· 8 years ago · Mar 23, 2018, 06:06 AM
1#!/bin/sh
2####################################################################################################
3# Script: IPSET_Netflix.sh
4# Author: Xentrk
5# 4-Mar-2018 Version 3.2
6# Collaborators: @Martineau, @thelonelycoder, @Adamm
7#
8# Thank you to @Martineau on snbforums.com for educating myself and others on Selective
9# Routing using Asuswrt-Merlin firmware.
10#
11#####################################################################################################
12# Script Description:
13#
14# The purpose of this script is for selective routing of Netflix traffic using
15# Autonomous System Numbers (ASNs). ASNs are assigned to entities such as Internet
16# Service Providers and other large organizations that control blocks of IP addresses.
17#
18# Netflix and other services that use Amazon AWS servers are blocking VPN's.
19#
20# This script will
21# 1. Create shared whitelist entry for ipinfo.io in /jffs/shared-SelectiveRouting-whitelist for use by AB-Solution and Skynet.
22# Otherwise, ipinfo.io may be blocked and the script will not work.
23# 2. Obtain the IPv4 addresses used by Netflix and Amazon AWS USA from ipinfo.io.
24# IPv6 addresses are excluded in this version.
25# 3. Create the IPSET list NETFLIX
26# 4. Add the IPv4 address to the IPSET list NETFLIX
27# 5. Route IPv4 addresses in IPSET list NETFLIX to WAN interface.
28#
29# Note 1: IPSET syntax differs between version 6 and 4.5
30# Syntax for ipset v6
31# ipset create WAN0 list:set
32# ipset add WAN0 setlist (e.g. SPEEDTEST)
33# for routers running ipset v4.5 (ipset -V)
34# ipset -N WAN0 setlist (e.g. SPEEDTEST)
35#
36# Note 2: In the event one needs to use IPv6 in the future, the syntax is: ipset -N NETFLIX-v6 hash:net family ipv6
37#
38# Note 3: Troubleshooting
39#
40# You can use these sites for AS validation and troubleshooting to lookup ASNs:
41#
42# https://bgp.he.net/AS16509 (Click on the prefixes tab to view IP addresses)
43# http://ipinfo.io/AS2906
44#
45# Note 4: Required OpenVPN Client Settings
46#
47# - Redirect Internet Traffic = Policy Rules or Policy Rules (Strict)
48# - Others?
49#
50#######################################################################
51logger -t "($(basename $0))" $$ Starting IPSET_Netflix.sh..." $0${*:+ $*}."
52
53# Uncomment for debugging
54set -x
55
56# Prevent script from running concurrently when called from nat-start
57
58PROGNAME=$(basename "$0")
59LOCKFILE_DIR=/tmp
60LOCK_FD=200
61
62lock() {
63 local prefix=$1
64 local fd=${2:-$LOCK_FD}
65 local lock_file=$LOCKFILE_DIR/$prefix.lock
66
67 # create lock file
68 eval "exec $fd>$lock_file"
69
70 # acquier the lock
71 flock -n $fd \
72 && return 0 \
73 || return 1
74}
75
76eexit() {
77 local error_str="$@"
78 echo $error_str
79 exit 1
80}
81
82main() {
83 lock $PROGNAME \
84 || eexit "Only one instance of $PROGNAME can run at one time."
