華鳥風月 https://blog.9-ch.com/ Recent content on 華鳥風月 Hugo -- gohugo.io zh-cn Thu, 09 Mar 2023 15:31:37 +0800 RouterOS 通过 OSPF IP分流非CN流量 https://blog.9-ch.com/post/homelab-no-cn-routes/ Thu, 09 Mar 2023 15:31:37 +0800 https://blog.9-ch.com/post/homelab-no-cn-routes/ ROS ip 分流方案 主要适用于不想折腾PS/XBOX/Switch设备网关配置,又不希望出口网关为卵漏油/AIB的,或者怕折腾网络时家里断网影响家人的场景

更新

  • 2022-06-18: 高版本ROS建立邻居困难问题建议尝试PTP/PTMP模式,并且对齐两侧参数(hello、dead count等),并检查224.0.0.0组播地址范围有无防火墙/路由规则影响导致的不可达问题
  • 2023-01-28: 更新探针脚本, 调整文档结构

相关硬件

  • Mikrotik AC^2 (ros stable 7.2.3*)

  • NUC5i5MYBE (debian 11)

    *该版本OSPF似乎有bug,测试邻居离线时出现过一次不能自动删除路由,建议还是LT版本

网络结构

1
2
3
4
5
6
7

AC^2--ETH1(192.168.0.254)--(192.168.0.1)光猫--Internet
    |
    |-ETH2-| birdge:lan
    |-ETH3-| ip:192.168.1.1
    |-ETH4-|----> 192.168.1.0/24 SW
    |
    |-ETH5(192.168.255.1)--(192.168.255.254)NUC

相关网段划分:

  • 192.168.0.0/24 –光猫/WAN口网段
  • 192.168.1.0/24 –普通设备网段
  • 192.168.255.0/24 –NUC网段

基础防火墙配置

不建议无脑抄,大部分配置有comment,建议按需添加

LAN包含lan桥ether5,WAN包括pppoe-out

ROS IPV4防火墙(较长已折叠) 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

/ip firewall address-list
add address=0.0.0.0/8 comment="defconf: RFC6890" list=no_forward_ipv4
add address=169.254.0.0/16 comment="defconf: RFC6890" list=no_forward_ipv4
add address=224.0.0.0/4 comment="defconf: multicast" list=no_forward_ipv4
add address=255.255.255.255 comment="defconf: RFC6890" list=no_forward_ipv4
add address=192.168.233.233 list=BOT
add address=192.168.0.0/16 list=private
add address=10.0.0.0/8 list=private
add address=172.16.0.0/12 list=private
/ip firewall filter
add action=drop chain=input comment=ANTI-BOT disabled=yes src-address-list=\
    BOT
add action=accept chain=input comment=Accept-OSPF protocol=ospf
add action=accept chain=input comment=Accept-LAN-DNS dst-address=192.168.1.1 \
    dst-port=53 protocol=udp
add action=accept chain=input comment=Accept-NTP dst-port=123 protocol=udp
add action=drop chain=input comment=BLOCK-DNS dst-port=53 in-interface-list=\
    WAN protocol=udp
add action=drop chain=input comment=BLOCK-DoT dst-port=53 in-interface-list=\
    WAN protocol=tcp
add action=drop chain=input comment=BLOCK-HTTP dst-port=80 in-interface-list=\
    WAN protocol=tcp
add action=drop chain=input comment=BLOCK-HTTPS dst-port=443 \
    in-interface-list=WAN protocol=tcp
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMP" log-prefix=\
    IPv4-ping protocol=icmp
add action=accept chain=input comment=\
    "defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "defconf: accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat \
    connection-state=new in-interface-list=WAN
add action=drop chain=forward comment="defconf: drop bad forward IPs" \
    src-address-list=no_forward_ipv4
add action=drop chain=forward comment="defconf: drop bad forward IPs" \
    dst-address-list=no_forward_ipv4
/ip firewall nat
add action=masquerade chain=srcnat comment="Hairpin NAT" dst-address=\
    192.168.1.0/24 out-interface=lan src-address=192.168.1.0/24
add action=masquerade chain=srcnat comment=ONU dst-address=192.168.0.0/24 \
    src-address=192.168.1.0/24
add action=masquerade chain=srcnat comment="defconf: masquerade" \
    ipsec-policy=out,none out-interface-list=WAN

DNS解析

ROS配置

使用netwatch检查NUC状态,离线时自动将dns切换为公共dns

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

/system script
add dont-require-permissions=yes name=use-default-dns owner=admin policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="/\
    ip/dns/set allow-remote-requests=yes cache-size=4096KiB servers=119.29.29.\
    29,223.5.5.5 \r\
    \n/ip dns cache flush"
add dont-require-permissions=yes name=use-sgw-dns owner=admin policy=\
    ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source="/\
    ip/dns/set allow-remote-requests=yes cache-size=4096KiB servers=192.168.25\
    5.254\r\
    \n/ip dns cache flush"
/tool netwatch
add down-script=use-default-dns host=192.168.255.254 interval=30s up-script=use-sgw-dns

(可选)192.168.1.0/24网段dns劫持

1
2
3
4

/ip firewall nat
add action=dst-nat chain=dstnat comment="Hijacking for DNS" dst-port=53 \
    protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.1 \
    to-ports=53

Debian配置

SmartDNS分流解析

1

apt install smartdns

配置/etc/smartdns/smartdns.conf 如下

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

bind :53
cache-size 0
prefetch-domain no
serve-expired no
speed-check-mode ping,tcp:80

log-level info
log-file /var/log/smartdns.log
server 223.5.5.5:53
server 119.29.29.29:53
server-https https://dns.google/dns-query -check-edns -blacklist-ip -group GFW -exclude-default-group
server-https https://1.1.1.1/dns-query -blacklist-ip -group GFW -exclude-default-group
server-https https://cloudflare-dns.com/dns-query -blacklist-ip -group GFW -exclude-default-group
conf-file /etc/smartdns/gfw.conf

/etc/smartdns/gfw.conf 使用crontab更新

1

0 2 * * * curl -s https://raw.githubusercontents.com/RyoLee/gfwlist2smartdns/master/run.sh | bash -s -- -o /etc/smartdns/gfw.conf && /etc/init.d/smartdns reload

