mirror of
https://github.com/3proxy/3proxy.git
synced 2026-08-26 09:55:48 +08:00
2cbdc6e845
3proxy is not in the OpenWrt feed, and the static binaries built here install
nowhere in particular: they carry no service definition, no configuration and
no way to survive a sysupgrade.
Add the package as it would be submitted to openwrt/packages - a Makefile, a
procd init script and a UCI schema. Built in the 24.10 SDK for mipsel_24kc
against the distribution's libraries, so the result is a 220kB package
depending on libopenssl and libpcre2 rather than a static binary, with TLS and
PCRE support actually present.
3proxy.cfg is order dependent, which is the whole difficulty of generating it
from UCI, where sections are unordered:
- access rules are named sections referenced by a service through an ordered
list, so the reference order decides precedence, and the list is flushed
before each service so rules do not leak into the next one
- parent proxies extend the allow rule they follow, so they hang off the
access rule rather than the service
- the TLS switches apply to every service below them, so the generator
tracks what is in effect and emits a directive only when a service needs a
different state, rather than letting certificate spoofing leak into a
service that did not ask for it
- bandwidth, connection and counter limits are global and match on their own
ACL pattern, so they are a separate ordered list
Nothing is enabled by default: the global switch is off, no service ships
enabled, and a service section that omits the option does not start either, so
installing the package opens no ports.
Values that would make 3proxy reject the whole configuration at boot are
checked while writing it - unknown access actions, limiter types, pcre types
and actions - and reported instead of being passed through.
60 lines
1.6 KiB
Plaintext
60 lines
1.6 KiB
Plaintext
config 3proxy 'global'
|
|
option enabled '0'
|
|
option nscache '65536'
|
|
# option nscache6 '65536'
|
|
# static records, added to the cache; 0.0.0.0 blackholes a name
|
|
# list nsrecord 'ads.example.com 0.0.0.0'
|
|
option maxconn '128'
|
|
option auth 'iponly'
|
|
option log 'syslog'
|
|
# option timeouts '1 5 30 60 180 1800 15 60 15 5 5'
|
|
# list include '/etc/3proxy/extra.cfg'
|
|
list nserver '8.8.8.8'
|
|
list nserver '8.8.4.4'
|
|
# list user 'admin:CL:password'
|
|
# list extra_config 'timeouts 1 5 30 60 180 1800 15 60'
|
|
# access list used by services which do not define their own
|
|
list acl 'lan'
|
|
|
|
# Access rules are named sections referenced by services. The order of the
|
|
# references decides precedence: 3proxy stops at the first rule that matches.
|
|
config acl 'lan'
|
|
option action 'allow'
|
|
option src '192.168.1.0/24'
|
|
|
|
config acl 'deny_private'
|
|
option action 'deny'
|
|
option dst '10.0.0.0/8,172.16.0.0/12,192.168.0.0/16'
|
|
|
|
#config acl 'via_upstream'
|
|
# option action 'allow'
|
|
# list parent 'upstream'
|
|
|
|
# Parent proxies extend an allow rule to build a chain. Weights group them:
|
|
# parents whose weights sum to 1000 form one group and one is picked at random,
|
|
# several groups are chained in order.
|
|
#config parent 'upstream'
|
|
# option weight '1000'
|
|
# option type 'socks5'
|
|
# option ip '10.0.0.1'
|
|
# option port '1080'
|
|
# option username ''
|
|
# option password ''
|
|
|
|
config service 'proxy'
|
|
option enabled '0'
|
|
option type 'proxy'
|
|
option port '3128'
|
|
# option bind ''
|
|
# option external ''
|
|
# option extra ''
|
|
# option auth 'strong'
|
|
list acl 'deny_private'
|
|
list acl 'lan'
|
|
|
|
config service 'socks'
|
|
option enabled '0'
|
|
option type 'socks'
|
|
option port '1080'
|
|
list acl 'lan'
|