OpenWRT多WAN情況下 數據包哪裏進哪裏出

, 2020年05月15日 , Linux , 评论 在〈OpenWRT多WAN情況下 數據包哪裏進哪裏出〉中留言功能已關閉 ,

#電信
>vi /etc/ppp/ip-up.d/ctc
#!/bin/sh
ip route flush table 220
ip route add default dev pppoe-wan table 220
ip rule add fwmark 220 table 220
exit 0
#移動
>vi /etc/ppp/ip-up.d/cmcc
#!/bin/sh
ip route flush table 250
ip route add default dev pppoe-wan2 table 250
ip rule add fwmark 250 table 250
exit 0

2.分流腳本

>vi /root/swan.sh
#!/bin/sh
#預留網段
ipset -! -R <<-EOF || return 1
    create LOCAL_RULES hash:net hashsize 64 maxelem 25
    add LOCAL_RULES 0.0.0.0/8
    add LOCAL_RULES 10.0.0.0/8
    add LOCAL_RULES 100.64.0.0/10
    add LOCAL_RULES 127.0.0.0/8
    add LOCAL_RULES 169.254.0.0/16
    add LOCAL_RULES 172.16.0.0/12
    add LOCAL_RULES 192.0.0.0/24
    add LOCAL_RULES 192.0.2.0/24
    add LOCAL_RULES 192.31.196.0/24
    add LOCAL_RULES 192.52.193.0/24
    add LOCAL_RULES 192.88.99.0/24
    add LOCAL_RULES 192.168.0.0/16
    add LOCAL_RULES 192.175.48.0/24
    add LOCAL_RULES 198.18.0.0/15
    add LOCAL_RULES 198.51.100.0/24
    add LOCAL_RULES 203.0.113.0/24
    add LOCAL_RULES 224.0.0.0/4
    add LOCAL_RULES 240.0.0.0/4
    add LOCAL_RULES 255.255.255.255
EOF
#初始化HASH表
ipset destroy CTC_SRC
ipset create CTC_SRC hash:ip hashsize 64 maxelem 655350
ipset destroy CMCC_SRC
ipset create CMCC_SRC hash:ip hashsize 64 maxelem 655350
#進行日志輸出
uci set system.@system[0].log_file='/var/log/syslog'
uci set system.@system[0].log_remote='0'
uci commit
/etc/init.d/log reload
iptables -t mangle -N SWANLOG
iptables -t mangle -A SWANLOG -i pppoe-wan -m set --match-set CTC_SRC src -j RETURN
iptables -t mangle -A SWANLOG -i pppoe-wan -j LOG --log-prefix="CTC "
iptables -t mangle -A SWANLOG -i pppoe-wan2 -m set --match-set CMCC_SRC src -j RETURN
iptables -t mangle -A SWANLOG -i pppoe-wan2 -j LOG --log-prefix="CMCC "
iptables -t mangle -I INPUT -j SWANLOG
#根據日志進行HASH表設置
nohup tail -fn0 /var/log/syslog |grep "CTC " |grep -E -o "SRC=[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+"| awk -F '=' '{system("ipset add CTC_SRC "$2)}{system("ipset del CMCC_SRC "$2)}' > /dev/null 2>&1 &
nohup tail -fn0 /var/log/syslog |grep "CMCC " |grep -E -o "SRC=[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+"| awk -F '=' '{system("ipset add CMCC_SRC "$2)}{system("ipset del CTC_SRC "$2)}' > /dev/null 2>&1 &
#根據HASH表對出局數據表打標
iptables -t mangle -N SWANMARK
iptables -t mangle -A SWANMARK -m set --match-set LOCAL_RULES dst -j RETURN
iptables -t mangle -A SWANMARK -m set --match-set CTC_SRC dst -j MARK --set-mark 220
iptables -t mangle -A SWANMARK -m set --match-set CMCC_SRC dst -j MARK --set-mark 250
#對路由本設備進行出局打標
iptables -t mangle -I OUTPUT -j SWANMARK
#對路由子設備進行路由打標
#iptables -t mangle -I PREROUTING -j SWANMARK