Merge pull request #25 from HattabbI4/master

feat: Added package installation check

.github/workflows/public-galaxy.yml

@@ -2,7 +2,6 @@ name: Public to Ansible Galaxy
 
 on:
   push:
-    branches: [ "master" ]
     tags:
       - '*'
 

README.EN.md

@@ -69,7 +69,7 @@ Wireguard, only domains, stubby, Russia, acces from wg network, host 192.168.1.1
   remote_user: root
 
   roles:
-    - domain-routing-openwrt
+    - itdoginfo.domain_routing_openwrt
 
   vars:
     tunnel: wg
@@ -93,12 +93,22 @@ Sing-box, stubby, Russia
   remote_user: root
 
   roles:
-    - domain-routing-openwrt
+    - itdoginfo.domain_routing_openwrt
 
   vars:
     tunnel: singbox
     dns_encrypt: stubby
     country: russia-inside
+
+  tasks:
+  - name: sing-box config
+    template:
+      src: "templates/openwrt-sing-box-json.j2"
+      dest: "/etc/sing-box/config.json"
+      mode: 0644
+    notify:
+      - Restart sing-box
+      - Restart network
 ```
 
 License

README.md

@@ -1,7 +1,7 @@
 [English role README](https://github.com/itdoginfo/domain-routing-openwrt/blob/master/README.EN.md)
 
 # Описание
-Shell скрипт и playbook для Ansible. Автоматизируют настройку роутера на OpenWrt для роутинга по доменам и спискам IP-адресов.
+Shell скрипт и [роль для Ansible](https://galaxy.ansible.com/ui/standalone/roles/itdoginfo/domain_routing_openwrt). Автоматизируют настройку роутера на OpenWrt для роутинга по доменам и спискам IP-адресов.
 
 Полное описание происходящего:
 - [Статья на хабре](https://habr.com/ru/articles/767464/)
@@ -12,6 +12,18 @@ Shell скрипт и playbook для Ansible. Автоматизируют на
 sh <(wget -O - https://raw.githubusercontent.com/itdoginfo/domain-routing-openwrt/master/getdomains-install.sh)
 ```
 
+# Скрипт для удаления
+```
+sh <(wget -O - https://raw.githubusercontent.com/itdoginfo/domain-routing-openwrt/refs/heads/master/getdomains-uninstall.sh)
+```
+
+## AmneziaWG
+Через этот скрипт можно установить Amnezia wireguard. Скрипт проверяет наличие пакетов под вашу платформу в [стороннем репозитории](https://github.com/Slava-Shchipunov/awg-openwrt/releases), так как в официальном репозитории OpenWRT они отсутствуют, и автоматически их устанавливает.
+
+Если вам нужно установить только AWG, воспользуйтесь скриптом в репозитории: https://github.com/Slava-Shchipunov/awg-openwrt
+
+Если подходящих пакетов нет, перед настройкой необходимо будет самостоятельно [собрать бинарники AmneziaWG](https://github.com/itdoginfo/domain-routing-openwrt/wiki/Amnezia-WG-Build) для своего устройства и установить их.
+
 ## Скрипт для проверки конфигурации
 Написан для OpenWrt 23.05 и 22.03. На 21.02 работает только половина проверок.
 
@@ -22,6 +34,12 @@ sh <(wget -O - https://raw.githubusercontent.com/itdoginfo/domain-routing-openwr
 wget -O - https://raw.githubusercontent.com/itdoginfo/domain-routing-openwrt/master/getdomains-check.sh | sh
 ```
 
+По-умолчанию запускается на русском языке. Если нужно запустить на английском, то после `sh` нужно добавить `-s --lang en`. Аналогично для проверок на подмену DNS и создания дампа.
+
+```
+wget -O - https://raw.githubusercontent.com/itdoginfo/domain-routing-openwrt/master/getdomains-check.sh | sh -s --lang en
+```
+
 ### Запустить с проверкой на подмену DNS
 ```
 wget -O - https://raw.githubusercontent.com/itdoginfo/domain-routing-openwrt/master/getdomains-check.sh | sh -s dns
@@ -44,7 +62,7 @@ ansible-galaxy role install itdoginfo.domain_routing_openwrt
 
 Примеры playbooks
 
-Wireguard, only domains, stubby, Russia, acces from wg network (примерное значение 192.168.80.0/24), host 192.168.1.1
+Wireguard, only domains, stubby, Russia, acces from wg network (пример 192.168.80.0/24), host 192.168.1.1
 ```
 - hosts: 192.168.1.1
   remote_user: root
@@ -81,6 +99,16 @@ Sing-box, stubby, Russia
     tunnel: singbox
     dns_encrypt: stubby
     country: russia-inside
+
+  tasks:
+  - name: sing-box config
+    template:
+      src: "templates/openwrt-sing-box-json.j2"
+      dest: "/etc/sing-box/config.json"
+      mode: 0644
+    notify:
+      - Restart sing-box
+      - Restart network
 ```
 
 В inventory файле роутер обязательно должен быть в группе `[openwrt]`
@@ -115,7 +143,7 @@ service getdomains start
 Для 22ой версии нужно установить пакет вручную.
 - tun2socks настраивается только роутинг и зона. Всё остальное нужно настроить вручную
 
-Для **tunnel** четыре возможных значения:
+Для **tunnel** шесть возможных значений:
 - wg
 - openvpn
 - singbox
@@ -183,12 +211,11 @@ service getdomains start
 [Инструкция для OpenWrt 21.02](https://t.me/itdoginfo/8)
 
 ## Текстовый редактор nano
-Устанавливается по умолчанию
+Устанавливается по умолчанию. Можно выключить
-Можно выключить
 ```
   nano: false
 ```
 
 ---
 
-[Telegram-канал с обновлениями](https://t.me/+lW1HmBO_Fa00M2Iy)
+[Telegram-канал с обновлениями](https://t.me/+lW1HmBO_Fa00M2Iy)