最终效果list内走223.5.5.5/119.29.29.29,list外走DoH

OSPF路由

ROS配置

添加防火墙放行

1
2
3
4
5

/ip firewall mangle
add action=mark-routing chain=prerouting new-routing-mark=main passthrough=\
    yes protocol=ospf
add action=mark-routing chain=prerouting dst-address-list=!private \
    in-interface=ether5 new-routing-mark=bypass passthrough=yes

Bypass路由表 & OSPF

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

/routing ospf instance
add disabled=no name=sgw router-id=192.168.255.1 routing-table=main
/routing ospf area
add disabled=no instance=sgw name=sgw
/routing table
add disabled=no fib name=bypass
/ip route
add comment="BYPASS" disabled=no distance=1 dst-address=0.0.0.0/0 \
    gateway=pppoe-out pref-src=0.0.0.0 routing-table=bypass scope=30 \
    suppress-hw-offload=no target-scope=10
/routing ospf interface-template
add area=sgw disabled=no interfaces=ether5
/routing rule
add action=lookup disabled=no routing-mark=bypass table=bypass
add action=lookup disabled=no table=main

Debian配置

安装bird2

1

apt install bird2

配置/etc/bird/bird.conf (网卡为enp0s25)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

log syslog all;

router id 192.168.255.254;


protocol device {
	scan time 60;
}

protocol kernel {
	ipv4 {
	      import none;
	      export all;
	};
}

protocol static {
	ipv4;
	include "routes4.conf";
}

protocol ospf v2 {
    ecmp no;
  	ipv4 {
		export all;
	};
	area 0.0.0.0 {
		interface "enp0s25" {
			type broadcast;
		};
	};
}

非CN流量出口为虚拟设备为utun,若使用TProxy则配置为对应的以太网网卡(如本例中enp0s25)

/etc/bird/routes4.conf 使用crontab更新

1
2

0 2 * * * curl -s https://api.9-ch.com/ncr?device=utun  -o /etc/bird/routes4.conf
0 3 */1 * * /etc/init.d/bird reload

心跳检查,若google 204服务检查失败则停止bird触发回落

探针脚本路径 /opt/check/tun.sh (已删除bark推送部分, 可自行按需添加)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

#!/usr/bin/bash
COUNT=0
MAX_COUNT=6
while [ $COUNT -lt $MAX_COUNT ]
do
    SER=0
    NET=0
    if [ $(curl --connect-timeout 10 --interface utun -w "%{http_code}" -s https://www.google.com/generate_204) -eq 204 ];then
        NET=1
    fi
    if /etc/init.d/bird status|grep Active|grep -q running;then
        SER=1
    fi
    if [ $NET -eq 1 ] && [ $SER -eq 0 ];then
        /etc/init.d/bird start
        # curl -X "POST" "https://******/push" -H 'Content-Type: application/json; charset=utf-8' -d $'{"body": "***隧道已上线","device_key": "******","level": "passive","title": "网络探针"}'
        exit 0
    fi
    if [ $NET -eq 0 ] && [ $SER -eq 1 ];then
        let COUNT+=1
        if [ $COUNT -eq $MAX_COUNT ];then
            /etc/init.d/bird stop
            # curl -X "POST" "https://******/push" -H 'Content-Type: application/json; charset=utf-8' -d $'{"body": "***隧道已离线","device_key": "******","level": "passive","title": "网络探针"}'
            exit 0
        fi
        continue
    fi
    exit 0
done

1

* * * * * bash /opt/check/tun.sh

ROS DDNS失效问题

见前文ros-ddns失效

参考信息

同网段分流openwrt方案

见前文RouterOS 通过 OSPF IP分流至 OpenWrt

零散问题比较多, 本方案为基于以上测试经验改进出新方案,非CN IP流量出口改为使用运行debian的一台NUC

]]> 本站域名已迁移至9-ch.com https://blog.9-ch.com/post/base-domain-update/ Thu, 09 Mar 2023 15:31:19 +0800 https://blog.9-ch.com/post/base-domain-update/ 站点维护日志 站点维护日志

考虑到 IDN 域名对非中文用户不友好、部分搜索引擎收录异常等诸多问题，本站已经迁移至新域名 9-ch.com

原域名 花鸟风月.com 将继续提供 api 服务至 2023-04-07 ，请尽快迁移使用 api.xn--7ovq92diups1e.com 的服务至新域名 api.9-ch.com

]]> 通过Python自动生成Beancount月度账单 https://blog.9-ch.com/post/homelab-beancount-bill/ Fri, 03 Feb 2023 14:37:13 +0800 https://blog.9-ch.com/post/homelab-beancount-bill/ 通过BQL查询生成Latex格式Beancount月度账单, 再导出为PDF后发送到邮箱 截图

背景

最近几个月开始使用 Beancount 记账, 并且每月通过 Github actions 自动生成一份 markdown 格式的汇总单(参考), 由于觉得显示效果不太好, 决定手撸一份新的生成程序

代码

文档生成

首先是生成 latex 文档的部分, 直接使用文本模板+占位符替换的模式实现, 这样就不用和 latex 的包打交道了(懒狗

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231

#!/usr/bin/env python3
# -*- coding: UTF-8 -*-

import datetime
from decimal import Decimal
from beancount import loader
from beancount.query import query
import calendar
import sys
import os
from dateutil.relativedelta import relativedelta
_template = r'''
\documentclass[UTF8]{ctexart}
\usepackage{multicol}
\usepackage{geometry}

\setlength\columnsep{1cm}
\geometry{a4paper,left=1.5cm,right=1.5cm,top=0cm,bottom=1.5cm}
\columnseprule=1pt

