|
#!/bin/sh |
|
|
|
# ============================================================================== |
|
# VPN Director - Cloudflare CIDR Updater |
|
# |
|
# This script automatically fetches the latest Cloudflare IPv4 CIDRs, |
|
# compares them against the currently configured rules in VPN Director, |
|
# and updates the rule list if any changes are detected. |
|
# |
|
# It correctly parses and generates the concatenated rule format. |
|
# Designed for POSIX-compliant shells (e.g., ash on BusyBox). |
|
# ============================================================================== |
|
|
|
# --- Configuration --- |
|
readonly RULE_PREFIX="Cloudflare v4_" |
|
readonly VPN_CLIENT_ID="WGC1" |
|
readonly RULES_FILE="/jffs/openvpn/vpndirector_rulelist" |
|
readonly LOCAL_SUBNET="" # (Optional) Specify a subnet (e.g., 192.168.1.0/24) or a single IP address to restrict the Cloudflare rules to a specific local network segment or client. |
|
# Leave empty ("") to apply the rules to ALL clients on the router. |
|
# Example: LOCAL_SUBNET="192.168.1.0/24" will only route traffic from this subnet through the VPN for Cloudflare IPs. |
|
# Use for testing |
|
#readonly RULES_FILE="./vpndirector_rulelist" |
|
|
|
# --- Script Logic --- |
|
set -e |
|
set -u |
|
set -o pipefail |
|
|
|
readonly TEMP_DIR="/tmp/cf_updater_$$" |
|
mkdir "$TEMP_DIR" |
|
trap 'rm -rf -- "$TEMP_DIR"' EXIT |
|
|
|
readonly NEW_CIDRS_FILE="$TEMP_DIR/cloudflare_cidrs_new.txt" |
|
readonly OLD_CIDRS_FILE="$TEMP_DIR/cloudflare_cidrs_old.txt" |
|
readonly NEW_CF_RULES_FILE="$TEMP_DIR/cloudflare_rules_new.txt" |
|
readonly OLD_CF_RULES_FILE="$TEMP_DIR/cloudflare_rules_old.txt" |
|
|
|
logger -sc -t "Cloudflare CIDR VPN Director Updater" -p user.notice "INFO: Starting Cloudflare CIDR update process." |
|
|
|
# Step 1: Fetch the latest Cloudflare IPv4 CIDRs. |
|
intrfce=$(echo "$VPN_CLIENT_ID" | awk '{print tolower($0)}') |
|
logger -sc -t "Cloudflare CIDR VPN Director Updater" -p user.notice "INFO: Fetching latest Cloudflare IPv4 CIDRs..." |
|
if ! curl --interface "$intrfce" -s "https://api.cloudflare.com/client/v4/ips" | jq -r '.result.ipv4_cidrs[]' > "$NEW_CIDRS_FILE"; then |
|
logger -sc -t "Cloudflare CIDR VPN Director Updater" -p user.error "ERROR: Failed to fetch or parse Cloudflare IPs. Exiting." |
|
exit 1 |
|
fi |
|
|
|
if [ ! -s "$NEW_CIDRS_FILE" ]; then |
|
logger -sc -t "Cloudflare CIDR VPN Director Updater" -p user.error "ERROR: Fetched CIDR list is empty. Exiting." |
|
exit 1 |
|
fi |
|
|
|
# Step 2: Extract currently configured Cloudflare rules block. |
|
logger -sc -t "Cloudflare CIDR VPN Director Updater" -p user.notice "INFO: Extracting existing Cloudflare rules from $RULES_FILE..." |
|
if [ -f "$RULES_FILE" ] && [ -s "$RULES_FILE" ]; then |
|
# Extract the full Cloudflare rules block (not just CIDRs) |
|
awk -F'>' -v prefix="^${RULE_PREFIX}" 'BEGIN{RS="<"; ORS=""} NF>0 && $2 ~ prefix {print "<"$0}' "$RULES_FILE" > "$OLD_CF_RULES_FILE" |
|
else |
|
logger -sc -t "Cloudflare CIDR VPN Director Updater" -p user.notice "INFO: Rules file does not exist or is empty. Will create it." |
|
: > "$OLD_CF_RULES_FILE" |
|
fi |
|
|
|
# Step 3: Generate the new block of Cloudflare rules. |
|
NEW_CLOUDFLARE_RULES_BLOCK="" |
|
counter=0 |
|
while IFS= read -r cidr; do |
|
label="${RULE_PREFIX}${counter}" |
|
NEW_CLOUDFLARE_RULES_BLOCK="${NEW_CLOUDFLARE_RULES_BLOCK}<1>${label}>${LOCAL_SUBNET}>${cidr}>${VPN_CLIENT_ID}" |
|
counter=$((counter + 1)) |
|
done < "$NEW_CIDRS_FILE" |
|
echo -n "$NEW_CLOUDFLARE_RULES_BLOCK" > "$NEW_CF_RULES_FILE" |
|
|
|
# Step 4: Compare the new and existing Cloudflare rules blocks. |
|
logger -sc -t "Cloudflare CIDR VPN Director Updater" -p user.notice "INFO: Comparing new and existing Cloudflare rules block..." |
|
if cmp -s "$OLD_CF_RULES_FILE" "$NEW_CF_RULES_FILE"; then |
|
logger -sc -t "Cloudflare CIDR VPN Director Updater" -p user.notice "INFO: No changes detected in Cloudflare rules. No update necessary. Exiting." |
|
exit 0 |
|
fi |
|
|
|
logger -sc -t "Cloudflare CIDR VPN Director Updater" -p user.notice "INFO: Changes detected. Proceeding with rule update." |
|
|
|
# Step 5: Extract all non-Cloudflare rules. |
|
CUSTOM_RULES_BLOCK="" |
|
if [ -f "$RULES_FILE" ] && [ -s "$RULES_FILE" ]; then |
|
CUSTOM_RULES_BLOCK=$(awk -F'>' -v prefix="^${RULE_PREFIX}" 'BEGIN{RS="<"; ORS=""} NF>0 && $2 !~ prefix {print "<"$0}' "$RULES_FILE") |
|
fi |
|
|
|
# Step 6: Combine custom rules with the new Cloudflare rules by simple concatenation. |
|
FINAL_RULE_LIST="${CUSTOM_RULES_BLOCK}${NEW_CLOUDFLARE_RULES_BLOCK}" |
|
|
|
# Step 7: Atomically update the rule list and apply changes. |
|
logger -sc -t "Cloudflare CIDR VPN Director Updater" -p user.notice "INFO: Writing new rules to $RULES_FILE and applying changes." |
|
echo -n "$FINAL_RULE_LIST" > "$RULES_FILE.tmp" |
|
mv "$RULES_FILE.tmp" "$RULES_FILE" |
|
service restart_vpndirector |
|
|
|
logger -sc -t "Cloudflare CIDR VPN Director Updater" -p user.notice "SUCCESS: VPN Director rules updated successfully." |
|
exit 0 |
"02-wgclient-start" - отличный скипт (большое вам спасибо за него!), но к сожалению он у меня перестаёт срабатывать со всё большим количеством хостингов. :(