getdomains-check.sh

@@ -1,195 +1,459 @@
 #!/bin/sh
 
-HIVPN=/etc/init.d/hivpn
+SCRIPTS_DIR="/etc/init.d"
-GETDOMAINS=/etc/init.d/getdomains
+TMP_DIR="/tmp"
-DUMP=/tmp/dump.txt
+HIVPN_SCRIPT_FILENAME="hivpn"
+GETDOMAINS_SCRIPT_FILENAME="getdomains"
+DUMP_FILENAME="dump.txt"
+
+HIVPN_SCRIPT_PATH="$SCRIPTS_DIR/$HIVPN_SCRIPT_FILENAME"
+GETDOMAINS_SCRIPT_PATH="$SCRIPTS_DIR/$GETDOMAINS_SCRIPT_FILENAME"
+DUMP_PATH="$TMP_DIR/$DUMP_FILENAME"
+
+COLOR_BOLD_BLUE="\033[34;1m"
+COLOR_BOLD_GREEN="\033[32;1m"
+COLOR_BOLD_RED="\033[31;1m"
+COLOR_BOLD_CYAN="\033[36;1m"
+COLOR_RESET="\033[0m"
+
+UNSUPPORTED_OPENWRT_VERSION="21.02"
+MIN_RAM="256"
+DNSMASQ_FULL_REQUIRED_VERSION="2.87"
+
+SINGBOX_CONFIG_PATH="/etc/config/sing-box"
+
+CURL_PACKAGE="curl"
+DNSMASQ_PACKAGE="dnsmasq"
+DNSMASQ_FULL_PACKAGE="$DNSMASQ_PACKAGE-full"
+XRAY_CORE_PACKAGE="xray-core"
+LUCI_APP_XRAY_PACKAGE="luci-app-xray"
+WIREGUARD_TOOLS_PACKAGE="wireguard-tools"
+OPENVPN_PACKAGE="openvpn"
+SINGBOX_PACKAGE="sing-box"
+TUN2SOCKS_PACKAGE="tun2socks"
+DNSCRYPT_PACKAGE="dnscrypt-proxy2"
+STUBBY_PACKAGE="stubby"
+
+WIREGUARD_PROTOCOL="Wireguard"
+OPENVPN_PROTOCOL="OpenVPN"
+
+LANGUAGE="ru"
+SUPPORTED_LANGUAGES="ru, en"
+
+set_language_en() {
+  DEVICE_MODEL="Model"
+  OPENWRT_VERSION="Version"
+  CURRENT_DATE="Date"
+  INSTALLED="is installed"
+  NOT_INSTALLED="is not installed"
+  RUNNING="is running"
+  NOT_RUNNING="is not running"
+  ENABLED="is enabled"
+  DISABLED="is disabled"
+  EXISTS="exists"
+  DOESNT_EXIST="doesn't exist"
+  UNSUPPORTED_OPENWRT="You are using OpenWrt $UNSUPPORTED_OPENWRT_VERSION. This check script does not support it."
+  RAM_WARNING="Your router has less than $MIN_RAM MB of RAM. It is recommended to use only the vpn_domains list."
+  CURL_INSTALLED="$CURL_PACKAGE $INSTALLED"
+  CURL_NOT_INSTALLED="$CURL_PACKAGE $NOT_INSTALLED. Install it: opkg install $CURL_PACKAGE"
+  DNSMASQ_FULL_INSTALLED="$DNSMASQ_FULL_PACKAGE $INSTALLED"
+  DNSMASQ_FULL_NOT_INSTALLED="$DNSMASQ_FULL_PACKAGE $NOT_INSTALLED"
+  DNSMASQ_FULL_DETAILS="If you don't use vpn_domains set, it's OK\nCheck version: opkg list-installed | grep $DNSMASQ_FULL_PACKAGE\nRequired version >= $DNSMASQ_FULL_REQUIRED_VERSION. For OpenWrt 22.03 follow manual: https://t.me/itdoginfo/12"
+  OPENWRT_21_DETAILS="\nYou are using OpenWrt $UNSUPPORTED_OPENWRT_VERSION. This check does not support it.\nManual for OpenWrt $UNSUPPORTED_OPENWRT_VERSION: https://t.me/itdoginfo/8"
+  XRAY_CORE_PACKAGE_DETECTED="$XRAY_CORE_PACKAGE package detected"
+  LUCI_APP_XRAY_PACKAGE_DETECTED="$LUCI_APP_XRAY_PACKAGE package detected which is incompatible. Remove it: opkg remove $LUCI_APP_XRAY_PACKAGE --force-removal-of-dependent-packages"
+  DNSMASQ_SERVICE_RUNNING="$DNSMASQ_PACKAGE service $RUNNING"
+  DNSMASQ_SERVICE_NOT_RUNNING="$DNSMASQ_PACKAGE service $NOT_RUNNING. Check configuration: /etc/config/dhcp"
+  INTERNET_IS_AVAILABLE="Internet is available"
+  INTERNET_IS_NOT_AVAILABLE="Internet is not available"
+  INTERNET_DETAILS="Check internet connection. If it's ok, check date on router. Details: https://cli.co/2EaW4rO\nFor more info run: curl -Is https://community.antifilter.download/"
+  IPV6_DETECTED="IPv6 detected. This script does not currently work with IPv6"
+  WIREGUARD_TOOLS_INSTALLED="$WIREGUARD_TOOLS_PACKAGE $INSTALLED"
+  WIREGUARD_ROUTING_DOESNT_WORK="Tunnel to the $WIREGUARD_PROTOCOL server works, but routing to the internet does not work. Check server configuration. Details: https://cli.co/RSCvOxI"
+  WIREGUARD_TUNNEL_NOT_WORKING="Bad news: $WIREGUARD_PROTOCOL tunnel isn't working. Check your $WIREGUARD_PROTOCOL configuration. Details: https://cli.co/hGUUXDs\nIf you don't use $WIREGUARD_PROTOCOL, but $OPENVPN_PROTOCOL for example, it's OK"
+  WIREGUARD_ROUTE_ALLOWED_IPS_ENABLED="$WIREGUARD_PROTOCOL route_allowed_ips $ENABLED. All traffic goes into the tunnel. Read more at: https://cli.co/SaxBzH7"
+  WIREGUARD_ROUTE_ALLOWED_IPS_DISABLED="$WIREGUARD_PROTOCOL route_allowed_ips $DISABLED"
+  WIREGUARD_ROUTING_TABLE_EXISTS="$WIREGUARD_PROTOCOL routing table $EXISTS"
+  WIREGUARD_ROUTING_TABLE_DOESNT_EXIST="$WIREGUARD_PROTOCOL routing table $DOESNT_EXIST. Details: https://cli.co/Atxr6U3"
+  OPENVPN_INSTALLED="$OPENVPN_PACKAGE $INSTALLED"
+  OPENVPN_ROUTING_DOESNT_WORK="Tunnel to the $OPENVPN_PROTOCOL server works, but routing to the internet does not work. Check server configuration."
+  OPENVPN_TUNNEL_NOT_WORKING="Bad news: $OPENVPN_PROTOCOL tunnel isn't working. Check your $OPENVPN_PROTOCOL configuration."
+  OPENVPN_REDIRECT_GATEWAY_ENABLED="$OPENVPN_PROTOCOL redirect-gateway $ENABLED. All traffic goes into the tunnel. Read more at: https://cli.co/vzTNq_3"
+  OPENVPN_REDIRECT_GATEWAY_DISABLED="$OPENVPN_PROTOCOL redirect-gateway $DISABLED"
+  OPENVPN_ROUTING_TABLE_EXISTS="$OPENVPN_PROTOCOL routing table $EXISTS"
+  OPENVPN_ROUTING_TABLE_DOESNT_EXIST="$OPENVPN_PROTOCOL routing table $DOESNT_EXIST. Details: https://cli.co/Atxr6U3"
+  SINGBOX_INSTALLED="$SINGBOX_PACKAGE $INSTALLED"
+  SINGBOX_ROUTING_TABLE_EXISTS="$SINGBOX_PACKAGE routing table $EXISTS"
+  SINGBOX_ROUTING_TABLE_DOESNT_EXIST="$SINGBOX_PACKAGE routing table $DOESNT_EXIST. Try: service network restart. Details: https://cli.co/n7xAbc1"
+  SINGBOX_UCI_CONFIG_OK="$SINGBOX_PACKAGE UCI configuration has been successfully validated"
+  SINGBOX_UCI_CONFIG_ERROR="$SINGBOX_PACKAGE Error validation UCI configuration. Check $SINGBOX_CONFIG_PATH"
+  SINGBOX_CONFIG_OK="$SINGBOX_PACKAGE configuration has been successfully validated"
+  SINGBOX_CONFIG_ERROR="$SINGBOX_PACKAGE configuration validation error"
+  SINGBOX_WORKING_TEMPLATE="$SINGBOX_PACKAGE works. VPN IP: %s"
+  SINGBOX_ROUTING_DOESNT_WORK="$SINGBOX_PACKAGE: Your traffic is not routed through the VPN. Check configuration: https://cli.co/Badmn3K"
+  TUN2SOCKS_INSTALLED="$TUN2SOCKS_PACKAGE $INSTALLED"
+  TUN2SOCKS_ROUTING_TABLE_EXISTS="$TUN2SOCKS_PACKAGE routing table $EXISTS"
+  TUN2SOCKS_ROUTING_TABLE_DOESNT_EXIST="$TUN2SOCKS_PACKAGE routing table $DOESNT_EXIST. Try: service network restart. Details: https://cli.co/n7xAbc1"
+  TUN2SOCKS_WORKING_TEMPLATE="$TUN2SOCKS_PACKAGE works. VPN IP: %s"
+  TUN2SOCKS_ROUTING_DOESNT_WORK="$TUN2SOCKS_PACKAGE: Your traffic is not routed through the VPN. Check configuration: https://cli.co/VNZISEM"
+  VPN_DOMAINS_SET_EXISTS="vpn_domains set $EXISTS"
+  VPN_DOMAINS_SET_DOESNT_EXIST="vpn_domains set $DOESNT_EXIST"
+  IPS_IN_VPN_DOMAINS_SET_OK="IPs are successfully added to vpn_domains set"
+  IPS_IN_VPN_DOMAINS_SET_ERROR="IPs were not added to vpn_domains set"
+  VPN_DOMAINS_DETAILS="If you don't use vpn_domains, it's OK.\nBut if you want to use it, check the configuration and run: service getdomains start"
+  VPN_DOMAINS_DETAILS_2="If you don't use vpn_domains, it's OK.\nBut if you want use, check the configuration: https://cli.co/AwUGeM6"
+  VPN_IP_SET_EXISTS="vpn_ip set $EXISTS"
+  VPN_IP_SET_DOESNT_EXIST="vpn_ip set $DOESNT_EXIST. Check configuration: https://cli.co/AwUGeM6"
+  IPS_IN_VPN_IP_SET_OK="IPs are successfully added to vpn_ip set"
+  IPS_IN_VPN_IP_SET_ERROR="IPs were not added to vpn_ip set. But if you want to use it, check configuration"
+  VPN_SUBNET_SET_EXISTS="vpn_subnets set $EXISTS"
+  VPN_SUBNET_SET_DOESNT_EXIST="vpn_subnets set $DOESNT_EXIST. Check configuration: https://cli.co/AwUGeM6"
+  IPS_IN_VPN_SUBNET_SET_OK="IPs are successfully added to vpn_subnets set"
+  IPS_IN_VPN_SUBNET_SET_ERROR="IPs were not added to vpn_subnets set. But if you want to use it, check configs"
+  VPN_COMMUNITY_SET_EXISTS="vpn_community set $EXISTS"
+  VPN_COMMUNITY_SET_DOESNT_EXIST="vpn_community set $DOESNT_EXIST. Check configuration: https://cli.co/AwUGeM6"
+  IPS_IN_VPN_COMMUNITY_SET_OK="IPs are successfully added to vpn_community set"
+  IPS_IN_VPN_COMMUNITY_SET_ERROR="IPs were not added to vpn_community set. But if you want to use it, check configs"
+  GETDOMAINS_SCRIPT_EXISTS="Script $GETDOMAINS_SCRIPT_FILENAME $EXISTS"
+  GETDOMAINS_SCRIPT_DOESNT_EXIST="Script $GETDOMAINS_SCRIPT_FILENAME $DOESNT_EXIST. Script doesn't exists in $GETDOMAINS_SCRIPT_PATH. If you don't use getdomains, it's OK"
+  GETDOMAINS_SCRIPT_CRONTAB_OK="Script $GETDOMAINS_SCRIPT_FILENAME has been successfully added to crontab"
+  GETDOMAINS_SCRIPT_CRONTAB_ERROR="Script $GETDOMAINS_SCRIPT_FILENAME has not been added to crontab. Check: crontab -l"
+  DNSCRYPT_INSTALLED="$DNSCRYPT_PACKAGE $INSTALLED"
+  DNSCRYPT_SERVICE_RUNNING="$DNSCRYPT_PACKAGE service $RUNNING"
+  DNSCRYPT_SERVICE_NOT_RUNNING="$DNSCRYPT_PACKAGE service $NOT_RUNNING. Check configuration: https://cli.co/wN-tc_S"
+  DNSMASQ_CONFIG_FOR_DNSCRYPT_OK="$DNSMASQ_PACKAGE configuration for $DNSCRYPT_PACKAGE is ok"
+  DNSMASQ_CONFIG_FOR_DNSCRYPT_ERROR="$DNSMASQ_PACKAGE configuration for $DNSCRYPT_PACKAGE is not ok. Check configuration: https://cli.co/rooc0uz"
+  STUBBY_INSTALLED="$STUBBY_PACKAGE $INSTALLED"
+  STUBBY_SERVICE_RUNNING="$STUBBY_PACKAGE service $RUNNING"
+  STUBBY_SERVICE_NOT_RUNNING="$STUBBY_PACKAGE service $NOT_RUNNING. Check configuration: https://cli.co/HbDBT2V"
+  DNSMASQ_CONFIG_FOR_STUBBY_OK="$DNSMASQ_PACKAGE configuration for $STUBBY_PACKAGE is ok"
+  DNSMASQ_CONFIG_FOR_STUBBY_ERROR="$DNSMASQ_PACKAGE configuration for $STUBBY_PACKAGE is not ok. Check configuration: https://cli.co/HbDBT2V"
+  DUMP_CREATION="Creating dump without private variables"
+  DUMP_DETAILS="Dump is here: $DUMP_PATH\nFor download on Linux/Mac use: scp root@IP_ROUTER:$DUMP_PATH .\nFor Windows use WinSCP/PSCP or WSL"
+  DNS_CHECK="Checking DNS servers"
+  IS_DNS_TRAFFIC_BLOCKED="Checking DNS traffic blocking (Port 53/udp is available)"
+  IS_DOH_AVAILABLE="Checking DOH availability"
+  RESPONSE_NOT_CONTAINS_127_0_0_8="Checking that the response does not contain an address from 127.0.0.8"
+  ONE_IP_FOR_TWO_DOMAINS="Checking IP for two different domains"
+  IPS_ARE_THE_SAME="IPs are the same"
+  IPS_ARE_DIFFERENT="IPs are different"
+  RESPONSE_IS_NOT_BLANK="Checking if response is not blank"
+  DNS_POISONING_CHECK="Сomparing response from unencrypted DNS and DoH (DNS poisoning)"
+  TELEGRAM_CHANNEL="Telegram channel"
+  TELEGRAM_CHAT="Telegram chat"
+}
+
+set_language_ru() {
+  DEVICE_MODEL="Модель"
+  OPENWRT_VERSION="Версия"
+  CURRENT_DATE="Дата"
+  INSTALLED="установлен"
+  NOT_INSTALLED="не установлен"
+  RUNNING="запущен"
+  NOT_RUNNING="не запущен"
+  ENABLED="включен"
+  DISABLED="выключен"
+  EXISTS="существует"
+  DOESNT_EXIST="не существует"
+  UNSUPPORTED_OPENWRT="Вы используете OpenWrt $UNSUPPORTED_OPENWRT_VERSION. Этот скрипт проверки её не поддерживает."
+  RAM_WARNING="У вашего роутера менее $MIN_RAM МБ ОЗУ. Рекомендуется использовать только vpn_domains set."
+  CURL_INSTALLED="$CURL_PACKAGE $INSTALLED"
+  CURL_NOT_INSTALLED="$CURL_PACKAGE $NOT_INSTALLED. Установите его: opkg install $CURL_PACKAGE"
+  DNSMASQ_FULL_INSTALLED="$DNSMASQ_FULL_PACKAGE $INSTALLED"
+  DNSMASQ_FULL_NOT_INSTALLED="$DNSMASQ_FULL_PACKAGE $NOT_INSTALLED"
+  DNSMASQ_FULL_DETAILS="Если вы не используете vpn_domains set, это нормально\nПроверьте версию: opkg list-installed | grep $DNSMASQ_FULL_PACKAGE\nТребуемая версия >= $DNSMASQ_FULL_REQUIRED_VERSION. Для OpenWrt 22.03 следуйте инструкции: https://t.me/itdoginfo/12"
+  OPENWRT_21_DETAILS="\nВы используете OpenWrt $UNSUPPORTED_OPENWRT_VERSION. Этот скрипт её не поддерживает.\nИнструкция для OpenWrt $UNSUPPORTED_OPENWRT_VERSION: https://t.me/itdoginfo/8"
+  XRAY_CORE_PACKAGE_DETECTED="Обнаружен пакет $XRAY_CORE_PACKAGE"
+  LUCI_APP_XRAY_PACKAGE_DETECTED="Обнаружен пакет $LUCI_APP_XRAY_PACKAGE, который не совместим. Удалите его: opkg remove $LUCI_APP_XRAY_PACKAGE --force-removal-of-dependent-packages"
+  DNSMASQ_SERVICE_RUNNING="Сервис $DNSMASQ_PACKAGE $RUNNING"
+  DNSMASQ_SERVICE_NOT_RUNNING="Сервис $DNSMASQ_PACKAGE $NOT_RUNNING. Проверьте конфигурацию: /etc/config/dhcp"
+  INTERNET_IS_AVAILABLE="Интернет доступен"
+  INTERNET_IS_NOT_AVAILABLE="Интернет недоступен"
+  INTERNET_DETAILS="Проверьте подключение к интернету. Если оно в порядке, проверьте дату на роутере. Подробности: https://cli.co/2EaW4rO\nДополнительно выполните: curl -Is https://community.antifilter.download/"
+  IPV6_DETECTED="Обнаружен IPv6. Этот скрипт не поддерживает работу с IPv6"
+  WIREGUARD_TOOLS_INSTALLED="$WIREGUARD_TOOLS_PACKAGE $INSTALLED"
+  WIREGUARD_ROUTING_DOESNT_WORK="Туннель к $WIREGUARD_PROTOCOL серверу работает, но маршрутизация в интернет не работает. Проверьте конфигурацию сервера. Подробности: https://cli.co/RSCvOxI"
+  WIREGUARD_TUNNEL_NOT_WORKING="Плохие новости: туннель $WIREGUARD_PROTOCOL не работает. Проверьте конфигурацию $WIREGUARD_PROTOCOL. Подробности: https://cli.co/hGUUXDs\nЕсли вы не используете $WIREGUARD_PROTOCOL, а, например, $OPENVPN_PROTOCOL, то это нормально"
+  WIREGUARD_ROUTE_ALLOWED_IPS_ENABLED="$WIREGUARD_PROTOCOL route_allowed_ips $ENABLED. Весь трафик идет в туннель. Подробнее: https://cli.co/SaxBzH7"
+  WIREGUARD_ROUTE_ALLOWED_IPS_DISABLED="$WIREGUARD_PROTOCOL route_allowed_ips $DISABLED"
+  WIREGUARD_ROUTING_TABLE_EXISTS="Таблица маршрутизации $WIREGUARD_PROTOCOL $EXISTS"
+  WIREGUARD_ROUTING_TABLE_DOESNT_EXIST="Таблица маршрутизации $WIREGUARD_PROTOCOL $DOESNT_EXIST. Подробности: https://cli.co/Atxr6U3"
+  OPENVPN_INSTALLED="$OPENVPN_PACKAGE $INSTALLED"
+  OPENVPN_ROUTING_DOESNT_WORK="Туннель к $OPENVPN_PROTOCOL серверу работает, но маршрутизация в интернет не работает. Проверьте конфигурацию сервера."
+  OPENVPN_TUNNEL_NOT_WORKING="Плохие новости: туннель $OPENVPN_PROTOCOL не работает. Проверьте конфигурацию $OPENVPN_PROTOCOL."
+  OPENVPN_REDIRECT_GATEWAY_ENABLED="$OPENVPN_PROTOCOL redirect-gateway $ENABLED. Весь трафик идет в туннель. Подробнее: https://cli.co/vzTNq_3"
+  OPENVPN_REDIRECT_GATEWAY_DISABLED="$OPENVPN_PROTOCOL redirect-gateway $DISABLED"
+  OPENVPN_ROUTING_TABLE_EXISTS="Таблица маршрутизации $OPENVPN_PROTOCOL $EXISTS"
+  OPENVPN_ROUTING_TABLE_DOESNT_EXIST="Таблица маршрутизации $OPENVPN_PROTOCOL $DOESNT_EXIST. Подробности: https://cli.co/Atxr6U3"
+  SINGBOX_INSTALLED="$SINGBOX_PACKAGE $INSTALLED"
+  SINGBOX_ROUTING_TABLE_EXISTS="Таблица маршрутизации $SINGBOX_PACKAGE $EXISTS"
+  SINGBOX_ROUTING_TABLE_DOESNT_EXIST="Таблица маршрутизации $SINGBOX_PACKAGE $DOESNT_EXIST. Попробуйте: service network restart. Подробности: https://cli.co/n7xAbc1"
+  SINGBOX_UCI_CONFIG_OK="UCI конфигурация для $SINGBOX_PACKAGE успешно проверена"
+  SINGBOX_UCI_CONFIG_ERROR="Ошибка валидации UCI конфигурации для $SINGBOX_PACKAGE"
+  SINGBOX_CONFIG_OK="Конфигурация $SINGBOX_PACKAGE успешно проверена"
+  SINGBOX_CONFIG_ERROR="Ошибка валидации конфигурации $SINGBOX_PACKAGE"
+  SINGBOX_WORKING_TEMPLATE="$SINGBOX_PACKAGE работает. VPN IP: %s"
+  SINGBOX_ROUTING_DOESNT_WORK="$SINGBOX_PACKAGE: Ваш трафик не идёт через VPN. Проверьте конфигурацию: https://cli.co/Badmn3K"
+  TUN2SOCKS_INSTALLED="$TUN2SOCKS_PACKAGE $INSTALLED"
+  TUN2SOCKS_ROUTING_TABLE_EXISTS="Таблица маршрутизации $TUN2SOCKS_PROTOCOL $EXISTS"
+  TUN2SOCKS_ROUTING_TABLE_DOESNT_EXIST="Таблица маршрутизации $TUN2SOCKS_PROTOCOL $DOESNT_EXIST. Подробности: https://cli.co/n7xAbc1"
+  TUN2SOCKS_WORKING_TEMPLATE="$TUN2SOCKS_PACKAGE работает. VPN IP: %s"
+  TUN2SOCKS_ROUTING_DOESNT_WORK="$TUN2SOCKS_PACKAGE: Ваш трафик не идёт через VPN. Проверьте конфигурацию: https://cli.co/VNZISEM"
+  VPN_DOMAINS_SET_EXISTS="vpn_domains set $EXISTS"
+  VPN_DOMAINS_SET_DOESNT_EXIST="vpn_domains set $DOESNT_EXIST"
+  IPS_IN_VPN_DOMAINS_SET_OK="IP-адреса успешно добавлены в vpn_domains set"
+  IPS_IN_VPN_DOMAINS_SET_ERROR="IP-адреса не добавлены в vpn_domains set"
+  VPN_DOMAINS_DETAILS="Если вы не используете vpn_domains, все в порядке.\nНо если вы хотите использовать его, проверьте конфигурацию и выполните: service getdomains start"
+  VPN_DOMAINS_DETAILS_2="Если вы не используете vpn_domains, все в порядке.\nНо если вы хотите использовать, проверьте конфигурацию: https://cli.co/AwUGeM6"
+  VPN_IP_SET_EXISTS="vpn_ip set $EXISTS"
+  VPN_IP_SET_DOESNT_EXIST="vpn_ip set $DOESNT_EXIST"
+  IPS_IN_VPN_IP_SET_OK="IP-адреса успешно добавлены в set vpn_ip"
+  IPS_IN_VPN_IP_SET_ERROR="IP-адреса не добавлены в set vpn_ip"
+  VPN_SUBNET_SET_EXISTS="vpn_subnet set $EXISTS"
+  VPN_SUBNET_SET_DOESNT_EXIST="vpn_subnet set $DOESNT_EXIST"
+  IPS_IN_VPN_SUBNET_SET_OK="IP-адреса успешно добавлены в set vpn_subnet"
+  IPS_IN_VPN_SUBNET_SET_ERROR="IP-адреса не добавлены в set vpn_subnet"
+  VPN_COMMUNITY_SET_EXISTS="vpn_community set $EXISTS"
+  VPN_COMMUNITY_SET_DOESNT_EXIST="vpn_community set $DOESNT_EXIST"
+  IPS_IN_VPN_COMMUNITY_SET_OK="IP-адреса успешно добавлены в set vpn_community"
+  IPS_IN_VPN_COMMUNITY_SET_ERROR="IP-адреса не добавлены в set vpn_community"
+  GETDOMAINS_SCRIPT_EXISTS="Скрипт $GETDOMAINS_SCRIPT_FILENAME $EXISTS"
+  GETDOMAINS_SCRIPT_DOESNT_EXIST="Скрипт $GETDOMAINS_SCRIPT_FILENAME $DOESNT_EXIST"
+  GETDOMAINS_SCRIPT_CRONTAB_OK="Скрипт $GETDOMAINS_SCRIPT_FILENAME успешно добавлен в crontab"
+  GETDOMAINS_SCRIPT_CRONTAB_ERROR="Скрипт $GETDOMAINS_SCRIPT_FILENAME не был добавлен в crontab. Проверьте: crontab -l"
+  DNSCRYPT_INSTALLED="$DNSCRYPT_PACKAGE $INSTALLED"
+  DNSCRYPT_SERVICE_RUNNING="Сервис $DNSCRYPT_PACKAGE $RUNNING"
+  DNSCRYPT_SERVICE_NOT_RUNNING="Сервис $DNSCRYPT_PACKAGE $NOT_RUNNING. Проверьте конфигурацию: https://cli.co/wN-tc_S"
+  DNSMASQ_CONFIG_FOR_DNSCRYPT_OK="Конфигурация $DNSMASQ_PACKAGE для $DNSCRYPT_PACKAGE в порядке"
+  DNSMASQ_CONFIG_FOR_DNSCRYPT_ERROR="Конфигурация $DNSMASQ_PACKAGE для $DNSCRYPT_PACKAGE не в порядке. Проверьте конфигурацию: https://cli.co/rooc0uz"
+  STUBBY_INSTALLED="$STUBBY_PACKAGE $INSTALLED"
+  STUBBY_SERVICE_RUNNING="Сервис $STUBBY_PACKAGE $RUNNING"
+  STUBBY_SERVICE_NOT_RUNNING="Сервис $STUBBY_PACKAGE $NOT_RUNNING. Проверьте конфигурацию: https://cli.co/HbDBT2V"
+  DNSMASQ_CONFIG_FOR_STUBBY_OK="Конфигурация $DNSMASQ_PACKAGE для $STUBBY_PACKAGE в порядке"
+  DNSMASQ_CONFIG_FOR_STUBBY_ERROR="Конфигурация $DNSMASQ_PACKAGE для $STUBBY_PACKAGE не в порядке. Проверьте конфигурацию: https://cli.co/HbDBT2V"
+  DUMP_CREATION="Создание дампа без приватных переменных"
+  DUMP_DETAILS="Дамп находится здесь: $DUMP_PATH\nДля загрузки на Linux/Mac используйте: scp root@IP_ROUTER:$DUMP_PATH .\nДля Windows используйте WinSCP/PSCP или WSL"
+  DNS_CHECK="Проверка DNS серверов"
+  IS_DNS_TRAFFIC_BLOCKED="Проверяем блокировку DNS трафика (Порт 53/udp доступен)"
+  IS_DOH_AVAILABLE="Проверяем доступность DoH"
+  RESPONSE_NOT_CONTAINS_127_0_0_8="Проверяем, что ответ на запрос не содержит адреса из 127.0.0.8"
+  ONE_IP_FOR_TWO_DOMAINS="Проверяем IP для двух разных доменов"
+  IPS_ARE_THE_SAME="IP совпадают"
+  IPS_ARE_DIFFERENT="IP различаются"
+  RESPONSE_IS_NOT_BLANK="Проверяем, что ответ не пустой"
+  DNS_POISONING_CHECK="Сравниваем ответ от незащищенного DNS и DoH (Подмена DNS)"
+  TELEGRAM_CHANNEL="Telegram канал"
+  TELEGRAM_CHAT="Telegram чат"
+}
 