\title{Monthly Beancount Report}
\author{GitHub Actions}
\date{}

\begin{document}
\maketitle

\begin{center}\small
\textbf{\Large Statement of Comprehensive Income} \\
\date{ENV_YEAR-ENV_MONTH-01 to ENV_YEAR-ENV_MONTH-ENV_DAY}
\begin{multicols}{2}
\begin{center}
\textbf{Income Detail} \\
\begin{tabular*}{\hsize}{@{}@{\extracolsep{\fill}}lr@{}}
ACCOUNT & TOTAL(CNY) \\
\hline
ENV_LINES_INCOME
\end{tabular*}
\vfill\null
\begin{tabular*}{\hsize}{@{}@{\extracolsep{\fill}}lr@{}}
\hline
Total & ENV_TOTAL_INCOME \\
\end{tabular*}
\end{center}
\columnbreak
\begin{center}
\textbf{Expenses Detail} \\
\begin{tabular*}{\hsize}{@{}@{\extracolsep{\fill}}lr@{}}
ACCOUNT & TOTAL(CNY) \\
\hline
ENV_LINES_EXPENSES
\end{tabular*}
\vfill\null
\begin{tabular*}{\hsize}{@{}@{\extracolsep{\fill}}lr@{}}
\hline
Total & ENV_TOTAL_EXPENSES \\
\end{tabular*}
\end{center}
\end{multicols}
\begin{center}
\begin{tabular*}{\hsize}{@{}@{\extracolsep{\fill}}lr@{}}
\hline
Net Profit & ENV_NET_PROFIT \\
\end{tabular*}
\end{center}
\vfill\null
\textbf{\Large Statement of Financial Position} \\
\date{As of ENV_YEAR-ENV_MONTH-ENV_DAY}
\begin{multicols}{2}
\begin{center}
\textbf{Assets Detail} \\
\begin{tabular*}{\hsize}{@{}@{\extracolsep{\fill}}lr@{}}
ACCOUNT & TOTAL(CNY) \\
\hline
ENV_LINES_ASSETS
\end{tabular*}
\vfill\null
\begin{tabular*}{\hsize}{@{}@{\extracolsep{\fill}}lr@{}}
\hline
Total & ENV_TOTAL_ASSETS \\
\end{tabular*}
\end{center}
\columnbreak
\begin{center}
\textbf{Liabilities Detail} \\
\begin{tabular*}{\hsize}{@{}@{\extracolsep{\fill}}lr@{}}
ACCOUNT & TOTAL(CNY) \\
\hline
ENV_LINES_LIABILITIES
\end{tabular*}
\vfill\null
\begin{tabular*}{\hsize}{@{}@{\extracolsep{\fill}}lr@{}}
\hline
Total & ENV_TOTAL_LIABILITIES \\
\end{tabular*}
\end{center}
\end{multicols}
\begin{center}
\begin{tabular*}{\hsize}{@{}@{\extracolsep{\fill}}lr@{}}
\hline
Debt Ratio & ENV_DEBT_RATIO \\
\end{tabular*}
\vfill\null
\end{center}
\end{center}
\end{document}
'''


class Buffer:
    def __init__(self, value: str):
        self.value = value

    def replace(self, _old: str, _new: str):
        self.value = self.value.replace(_old, _new)

    def __str__(self):
        return self.value


if __name__ == '__main__':
    # load file
    ledger_data, errors, options = loader.load_file(
        os.path.join(os.getcwd(), sys.argv[1]))

    # init buffer
    _buffer = Buffer(_template)

    # init time
    lm = datetime.datetime.now() - relativedelta(months=1)
    year = lm.strftime("%Y")
    month = lm.strftime("%m")
    ENV_YEAR = year
    ENV_MONTH = month
    year = int(year)
    month = int(month)
    day = calendar.monthrange(year, month)[1]
    ENV_DAY = str(day)

    # ENV_LINES_INCOME
    sql_query = r'SELECT account, abs(sum(cost(position))) as total WHERE account ~ "^Income:*" and year = ' + \
        ENV_YEAR + r' and month = ' + ENV_MONTH + \
        r' GROUP BY month, account ORDER BY account, total DESC'
    rrows = query.run_query(ledger_data, options, sql_query, numberify=True)[1]
    ENV_LINES_INCOME = ""
    for rrow in rrows:
        ENV_LINES_INCOME += rrow[0] + r' & ' + \
            '{0:.2f}'.format(rrow[1]) + r' \\' + '\n'

    # ENV_TOTAL_INCOME
    sql_query = r'SELECT abs(sum(cost(position))) WHERE account ~ "^Income:*" and year = ' + \
        ENV_YEAR + r' and month =  ' + ENV_MONTH + r' GROUP BY month'
    rrows = query.run_query(ledger_data, options, sql_query, numberify=True)[1]
    ENV_TOTAL_INCOME = '{0:.2f}'.format(rrows[0][0])

    # ENV_LINES_EXPENSES
    sql_query = r'SELECT account, sum(cost(position)) as total WHERE account ~ "^Expenses:*" and year = ' + \
        ENV_YEAR + r' and month = ' + ENV_MONTH + \
        r' GROUP BY month, account ORDER BY account, total DESC'
    rrows = query.run_query(ledger_data, options, sql_query, numberify=True)[1]
    ENV_LINES_EXPENSES = ""
    for rrow in rrows:
        ENV_LINES_EXPENSES += rrow[0] + r' & ' + \
            '{0:.2f}'.format(rrow[1]) + r' \\' + '\n'

    # ENV_TOTAL_EXPENSES
    sql_query = r'SELECT sum(cost(position)) WHERE account ~ "^Expenses:*" and year = ' + \
        ENV_YEAR + r' and month = ' + ENV_MONTH + r' GROUP BY month'
    rrows = query.run_query(ledger_data, options, sql_query, numberify=True)[1]
    ENV_TOTAL_EXPENSES = '{0:.2f}'.format(rrows[0][0])

    # ENV_NET_PROFIT
    sql_query = r'SELECT abs(sum(cost(position))) WHERE year = ' + ENV_YEAR + r' and month = ' + \
        ENV_MONTH + \
        r' and ( account ~ "^Expenses:*" or account ~ "^Income:*" ) GROUP BY month'
    rrows = query.run_query(ledger_data, options, sql_query, numberify=True)[1]
    ENV_NET_PROFIT = '{0:.2f}'.format(rrows[0][0])

    # ENV_LINES_ASSETS
    sql_query = r'SELECT account, sum(cost(position)) as total WHERE account ~ "^Assets:*" and year <= ' + \
        ENV_YEAR + r' and month <= ' + ENV_MONTH + r' and day <= ' + \
        ENV_DAY+r' ORDER BY account, total DESC'
    rrows = query.run_query(ledger_data, options, sql_query, numberify=True)[1]
    ENV_LINES_ASSETS = ""
    for rrow in rrows:
        ENV_LINES_ASSETS += rrow[0] + r' & ' + \
            '{0:.2f}'.format(rrow[1]) + r' \\' + '\n'

