Fixed for 24

Added openwrt 24.10
Merge pull request #33 from Akiyamov/master
2025-12-23 07:33:37 +05:00 · 2024-12-16 10:23:45 +03:00 · 2024-12-16 00:23:42 +03:00 · 2024-12-16 00:17:23 +03:00 · 2024-12-05 18:35:01 +05:00 · 2024-12-05 15:55:03 +05:00
13 changed files with 1498 additions and 574 deletions
--- a/.github/workflows/public-galaxy.yml
+++ b/.github/workflows/public-galaxy.yml
@@ -0,0 +1,17 @@
+name: Public to Ansible Galaxy
+
+on:
+  push:
+    tags:
+      - '*'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - name: checkout
+        uses: actions/checkout@v4
+      - name: Publish Ansible role to Galaxy
+        uses: robertdebock/galaxy-action@1.2.1
+        with:
+          galaxy_api_key: ${{ secrets.galaxy_api_key }}
--- a/README.EN.md
+++ b/README.EN.md
@@ -0,0 +1,117 @@
+Domain routing OpenWrt
+=========
+
+Configuring domain routing on Openwrt router.
+
+
+Role Variables
+--------------
+
+Lists
+```
+  country: russia-inside|russia-outside|ukraine
+  list_domains: true|falase
+
+  list_subnet: false|true
+  list_ip: false|true
+  list_community: false|true
+```
+
+Tunnel
+```
+  tunnel: wg|openvpn|singbox|tun2socks
+```
+
+DoH or DoT
+```
+  dns_encrypt: false|dnscrypt|stubby
+```
+
+Nano package
+```
+  nano: true|false
+```
+
+Acces from wg network to router
+```
+  wg_access: false|true
+  wg_access_network: 192.168.80.0/24 (for example)
+```
+
+If wireguard is used:
+```
+    wg_server_address: wg-server-host
+    wg_private_key: privatekey-client
+    wg_public_key: publickey-client
+    wg_preshared_key: presharedkey-client
+    wg_client_port: 51820
+    wg_client_address: ip-client
+
+    wg_access: true
+    wg_access_network: wg-network
+```
+
+Dependencies
+------------
+
+[gekmihesg.openwrt](https://github.com/gekmihesg/ansible-openwrt)
+
+
+Example Playbook
+----------------
+
+The inventory file must contain the group `[openwrt]` where your router will be located.
+
+
+Wireguard, only domains, stubby, Russia, acces from wg network, host 192.168.1.1
+```
+- hosts: 192.168.1.1
+  remote_user: root
+
+  roles:
+    - itdoginfo.domain_routing_openwrt
+
+  vars:
+    tunnel: wg
+    dns_encrypt: stubby
+    country: russia-inside
+    
+    wg_access: true
+    wg_server_address: wg-server-host
+    wg_private_key: privatekey-client
+    wg_public_key: publickey-client
+    wg_preshared_key: presharedkey-client
+    wg_listen_port: 51820
+    wg_client_port: 51820
+    wg_client_address: ip-client
+    wg_access_network: wg-network
+```
+
+Sing-box, stubby, Russia
+```
+- hosts: 192.168.1.1
+  remote_user: root
+
+  roles:
+    - itdoginfo.domain_routing_openwrt
+
+  vars:
+    tunnel: singbox
+    dns_encrypt: stubby
+    country: russia-inside
+
+  tasks:
+  - name: sing-box config
+    template:
+      src: "templates/openwrt-sing-box-json.j2"
+      dest: "/etc/sing-box/config.json"
+      mode: 0644
+    notify:
+      - Restart sing-box
+      - Restart network
+```
+
+License
+-------
+
+GNU General Public License v3.0
--- a/README.md
+++ b/README.md
@@ -1,62 +1,173 @@
+[English role README](https://github.com/itdoginfo/domain-routing-openwrt/blob/master/README.EN.md)
+
 # Описание
-Shell скрипт и playbook для Ansible. Автоматизируют настройку OpenWrt роутера для обхода блокировок по доменам и спискам IP-адресов.
+Shell скрипт и [роль для Ansible](https://galaxy.ansible.com/ui/standalone/roles/itdoginfo/domain_routing_openwrt). Автоматизируют настройку роутера на OpenWrt для роутинга по доменам и спискам IP-адресов.

-Полное описание происходящего: [Статья на хабре](https://habr.com/ru/articles/767464/)
+Полное описание происходящего:
+- [Статья на хабре](https://habr.com/ru/articles/767464/)
+- [Копия в моём блоге](https://itdog.info/tochechnyj-obhod-blokirovok-po-domenam-na-routere-s-openwrt/)

-[Копия в моём блоге](https://itdog.info/tochechnyj-obhod-blokirovok-po-domenam-na-routere-s-openwrt/)
-
-## Скрипт для установки
-Запуск без скачивания
+# Скрипт для установки
 ```
-sh <(wget -O - https://raw.githubusercontent.com/itdoginfo/ansible-openwrt-hirkn/master/getdomains-install.sh)
+sh <(wget -O - https://raw.githubusercontent.com/itdoginfo/domain-routing-openwrt/master/getdomains-install.sh)
 ```

-Запуск со скачиванием
+# Скрипт для удаления
 ```
-wget https://raw.githubusercontent.com/itdoginfo/ansible-openwrt-hirkn/master/getdomains-install.sh && sh getdomains-install.sh
+sh <(wget -O - https://raw.githubusercontent.com/itdoginfo/domain-routing-openwrt/refs/heads/master/getdomains-uninstall.sh)
 ```

-Подробности описаны в статье указаной выше.
+## AmneziaWG
+Через этот скрипт можно установить Amnezia wireguard. Скрипт проверяет наличие пакетов под вашу платформу в [стороннем репозитории](https://github.com/Slava-Shchipunov/awg-openwrt/releases), так как в официальном репозитории OpenWRT они отсутствуют, и автоматически их устанавливает.

-## Ansible
-Для взаимодействия c OpenWRT используется модуль [gekmihesg/ansible-openwrt](https://github.com/gekmihesg/ansible-openwrt)
+Если вам нужно установить только AWG, воспользуйтесь скриптом в репозитории: https://github.com/Slava-Shchipunov/awg-openwrt

-Домены берутся из [отсюда](https://github.com/itdoginfo/allow-domains). Списки IP-адресов берутся с [antifilter.download](https://antifilter.download/)
+Если подходящих пакетов нет, перед настройкой необходимо будет самостоятельно [собрать бинарники AmneziaWG](https://github.com/itdoginfo/domain-routing-openwrt/wiki/Amnezia-WG-Build) для своего устройства и установить их.
+
+## Скрипт для проверки конфигурации
+Написан для OpenWrt 23.05 и 22.03. На 21.02 работает только половина проверок.
+
+[x] - не обязательно означает, что эта часть не работает. Но это повод для ручной проверки.
+
+### Запуск
+```
+wget -O - https://raw.githubusercontent.com/itdoginfo/domain-routing-openwrt/master/getdomains-check.sh | sh
+```
+
+По-умолчанию запускается на русском языке. Если нужно запустить на английском, то после `sh` нужно добавить `-s --lang en`. Аналогично для проверок на подмену DNS и создания дампа.
+
+```
+wget -O - https://raw.githubusercontent.com/itdoginfo/domain-routing-openwrt/master/getdomains-check.sh | sh -s --lang en
+```
+
+### Запустить с проверкой на подмену DNS
+```
+wget -O - https://raw.githubusercontent.com/itdoginfo/domain-routing-openwrt/master/getdomains-check.sh | sh -s dns
+```
+
+### Запустить с созданием dump
+Все чувствительные переменные затираются.
+
+```
+wget -O - https://raw.githubusercontent.com/itdoginfo/domain-routing-openwrt/master/getdomains-check.sh | sh -s dump
+```
+
+Поиск ошибок вручную: https://habr.com/ru/post/702388/
+
+# Ansible
+Установить роль
+```
+ansible-galaxy role install itdoginfo.domain_routing_openwrt
+```
+
+Примеры playbooks
+
+Wireguard, only domains, stubby, Russia, acces from wg network (пример 192.168.80.0/24), host 192.168.1.1
+```
+- hosts: 192.168.1.1
+  remote_user: root
+
+  roles:
+    - itdoginfo.domain_routing_openwrt
+
+  vars:
+    tunnel: wg
+    dns_encrypt: stubby
+    country: russia-inside
+
+    wg_server_address: wg-server-host
+    wg_private_key: privatekey-client
+    wg_public_key: publickey-client
+    wg_preshared_key: presharedkey-client
+    wg_listen_port: 51820
+    wg_client_port: 51820
+    wg_client_address: ip-client
+
+    wg_access: true
+    wg_access_network: wg-network
+```
+
+Sing-box, stubby, Russia
+```
+- hosts: 192.168.1.1
+  remote_user: root
+
+  roles:
+    - itdoginfo.domain_routing_openwrt
+
+  vars:
+    tunnel: singbox
+    dns_encrypt: stubby
+    country: russia-inside
+
+  tasks:
+  - name: sing-box config
+    template:
+      src: "templates/openwrt-sing-box-json.j2"
+      dest: "/etc/sing-box/config.json"
+      mode: 0644
+    notify:
+      - Restart sing-box
+      - Restart network
+```
+
+В inventory файле роутер обязательно должен быть в группе `[openwrt]`
+```
+[openwrt]
+192.168.1.1
+```
+
+Для работы Ansible c OpenWrt необходимо, чтоб было выполнено одно из условий:
+- Отсутствие пароля для root (не рекомендуется)
+- Настроен доступ через публичный SSH-ключ в [конфиге dropbear](https://openwrt.org/docs/guide-user/security/dropbear.public-key.auth)
+
+После выполнения playbook роутер сразу начнёт роутить необходмые домены в туннель/прокси.
+
+Если у вас были ошибки и они исправились при повторном запуске playbook, но при этом роутинг не заработал, сделайте рестарт сети и скрипта:
+```
+service network restart
+service getdomains start
+```

 Тестировалось с
 - Ansible 2.10.8
-
 - OpenWrt 21.02.7
 - OpenWrt 22.03.5
- OpenWrt 23.05.0
+- OpenWrt 23.05.2

-### Выбор туннеля
+## Выбор туннеля
 - Wireguard настраивается автоматически через переменные
 - OpenVPN устанавливается пакет, настраивается роутинг и зона. Само подключение (скопировать конфиг и перезапустить openvpn) нужно [настроить вручную](https://itdog.info/nastrojka-klienta-openvpn-na-openwrt/)
- Sing-box устанавливает пакет, настраивается роутинг и зона. Также кладётся темплейт в `/etc/sing-box/config.json`. Нужно настроить `config.json` и сделать `service sing-box restart`
+- Sing-box устанавливает пакет, настраивается роутинг и зона. Также кладётся темплейт в `/etc/sing-box/config.json`. [Нужно настроить](https://habr.com/ru/articles/767458/) `config.json` и сделать `service sing-box restart`
 Не работает под 21ой версией. Поэтому при его выборе playbook выдаст ошибку.
 Для 22ой версии нужно установить пакет вручную.
 - tun2socks настраивается только роутинг и зона. Всё остальное нужно настроить вручную

-Для **tunnel** четыре возможных значения:
+Для **tunnel** шесть возможных значений:
 - wg
 - openvpn
 - singbox
 - tun2socks

-В случае использования WG обязательно нужно задать:
+В случае использования WG:
+```
+    wg_server_address: wg-server-host
+    wg_private_key: privatekey-client
+    wg_public_key: publickey-client
+    wg_preshared_key: presharedkey-client
+    wg_client_port: 51820
+    wg_client_address: ip-client
+```

-**wg_server_address** - ip/url wireguard сервера
+Если ваш wg сервер не использует `preshared_key`, то просто не задавайте её.

-**wg_private_key**, **wg_public_key** - ключи для "клиента"
+**wg_access** и **wg_access_network** для доступа к роутеру через WG. Переменная wg_access_network должна иметь значение подсети, например 192.168.10.0/24.
+```
+    wg_access_network: wg-network
+    wg_access: true
+```

-**wg_client_address** - адрес роутера в wg сети
-
-Если ваш wg сервер использует preshared_key, то раскомментируйте **wg_preshared_key** и задайте ключ
-
-Остальное можно менять, в зависимости от того, как настроен wireguard сервер
-
-### Шифрование DNS
+## Шифрование DNS
 Если ваш провайдер не подменяет DNS-запросы, ничего устанавливать не нужно.

 Для **dns_encrypt** три возможных значения:
@@ -64,15 +175,25 @@ wget https://raw.githubusercontent.com/itdoginfo/ansible-openwrt-hirkn/master/ge
 - stubby
 - false/закомментировано - пропуск, ничего не устанавливается и не настраивается

-### Выбор страны
- Для **county** три [возможных значения](https://github.com/itdoginfo/allow-domains):
+## Выбор страны
+Выбор списка доменов.
+Для **county** три [возможных значения](https://github.com/itdoginfo/allow-domains):
 - russia-inside
 - russia-outside
 - ukraine

-### Списки IP-адресов и домены
+## Списки IP-адресов
+Списки IP-адресов берутся с [antifilter.download](https://antifilter.download/)
 Переменные **list_** обозначают, какие списки нужно установить. true - установить, false - не устанавливать и удалить, если уже есть