 checkpoint_true() {
-    printf "\033[32;1m[\342\234\223] $1\033[0m\n"
+  printf "$COLOR_BOLD_GREEN[\342\234\223] $1$COLOR_RESET\n"
 }
 
 checkpoint_false() {
-    printf "\033[31;1m[x] $1\033[0m\n"
+  printf "$COLOR_BOLD_RED[x] $1$COLOR_RESET\n"
 }
 
 output_21() {
-    if [ "$VERSION_ID" -eq 21 ]; then
+  if [ "$VERSION_ID" -eq 21 ]; then
-        echo "You are using OpenWrt 21.02. This check does not support it"
+    echo "$UNSUPPORTED_OPENWRT"
-    fi
+  fi
 }
 
-# System Details
+update_vpn_ip() {
-MODEL=$(grep machine /proc/cpuinfo | cut -d ':' -f 2)
+  local template="$1"
-RELEASE=$(grep OPENWRT_RELEASE /etc/os-release | awk -F '"' '{print $2}')
+  local ip="$2"
-printf "\033[34;1mModel:$MODEL\033[0m\n"
+  echo "$(printf "$template" "$ip")"
-printf "\033[34;1mVersion: $RELEASE\033[0m\n"
+}
-printf "\033[34;1mDate: $(date)\033[0m\n"
 
-VERSION_ID=$(grep VERSION_ID /etc/os-release | awk -F '"' '{print $2}' | awk -F. '{print $1}')
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --lang)
+      LANGUAGE="$2"
+      shift 2
+      ;;
+    dump | dns)
+      COMMAND="$1"
+      shift 1
+      ;;
+    *)
+      printf "$COLOR_BOLD_RED[ERROR]$COLOR_RESET Unknown option: %s\n" "$1"
+      exit 1
+      ;;
+  esac
+done
+
+case $LANGUAGE in
+  ru)
+    set_language_ru
+    ;;
+  en)
+    set_language_en
+    ;;
+  *)
+    printf "$COLOR_BOLD_RED[ERROR]$COLOR_RESET Unsupported language '$LANGUAGE'. Supported languages: $SUPPORTED_LANGUAGES %s\n" "$1"
+    exit 1
+    ;;
+esac
+
+# System Details
+MODEL=$(cat /tmp/sysinfo/model)
+source /etc/os-release
+printf "$COLOR_BOLD_BLUE$DEVICE_MODEL: $MODEL$COLOR_RESET\n"
+printf "$COLOR_BOLD_BLUE$OPENWRT_VERSION: $OPENWRT_RELEASE$COLOR_RESET\n"
+printf "$COLOR_BOLD_BLUE$CURRENT_DATE: $(date)$COLOR_RESET\n"
+
+VERSION_ID=$(echo $VERSION | awk -F. '{print $1}')
 RAM=$(free -m | grep Mem: | awk '{print $2}')
-if [[ "$VERSION_ID" -ge 22 && "$RAM" -lt 150000 ]]
+if [[ "$VERSION_ID" -ge 22 && "$RAM" -lt 150000 ]]; then
-then 
+  echo "$RAM_WARNING"
-   echo "Your router has less than 256MB of RAM. I recommend using only the vpn_domains list"
 fi
 