    # ENV_TOTAL_ASSETS
    sql_query = r'SELECT sum(cost(position)) as total WHERE account ~ "^Assets:*" and year <= ' + \
        ENV_YEAR + r' and month <= ' + ENV_MONTH + r' and day <= '+ENV_DAY
    rrows = query.run_query(ledger_data, options, sql_query, numberify=True)[1]
    ENV_TOTAL_ASSETS = '{0:.2f}'.format(rrows[0][0])

    # ENV_LINES_LIABILITIES
    sql_query = r'SELECT account, abs(sum(cost(position))) as total WHERE account ~ "^Liabilities:*" and year <= ' + \
        ENV_YEAR + r' and month <= ' + ENV_MONTH + r' and day <= ' + \
        ENV_DAY+r' ORDER BY account, total DESC'
    rrows = query.run_query(ledger_data, options, sql_query, numberify=True)[1]
    ENV_LINES_LIABILITIES = ""
    for rrow in rrows:
        ENV_LINES_LIABILITIES += rrow[0] + r' & ' + \
            '{0:.2f}'.format(rrow[1]) + r' \\' + '\n'

    # ENV_TOTAL_LIABILITIES
    sql_query = r'SELECT abs(sum(cost(position))) as total WHERE account ~ "^Liabilities:*" and year <= ' + \
        ENV_YEAR + r' and month <= ' + ENV_MONTH + r' and day <= '+ENV_DAY
    rrows = query.run_query(ledger_data, options, sql_query, numberify=True)[1]
    ENV_TOTAL_LIABILITIES = '{0:.2f}'.format(rrows[0][0])

    # ENV_DEBT_RATIO
    ENV_DEBT_RATIO = "{:.2%}".format(
        Decimal(ENV_TOTAL_LIABILITIES)/Decimal(ENV_TOTAL_ASSETS)).replace(r'%', r'\%')

    _buffer.replace(r"ENV_YEAR", ENV_YEAR)
    _buffer.replace(r"ENV_MONTH", ENV_MONTH)
    _buffer.replace(r"ENV_DAY", ENV_DAY)

    _buffer.replace(r"ENV_LINES_INCOME", ENV_LINES_INCOME)
    _buffer.replace(r"ENV_TOTAL_INCOME", ENV_TOTAL_INCOME)
    _buffer.replace(r"ENV_LINES_EXPENSES", ENV_LINES_EXPENSES)
    _buffer.replace(r"ENV_TOTAL_EXPENSES", ENV_TOTAL_EXPENSES)
    _buffer.replace(r"ENV_NET_PROFIT", ENV_NET_PROFIT)

    _buffer.replace(r"ENV_LINES_ASSETS", ENV_LINES_ASSETS)
    _buffer.replace(r"ENV_TOTAL_ASSETS", ENV_TOTAL_ASSETS)
    _buffer.replace(r"ENV_LINES_LIABILITIES", ENV_LINES_LIABILITIES)
    _buffer.replace(r"ENV_TOTAL_LIABILITIES", ENV_TOTAL_LIABILITIES)
    _buffer.replace(r"ENV_DEBT_RATIO", ENV_DEBT_RATIO)

    print(_buffer)

可以在这个github 仓库查看后续更新

Github actions 配置

Github actions 配置部分比较简单, 每月月初定时生成后邮件发出即可

敏感信息已用*号代替, 请自行替换(邮箱密码需在 github 添加 secrets MAIL_PASSWORD)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

name: schedule-email
on:
  schedule:
    - cron: "30 16 1 */1 *"
  workflow_dispatch:
jobs:
  make-monthly-bill:
    name: make-monthly-bill
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@master
      - name: Set up Python3
        uses: actions/setup-python@v1
        with:
          python-version: "3.7"
      - uses: BSFishy/pip-action@v1
        with:
          packages: |
            beancount            
      - run: python3 tool/get_bill.py main.bean > report.tex
      - name: Github Action for LaTeX
        uses: xu-cheng/latex-action@v2
        with:
          root_file: report.tex
          latexmk_use_xelatex: true
      - name: send-email
        uses: dawidd6/action-send-mail@v3
        with:
          server_address: ******
          server_port: ******
          username: ******
          password: ${{secrets.MAIL_PASSWORD}}
          subject: Monthly Beancount Report
          attachments: ./report.pdf
          to: ******
          from: ******
]]> 通过DNS与Nginx锁定并加速Steam下载(CDN) https://blog.9-ch.com/post/homelab-steam-cdn/ Sat, 28 Jan 2023 17:08:11 +0800 https://blog.9-ch.com/post/homelab-steam-cdn/ 通过DNS与Nginx锁定并加速Steam下载(CDN) 更新记录
  • 2024-09-24: 简化配置, 通过lancache机制直接实现对CDN的控制

为什么要手动锁定

当使用透明网关对内网进行加速时(包括部分游戏加速器的特定工作模式), 会因为Steam根据当前ip判断自动切换到ip对应地区的下载CDN, 造成隧道流量的浪费甚至产生反效果导致下载缓慢

如何判断是否需要使用该方案

最简单的办法就是不做任何其他配置的情况下(若使用加速器需要先打开加速器), 打开 Steam--设置--下载 检查下载地区, 若显示为任意大陆地区城市则大概率不需要本方案修改(这个选项城市其实是假的, 只要是任意大陆城市本质都一样)

若显示为透明网关对应隧道/加速器ip地区, 则可以考虑使用本方案

另外也可以通过 Win+R 执行 steam://open/console 调出Steam控制台来查看信息判断

  1. 执行 user_info 查看IPCountry是否为CN
  2. 执行 download_sources 直接查看当前下载服务器是否为国内CDN

常见国内服务器域名可以在 CDN清单 查到

相关配置

本方案由两部分组成

  • DNS
  • Nginx

DNS

下面以ROS为例, 假设Nginx服务所在IP为内网192.168.1.100, 需要劫持的域名见如下配置

1
2

/ip dns static
add address=192.168.1.100 name=lancache.steamcontent.com

配置完毕后将PC的DNS指向ROS后即可, 另外也可以通过dstnat将dst port 53的udp流量直接劫持给ROS

以ROS ip 192.168.1.1, PC网段192.168.1.0/24为例, 解析劫持配置如下

1
2

/ip firewall nat
add action=dst-nat chain=dstnat comment="Hijacking for DNS" dst-port=53 protocol=udp src-address=192.168.1.0/24 to-addresses=192.168.1.1 to-ports=53

