-

netflow/iptables.sh

@@ -3,28 +3,20 @@
 
 if [[ -d "/host/proc/1/" ]]; then source /apps/gitrce/hook/singleton.sh "$0"; fi
 
-__main() {
+_owner_id=50000
-	:
+_chain="output_netflow_owner_${_owner_id}"
-	# 切换到系统默认的legacy 有些不支持iptabes-nft或者nftables
-	update-alternatives --set iptables /usr/sbin/iptables-legacy
 
-	_owner_id=50000
+for cmd in iptables ip6tables; do
-	_chain_name="output_netflow_owner_${_owner_id}"
+	$cmd -t mangle -N "$_chain" 2>/dev/null || true
-	# 创建链（如果不存在）
-	iptables -t mangle -N "${_chain_name}" 2>/dev/null
 
-	# 检查主链 OUTPUT 是否已有跳转规则
+	if ! $cmd -t mangle -C OUTPUT -m owner --gid-owner "$_owner_id" -j "$_chain" 2>/dev/null; then
-	if ! iptables -t mangle -C OUTPUT -m owner --gid-owner "${_owner_id}" -j "${_chain_name}" 2>/dev/null; then
+		$cmd -t mangle -A OUTPUT -m owner --gid-owner "$_owner_id" -j "$_chain"
-		iptables -t mangle -A OUTPUT -m owner --gid-owner "${_owner_id}" -j "${_chain_name}"
 	fi
 
-	# 检查子链是否已有 RETURN
+	if ! $cmd -t mangle -C "$_chain" -j RETURN 2>/dev/null; then
-	if ! iptables -t mangle -C "${_chain_name}" -j RETURN 2>/dev/null; then
+		$cmd -t mangle -A "$_chain" -j RETURN
-		iptables -t mangle -A "${_chain_name}" -j RETURN
 	fi
-}
+done
-
-__main
 
 __help() {
 	cat >/dev/null <<-'EOF'