merlin-ovpn-plex-pbr.sh

#!/bin/sh
#DEBUG= # uncomment/comment to enable/disable debug mode

#          name: merlin-ovpn-plex-pbr.sh
#       version: 2.0.0, 23-jul-2022, by eibgrad
#       purpose: route remote access of plex server back over wan
#       type(s): firewall-start
#          href: https://tinyurl.com/yc3atrep
#  installation:
#    1. enable jffs custom scripts and configs (administration->system)
#    2. ssh to router and copy/paste the following command:
#         curl -kLs bit.ly/merlin-installer|tr -d '\r'|sh -s i8hpNGpq
#    3. reboot

SCRIPTS_DIR="/jffs/scripts"
SCRIPT1="$SCRIPTS_DIR/merlin-ovpn-plex-pbr.sh"
SCRIPT2="$SCRIPTS_DIR/firewall-start"

mkdir -p $SCRIPTS_DIR

# ---------------------- DO NOT CHANGE BELOW THIS LINE ----------------------- #

# ------------------------ begin merlin-ovpn-plex-pbr ------------------------ #
cat << "EOF" > $SCRIPT1
#!/bin/sh
#set -x # uncomment/comment to enable/disable debug mode
{
TID='10'
FW_MARK='0x7000/0x7000'
PLEX_PORT='32400'

ipt() { iptables ${@/-[IA]/-D} 2>/dev/null; iptables $@; }

# cleanup from possible prior execution
{
ip rule del fwmark $FW_MARK table $TID
ip route flush table $TID
ip route flush cache
} 2>/dev/null

# build alternate routing table (default gateway = wan)
ip route show | grep -Ev '^0\.0\.0\.0/1 |^128\.0\.0\.0/1 ' \
  | while read route; do
        ip route add $route table $TID
    done

# note: the disabling of reverse path filtering may NOT be required in some
# cases; if you comment out the following command and it still works, you
# should continue to do so since it's more secure, but always start w/ it
# enabled until the script is working

# disable reverse path filtering
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 0 > $i; done

# start split tunnel
ip rule add fwmark $FW_MARK table $TID prio 9990

# force routing system to recognize changes
ip route flush cache

# route plex traffic in/out wan
ipt -t mangle -A PREROUTING -i br0 -p udp --sport $PLEX_PORT -j MARK --set-mark $FW_MARK
ipt -t mangle -A PREROUTING -i br0 -p tcp --sport $PLEX_PORT -j MARK --set-mark $FW_MARK
ipt -t mangle -A PREROUTING -i br0 -p udp --dport $PLEX_PORT -j MARK --set-mark $FW_MARK
ipt -t mangle -A PREROUTING -i br0 -p tcp --dport $PLEX_PORT -j MARK --set-mark $FW_MARK

exit 0
} 2>&1 | logger -t $(basename $0 .sh)[$$]
EOF
[ ${DEBUG+x} ] && sed -ri '2 s/^#(set -x)/\1/' $SCRIPT1
chmod +x $SCRIPT1
echo "installed: $SCRIPT1"
# ------------------------- end merlin-ovpn-plex-pbr ------------------------- #

# --------------------------- begin firewall-start --------------------------- #
create_script() {
cat << 'EOF' > $SCRIPT2
#!/bin/sh
#set -x # comment/uncomment to disable/enable debug mode
{
$SCRIPT1
} 2>&1 | logger -t $(basename $0)[$$]
EOF
[ ${DEBUG+x} ] && sed -ri '2 s/^#(set -x)/\1/' $SCRIPT2
sed "s:\$SCRIPT1:$SCRIPT1:g" -i $SCRIPT2
chmod +x $SCRIPT2
}

if [ -f $SCRIPT2 ]; then
    echo "error: $SCRIPT2 already exists; requires manual installation"
else
    create_script
    echo "installed: $SCRIPT2"
fi
# ---------------------------- end firewall-start ---------------------------- #