也可以直接在Steam运行机器通过Hosts文件配置

Nginx转发配置

可选的CDN很多, 这里以阿里云 xz.pphimalayanrt.com 为例, 若使用其他CDN修改配置中对应 server 与 Host 即可

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

upstream steam-upstream {
    server xz.pphimalayanrt.com;
}
server {
    listen 80;
    server_name lancache.steamcontent.com *.steamcontent.com;
    slice 8m;
    proxy_set_header Range $slice_range;
    location / {
        proxy_pass http://steam-upstream;
        proxy_set_header Host "xz.pphimalayanrt.com";
    }
}

若阿里云速度不理想可以参考 dogfight360 的这篇 blog 自行逐个测试, 根据自身网络选出最佳CDN

检查是否生效

随便下载个游戏, 检查Nginx日志, 会发现有大量的 Valve/Steam HTTP Client 1.0 访问记录, 即说明当前运行正常

其他方案

Dogfight360的 Steam下载CDN重定向 非常好用的锁定工具 除了每次要手动启动

]]> Emby 弹幕插件 https://blog.9-ch.com/post/homelab-emby-danmaku/ Mon, 08 Aug 2022 18:44:25 +0800 https://blog.9-ch.com/post/homelab-emby-danmaku/ Emby danmaku extension 截图

项目主页

RyoLee/emby-danmaku

安装

任意一种方式安装即可

浏览器方式(推荐)

  1. Tampermonkey
  2. 添加脚本

服务端方式

路径 /system/dashboard-ui/index.html 在</body>前添加如下标签

1

<script src="https://cdn.jsdelivr.net/gh/RyoLee/emby-danmaku@gh-pages/ede.user.js" defer></script>

客户端方式

类似服务端方式,解包后修改dashboard-ui/index.html再重新打包即可,iOS需要通过类似AltStore方式自签,请自行Google解决

界面

插件运行后会在界面左下侧追加4个新按钮,分别为:

  • 弹幕开关
  • 手动匹配
  • 简繁转换
  • 弹幕信息(触发右下角消息)

补充说明

弹幕来源为弹弹play 已开启弹幕聚合(A/B/C 站等弹幕融合)

因播放文件在emby中与上游弹弹play的名称可能存在不同(如"彻夜之歌"<–>“夜曲”),或因为存在多季/剧场版/OVA导致搜索匹配错误,首次播放时请检查当前弹幕信息是否正确匹配,若匹配错误可尝试手动匹配

匹配完成后对应关系会保存在浏览器本地存储中,后续播放(包括同季的其他集)会优先按照保存的匹配记录载入弹幕

TODO

  • 屏蔽规则导入
  • 简繁转换开关
  • 弹幕加载失败自动重试

参考项目

susundingkai/emby-danmaku

主要差异:

  • 配置存储改为 localstorage
  • 弹幕数据跨域问题通过 cloudflare 的 workers 处理绕过
  • 通过播放对象的 item id 从 emby 的 api 获取数据,不再使用页面对象提取,更新导致出错概率大幅下降(顺便修好了播放下一集不能加载的问题)

License

MIT License

]]> RouterOS 端口扫描防御 https://blog.9-ch.com/post/homelab-ros-anti-scan/ Mon, 06 Jun 2022 20:29:11 +0800 https://blog.9-ch.com/post/homelab-ros-anti-scan/ RouterOS 入侵检测 通过ROS防火墙检测并屏蔽端口扫描行为,并使用bark将屏蔽事件发送至手机

ROS配置

屏蔽列表IP

屏蔽BOT列表中的数据包,建议将这一条的优先级提高到最高(即编号#1)

1
2

/ip firewall raw
add action=drop chain=prerouting comment=ANTI-BOT src-address-list=BOT

指定端口方式

对于常见家用环境下不使用的高危TCP端口进行记录,在连续尝试3次(1分钟超时)后拉黑IP 7天

1
2
3
4

/ip firewall raw
add action=add-src-to-address-list address-list=BOT address-list-timeout=1w chain=prerouting comment=ANTI-SCAN dst-port=20-23,53,80,135,139,443,445,1433,2049,3389,5900,8080,8089 log=yes log-prefix=ANTI-SCAN protocol=tcp src-address-list=SCAN_S2
add action=add-src-to-address-list address-list=SCAN_S2 address-list-timeout=1m chain=prerouting comment=ANTI-SCAN dst-port=20-23,53,80,135,139,443,445,1433,2049,3389,5900,8080,8089 protocol=tcp src-address-list=SCAN_S1
add action=add-src-to-address-list address-list=SCAN_S1 address-list-timeout=1m chain=prerouting comment=ANTI-SCAN dst-port=20-23,53,80,135,139,443,445,1433,2049,3389,5900,8080,8089 in-interface-list=WAN protocol=tcp

PSD方式

如果觉得搞一堆端口配置太麻烦,也可以用内置的PSD来实现,默认规则为: 3秒内低位端口计3分,高位端口计1分,合计21分触发

实测默认规则针对端口批量扫描检出率较高,针对定向端口弱口令爆破识别效果稍差,建议自行调整参数,或者结合指定端口方式配置

1
2
3

/ip firewall raw
add action=add-src-to-address-list address-list=BOT address-list-timeout=1w chain=prerouting comment=ANTI-SCAN in-interface-list=WAN log=yes log-prefix=ANTI-SCAN protocol=tcp psd=21,3s,3,1
add action=add-src-to-address-list address-list=BOT address-list-timeout=1w chain=prerouting comment=ANTI-SCAN in-interface-list=WAN log=yes log-prefix=ANTI-SCAN protocol=udp psd=21,3s,3,1

Rsyslog配置

如果不需要推送屏蔽完成上述配置即可

假设接收日志机器ip为192.168.1.100

1
2
3
4

/system logging action
set remote=192.168.1.100 remote
/system logging
add action=remote topics=info

