Refactor

docker/docker-compose.yml

@@ -0,0 +1,37 @@
+version: '2.4'
+
+services:
+  tun2socks:
+    image: ghcr.io/xjasonlyu/tun2socks:latest
+    cap_add:
+      - NET_ADMIN
+    devices:
+        - '/dev/net/tun:/dev/net/tun'
+    environment:
+      - GODEBUG=madvdontneed=1
+      - PROXY=
+      - LOGLEVEL=
+      - STATS=
+      - SECRET=
+      - EXCLUDED=
+      - EXTRACMD=
+    networks:
+      switch:
+        ipv4_address: 172.20.1.2
+    sysctls:
+      - net.ipv4.ip_forward=1
+      - net.ipv4.conf.all.rp_filter=0
+    restart: unless-stopped
+    container_name: tun2socks
+
+networks:
+  switch:
+    name: switch
+    ipam:
+      driver: default
+      config:
+        - subnet: '172.20.1.0/24'
+          gateway: 172.20.1.1
+    driver: macvlan
+    driver_opts:
+      parent: eth0

docker/entrypoint.sh

@@ -0,0 +1,78 @@
+#!/bin/sh
+
+TUN="${TUN:-tun0}"
+ETH="${ETH:-eth0}"
+TUN_ADDR="${TUN_ADDR:-198.18.0.1}"
+TUN_MASK="${TUN_MASK:-255.254.0.0}"
+LOGLEVEL="${LOGLEVEL:-INFO}"
+
+mk_tun() {
+  # params
+  NAME="$1"
+  ADDR="$2"
+  MASK="$3"
+  # create tun device
+  ip tuntap add mode tun dev "$NAME"
+  ip addr add "$ADDR/$MASK" dev "$NAME"
+  ip link set dev "$NAME" up
+}
+
+config_route() {
+  # params
+  TABLE="$1"
+  TUN_IF="$2"
+  ETH_IF="$3"
+  TUN_EXCLUDED="$4"
+
+  # add custom table
+  printf "%s\t%s\n" 100 "$TABLE" >>/etc/iproute2/rt_tables
+
+  # clone main route
+  ip route show table main |
+    while read -r route; do
+      ip route add ${route%linkdown*} table "$TABLE"
+    done
+
+  # config default route
+  ip route del default table "$TABLE"
+  ip route add default dev "$TUN_IF" table "$TABLE"
+
+  # policy routing
+  tun=$(ip -4 addr show "$TUN_IF" | awk 'NR==2 {print $2}')
+  eth=$(ip -4 addr show "$ETH_IF" | awk 'NR==2 {split($2,a,"/");print a[1]}')
+  ip rule add from "$eth" to "$tun" priority 1000 prohibit
+  ip rule add from "$eth" priority 2000 table main
+  ip rule add from all priority 3000 table "$TABLE"
+
+  # add tun excluded to route
+  for addr in $(echo "$TUN_EXCLUDED" | tr ',' '\n'); do
+    ip rule add to "$addr" table main
+  done
+}
+
+main() {
+  mk_tun "$TUN" "$TUN_ADDR" "$TUN_MASK"
+  config_route "tun2socks" "$TUN" "$ETH" "$EXCLUDED"
+
+  # execute extra commands
+  if [ -n "$EXTRACMD" ]; then
+    sh -c "$EXTRACMD"
+  fi
+
+  if [ -n "$STATS" ]; then
+    ARGS="--stats $STATS"
+  fi
+
+  if [ -n "$SECRET" ]; then
+    ARGS="$ARGS --secret $SECRET"
+  fi
+
+  exec tun2socks \
+    --loglevel "$LOGLEVEL" \
+    --interface "$ETH" \
+    --device "$TUN" \
+    --proxy "$PROXY" \
+    $ARGS
+}
+
+main || exit 1

docker/load_tun.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+
+# Create the necessary file structure for /dev/net/tun
+if [ ! -c /dev/net/tun ]; then
+  if [ ! -d /dev/net ]; then
+    mkdir -m 755 /dev/net
+  fi
+  mknod /dev/net/tun c 10 200
+  chmod 0755 /dev/net/tun
+fi
+
+# Load the tun module if not already loaded
+if ( ! (lsmod | grep -q "^tun\s")); then
+  insmod /lib/modules/tun.ko
+fi