+Доступные переменные
+```
+  list_domains: true
+  list_subnet: false
+  list_ip: falses
+  list_community: false
+```
+
 Я советую использовать только домены
 ```
    list_domains: true
@@ -89,85 +210,12 @@ wget https://raw.githubusercontent.com/itdoginfo/ansible-openwrt-hirkn/master/ge

 [Инструкция для OpenWrt 21.02](https://t.me/itdoginfo/8)

-### Использование
-
-Установить модуль gekmihesg/ansible-openwrt
-
+## Текстовый редактор nano
+Устанавливается по умолчанию. Можно выключить
 ```
-ansible-galaxy install gekmihesg.openwrt
+  nano: false
 ```

-Скачать playbook и темплейты в /etc/ansible
-
-```
-cd /etc/ansible
-git clone https://github.com/itdoginfo/ansible-openwrt-hirkn
-mv ansible-openwrt-hirkn/* .
-rm -rf ansible-openwrt-hirkn README.md
-```
-
-Добавить роутер в файл hosts в группу openwrt
-```
-[openwrt]
-192.168.1.1
-```
-
-Подставить переменные в **hirkn.yml**
-
-Для работы Ansible c OpenWrt необходимо, чтоб было выполнено одно из условий:
- Отсутствие пароля для root (не рекомендуется)
- Настроен доступ через публичный SSH-ключ в [конфиге dropbear](https://openwrt.org/docs/guide-user/security/dropbear.public-key.auth)
-
-Запуск playbook
-```
-ansible-playbook playbooks/hirkn.yml --limit 192.168.1.1
-```
-
-После выполнения playbook роутер сразу начнёт выполнять обход блокировок.
-
-Если у вас были ошибки и они исправились при повторном запуске playbook, но при этом обход не разработал, сделайте рестарт сети и скрипта:
-```
-service network restart
-service getdomains start
-```
-
-# Скрипт для проверки конфигурации
-
-Написан для OpenWrt 23.05 и 22.03. На 21.02 работает только половина проверок.
-
-[x] - не обязательно означает, что эта часть не работает. Но это повод для ручной проверки.
-
-Есть функционал сохранения вывода скрипта, конфигурации сети и firewall в файл. Все чувствительные переменные при этом затираются.
-
-### Запуск
-```
-wget -O - https://raw.githubusercontent.com/itdoginfo/ansible-openwrt-hirkn/master/getdomains-check.sh | sh
-```
-
-### Запустить с проверкой на подмену DNS
-```
-wget -O - https://raw.githubusercontent.com/itdoginfo/ansible-openwrt-hirkn/master/getdomains-check.sh | sh -s dns
-```
-
-### Запустить с созданием dump
-```
-wget -O - https://raw.githubusercontent.com/itdoginfo/ansible-openwrt-hirkn/master/getdomains-check.sh | sh -s dump
-```
-
-### Скачать и потом запустить
-```
-wget https://raw.githubusercontent.com/itdoginfo/ansible-openwrt-hirkn/master/getdomains-check.sh
-chmod +x check-hirkn.sh
-./check-hirkn.sh
-```
-
-С созданием dump
-```
-./check-hirkn.sh dump
-```
-
-Поиск ошибок вручную: https://habr.com/ru/post/702388/
-
 ---

-[Telegram-канал с обновлениями](https://t.me/+lW1HmBO_Fa00M2Iy)
+[Telegram-канал с обновлениями](https://t.me/+lW1HmBO_Fa00M2Iy)
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -0,0 +1,12 @@
+---
+  list_domains: true
+  list_subnet: false
+  list_ip: false
+  list_community: false
+  tunnel: wg
+  dns_encrypt: false
+  country: russia-inside
+  nano: true
+  wg_access: false
+
+  wg_listen_port: 51820
--- a/getdomains-check.sh
+++ b/getdomains-check.sh
--- a/getdomains-install.sh
+++ b/getdomains-install.sh
@@ -9,19 +9,27 @@ check_repo() {

 route_vpn () {
    if [ "$TUNNEL" == wg ]; then
-cat << EOF > /etc/hotplug.d/iface/30-rknroute
+cat << EOF > /etc/hotplug.d/iface/30-vpnroute
 #!/bin/sh

 ip route add table vpn default dev wg0
 EOF
-    elif [ "$TUNNEL" == singbox ] || [ "$TUNNEL" == ovpn ] || [ "$TUNNEL" == tun2socks ]; then
-cat << EOF > /etc/hotplug.d/iface/30-rknroute
+    elif [ "$TUNNEL" == awg ]; then
+cat << EOF > /etc/hotplug.d/iface/30-vpnroute
 #!/bin/sh

-sleep 5
+ip route add table vpn default dev awg0
+EOF
+    elif [ "$TUNNEL" == singbox ] || [ "$TUNNEL" == ovpn ] || [ "$TUNNEL" == tun2socks ]; then
+cat << EOF > /etc/hotplug.d/iface/30-vpnroute
+#!/bin/sh
+
+sleep 10
 ip route add table vpn default dev tun0
 EOF
    fi
+
+    cp /etc/hotplug.d/iface/30-vpnroute /etc/hotplug.d/net/30-vpnroute
 }

 add_mark() {
@@ -39,13 +47,16 @@ add_mark() {
 }

 add_tunnel() {
-    echo "We can automatically configure only Wireguard. OpenVPN, Sing-box(Shadowsocks2022, VMess, VLESS, etc) and tun2socks will need to be configured manually"
+    echo "We can automatically configure only Wireguard and Amnezia WireGuard. OpenVPN, Sing-box(Shadowsocks2022, VMess, VLESS, etc) and tun2socks will need to be configured manually"
    echo "Select a tunnel:"
    echo "1) WireGuard"
    echo "2) OpenVPN"
    echo "3) Sing-box"
    echo "4) tun2socks"
-    echo "5) Skip this step"
+    echo "5) wgForYoutube"
+    echo "6) Amnezia WireGuard"
+    echo "7) Amnezia WireGuard For Youtube"
+    echo "8) Skip this step"

    while true; do
    read -r -p '' TUNNEL
@@ -71,7 +82,22 @@ add_tunnel() {
            break
            ;;

-        5)
+        5) 
+            TUNNEL=wgForYoutube
+            break
+            ;;
+
+        6) 
+            TUNNEL=awg
+            break
+            ;;
+
+        7) 
+            TUNNEL=awgForYoutube
+            break
+            ;;
+
+        8)
            echo "Skip"
            TUNNEL=0
            break
@@ -107,9 +133,9 @@ add_tunnel() {

        read -r -p "Enter the public key (from [Peer]):"$'\n' WG_PUBLIC_KEY
        read -r -p "If use PresharedKey, Enter this (from [Peer]). If your don't use leave blank:"$'\n' WG_PRESHARED_KEY
-        read -r -p "Enter Enpoint host without port (Domain or IP) (from [Peer]):"$'\n' WG_ENDPOINT
+        read -r -p "Enter Endpoint host without port (Domain or IP) (from [Peer]):"$'\n' WG_ENDPOINT

-        read -r -p "Enter Enpoint host port (from [Peer]) [51820]:"$'\n' WG_ENDPOINT_PORT
+        read -r -p "Enter Endpoint host port (from [Peer]) [51820]:"$'\n' WG_ENDPOINT_PORT
        WG_ENDPOINT_PORT=${WG_ENDPOINT_PORT:-51820}
        if [ "$WG_ENDPOINT_PORT" = '51820' ]; then
            echo $WG_ENDPOINT_PORT
@@ -207,6 +233,85 @@ EOF
        printf "\033[32;1mConfigure route for Sing-box\033[0m\n"
        route_vpn
    fi
+
+    if [ "$TUNNEL" == 'wgForYoutube' ]; then
+        add_internal_wg Wireguard
+    fi
+
+    if [ "$TUNNEL" == 'awgForYoutube' ]; then
+        add_internal_wg AmneziaWG
+    fi
+
+    if [ "$TUNNEL" == 'awg' ]; then
+        printf "\033[32;1mConfigure Amnezia WireGuard\033[0m\n"
+
+        install_awg_packages
+
+        route_vpn
+
+        read -r -p "Enter the private key (from [Interface]):"$'\n' AWG_PRIVATE_KEY
+
+        while true; do
+            read -r -p "Enter internal IP address with subnet, example 192.168.100.5/24 (Address from [Interface]):"$'\n' AWG_IP
+            if echo "$AWG_IP" | egrep -oq '^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]+$'; then
+                break
+            else
+                echo "This IP is not valid. Please repeat"
+            fi
+        done
+
+        read -r -p "Enter Jc value (from [Interface]):"$'\n' AWG_JC
+        read -r -p "Enter Jmin value (from [Interface]):"$'\n' AWG_JMIN
+        read -r -p "Enter Jmax value (from [Interface]):"$'\n' AWG_JMAX
+        read -r -p "Enter S1 value (from [Interface]):"$'\n' AWG_S1
+        read -r -p "Enter S2 value (from [Interface]):"$'\n' AWG_S2
+        read -r -p "Enter H1 value (from [Interface]):"$'\n' AWG_H1
+        read -r -p "Enter H2 value (from [Interface]):"$'\n' AWG_H2
+        read -r -p "Enter H3 value (from [Interface]):"$'\n' AWG_H3
+        read -r -p "Enter H4 value (from [Interface]):"$'\n' AWG_H4
+    
+        read -r -p "Enter the public key (from [Peer]):"$'\n' AWG_PUBLIC_KEY