如果不需要其他消息可以在topics中加上firewall,仅过滤并转发防火墙的log

Linux配置

假设接收设备ip为192.168.1.100,ROS ip为192.168.1.1

修改/etc/rsyslog.conf如下部分,去除最前面的"#“解除注释,启用udp模式rsyslog接收ros发送过来的日志

1
2

module(load="imudp")
input(type="imudp" port="514")                              # 可按需修改端口,需要同步修改ros配置端口

再添加如下规则

1
2
3

:msg, contains, "ANTI-SCAN"     ^/opt/bark/router.sh        # 调用脚本处理并发送bark消息
:FROMHOST-IP, isequal,"192.168.1.1" /var/log/router.log     # 汇总ros日志
:FROMHOST-IP, isequal,"192.168.1.1" ~                       # 防止重复收集到message中

修改/etc/logrotate.d/rsyslog 在花括号前添加一行,配置日志老化

1

/var/log/router.log

创建脚本 /opt/bark/router.sh 并添加权限(chmod +x /opt/bark/router.sh),消息格式可自行按需调整

YOUR_BARK_SERVER 替换为BARK服务器ip/域名

YOUR_DEVICE_ID 替换为接收设备ID

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

#!/usr/bin/bash
msg=$(echo "$*" |tr " " "\n"|grep '\->'|grep -E "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"|tr -d ",")
curl -X "POST" "https://YOUR_BARK_SERVER/push" \
     -H 'Content-Type: application/json; charset=utf-8' \
     -d $'{
  "body": "已封禁:\n'$msg'",
  "device_key": "YOUR_DEVICE_ID",
  "level": "passive",
  "title": "IDS"
}'

重启rsyslog与logrotate服务使配置生效

1
2

systemctl restart rsyslog
systemctl restart logrotate
]]> iOS中国大陆工作日闹钟 https://blog.9-ch.com/post/homelab-cn-working-clock/ Fri, 29 Apr 2022 19:22:21 +0800 https://blog.9-ch.com/post/homelab-cn-working-clock/ iOS中国大陆工作日闹钟 简述

使用数据来自

半线上方案使用 Apple 官方中国节假日日历数据判断,不需要频繁联网同步 推荐使用

线上方案使用 cn_working_day 数据,使用 Github action 基于workalendar 自动生成近 30 天工作日信息

已知 BUG

  • 快捷指令无法操作健康添加的就寝闹钟: ios bug 待官方修复

半线上方案

导入&设定

快捷指令-中国大陆节假日闹钟

导入后编辑快捷指令第 4/12 行,手动选择对应的闹钟并保存

建议检查第 2 行日历是否为中国节假日, 以防导入未自动匹配正确的日历

自动化

为防止快捷指令运行异常时未能开启闹钟,这里参考被动安全概念,即通过复数个自动化任务先在每天凌晨无条件开启闹钟,再通过本快捷指令判断是否为休息日关闭

建议在每天 00:01 00:02 00:03 添加三个自动化执行开启闹钟,再在 01:00 02:00 03:00 添加三个自动化执行本快捷指令,6 个任务均关闭运行前询问,关闭运行时通知

线上方案

导入&设定

iOS 工作日闹钟快捷指令-工作日闹钟

当前版本 v1.1 已更新数据 URL

使用该快捷指令需配置 2 个闹钟,分别对应工作日和休息日,再编辑快捷指令找到如下部分,分别点击"工作日"/“休息日"改为需要的闹钟

  • [打开]闹钟"工作日”
  • [打开]闹钟"休息日"

因闹钟可能不存在或未配置闹钟名,[打开]闹钟可能会显示异常,请手动修改打开闹钟"工作日"/“休息日"为对应闹钟

请不要修改后面的部分,后面的关闭部分除非你要删除休息日闹钟,否则不需要手动修改

不需要休息日闹钟？

如果休息日想睡懒觉不需要闹钟,则删除以下 2 项

  • [打开]闹钟"休息日”
  • [关闭]闹钟"休息日闹钟"

自动化

自动化可以自行选择方案,比较常见的是在 快捷指令-自动化-创建个人自动化-打开"勿扰模式"模式时 添加运行本快捷指令利用勿扰模式触发自动运行

勿扰模式在 设置-专注模式-勿扰模式-自动打开 处添加 每天 00:10-06:00 配置,即可实现全自动触发

最新版本上已支持定时无操作触发,勿扰方式是旧版的老黄历了

新版直接如下操作即可:

快捷指令–>自动化–>"+"–>创建个人自动化–>特定时间–>修改时间(注意要在 0 点以后)并下一步–>添加操作–>运行快捷指令–>点选运行"工作日闹钟"并下一步–>取消勾选运行前询问–>完成

如果没有取消勾选运行前询问则为老版本,需要继续使用勿扰来绕过

其他

  1. 首次运行时会询问是否运行访问数据源网站,需要手动允许一次才能自动运行,不然会卡住
  2. 可以通过添加多个自动化的方式防止访问数据源失败(如工作日/休息日闹钟分别为 07:00/09:32,可以在 1/3/5 点分别加一个)
  3. 请求数据失败时,两个闹钟都会开启
]]> Gevjon -- YGO Master Duel工具 https://blog.9-ch.com/post/gevjon-home/ Sat, 23 Apr 2022 16:00:23 +0800 https://blog.9-ch.com/post/gevjon-home/ 支持识别控制器调用的卡查工具 Gevjon项目由核心(Core)与控制器(Observer)组成,核心可独立使用

组合使用时文件夹结构如下

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

Gevjon
├── Gevjon-Observer.pyw
├── LICENSE
├── README.md
├── cards.json
├── core
│   ├── Gevjon.exe
│   ├── Gevjon.exe.Config
│   ├── README.md
│   ├── data.json
│   └── version.txt
├── log.txt
├── requirements.txt
└── version.txt

Core

本项目为Gevjon项目组件core组件,仅提供卡查功能

界面操作

查询框输入查询内容后回车(或Ctrl+回车)进行查询,支持中日英三语(包括简中官方译名和日文ruby注音)

