# 面：防火墙（fw_start.sh → fw_iptables / fw_nftables；fw_stop.sh）在桩下打出的命令，按调用顺序
## iptables Redir fake-ip 局域网（梅林首装默认）
### 命令序列（fw_start.sh）
iptables -h
ip6tables -h
iptables -w -I INPUT -p tcp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -I INPUT -p tcp -m multiport --dports 7890,9999 -j REJECT
iptables -w -I INPUT -p udp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -I INPUT -p udp -m multiport --dports 7890,9999 -j REJECT
iptables -w -I INPUT -s 10.0.2.0/24 -j ACCEPT
iptables -w -I INPUT -s 192.168.50.0/24 -j ACCEPT
iptables -w -I INPUT -s 192.168.101.0/24 -j ACCEPT
ip6tables -w -I INPUT -s fe80::/10 -j ACCEPT
ip6tables -w -I INPUT -s fd00::/8 -j ACCEPT
iptables -w -N kjx_guard
iptables -w -F kjx_guard
iptables -w -A kjx_guard -i eth0 -p tcp -m multiport --dports 7890,9999 -j REJECT
iptables -w -A kjx_guard -i eth0 -p udp -m multiport --dports 7890,9999 -j REJECT
iptables -w -A kjx_guard ! -i br0 -p tcp --dport 9999 -j REJECT
iptables -w -A kjx_guard ! -i br0 -p udp --dport 9999 -j REJECT
iptables -w -D INPUT -j kjx_guard
iptables -w -I INPUT -j kjx_guard
ip6tables -w -N kjx_guard
ip6tables -w -F kjx_guard
ip6tables -w -A kjx_guard -i eth0 -p tcp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -A kjx_guard -i eth0 -p udp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -A kjx_guard ! -i br0 -p tcp --dport 9999 -j REJECT
ip6tables -w -A kjx_guard ! -i br0 -p udp --dport 9999 -j REJECT
ip6tables -w -D INPUT -j kjx_guard
ip6tables -w -I INPUT -j kjx_guard
iptables -w -I INPUT -i lo -j ACCEPT
ip6tables -w -I INPUT -i lo -j ACCEPT
iptables -h
iptables -w -t nat -N shellcrash
iptables -w -t nat -A shellcrash -p tcp --dport 53 -j RETURN
iptables -w -t nat -A shellcrash -p udp --dport 53 -j RETURN
iptables -w -t nat -A shellcrash -m mark --mark 7894 -j RETURN
iptables -w -t nat -A shellcrash -d 10.0.2.0/24 -j RETURN
iptables -w -t nat -A shellcrash -d 192.168.50.0/24 -j RETURN
iptables -w -t nat -A shellcrash -d 192.168.101.0/24 -j RETURN
iptables -w -t nat -A shellcrash -d 0.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash -d 10.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash -d 127.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash -d 100.64.0.0/10 -j RETURN
iptables -w -t nat -A shellcrash -d 169.254.0.0/16 -j RETURN
iptables -w -t nat -A shellcrash -d 172.16.0.0/12 -j RETURN
iptables -w -t nat -A shellcrash -d 192.168.0.0/16 -j RETURN
iptables -w -t nat -A shellcrash -d 224.0.0.0/4 -j RETURN
iptables -w -t nat -A shellcrash -d 240.0.0.0/4 -j RETURN
iptables -w -t nat -A shellcrash -p tcp -s 10.0.2.0/24 -j REDIRECT --to-ports 7892
iptables -w -t nat -A shellcrash -p tcp -s 192.168.50.0/24 -j REDIRECT --to-ports 7892
iptables -w -t nat -A shellcrash -p tcp -s 192.168.101.0/24 -j REDIRECT --to-ports 7892
iptables -w -t nat -I PREROUTING -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrash
iptables -w -t nat -I PREROUTING -p tcp -d 198.18.0.0/15 -j shellcrash
iptables -h
iptables -w -t nat -N shellcrash_dns
iptables -w -t nat -A shellcrash_dns -m mark --mark 7894 -j RETURN
iptables -w -t nat -A shellcrash_dns -p tcp -s 10.0.2.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 10.0.2.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p tcp -s 192.168.50.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 192.168.50.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p tcp -s 192.168.101.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 192.168.101.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -I PREROUTING -p tcp --dport 53 -j shellcrash_dns
iptables -w -t nat -I PREROUTING -p udp --dport 53 -j shellcrash_dns
ip6tables -w -j REDIRECT -h
ip6tables -h
ip6tables -w -t nat -N shellcrashv6_dns
ip6tables -w -t nat -A shellcrashv6_dns -m mark --mark 7894 -j RETURN
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -s fe80::/10 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p udp -s fe80::/10 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -s fd00::/8 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p udp -s fd00::/8 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -j RETURN
ip6tables -w -t nat -A shellcrashv6_dns -p udp -j RETURN
ip6tables -w -t nat -I PREROUTING -p tcp --dport 53 -j shellcrashv6_dns
ip6tables -w -t nat -I PREROUTING -p udp --dport 53 -j shellcrashv6_dns
