Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] прекращает писаться nfqws.log вскоре после установки - OpenWrt #167

Open
LimpingK opened this issue Jan 30, 2025 · 0 comments

Comments

@LimpingK
Copy link

В первые минуты посте установки и запуска в nfqws.log появляются строки.
Смотрю в web-интерфейсе. Но когда набирается десяток строк за первые минуты, лог становится пустой. Я сначала думал, что проблема с веб-интерфейсом.
Но собственно файл тоже пустой, 0b.
Остальные файлы,
nfqws.conf
user.list
exclude.list
auto.list

  • сохраняю из веб-интерфейса нормально.

GL.iNet GL-MT3000
OpenWrt 21.02-SNAPSHOT r15812+908-46b6ee7ffc / LuCI openwrt-21.02 branch git-22.245.77575-63bfee6
Kernel Version 5.4.211

Провайдер
Повторяется в разных случаях: USB-модем, Repeater WiFi, ethernet.

Выполните команды и приложите их вывод
opkg info nfqws-keenetic

root@GL-MT3000:~# opkg info nfqws-keenetic
Package: nfqws-keenetic
Version: 2.7.6
Depends: libc, iptables, iptables-mod-extra, iptables-mod-nfqueue, iptables-mod-filter, iptables-mod-ipopt, iptables-mod-conntrack-extra, ip6tables, ip6tables-mod-nat, ip6tables-extra
Conflicts: tpws-keenetic
Status: install user installed
Architecture: all
Conffiles:
 /etc/nfqws/auto.list e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
 /etc/nfqws/exclude.list 7b1d1ef573fe736f132520989a4b8534c611c0a7fdc9d10c323f4589f5e99e94
 /etc/nfqws/nfqws.conf 0e435265380ff191db056cea27e2472ab74cd8e3ef4d3facb994cf69e121393c
 /etc/nfqws/user.list 45dc2adaa172b86d73369c6ed12a8a0e648b851b66293b11514c3b1d4bd3fce6
Installed-Time: 1738174256

/opt/etc/init.d/S51nfqws restart

root@GL-MT3000:~# /etc/init.d/S51nfqws restart
-ash: /etc/init.d/S51nfqws: not found

cat /opt/etc/nfqws/nfqws.conf

root@GL-MT3000:~# cat /etc/nfqws/nfqws.conf
# Provider network interface, e.g. eth3
# You can specify multiple interfaces separated by space, e.g. ISP_INTERFACE="eth3 nwg1"
ISP_INTERFACE="eth2 eth1 br-lan"

# All arguments here: https://github.com/bol-van/zapret (search for `nfqws` on the page)
# HTTP(S) strategy
NFQWS_ARGS="--dpi-desync=fake --dpi-desync-ttl=12 --dpi-desync-fake-http=0x00000000"

# QUIC strategy
NFQWS_ARGS_QUIC="--filter-udp=443 --dpi-desync=fake --dpi-desync-repeats=11 --dpi-desync-fake-quic=/etc/nfqws/quic_initial.bin"

# UDP strategy (doesn't use lists from NFQWS_EXTRA_ARGS)
NFQWS_ARGS_UDP="--filter-udp=50000-50099 --dpi-desync=fake --dpi-desync-any-protocol --dpi-desync-repeats=6 --dpi-desync-cutoff=n2"

# auto - automatically detects blocked resources and adds them to the auto.list
NFQWS_EXTRA_ARGS="--hostlist=/etc/nfqws/user.list --hostlist-auto=/etc/nfqws/auto.list --hostlist-auto-debug=/var/log/nfqws.log --hostlist-exclude=/etc/nfqws/exclude.list"

# list - applies rules only to domains in the user.list
#NFQWS_EXTRA_ARGS="--hostlist=/etc/nfqws/user.list"

# all  - applies rules to all traffic except domains from exclude.list
#NFQWS_EXTRA_ARGS="--hostlist-exclude=/etc/nfqws/exclude.list"

# IPv6 support
IPV6_ENABLED=0

# TCP ports for iptables rules
TCP_PORTS=443

# UDP ports for iptables rules
UDP_PORTS=443,50000:50099

# Keenetic policy name
POLICY_NAME="nfqws"
# Policy mode (0 - include, 1 - exclude)
POLICY_EXCLUDE=0

# Syslog logging level (0 - silent, 1 - debug)
LOG_LEVEL=0

NFQUEUE_NUM=200
USER=nobody
CONFIG_VERSION=5

ps | grep nfqws

root@GL-MT3000:~# ps | grep nfqws
 4787 nobody     660 S    /usr/bin/nfqws --user=nobody --qnum=200 --bind-fix4 --filter-udp=50000-50099 --dpi-desync=fake --dpi-desync-any-p
20627 root      1232 S    grep nfqws

iptables-save | grep 200

root@GL-MT3000:~# iptables-save | grep 200
-A OUTPUT -m owner --gid-owner 20000 -m comment --comment "!fw3: process_explict_vpn" -j MARK --set-xmark 0x20000/0x20000
-A POSTROUTING -o eth2 -p udp -m multiport --dports 443,50000:50099 -m mark --mark 0x40000000/0x40000000 -j MARK --set-xmark 0x20000000/0x20000000
-A POSTROUTING -o eth2 -p udp -m multiport --dports 443,50000:50099 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x20000000/0x20000000 -j NFQUEUE --queue-num 200 --queue-bypass
-A POSTROUTING -o eth2 -p tcp -m multiport --dports 443 -m mark --mark 0x40000000/0x40000000 -j MARK --set-xmark 0x20000000/0x20000000
-A POSTROUTING -o eth2 -p tcp -m multiport --dports 443 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x20000000/0x20000000 -j NFQUEUE --queue-num 200 --queue-bypass
-A POSTROUTING -o eth1 -p udp -m multiport --dports 443,50000:50099 -m mark --mark 0x40000000/0x40000000 -j MARK --set-xmark 0x20000000/0x20000000
-A POSTROUTING -o eth1 -p udp -m multiport --dports 443,50000:50099 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x20000000/0x20000000 -j NFQUEUE --queue-num 200 --queue-bypass
-A POSTROUTING -o eth1 -p tcp -m multiport --dports 443 -m mark --mark 0x40000000/0x40000000 -j MARK --set-xmark 0x20000000/0x20000000
-A POSTROUTING -o eth1 -p tcp -m multiport --dports 443 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x20000000/0x20000000 -j NFQUEUE --queue-num 200 --queue-bypass
-A POSTROUTING -o br-lan -p udp -m multiport --dports 443,50000:50099 -m mark --mark 0x40000000/0x40000000 -j MARK --set-xmark 0x20000000/0x20000000
-A POSTROUTING -o br-lan -p udp -m multiport --dports 443,50000:50099 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x20000000/0x20000000 -j NFQUEUE --queue-num 200 --queue-bypass
-A POSTROUTING -o br-lan -p tcp -m multiport --dports 443 -m mark --mark 0x40000000/0x40000000 -j MARK --set-xmark 0x20000000/0x20000000
-A POSTROUTING -o br-lan -p tcp -m multiport --dports 443 -m connbytes --connbytes 1:8 --connbytes-mode packets --connbytes-dir original -m mark ! --mark 0x20000000/0x20000000 -j NFQUEUE --queue-num 200 --queue-bypass

sysctl net.netfilter.nf_conntrack_checksum

root@GL-MT3000:~# sysctl net.netfilter.nf_conntrack_checksum
net.netfilter.nf_conntrack_checksum = 0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant