feat: add fnos iptables forward installer

2026-06-02 17:12:11 +08:00
commit de87a8085b
3 changed files with 234 additions and 0 deletions
@@ -0,0 +1,101 @@
+# fnOS EasyTier iptables 转发规则持久化
+
+适用于飞牛 fnOS / Debian 系 systemd 环境：开机后通过 `systemd timer` 延迟加载 iptables 转发规则，避免重启后规则丢失或网络/tun 设备未就绪导致规则加载失败。
+
+默认规则：
+
+- 开启 IPv4 转发：`/proc/sys/net/ipv4/ip_forward = 1`
+- 允许 `192.168.2.0/24` 与 `192.168.3.0/24` 双向转发
+- 允许 `tun0` 入站/出站 FORWARD
+- 开机延迟 `20s` 执行
+
+## 一键安装
+
+```bash
+curl -fsSL https://gitea.chickliu.fun/Hermes/fnos-iptables-forward/raw/branch/main/install.sh -o install.sh
+sudo bash install.sh install
+```
+
+或直接：
+
+```bash
+curl -fsSL https://gitea.chickliu.fun/Hermes/fnos-iptables-forward/raw/branch/main/install.sh | sudo bash
+```
+
+## 自定义网段 / 网卡 / 延迟
+
+```bash
+sudo LAN_A=192.168.2.0/24 LAN_B=192.168.3.0/24 TUN_IF=tun0 DELAY=20s bash install.sh install
+```
+
+## 查看状态
+
+```bash
+sudo bash install.sh status
+```
+
+会显示：
+
+- timer 状态
+- service 最近执行结果
+- `ip_forward`
+- `iptables -S FORWARD`
+
+## 卸载
+
+```bash
+sudo bash install.sh uninstall
+```
+
+卸载会移除：
+
+- `/home/scripts/iptables-forward.sh`
+- `/etc/systemd/system/iptables-forward.service`
+- `/etc/systemd/system/iptables-forward.timer`
+
+注意：卸载不会主动清空当前 iptables FORWARD 规则，避免误断网。如需清空请手动管理 iptables。
+
+## 安装后生成的文件
+
+### `/home/scripts/iptables-forward.sh`
+
+```bash
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+echo 1 > /proc/sys/net/ipv4/ip_forward
+iptables -F FORWARD
+iptables -P FORWARD ACCEPT
+iptables -A FORWARD -s 192.168.2.0/24 -d 192.168.3.0/24 -j ACCEPT
+iptables -A FORWARD -s 192.168.3.0/24 -d 192.168.2.0/24 -j ACCEPT
+iptables -A FORWARD -i tun0 -j ACCEPT
+iptables -A FORWARD -o tun0 -j ACCEPT
+```
+
+### `/etc/systemd/system/iptables-forward.service`
+
+```ini
+[Unit]
+Description=EasyTier iptables forward rules loader
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/home/scripts/iptables-forward.sh
+User=root
+```
+
+### `/etc/systemd/system/iptables-forward.timer`
+
+```ini
+[Unit]
+Description=Delay load EasyTier iptables forward rules after boot
+
+[Timer]
+OnBootSec=20s
+Unit=iptables-forward.service
+
+[Install]
+WantedBy=timers.target
+```