feat: add fnos iptables forward installer

2026-06-02 17:12:11 +08:00
commit de87a8085b
3 changed files with 234 additions and 0 deletions
@@ -0,0 +1,3 @@
+.DS_Store
+*.log
+/tmp/
@@ -0,0 +1,101 @@
+# fnOS EasyTier iptables 转发规则持久化
+
+适用于飞牛 fnOS / Debian 系 systemd 环境：开机后通过 `systemd timer` 延迟加载 iptables 转发规则，避免重启后规则丢失或网络/tun 设备未就绪导致规则加载失败。
+
+默认规则：
+
+- 开启 IPv4 转发：`/proc/sys/net/ipv4/ip_forward = 1`
+- 允许 `192.168.2.0/24` 与 `192.168.3.0/24` 双向转发
+- 允许 `tun0` 入站/出站 FORWARD
+- 开机延迟 `20s` 执行
+
+## 一键安装
+
+```bash
+curl -fsSL https://gitea.chickliu.fun/Hermes/fnos-iptables-forward/raw/branch/main/install.sh -o install.sh
+sudo bash install.sh install
+```
+
+或直接：
+
+```bash
+curl -fsSL https://gitea.chickliu.fun/Hermes/fnos-iptables-forward/raw/branch/main/install.sh | sudo bash
+```
+
+## 自定义网段 / 网卡 / 延迟
+
+```bash
+sudo LAN_A=192.168.2.0/24 LAN_B=192.168.3.0/24 TUN_IF=tun0 DELAY=20s bash install.sh install
+```
+
+## 查看状态
+
+```bash
+sudo bash install.sh status
+```
+
+会显示：
+
+- timer 状态
+- service 最近执行结果
+- `ip_forward`
+- `iptables -S FORWARD`
+
+## 卸载
+
+```bash
+sudo bash install.sh uninstall
+```
+
+卸载会移除：
+
+- `/home/scripts/iptables-forward.sh`
+- `/etc/systemd/system/iptables-forward.service`
+- `/etc/systemd/system/iptables-forward.timer`
+
+注意：卸载不会主动清空当前 iptables FORWARD 规则，避免误断网。如需清空请手动管理 iptables。
+
+## 安装后生成的文件
+
+### `/home/scripts/iptables-forward.sh`
+
+```bash
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+echo 1 > /proc/sys/net/ipv4/ip_forward
+iptables -F FORWARD
+iptables -P FORWARD ACCEPT
+iptables -A FORWARD -s 192.168.2.0/24 -d 192.168.3.0/24 -j ACCEPT
+iptables -A FORWARD -s 192.168.3.0/24 -d 192.168.2.0/24 -j ACCEPT
+iptables -A FORWARD -i tun0 -j ACCEPT
+iptables -A FORWARD -o tun0 -j ACCEPT
+```
+
+### `/etc/systemd/system/iptables-forward.service`
+
+```ini
+[Unit]
+Description=EasyTier iptables forward rules loader
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/home/scripts/iptables-forward.sh
+User=root
+```
+
+### `/etc/systemd/system/iptables-forward.timer`
+
+```ini
+[Unit]
+Description=Delay load EasyTier iptables forward rules after boot
+
+[Timer]
+OnBootSec=20s
+Unit=iptables-forward.service
+
+[Install]
+WantedBy=timers.target
+```
@@ -0,0 +1,130 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+SERVICE_NAME="${SERVICE_NAME:-iptables-forward}"
+SCRIPT_DIR="${SCRIPT_DIR:-/home/scripts}"
+RULE_SCRIPT="${RULE_SCRIPT:-$SCRIPT_DIR/iptables-forward.sh}"
+SERVICE_FILE="${SERVICE_FILE:-/etc/systemd/system/${SERVICE_NAME}.service}"
+TIMER_FILE="${TIMER_FILE:-/etc/systemd/system/${SERVICE_NAME}.timer}"
+DELAY="${DELAY:-20s}"
+LAN_A="${LAN_A:-192.168.2.0/24}"
+LAN_B="${LAN_B:-192.168.3.0/24}"
+TUN_IF="${TUN_IF:-tun0}"
+MODE="${1:-install}"
+
+info() { printf '\033[1;34m==>\033[0m %s\n' "$*"; }
+warn() { printf '\033[1;33mWARN:\033[0m %s\n' "$*" >&2; }
