#!/bin/sh
# Jayanta / 2026-01-16 / The Unlicense (unlicense.org) / 無保証 / 自己責任 / 悪用厳禁

PATH='/usr/sbin:/usr/bin'; WARP='162.158.0.0/15'; DNS='cloudflare' # adguard # mullvad
[ "$(id -u)" -eq 0 ] || exit 1
type warp-cli nft tor dnscrypt-proxy || exit 2
[ -f /etc/dnsmasq.conf ] || { echo 'dnsmasq: not found'; exit 3; }
RAW_UID='tinyproxy'; id "$RAW_UID" || { echo 'tinyproxy: not found'; exit 4; }
TOR_UID='debian-tor'; id "$TOR_UID" || { echo 'CHANGE: TOR_UID= tor, toranon'; exit 5; }
sysctl -w net.core.default_qdisc=fq -w net.ipv4.tcp_no_metrics_save=1 -w net.ipv4.tcp_congestion_control=bbr -w net.ipv6.conf.all.disable_ipv6=1 -w net.ipv6.conf.default.disable_ipv6=1 || { echo 'ERROR: SYSCTL'; exit 6; }

nft flush ruleset; nft add table ip nat; nft add table ip filter
nft add chain ip nat output '{ type nat hook output priority dstnat; policy accept; }'
nft add chain ip filter input '{ type filter hook input priority filter; policy drop; }'
nft add chain ip filter output '{ type filter hook output priority filter; policy drop; }'
nft add chain ip filter forward '{ type filter hook forward priority filter; policy drop; }'
nft add set ip nat reserved '{ type ipv4_addr; flags interval; elements = { 0.0.0.0/8, 10.0.0.0/8, 100.64.0.0/10, 127.0.0.0/8, 169.254.0.0/16, 172.16.0.0/12, 192.0.0.0/24, 192.0.2.0/24, 192.31.196.0/24, 192.52.193.0/24, 192.88.99.0/24, 192.168.0.0/16, 192.175.48.0/24, 198.18.0.0/15, 198.51.100.0/24, 203.0.113.0/24, 224.0.0.0/4, 240.0.0.0/4 }; }'

nft add rule ip nat output ip daddr 10.192.0.0/10 tcp dport '{ 80, 443 }' tcp flags syn / fin,syn,rst,ack counter redirect to 9040
nft add rule ip nat output skuid "$TOR_UID" counter return
nft add rule ip nat output skuid "$RAW_UID" counter return
nft add rule ip nat output ip daddr "$WARP" counter return
nft add rule ip nat output ip daddr 127.0.0.1 counter return
nft add rule ip nat output oifname "lo" counter return
nft add rule ip nat output ip daddr @reserved counter return
nft add rule ip nat output tcp dport '{ 80, 443 }' tcp flags syn / fin,syn,rst,ack counter redirect to 9040

nft add rule ip filter input ct state established counter accept
nft add rule ip filter input iifname "lo" counter accept
nft add rule ip filter output ct state invalid counter drop
nft add rule ip filter output ct state established counter accept
nft add rule ip filter output tcp dport 443 tcp flags syn / fin,syn,rst,ack skuid "$TOR_UID" ct state new counter accept
nft add rule ip filter output tcp dport 443 tcp flags syn / fin,syn,rst,ack skuid "$RAW_UID" ct state new counter accept
nft add rule ip filter output ip daddr "$WARP" tcp dport 443 tcp flags syn / fin,syn,rst,ack ct state new counter accept
nft add rule ip filter output ip daddr "$WARP" udp dport 443 ct state new counter accept
nft add rule ip filter output ip daddr "$WARP" udp dport 123 ct state new counter accept
nft add rule ip filter output ip daddr 127.0.0.1 ct state new counter accept
nft add rule ip filter output oifname "lo" counter accept

nft list ruleset

{
  echo "nameserver 127.0.0.1"
} > /etc/resolv.conf; cat /etc/resolv.conf

{
  echo "NewCircuitPeriod 30"
  echo "MaxCircuitDirtiness 30"
  echo "FascistFirewall 1"
  echo "ReachableAddresses *:443"
  echo "User $TOR_UID"
  echo "DataDirectory /var/lib/tor"
  echo "DNSPort 9053"
  echo "TransPort 9040"
  echo "SocksPort 9050"
  echo "AutomapHostsOnResolve 1"
  echo "AutomapHostsSuffixes .onion"
  echo "VirtualAddrNetworkIPv4 10.192.0.0/10"
} > /etc/tor/torrc; cat /etc/tor/torrc; service tor restart

{
  echo "server=/onion/127.0.0.1#9053"
  echo "server=127.0.0.1#5300"
  echo "max-cache-ttl=300"
  echo "no-resolv"
  echo "listen-address=127.0.0.1"
  echo "bind-interfaces"
  echo "dnssec"
} > /etc/dnsmasq.conf; cat /etc/dnsmasq.conf; service dnsmasq restart

{
  echo "Port 8888"
  echo "Timeout 60"
  echo "User $RAW_UID"
  echo "Group $RAW_UID"
  echo "Allow 127.0.0.1"
  echo "Listen 127.0.0.1"
  echo "LogLevel Critical"
} > /etc/tinyproxy/tinyproxy.conf; cat /etc/tinyproxy/tinyproxy.conf; service tinyproxy restart

{
  case "$DNS" in
    mullvad) echo "server_names = ['mullvad-doh-family']" ;;
    adguard) echo "server_names = ['adguard-doh-family']" ;;
    *) echo "server_names = ['cloudflare-doh-onion']" ;;
  esac
  echo "listen_addresses = ['127.0.0.1:5300']"
  echo "proxy = 'socks5://127.0.0.1:9050'"
  echo "force_tcp = true"
  echo "[static]"
  echo "[static.'cloudflare-doh-onion']"
  echo "stamp = 'sdns://AgcAAAAAAAAAAAA-ZG5zNHRvcnBubGZzMmlmdXoyczJ5ZjNmYzdyZG1zYmhtNnJ3NzVldWozNXBhYzZhcDI1emdxYWQub25pb24KL2Rucy1xdWVyeQ'"
  echo "[static.'adguard-doh-family']"
  echo "stamp = 'sdns://AgMAAAAAAAAADDk0LjE0MC4xNC4xNSCaOjT3J965vKUQA9nOnDn48n3ZxSQpAcK6saROY1oCGQw5NC4xNDAuMTQuMTUKL2Rucy1xdWVyeQ'"
  echo "[static.'mullvad-doh-family']"
  echo "stamp = 'sdns://AgMAAAAAAAAACzE5NC4yNDIuMi42ABZmYW1pbHkuZG5zLm11bGx2YWQubmV0Ci9kbnMtcXVlcnk'"
} > /etc/dnscrypt-proxy/dnscrypt-proxy.toml; cat /etc/dnscrypt-proxy/dnscrypt-proxy.toml; service dnscrypt-proxy restart

warp-cli registration show | grep -i 'account type' || warp-cli registration new; warp-cli mode proxy; warp-cli proxy port 1080; warp-cli connect; service warp-svc restart
Edit

Pub: 23 Dec 2025 06:15 UTC

Edit: 15 Jan 2026 18:08 UTC

Views: 928

Auto Theme: Dark