+        read -r -p "If use PresharedKey, Enter this (from [Peer]). If your don't use leave blank:"$'\n' AWG_PRESHARED_KEY
+        read -r -p "Enter Endpoint host without port (Domain or IP) (from [Peer]):"$'\n' AWG_ENDPOINT
+
+        read -r -p "Enter Endpoint host port (from [Peer]) [51820]:"$'\n' AWG_ENDPOINT_PORT
+        AWG_ENDPOINT_PORT=${AWG_ENDPOINT_PORT:-51820}
+        if [ "$AWG_ENDPOINT_PORT" = '51820' ]; then
+            echo $AWG_ENDPOINT_PORT
+        fi
+        
+        uci set network.awg0=interface
+        uci set network.awg0.proto='amneziawg'
+        uci set network.awg0.private_key=$AWG_PRIVATE_KEY
+        uci set network.awg0.listen_port='51820'
+        uci set network.awg0.addresses=$AWG_IP
+
+        uci set network.awg0.awg_jc=$AWG_JC
+        uci set network.awg0.awg_jmin=$AWG_JMIN
+        uci set network.awg0.awg_jmax=$AWG_JMAX
+        uci set network.awg0.awg_s1=$AWG_S1
+        uci set network.awg0.awg_s2=$AWG_S2
+        uci set network.awg0.awg_h1=$AWG_H1
+        uci set network.awg0.awg_h2=$AWG_H2
+        uci set network.awg0.awg_h3=$AWG_H3
+        uci set network.awg0.awg_h4=$AWG_H4
+
+        if ! uci show network | grep -q amneziawg_awg0; then
+            uci add network amneziawg_awg0
+        fi
+
+        uci set network.@amneziawg_awg0[0]=amneziawg_awg0
+        uci set network.@amneziawg_awg0[0].name='awg0_client'
+        uci set network.@amneziawg_awg0[0].public_key=$AWG_PUBLIC_KEY
+        uci set network.@amneziawg_awg0[0].preshared_key=$AWG_PRESHARED_KEY
+        uci set network.@amneziawg_awg0[0].route_allowed_ips='0'
+        uci set network.@amneziawg_awg0[0].persistent_keepalive='25'
+        uci set network.@amneziawg_awg0[0].endpoint_host=$AWG_ENDPOINT
+        uci set network.@amneziawg_awg0[0].allowed_ips='0.0.0.0/0'
+        uci set network.@amneziawg_awg0[0].endpoint_port=$AWG_ENDPOINT_PORT
+        uci commit
+    fi
+
 }

 dnsmasqfull() {
@@ -218,7 +323,19 @@ dnsmasqfull() {
        opkg remove dnsmasq && opkg install dnsmasq-full --cache /tmp/

        [ -f /etc/config/dhcp-opkg ] && cp /etc/config/dhcp /etc/config/dhcp-old && mv /etc/config/dhcp-opkg /etc/config/dhcp
-fi
+    fi
+}
+s
+dnsmasqconfdir() {
+    if [ $VERSION_ID -ge 24 ]; then
+        if uci get dhcp.@dnsmasq[0].confdir | grep -q /tmp/dnsmasq.d; then
+            printf "\033[32;1mconfdir already set\033[0m\n"
+        else
+            printf "\033[32;1mSetting confdir\033[0m\n"
+            uci set dhcp.@dnsmasq[0].confdir='/tmp/dnsmasq.d'
+            uci commit dhcp
+        fi
+    fi
 }

 remove_forwarding() {
@@ -254,14 +371,25 @@ add_zone() {
            while uci -q delete firewall.@zone[$zone_wg_id]; do :; done
        fi

+        zone_awg_id=$(uci show firewall | grep -E '@zone.*awg0' | awk -F '[][{}]' '{print $2}' | head -n 1)
+        if [ "$zone_awg_id" == 0 ] || [ "$zone_awg_id" == 1 ]; then
+            printf "\033[32;1mawg0 zone has an identifier of 0 or 1. That's not ok. Fix your firewall. lan and wan zones should have identifiers 0 and 1. \033[0m\n"
+            exit 1
+        fi
+        if [ ! -z "$zone_awg_id" ]; then
+            while uci -q delete firewall.@zone[$zone_awg_id]; do :; done
+        fi
+
        uci add firewall zone
        uci set firewall.@zone[-1].name="$TUNNEL"
        if [ "$TUNNEL" == wg ]; then
            uci set firewall.@zone[-1].network='wg0'
+        elif [ "$TUNNEL" == awg ]; then
+            uci set firewall.@zone[-1].network='awg0'
        elif [ "$TUNNEL" == singbox ] || [ "$TUNNEL" == ovpn ] || [ "$TUNNEL" == tun2socks ]; then
            uci set firewall.@zone[-1].device='tun0'
        fi
-        if [ "$TUNNEL" == wg ] || [ "$TUNNEL" == ovpn ] || [ "$TUNNEL" == tun2socks ]; then
+        if [ "$TUNNEL" == wg ] || [ "$TUNNEL" == awg ] || [ "$TUNNEL" == ovpn ] || [ "$TUNNEL" == tun2socks ]; then
            uci set firewall.@zone[-1].forward='REJECT'
            uci set firewall.@zone[-1].output='ACCEPT'
            uci set firewall.@zone[-1].input='REJECT'
@@ -288,6 +416,11 @@ add_zone() {
            remove_forwarding
        fi

+        if [[ $TUNNEL != "awg" ]]; then
+            forward_id=$(uci show firewall | grep -E "@forwarding.*dest='awg'" | awk -F '[][{}]' '{print $2}' | head -n 1)
+            remove_forwarding
+        fi
+
        if [[ $TUNNEL != "ovpn" ]]; then
            forward_id=$(uci show firewall | grep -E "@forwarding.*dest='ovpn'" | awk -F '[][{}]' '{print $2}' | head -n 1)
            remove_forwarding
@@ -443,19 +576,21 @@ add_dns_resolver() {
 }

 add_packages() {
-    if opkg list-installed | grep -q "curl -"; then
-        printf "\033[32;1mCurl already installed\033[0m\n"
-    else
-        printf "\033[32;1mInstall curl\033[0m\n"
-        opkg install curl
-    fi
-
-    if opkg list-installed | grep -q nano; then
-        printf "\033[32;1mNano already installed\033[0m\n"
-    else
-        printf "\033[32;1mInstall nano\033[0m\n"
-        opkg install nano
-    fi
+    for package in curl nano; do
+        if opkg list-installed | grep -q "^$package "; then
+            printf "\033[32;1m$package already installed\033[0m\n"
+        else
+            printf "\033[32;1mInstalling $package...\033[0m\n"
+            opkg install "$package"
+            
+            if "$package" --version >/dev/null 2>&1; then
+                printf "\033[32;1m$package was successfully installed and available\033[0m\n"
+            else
+                printf "\033[31;1mError: failed to install $package\033[0m\n"
+                exit 1
+            fi
+        fi
+    done
 }

 add_getdomains() {
@@ -552,19 +687,296 @@ EOF
    fi
 }

+add_internal_wg() {
+    PROTOCOL_NAME=$1
+    printf "\033[32;1mConfigure ${PROTOCOL_NAME}\033[0m\n"
+    if [ "$PROTOCOL_NAME" = 'Wireguard' ]; then
+        INTERFACE_NAME="wg1"
+        CONFIG_NAME="wireguard_wg1"
+        PROTO="wireguard"
+        ZONE_NAME="wg_internal"
+
+        if opkg list-installed | grep -q wireguard-tools; then
+            echo "Wireguard already installed"
+        else
+            echo "Installed wg..."
+            opkg install wireguard-tools
+        fi
+    fi
+
+    if [ "$PROTOCOL_NAME" = 'AmneziaWG' ]; then
+        INTERFACE_NAME="awg1"
+        CONFIG_NAME="amneziawg_awg1"
+        PROTO="amneziawg"
+        ZONE_NAME="awg_internal"
+
+        install_awg_packages
+    fi
+
+    read -r -p "Enter the private key (from [Interface]):"$'\n' WG_PRIVATE_KEY_INT
+
+    while true; do
+        read -r -p "Enter internal IP address with subnet, example 192.168.100.5/24 (from [Interface]):"$'\n' WG_IP
+        if echo "$WG_IP" | egrep -oq '^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]+$'; then
+            break
+        else
+            echo "This IP is not valid. Please repeat"
+        fi
+    done
+
+    read -r -p "Enter the public key (from [Peer]):"$'\n' WG_PUBLIC_KEY_INT
+    read -r -p "If use PresharedKey, Enter this (from [Peer]). If your don't use leave blank:"$'\n' WG_PRESHARED_KEY_INT
+    read -r -p "Enter Endpoint host without port (Domain or IP) (from [Peer]):"$'\n' WG_ENDPOINT_INT
+
+    read -r -p "Enter Endpoint host port (from [Peer]) [51820]:"$'\n' WG_ENDPOINT_PORT_INT
+    WG_ENDPOINT_PORT_INT=${WG_ENDPOINT_PORT_INT:-51820}
+    if [ "$WG_ENDPOINT_PORT_INT" = '51820' ]; then
+        echo $WG_ENDPOINT_PORT_INT
+    fi
+
+    if [ "$PROTOCOL_NAME" = 'AmneziaWG' ]; then
+        read -r -p "Enter Jc value (from [Interface]):"$'\n' AWG_JC
