transparent DNS proxy
This commit is contained in:
garywill
garywill
parent
0f498e043d
commit
e5e1c96a53
24
README.md
24
README.md
|
|
@ -4,6 +4,8 @@ Set Linux as router in one command. Able to Provide Internet, or create Wifi hot
|
|||
|
||||
It wraps `iptables`, `dnsmasq` etc. stuff. Use in one command, restore in one command or by `control-c`.
|
||||
|
||||
[Buy me a coffee](https://github.com/garywill/receiving/blob/master/receiving_methods.md)
|
||||
|
||||
## Features
|
||||
|
||||
Basic features:
|
||||
|
|
@ -211,11 +213,11 @@ Options:
|
|||
(Note using this with default DNS option may leak
|
||||
queries to other interfaces)
|
||||
-n Do not provide Internet
|
||||
|
||||
|
||||
-g <ip> Set this host's IPv4 address, netmask is 24
|
||||
-6 Enable IPv6 (NAT)
|
||||
--p6 <prefix> Set IPv6 prefix (length 64)
|
||||
|
||||
--p6 <prefix> Set IPv6 prefix (length 64) (example: fd00:1:2:3::)
|
||||
|
||||
--dns <ip>|<port>|<ip:port>
|
||||
DNS server's upstream DNS.
|
||||
Use ',' to seperate multiple servers
|
||||
|
|
@ -223,6 +225,8 @@ Options:
|
|||
(Note IPv6 addresses need '[]' around)
|
||||
--no-dns Do not serve DNS
|
||||
--no-dnsmasq Disable dnsmasq server (DHCP, DNS, RA)
|
||||
--catch-dns Transparent DNS proxy, redirect packets(TCP/UDP)
|
||||
that destination port is 53 to this host
|
||||
--log-dns Show DNS query log
|
||||
--dhcp-dns <IP1[,IP2]>|no
|
||||
Set IPv4 DNS offered by DHCP (default: this host)
|
||||
|
|
@ -235,18 +239,18 @@ Options:
|
|||
-d DNS server will take into account /etc/hosts
|
||||
-e <hosts_file> DNS server will take into account additional
|
||||
hosts file
|
||||
|
||||
|
||||
--mac <MAC> Set MAC address
|
||||
|
||||
|
||||
--tp <port> Transparent proxy,
|
||||
redirect non-LAN tcp and udp traffic to port.
|
||||
redirect non-LAN TCP and UDP traffic to port.
|
||||
Usually used with '--dns'
|
||||
|
||||
|
||||
Wifi hotspot options:
|
||||
--ap <wifi interface> <SSID>
|
||||
Create Wifi access point
|
||||
--password <password> Wifi password
|
||||
|
||||
|
||||
--hidden Hide access point (not broadcast SSID)
|
||||
--no-virt Do not create virtual interface
|
||||
Using this you can't use same wlan interface
|
||||
|
|
@ -265,12 +269,12 @@ Options:
|
|||
(defaults to /etc/hostapd/hostapd.accept)
|
||||
--hostapd-debug <level> 1 or 2. Passes -d or -dd to hostapd
|
||||
--isolate-clients Disable wifi communication between clients
|
||||
|
||||
|
||||
--ieee80211n Enable IEEE 802.11n (HT)
|
||||
--ieee80211ac Enable IEEE 802.11ac (VHT)
|
||||
--ht_capab <HT> HT capabilities (default: [HT40+])
|
||||
--vht_capab <VHT> VHT capabilities
|
||||
|
||||
|
||||
--no-haveged Do not run haveged automatically when needed
|
||||
|
||||
Instance managing:
|
||||
|
|
|
|||
33
lnxrouter
33
lnxrouter
|
|
@ -37,6 +37,8 @@ Options:
|
|||
(Note IPv6 addresses need '[]' around)
|
||||
--no-dns Do not serve DNS
|
||||
--no-dnsmasq Disable dnsmasq server (DHCP, DNS, RA)
|
||||
--catch-dns Transparent DNS proxy, redirect packets(TCP/UDP)
|
||||
that destination port is 53 to this host
|
||||
--log-dns Show DNS query log
|
||||
--dhcp-dns <IP1[,IP2]>|no
|
||||
Set IPv4 DNS offered by DHCP (default: this host)
|
||||
|
|
@ -53,7 +55,7 @@ Options:
|
|||
--mac <MAC> Set MAC address
|
||||
|
||||
--tp <port> Transparent proxy,
|
||||
redirect non-LAN tcp and udp traffic to port.
|
||||
redirect non-LAN TCP and UDP traffic to port.
|
||||
Usually used with '--dns'
|
||||
|
||||
Wifi hotspot options:
|
||||
|
|
@ -118,6 +120,7 @@ DHCP_DNS=gateway
|
|||
DHCP_DNS6=gateway
|
||||
dnsmasq_NO_DNS=0
|
||||
NO_DNSMASQ=0
|
||||
CATCH_DNS=0
|
||||
SHOW_DNS_QUERY=0
|
||||
ETC_HOSTS=0
|
||||
ADDN_HOSTS=
|
||||
|
|
@ -236,6 +239,10 @@ while [[ -n "$1" ]]; do
|
|||
DHCP_DNS6="$1"
|
||||
shift
|
||||
;;
|
||||
--catch-dns)
|
||||
shift
|
||||
CATCH_DNS=1
|
||||
;;
|
||||
--log-dns)
|
||||
shift
|
||||
SHOW_DNS_QUERY=1
|
||||
|
|
@ -753,6 +760,26 @@ unallow_dns_port() {
|
|||
fi
|
||||
}
|
||||
|
||||
start_catch_dns() {
|
||||
echo
|
||||
echo "iptables: redirect all TCP/UDP packet that destination port is 53"
|
||||
iptables_ -v -t nat -I PREROUTING -i ${SUBNET_IFACE} ! -d ${GATEWAY} -p udp -m udp --dport 53 -j REDIRECT --to-ports 53 || die
|
||||
iptables_ -v -t nat -I PREROUTING -i ${SUBNET_IFACE} ! -d ${GATEWAY} -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53 || die
|
||||
if [[ $IPV6 -eq 1 ]]; then
|
||||
ip6tables_ -v -t nat -I PREROUTING -i ${SUBNET_IFACE} ! -d ${GATEWAY6} -p udp -m udp --dport 53 -j REDIRECT --to-ports 53 || die
|
||||
ip6tables_ -v -t nat -I PREROUTING -i ${SUBNET_IFACE} ! -d ${GATEWAY6} -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53 || die
|
||||
fi
|
||||
}
|
||||
stop_catch_dns() {
|
||||
echo "iptables: stop redirecting DNS queries"
|
||||
iptables_ -t nat -D PREROUTING -i ${SUBNET_IFACE} ! -d ${GATEWAY} -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
|
||||
iptables_ -t nat -D PREROUTING -i ${SUBNET_IFACE} ! -d ${GATEWAY} -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
|
||||
if [[ $IPV6 -eq 1 ]]; then
|
||||
ip6tables_ -t nat -D PREROUTING -i ${SUBNET_IFACE} ! -d ${GATEWAY6} -p udp -m udp --dport 53 -j REDIRECT --to-ports 53
|
||||
ip6tables_ -t nat -D PREROUTING -i ${SUBNET_IFACE} ! -d ${GATEWAY6} -p tcp -m tcp --dport 53 -j REDIRECT --to-ports 53
|
||||
fi
|
||||
}
|
||||
|
||||
start_dhcp() {
|
||||
echo
|
||||
echo "iptables: allow DHCP port access"
|
||||
|
|
@ -892,6 +919,8 @@ clean_iptables() {
|
|||
unallow_dns_port
|
||||
fi
|
||||
|
||||
[[ "$CATCH_DNS" -eq 1 ]] && stop_catch_dns
|
||||
|
||||
|
||||
if [[ $NO_DNSMASQ -eq 0 ]]; then
|
||||
stop_dhcp
|
||||
|
|
@ -1591,6 +1620,8 @@ if [[ "$DHCP_DNS" == "gateway" || "$DHCP_DNS6" == "gateway" ]]; then
|
|||
allow_dns_port
|
||||
fi
|
||||
|
||||
[[ "$CATCH_DNS" -eq 1 ]] && start_catch_dns
|
||||
|
||||
|
||||
if [[ $NO_DNSMASQ -eq 0 ]]; then
|
||||
start_dhcp
|
||||
|
|
|
|||
Loading…
Reference in New Issue