Remove legacy vpn proxy code and simplify the client

entrypoint.sh

@@ -5,22 +5,12 @@ TPROXY_PORT="${TPROXY_PORT:-7895}"
 TPROXY_MARK="${TPROXY_MARK:-1}"
 TPROXY_TABLE="${TPROXY_TABLE:-100}"
 TPROXY_CHAIN="${TPROXY_CHAIN:-VPN_PROXY_TPROXY}"
-TPROXY_SOURCE_BYPASS_CHAIN="${TPROXY_SOURCE_BYPASS_CHAIN:-VPN_PROXY_SRC_BYPASS}"
-TPROXY_SOURCE_FORWARD_CHAIN="${TPROXY_SOURCE_FORWARD_CHAIN:-VPN_PROXY_FWD_BYPASS}"
-TPROXY_SOURCE_NAT_CHAIN="${TPROXY_SOURCE_NAT_CHAIN:-VPN_PROXY_NAT_BYPASS}"
 PROXY_PORT="${PROXY_PORT:-8080}"
 PROXY_BIND_IP="${PROXY_BIND_IP:-0.0.0.0}"
 PROXY_INPUT_CHAIN="${PROXY_INPUT_CHAIN:-VPN_PROXY_INPUT}"
 PROXY_FIREWALL="${PROXY_FIREWALL:-true}"
 PROXY_ALLOWED_CIDRS="${PROXY_ALLOWED_CIDRS:-10.0.0.0/8 172.16.0.0/12 192.168.0.0/16}"
-TPROXY_BYPASS_SOURCE_CIDRS="${TPROXY_BYPASS_SOURCE_CIDRS:-}"
 BYPASS_CIDRS="${BYPASS_CIDRS:-0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 127.0.0.0/8 169.254.0.0/16 172.16.0.0/12 192.168.0.0/16 224.0.0.0/4 240.0.0.0/4}"
-# Имя ipset для IP-адресов, которые sing-box отправил напрямую (direct bypass cache)
-DIRECT_BYPASS_SET="${DIRECT_BYPASS_SET:-vpn_direct_bypass}"
-# TTL записи в ipset (секунды). По умолчанию 1 час.
-DIRECT_BYPASS_TTL="${DIRECT_BYPASS_TTL:-3600}"
-# Direct bypass cache выключен по умолчанию, потому что он обходит global rules.
-DIRECT_BYPASS_CACHE="${DIRECT_BYPASS_CACHE:-false}"
 
 log() {
   printf '[gateway-entrypoint] %s\n' "$*"
@@ -38,55 +28,27 @@ cleanup_proxy_firewall() {
 }
 
 cleanup_tproxy() {
-  log "cleanup tproxy rules"
   ipt -t mangle -D PREROUTING -j "$TPROXY_CHAIN" 2>/dev/null || true
-  ipt -D FORWARD -j "$TPROXY_SOURCE_FORWARD_CHAIN" 2>/dev/null || true
-  ipt -t nat -D POSTROUTING -j "$TPROXY_SOURCE_NAT_CHAIN" 2>/dev/null || true
   ipt -t mangle -F "$TPROXY_CHAIN" 2>/dev/null || true
   ipt -t mangle -X "$TPROXY_CHAIN" 2>/dev/null || true
-  ipt -t mangle -F "$TPROXY_SOURCE_BYPASS_CHAIN" 2>/dev/null || true
-  ipt -t mangle -X "$TPROXY_SOURCE_BYPASS_CHAIN" 2>/dev/null || true
-  ipt -F "$TPROXY_SOURCE_FORWARD_CHAIN" 2>/dev/null || true
-  ipt -X "$TPROXY_SOURCE_FORWARD_CHAIN" 2>/dev/null || true
-  ipt -t nat -F "$TPROXY_SOURCE_NAT_CHAIN" 2>/dev/null || true
-  ipt -t nat -X "$TPROXY_SOURCE_NAT_CHAIN" 2>/dev/null || true
   ip rule del fwmark "$TPROXY_MARK" table "$TPROXY_TABLE" 2>/dev/null || true
   ip route flush table "$TPROXY_TABLE" 2>/dev/null || true
-  # ipset не чистим при завершении — TTL сам истечёт
 }
 
 enable_ip_forwarding() {
-  log "enable IPv4 forwarding for source bypass"
   if [[ -w /proc/sys/net/ipv4/ip_forward ]]; then
     printf '1' > /proc/sys/net/ipv4/ip_forward || true
-    return
-  fi
-  if command -v sysctl >/dev/null 2>&1; then
+  elif command -v sysctl >/dev/null 2>&1; then
     sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1 || true
   fi
 }
 