### 改根后的 resolv.conf
# mode 644
nameserver 10.0.2.2
### 命令序列（fw_stop.sh）
iptables -h
iptables -w -t nat -D PREROUTING -p tcp --dport 53 -j shellcrash_dns
iptables -w -t nat -D PREROUTING -p udp --dport 53 -j shellcrash_dns
iptables -w -t nat -D OUTPUT -p udp --dport 53 -j shellcrash_dns_out
iptables -w -t nat -D OUTPUT -p tcp --dport 53 -j shellcrash_dns_out
iptables -w -t nat -D PREROUTING -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrash
iptables -w -t nat -D OUTPUT -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrash_out
iptables -w -t nat -D PREROUTING -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrash_vm
iptables -w -t mangle -D PREROUTING -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrash_mark
iptables -w -t mangle -D PREROUTING -p udp -m multiport --dports 22,80,443,8080,8443 -j shellcrash_mark
iptables -w -t mangle -D OUTPUT -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrash_mark_out
iptables -w -t mangle -D OUTPUT -p udp -m multiport --dports 22,80,443,8080,8443 -j shellcrash_mark_out
iptables -w -t nat -D PREROUTING -p tcp -d 198.18.0.0/15 -j shellcrash
iptables -w -t nat -D OUTPUT -p tcp -d 198.18.0.0/15 -j shellcrash_out
iptables -w -t nat -D PREROUTING -p tcp --dport 53 -j shellcrash_vm_dns
iptables -w -t nat -D PREROUTING -p udp --dport 53 -j shellcrash_vm_dns
iptables -w -t nat -D PREROUTING -p tcp -d 198.18.0.0/15 -j shellcrash_vm
iptables -w -t mangle -D PREROUTING -p tcp -d 198.18.0.0/15 -j shellcrash_mark
iptables -w -t mangle -D PREROUTING -p udp -d 198.18.0.0/15 -j shellcrash_mark
iptables -w -t mangle -D OUTPUT -p tcp -d 198.18.0.0/15 -j shellcrash_mark_out
iptables -w -t mangle -D OUTPUT -p udp -d 198.18.0.0/15 -j shellcrash_mark_out
iptables -w -t mangle -D PREROUTING -m mark --mark 7892 -p tcp -j TPROXY --on-port 7893
iptables -w -t mangle -D PREROUTING -m mark --mark 7892 -p udp -j TPROXY --on-port 7893
iptables -w -D FORWARD -o utun -j ACCEPT
iptables -w -D INPUT -p udp --dport 443 -j REJECT
iptables -w -D FORWARD -p udp --dport 443 -o utun -j REJECT
iptables -w -D INPUT -j kjx_guard
iptables -w -F kjx_guard
iptables -w -X kjx_guard
iptables -w -D INPUT -i lo -j ACCEPT
iptables -w -D INPUT -s 10.0.2.0/24 -j ACCEPT
iptables -w -D INPUT -s 192.168.50.0/24 -j ACCEPT
iptables -w -D INPUT -s 192.168.101.0/24 -j ACCEPT
iptables -w -D INPUT -p tcp -m multiport --dports  -j ACCEPT
iptables -w -D INPUT -p udp -m multiport --dports  -j ACCEPT
iptables -w -D INPUT -p tcp -m multiport --dports 7890,9999 -j REJECT
iptables -w -D INPUT -p udp -m multiport --dports 7890,9999 -j REJECT
iptables -w -t nat -F shellcrash_dns
iptables -w -t nat -X shellcrash_dns
iptables -w -t nat -F shellcrash
iptables -w -t nat -X shellcrash
iptables -w -t nat -F shellcrash_out
iptables -w -t nat -X shellcrash_out
iptables -w -t nat -F shellcrash_dns_out
iptables -w -t nat -X shellcrash_dns_out
iptables -w -t nat -F shellcrash_vm
iptables -w -t nat -X shellcrash_vm
iptables -w -t nat -F shellcrash_vm_dns
iptables -w -t nat -X shellcrash_vm_dns
iptables -w -t mangle -F shellcrash_mark
iptables -w -t mangle -X shellcrash_mark
iptables -w -t mangle -F shellcrash_mark_out
iptables -w -t mangle -X shellcrash_mark_out
ip6tables -h
ip6tables -w -t nat -D PREROUTING -p tcp --dport 53 -j shellcrashv6_dns
ip6tables -w -t nat -D PREROUTING -p udp --dport 53 -j shellcrashv6_dns
ip6tables -w -t nat -D PREROUTING -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrashv6
ip6tables -w -t nat -D OUTPUT -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrashv6_out
ip6tables -w -t mangle -D PREROUTING -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrashv6_mark
ip6tables -w -t mangle -D PREROUTING -p udp -m multiport --dports 22,80,443,8080,8443 -j shellcrashv6_mark
ip6tables -w -t mangle -D OUTPUT -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrashv6_mark_out
ip6tables -w -t mangle -D OUTPUT -p udp -m multiport --dports 22,80,443,8080,8443 -j shellcrashv6_mark_out
ip6tables -w -t nat -D PREROUTING -p tcp -d fc00::/16 -j shellcrashv6
ip6tables -w -t nat -D OUTPUT -p tcp -d fc00::/16 -j shellcrashv6_out
ip6tables -w -D INPUT -p tcp --dport 53 -j REJECT
ip6tables -w -D INPUT -p udp --dport 53 -j REJECT
ip6tables -w -t mangle -D PREROUTING -p tcp -d fc00::/16 -j shellcrashv6_mark