 # Check packages
 CURL=$(opkg list-installed | grep -c curl)
 if [ $CURL -eq 2 ]; then
-    checkpoint_true "Curl package"
+  checkpoint_true "$CURL_INSTALLED"
 else
-    checkpoint_false "Curl package"
+  checkpoint_false "$CURL_NOT_INSTALLED"
-    echo "Install: opkg install curl"
 fi
 
-DNSMASQ=$(opkg list-installed | grep dnsmasq-full | awk -F "-" '{print $3}' | tr -d '.' )
+DNSMASQ=$(opkg list-installed | grep dnsmasq-full | awk -F "-" '{print $3}' | tr -d '.')
 if [ $DNSMASQ -ge 287 ]; then
-    checkpoint_true "Dnsmasq-full package"
+  checkpoint_true "$DNSMASQ_FULL_INSTALLED"
 else
-    checkpoint_false "Dnsmasq-full package"
+  checkpoint_false "$DNSMASQ_FULL_NOT_INSTALLED"
-    echo "If you don't use vpn_domains set, it's OK"
+  printf "$DNSMASQ_FULL_DETAILS\n"
-    echo "Check version: opkg list-installed | grep dnsmasq-full"
+  if [ "$VERSION_ID" -eq 21 ]; then
-    echo "Required version >= 2.87. For openwrt 22.03 follow manual: https://t.me/itdoginfo/12"
+    printf "$OPENWRT_21_DETAILS\n"
-    if [ "$VERSION_ID" -eq 21 ]; then
+  fi
-        echo "You are using OpenWrt 21.02. This check does not support it"
-        echo "Manual for openwrt 21.02: https://t.me/itdoginfo/8"
-    fi
 fi
 
 # Chek xray package
 if opkg list-installed | grep -q xray-core; then
-    checkpoint_false "Xray-core package detected"
+  checkpoint_false "$XRAY_CORE_PACKAGE_DETECTED"
 fi
 
 if opkg list-installed | grep -q luci-app-xray; then
-    checkpoint_false "luci-app-xray package detected. Not compatible. For delete: opkg remove luci-app-xray --force-removal-of-dependent-packages"
+  checkpoint_false "$LUCI_APP_XRAY_PACKAGE_DETECTED"
 fi
 
 # Check dnsmasq
 DNSMASQ_RUN=$(service dnsmasq status | grep -c 'running')
 if [ $DNSMASQ_RUN -eq 1 ]; then
-    checkpoint_true "Dnsmasq service"
+  checkpoint_true "$DNSMASQ_SERVICE_RUNNING"
 else
-    checkpoint_false "Dnsmasq service"
+  checkpoint_false "$DNSMASQ_SERVICE_NOT_RUNNING"
-    echo "Check config /etc/config/dhcp"
+  output_21
-    output_21
 fi
 
-
 # Check internet connection
 if curl -Is https://community.antifilter.download/ | grep -q 200; then
-    checkpoint_true "Check Internet"
+  checkpoint_true "$INTERNET_IS_AVAILABLE"
-    else
+else
-    checkpoint_false "Check Internet"
+  checkpoint_false "$INTERNET_IS_NOT_AVAILABLE"
-    if [ $CURL -lt 2 ]; then
+  if [ $CURL -lt 2 ]; then
-        echo "Install curl: opkg install curl"
+    echo "$CURL_NOT_INSTALLED"
-    else
+  else
-        echo "Check internet connection. If ok, check date on router. Details: https://cli.co/2EaW4rO"
+    printf "$INTERNET_DETAILS\n"
-        echo "For more info run: curl -Is https://community.antifilter.download/"
+  fi
-    fi
 fi
 
 # Check IPv6
 
 if curl -6 -s https://ifconfig.io | egrep -q "(::)?[0-9a-fA-F]{1,4}(::?[0-9a-fA-F]{1,4}){1,7}(::)?"; then
-    checkpoint_false "IPv6 detected. This script does not currently work with IPv6"
+  checkpoint_false "$IPV6_DETECTED"
-fi
-
-# PPPoE
-if uci show network.wan.proto | grep -q "pppoe"; then
-    checkpoint_false "PPPoE is used. That could be a problem"
 fi
 
 # Tunnels
-WIREGUARD=$(opkg list-installed | grep -c wireguard-tools )
+WIREGUARD=$(opkg list-installed | grep -c wireguard-tools)
 if [ $WIREGUARD -eq 1 ]; then
-    checkpoint_true "Wireguard-tools package"
+  checkpoint_true "$WIREGUARD_TOOLS_INSTALLED"
-    WG=true
+  WG=true
 fi
 
 if [ "$WG" == true ]; then
-    WG_PING=$(ping -c 1 -q -I wg0 itdog.info | grep -c "1 packets received")
+  WG_PING=$(ping -c 1 -q -I wg0 itdog.info | grep -c "1 packets received")
-    if [ $WG_PING -eq 1 ]; then
+  if [ $WG_PING -eq 1 ]; then
-        checkpoint_true "Wireguard"
+    checkpoint_true "$WIREGUARD_PROTOCOL"
+  else
+    checkpoint_false "$WIREGUARD_PROTOCOL"
+    WG_TRACE=$(traceroute -i wg0 itdog.info -m 1 | grep ms | awk '{print $2}' | grep -c -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
+    if [ $WG_TRACE -eq 1 ]; then
+      echo "$WIREGUARD_ROUTING_DOESNT_WORK"
     else
-        checkpoint_false "Wireguard"
+      printf "$WIREGUARD_TUNNEL_NOT_WORKING\n"
-        WG_TRACE=$(traceroute -i wg0 itdog.info -m 1 | grep ms | awk '{print $2}' | grep -c -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
-        if [ $WG_TRACE -eq 1 ]; then
-            echo "Tunnel to wg server is work, but routing to internet doesn't work. Check server configuration. Details: https://cli.co/RSCvOxI"
-        else
-            echo "Bad news: WG tunnel isn't work, check your WG configuration. Details: https://cli.co/hGUUXDs"
-            echo "If you don't use WG, but OpenVPN for example, it's OK"
-        fi
     fi
+  fi
 
-    # Check WG route_allowed_ips
+  # Check WG route_allowed_ips
-    if uci show network | grep -q ".route_allowed_ips='1'"; then
+  if uci show network | grep -q ".route_allowed_ips='1'"; then
-        checkpoint_false "Wireguard route_allowed_ips"
+    checkpoint_false "$WIREGUARD_ROUTE_ALLOWED_IPS_ENABLED"
-        echo "All traffic goes into the tunnel. Read more at: https://cli.co/SaxBzH7"
+  else
-    else
+    checkpoint_true "$WIREGUARD_ROUTE_ALLOWED_IPS_DISABLED"
-        checkpoint_true "Wireguard route_allowed_ips"
+  fi
-    fi
 
-    # Check route table
+  # Check route table
-    ROUTE_TABLE=$(ip route show table vpn | grep -c "default dev wg0" )
+  ROUTE_TABLE=$(ip route show table vpn | grep -c "default dev wg0")
-    if [ $ROUTE_TABLE -eq 1 ]; then
+  if [ $ROUTE_TABLE -eq 1 ]; then
-        checkpoint_true "Route table WG"
+    checkpoint_true "$WIREGUARD_ROUTING_TABLE_EXISTS"
-    else
+  else
-        checkpoint_false "Route table VPN"
+    checkpoint_false "$WIREGUARD_ROUTING_TABLE_DOESNT_EXIST"
-        echo "Details: https://cli.co/Atxr6U3"
+  fi
-    fi
 fi
 
 if opkg list-installed | grep -q openvpn; then
-    checkpoint_true "OpenVPN package"
+  checkpoint_true "$OPENVPN_INSTALLED"
-    OVPN=true
+  OVPN=true
 fi
 
 # Check OpenVPN
 if [ "$OVPN" == true ]; then
-    if ping -c 1 -q -I tun0 itdog.info | grep -q "1 packets received"; then
+  if ping -c 1 -q -I tun0 itdog.info | grep -q "1 packets received"; then
-        checkpoint_true "OpenVPN"
+    checkpoint_true "$OPENVPN_PROTOCOL"
+  else
+    checkpoint_false "$OPENVPN_PROTOCOL"
+    if traceroute -i tun0 itdog.info -m 1 | grep ms | awk '{print $2}' | grep -c -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'; then
+      echo "$OPENVPN_ROUTING_DOESNT_WORK"
     else
-        checkpoint_false "OpenVPN"
+      echo "$OPENVPN_TUNNEL_NOT_WORKING"
-        if traceroute -i tun0 itdog.info -m 1 | grep ms | awk '{print $2}' | grep -c -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'; then
-            echo "Tunnel to OpenVPN server is work, but routing to internet doesn't work. Check server configuration."
-        else
-            echo "Bad news: OpenVPN tunnel isn't work, check your OpenVPN configuration."
-        fi
     fi
+  fi
 
-    # Check OpenVPN redirect-gateway
+  # Check OpenVPN redirect-gateway
-    if grep -q redirect-gateway /etc/openvpn/*; then
+  if grep -q redirect-gateway /etc/openvpn/*; then
-        checkpoint_false "OpenVPN redirect-gateway"
+    checkpoint_false "$OPENVPN_REDIRECT_GATEWAY_ENABLED"
-        echo "All traffic goes into the tunnel. Read more at: https://cli.co/vzTNq_3"
+  else
-    else
+    checkpoint_true "$OPENVPN_REDIRECT_GATEWAY_DISABLED"
-        checkpoint_true "OpenVPN redirect-gateway"
+  fi
-    fi
 
-    # Check route table
+  # Check route table
-    if ip route show table vpn | grep -q "default dev tun0"; then
+  if ip route show table vpn | grep -q "default dev tun0"; then
-        checkpoint_true "Route table OpenVPN"
+    checkpoint_true "$OPENVPN_ROUTING_TABLE_EXISTS"
-    else
+  else
-        checkpoint_false "Route table OpenVPN"
+    checkpoint_false "$OPENVPN_ROUTING_TABLE_DOESNT_EXIST"
-        echo "Details: https://cli.co/Atxr6U3"
+  fi
-    fi
 fi
 
 if opkg list-installed | grep -q sing-box; then
-    checkpoint_true "Sing-box package"
+  checkpoint_true "$SINGBOX_INSTALLED"
 
-    # Check route table
+  # Check route table
-    if ip route show table vpn | grep -q "default dev tun0"; then
+  if ip route show table vpn | grep -q "default dev tun0"; then
-        checkpoint_true "Route table Sing-box"
+    checkpoint_true "$SINGBOX_ROUTING_TABLE_EXISTS"
-    else
+  else
-        checkpoint_false "Route table Sing-box. Try service network restart. Details: https://cli.co/n7xAbc1"
+    checkpoint_false "$SINGBOX_ROUTING_TABLE_DOESNT_EXIST"
-    fi
+  fi
 
-    # Sing-box uci validation
+  # Sing-box uci validation
-    if uci show sing-box 2>&1 | grep -q "Parse error"; then
+  if uci show sing-box 2>&1 | grep -q "Parse error"; then
-        checkpoint_false "Sing-box UCI config. Check /etc/config/sing-box"
+    checkpoint_false "$SINGBOX_UCI_CONFIG_ERROR"
-    else
+  else
-        checkpoint_true "Sing-box UCI config"
+    checkpoint_true "$SINGBOX_UCI_CONFIG_OK"
-    fi    
+  fi
+
+  singbox_check_cmd="sing-box -c /etc/sing-box/config.json check"
+  if $singbox_check_cmd >/dev/null 2>&1; then
+    checkpoint_true "$SINGBOX_CONFIG_OK"
 
     # Check traffic
     IP_EXTERNAL=$(curl -s ifconfig.me)
@@ -197,33 +461,41 @@ if opkg list-installed | grep -q sing-box; then
 
     IP_VPN=$(curl --interface tun0 -s ifconfig.me)
 
