ss-redir + iptables + china_ip_list

shadowiptables.sh

#!/bin/sh
# china_ip_list.txt from https://github.com/17mon/china_ip_list
set -x

chnroute_file=./china_ip_list/china_ip_list.txt
src_addr=192.168.100.1/24
gamesrc_addr=192.168.200.1/24
game_port=1082
local_port=1081
clash_dns_port=1053
dnscrypt_port=5453

update() {
	if cd china_ip_list; then git pull; else git clone git://github.com/17mon/china_ip_list china_ip_list; fi
}

start_rule() {
	check_for_update
	iptables -t nat -A OUTPUT -p udp -s $src_addr -j CLASH_DNS_LOCAL
	iptables -t nat -A OUTPUT -p tcp -s $src_addr -j CLASHTABLES

	iptables -t nat -A OUTPUT -p udp -s $gamesrc_addr -j DNSCRYPT_LOCAL
	iptables -t nat -A OUTPUT -p tcp -s $gamesrc_addr -j SHADOWTABLES
}

apply_redir() {
	iptables -t nat -A PREROUTING -p udp -s $src_addr -j CLASH_DNS_LOCAL
	iptables -t nat -A PREROUTING -p tcp -s $src_addr -j CLASHTABLES

	iptables -t nat -A PREROUTING -p udp -s $gamesrc_addr -j DNSCRYPT_LOCAL
	iptables -t nat -A PREROUTING -p tcp -s $gamesrc_addr -j SHADOWTABLES

	iptables -t mangle -A PREROUTING -p udp -s $gamesrc_addr -j SHADOWTABLES_UDP
	iptables -t mangle -A OUTPUT -p udp -s $gamesrc_addr -j SHADOWTABLES_UDP_MARK
}

stop_rule() {
	iptables -t nat -D OUTPUT -p udp -s $src_addr -j CLASH_DNS_LOCAL
	iptables -t nat -D OUTPUT -p tcp -s $src_addr -j CLASHTABLES
	#iptables -t nat -D OUTPUT -p udp -s $src_addr -j CLASHTABLES

	iptables -t nat -D OUTPUT -p udp -s $gamesrc_addr -j DNSCRYPT_LOCAL
	iptables -t nat -D OUTPUT -p tcp -s $gamesrc_addr -j SHADOWTABLES

	ip route del local default dev lo table 100
	ip rule del fwmark 2 lookup 100

	iptables -t mangle -D PREROUTING -p udp -j SHADOWTABLES_UDP
	iptables -t mangle -D OUTPUT -p udp -j SHADOWTABLES_UDP_MARK

	iptables -t mangle -F SHADOWTABLES_UDP
	iptables -t mangle -X SHADOWTABLES_UDP

	iptables -t mangle -F SHADOWTABLES_UDP_MARK
	iptables -t mangle -X SHADOWTABLES_UDP_MARK
}

add_tables() {
	iptables -t nat -N CLASH_DNS_LOCAL
	iptables -t nat -A CLASH_DNS_LOCAL -p udp ! --dport 53 -j RETURN
	iptables -t nat -A CLASH_DNS_LOCAL -p udp -s $src_addr -j REDIRECT --to-ports $clash_dns_port

	iptables -t nat -N DNSCRYPT_LOCAL
	iptables -t nat -A DNSCRYPT_LOCAL -p udp ! --dport 53 -j RETURN
	iptables -t nat -A DNSCRYPT_LOCAL -p udp -s $gamesrc_addr -j REDIRECT --to-ports $dnscrypt_port

	iptables -t nat -N CLASHTABLES
	iptables -t nat -N SHADOWTABLES

	#for ip in ${ignore_ips[@]} ;do
	#	iptables -t nat -C SHADOWTABLES -s $src_addr -d $ip -j RETURN >& /dev/null \
	#		|| iptables -t nat -I SHADOWTABLES 1 -s $src_addr -d $ip -j RETURN
	#done

	# Add ipste chnroutes
	ipset create chnroute hash:net -exist
	while IFS='' read -r ip <&3; do
    		ipset add chnroute "$ip" -exist
	done 3< "$chnroute_file"

	# Ignore IPs
	for ip in \
		0.0.0.0/8 \
		10.0.0.0/8 \
		100.64.0.0/10 \
		127.0.0.0/8 \
		169.254.0.0/16 \
		172.16.0.0/12 \
		192.168.0.0/16 \
		224.0.0.0/4
 	do
		ipset add chnroute $ip -exist
	done

	# CLASH TCP
	iptables -t nat -A CLASHTABLES -s $src_addr -m set --match-set chnroute dst -j RETURN
	iptables -t nat -A CLASHTABLES -p tcp -s $src_addr -j REDIRECT --to-ports $local_port

	# SS TCP
	iptables -t nat -A SHADOWTABLES -s $gamesrc_addr -m set --match-set chnroute dst -j RETURN
	iptables -t nat -A SHADOWTABLES -p tcp -s $gamesrc_addr -j REDIRECT --to-ports $game_port

	# SS UDP
	ip route add local default dev lo table 100
	ip rule add fwmark 0x2/0x2 table 100

	iptables -t mangle -N SHADOWTABLES_UDP
	iptables -t mangle -N SHADOWTABLES_UDP_MARK

	iptables -t mangle -A SHADOWTABLES_UDP -p udp -s $gamesrc_addr -m set --match-set chnroute dst -j RETURN
	iptables -t mangle -A SHADOWTABLES_UDP -p udp -s $gamesrc_addr -j TPROXY --on-port $game_port --tproxy-mark 0x2/0x2

	iptables -t mangle -A SHADOWTABLES_UDP_MARK -p udp -s $gamesrc_addr -m set --match-set chnroute dst -j RETURN
	iptables -t mangle -A SHADOWTABLES_UDP_MARK -p udp -s $gamesrc_addr -j MARK --set-mark 2

}

case $1 in
	update_ip_list)
		update
		;;

	stop)
		stop_rule
		;;

	add_rule)
		add_tables
		;;

	restart)
		stop_rule
		add_tables
		start_rule
		;;

	start|*)
		add_tables
		start_rule
		apply_redir
		;;
esac