ip6tables -w -t mangle -D PREROUTING -p udp -d fc00::/16 -j shellcrashv6_mark
ip6tables -w -t mangle -D OUTPUT -p tcp -d fc00::/16 -j shellcrashv6_mark_out
ip6tables -w -t mangle -D OUTPUT -p udp -d fc00::/16 -j shellcrashv6_mark_out
ip6tables -w -D INPUT -p udp --dport 443 -j REJECT
ip6tables -w -t mangle -D PREROUTING -m mark --mark 7892 -p tcp -j TPROXY --on-port 7893
ip6tables -w -t mangle -D PREROUTING -m mark --mark 7892 -p udp -j TPROXY --on-port 7893
ip6tables -w -D FORWARD -o utun -j ACCEPT
ip6tables -w -D INPUT -p udp --dport 443 -j REJECT
ip6tables -w -D FORWARD -p udp --dport 443 -o utun -j REJECT
ip6tables -w -D INPUT -j kjx_guard
ip6tables -w -F kjx_guard
ip6tables -w -X kjx_guard
ip6tables -w -D INPUT -i lo -j ACCEPT
ip6tables -w -D INPUT -s fe80::/10 -j ACCEPT
ip6tables -w -D INPUT -s fd00::/8 -j ACCEPT
ip6tables -w -D INPUT -p tcp -m multiport --dports  -j ACCEPT
ip6tables -w -D INPUT -p udp -m multiport --dports  -j ACCEPT
ip6tables -w -D INPUT -p tcp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -D INPUT -p udp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -t nat -F shellcrashv6_dns
ip6tables -w -t nat -X shellcrashv6_dns
ip6tables -w -t nat -F shellcrashv6
ip6tables -w -t nat -X shellcrashv6
ip6tables -w -t nat -F shellcrashv6_out
ip6tables -w -t nat -X shellcrashv6_out
ip6tables -w -t mangle -F shellcrashv6_mark
ip6tables -w -t mangle -X shellcrashv6_mark
ip6tables -w -t mangle -F shellcrashv6_mark_out
ip6tables -w -t mangle -X shellcrashv6_mark_out
ip6tables -w -t mangle -F shellcrashv6_mark
ip6tables -w -t mangle -X shellcrashv6_mark
ipset destroy cn_ip
ipset destroy cn_ip6
ip rule del fwmark 7892 table 100
ip route flush table 100
ip -6 rule del fwmark 7892 table 101
ip -6 route flush table 101
nft delete table inet shellcrash
### 输出
## iptables Redir + IPv6
### 命令序列（fw_start.sh）
iptables -h
ip6tables -h
iptables -w -I INPUT -p tcp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -I INPUT -p tcp -m multiport --dports 7890,9999 -j REJECT
iptables -w -I INPUT -p udp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -I INPUT -p udp -m multiport --dports 7890,9999 -j REJECT
iptables -w -I INPUT -s 10.0.2.0/24 -j ACCEPT
iptables -w -I INPUT -s 192.168.50.0/24 -j ACCEPT
iptables -w -I INPUT -s 192.168.101.0/24 -j ACCEPT
ip6tables -w -I INPUT -s fe80::/10 -j ACCEPT
ip6tables -w -I INPUT -s fd00::/8 -j ACCEPT
ip6tables -w -I INPUT -s 2001:db8:50::1/64 -j ACCEPT
iptables -w -N kjx_guard
iptables -w -F kjx_guard
iptables -w -A kjx_guard -i eth0 -p tcp -m multiport --dports 7890,9999 -j REJECT
iptables -w -A kjx_guard -i eth0 -p udp -m multiport --dports 7890,9999 -j REJECT
iptables -w -A kjx_guard ! -i br0 -p tcp --dport 9999 -j REJECT
iptables -w -A kjx_guard ! -i br0 -p udp --dport 9999 -j REJECT
iptables -w -D INPUT -j kjx_guard
iptables -w -I INPUT -j kjx_guard
ip6tables -w -N kjx_guard
ip6tables -w -F kjx_guard
ip6tables -w -A kjx_guard -i eth0 -p tcp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -A kjx_guard -i eth0 -p udp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -A kjx_guard ! -i br0 -p tcp --dport 9999 -j REJECT
ip6tables -w -A kjx_guard ! -i br0 -p udp --dport 9999 -j REJECT
ip6tables -w -D INPUT -j kjx_guard
ip6tables -w -I INPUT -j kjx_guard
iptables -w -I INPUT -i lo -j ACCEPT
ip6tables -w -I INPUT -i lo -j ACCEPT
iptables -h
iptables -w -t nat -N shellcrash
iptables -w -t nat -A shellcrash -p tcp --dport 53 -j RETURN
iptables -w -t nat -A shellcrash -p udp --dport 53 -j RETURN
iptables -w -t nat -A shellcrash -m mark --mark 7894 -j RETURN
iptables -w -t nat -A shellcrash -d 10.0.2.0/24 -j RETURN
iptables -w -t nat -A shellcrash -d 192.168.50.0/24 -j RETURN
iptables -w -t nat -A shellcrash -d 192.168.101.0/24 -j RETURN
iptables -w -t nat -A shellcrash -d 0.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash -d 10.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash -d 127.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash -d 100.64.0.0/10 -j RETURN
iptables -w -t nat -A shellcrash -d 169.254.0.0/16 -j RETURN
iptables -w -t nat -A shellcrash -d 172.16.0.0/12 -j RETURN
iptables -w -t nat -A shellcrash -d 192.168.0.0/16 -j RETURN
iptables -w -t nat -A shellcrash -d 224.0.0.0/4 -j RETURN
iptables -w -t nat -A shellcrash -d 240.0.0.0/4 -j RETURN