+    SINGBOX_WORKING=$(update_vpn_ip "$SINGBOX_WORKING_TEMPLATE" "$IP_VPN")
+
     if [ "$IP_EXTERNAL" != $IP_VPN ]; then
-        checkpoint_true "Sing-box. VPN IP: $IP_VPN"
+      checkpoint_true "$SINGBOX_WORKING"
     else
-        checkpoint_false "Sing-box. Check config: https://cli.co/Badmn3K"
+      checkpoint_false "$SINGBOX_ROUTING_DOESNT_WORK"
     fi
+  else
+    checkpoint_false "$SINGBOX_CONFIG_ERROR:"
+    $singbox_check_cmd
+  fi
 fi
 
 if which tun2socks | grep -q tun2socks; then
-    checkpoint_true "tun2socks package"
+  checkpoint_true "$TUN2SOCKS_INSTALLED"
 
-    # Check route table
+  # Check route table
-    if ip route show table vpn | grep -q "default dev tun0"; then
+  if ip route show table vpn | grep -q "default dev tun0"; then
-        checkpoint_true "Route table tun2socks"
+    checkpoint_true "$TUN2SOCKS_ROUTING_TABLE_EXISTS"
-    else
+  else
-        checkpoint_false "Route table tun2socks. Try service network restart. Details: https://cli.co/n7xAbc1"
+    checkpoint_false "$TUN2SOCKS_ROUTING_TABLE_DOESNT_EXIST"
-    fi
+  fi
 
-    IP_EXTERNAL=$(curl -s ifconfig.me)
+  IP_EXTERNAL=$(curl -s ifconfig.me)
-    IFCONFIG=$(nslookup -type=a ifconfig.me | awk '/^Address: / {print $2}')
+  IFCONFIG=$(nslookup -type=a ifconfig.me | awk '/^Address: / {print $2}')
 
-    IP_VPN=$(curl --interface tun0 -s ifconfig.me)
+  IP_VPN=$(curl --interface tun0 -s ifconfig.me)
 
-    if [ "$IP_EXTERNAL" != $IP_VPN ]; then
+  TUN2SOCKS_WORKING=$(update_vpn_ip "$TUN2SOCKS_WORKING_TEMPLATE" "$IP_VPN")
-        checkpoint_true "tun2socks. VPN IP: $IP_VPN"
+
-    else
+  if [ "$IP_EXTERNAL" != $IP_VPN ]; then
-        checkpoint_false "tun2socks. Check config: https://cli.co/VNZISEM"
+    checkpoint_true "$TUN2SOCKS_WORKING"
-    fi
+  else
+    checkpoint_false "$TUN2SOCKS_ROUTING_DOESNT_WORK"
+  fi
 fi
 
 # Check sets
@@ -235,26 +507,24 @@ vpn_domain_rule_id=$(uci show firewall | grep -E '@rule.*vpn_domains' | awk -F '
 vpn_domain_rule_string=$(uci show firewall.@rule[$vpn_domain_rule_id] | grep -c "name='mark_domains'\|src='lan'\|dest='*'\|proto='all'\|ipset='vpn_domains'\|set_mark='0x1'\|target='MARK'\|family='ipv4'")
 
 if [ $((vpn_domain_ipset_string + vpn_domain_rule_string)) -eq 10 ]; then
-    checkpoint_true "vpn_domains set"
+  checkpoint_true "$VPN_DOMAINS_SET_EXISTS"
 
-    # force resolve for vpn_domains. All list
+  # force resolve for vpn_domains. All list
-    nslookup terraform.io 127.0.0.1 > /dev/null
+  nslookup terraform.io 127.0.0.1 >/dev/null
-    nslookup pochta.ru 127.0.0.1 > /dev/null
+  nslookup pochta.ru 127.0.0.1 >/dev/null
-    nslookup 2gis.ru 127.0.0.1 > /dev/null
+  nslookup 2gis.ru 127.0.0.1 >/dev/null
 
-    VPN_DOMAINS_IP=$(nft list ruleset | grep -A 10 vpn_domains | grep -c -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
+  VPN_DOMAINS_IP=$(nft list ruleset | grep -A 10 vpn_domains | grep -c -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
-    if [ $VPN_DOMAINS_IP -ge 1 ]; then
+  if [ $VPN_DOMAINS_IP -ge 1 ]; then
-        checkpoint_true "IPs in vpn_domains"
+    checkpoint_true "$IPS_IN_VPN_DOMAINS_SET_OK"
-    else
+  else
-        checkpoint_false "IPs in vpn_domains"
+    checkpoint_false "$IPS_IN_VPN_DOMAINS_SET_ERROR"
-        echo "If you don't use vpn_domains, it's OK"
+    printf "$VPN_DOMAINS_DETAILS\n"
-        echo "But if you want use, check configs. And run `service getdomains start`"
+    output_21
-        output_21
+  fi
-    fi
 else
-    checkpoint_false "vpn_domains set"
+  checkpoint_false "$VPN_DOMAINS_SET_DOESNT_EXIST"
-    echo "If you don't use vpn_domains set, it's OK"
+  printf "$VPN_DOMAINS_DETAILS_2\n"
-    echo "But if you want use, check config: https://cli.co/AwUGeM6"
 fi
 
 # vpn_ip set
@@ -264,18 +534,16 @@ vpn_ip_rule_id=$(uci show firewall | grep -E '@rule.*vpn_ip' | awk -F '[][{}]' '
 vpn_ip_rule_string=$(uci show firewall.@rule[$vpn_ip_rule_id] | grep -c "name='mark_ip'\|src='lan'\|dest='*'\|proto='all'\|ipset='vpn_ip'\|set_mark='0x1'\|target='MARK'\|family='ipv4'")
 
 if [ $((vpn_ip_ipset_string + vpn_ip_rule_string)) -eq 11 ]; then
-    checkpoint_true "vpn_ip set"
+  checkpoint_true "$VPN_IP_SET_EXISTS"
-    VPN_IP_IP=$(nft list ruleset | grep -A 10 vpn_ip | grep -c -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
+  VPN_IP_IP=$(nft list ruleset | grep -A 10 vpn_ip | grep -c -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
-    if [ $VPN_IP_IP -ge 1 ]; then
+  if [ $VPN_IP_IP -ge 1 ]; then
-        checkpoint_true "IPs in vpn_ip"
+    checkpoint_true "$IPS_IN_VPN_IP_SET_OK"
-    else
+  else
-        checkpoint_false "IPs in vpn_ip"
+    checkpoint_false "$IPS_IN_VPN_IP_SET_ERROR"
-        echo "But if you want use, check configs"
+    output_21
-        output_21
+  fi
-    fi
 elif uci show firewall | grep -q "vpn_ip"; then
-        checkpoint_false "vpn_ip set"
+  checkpoint_false "$VPN_IP_SET_DOESNT_EXIST"
-        echo "Check config: https://cli.co/AwUGeM6"
 fi
 
 # vpn_subnet set
@@ -285,18 +553,16 @@ vpn_subnet_rule_id=$(uci show firewall | grep -E '@rule.*vpn_subnet' | awk -F '[
 vpn_subnet_rule_string=$(uci show firewall.@rule[$vpn_subnet_rule_id] | grep -c "name='mark_subnet'\|src='lan'\|dest='*'\|proto='all'\|ipset='vpn_subnets'\|set_mark='0x1'\|target='MARK'\|family='ipv4'")
 
 if [ $((vpn_subnet_ipset_string + vpn_subnet_rule_string)) -eq 11 ]; then
-    checkpoint_true "vpn_subnet set"
+  checkpoint_true "$VPN_SUBNET_SET_EXISTS"
-    VPN_IP_SUBNET=$(nft list ruleset | grep -A 10 vpn_subnet | grep -c -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
+  VPN_IP_SUBNET=$(nft list ruleset | grep -A 10 vpn_subnet | grep -c -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
-    if [ $VPN_IP_SUBNET -ge 1 ]; then
+  if [ $VPN_IP_SUBNET -ge 1 ]; then
-        checkpoint_true "IPs in vpn_subnet"
+    checkpoint_true "$IPS_IN_VPN_SUBNET_SET_OK"
-    else
+  else
-        checkpoint_false "IPs in vpn_subnet"
+    checkpoint_false "$IPS_IN_VPN_SUBNET_SET_ERROR"
-        echo "But if you want use, check configs"
+    output_21
-        output_21
+  fi
-    fi
 elif uci show firewall | grep -q "vpn_subnet"; then
-        checkpoint_false "vpn_subnet set"
+  checkpoint_false "$VPN_SUBNET_SET_DOESNT_EXIST"
-        echo "Check config: https://cli.co/AwUGeM6"
 fi
 
 # vpn_community set
@@ -306,165 +572,151 @@ vpn_community_rule_id=$(uci show firewall | grep -E '@rule.*vpn_community' | awk
 vpn_community_rule_string=$(uci show firewall.@rule[$vpn_community_rule_id] | grep -c "name='mark_community'\|src='lan'\|dest='*'\|proto='all'\|ipset='vpn_community'\|set_mark='0x1'\|target='MARK'\|family='ipv4'")
 
 if [ $((vpn_community_ipset_string + vpn_community_rule_string)) -eq 11 ]; then
-    checkpoint_true "vpn_community set"
+  checkpoint_true "$VPN_COMMUNITY_SET_EXISTS"
-    VPN_COMMUNITY_IP=$(nft list ruleset | grep -A 10 vpn_community | grep -c -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
+  VPN_COMMUNITY_IP=$(nft list ruleset | grep -A 10 vpn_community | grep -c -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
-    if [ $VPN_COMMUNITY_IP -ge 1 ]; then
+  if [ $VPN_COMMUNITY_IP -ge 1 ]; then
-        checkpoint_true "IPs in vpn_community"
+    checkpoint_true "$IPS_IN_VPN_COMMUNITY_SET_OK"
-    else
+  else
-        checkpoint_false "IPs in vpn_community"
+    checkpoint_false "$IPS_IN_VPN_COMMUNITY_SET_ERROR"
-        echo "But if you want use, check configs"
+    output_21
-        output_21
+  fi
-    fi
 elif uci show firewall | grep -q "vpn_community"; then
-        checkpoint_false "vpn_community set"
+  checkpoint_false "$VPN_COMMUNITY_SET_DOESNT_EXIST"
-        echo "Check config: https://cli.co/AwUGeM6"
 fi
 
 # getdomains script
-if [ -s "$GETDOMAINS" ]; then
+if [ -s "$GETDOMAINS_SCRIPT_PATH" ]; then
-    checkpoint_true "Script getdomains"
+  checkpoint_true "$GETDOMAINS_SCRIPT_EXISTS"
-    if crontab -l | grep -q $GETDOMAINS; then
+  if crontab -l | grep -q $GETDOMAINS_SCRIPT_PATH; then
-        checkpoint_true "Script getdomains in crontab"
+    checkpoint_true "$GETDOMAINS_SCRIPT_CRONTAB_OK"
-    else
+  else
-        checkpoint_false "Script getdomains in crontab"
+    checkpoint_false "$GETDOMAINS_SCRIPT_CRONTAB_ERROR"
-        echo "Script is not enabled in crontab. Check: crontab -l"
+  fi
-    fi
 else
-    checkpoint_false "Script getdomains"
+  checkpoint_false "$GETDOMAINS_SCRIPT_DOESNT_EXIST"
-    echo "Script don't exists in $GETDOMAINS. If you don't use getdomains, it's OK"
 fi
 
 # DNS
 
 # DNSCrypt
 if opkg list-installed | grep -q dnscrypt-proxy2; then
-    checkpoint_true "Dnscrypt-proxy2 package"
+  checkpoint_true "$DNSCRYPT_INSTALLED"
-    if service dnscrypt-proxy status | grep -q 'running'; then
+  if service dnscrypt-proxy status | grep -q 'running'; then
-        checkpoint_true "DNSCrypt service"
+    checkpoint_true "$DNSCRYPT_SERVICE_RUNNING"
-    else
+  else
-        checkpoint_false "DNSCrypt service"
+    checkpoint_false "$DNSCRYPT_SERVICE_NOT_RUNNING"
-        echo "Check config: https://cli.co/wN-tc_S"
+    output_21
-        output_21
+  fi
-    fi
 
-    DNSMASQ_STRING=$(uci show dhcp.@dnsmasq[0] | grep -c "127.0.0.53#53\|noresolv='1'")
+  DNSMASQ_STRING=$(uci show dhcp.@dnsmasq[0] | grep -c "127.0.0.53#53\|noresolv='1'")
-    if [ $DNSMASQ_STRING -eq 2 ]; then
+  if [ $DNSMASQ_STRING -eq 2 ]; then
-        checkpoint_true "Dnsmasq config for DNSCrypt"
+    checkpoint_true "$DNSMASQ_CONFIG_FOR_DNSCRYPT_OK"
-    else
+  else
-        checkpoint_false "Dnsmasq config for DNSCrypt"
+    checkpoint_false "$DNSMASQ_CONFIG_FOR_DNSCRYPT_ERROR"
-        echo "Check config: https://cli.co/rooc0uz"
+  fi
-    fi
 fi
 
