github-mirror/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2026-03-11 15:51:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

BSD use SYN,ACK filter to catch autottl

Browse Source
This commit is contained in:
bol-van
2024-03-09 12:45:17 +03:00
parent 48850b5f4e
commit 5ef3fb9e97
4 changed files with 31 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/bsdfw.txt
View File

@@ -27,9 +27,10 @@ ipfw add 100 fwd ::1,988 tcp from any to any 80,443 proto ip6 recv em1
ipfw delete 100
ipfw add 100 divert 989 tcp from any to any 80,443 out not diverted not sockarg xmit em0
; required for autottl mode
ipfw add 100 divert 989 tcp from any 80,443 to any tcpflags syn,ack in recv em0
; udp
ipfw add 100 divert 989 udp from any to any 443 out not diverted not sockarg xmit em0
# this is required for autottl but very bad, all incoming traffic will be diverted, no way to limit like in linux (connbytes)
ipfw add 100 divert 989 tcp from any 80,443 to any in not diverted not sockarg recv em0
ipfw delete 100
ipfw add 100 allow tcp from me to table\(nozapret\) 80,443
@@ -71,6 +72,7 @@ pfctl -f /etc/pf.conf
; dvtws works both for routed and local
pass in quick on em0 proto tcp from port {80,443} flags SA/SA divert-packet port 989 no state
pass in quick on em0 proto tcp from port {80,443} no state
pass out quick on em0 proto tcp to port {80,443} divert-packet port 989 no state
pfctl -f /etc/pf.conf