+        read -r -p "Enter Jmin value (from [Interface]):"$'\n' AWG_JMIN
+        read -r -p "Enter Jmax value (from [Interface]):"$'\n' AWG_JMAX
+        read -r -p "Enter S1 value (from [Interface]):"$'\n' AWG_S1
+        read -r -p "Enter S2 value (from [Interface]):"$'\n' AWG_S2
+        read -r -p "Enter H1 value (from [Interface]):"$'\n' AWG_H1
+        read -r -p "Enter H2 value (from [Interface]):"$'\n' AWG_H2
+        read -r -p "Enter H3 value (from [Interface]):"$'\n' AWG_H3
+        read -r -p "Enter H4 value (from [Interface]):"$'\n' AWG_H4
+    fi
+    
+    uci set network.${INTERFACE_NAME}=interface
+    uci set network.${INTERFACE_NAME}.proto=$PROTO
+    uci set network.${INTERFACE_NAME}.private_key=$WG_PRIVATE_KEY_INT
+    uci set network.${INTERFACE_NAME}.listen_port='51821'
+    uci set network.${INTERFACE_NAME}.addresses=$WG_IP
+
+    if [ "$PROTOCOL_NAME" = 'AmneziaWG' ]; then
+        uci set network.${INTERFACE_NAME}.awg_jc=$AWG_JC
+        uci set network.${INTERFACE_NAME}.awg_jmin=$AWG_JMIN
+        uci set network.${INTERFACE_NAME}.awg_jmax=$AWG_JMAX
+        uci set network.${INTERFACE_NAME}.awg_s1=$AWG_S1
+        uci set network.${INTERFACE_NAME}.awg_s2=$AWG_S2
+        uci set network.${INTERFACE_NAME}.awg_h1=$AWG_H1
+        uci set network.${INTERFACE_NAME}.awg_h2=$AWG_H2
+        uci set network.${INTERFACE_NAME}.awg_h3=$AWG_H3
+        uci set network.${INTERFACE_NAME}.awg_h4=$AWG_H4
+    fi
+
+    if ! uci show network | grep -q ${CONFIG_NAME}; then
+        uci add network ${CONFIG_NAME}
+    fi
+
+    uci set network.@${CONFIG_NAME}[0]=$CONFIG_NAME
+    uci set network.@${CONFIG_NAME}[0].name="${INTERFACE_NAME}_client"
+    uci set network.@${CONFIG_NAME}[0].public_key=$WG_PUBLIC_KEY_INT
+    uci set network.@${CONFIG_NAME}[0].preshared_key=$WG_PRESHARED_KEY_INT
+    uci set network.@${CONFIG_NAME}[0].route_allowed_ips='0'
+    uci set network.@${CONFIG_NAME}[0].persistent_keepalive='25'
+    uci set network.@${CONFIG_NAME}[0].endpoint_host=$WG_ENDPOINT_INT
+    uci set network.@${CONFIG_NAME}[0].allowed_ips='0.0.0.0/0'
+    uci set network.@${CONFIG_NAME}[0].endpoint_port=$WG_ENDPOINT_PORT_INT
+    uci commit network
+
+    grep -q "110 vpninternal" /etc/iproute2/rt_tables || echo '110 vpninternal' >> /etc/iproute2/rt_tables
+
+    if ! uci show network | grep -q mark0x2; then
+        printf "\033[32;1mConfigure mark rule\033[0m\n"
+        uci add network rule
+        uci set network.@rule[-1].name='mark0x2'
+        uci set network.@rule[-1].mark='0x2'
+        uci set network.@rule[-1].priority='110'
+        uci set network.@rule[-1].lookup='vpninternal'
+        uci commit
+    fi
+
+    if ! uci show network | grep -q vpn_route_internal; then
+        printf "\033[32;1mAdd route\033[0m\n"
+        uci set network.vpn_route_internal=route
+        uci set network.vpn_route_internal.name='vpninternal'
+        uci set network.vpn_route_internal.interface=$INTERFACE_NAME
+        uci set network.vpn_route_internal.table='vpninternal'
+        uci set network.vpn_route_internal.target='0.0.0.0/0'
+        uci commit network
+    fi
+
+    if ! uci show firewall | grep -q "@zone.*name='${ZONE_NAME}'"; then
+        printf "\033[32;1mZone Create\033[0m\n"
+        uci add firewall zone
+        uci set firewall.@zone[-1].name=$ZONE_NAME
+        uci set firewall.@zone[-1].network=$INTERFACE_NAME
+        uci set firewall.@zone[-1].forward='REJECT'
+        uci set firewall.@zone[-1].output='ACCEPT'
+        uci set firewall.@zone[-1].input='REJECT'
+        uci set firewall.@zone[-1].masq='1'
+        uci set firewall.@zone[-1].mtu_fix='1'
+        uci set firewall.@zone[-1].family='ipv4'
+        uci commit firewall
+    fi
+
+    if ! uci show firewall | grep -q "@forwarding.*name='${ZONE_NAME}'"; then
+        printf "\033[32;1mConfigured forwarding\033[0m\n"
+        uci add firewall forwarding
+        uci set firewall.@forwarding[-1]=forwarding
+        uci set firewall.@forwarding[-1].name="${ZONE_NAME}-lan"
+        uci set firewall.@forwarding[-1].dest=${ZONE_NAME}
+        uci set firewall.@forwarding[-1].src='lan'
+        uci set firewall.@forwarding[-1].family='ipv4'
+        uci commit firewall
+    fi
+
+    if uci show firewall | grep -q "@ipset.*name='vpn_domains_internal'"; then
+        printf "\033[32;1mSet already exist\033[0m\n"
+    else
+        printf "\033[32;1mCreate set\033[0m\n"
+        uci add firewall ipset
+        uci set firewall.@ipset[-1].name='vpn_domains_internal'
+        uci set firewall.@ipset[-1].match='dst_net'
+        uci commit firewall
+    fi
+
+    if uci show firewall | grep -q "@rule.*name='mark_domains_intenal'"; then
+        printf "\033[32;1mRule for set already exist\033[0m\n"
+    else
+        printf "\033[32;1mCreate rule set\033[0m\n"
+        uci add firewall rule
+        uci set firewall.@rule[-1]=rule
+        uci set firewall.@rule[-1].name='mark_domains_intenal'
+        uci set firewall.@rule[-1].src='lan'
+        uci set firewall.@rule[-1].dest='*'
+        uci set firewall.@rule[-1].proto='all'
+        uci set firewall.@rule[-1].ipset='vpn_domains_internal'
+        uci set firewall.@rule[-1].set_mark='0x2'
+        uci set firewall.@rule[-1].target='MARK'
+        uci set firewall.@rule[-1].family='ipv4'
+        uci commit firewall
+    fi
+
+    if uci show dhcp | grep -q "@ipset.*name='vpn_domains_internal'"; then
+        printf "\033[32;1mDomain on vpn_domains_internal already exist\033[0m\n"
+    else
+        printf "\033[32;1mCreate domain for vpn_domains_internal\033[0m\n"
+        uci add dhcp ipset
+        uci add_list dhcp.@ipset[-1].name='vpn_domains_internal'
+        uci add_list dhcp.@ipset[-1].domain='youtube.com'
+        uci add_list dhcp.@ipset[-1].domain='googlevideo.com'
+        uci add_list dhcp.@ipset[-1].domain='youtubekids.com'
+        uci add_list dhcp.@ipset[-1].domain='googleapis.com'
+        uci add_list dhcp.@ipset[-1].domain='ytimg.com'
+        uci add_list dhcp.@ipset[-1].domain='ggpht.com'
+        uci commit dhcp
+    fi
+
+    sed -i "/done/a sed -i '/youtube.com\\\|ytimg.com\\\|ggpht.com\\\|googlevideo.com\\\|googleapis.com\\\|youtubekids.com/d' /tmp/dnsmasq.d/domains.lst" "/etc/init.d/getdomains"
+
+    service dnsmasq restart
+    service network restart
+
+    exit 0
+}
+
+install_awg_packages() {
+    # Получение pkgarch с наибольшим приоритетом
+    PKGARCH=$(opkg print-architecture | awk 'BEGIN {max=0} {if ($3 > max) {max = $3; arch = $2}} END {print arch}')
+
+    TARGET=$(ubus call system board | jsonfilter -e '@.release.target' | cut -d '/' -f 1)
+    SUBTARGET=$(ubus call system board | jsonfilter -e '@.release.target' | cut -d '/' -f 2)
+    VERSION=$(ubus call system board | jsonfilter -e '@.release.version')
+    PKGPOSTFIX="_v${VERSION}_${PKGARCH}_${TARGET}_${SUBTARGET}.ipk"
+    BASE_URL="https://github.com/Slava-Shchipunov/awg-openwrt/releases/download/"
+
+    AWG_DIR="/tmp/amneziawg"
+    mkdir -p "$AWG_DIR"
+
+    if opkg list-installed | grep -q amneziawg-tools; then
+        echo "amneziawg-tools already installed"
+    else
+        AMNEZIAWG_TOOLS_FILENAME="amneziawg-tools${PKGPOSTFIX}"
+        DOWNLOAD_URL="${BASE_URL}v${VERSION}/${AMNEZIAWG_TOOLS_FILENAME}"
+        curl -L -o "$AWG_DIR/$AMNEZIAWG_TOOLS_FILENAME" "$DOWNLOAD_URL"
+
+        if [ $? -eq 0 ]; then
+            echo "amneziawg-tools file downloaded successfully"
+        else
+            echo "Error downloading amneziawg-tools. Please, install amneziawg-tools manually and run the script again"