iptables -w -t nat -A shellcrash -p tcp -s 10.0.2.0/24 -j REDIRECT --to-ports 7892
iptables -w -t nat -A shellcrash -p tcp -s 192.168.50.0/24 -j REDIRECT --to-ports 7892
iptables -w -t nat -A shellcrash -p tcp -s 192.168.101.0/24 -j REDIRECT --to-ports 7892
iptables -w -t nat -I PREROUTING -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrash
iptables -w -t nat -I PREROUTING -p tcp -d 198.18.0.0/15 -j shellcrash
ip6tables -w -j REDIRECT -h
ip6tables -h
ip6tables -w -t nat -N shellcrashv6
ip6tables -w -t nat -A shellcrashv6 -p tcp --dport 53 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -p udp --dport 53 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -m mark --mark 7894 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d fe80::/10 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d fd00::/8 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d 2001:db8:50::1/64 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d ::/128 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d ::1/128 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d ::ffff:0:0/96 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d 64:ff9b::/96 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d 100::/64 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d 2001::/32 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d 2001:20::/28 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d 2001:db8::/32 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d 2002::/16 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d fe80::/10 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -d ff00::/8 -j RETURN
ip6tables -w -t nat -A shellcrashv6 -p tcp -s fe80::/10 -j REDIRECT --to-ports 7892
ip6tables -w -t nat -A shellcrashv6 -p tcp -s fd00::/8 -j REDIRECT --to-ports 7892
ip6tables -w -t nat -A shellcrashv6 -p tcp -s 2001:db8:50::1/64 -j REDIRECT --to-ports 7892
ip6tables -w -t nat -I PREROUTING -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrashv6
ip6tables -w -t nat -I PREROUTING -p tcp -d fc00::/16 -j shellcrashv6
iptables -h
iptables -w -t nat -N shellcrash_dns
iptables -w -t nat -A shellcrash_dns -m mark --mark 7894 -j RETURN
iptables -w -t nat -A shellcrash_dns -p tcp -s 10.0.2.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 10.0.2.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p tcp -s 192.168.50.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 192.168.50.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p tcp -s 192.168.101.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 192.168.101.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -I PREROUTING -p tcp --dport 53 -j shellcrash_dns
iptables -w -t nat -I PREROUTING -p udp --dport 53 -j shellcrash_dns
ip6tables -w -j REDIRECT -h
ip6tables -h
ip6tables -w -t nat -N shellcrashv6_dns
ip6tables -w -t nat -A shellcrashv6_dns -m mark --mark 7894 -j RETURN
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -s fe80::/10 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p udp -s fe80::/10 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -s fd00::/8 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p udp -s fd00::/8 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -s 2001:db8:50::1/64 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p udp -s 2001:db8:50::1/64 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -j RETURN
ip6tables -w -t nat -A shellcrashv6_dns -p udp -j RETURN
ip6tables -w -t nat -I PREROUTING -p tcp --dport 53 -j shellcrashv6_dns
ip6tables -w -t nat -I PREROUTING -p udp --dport 53 -j shellcrashv6_dns
### 改根后的 resolv.conf
# mode 644
nameserver 10.0.2.2
### 输出
## iptables Tproxy
### 命令序列（fw_start.sh）
ip route add local default dev lo table 100
ip rule add fwmark 7892 table 100
iptables -h
ip6tables -h
iptables -w -I INPUT -p tcp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -I INPUT -p tcp -m multiport --dports 7890,9999 -j REJECT
iptables -w -I INPUT -p udp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -I INPUT -p udp -m multiport --dports 7890,9999 -j REJECT
iptables -w -I INPUT -s 10.0.2.0/24 -j ACCEPT
iptables -w -I INPUT -s 192.168.50.0/24 -j ACCEPT
iptables -w -I INPUT -s 192.168.101.0/24 -j ACCEPT
ip6tables -w -I INPUT -s fe80::/10 -j ACCEPT
ip6tables -w -I INPUT -s fd00::/8 -j ACCEPT