  • 模糊查询: Enter
  • 准确查询: Ctrl+Enter

下载方式

本项目使用Github Actions编译发布,构建完成后会自动发布到Release与gh-pages分支,并更新jsDeliver缓存

以下4个链接正常情况下内容均一致,请在下载后检查校验和是否一致,压缩包SHA256见Release页

  • Release-Latest

  • GH-Pages

  • GH-Pages-CDN-JSD*

  • GH-Pages-CDN-CF**

    * jsDelivr CDN加速缓存版本,发布更新时会尝试通知更新缓存,一般与上方两个链接内容一致,但少数情况下偶尔可能被墙

    ** Cloudflare CDN加速缓存版本,可能会存在更新延迟问题,仅建议其他3种方式均无法下载时使用

第三方调用方式

使用如下命名管道接收控制命令

\\.\pipe\GevjonCore

控制命令格式

  • mode: 查询模式
    • id: id搜索模式 //调整中
    • name: 卡名搜索模式 //调整中
    • issued: 控制器下发模式
  • id: YGOPro版本卡片ID
  • name: 卡名,支持简单的模糊搜索,比如"C107"可查询到卡片"混沌No.107 超银河眼时空龙"
  • data: 卡片数据,仅控制器下发模式生效,使用下发模式时,不会使用内部数据生成卡名,字段类型为string,内容为
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

{
	"cid": 11134,
	"id": 94415058,
	"cn_name": "星读之魔术师",
	"cnocg_n": "星读魔术师",
	"jp_ruby": "ほしよみのまじゅつし",
	"jp_name": "星読みの魔術師",
	"en_name": "Stargazer Magician",
	"text": {
		"types": "[怪兽|效果|灵摆] 魔法师/暗\n[★5] 1200/2400  1/1",
		"pdesc": "①：自己的灵摆怪兽进行战斗的场合，对方直到伤害步骤结束时魔法卡不能发动。\n②：另一边的自己的灵摆区域没有「魔术师」卡或者「异色眼」卡存在的场合，这张卡的灵摆刻度变成4。",
		"desc": "①：1回合1次，只让自己场上的灵摆怪兽1只因对方的效果回到自己手卡时才能发动。那1只同名怪兽从手卡特殊召唤。"
	}
}

可使用项目目录下PipeClient.py进行测试,请注意json需转义

1

.\PipeClient.py "{\"id\":\"\",\"name\":\"107\",\"mode\":\"name\"}"

数据更新

数据来源为mycard/ygopro-database (github.com),后续更新请自行下载，将locales文件夹拖放到DB/Cover.py脚本上生成data.json数据文件

v1.3.0以后版本数据来源为百鸽, 由于该来源api暂未提供版本跟踪相关信息,暂不提供自动更新检查(后续视情况增加), 已支持自动更新,感谢@mercury233

控制器

项目见 Gevjon-Observer

不同分支对应不同实现，以分支Readme文档为准

Python 内存读取实现

本分支为Python内存读取实现

基于SkywalkerJi/mdt: Yu-Gi-Oh! Master Duel (github.com)

请下载RyoLee/Gevjon并解压至core文件夹后,直接启动控制器(Gevjon-Observer.pyw)即可,核心会自动启动

当前版本Release已打包core

风险声明

本程序(Gevjon-Core)仅提供游戏王卡片查询功能,独立运行时与游戏无关,纯手动输入0风险

至于外接了其他控制器的情况,那要看控制器是怎么实现的了,例如控制器使用OCR实现,相对内存读取实现风险会低很多(因为特征上来看和主播开OBS直播是类似的的),但是也不是0风险

不管是基于内存读取还是图像识别/OCR,本质都是违反K社ToS的第三方软件,因为K社官方并没有发布任何API接口或SDK(以及配套的许可文档)允许第三方开发类似的工具

理论上检测很容易,不要以为只读不写/或者截图就安全,如果想查,反作弊程序给相关API下点钩子就能查,甚至暴力一点的会不管你的隐私信息直接用进程名的黑名单查(如TP之流)

实际上K社管不管那100%是他们内部决定的,只不过目前这个时间点他们没管,参考DL的经验他们可能也懒得管这种非恶意利用

总之,风险自负

License

MIT License

]]> RouterOS 通过 OSPF IP分流至 OpenWrt https://blog.9-ch.com/post/homelab-ros-ospf/ Wed, 20 Apr 2022 17:59:11 +0800 https://blog.9-ch.com/post/homelab-ros-ospf/ ROS ip 分流方案 更新

组网参考

Reflist:

主要适用于不想折腾PS/XBOX/Switch设备网关配置,又不希望出口网关为卵漏油/AIB的,或者怕折腾网络时家里断网影响家人的

遇到一些问题记录一下

ROS DDNS失效

表现: 域名解析ip不正确

原因: 分流后ROS内置ip cloud(DDNS)流量同样会被指向OpenWrt导致错误,尝试打标签bypass对应udp流量未成功,因为有公网IP所以直接改为通过域名服务商API更新对应解析为PPPOE接口地址

解决: 修改以下脚本中"CloudFlare variables"段内容即可.原始脚本见Mikrotik_CF_DDNS

Cloudflare DDNS ROS脚本(IPV4) 
  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120

#########################################################################
#         ==================================================            #
#         $ Mikrotik RouterOS update script for CloudFlare $            #
#         ==================================================            #
#                                                                       #
# - You need a CloudFlare account & api key (look under settings),      #
#   a zone and A record in it                                           #
# - All variables in first section are obvious,                         #
#   except CFid and CFzoneid                                            #
# - Obtain CFzoneid from Cloudflare Dashboard,                          #
#   on Overview tab scroll down                                         # 
#   To obtain CFid use following command in any unix shell:             #
#    curl -X GET "https://api.cloudflare.com/client/v4/zones/YOUR_ZONE_ID/dns_records?name=YOUR_DOMAIN" -H "Authorization:Bearer $CFtkn" -H "Content-Type: application/json" | python -mjson.tool
# - You can use my Postman script to get those variables                #
# - Enable CFDebug if needed - it'll print some info to logs            #
# - Enable CFcloud if you don't get a public IP on interface            #
# - Put script under /system scripts giving "read,write,ftp" policy access.       #
#   For 6.29 and older "test" policy is also needed.                    #
# - Add script to /system scheduler using it's name in "on-event"       #
# - Requires at least RouterOS 6.44beta75 for multiple header support   #
#                                                                       #
#              Credits for Samuel Tegenfeldt, CC BY-SA 3.0              #
#                        Modified by kiler129                           #
#                        Modified by viritt                             #
#                        Modified by asuna                              #
#                        Modified by mike6715b                          #
#                                                                       #
#               Tested and working as of February 22, 2021              #
#########################################################################

################# CloudFlare variables #################
:local CFDebug "false"
:local CFcloud "false"

:global WANInterface "[YOUR_WAN_INTERFACE_NAME]"

:local CFdomain "[YOUR_DOMAIN]"

:local CFtkn "[YOUR_CF_TOKEN]"

:local CFzoneid "[YOUR_CF_ZONE_ID]"
:local CFid "[YOUR_CF_ID]"

:local CFrecordType ""
:set CFrecordType "A"

:local CFrecordTTL ""
:set CFrecordTTL "60"

#########################################################################
########################  DO NOT EDIT BELOW  ############################
#########################################################################

:log info "Updating $CFDomain ..."