+            exit 1
+        fi
+
+        opkg install "$AWG_DIR/$AMNEZIAWG_TOOLS_FILENAME"
+
+        if [ $? -eq 0 ]; then
+            echo "amneziawg-tools file downloaded successfully"
+        else
+            echo "Error installing amneziawg-tools. Please, install amneziawg-tools manually and run the script again"
+            exit 1
+        fi
+    fi
+    
+    if opkg list-installed | grep -q kmod-amneziawg; then
+        echo "kmod-amneziawg already installed"
+    else
+        KMOD_AMNEZIAWG_FILENAME="kmod-amneziawg${PKGPOSTFIX}"
+        DOWNLOAD_URL="${BASE_URL}v${VERSION}/${KMOD_AMNEZIAWG_FILENAME}"
+        curl -L -o "$AWG_DIR/$KMOD_AMNEZIAWG_FILENAME" "$DOWNLOAD_URL"
+
+        if [ $? -eq 0 ]; then
+            echo "kmod-amneziawg file downloaded successfully"
+        else
+            echo "Error downloading kmod-amneziawg. Please, install kmod-amneziawg manually and run the script again"
+            exit 1
+        fi
+        
+        opkg install "$AWG_DIR/$KMOD_AMNEZIAWG_FILENAME"
+
+        if [ $? -eq 0 ]; then
+            echo "kmod-amneziawg file downloaded successfully"
+        else
+            echo "Error installing kmod-amneziawg. Please, install kmod-amneziawg manually and run the script again"
+            exit 1
+        fi
+    fi
+    
+    if opkg list-installed | grep -q luci-app-amneziawg; then
+        echo "luci-app-amneziawg already installed"
+    else
+        LUCI_APP_AMNEZIAWG_FILENAME="luci-app-amneziawg${PKGPOSTFIX}"
+        DOWNLOAD_URL="${BASE_URL}v${VERSION}/${LUCI_APP_AMNEZIAWG_FILENAME}"
+        curl -L -o "$AWG_DIR/$LUCI_APP_AMNEZIAWG_FILENAME" "$DOWNLOAD_URL"
+
+        if [ $? -eq 0 ]; then
+            echo "luci-app-amneziawg file downloaded successfully"
+        else
+            echo "Error downloading luci-app-amneziawg. Please, install luci-app-amneziawg manually and run the script again"
+            exit 1
+        fi
+
+        opkg install "$AWG_DIR/$LUCI_APP_AMNEZIAWG_FILENAME"
+
+        if [ $? -eq 0 ]; then
+            echo "luci-app-amneziawg file downloaded successfully"
+        else
+            echo "Error installing luci-app-amneziawg. Please, install luci-app-amneziawg manually and run the script again"
+            exit 1
+        fi
+    fi
+
+    rm -rf "$AWG_DIR"
+}
+
 # System Details
-MODEL=$(grep machine /proc/cpuinfo | cut -d ':' -f 2)
-RELEASE=$(grep OPENWRT_RELEASE /etc/os-release | awk -F '"' '{print $2}')
-printf "\033[34;1mModel:$MODEL\033[0m\n"
-printf "\033[34;1mVersion: $RELEASE\033[0m\n"
+MODEL=$(cat /tmp/sysinfo/model)
+source /etc/os-release
+printf "\033[34;1mModel: $MODEL\033[0m\n"
+printf "\033[34;1mVersion: $OPENWRT_RELEASE\033[0m\n"

-VERSION_ID=$(grep VERSION_ID /etc/os-release | awk -F '"' '{print $2}' | awk -F. '{print $1}')
+VERSION_ID=$(echo $VERSION | awk -F. '{print $1}')

-if [ "$VERSION_ID" -ne 23 ]; then
-    printf "\033[31;1mScript only support OpenWrt 23.05\033[0m\n"
+if [ "$VERSION_ID" -ne 23 ] && [ "$VERSION_ID" -ne 24 ]; then
+    printf "\033[31;1mScript only support OpenWrt 23.05 and 24.10\033[0m\n"
    echo "For OpenWrt 21.02 and 22.03 you can:"
-    echo "1) Use ansible https://github.com/itdoginfo/ansible-openwrt-hirkn"
-    echo "2) Configure manually. Old manual: https://itdog.info/tochechnyj-obhod-blokirovok-rkn-na-routere-s-openwrt-s-pomoshhyu-wireguard-i-dnscrypt/"
+    echo "1) Use ansible https://github.com/itdoginfo/domain-routing-openwrt"
+    echo "2) Configure manually. Old manual: https://itdog.info/tochechnaya-marshrutizaciya-na-routere-s-openwrt-wireguard-i-dnscrypt/"
    exit 1
 fi

@@ -586,6 +998,8 @@ add_set

 dnsmasqfull

+dnsmasqconfdir
+
 add_dns_resolver

 add_getdomains
--- a/getdomains-uninstall.sh
+++ b/getdomains-uninstall.sh
@@ -0,0 +1,78 @@
+#!/bin/ash
+
+echo "Выпиливаем скрипты"
+/etc/init.d/getdomains disable
+rm -rf /etc/init.d/getdomains
+
+rm -f /etc/hotplug.d/iface/30-vpnroute /etc/hotplug.d/net/30-vpnroute
+
+echo "Выпиливаем из crontab"
+sed -i '/getdomains start/d' /etc/crontabs/root
+
+echo "Выпиливаем домены"
+rm -f /tmp/dnsmasq.d/domains.lst
+
+echo "Чистим firewall, раз раз 🍴"
+
+ipset_id=$(uci show firewall | grep -E '@ipset.*name=.vpn_domains.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$ipset_id" ]; then
+    while uci -q delete firewall.@ipset[$ipset_id]; do :; done
+fi
+
+rule_id=$(uci show firewall | grep -E '@rule.*name=.mark_domains.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$rule_id" ]; then
+    while uci -q delete firewall.@rule[$rule_id]; do :; done
+fi
+
+ipset_id=$(uci show firewall | grep -E '@ipset.*name=.vpn_domains_internal.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$ipset_id" ]; then
+    while uci -q delete firewall.@ipset[$ipset_id]; do :; done
+fi
+
+rule_id=$(uci show firewall | grep -E '@rule.*name=.mark_domains_intenal.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$rule_id" ]; then
+    while uci -q delete firewall.@rule[$rule_id]; do :; done
+fi
+
+ipset_id=$(uci show firewall | grep -E '@ipset.*name=.vpn_subnet.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$ipset_id" ]; then
+    while uci -q delete firewall.@ipset[$ipset_id]; do :; done
+fi
+
+rule_id=$(uci show firewall | grep -E '@rule.*name=.mark_subnet.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$rule_id" ]; then
+    while uci -q delete firewall.@rule[$rule_id]; do :; done
+fi
+
+uci commit firewall
+/etc/init.d/firewall restart
+
+echo "Чистим сеть"
+sed -i '/99 vpn/d' /etc/iproute2/rt_tables
+
+rule_id=$(uci show network | grep -E '@rule.*name=.mark0x1.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$rule_id" ]; then
+    while uci -q delete network.@rule[$rule_id]; do :; done
+fi
+
+rule_id=$(uci show network | grep -E '@rule.*name=.mark0x2.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$rule_id" ]; then
+    while uci -q delete network.@rule[$rule_id]; do :; done
+fi
+
+while uci -q delete network.vpn_route_internal; do :; done
+
+uci commit network
+/etc/init.d/network restart
+
+echo "Проверяем Dnsmasq"
+if uci show dhcp | grep -q ipset; then
+    echo "В dnsmasq (/etc/config/dhcp) заданы домены. Нужные из них сохраните, остальные удалите вместе с ipset"
+fi
+
+echo "Все туннели, прокси, зоны и forwarding к ним оставляем на месте, они вам не помешают и скорее пригодятся"
+echo "Dnscrypt, stubby тоже не трогаем"
+
+echo "  ______  _____        _____   _____  ______  _     _  _____   _____"
+echo " |  ____ |     |      |_____] |     | |     \ |____/  |     | |_____]"
+echo " |_____| |_____|      |       |_____| |_____/ |    \_ |_____| |     "
--- a/handlers/main.yml
+++ b/handlers/main.yml
@@ -0,0 +1,31 @@
+---
+  - name: Restart sing-box
+    service:
+      name: sing-box
+      state: restarted
+
+  - name: Restart network
+    service:
+      name: network
+      state: restarted
+
+  - name: Restart firewall
+    service:
+      name: firewall
+      state: restarted
+
+  - name: Run getdomains script
+    service:
+      name: getdomains
+      state: restarted
+
+  - name: Restart dnscrypt-proxy
+    service:
+      name: dnscrypt-proxy
+      state: restarted
+      enabled: yes
+      
+  - name: Restart dnsmasq
+    service:
+      name: dnsmasq
+      state: restarted
--- a/meta/main.yml
+++ b/meta/main.yml
@@ -0,0 +1,22 @@
+---
+galaxy_info:
+  role_name: domain_routing_openwrt
+  namespace: itdoginfo
+  author: itdog
+  description: Configuring domain routing on Openwrt router