+fail() { printf '\033[1;31mERROR:\033[0m %s\n' "$*" >&2; exit 1; }
+need_root() { [ "$(id -u)" -eq 0 ] || fail "请用 root 运行：sudo bash install.sh ${MODE}"; }
+need_cmd() { command -v "$1" >/dev/null 2>&1 || fail "缺少命令：$1"; }
+
+write_rule_script() {
+  mkdir -p "$SCRIPT_DIR"
+  cat > "$RULE_SCRIPT" <<EOF
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+echo 1 > /proc/sys/net/ipv4/ip_forward
+
+iptables -F FORWARD
+iptables -P FORWARD ACCEPT
+iptables -A FORWARD -s ${LAN_A} -d ${LAN_B} -j ACCEPT
+iptables -A FORWARD -s ${LAN_B} -d ${LAN_A} -j ACCEPT
+iptables -A FORWARD -i ${TUN_IF} -j ACCEPT
+iptables -A FORWARD -o ${TUN_IF} -j ACCEPT
+EOF
+  chmod 0755 "$RULE_SCRIPT"
+}
+
+write_systemd_units() {
+  cat > "$SERVICE_FILE" <<EOF
+[Unit]
+Description=EasyTier iptables forward rules loader
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=${RULE_SCRIPT}
+User=root
+EOF
+
+  cat > "$TIMER_FILE" <<EOF
+[Unit]
+Description=Delay load EasyTier iptables forward rules after boot
+
+[Timer]
+OnBootSec=${DELAY}
+Unit=${SERVICE_NAME}.service
+
+[Install]
+WantedBy=timers.target
+EOF
+}
+
+install_all() {
+  need_root
+  need_cmd systemctl
+  need_cmd iptables
+  info "写入转发规则脚本：$RULE_SCRIPT"
+  write_rule_script
+  info "写入 systemd service/timer"
+  write_systemd_units
+  info "加载并启用 timer（只启用 timer，不直接 enable service）"
+  systemctl daemon-reload
+  systemctl enable --now "${SERVICE_NAME}.timer"
+  info "立即执行一次规则加载，避免等到下次开机才生效"
+  systemctl start "${SERVICE_NAME}.service"
+  info "安装完成"
+  status_all
+}
+
+uninstall_all() {
+  need_root
+  need_cmd systemctl
+  info "停止并禁用 timer/service"
+  systemctl disable --now "${SERVICE_NAME}.timer" 2>/dev/null || true
+  systemctl stop "${SERVICE_NAME}.service" 2>/dev/null || true
+  rm -f "$SERVICE_FILE" "$TIMER_FILE" "$RULE_SCRIPT"
+  systemctl daemon-reload
+  info "已移除 systemd 单元和规则脚本；现有 iptables 规则不会自动清空，如需清空请手动执行 iptables 管理命令。"
+}
+
+status_all() {
+  need_root
+  printf '\n# systemd timer\n'
+  systemctl --no-pager --full status "${SERVICE_NAME}.timer" || true
+  printf '\n# systemd service\n'
+  systemctl --no-pager --full status "${SERVICE_NAME}.service" || true
+  printf '\n# ip_forward\n'
+  cat /proc/sys/net/ipv4/ip_forward || true
+  printf '\n# iptables FORWARD\n'
+  iptables -S FORWARD || true
+}
+
+case "$MODE" in
+  install) install_all ;;
+  uninstall|remove) uninstall_all ;;
+  status) status_all ;;
+  *)
+    cat <<USAGE
+Usage: sudo bash install.sh [install|status|uninstall]
+
+Environment overrides:
+  LAN_A=$LAN_A
+  LAN_B=$LAN_B
+  TUN_IF=$TUN_IF
+  DELAY=$DELAY
+  SERVICE_NAME=$SERVICE_NAME
+  SCRIPT_DIR=$SCRIPT_DIR
+
+Examples:
+  sudo bash install.sh install
+  sudo LAN_A=192.168.2.0/24 LAN_B=192.168.3.0/24 TUN_IF=tun0 bash install.sh install
+  sudo DELAY=30s bash install.sh install
+  sudo bash install.sh status
+  sudo bash install.sh uninstall
+USAGE
+    exit 2
+    ;;
+esac