 # Stubby
 if opkg list-installed | grep -q stubby; then
-    checkpoint_true "Stubby package"
+  checkpoint_true "$STUBBY_INSTALLED"
-    if service stubby status | grep -q 'running'; then
+  if service stubby status | grep -q 'running'; then
-        checkpoint_true "Stubby service"
+    checkpoint_true "$STUBBY_SERVICE_RUNNING"
-    else
+  else
-        checkpoint_false "Stubby service"
+    checkpoint_false "$STUBBY_SERVICE_NOT_RUNNING"
-        echo "Check config: https://cli.co/HbDBT2V"
+    output_21
-        output_21
+  fi
-    fi
 
-    STUBBY_STRING=$(uci show dhcp.@dnsmasq[0] | grep -c "127.0.0.1#5453\|noresolv='1'")
+  STUBBY_STRING=$(uci show dhcp.@dnsmasq[0] | grep -c "127.0.0.1#5453\|noresolv='1'")
-    if [ $STUBBY_STRING -eq 2 ]; then
+  if [ $STUBBY_STRING -eq 2 ]; then
-        checkpoint_true "Dnsmasq config for Stubby"
+    checkpoint_true "$DNSMASQ_CONFIG_FOR_STUBBY_OK"
-    else
+  else
-        checkpoint_false "Dnsmasq config for Stubby"
+    checkpoint_false "$DNSMASQ_CONFIG_FOR_STUBBY_ERROR"
-        echo "Check config: https://cli.co/HbDBT2V"
+  fi
-    fi
 fi
 
-# Create dump
+case $COMMAND in
-if [[ "$1" == dump ]]; then
+  dump)
-    printf "\033[36;1mCreate dump without private variables\033[0m\n"
+    # Create dump
-    date > $DUMP
+    printf "\n$COLOR_BOLD_CYAN$DUMP_CREATION$COLOR_RESET\n"
-    $HIVPN start >> $DUMP 2>&1
+    date >$DUMP_PATH
-    $GETDOMAINS start >> $DUMP 2>&1
+    $HIVPN start >>$DUMP_PATH 2>&1
-    uci show firewall >> $DUMP
+    $GETDOMAINS_SCRIPT_PATH start >>$DUMP_PATH 2>&1
-    uci show network | sed -r 's/(.*private_key=|.*preshared_key=|.*public_key=|.*endpoint_host=|.*wan.ipaddr=|.*wan.netmask=|.*wan.gateway=|.*wan.dns|.*.macaddr=).*/\1REMOVED/' >> $DUMP
+    uci show firewall >>$DUMP_PATH
-
+    uci show network | sed -r 's/(.*private_key=|.*preshared_key=|.*public_key=|.*endpoint_host=|.*wan.ipaddr=|.*wan.netmask=|.*wan.gateway=|.*wan.dns|.*.macaddr=).*/\1REMOVED/' >>$DUMP_PATH
-    echo "Dump is here: $DUMP"
+    printf "$DUMP_DETAILS\n"
-    echo "For download Linux/Mac use:"
+    ;;
-    echo "scp root@IP_ROUTER:$DUMP ."
+  dns)
-    echo "For Windows use PSCP or WSL"
+    # Check DNS
-fi
+    printf "\n$COLOR_BOLD_CYAN$DNS_CHECK$COLOR_RESET\n"
-
-# Check DNS
-if [[ "$1" == dns ]]; then
-    printf "\033[36;1mCheck DNS servers\033[0m\n"
     DNS_SERVERS="1.1.1.1 8.8.8.8 8.8.4.4"
     DOH_DNS_SERVERS="cloudflare-dns.com 1.1.1.1 mozilla.cloudflare-dns.com security.cloudflare-dns.com"
     DOMAINS="instagram.com facebook.com"
 
-    echo "1. Block DNS traffic (Port 53/udp is available)"
+    echo "1. $IS_DNS_TRAFFIC_BLOCKED"
 
-    for i in $DNS_SERVERS;
+    for i in $DNS_SERVERS; do
-    do
+      if nslookup -type=a -timeout=2 -retry=1 itdog.info $i | grep -q "timed out"; then
-        if nslookup -type=a -timeout=2 -retry=1 itdog.info $i | grep -q "timed out"; then
+        checkpoint_false "$i"
-            checkpoint_false "$i"
+      else
-        else
+        checkpoint_true "$i"
-            checkpoint_true "$i"
+      fi
-        fi
     done
 
-    echo "2. DoH available"
+    echo "2. $IS_DOH_AVAILABLE"
 
-    for i in $DOH_DNS_SERVERS;
+    for i in $DOH_DNS_SERVERS; do
-    do
+      if curl --connect-timeout 5 -s -H "accept: application/dns-json" "https://$i/dns-query?name=itdog.info&type=A" | awk -F"data\":\"" '/data":"/{print $2}' | grep -q -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'; then
-        if curl --connect-timeout 5 -s -H "accept: application/dns-json" "https://$i/dns-query?name=itdog.info&type=A" | awk -F"data\":\"" '/data":"/{print $2}' | grep -q -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'; then
+        checkpoint_true "$i"
-            checkpoint_true "$i"
+      else
-        else
+        checkpoint_false "$i"
-            checkpoint_false "$i"
+      fi
-        fi
     done
 
-    echo "3. The response not contains an address from 127.0.0.0/8"
+    echo "3. $RESPONSE_NOT_CONTAINS_127_0_0_8"
 
-    for i in $DOMAINS;
+    for i in $DOMAINS; do
-    do
+      if nslookup -type=a -timeout=2 -retry=1 $i | awk '/^Address: / {print $2}' | grep -q -E '127\.[0-9]{1,3}\.'; then
-        if nslookup -type=a -timeout=2 -retry=1 $i | awk '/^Address: / {print $2}' | grep -q -E '127\.[0-9]{1,3}\.'; then
+        checkpoint_false "$i"
-            checkpoint_false "$i"
+      else
-        else
+        checkpoint_true "$i"
-            checkpoint_true "$i"
+      fi
-        fi
     done
 
-    echo "4. One IP for two different domains"
+    echo "4. $ONE_IP_FOR_TWO_DOMAINS"
 
     FIRSTIP=$(nslookup -type=a instagram.com | awk '/^Address: / {print $2}')
     SECONDIP=$(nslookup -type=a facebook.com | awk '/^Address: / {print $2}')
 
-    if [ "$FIRSTIP" = "$SECONDIP" ] ; then 
+    if [ "$FIRSTIP" = "$SECONDIP" ]; then
-        checkpoint_false "IP addresses are the same"
+      checkpoint_false "$IPS_ARE_THE_SAME"
     else
-        checkpoint_true "Different IP addresses"
+      checkpoint_true "$IPS_ARE_DIFFERENT"
     fi
 
-    echo "5. The response is not blank"
+    echo "5. $RESPONSE_IS_NOT_BLANK"
 
-    for i in $DOMAINS;
+    for i in $DOMAINS; do
-    do
+      if nslookup -type=a -timeout=2 -retry=1 $i | awk '/^Address: / {print $2}' | grep -q -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'; then
-        if nslookup -type=a -timeout=2 -retry=1 $i | awk '/^Address: / {print $2}' | grep -q -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'; then
+        checkpoint_true "$i"
-            checkpoint_true "$i"
+      else
-        else
+        checkpoint_false "$i"
-            checkpoint_false "$i"
+      fi
-        fi
     done
 
-    echo "6. Сomparing response from unencrypted DNS and DoH (DNS poisoning)"
+    echo "6. $DNS_POISONING_CHECK"
 
     DOHIP=$(curl -s -H "accept: application/dns-json" "https://1.1.1.1/dns-query?name=facebook.com&type=A" | awk -F"data\":\"" '/data":"/{print $2}' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}')
     OPENIP=$(nslookup -type=a -timeout=2 facebook.com 1.1.1.1 | awk '/^Address: / {print $2}')
 
-    if [ "$DOHIP" = "$OPENIP" ]; then 
+    if [ "$DOHIP" = "$OPENIP" ]; then
-        checkpoint_true "IPs match"
+      checkpoint_true "$IPS_ARE_THE_SAME"
     else
-        checkpoint_false "IPs not match"
+      checkpoint_false "$IPS_ARE_DIFFERENT"
     fi
-fi
+    ;;
+  *) ;;
+esac
 
 # Info
-echo -e "\nTelegram channel: https://t.me/itdoginfo"
+echo -e "\n$TELEGRAM_CHANNEL: https://t.me/itdoginfo"
-echo "Telegram chat: https://t.me/itdogchat"
+echo "$TELEGRAM_CHAT: https://t.me/itdogchat"

getdomains-install.sh

@@ -13,6 +13,12 @@ cat << EOF > /etc/hotplug.d/iface/30-vpnroute
 #!/bin/sh
 
 ip route add table vpn default dev wg0
+EOF
+    elif [ "$TUNNEL" == awg ]; then
+cat << EOF > /etc/hotplug.d/iface/30-vpnroute
+#!/bin/sh
+
+ip route add table vpn default dev awg0
 EOF
     elif [ "$TUNNEL" == singbox ] || [ "$TUNNEL" == ovpn ] || [ "$TUNNEL" == tun2socks ]; then
 cat << EOF > /etc/hotplug.d/iface/30-vpnroute
@@ -22,6 +28,8 @@ sleep 10
 ip route add table vpn default dev tun0
 EOF
     fi
+
+    cp /etc/hotplug.d/iface/30-vpnroute /etc/hotplug.d/net/30-vpnroute
 }
 
 add_mark() {
@@ -39,13 +47,16 @@ add_mark() {
 }
 
 add_tunnel() {
-    echo "We can automatically configure only Wireguard. OpenVPN, Sing-box(Shadowsocks2022, VMess, VLESS, etc) and tun2socks will need to be configured manually"
+    echo "We can automatically configure only Wireguard and Amnezia WireGuard. OpenVPN, Sing-box(Shadowsocks2022, VMess, VLESS, etc) and tun2socks will need to be configured manually"
     echo "Select a tunnel:"
     echo "1) WireGuard"
     echo "2) OpenVPN"
     echo "3) Sing-box"
     echo "4) tun2socks"
-    echo "5) Skip this step"
+    echo "5) wgForYoutube"
+    echo "6) Amnezia WireGuard"
+    echo "7) Amnezia WireGuard For Youtube"
+    echo "8) Skip this step"
 
     while true; do
     read -r -p '' TUNNEL
@@ -71,7 +82,22 @@ add_tunnel() {
             break
             ;;
 
