刚入手一只如意云 RY-1A 机器,第一次用OpenWRT
配置文件如下:
firewall.user
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4A7D7F66|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4A7D9B66|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4A7D2766|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4A7D2771|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|BDA31105|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D155E58A|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|F9812E30|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|80797E8B|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|9F6A794B|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|A9840D67|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|C043C606|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|CA6A0102|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|CAB50755|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|CBA1E6AB|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|CB620741|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|CF0C5862|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D0381F2B|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D1913632|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D1DC1EAE|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D1244921|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D35E4293|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D5A9FB23|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D8DDBCB6|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D8EAB30D|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|F3B9BB27|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|253D369E|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|042442B2|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|2E52AE44|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|3B1803AD|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|402158A1|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4021632F|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4042A3FB|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4168CAFC|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|41A0DB71|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|422DFCED|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|480ECD68|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|480ECD63|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4E10310F|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|0807C62D|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|5D2E0859|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|FD9D0EA5|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|364C8701|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|1759053C|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|31027B38|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4D04075C|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|C504040C|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|76053106|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|BC050460|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|BDA31105|" --from 60 --to 180? -j DROP
iptables -t mangle -I FORWARD -o tun+ -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -i tun+ -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -A OUTPUT -o tun+ -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
/etc/config/network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config interface 'lan'
option type 'bridge'
option proto 'static'
option netmask '255.255.255.0'
option macaddr '00:86:33:50:08:74'
option ifname 'eth2.1'
option ipaddr '192.168.2.1'
option dns '223.5.5.5'
config interface 'wan'
option ifname 'eth2.2'
option proto 'static'
option netmask '255.255.255.0'
option gateway '192.168.1.1'
option dns '223.5.5.5'
option ipaddr '192.168.1.11'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 3 8t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '4 8t'
配置文件如下:
firewall.user
# This file is interpreted as shell script.
# Put your custom iptables rules here, they will
# be executed with each firewall (re-)start.
# Internal uci firewall chains are flushed and recreated on reload, so
# put custom rules into the root chains e.g. INPUT or FORWARD or into the
# special user chains, e.g. input_wan_rule or postrouting_lan_rule.
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4A7D7F66|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4A7D9B66|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4A7D2766|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4A7D2771|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|BDA31105|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D155E58A|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|F9812E30|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|80797E8B|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|9F6A794B|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|A9840D67|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|C043C606|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|CA6A0102|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|CAB50755|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|CBA1E6AB|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|CB620741|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|CF0C5862|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D0381F2B|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D1913632|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D1DC1EAE|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D1244921|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D35E4293|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D5A9FB23|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D8DDBCB6|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|D8EAB30D|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|F3B9BB27|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|253D369E|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|042442B2|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|2E52AE44|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|3B1803AD|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|402158A1|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4021632F|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4042A3FB|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4168CAFC|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|41A0DB71|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|422DFCED|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|480ECD68|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|480ECD63|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4E10310F|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|0807C62D|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|5D2E0859|" --from 60 --to 180 -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|FD9D0EA5|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|364C8701|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|1759053C|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|31027B38|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|4D04075C|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|C504040C|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|76053106|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|BC050460|" --from 60 --to 180? -j DROP
iptables -t mangle -I PREROUTING -p udp --sport 53 -m string --algo bm --hex-string "|BDA31105|" --from 60 --to 180? -j DROP
iptables -t mangle -I FORWARD -o tun+ -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -I FORWARD -i tun+ -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -A OUTPUT -o tun+ -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
/etc/config/network
config interface 'loopback'
option ifname 'lo'
option proto 'static'
option ipaddr '127.0.0.1'
option netmask '255.0.0.0'
config interface 'lan'
option type 'bridge'
option proto 'static'
option netmask '255.255.255.0'
option macaddr '00:86:33:50:08:74'
option ifname 'eth2.1'
option ipaddr '192.168.2.1'
option dns '223.5.5.5'
config interface 'wan'
option ifname 'eth2.2'
option proto 'static'
option netmask '255.255.255.0'
option gateway '192.168.1.1'
option dns '223.5.5.5'
option ipaddr '192.168.1.11'
config switch_vlan
option device 'switch0'
option vlan '1'
option ports '0 1 2 3 8t'
config switch_vlan
option device 'switch0'
option vlan '2'
option ports '4 8t'