################# Internal variables #################
:local previousIP ""
:global WANip ""

################# Build CF API Url (v4) #################
:local CFurl "https://api.cloudflare.com/client/v4/zones/"
:set CFurl ($CFurl . "$CFzoneid/dns_records/$CFid");
 
################# Get or set previous IP-variables #################
:if ($CFcloud = "true") do={
    :set WANip [/ip cloud get public-address]
};

:if ($CFcloud = "false") do={
    :local currentIP [/ip address get [/ip address find interface=$WANInterface ] address];
    :set WANip [:pick $currentIP 0 [:find $currentIP "/"]];
};

:if ([/file find name=ddns.tmp.txt] = "") do={
    :log error "No previous ip address file found, createing..."
    :set previousIP $WANip;
    :execute script=":put $WANip" file="ddns.tmp";
    :log info ("CF: Updating CF, setting $CFDomain = $WANip")
    /tool fetch http-method=put mode=https output=none url="$CFurl" http-header-field="Authorization:Bearer $CFtkn,content-type:application/json" http-data="{\"type\":\"$CFrecordType\",\"name\":\"$CFdomain\",\"ttl\":$CFrecordTTL,\"content\":\"$WANip\"}"
    :error message="No previous ip address file found."
} else={
    :if ( [/file get [/file find name=ddns.tmp.txt] size] > 0 ) do={ 
    :global content [/file get [/file find name="ddns.tmp.txt"] contents] ;
    :global contentLen [ :len $content ] ;  
    :global lineEnd 0;
    :global line "";
    :global lastEnd 0;   
            :set lineEnd [:find $content "\n" $lastEnd ] ;
            :set line [:pick $content $lastEnd $lineEnd] ;
            :set lastEnd ( $lineEnd + 1 ) ;   
            :if ( [:pick $line 0 1] != "#" ) do={   
                #:local previousIP [:pick $line 0 $lineEnd ]
                :set previousIP [:pick $line 0 $lineEnd ];
                :set previousIP [:pick $previousIP 0 [:find $previousIP "\r"]];
            }
    }
}

######## Write debug info to log #################
:if ($CFDebug = "true") do={
 :log info ("CF: hostname = $CFdomain")
 :log info ("CF: previousIP = $previousIP")
 :log info ("CF: currentIP = $currentIP")
 :log info ("CF: WANip = $WANip")
 :log info ("CF: CFurl = $CFurl&content=$WANip")
 :log info ("CF: Command = \"/tool fetch http-method=put mode=https url=\"$CFurl\" http-header-field="Authorization:Bearer $CFtkn,content-type:application/json" output=none http-data=\"{\"type\":\"$CFrecordType\",\"name\":\"$CFdomain\",\"ttl\":$CFrecordTTL,\"content\":\"$WANip\"}\"")
};
  
######## Compare and update CF if necessary #####
:if ($previousIP != $WANip) do={
 :log info ("CF: Updating CF, setting $CFDomain = $WANip")
 /tool fetch http-method=put mode=https url="$CFurl" http-header-field="Authorization:Bearer $CFtkn,content-type:application/json" output=none http-data="{\"type\":\"$CFrecordType\",\"name\":\"$CFdomain\",\"ttl\":$CFrecordTTL,\"content\":\"$WANip\"}"
 /ip dns cache flush
    :if ( [/file get [/file find name=ddns.tmp.txt] size] > 0 ) do={
        /file remove ddns.tmp.txt
        :execute script=":put $WANip" file="ddns.tmp"
    }
} else={
 :log info "CF: No Update Needed!"
}

TCP流量握手缓慢

表现: 访问网站时打开缓慢,F12查看SSL阶段时间长度接近甚至超过10秒

原因: OP与ROS在同一网段,进出流量路由不对称,触发ROS防火墙动作

解决: 禁用ROS防火墙drop invalid规则(位于ip-firewall-filter rules)

ICMP(Ping)异常

表现: ping 被分流网段ip时黑洞

原因: 出口Op通过TProxy只能处理TCP/UDP流量

解决:

  • A: Op添加 ICMP劫持(假响应,可规避一些软件的报错)
  • B: ROS给ICMP流量打上bypass的route标签,再创建一个bypass路由表,该表不包含OSPF宣告的分流规则,所以如果没有被ISP之类的劫持就是裸连的真响应

Openwrt无法与被分流网段通信(循环)

表现: OpenWrt与被分流网段通信时不通

原因: ROS接到宣告的表后循环Op->ROS->Op->…

解决: 给Op流量打上标签,直接走bypass表

防火墙规则(Mangle)可参考

1

chain=prerouting action=mark-routing new-routing-mark=bypass passthrough=yes src-address=[BYPASS_DEVICE_IP] dst-address-list=!private log=no log-prefix=""

DNS CDN优化

表现: 不需要分流区域域名CDN解析为分流区域

原因: Op全局流量隧道,DNS解析也被隧道处理,导致CDN失效

解决: dnsmasq-full分流list外走国内DNS服务,list内走DoH,Op故障时回落全国内DNS服务

OpenWrt访问内网异常

表现: Op所在子网广播域外的其他子网访问Op时,无法正常响应

原因: Op走了bypass表,未添加其他子网路由,下一跳直接从pppoe-out出去了

解决: 防火墙匹配src address为op的ip,dst address为需要支持访问子网流量打上main标签走main路由表

]]>