+  issue_tracker_url: https://github.com/itdoginfo/domain-routing-openwrt/issues
+  license: GPL-3.0
+  min_ansible_version: 2.10.7
+  platforms:
+    - name: OpenWrt
+  galaxy_tags:
+    - openwrt
+    - dnsmasq
+    - ipset
+    - wireguard
+    - sing-box
+    - openvpn
+    - bypass
+    - routing
+dependencies:
+  - role: gekmihesg.openwrt
--- a/playbooks/hirkn.yml
+++ b/playbooks/hirkn.yml
@@ -1,37 +1,20 @@
 ---

- hosts: openwrt
-
-  remote_user: root
-  
-  roles:
-    - gekmihesg.openwrt
-
-  vars:
-    ansible_template_dir: /etc/ansible/templates/
-    list_domains: true
-    list_subnet: false
-    list_ip: false
-    list_community: false
-    tunnel: wg
-    dns_encrypt: false
-    country: russia-inside
-
-    wg_server_address: wg-server-host
-    wg_private_key: privatekey-client
-    wg_public_key: publickey-client
-    #wg_preshared_key: presharedkey-client
-    wg_listen_port: 51820
-    wg_client_port: 51820
-    wg_client_address: ip-client
-
-  tasks:
 # Dnsmasq version check

  - name: Get dnsmasq version
    shell: opkg list-installed | grep dnsmasq-full | awk '{print $3}'
    register: dnsmasqfull_version

+  - name: Check confdir option
+    shell: uci get dhcp.@dnsmasq[0].confdir
+    register: dnsmasq_confdir
+    ignore_errors: true
+
+  - name: Get openwrt major release
+    shell: cat /etc/openwrt_release | grep -Eo [0-9]{2}[.][0-9]{2}[.][0-9]* | cut -d '.' -f 1 | tail -n 1
+    register: openwrt_major_release
+
  - name: debug
    debug:
      var: ansible_distribution_major_version
@@ -63,13 +46,20 @@
        - sing-box
    when: tunnel == "singbox" and ansible_distribution_major_version >= "23"

-  - name: install curl and nano
+  - name: install curl
    opkg:
      name: "{{ item }}"
      state: present
    loop:
        - curl
+
+  - name: install nano
+    opkg:
+      name: "{{ item }}"
+      state: present
+    loop:
        - nano
+    when: nano

  - name: install ipset
    opkg:
@@ -82,11 +72,21 @@
    when: ansible_distribution_major_version >= "23" and list_domains and not dnsmasqfull_version.stdout
    ignore_errors: true

+  - name: set confdir for dnsmasq
+    uci: 
+      command: set
+      key: dhcp.@dnsmasq[0]
+      value:
+        confdir: "/tmp/dnsmasq.d"
+    when: ansible_distribution_major_version >= 24
+    notify:
+      - Restart dnsmasq  
+
 # Getdomains script configure
      
  - name: getdomains script copy
    template:
-      src: "{{ ansible_template_dir }}openwrt-getdomains.j2"
+      src: "openwrt-getdomains.j2"
      dest: "/etc/init.d/getdomains"
      mode: a+x
      trim_blocks: false
@@ -120,61 +120,11 @@
      enabled: yes
      
 # Configure route table
-      
-  # - name: Create vpn0 interface
-  #   uci:
-  #     command: section
-  #     config: network
-  #     type: interface
-  #     find_by:
-  #       name: vpn0
-  #     name: vpn0
-  #     value:
-  #       name: vpn0
-  #       proto: none
-  #       auto: 1
-  #       device: tun0
-  #   when: tunnel == "openvpn" or tunnel == "singbox" or tunnel == "tun2socks"
-  #   notify:
-  #     - Restart network
-
-  # - name: tunnel routing. tun0
-  #   uci:
-  #     command: section
-  #     config: network
-  #     type: route
-  #     find_by:
-  #       name: vpn_route
-  #     name: vpn_route
-  #     value:
-  #       name: vpn_route
-  #       interface: vpn0
-  #       table: vpn
-  #       target: 0.0.0.0/0
-  #   when: tunnel == "openvpn" or tunnel == "singbox" or tunnel == "tun2socks"
-  #   notify:
-  #     - Restart network
-
-  # - name: tunnel routing. wg0
-  #   uci:
-  #     command: section
-  #     config: network
-  #     type: route
-  #     find_by:
-  #       name: vpn
-  #     name: vpn_route
-  #     value:
-  #       interface: wg0
-  #       table: vpn
-  #       target: 0.0.0.0/0
-  #   when: tunnel == "wg"
-  #   notify:
-  #     - Restart network

  - name: Route for vpn table
    template:
-      src: "{{ ansible_template_dir }}openwrt-30-rknroute.j2"
-      dest: "/etc/hotplug.d/iface/30-rknroute"
+      src: "openwrt-30-vpnroute.j2"
+      dest: "/etc/hotplug.d/iface/30-vpnroute"
      mode: 0644

  - name: Check string in rt_tables
@@ -305,7 +255,7 @@

  - name: template for sing-box.json
    template:
-      src: "{{ ansible_template_dir }}sing-box-json.j2"
+      src: "sing-box-json.j2"
      dest: "/etc/sing-box/config.json"
      mode: 0644
    when: tunnel == "singbox"
@@ -313,7 +263,7 @@

  - name: template for config/sing-box
    template:
-      src: "{{ ansible_template_dir }}config-sing-box.j2"
+      src: "config-sing-box.j2"
      dest: "/etc/config/sing-box"
      mode: 0600
    when: tunnel == "singbox"
@@ -483,7 +433,6 @@
       value:
         match: dst_net
         storage: hash
-    failed_when: ansible_distribution_major_version < "22" and list_domains and not dnsmasqfull_version.stdout
    when: ansible_distribution_major_version < "22" and list_domains

  - name: add nfset for domains (>=22). If failed, repeat playbook. If failed is repeated check dnsmasq-full.
@@ -495,7 +444,6 @@
         name: vpn_domains
       value:
         match: dst_net
-    failed_when: ansible_distribution_major_version >= "22" and list_domains and (not dnsmasqfull_version.stdout or dnsmasqfull_version.stdout < "2.87")
    when: ansible_distribution_major_version >= "22" and list_domains

  - name: add mark rule vpn_subnet
@@ -564,7 +512,30 @@
         set_mark: "0x1"
         target: MARK
         family: ipv4
-    when: (ansible_distribution_major_version < "22" and list_domains and dnsmasqfull_version.stdout) or (ansible_distribution_major_version >= "22" and list_domains and dnsmasqfull_version.stdout >= "2.87")
+    when: (ansible_distribution_major_version < "22" and list_domains) or (ansible_distribution_major_version >= "22" and list_domains)
+
+  - name: wg access route
+    uci:
+      command: section
+      config: network
+      type: route
+      find_by:
+        name: wg_access_route
+      value:
+        interface: wg0
+        target: "{{ wg_access_network }}"
+    when: wg_access
+
+  - name: set WG firewall zone 
+    uci:
+      command: section
+      config: firewall
+      type: zone
+      find_by:
+        name: wg
+      value:
+        input: ACCEPT
+    when: wg_access

 # Remove unused rules and ipset
  - name: Remove ipset for ip
@@ -694,7 +665,7 @@
      - Restart dnsmasq
    when: dns_encrypt == "stubby"

-# Commit and handlers
+# Commit

  - name: uci commit firewall
    uci:
@@ -703,36 +674,16 @@
    notify:
      - Restart firewall

+    - name: uci commit dhcp
+    uci:
+      command: commit
+      config: dhcp
+    notify:
+      - Restart dnsmasq
+
  - name: uci commit network
    uci:
      command: commit
      config: network
    notify:
-      - Restart network
-
-  handlers:
-  - name: Restart network
-    service:
-      name: network
-      state: restarted
-
-  - name: Restart firewall
-    service:
-      name: firewall
-      state: restarted
-
-  - name: Run getdomains script
-    service:
-      name: getdomains
-      state: restarted
-
-  - name: Restart dnscrypt-proxy
-    service:
-      name: dnscrypt-proxy
-      state: restarted
-      enabled: yes
-      
-  - name: Restart dnsmasq
-    service:
-      name: dnsmasq
-      state: restarted
+      - Restart network
--- a/templates/openwrt-30-vpnroute.j2
+++ b/templates/openwrt-30-vpnroute.j2
@@ -3,6 +3,6 @@
 {% if tunnel == "wg" %}
 ip route add table vpn default dev wg0
 {% elif (tunnel == "openvpn") or (tunnel == "singbox") or (tunnel == "tun2socks") %}