iptables -w -N kjx_guard
iptables -w -F kjx_guard
iptables -w -A kjx_guard -i eth0 -p tcp -m multiport --dports 7890,9999 -j REJECT
iptables -w -A kjx_guard -i eth0 -p udp -m multiport --dports 7890,9999 -j REJECT
iptables -w -A kjx_guard ! -i br0 -p tcp --dport 9999 -j REJECT
iptables -w -A kjx_guard ! -i br0 -p udp --dport 9999 -j REJECT
iptables -w -D INPUT -j kjx_guard
iptables -w -I INPUT -j kjx_guard
ip6tables -w -N kjx_guard
ip6tables -w -F kjx_guard
ip6tables -w -A kjx_guard -i eth0 -p tcp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -A kjx_guard -i eth0 -p udp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -A kjx_guard ! -i br0 -p tcp --dport 9999 -j REJECT
ip6tables -w -A kjx_guard ! -i br0 -p udp --dport 9999 -j REJECT
ip6tables -w -D INPUT -j kjx_guard
ip6tables -w -I INPUT -j kjx_guard
iptables -w -I INPUT -i lo -j ACCEPT
ip6tables -w -I INPUT -i lo -j ACCEPT
iptables -w -j TPROXY -h
iptables -h
iptables -w -t mangle -N shellcrash_mark
iptables -w -t mangle -A shellcrash_mark -p tcp --dport 53 -j RETURN
iptables -w -t mangle -A shellcrash_mark -p udp --dport 53 -j RETURN
iptables -w -t mangle -A shellcrash_mark -m mark --mark 7894 -j RETURN
iptables -w -t mangle -A shellcrash_mark -d 10.0.2.0/24 -j RETURN
iptables -w -t mangle -A shellcrash_mark -d 192.168.50.0/24 -j RETURN
iptables -w -t mangle -A shellcrash_mark -d 192.168.101.0/24 -j RETURN
iptables -w -t mangle -A shellcrash_mark -d 0.0.0.0/8 -j RETURN
iptables -w -t mangle -A shellcrash_mark -d 10.0.0.0/8 -j RETURN
iptables -w -t mangle -A shellcrash_mark -d 127.0.0.0/8 -j RETURN
iptables -w -t mangle -A shellcrash_mark -d 100.64.0.0/10 -j RETURN
iptables -w -t mangle -A shellcrash_mark -d 169.254.0.0/16 -j RETURN
iptables -w -t mangle -A shellcrash_mark -d 172.16.0.0/12 -j RETURN
iptables -w -t mangle -A shellcrash_mark -d 192.168.0.0/16 -j RETURN
iptables -w -t mangle -A shellcrash_mark -d 224.0.0.0/4 -j RETURN
iptables -w -t mangle -A shellcrash_mark -d 240.0.0.0/4 -j RETURN
iptables -w -t mangle -A shellcrash_mark -p tcp -s 10.0.2.0/24 -j TPROXY --on-port 7893 --tproxy-mark 7892
iptables -w -t mangle -A shellcrash_mark -p tcp -s 192.168.50.0/24 -j TPROXY --on-port 7893 --tproxy-mark 7892
iptables -w -t mangle -A shellcrash_mark -p tcp -s 192.168.101.0/24 -j TPROXY --on-port 7893 --tproxy-mark 7892
iptables -w -t mangle -I PREROUTING -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrash_mark
iptables -w -t mangle -I PREROUTING -p tcp -d 198.18.0.0/15 -j shellcrash_mark
iptables -w -t mangle -A shellcrash_mark -p udp -s 10.0.2.0/24 -j TPROXY --on-port 7893 --tproxy-mark 7892
iptables -w -t mangle -A shellcrash_mark -p udp -s 192.168.50.0/24 -j TPROXY --on-port 7893 --tproxy-mark 7892
iptables -w -t mangle -A shellcrash_mark -p udp -s 192.168.101.0/24 -j TPROXY --on-port 7893 --tproxy-mark 7892
iptables -w -t mangle -I PREROUTING -p udp -m multiport --dports 22,80,443,8080,8443 -j shellcrash_mark
iptables -w -t mangle -I PREROUTING -p udp -d 198.18.0.0/15 -j shellcrash_mark
iptables -h
iptables -w -t nat -N shellcrash_dns
iptables -w -t nat -A shellcrash_dns -m mark --mark 7894 -j RETURN
iptables -w -t nat -A shellcrash_dns -p tcp -s 10.0.2.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 10.0.2.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p tcp -s 192.168.50.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 192.168.50.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p tcp -s 192.168.101.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 192.168.101.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -I PREROUTING -p tcp --dport 53 -j shellcrash_dns
iptables -w -t nat -I PREROUTING -p udp --dport 53 -j shellcrash_dns
ip6tables -w -j REDIRECT -h
ip6tables -h
ip6tables -w -t nat -N shellcrashv6_dns
ip6tables -w -t nat -A shellcrashv6_dns -m mark --mark 7894 -j RETURN
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -s fe80::/10 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p udp -s fe80::/10 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -s fd00::/8 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p udp -s fd00::/8 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -j RETURN
ip6tables -w -t nat -A shellcrashv6_dns -p udp -j RETURN
ip6tables -w -t nat -I PREROUTING -p tcp --dport 53 -j shellcrashv6_dns
