010-bypass_with_tg.sh

#!/bin/sh

[ "$type" = "ip6tables" ] && exit
[ "$table" != "mangle" ] && exit

ipset_lists="bypass bypass2"

for bypass_desc in $ipset_lists; do
    mark_id=$(curl -kfsS http://localhost:79/rci/show/ip/policy | jq -r ".[] | select(.description == \"$bypass_desc\") | .mark")
    [ -z "$mark_id" ] && continue

ipset create "$bypass_desc" hash:ip timeout 43200 --exist

chain="_CUST_BYPASS_${bypass_desc}_MANGLE"
iptables -w -t mangle -N "$chain" 2>/dev/null || true

iptables -w -t mangle -C PREROUTING -m mark --mark 0x0 -j "$chain" >/dev/null 2>&1 || \
iptables -w -t mangle -A PREROUTING -m mark --mark 0x0 -j "$chain"

iptables -w -t mangle -C "$chain" -m set --match-set "$bypass_desc" dst -j MARK --set-mark 0x$mark_id >/dev/null 2>&1 || \
iptables -w -t mangle -A "$chain" -m set --match-set "$bypass_desc" dst -j MARK --set-mark 0x$mark_id

iptables -w -t mangle -C "$chain" -m set --match-set "$bypass_desc" dst -j CONNMARK --save-mark >/dev/null 2>&1 || \
iptables -w -t mangle -A "$chain" -m set --match-set "$bypass_desc" dst -j CONNMARK --save-mark

iptables -w -t mangle -C "$chain" -m set --match-set "$bypass_desc" dst -j RETURN >/dev/null 2>&1 || \
iptables -w -t mangle -A "$chain" -m set --match-set "$bypass_desc" dst -j RETURN

done

ipset create bypass_telegram hash:net --exist

telegram_cidrs=$(curl -kfsS https://core.telegram.org/resources/cidr.txt | grep -v ':' || true)

if [ -n "$telegram_cidrs" ]; then
    ipset flush bypass_telegram
    for cidr in $telegram_cidrs; do
        ipset add bypass_telegram "$cidr"
    done
fi

mark_id_bypass=$(curl -kfsS http://localhost:79/rci/show/ip/policy | jq -r '.[] | select(.description == "bypass") | .mark')
chain="_CUST_BYPASS_bypass_MANGLE"

iptables -w -t mangle -C "$chain" -m set --match-set bypass_telegram dst -j MARK --set-mark 0x$mark_id_bypass >/dev/null 2>&1 || \
iptables -w -t mangle -A "$chain" -m set --match-set bypass_telegram dst -j MARK --set-mark 0x$mark_id_bypass

iptables -w -t mangle -C "$chain" -m set --match-set bypass_telegram dst -j CONNMARK --save-mark >/dev/null 2>&1 || \
iptables -w -t mangle -A "$chain" -m set --match-set bypass_telegram dst -j CONNMARK --save-mark

iptables -w -t mangle -C "$chain" -m set --match-set bypass_telegram dst -j RETURN >/dev/null 2>&1 || \
iptables -w -t mangle -A "$chain" -m set --match-set bypass_telegram dst -j RETURN