From 709616b7af1249af014ba6d2ea3e1538ee0a32fe Mon Sep 17 00:00:00 2001 From: nnduc Date: Mon, 31 Aug 2026 12:27:04 +0700 Subject: [PATCH] up --- .gitignore | 0 iptables/china-block.service | 13 ------ iptables/china-block.sh | 83 ------------------------------------ iptables/china-unblock.sh | 28 ------------ iptables/install.sh | 26 ----------- iptables/requirements.txt | 3 -- nvidia-suspend-fix.sh | 0 packages.txt | 13 +++--- unbound.sh | 0 9 files changed, 8 insertions(+), 158 deletions(-) mode change 100644 => 100755 .gitignore delete mode 100644 iptables/china-block.service delete mode 100755 iptables/china-block.sh delete mode 100755 iptables/china-unblock.sh delete mode 100755 iptables/install.sh delete mode 100644 iptables/requirements.txt mode change 100644 => 100755 nvidia-suspend-fix.sh mode change 100644 => 100755 packages.txt mode change 100644 => 100755 unbound.sh diff --git a/.gitignore b/.gitignore old mode 100644 new mode 100755 diff --git a/iptables/china-block.service b/iptables/china-block.service deleted file mode 100644 index 0395aea..0000000 --- a/iptables/china-block.service +++ /dev/null @@ -1,13 +0,0 @@ -[Unit] -Description=Block Chinese IP ranges via ipset + iptables -After=network-online.target -Wants=network-online.target - -[Service] -Type=oneshot -RemainAfterExit=yes -ExecStart=/usr/local/sbin/china-block.sh -ExecStop=/usr/local/sbin/china-unblock.sh - -[Install] -WantedBy=multi-user.target diff --git a/iptables/china-block.sh b/iptables/china-block.sh deleted file mode 100755 index f8425cc..0000000 --- a/iptables/china-block.sh +++ /dev/null @@ -1,83 +0,0 @@ -#!/bin/bash -set -e - -IPSET_NAME="china" -CIDR_FILE="/tmp/cn.cidr" - -SOURCES=( - "https://www.ipdeny.com/ipblocks/data/countries/cn.zone" - "https://raw.githubusercontent.com/mayaxcn/china-ip-list/master/chnroute.txt" -) - -echo "[*] Downloading CN IP ranges..." -for url in "${SOURCES[@]}"; do - echo " Trying $url ..." - wget -q "$url" -O "$CIDR_FILE" - if [[ $(wc -l < "$CIDR_FILE") -gt 10 ]]; then - echo " [+] Success: $(wc -l < "$CIDR_FILE") entries" - break - fi -done - -if [[ $(wc -l < "$CIDR_FILE") -lt 10 ]]; then - echo "[!] All sources failed. Aborting." - exit 1 -fi - -echo "[*] Creating ipset..." -ipset create "$IPSET_NAME" hash:net 2>/dev/null || ipset flush "$IPSET_NAME" - -echo "[*] Populating ipset..." -while IFS= read -r cidr; do - [[ -z "$cidr" || "$cidr" == \#* ]] && continue - ipset add "$IPSET_NAME" "$cidr" || true -done < "$CIDR_FILE" - -echo "[*] Applying iptables rules..." -iptables -A INPUT -m set --match-set "$IPSET_NAME" src -j DROP -iptables -A OUTPUT -m set --match-set "$IPSET_NAME" dst -j DROP - -echo "[*] Applying raw table rules (block UDP hole punch)..." -iptables -t raw -A PREROUTING -m set --match-set "$IPSET_NAME" src -j DROP -iptables -t raw -A OUTPUT -m set --match-set "$IPSET_NAME" dst -j DROP - -CIDR6_FILE="/tmp/cn6.cidr" -SOURCES6=( - "https://raw.githubusercontent.com/gaoyifan/china-operator-ip/ip-lists/china6.txt" - "https://raw.githubusercontent.com/ipverse/rir-ip/master/country/cn/ipv6-aggregated.txt" -) - -echo "[*] Downloading CN IPv6 ranges..." -for url in "${SOURCES6[@]}"; do - echo " Trying $url ..." - wget -q "$url" -O "$CIDR6_FILE" - if [[ $(wc -l < "$CIDR6_FILE") -gt 10 ]]; then - echo " [+] Success: $(wc -l < "$CIDR6_FILE") entries" - break - fi -done - -if [[ $(wc -l < "$CIDR6_FILE") -lt 10 ]]; then - echo "[!] All IPv6 sources failed. Skipping IPv6 blocking." -else - ipset create china6 hash:net family inet6 2>/dev/null || ipset flush china6 - while IFS= read -r cidr; do - [[ -z "$cidr" || "$cidr" == \#* ]] && continue - ipset add china6 "$cidr" || true - done < "$CIDR6_FILE" - - ip6tables -A INPUT -m set --match-set china6 src -j DROP - ip6tables -A OUTPUT -m set --match-set china6 dst -j DROP - ip6tables -t raw -A PREROUTING -m set --match-set