ip6tables -w -t nat -I PREROUTING -p udp --dport 53 -j shellcrashv6_dns
### 改根后的 resolv.conf
# mode 644
nameserver 10.0.2.2
### 输出
## iptables Redir 本机+局域网（firewall_area=3）
### 命令序列（fw_start.sh）
iptables -h
ip6tables -h
iptables -w -I INPUT -p tcp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -I INPUT -p tcp -m multiport --dports 7890,9999 -j REJECT
iptables -w -I INPUT -p udp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -I INPUT -p udp -m multiport --dports 7890,9999 -j REJECT
iptables -w -I INPUT -s 10.0.2.0/24 -j ACCEPT
iptables -w -I INPUT -s 192.168.50.0/24 -j ACCEPT
iptables -w -I INPUT -s 192.168.101.0/24 -j ACCEPT
ip6tables -w -I INPUT -s fe80::/10 -j ACCEPT
ip6tables -w -I INPUT -s fd00::/8 -j ACCEPT
iptables -w -N kjx_guard
iptables -w -F kjx_guard
iptables -w -A kjx_guard -i eth0 -p tcp -m multiport --dports 7890,9999 -j REJECT
iptables -w -A kjx_guard -i eth0 -p udp -m multiport --dports 7890,9999 -j REJECT
iptables -w -A kjx_guard ! -i br0 -p tcp --dport 9999 -j REJECT
iptables -w -A kjx_guard ! -i br0 -p udp --dport 9999 -j REJECT
iptables -w -D INPUT -j kjx_guard
iptables -w -I INPUT -j kjx_guard
ip6tables -w -N kjx_guard
ip6tables -w -F kjx_guard
ip6tables -w -A kjx_guard -i eth0 -p tcp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -A kjx_guard -i eth0 -p udp -m multiport --dports 7890,9999 -j REJECT
ip6tables -w -A kjx_guard ! -i br0 -p tcp --dport 9999 -j REJECT
ip6tables -w -A kjx_guard ! -i br0 -p udp --dport 9999 -j REJECT
ip6tables -w -D INPUT -j kjx_guard
ip6tables -w -I INPUT -j kjx_guard
iptables -w -I INPUT -i lo -j ACCEPT
ip6tables -w -I INPUT -i lo -j ACCEPT
iptables -h
iptables -w -t nat -N shellcrash
iptables -w -t nat -A shellcrash -p tcp --dport 53 -j RETURN
iptables -w -t nat -A shellcrash -p udp --dport 53 -j RETURN
iptables -w -t nat -A shellcrash -m mark --mark 7894 -j RETURN
iptables -w -t nat -A shellcrash -d 10.0.2.0/24 -j RETURN
iptables -w -t nat -A shellcrash -d 192.168.50.0/24 -j RETURN
iptables -w -t nat -A shellcrash -d 192.168.101.0/24 -j RETURN
iptables -w -t nat -A shellcrash -d 0.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash -d 10.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash -d 127.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash -d 100.64.0.0/10 -j RETURN
iptables -w -t nat -A shellcrash -d 169.254.0.0/16 -j RETURN
iptables -w -t nat -A shellcrash -d 172.16.0.0/12 -j RETURN
iptables -w -t nat -A shellcrash -d 192.168.0.0/16 -j RETURN
iptables -w -t nat -A shellcrash -d 224.0.0.0/4 -j RETURN
iptables -w -t nat -A shellcrash -d 240.0.0.0/4 -j RETURN
iptables -w -t nat -A shellcrash -p tcp -s 10.0.2.0/24 -j REDIRECT --to-ports 7892
iptables -w -t nat -A shellcrash -p tcp -s 192.168.50.0/24 -j REDIRECT --to-ports 7892
iptables -w -t nat -A shellcrash -p tcp -s 192.168.101.0/24 -j REDIRECT --to-ports 7892
iptables -w -t nat -I PREROUTING -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrash
iptables -w -t nat -I PREROUTING -p tcp -d 198.18.0.0/15 -j shellcrash
iptables -h
iptables -w -t nat -N shellcrash_out
iptables -w -t nat -A shellcrash_out -p tcp --dport 53 -j RETURN
iptables -w -t nat -A shellcrash_out -p udp --dport 53 -j RETURN
iptables -w -t nat -A shellcrash_out -m mark --mark 7894 -j RETURN
iptables -w -t nat -A shellcrash_out -m owner --gid-owner 453 -j RETURN
iptables -w -t nat -A shellcrash_out -m owner --gid-owner 7890 -j RETURN
iptables -w -t nat -A shellcrash_out -d 127.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash_out -d 10.0.2.15 -j RETURN
iptables -w -t nat -A shellcrash_out -d 192.168.50.1 -j RETURN
iptables -w -t nat -A shellcrash_out -d 0.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash_out -d 10.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash_out -d 127.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash_out -d 100.64.0.0/10 -j RETURN
iptables -w -t nat -A shellcrash_out -d 169.254.0.0/16 -j RETURN
iptables -w -t nat -A shellcrash_out -d 172.16.0.0/12 -j RETURN
iptables -w -t nat -A shellcrash_out -d 192.168.0.0/16 -j RETURN
iptables -w -t nat -A shellcrash_out -d 224.0.0.0/4 -j RETURN
iptables -w -t nat -A shellcrash_out -d 240.0.0.0/4 -j RETURN
iptables -w -t nat -A shellcrash_out -p tcp -s 127.0.0.0/8 -j REDIRECT --to-ports 7892