-        5)
+        5) 
+            TUNNEL=wgForYoutube
+            break
+            ;;
+
+        6) 
+            TUNNEL=awg
+            break
+            ;;
+
+        7) 
+            TUNNEL=awgForYoutube
+            break
+            ;;
+
+        8)
             echo "Skip"
             TUNNEL=0
             break
@@ -207,6 +233,85 @@ EOF
         printf "\033[32;1mConfigure route for Sing-box\033[0m\n"
         route_vpn
     fi
+
+    if [ "$TUNNEL" == 'wgForYoutube' ]; then
+        add_internal_wg Wireguard
+    fi
+
+    if [ "$TUNNEL" == 'awgForYoutube' ]; then
+        add_internal_wg AmneziaWG
+    fi
+
+    if [ "$TUNNEL" == 'awg' ]; then
+        printf "\033[32;1mConfigure Amnezia WireGuard\033[0m\n"
+
+        install_awg_packages
+
+        route_vpn
+
+        read -r -p "Enter the private key (from [Interface]):"$'\n' AWG_PRIVATE_KEY
+
+        while true; do
+            read -r -p "Enter internal IP address with subnet, example 192.168.100.5/24 (Address from [Interface]):"$'\n' AWG_IP
+            if echo "$AWG_IP" | egrep -oq '^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]+$'; then
+                break
+            else
+                echo "This IP is not valid. Please repeat"
+            fi
+        done
+
+        read -r -p "Enter Jc value (from [Interface]):"$'\n' AWG_JC
+        read -r -p "Enter Jmin value (from [Interface]):"$'\n' AWG_JMIN
+        read -r -p "Enter Jmax value (from [Interface]):"$'\n' AWG_JMAX
+        read -r -p "Enter S1 value (from [Interface]):"$'\n' AWG_S1
+        read -r -p "Enter S2 value (from [Interface]):"$'\n' AWG_S2
+        read -r -p "Enter H1 value (from [Interface]):"$'\n' AWG_H1
+        read -r -p "Enter H2 value (from [Interface]):"$'\n' AWG_H2
+        read -r -p "Enter H3 value (from [Interface]):"$'\n' AWG_H3
+        read -r -p "Enter H4 value (from [Interface]):"$'\n' AWG_H4
+    
+        read -r -p "Enter the public key (from [Peer]):"$'\n' AWG_PUBLIC_KEY
+        read -r -p "If use PresharedKey, Enter this (from [Peer]). If your don't use leave blank:"$'\n' AWG_PRESHARED_KEY
+        read -r -p "Enter Endpoint host without port (Domain or IP) (from [Peer]):"$'\n' AWG_ENDPOINT
+
+        read -r -p "Enter Endpoint host port (from [Peer]) [51820]:"$'\n' AWG_ENDPOINT_PORT
+        AWG_ENDPOINT_PORT=${AWG_ENDPOINT_PORT:-51820}
+        if [ "$AWG_ENDPOINT_PORT" = '51820' ]; then
+            echo $AWG_ENDPOINT_PORT
+        fi
+        
+        uci set network.awg0=interface
+        uci set network.awg0.proto='amneziawg'
+        uci set network.awg0.private_key=$AWG_PRIVATE_KEY
+        uci set network.awg0.listen_port='51820'
+        uci set network.awg0.addresses=$AWG_IP
+
+        uci set network.awg0.awg_jc=$AWG_JC
+        uci set network.awg0.awg_jmin=$AWG_JMIN
+        uci set network.awg0.awg_jmax=$AWG_JMAX
+        uci set network.awg0.awg_s1=$AWG_S1
+        uci set network.awg0.awg_s2=$AWG_S2
+        uci set network.awg0.awg_h1=$AWG_H1
+        uci set network.awg0.awg_h2=$AWG_H2
+        uci set network.awg0.awg_h3=$AWG_H3
+        uci set network.awg0.awg_h4=$AWG_H4
+
+        if ! uci show network | grep -q amneziawg_awg0; then
+            uci add network amneziawg_awg0
+        fi
+
+        uci set network.@amneziawg_awg0[0]=amneziawg_awg0
+        uci set network.@amneziawg_awg0[0].name='awg0_client'
+        uci set network.@amneziawg_awg0[0].public_key=$AWG_PUBLIC_KEY
+        uci set network.@amneziawg_awg0[0].preshared_key=$AWG_PRESHARED_KEY
+        uci set network.@amneziawg_awg0[0].route_allowed_ips='0'
+        uci set network.@amneziawg_awg0[0].persistent_keepalive='25'
+        uci set network.@amneziawg_awg0[0].endpoint_host=$AWG_ENDPOINT
+        uci set network.@amneziawg_awg0[0].allowed_ips='0.0.0.0/0'
+        uci set network.@amneziawg_awg0[0].endpoint_port=$AWG_ENDPOINT_PORT
+        uci commit
+    fi
+
 }
 
 dnsmasqfull() {
@@ -254,14 +359,25 @@ add_zone() {
             while uci -q delete firewall.@zone[$zone_wg_id]; do :; done
         fi
 
+        zone_awg_id=$(uci show firewall | grep -E '@zone.*awg0' | awk -F '[][{}]' '{print $2}' | head -n 1)
+        if [ "$zone_awg_id" == 0 ] || [ "$zone_awg_id" == 1 ]; then
+            printf "\033[32;1mawg0 zone has an identifier of 0 or 1. That's not ok. Fix your firewall. lan and wan zones should have identifiers 0 and 1. \033[0m\n"
+            exit 1
+        fi
+        if [ ! -z "$zone_awg_id" ]; then
+            while uci -q delete firewall.@zone[$zone_awg_id]; do :; done
+        fi
+
         uci add firewall zone
         uci set firewall.@zone[-1].name="$TUNNEL"
         if [ "$TUNNEL" == wg ]; then
             uci set firewall.@zone[-1].network='wg0'
+        elif [ "$TUNNEL" == awg ]; then
+            uci set firewall.@zone[-1].network='awg0'
         elif [ "$TUNNEL" == singbox ] || [ "$TUNNEL" == ovpn ] || [ "$TUNNEL" == tun2socks ]; then
             uci set firewall.@zone[-1].device='tun0'
         fi
-        if [ "$TUNNEL" == wg ] || [ "$TUNNEL" == ovpn ] || [ "$TUNNEL" == tun2socks ]; then
+        if [ "$TUNNEL" == wg ] || [ "$TUNNEL" == awg ] || [ "$TUNNEL" == ovpn ] || [ "$TUNNEL" == tun2socks ]; then
             uci set firewall.@zone[-1].forward='REJECT'
             uci set firewall.@zone[-1].output='ACCEPT'
             uci set firewall.@zone[-1].input='REJECT'
@@ -288,6 +404,11 @@ add_zone() {
             remove_forwarding
         fi
 
+        if [[ $TUNNEL != "awg" ]]; then
+            forward_id=$(uci show firewall | grep -E "@forwarding.*dest='awg'" | awk -F '[][{}]' '{print $2}' | head -n 1)
+            remove_forwarding
+        fi
+
         if [[ $TUNNEL != "ovpn" ]]; then
             forward_id=$(uci show firewall | grep -E "@forwarding.*dest='ovpn'" | awk -F '[][{}]' '{print $2}' | head -n 1)
             remove_forwarding
@@ -443,19 +564,21 @@ add_dns_resolver() {
 }
 
 add_packages() {
-    if opkg list-installed | grep -q "curl -"; then
+    for package in curl nano; do
-        printf "\033[32;1mCurl already installed\033[0m\n"
+        if opkg list-installed | grep -q "^$package "; then
-    else
+            printf "\033[32;1m$package already installed\033[0m\n"
-        printf "\033[32;1mInstall curl\033[0m\n"
+        else
-        opkg install curl
+            printf "\033[32;1mInstalling $package...\033[0m\n"
-    fi
+            opkg install "$package"
-
+            
-    if opkg list-installed | grep -q nano; then
+            if "$package" --version >/dev/null 2>&1; then
-        printf "\033[32;1mNano already installed\033[0m\n"
+                printf "\033[32;1m$package was successfully installed and available\033[0m\n"
-    else
+            else
-        printf "\033[32;1mInstall nano\033[0m\n"
+                printf "\033[31;1mError: failed to install $package\033[0m\n"
-        opkg install nano
+                exit 1
-    fi
+            fi
+        fi
+    done
 }
 
 add_getdomains() {
@@ -552,13 +675,290 @@ EOF
     fi
 }
 
-# System Details
+add_internal_wg() {
-MODEL=$(grep machine /proc/cpuinfo | cut -d ':' -f 2)
+    PROTOCOL_NAME=$1
-RELEASE=$(grep OPENWRT_RELEASE /etc/os-release | awk -F '"' '{print $2}')
+    printf "\033[32;1mConfigure ${PROTOCOL_NAME}\033[0m\n"
-printf "\033[34;1mModel:$MODEL\033[0m\n"
+    if [ "$PROTOCOL_NAME" = 'Wireguard' ]; then
-printf "\033[34;1mVersion: $RELEASE\033[0m\n"
+        INTERFACE_NAME="wg1"
+        CONFIG_NAME="wireguard_wg1"
+        PROTO="wireguard"
+        ZONE_NAME="wg_internal"
 
