|
|
楼主 |
发表于 2023-2-1 20:02:50
|
显示全部楼层
主要是三步：
第一步要给内核打补丁，把LGA1150佬的补丁https://github.com/LGA1150/openwrt-fullconenat放在feeds/package里面，注意更新一下feeds；第二步给防火墙的代码打上FullCone的补丁，你需要在package/network/config/patches建一个空的补丁，命名为0100-fullconenat.patch，AXT1800的官方代码和Openwrt的防火墙代码不太一样，所以得调一下官方的代码的位置，我这有个写好的，你可以直接用：
- --- a/defaults.c
- +++ b/defaults.c
- @@ -48,7 +48,9 @@ const struct fw3_option fw3_flag_opts[] = {
- FW3_OPT("synflood_protect", bool, defaults, syn_flood),
- FW3_OPT("synflood_rate", limit, defaults, syn_flood_rate),
- FW3_OPT("synflood_burst", int, defaults, syn_flood_rate.burst),
- -
- +
- + FW3_OPT("fullcone", bool, defaults, fullcone),
- +
- FW3_OPT("tcp_syncookies", bool, defaults, tcp_syncookies),
- FW3_OPT("tcp_ecn", int, defaults, tcp_ecn),
- FW3_OPT("tcp_window_scaling", bool, defaults, tcp_window_scaling),
- --- a/options.h
- +++ b/options.h
- @@ -296,6 +296,7 @@ struct fw3_defaults
- enum fw3_reject_code tcp_reject_code;
- enum fw3_reject_code any_reject_code;
-
- + bool fullcone;
- bool syn_flood;
- struct fw3_limit syn_flood_rate;
-
- --- a/zones.c
- +++ b/zones.c
- @@ -670,6 +670,7 @@ print_zone_rule(struct fw3_ipt_handle *h
- struct fw3_address *msrc;
- struct fw3_address *mdest;
- struct fw3_ipt_rule *r;
- + struct fw3_defaults *defs = &state->defaults;
-
- if (!fw3_is_family(zone, handle->family))
- return;
- @@ -755,8 +756,22 @@ print_zone_rule(struct fw3_ipt_handle *h
- {
- r = fw3_ipt_rule_new(handle);
- fw3_ipt_rule_src_dest(r, msrc, mdest);
- - fw3_ipt_rule_target(r, "MASQUERADE");
- - fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
- + /*FIXME: Workaround for FULLCONE-NAT*/
- + if(defs->fullcone)
- + {
- + warn("%s will enable FULLCONE-NAT", zone->name);
- + fw3_ipt_rule_target(r, "FULLCONENAT");
- + fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
- + r = fw3_ipt_rule_new(handle);
- + fw3_ipt_rule_src_dest(r, msrc, mdest);
- + fw3_ipt_rule_target(r, "FULLCONENAT");
- + fw3_ipt_rule_append(r, "zone_%s_prerouting", zone->name);
- + }
- + else
- + {
- + fw3_ipt_rule_target(r, "MASQUERADE");
- + fw3_ipt_rule_append(r, "zone_%s_postrouting", zone->name);
- + }
- }
- }
- }
第三步，加入一个启动FullCone NAT的luci界面，https://github.com/peter-tank/luci-app-fullconenat，编译的时候勾上，它会自动勾上第一步的模块
|
|
发表于 2022-12-27 21:31:17