iptables -w -t nat -A shellcrash_out -p tcp -s 10.0.2.15 -j REDIRECT --to-ports 7892
iptables -w -t nat -A shellcrash_out -p tcp -s 192.168.50.1 -j REDIRECT --to-ports 7892
iptables -w -t nat -I OUTPUT -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrash_out
iptables -w -t nat -I OUTPUT -p tcp -d 198.18.0.0/15 -j shellcrash_out
iptables -h
iptables -w -t nat -N shellcrash_dns
iptables -w -t nat -A shellcrash_dns -m mark --mark 7894 -j RETURN
iptables -w -t nat -A shellcrash_dns -p tcp -s 10.0.2.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 10.0.2.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p tcp -s 192.168.50.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 192.168.50.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p tcp -s 192.168.101.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 192.168.101.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -I PREROUTING -p tcp --dport 53 -j shellcrash_dns
iptables -w -t nat -I PREROUTING -p udp --dport 53 -j shellcrash_dns
ip6tables -w -j REDIRECT -h
ip6tables -h
ip6tables -w -t nat -N shellcrashv6_dns
ip6tables -w -t nat -A shellcrashv6_dns -m mark --mark 7894 -j RETURN
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -s fe80::/10 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p udp -s fe80::/10 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -s fd00::/8 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p udp -s fd00::/8 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -j RETURN
ip6tables -w -t nat -A shellcrashv6_dns -p udp -j RETURN
ip6tables -w -t nat -I PREROUTING -p tcp --dport 53 -j shellcrashv6_dns
ip6tables -w -t nat -I PREROUTING -p udp --dport 53 -j shellcrashv6_dns
iptables -h
iptables -w -t nat -N shellcrash_dns_out
iptables -w -t nat -A shellcrash_dns_out -m mark --mark 7894 -j RETURN
iptables -w -t nat -A shellcrash_dns_out -m owner --gid-owner 453 -j RETURN
iptables -w -t nat -A shellcrash_dns_out -m owner --gid-owner 7890 -j RETURN
iptables -w -t nat -A shellcrash_dns_out -p tcp -s 127.0.0.0/8 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns_out -p udp -s 127.0.0.0/8 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns_out -p tcp -s 10.0.2.15 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns_out -p udp -s 10.0.2.15 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns_out -p tcp -s 192.168.50.1 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns_out -p udp -s 192.168.50.1 -j REDIRECT --to-ports 1053
iptables -w -t nat -I OUTPUT -p tcp --dport 53 -j shellcrash_dns_out
iptables -w -t nat -I OUTPUT -p udp --dport 53 -j shellcrash_dns_out
### 改根后的 resolv.conf
# mode 644
nameserver 127.0.0.1 #shellcrash-dns-repair
nameserver 10.0.2.2
### 输出
## iptables Redir mix DNS、公网防火墙关
### 命令序列（fw_start.sh）
iptables -h
ip6tables -h
iptables -h
iptables -w -t nat -N shellcrash
iptables -w -t nat -A shellcrash -p tcp --dport 53 -j RETURN
iptables -w -t nat -A shellcrash -p udp --dport 53 -j RETURN
iptables -w -t nat -A shellcrash -m mark --mark 7894 -j RETURN
iptables -w -t nat -A shellcrash -d 10.0.2.0/24 -j RETURN
iptables -w -t nat -A shellcrash -d 192.168.50.0/24 -j RETURN
iptables -w -t nat -A shellcrash -d 192.168.101.0/24 -j RETURN
iptables -w -t nat -A shellcrash -d 0.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash -d 10.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash -d 127.0.0.0/8 -j RETURN
iptables -w -t nat -A shellcrash -d 100.64.0.0/10 -j RETURN
iptables -w -t nat -A shellcrash -d 169.254.0.0/16 -j RETURN
iptables -w -t nat -A shellcrash -d 172.16.0.0/12 -j RETURN
iptables -w -t nat -A shellcrash -d 192.168.0.0/16 -j RETURN
iptables -w -t nat -A shellcrash -d 224.0.0.0/4 -j RETURN
iptables -w -t nat -A shellcrash -d 240.0.0.0/4 -j RETURN
iptables -w -t nat -A shellcrash -p tcp -s 10.0.2.0/24 -j REDIRECT --to-ports 7892
iptables -w -t nat -A shellcrash -p tcp -s 192.168.50.0/24 -j REDIRECT --to-ports 7892
iptables -w -t nat -A shellcrash -p tcp -s 192.168.101.0/24 -j REDIRECT --to-ports 7892
iptables -w -t nat -I PREROUTING -p tcp -m multiport --dports 22,80,443,8080,8443 -j shellcrash
iptables -w -t nat -I PREROUTING -p tcp -d 198.18.0.0/15 -j shellcrash
iptables -h
iptables -w -t nat -N shellcrash_dns
iptables -w -t nat -A shellcrash_dns -m mark --mark 7894 -j RETURN
iptables -w -t nat -A shellcrash_dns -p tcp -s 10.0.2.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 10.0.2.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p tcp -s 192.168.50.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 192.168.50.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p tcp -s 192.168.101.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -A shellcrash_dns -p udp -s 192.168.101.0/24 -j REDIRECT --to-ports 1053
iptables -w -t nat -I PREROUTING -p tcp --dport 53 -j shellcrash_dns
iptables -w -t nat -I PREROUTING -p udp --dport 53 -j shellcrash_dns
ip6tables -w -j REDIRECT -h
ip6tables -h
ip6tables -w -t nat -N shellcrashv6_dns
ip6tables -w -t nat -A shellcrashv6_dns -m mark --mark 7894 -j RETURN
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -s fe80::/10 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p udp -s fe80::/10 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -s fd00::/8 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p udp -s fd00::/8 -j REDIRECT --to-ports 1053
ip6tables -w -t nat -A shellcrashv6_dns -p tcp -j RETURN
ip6tables -w -t nat -A shellcrashv6_dns -p udp -j RETURN
ip6tables -w -t nat -I PREROUTING -p tcp --dport 53 -j shellcrashv6_dns
ip6tables -w -t nat -I PREROUTING -p udp --dport 53 -j shellcrashv6_dns
### 改根后的 resolv.conf
# mode 644
nameserver 10.0.2.2
### 输出
## nftables Redir 局域网
### 命令序列（fw_start.sh）
nft add table inet shellcrash
nft flush table inet shellcrash
nft add chain inet shellcrash input { type filter hook input priority -100 ; }
nft add rule inet shellcrash input iif lo accept
nft add rule inet shellcrash input iifname eth0 tcp dport { 7890, 9999 } reject
nft add rule inet shellcrash input iifname eth0 udp dport { 7890, 9999 } reject
nft add rule inet shellcrash input iifname != br0 tcp dport 9999 reject
nft add rule inet shellcrash input iifname != br0 udp dport 9999 reject
nft add rule inet shellcrash input ip saddr {10.0.2.0/24, 192.168.50.0/24, 192.168.101.0/24} accept
nft add rule inet shellcrash input ip6 saddr {fe80::/10, fd00::/8} accept
nft add rule inet shellcrash input tcp dport { 7890, 9999 } reject
nft add rule inet shellcrash input udp dport { 7890, 9999 } reject
nft list chain inet fw4 input
nft insert rule inet fw4 input meta mark 0x67890 accept
nft add chain inet shellcrash prerouting_dns { type nat hook prerouting priority -100 ; }
nft add rule inet shellcrash prerouting_dns udp dport != 53 return
nft add rule inet shellcrash prerouting_dns tcp dport != 53 return
nft add rule inet shellcrash prerouting_dns meta mark 7894 return
nft add rule inet shellcrash prerouting_dns meta skgid { 453, 7890 } return
nft add rule inet shellcrash prerouting_dns ip saddr != {10.0.2.0/24, 192.168.50.0/24, 192.168.101.0/24} return
nft add rule inet shellcrash prerouting_dns ip6 saddr != {fe80::/10, fd00::/8} return
nft add rule inet shellcrash prerouting_dns udp dport 53 redirect to 1053
nft add rule inet shellcrash prerouting_dns tcp dport 53 redirect to 1053
nft add chain inet shellcrash prerouting { type nat hook prerouting priority -100 ; }
nft add rule inet shellcrash prerouting tcp dport 53 return
nft add rule inet shellcrash prerouting udp dport 53 return
nft add rule inet shellcrash prerouting meta mark 7894 return
nft add rule inet shellcrash prerouting meta skgid 7890 return
nft add rule inet shellcrash prerouting ip daddr != {198.18.0.0/15} tcp dport != {22, 80, 443, 8080, 8443} return
nft add rule inet shellcrash prerouting ip daddr != {198.18.0.0/15} udp dport != {22, 80, 443, 8080, 8443} return
nft add rule inet shellcrash prerouting ip6 daddr != {fc00::/16} tcp dport != {22, 80, 443, 8080, 8443} return
nft add rule inet shellcrash prerouting ip6 daddr != {fc00::/16} udp dport != {22, 80, 443, 8080, 8443} return
nft add rule inet shellcrash prerouting ip daddr {0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/8, 100.64.0.0/10, 169.254.0.0/16, 172.16.0.0/12, 192.168.0.0/16, 224.0.0.0/4, 240.0.0.0/4} return
nft add rule inet shellcrash prerouting ip saddr != {10.0.2.0/24, 192.168.50.0/24, 192.168.101.0/24} return
nft add rule inet shellcrash prerouting meta nfproto ipv6 return
nft add rule inet shellcrash prerouting meta l4proto tcp redirect to 7892
### 改根后的 resolv.conf
# mode 644
nameserver 10.0.2.2
### 输出