-VERSION_ID=$(grep VERSION_ID /etc/os-release | awk -F '"' '{print $2}' | awk -F. '{print $1}')
+        if opkg list-installed | grep -q wireguard-tools; then
+            echo "Wireguard already installed"
+        else
+            echo "Installed wg..."
+            opkg install wireguard-tools
+        fi
+    fi
+
+    if [ "$PROTOCOL_NAME" = 'AmneziaWG' ]; then
+        INTERFACE_NAME="awg1"
+        CONFIG_NAME="amneziawg_awg1"
+        PROTO="amneziawg"
+        ZONE_NAME="awg_internal"
+
+        install_awg_packages
+    fi
+
+    read -r -p "Enter the private key (from [Interface]):"$'\n' WG_PRIVATE_KEY_INT
+
+    while true; do
+        read -r -p "Enter internal IP address with subnet, example 192.168.100.5/24 (from [Interface]):"$'\n' WG_IP
+        if echo "$WG_IP" | egrep -oq '^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]+$'; then
+            break
+        else
+            echo "This IP is not valid. Please repeat"
+        fi
+    done
+
+    read -r -p "Enter the public key (from [Peer]):"$'\n' WG_PUBLIC_KEY_INT
+    read -r -p "If use PresharedKey, Enter this (from [Peer]). If your don't use leave blank:"$'\n' WG_PRESHARED_KEY_INT
+    read -r -p "Enter Endpoint host without port (Domain or IP) (from [Peer]):"$'\n' WG_ENDPOINT_INT
+
+    read -r -p "Enter Endpoint host port (from [Peer]) [51820]:"$'\n' WG_ENDPOINT_PORT_INT
+    WG_ENDPOINT_PORT_INT=${WG_ENDPOINT_PORT_INT:-51820}
+    if [ "$WG_ENDPOINT_PORT_INT" = '51820' ]; then
+        echo $WG_ENDPOINT_PORT_INT
+    fi
+
+    if [ "$PROTOCOL_NAME" = 'AmneziaWG' ]; then
+        read -r -p "Enter Jc value (from [Interface]):"$'\n' AWG_JC
+        read -r -p "Enter Jmin value (from [Interface]):"$'\n' AWG_JMIN
+        read -r -p "Enter Jmax value (from [Interface]):"$'\n' AWG_JMAX
+        read -r -p "Enter S1 value (from [Interface]):"$'\n' AWG_S1
+        read -r -p "Enter S2 value (from [Interface]):"$'\n' AWG_S2
+        read -r -p "Enter H1 value (from [Interface]):"$'\n' AWG_H1
+        read -r -p "Enter H2 value (from [Interface]):"$'\n' AWG_H2
+        read -r -p "Enter H3 value (from [Interface]):"$'\n' AWG_H3
+        read -r -p "Enter H4 value (from [Interface]):"$'\n' AWG_H4
+    fi
+    
+    uci set network.${INTERFACE_NAME}=interface
+    uci set network.${INTERFACE_NAME}.proto=$PROTO
+    uci set network.${INTERFACE_NAME}.private_key=$WG_PRIVATE_KEY_INT
+    uci set network.${INTERFACE_NAME}.listen_port='51821'
+    uci set network.${INTERFACE_NAME}.addresses=$WG_IP
+
+    if [ "$PROTOCOL_NAME" = 'AmneziaWG' ]; then
+        uci set network.${INTERFACE_NAME}.awg_jc=$AWG_JC
+        uci set network.${INTERFACE_NAME}.awg_jmin=$AWG_JMIN
+        uci set network.${INTERFACE_NAME}.awg_jmax=$AWG_JMAX
+        uci set network.${INTERFACE_NAME}.awg_s1=$AWG_S1
+        uci set network.${INTERFACE_NAME}.awg_s2=$AWG_S2
+        uci set network.${INTERFACE_NAME}.awg_h1=$AWG_H1
+        uci set network.${INTERFACE_NAME}.awg_h2=$AWG_H2
+        uci set network.${INTERFACE_NAME}.awg_h3=$AWG_H3
+        uci set network.${INTERFACE_NAME}.awg_h4=$AWG_H4
+    fi
+
+    if ! uci show network | grep -q ${CONFIG_NAME}; then
+        uci add network ${CONFIG_NAME}
+    fi
+
+    uci set network.@${CONFIG_NAME}[0]=$CONFIG_NAME
+    uci set network.@${CONFIG_NAME}[0].name="${INTERFACE_NAME}_client"
+    uci set network.@${CONFIG_NAME}[0].public_key=$WG_PUBLIC_KEY_INT
+    uci set network.@${CONFIG_NAME}[0].preshared_key=$WG_PRESHARED_KEY_INT
+    uci set network.@${CONFIG_NAME}[0].route_allowed_ips='0'
+    uci set network.@${CONFIG_NAME}[0].persistent_keepalive='25'
+    uci set network.@${CONFIG_NAME}[0].endpoint_host=$WG_ENDPOINT_INT
+    uci set network.@${CONFIG_NAME}[0].allowed_ips='0.0.0.0/0'
+    uci set network.@${CONFIG_NAME}[0].endpoint_port=$WG_ENDPOINT_PORT_INT
+    uci commit network
+
+    grep -q "110 vpninternal" /etc/iproute2/rt_tables || echo '110 vpninternal' >> /etc/iproute2/rt_tables
+
+    if ! uci show network | grep -q mark0x2; then
+        printf "\033[32;1mConfigure mark rule\033[0m\n"
+        uci add network rule
+        uci set network.@rule[-1].name='mark0x2'
+        uci set network.@rule[-1].mark='0x2'
+        uci set network.@rule[-1].priority='110'
+        uci set network.@rule[-1].lookup='vpninternal'
+        uci commit
+    fi
+
+    if ! uci show network | grep -q vpn_route_internal; then
+        printf "\033[32;1mAdd route\033[0m\n"
+        uci set network.vpn_route_internal=route
+        uci set network.vpn_route_internal.name='vpninternal'
+        uci set network.vpn_route_internal.interface=$INTERFACE_NAME
+        uci set network.vpn_route_internal.table='vpninternal'
+        uci set network.vpn_route_internal.target='0.0.0.0/0'
+        uci commit network
+    fi
+
+    if ! uci show firewall | grep -q "@zone.*name='${ZONE_NAME}'"; then
+        printf "\033[32;1mZone Create\033[0m\n"
+        uci add firewall zone
+        uci set firewall.@zone[-1].name=$ZONE_NAME
+        uci set firewall.@zone[-1].network=$INTERFACE_NAME
+        uci set firewall.@zone[-1].forward='REJECT'
+        uci set firewall.@zone[-1].output='ACCEPT'
+        uci set firewall.@zone[-1].input='REJECT'
+        uci set firewall.@zone[-1].masq='1'
+        uci set firewall.@zone[-1].mtu_fix='1'
+        uci set firewall.@zone[-1].family='ipv4'
+        uci commit firewall
+    fi
+
+    if ! uci show firewall | grep -q "@forwarding.*name='${ZONE_NAME}'"; then
+        printf "\033[32;1mConfigured forwarding\033[0m\n"
+        uci add firewall forwarding
+        uci set firewall.@forwarding[-1]=forwarding
+        uci set firewall.@forwarding[-1].name="${ZONE_NAME}-lan"
+        uci set firewall.@forwarding[-1].dest=${ZONE_NAME}
+        uci set firewall.@forwarding[-1].src='lan'
+        uci set firewall.@forwarding[-1].family='ipv4'
+        uci commit firewall
+    fi
+
+    if uci show firewall | grep -q "@ipset.*name='vpn_domains_internal'"; then
+        printf "\033[32;1mSet already exist\033[0m\n"
+    else
+        printf "\033[32;1mCreate set\033[0m\n"
+        uci add firewall ipset
+        uci set firewall.@ipset[-1].name='vpn_domains_internal'
+        uci set firewall.@ipset[-1].match='dst_net'
+        uci commit firewall
+    fi
+
+    if uci show firewall | grep -q "@rule.*name='mark_domains_intenal'"; then
+        printf "\033[32;1mRule for set already exist\033[0m\n"
+    else
+        printf "\033[32;1mCreate rule set\033[0m\n"
+        uci add firewall rule
+        uci set firewall.@rule[-1]=rule
+        uci set firewall.@rule[-1].name='mark_domains_intenal'
+        uci set firewall.@rule[-1].src='lan'
+        uci set firewall.@rule[-1].dest='*'
+        uci set firewall.@rule[-1].proto='all'
+        uci set firewall.@rule[-1].ipset='vpn_domains_internal'
+        uci set firewall.@rule[-1].set_mark='0x2'
+        uci set firewall.@rule[-1].target='MARK'
+        uci set firewall.@rule[-1].family='ipv4'
+        uci commit firewall
+    fi
+
+    if uci show dhcp | grep -q "@ipset.*name='vpn_domains_internal'"; then
+        printf "\033[32;1mDomain on vpn_domains_internal already exist\033[0m\n"
+    else
+        printf "\033[32;1mCreate domain for vpn_domains_internal\033[0m\n"
+        uci add dhcp ipset
+        uci add_list dhcp.@ipset[-1].name='vpn_domains_internal'
+        uci add_list dhcp.@ipset[-1].domain='youtube.com'
+        uci add_list dhcp.@ipset[-1].domain='googlevideo.com'
+        uci add_list dhcp.@ipset[-1].domain='youtubekids.com'
+        uci add_list dhcp.@ipset[-1].domain='googleapis.com'
+        uci add_list dhcp.@ipset[-1].domain='ytimg.com'
+        uci add_list dhcp.@ipset[-1].domain='ggpht.com'
+        uci commit dhcp
+    fi
+
+    sed -i "/done/a sed -i '/youtube.com\\\|ytimg.com\\\|ggpht.com\\\|googlevideo.com\\\|googleapis.com\\\|youtubekids.com/d' /tmp/dnsmasq.d/domains.lst" "/etc/init.d/getdomains"
+
+    service dnsmasq restart
+    service network restart
+
+    exit 0
+}
+
+install_awg_packages() {
+    # Получение pkgarch с наибольшим приоритетом
+    PKGARCH=$(opkg print-architecture | awk 'BEGIN {max=0} {if ($3 > max) {max = $3; arch = $2}} END {print arch}')
+
+    TARGET=$(ubus call system board | jsonfilter -e '@.release.target' | cut -d '/' -f 1)
+    SUBTARGET=$(ubus call system board | jsonfilter -e '@.release.target' | cut -d '/' -f 2)
+    VERSION=$(ubus call system board | jsonfilter -e '@.release.version')
+    PKGPOSTFIX="_v${VERSION}_${PKGARCH}_${TARGET}_${SUBTARGET}.ipk"
+    BASE_URL="https://github.com/Slava-Shchipunov/awg-openwrt/releases/download/"
+
+    AWG_DIR="/tmp/amneziawg"
+    mkdir -p "$AWG_DIR"
+
+    if opkg list-installed | grep -q amneziawg-tools; then
+        echo "amneziawg-tools already installed"
+    else
+        AMNEZIAWG_TOOLS_FILENAME="amneziawg-tools${PKGPOSTFIX}"
+        DOWNLOAD_URL="${BASE_URL}v${VERSION}/${AMNEZIAWG_TOOLS_FILENAME}"
+        curl -L -o "$AWG_DIR/$AMNEZIAWG_TOOLS_FILENAME" "$DOWNLOAD_URL"
+
+        if [ $? -eq 0 ]; then
+            echo "amneziawg-tools file downloaded successfully"
+        else
+            echo "Error downloading amneziawg-tools. Please, install amneziawg-tools manually and run the script again"
+            exit 1
+        fi
+
+        opkg install "$AWG_DIR/$AMNEZIAWG_TOOLS_FILENAME"
+
+        if [ $? -eq 0 ]; then
+            echo "amneziawg-tools file downloaded successfully"
+        else
+            echo "Error installing amneziawg-tools. Please, install amneziawg-tools manually and run the script again"
+            exit 1
+        fi
+    fi
+    
+    if opkg list-installed | grep -q kmod-amneziawg; then
+        echo "kmod-amneziawg already installed"
+    else
+        KMOD_AMNEZIAWG_FILENAME="kmod-amneziawg${PKGPOSTFIX}"
+        DOWNLOAD_URL="${BASE_URL}v${VERSION}/${KMOD_AMNEZIAWG_FILENAME}"
+        curl -L -o "$AWG_DIR/$KMOD_AMNEZIAWG_FILENAME" "$DOWNLOAD_URL"
+
+        if [ $? -eq 0 ]; then
+            echo "kmod-amneziawg file downloaded successfully"
+        else
+            echo "Error downloading kmod-amneziawg. Please, install kmod-amneziawg manually and run the script again"
+            exit 1
+        fi
+        
+        opkg install "$AWG_DIR/$KMOD_AMNEZIAWG_FILENAME"
+
+        if [ $? -eq 0 ]; then
+            echo "kmod-amneziawg file downloaded successfully"
+        else
+            echo "Error installing kmod-amneziawg. Please, install kmod-amneziawg manually and run the script again"
+            exit 1
+        fi
+    fi
+    
+    if opkg list-installed | grep -q luci-app-amneziawg; then
+        echo "luci-app-amneziawg already installed"
+    else
+        LUCI_APP_AMNEZIAWG_FILENAME="luci-app-amneziawg${PKGPOSTFIX}"
+        DOWNLOAD_URL="${BASE_URL}v${VERSION}/${LUCI_APP_AMNEZIAWG_FILENAME}"
+        curl -L -o "$AWG_DIR/$LUCI_APP_AMNEZIAWG_FILENAME" "$DOWNLOAD_URL"
+
+        if [ $? -eq 0 ]; then
+            echo "luci-app-amneziawg file downloaded successfully"
+        else
+            echo "Error downloading luci-app-amneziawg. Please, install luci-app-amneziawg manually and run the script again"
+            exit 1
+        fi
+
+        opkg install "$AWG_DIR/$LUCI_APP_AMNEZIAWG_FILENAME"
+
+        if [ $? -eq 0 ]; then
+            echo "luci-app-amneziawg file downloaded successfully"
+        else
+            echo "Error installing luci-app-amneziawg. Please, install luci-app-amneziawg manually and run the script again"
+            exit 1
+        fi
+    fi
+
+    rm -rf "$AWG_DIR"
+}
+
+# System Details
+MODEL=$(cat /tmp/sysinfo/model)
+source /etc/os-release
+printf "\033[34;1mModel: $MODEL\033[0m\n"
+printf "\033[34;1mVersion: $OPENWRT_RELEASE\033[0m\n"
+
+VERSION_ID=$(echo $VERSION | awk -F. '{print $1}')
 
 if [ "$VERSION_ID" -ne 23 ]; then
     printf "\033[31;1mScript only support OpenWrt 23.05\033[0m\n"

getdomains-uninstall.sh

@@ -0,0 +1,78 @@
+#!/bin/ash
+
+echo "Выпиливаем скрипты"
+/etc/init.d/getdomains disable
+rm -rf /etc/init.d/getdomains
+
+rm -f /etc/hotplug.d/iface/30-vpnroute /etc/hotplug.d/net/30-vpnroute
+
+echo "Выпиливаем из crontab"
+sed -i '/getdomains start/d' /etc/crontabs/root
+
+echo "Выпиливаем домены"
+rm -f /tmp/dnsmasq.d/domains.lst
+
+echo "Чистим firewall, раз раз 🍴"
+
+ipset_id=$(uci show firewall | grep -E '@ipset.*name=.vpn_domains.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$ipset_id" ]; then
+    while uci -q delete firewall.@ipset[$ipset_id]; do :; done
+fi
+
+rule_id=$(uci show firewall | grep -E '@rule.*name=.mark_domains.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$rule_id" ]; then
+    while uci -q delete firewall.@rule[$rule_id]; do :; done
+fi
+
+ipset_id=$(uci show firewall | grep -E '@ipset.*name=.vpn_domains_internal.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$ipset_id" ]; then
+    while uci -q delete firewall.@ipset[$ipset_id]; do :; done
+fi
+
+rule_id=$(uci show firewall | grep -E '@rule.*name=.mark_domains_intenal.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$rule_id" ]; then
+    while uci -q delete firewall.@rule[$rule_id]; do :; done
+fi
+
+ipset_id=$(uci show firewall | grep -E '@ipset.*name=.vpn_subnet.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$ipset_id" ]; then
+    while uci -q delete firewall.@ipset[$ipset_id]; do :; done
+fi
+
+rule_id=$(uci show firewall | grep -E '@rule.*name=.mark_subnet.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$rule_id" ]; then
+    while uci -q delete firewall.@rule[$rule_id]; do :; done
+fi
+
+uci commit firewall
+/etc/init.d/firewall restart
+
+echo "Чистим сеть"
+sed -i '/99 vpn/d' /etc/iproute2/rt_tables
+
+rule_id=$(uci show network | grep -E '@rule.*name=.mark0x1.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$rule_id" ]; then
+    while uci -q delete network.@rule[$rule_id]; do :; done
+fi
+
+rule_id=$(uci show network | grep -E '@rule.*name=.mark0x2.' | awk -F '[][{}]' '{print $2}' | head -n 1)
+if [ ! -z "$rule_id" ]; then
+    while uci -q delete network.@rule[$rule_id]; do :; done
+fi
+
+while uci -q delete network.vpn_route_internal; do :; done
+
+uci commit network
+/etc/init.d/network restart
+
+echo "Проверяем Dnsmasq"
+if uci show dhcp | grep -q ipset; then
+    echo "В dnsmasq (/etc/config/dhcp) заданы домены. Нужные из них сохраните, остальные удалите вместе с ipset"
+fi
+
+echo "Все туннели, прокси, зоны и forwarding к ним оставляем на месте, они вам не помешают и скорее пригодятся"
+echo "Dnscrypt, stubby тоже не трогаем"
+
+echo "  ______  _____        _____   _____  ______  _     _  _____   _____"
+echo " |  ____ |     |      |_____] |     | |     \ |____/  |     | |_____]"
+echo " |_____| |_____|      |       |_____| |_____/ |    \_ |_____| |     "

handlers/main.yml

@@ -1,4 +1,9 @@
 ---
+  - name: Restart sing-box
+    service:
+      name: sing-box
+      state: restarted
+
   - name: Restart network
     service:
       name: network