china6 src -j DROP - ip6tables -t raw -A OUTPUT -m set --match-set china6 dst -j DROP -fi - -echo "[*] Saving rules..." -mkdir -p /etc/iptables -ipset save > /etc/ipset.conf -iptables-save > /etc/iptables/iptables.rules -ip6tables-save > /etc/iptables/ip6tables.rules -systemctl enable --now iptables -systemctl enable --now ip6tables 2>/dev/null || true - -echo "[+] Done! Chinese IPs are now blocked." \ No newline at end of file diff --git a/iptables/china-unblock.sh b/iptables/china-unblock.sh deleted file mode 100755 index e900611..0000000 --- a/iptables/china-unblock.sh +++ /dev/null @@ -1,28 +0,0 @@ -#!/bin/bash -set -e - -IPSET_NAME="china" - -echo "[*] Removing iptables rules..." -iptables -D INPUT -m set --match-set "$IPSET_NAME" src -j DROP 2>/dev/null || true -iptables -D OUTPUT -m set --match-set "$IPSET_NAME" dst -j DROP 2>/dev/null || true - -echo "[*] Removing raw table rules..." -iptables -t raw -D PREROUTING -m set --match-set "$IPSET_NAME" src -j DROP 2>/dev/null || true -iptables -t raw -D OUTPUT -m set --match-set "$IPSET_NAME" dst -j DROP 2>/dev/null || true - -echo "[*] Removing ip6tables rules..." -ip6tables -D INPUT -m set --match-set china6 src -j DROP 2>/dev/null || true -ip6tables -D OUTPUT -m set --match-set china6 dst -j DROP 2>/dev/null || true -ip6tables -t raw -D PREROUTING -m set --match-set china6 src -j DROP 2>/dev/null || true -ip6tables -t raw -D OUTPUT -m set --match-set china6 dst -j DROP 2>/dev/null || true - -echo "[*] Destroying ipsets..." -ipset destroy "$IPSET_NAME" 2>/dev/null || true -ipset destroy china6 2>/dev/null || true -rm -f /etc/ipset.conf /tmp/cn.cidr /tmp/cn6.cidr - -echo "[*] Clearing saved rules..." -rm -f /etc/iptables/iptables.rules /etc/iptables/ip6tables.rules - -echo "[+] Done! Chinese IPs are now unblocked." \ No newline at end of file diff --git a/iptables/install.sh b/iptables/install.sh deleted file mode 100755 index 0209716..0000000 --- a/iptables/install.sh +++ /dev/null @@ -1,26 +0,0 @@ -#!/bin/bash -set -e - -install_() { - install -m 755 china-block.sh /usr/local/sbin/china-block.sh - install -m 755 china-unblock.sh /usr/local/sbin/china-unblock.sh - install -m 644 china-block.service /etc/systemd/system/china-block.service - systemctl daemon-reload - systemctl enable --now china-block - echo "[+] china-block service installed and started." -} - -uninstall() { - systemctl disable --now china-block 2>/dev/null || true - rm -f /usr/local/sbin/china-block.sh - rm -f /usr/local/sbin/china-unblock.sh - rm -f /etc/systemd/system/china-block.service - systemctl daemon-reload - echo "[+] china-block service removed." -} - -case "${1:-install}" in - install) install_ ;; - uninstall) uninstall ;; - *) echo "Usage: $0 [install|uninstall]"; exit 1 ;; -esac diff --git a/iptables/requirements.txt b/iptables/requirements.txt deleted file mode 100644 index 2e1cfa2..0000000 --- a/iptables/requirements.txt +++ /dev/null @@ -1,3 +0,0 @@ -ipset -wget -ufw \ No newline at end of file diff --git a/nvidia-suspend-fix.sh b/nvidia-suspend-fix.sh old mode 100644 new mode 100755 diff --git a/packages.txt b/packages.txt old mode 100644 new mode 100755 index 97e07c4..5166f47 --- a/packages.txt +++ b/packages.txt @@ -6,22 +6,25 @@ bluez-utils calibre clang cronie -cuda docker docker-compose extra-cmake-modules fastfetch fcitx5-configtool fcitx5-gtk +fcitx5-qt +fcitx5-unikey feh firefox flameshot flatpak fuse2 fzf -gparted grub-btrfs htop +i3-wm +i3lock +imagemagick inkscape intel-ucode kbibtex @@ -48,12 +51,13 @@ ranger ripgrep rsync rust-analyzer +scrot scx-tools sddm signal-desktop snap-pac +snixembed sof-firmware -steam strawberry swaybg swayidle @@ -66,8 +70,7 @@ thunderbird unbound vala vlc -wezterm wireguard-tools -xfce4-terminal xorg-xinput +xwallpaper zram-generator diff --git a/unbound.sh b/unbound.sh old mode 100644 new mode 100755