# fnOS EasyTier iptables 转发规则持久化

适用于飞牛 fnOS / Debian 系 systemd 环境：开机后通过 `systemd timer` 延迟加载 iptables 转发规则，避免重启后规则丢失或网络/tun 设备未就绪导致规则加载失败。

默认规则：

- 开启 IPv4 转发：`/proc/sys/net/ipv4/ip_forward = 1`
- 允许 `192.168.2.0/24` 与 `192.168.3.0/24` 双向转发
- 允许 `tun0` 入站/出站 FORWARD
- 开机延迟 `20s` 执行

## 一键安装

```bash
curl -fsSL https://gitea.chickliu.fun/Hermes/fnos-iptables-forward/raw/branch/main/install.sh -o install.sh
sudo bash install.sh install
```

或直接：

```bash
curl -fsSL https://gitea.chickliu.fun/Hermes/fnos-iptables-forward/raw/branch/main/install.sh | sudo bash
```

## 自定义网段 / 网卡 / 延迟

```bash
sudo LAN_A=192.168.2.0/24 LAN_B=192.168.3.0/24 TUN_IF=tun0 DELAY=20s bash install.sh install
```

## 查看状态

```bash
sudo bash install.sh status
```

会显示：

- timer 状态
- service 最近执行结果
- `ip_forward`
- `iptables -S FORWARD`

## 卸载

```bash
sudo bash install.sh uninstall
```

卸载会移除：

- `/home/scripts/iptables-forward.sh`
- `/etc/systemd/system/iptables-forward.service`
- `/etc/systemd/system/iptables-forward.timer`

注意：卸载不会主动清空当前 iptables FORWARD 规则，避免误断网。如需清空请手动管理 iptables。

## 安装后生成的文件

### `/home/scripts/iptables-forward.sh`

```bash
#!/usr/bin/env bash
set -Eeuo pipefail

echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -F FORWARD
iptables -P FORWARD ACCEPT
iptables -A FORWARD -s 192.168.2.0/24 -d 192.168.3.0/24 -j ACCEPT
iptables -A FORWARD -s 192.168.3.0/24 -d 192.168.2.0/24 -j ACCEPT
iptables -A FORWARD -i tun0 -j ACCEPT
iptables -A FORWARD -o tun0 -j ACCEPT
```

### `/etc/systemd/system/iptables-forward.service`

```ini
[Unit]
Description=EasyTier iptables forward rules loader
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
ExecStart=/home/scripts/iptables-forward.sh
User=root
```

### `/etc/systemd/system/iptables-forward.timer`

```ini
[Unit]
Description=Delay load EasyTier iptables forward rules after boot

[Timer]
OnBootSec=20s
Unit=iptables-forward.service

[Install]
WantedBy=timers.target
```