-setup_direct_bypass_set() {
-  if [[ "$DIRECT_BYPASS_CACHE" != "true" ]]; then
-    export DIRECT_BYPASS_CACHE
-    return
-  fi
-
-  log "setup ipset ${DIRECT_BYPASS_SET} (timeout=${DIRECT_BYPASS_TTL}s)"
-  # Создаём с timeout; если уже существует — не трогаем (сохраняем накопленные записи)
-  ipset create "$DIRECT_BYPASS_SET" hash:ip timeout "$DIRECT_BYPASS_TTL" 2>/dev/null || true
-  # Экспортируем имя для использования в Node.js через env
-  export DIRECT_BYPASS_SET DIRECT_BYPASS_TTL DIRECT_BYPASS_CACHE
-}
-
 setup_proxy_firewall() {
   if [[ "$PROXY_FIREWALL" != "true" || "$PROXY_BIND_IP" == "127.0.0.1" || "$PROXY_BIND_IP" == "::1" ]]; then
     return
   fi
 
-  log "setup proxy firewall for :${PROXY_PORT} (${PROXY_ALLOWED_CIDRS})"
   cleanup_proxy_firewall
-
   ipt -N "$PROXY_INPUT_CHAIN"
   for cidr in $PROXY_ALLOWED_CIDRS; do
     ipt -A "$PROXY_INPUT_CHAIN" -s "$cidr" -j RETURN
@@ -97,41 +59,17 @@ setup_proxy_firewall() {
 }
 
 setup_tproxy() {
-  log "setup tproxy on port ${TPROXY_PORT}, mark ${TPROXY_MARK}, table ${TPROXY_TABLE}"
+  log "setup tproxy on port ${TPROXY_PORT}"
   cleanup_tproxy
   enable_ip_forwarding
 
   ip rule add fwmark "$TPROXY_MARK" table "$TPROXY_TABLE" 2>/dev/null || true
   ip route replace local 0.0.0.0/0 dev lo table "$TPROXY_TABLE"
-
   ipt -t mangle -N "$TPROXY_CHAIN"
-  ipt -t mangle -N "$TPROXY_SOURCE_BYPASS_CHAIN"
-  ipt -N "$TPROXY_SOURCE_FORWARD_CHAIN"
-  ipt -t nat -N "$TPROXY_SOURCE_NAT_CHAIN"
-  # Пропускаем пакеты, адресованные самому хосту (ответы на исходящие соединения sing-box)
   ipt -t mangle -A "$TPROXY_CHAIN" -m addrtype --dst-type LOCAL -j RETURN
   ipt -t mangle -A "$TPROXY_CHAIN" -m mark --mark "$TPROXY_MARK" -j RETURN
-  ipt -t mangle -A "$TPROXY_CHAIN" -j "$TPROXY_SOURCE_BYPASS_CHAIN"
-  ipt -I FORWARD 1 -j "$TPROXY_SOURCE_FORWARD_CHAIN"
-  ipt -t nat -I POSTROUTING 1 -j "$TPROXY_SOURCE_NAT_CHAIN"
-
-  for cidr in $BYPASS_CIDRS; do
-    ipt -t nat -A "$TPROXY_SOURCE_NAT_CHAIN" -d "$cidr" -j RETURN
-  done
-
-  for cidr in $TPROXY_BYPASS_SOURCE_CIDRS; do
-    ipt -t mangle -A "$TPROXY_SOURCE_BYPASS_CHAIN" -s "$cidr" -j ACCEPT
-    ipt -A "$TPROXY_SOURCE_FORWARD_CHAIN" -s "$cidr" -j ACCEPT
-    ipt -A "$TPROXY_SOURCE_FORWARD_CHAIN" -d "$cidr" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-    ipt -t nat -A "$TPROXY_SOURCE_NAT_CHAIN" -s "$cidr" -j MASQUERADE
-  done
-
-  if [[ "$DIRECT_BYPASS_CACHE" == "true" ]]; then
-    # Direct bypass cache: IP-адреса из ipset идут напрямую, минуя sing-box.
-    # Включайте только если готовы к тому, что global rules для этих dst IP не будут проверяться.
-    ipt -t mangle -A "$TPROXY_CHAIN" -m set --match-set "$DIRECT_BYPASS_SET" dst -j RETURN
-  fi
 
+  # Private/local destinations stay reachable; every intercepted public packet goes to VPN.
   for cidr in $BYPASS_CIDRS; do
     ipt -t mangle -A "$TPROXY_CHAIN" -d "$cidr" -j RETURN
   done
@@ -141,7 +79,6 @@ setup_tproxy() {
   ipt -t mangle -A PREROUTING -j "$TPROXY_CHAIN"
 }
 
-setup_direct_bypass_set
 setup_tproxy
 setup_proxy_firewall
 
@@ -149,7 +86,6 @@ node /app/src/server/index.js &
 APP_PID=$!
 
 shutdown() {
-  log "shutdown requested"
   kill "$APP_PID" 2>/dev/null || true
   wait "$APP_PID" 2>/dev/null || true
   cleanup_proxy_firewall
@@ -157,7 +93,6 @@ shutdown() {
 }
 
 trap 'shutdown; exit 0' SIGTERM SIGINT
-
 wait "$APP_PID"
 STATUS=$?
 cleanup_proxy_firewall