85
86# Create shared-SelectiveRouting-whitelist file if one does not exist
87# to prevent ipinfo.io from being blocked by AB-Solution and Skynet
88
89if [ ! -s "/jffs/shared-SelectiveRouting-whitelist" ];then
90# create shared white list for ABS and Skynet"
91 echo "ipinfo.io" > /jffs/shared-SelectiveRouting-whitelist
92fi
93
94ipset create NETFLIX hash:net family inet hashsize 1024 maxelem 65536
95
96#Pull all IPv4s listed for Netflix USA - AS2906
97netsv4=`curl http://ipinfo.io/AS2906 2>/dev/null | grep -E "a href.*2906\/" | grep -v ":" |sed 's/^.*\">//; s/<.*//; /^\s*$/d'`
98for net in $netsv4
99do
100 ipset add NETFLIX $net
101done
102unset netsv4
103
104# Prevent entware funcion jq from executing until entware has mounted
105# Chk_Entware function provided by @Martineau
106
107Chk_Entware () {
108
109 # ARGS [wait attempts] [specific_entware_utility]
110
111 local READY=1 # Assume Entware Utilities are NOT available
112 local ENTWARE="opkg"
113 ENTWARE_UTILITY= # Specific Entware utility to search for
114 local MAX_TRIES=30
115
116 if [ ! -z "$2" ] && [ ! -z "$(echo $2 | grep -E '^[0-9]+$')" ];then
117 local MAX_TRIES=$2
118 fi
119
120 if [ ! -z "$1" ] && [ -z "$(echo $1 | grep -E '^[0-9]+$')" ];then
121 ENTWARE_UTILITY=$1
122 else
123 if [ -z "$2" ] && [ ! -z "$(echo $1 | grep -E '^[0-9]+$')" ];then
124 MAX_TRIES=$1
125 fi
126 fi
127
128 # Wait up to (default) 30 seconds to see if Entware utilities available.....
129 local TRIES=0
130
131 while [ $TRIES -lt $MAX_TRIES ];do
132 if [ ! -z "$(which $ENTWARE)" ] && [ "$($ENTWARE -v | grep -o "version")" == "version" ];then
133 if [ ! -z "$ENTWARE_UTILITY" ];then # Specific Entware utility installed?
134 if [ ! -z "$($ENTWARE list-installed $ENTWARE_UTILITY)" ];then
135 READY=0 # Specific Entware utility found
136 else
137 # Not all Entware utilities exists as a stand-alone package e.g. 'find' is in package 'findutils'
138 if [ -d /opt ] && [ ! -z "$(find /opt/ -name $ENTWARE_UTILITY)" ];then
139 READY=0 # Specific Entware utility found
140 fi
141 fi
142 else
143 READY=0 # Entware utilities ready
144 fi
145 break
146 fi
147 sleep 1
148 logger -st "($(basename $0))" $$ "Entware" $ENTWARE_UTILITY "not available - wait time" $((MAX_TRIES - TRIES-1))" secs left"
149 local TRIES=$((TRIES + 1))
150 done
151
152 return $READY
153}
154
155Chk_Entware 'jq' || { echo -e "\a***ERROR*** Entware" $ENTWARE_UTILITY "not available";exit 99; }
156
157# Download Amazon AWS json file
158wget https://ip-ranges.amazonaws.com/ip-ranges.json -O /jffs/scripts/ip-ranges.json
159
160# Create IPSET lists
161ipset create AMAZONAWS hash:net family inet hashsize 1024 maxelem 65536
162
163#Pull all IPv4s listed for Amazon AWS
164
165for IPv4 in `jq -r '.prefixes | .[].ip_prefix' < /jffs/scripts/ip-ranges.json`
166do
167 ipset add AMAZONAWS $IPv4
168done
169unset IPv4
170
171###########################################################
172#Create table to contain items added automatically by wan #
173###########################################################
174ip rule del prio 9990 > /dev/null 2>&1
175ip rule add from 0/0 fwmark 0x7000/0x7000 table main prio 9990
176
177iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set NETFLIX dst,dst -j MARK --set-mark 0x7000/0x7000 > /dev/null 2>&1
178iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set NETFLIX dst,dst -j MARK --set-mark 0x7000/0x7000
179
180iptables -t mangle -D PREROUTING -i br0 -p tcp -m set --match-set AMAZONAWS dst,dst -j MARK --set-mark 0x7000/0x7000 > /dev/null 2>&1
181iptables -t mangle -A PREROUTING -i br0 -p tcp -m set --match-set AMAZONAWS dst,dst -j MARK --set-mark 0x7000/0x7000
182
183logger -t "($(basename $0))" $$ Ending IPSET_Netflix.sh..." $0${*:+ $*}."
184}
185main