-sleep 5
+sleep 10
 ip route add table vpn default dev tun0
 {% endif %}
--- a/tests/inventory
+++ b/tests/inventory
@@ -0,0 +1,2 @@
+[openwrt]
+192.168.56.23
--- a/tests/test.yml
+++ b/tests/test.yml
@@ -0,0 +1,6 @@
+---
+- hosts: openwrt
+  remote_user: root
+
+  roles:
+    - domain_routing_openwrt
Author	SHA1	Message	Date
itdoginfo	dfab862088	Fixed for 24	2024-12-16 10:23:45 +03:00
itdoginfo	02f5e5e5c8	Added openwrt 24.10	2024-12-16 00:23:42 +03:00
itdoginfo	f6a6864080	Merge pull request #33 from Akiyamov/master Add confdir for snapshot	2024-12-16 00:17:23 +03:00
Akiyamov	86b9c1c075	Major release for ansible	2024-12-05 18:35:01 +05:00
Akiyamov	7b1f1631b3	Execute confdir only for 24 and newer versions	2024-12-05 15:55:03 +05:00
Akiyamov	f3bf5dda15	Update tasks/main.yml Co-authored-by: Morozov Dmitriy <hacker000@yandex.ru>	2024-12-04 16:51:37 +05:00
Akiyamov	ae9e42a578	Add func exec	2024-12-04 16:16:30 +05:00
Akiyamov	a974ddef29	Add confdir for snapshot	2024-12-03 23:36:40 +05:00
itdoginfo	1e7a3bb8f6	Merge pull request #25 from HattabbI4/master feat: Added package installation check	2024-10-31 13:18:51 +03:00
HattabbI4	a81fe1fb24	translate log messages	2024-10-31 14:53:16 +05:00
HattabbI4	71590700b0	Добавлена проверка установки пакетов	2024-10-31 13:52:28 +05:00
itdoginfo	4a0a38661d	Update	2024-10-26 01:08:41 +03:00
itdoginfo	b6b639e76b	Uninstall and AWG install	2024-10-26 00:49:36 +03:00
itdoginfo	55ceab7233	Uninstall script	2024-10-26 00:44:59 +03:00
itdoginfo	3f35560f48	Fix hotplug	2024-10-25 18:47:09 +03:00
itdoginfo	b506913226	Moved hotplug to net	2024-10-25 11:59:15 +03:00
itdoginfo	a7eb46bd7f	Merge pull request #21 from vernette/master fix(getdomains-check.sh): add update_vpn_ip function to fix VPN IP address display for sing-box and tun2socks	2024-09-19 11:23:38 +03:00
Nikita Skryabin	4d1a838e2d	fix(getdomains-check.sh): add update_vpn_ip function to fix VPN IP address display for sing-box and tun2socks	2024-09-18 13:19:59 +03:00
itdoginfo	66f9fb75d4	Merge pull request #20 from vernette/master feat: translate getdomains-check.sh script to russian language	2024-09-18 12:31:39 +03:00
Nikita Skryabin	202f635c89	docs(README.md): add launch command with --lang flag	2024-09-18 09:19:16 +03:00
Nikita Skryabin	b66d61fd23	refactor(getdomains-check.sh): move translations from translations file to the script	2024-09-18 09:12:52 +03:00
Nikita Skryabin	7f3cf77748	fix(getdomains-check.sh): remove forgotten code	2024-09-17 14:14:15 +03:00
Nikita Skryabin	c478349e9f	feat(README.md): update the launch instructions	2024-09-17 13:59:11 +03:00
Nikita Skryabin	a8f8e53326	fix(getdomains-check.sh): change repository author back to itdoginfo	2024-09-17 13:46:10 +03:00
Nikita Skryabin	f5f4fadb42	feat(getdomains-check.sh): add --lang flag to choose language	2024-09-17 13:45:13 +03:00
Nikita Skryabin	4b2264ff24	feat(getdomains-check.sh): add code for downloading translations file from URL	2024-09-17 13:38:28 +03:00
Nikita Skryabin	648ff65835	refactor(getdomains-check.sh): replace text output with constants	2024-09-17 13:27:27 +03:00
Nikita Skryabin	9376926215	feat(translations.sh): add a translation file with english and russian languages	2024-09-17 13:26:58 +03:00
itdoginfo	22487c2c29	Merge pull request #19 from ampetelin/master feature: Added validation of the sing-box config	2024-09-16 13:04:42 +03:00
Andrey Petelin	4422e8c40c	feature: Added validation of the sing-box config	2024-09-16 14:57:38 +05:00
itdoginfo	03b2a1aa95	Merge pull request #16 from vernette/master refactor: improve model detection and reuse environment variables for version parsing	2024-09-09 15:26:08 +03:00
itdoginfo	6790ff7502	Merge pull request #15 from Slava-Shchipunov/master Feat: add awg for youtube (#4)	2024-09-09 15:23:51 +03:00
Nikita Skryabin	7177c18ecd	fix: correct VERSION_ID extraction using echo instead of cat	2024-09-05 16:36:17 +03:00
Nikita Skryabin	0a71e0de9b	refactor: reuse environment variables from /etc/os-release for version checks	2024-09-05 16:31:28 +03:00
Nikita Skryabin	67832bea31	refactor: switch model detection to use /tmp/sysinfo/model	2024-09-05 16:26:12 +03:00
Slava-Shchipunov	77d3681ff3	Feat: add awg for youtube (#4 ) * feat: add awgForYoutube * fix: add proto from variable * fix: fix wg internal listen port	2024-08-31 17:31:54 +07:00
itdoginfo	ceac5597ac	Fix internal WG	2024-08-18 14:37:21 +03:00
itdoginfo	ffb3b54b28	Fix about awg	2024-08-18 14:36:15 +03:00
itdoginfo	49beabdf05	Merge pull request #13 from Slava-Shchipunov/master feat: add AmneziaWG	2024-08-18 13:55:37 +03:00
Slava-Shchipunov	ec3655a8e9	refactor: remove DNS AWG settings (#3 )	2024-08-17 22:41:32 +07:00
Slava-Shchipunov	db5df24e9d	docs: update README.md	2024-08-17 03:49:57 +07:00
Slava-Shchipunov	1ae8f485fe	feat: add automatical install amnezia wg packages (#2 ) * feat: add amnezia wg to settings * feat: add TUNNEL = awg * feat: update getdomains-install.sh * fix: fix dns array processing * fix: add awg to menu * fix: fix script to awg * fix: add missing space * fix: add missing space * feat: add downloading awg packages * refactor: update comments * refactor: fix typo * fix: add sync before install package * fix: fix file name	2024-08-17 03:13:28 +07:00
Slava-Shchipunov	d5b842095c	docs: update README.md	2024-08-13 13:45:51 +07:00
Slava-Shchipunov	973a151787	chore: delete docs directory	2024-08-13 13:38:12 +07:00
itdoginfo	3f069118ca	Remove pppoe check	2024-08-12 07:39:20 +03:00
Slava-Shchipunov	0b3dac7307	feat: add how enable gh workflow	2024-08-09 15:30:00 +07:00
Slava-Shchipunov	27fb667059	feat: add image	2024-08-09 15:24:28 +07:00
Slava-Shchipunov	7c2e79db2f	docs: add awg build instructions	2024-08-04 19:22:30 +07:00
Slava-Shchipunov	bb7c66dba2	Feat/add amnezia wg (#1 ) * feat: add amnezia wg to settings * feat: add TUNNEL = awg * feat: update getdomains-install.sh * fix: fix dns array processing * fix: add awg to menu * fix: fix script to awg * fix: add missing space * fix: add missing space	2024-08-04 16:15:32 +07:00
itdoginfo	20262f21db	Added internal wg logic	2024-07-28 17:09:58 +03:00
itdoginfo	aae9c50f10	Fix examples	2024-05-06 14:05:03 +03:00
itdoginfo	db0d06408a	Fix order	2024-05-06 13:48:30 +03:00
itdoginfo	b5b6a7ad5f	Added sing-box handler	2024-05-05 19:25:13 +03:00
itdoginfo	3fdf04518f	Fix	2024-04-18 17:24:24 +03:00
itdoginfo	5f015d069f	Fixed workflow	2024-04-18 17:21:38 +03:00
itdoginfo	76fcd4860f	Several fixes	2024-04-18 17:14:35 +03:00
itdoginfo	96c8ceee44	Merge pull request #9 from itdoginfo/role Conversion to a role	2024-04-18 16:59:35 +03:00
itdoginfo	92f25df564	Changed to master branch	2024-04-18 16:58:59 +03:00
itdoginfo	ec9971ef4b	Redrafting	2024-04-18 16:54:27 +03:00
itdoginfo	df8ecd5cdc	fix	2024-04-18 15:29:08 +03:00
itdoginfo	5e9576258e	Added workflow	2024-04-18 15:26:59 +03:00
itdoginfo	60b94f4e48	Added role	2024-04-18 15:16:25 +03:00
itdoginfo	8ca4fb08d6	Fixed route check	2024-04-10 14:17:40 +03:00
itdoginfo	301da76110	Added show date	2024-04-04 14:37:27 +03:00
itdoginfo	d9e9317995	Cleanup	2024-04-02 18:59:15 +03:00
itdoginfo	15ad1f5115	Added UCI sing-box validation, curl to --interface check for proxy	2024-03-13 20:41:59 +03:00
itdoginfo	d0fad434cc	(・x・)	2024-03-09 12:29:54 +03:00
itdoginfo	8f18b95b1e	Some fixes	2024-02-20 13:53:13 +03:00
itdoginfo	6ec2438165	Fixed wg_access_network	2024-01-18 12:33:26 +03:00
itdoginfo	9baaddabc6	Added wg_access and fixed dnsmasq check issue	2024-01-12 13:34:13 +03:00
itdoginfo	388ad72492	Some fixes	2024-01-12 13:33:19 +03:00