View difference between Paste ID: F2GmyrCC and 4PptMAx6

 #!/bin/sh
-# version: 1.0.0, 28-sep-2021, by eibgrad
+#DEBUG= # uncomment/comment to enable/disable debug mode
-# href: https://tinyurl.com/crwtpkep
+
 #          name: merlin-ovpn-client-killswitch.sh
 #       version: 2.0.0, 22-jul-2022, by eibgrad
-SCRIPT="$SCRIPTS_DIR/firewall-start"
+#       purpose: openvpn client firewall-based killswitch
 #       type(s): firewall-start
 #          href: https://tinyurl.com/35xww7ue
 #  installation:
 #    1. enable jffs custom scripts and configs (administration->system)
-cat << "EOF" > $SCRIPT
+#    2. ssh to router and copy/paste the following command:
 #         curl -kLs bit.ly/merlin-installer|tr -d '\r'|sh -s F2GmyrCC
-set -x # uncomment/comment to enable/disable debug mode
+#    3. modify script w/ your preferred options using nano editor:
 #         nano /jffs/scripts/merlin-ovpn-client-killswitch.sh
 #    4. reboot
 
-# openvpn clients that will participate in the kill switch (all by default)
+
 SCRIPT1="$SCRIPTS_DIR/merlin-ovpn-client-killswitch.sh"
 SCRIPT2="$SCRIPTS_DIR/firewall-start"
 
 mkdir -p $SCRIPTS_DIR
 
 # ------------------- begin merlin-ovpn-client-killswitch -------------------- #
 cat << 'EOF' > $SCRIPT1
 #!/bin/sh
 #set -x # comment/uncomment to disable/enable debug mode
 {
 # ------------------------------ BEGIN OPTIONS ------------------------------- #
 
 # openvpn clients that will participate in the killswitch (all by default)
 VPN_CLIENTS='1 2 3 4 5'
 
 # uncomment/comment to enable/disable autostart checking
 VPN_AUTOSTART_ONLY= # only consider auto-started openvpn clients
 
 # state checking: "state NEW" vs. no state
 #   state NEW:
 #     * any pre-existing LAN->WAN connections persist unless/until they
 #       timeout/close
 #     * remote access (WAN->LAN) is allowed (provided port forwarding is enabled)
 #     * more efficient (only LAN->WAN packets used to establish NEW connections
-PBR_RULES="$(cat /jffs/openvpn/vpndirector_rulelist)"
+
-FW_CHAIN='ovpn_block_wan'
+
-WAN_IF="$(nvram get wan0_ifname)"
+
 #     * remote access (WAN->LAN) is denied (even if port forwarding is enabled)
 #     * less efficient (every LAN->WAN packet is inspected)
 
 # uncomment/comment to enable/disable state checking
-# function is_kill_switch_participant( vpn-client-number )
+
-is_kill_switch_participant() { echo $VPN_CLIENTS | grep -q $1; }
+
 # ------------------------------- END OPTIONS -------------------------------- #
 
 # ---------------------- DO NOT CHANGE BELOW THIS LINE ----------------------- #
 
 WAN_IF="$([ $1 ] && echo $1 || echo $(nvram get wan0_ifname))"
 PBR_RULES="$(sed 's/\s//g' /jffs/openvpn/vpndirector_rulelist 2>/dev/null)"
 FW_CHAIN='ovpnc_block_wan'
 
 # function is_autostart_enabled( vpn-client-number )
 is_autostart_enabled() { nvram get vpn_clientx_eas | grep -q $1; }
 
 # function is_killswitch_participant( vpn-client-number )
-    # prerequisite: vpn client has "Yes(all)" routing policy
+is_killswitch_participant() { echo $VPN_CLIENTS | grep -q $1; }
 
 # function is_redirect_all( vpn-client-number )
 is_redirect_all() { [ "$(nvram get vpn_client${1}_rgw)" == '1' ]; }
 
 # cleanup from possible prior execution
 {
 iptables -D FORWARD -i br+ -o $WAN_IF $FW_STATE -j REJECT
 iptables -D FORWARD -i br+ -o $WAN_IF $FW_STATE -j $FW_CHAIN
 iptables -F $FW_CHAIN && iptables -X $FW_CHAIN
 } &>/dev/null
 
 for i in $VPN_CLIENTS; do
     # handle vpn client w/ "Yes(all)" routing policy
     is_redirect_all $i || continue
 
     # prerequisite: vpn client has autostart enabled (when applicable)
     [ ${VPN_AUTOSTART_ONLY+x} ] && ! is_autostart_enabled $i && continue
 
-    # prerequisite: enabled vpn pbr rule
+
-    { [ "$f1" == '1' ] && echo $f5 | grep -q 'OVPN'; } || continue
+
 
     exit 0
 done
 
-    # prerequisite: vpn client is kill switch participant
+
-    is_kill_switch_participant $f5 || continue
+
 
 # iterate over the pbr (policy based routing) rules
 for i in $(echo "$PBR_RULES" | tr '<' '\n'); do
     # parse the rule into separate fields (ignore description field (#2))
     for j in 1 3 4 5; do eval f$j="$(echo $i | cut -d'>' -f$j)"; done
 
     # prerequisite: enabled rule
     [ "$f1" == '1' ] || continue
 
     # handle wan pbr rule
     if echo $f5 | grep -q 'WAN'; then
         # do NOT deny access to this local and/or remote ip/network
         iptables -A $FW_CHAIN $([ "$f3" ] && echo "-s $f3") \
-#} >/tmp/$(basename $0).$$.log 2>&1
+            $([ "$f4" ] && echo "-d $f4") -j RETURN
         continue
     fi
-chmod +x $SCRIPT
+
     # handle vpn pbr rule
     echo $f5 | grep -q 'OVPN' || continue
-if [ -f $SCRIPT ]; then
+
-    echo "error: $SCRIPT already exists; requires manual installation"
+
     f5="$(echo $f5 | grep -o [1-5])"
 
-    echo 'Done.'
+    # prerequisite: vpn client is killswitch participant
-fi
+    is_killswitch_participant $f5 || continue
 
     # prerequisite: vpn client has autostart enabled (when applicable)
     [ ${VPN_AUTOSTART_ONLY+x} ] && ! is_autostart_enabled $f5 && continue
 
     # deny access to wan for this local and/or remote ip/network
     iptables -A $FW_CHAIN $([ "$f3" ] && echo "-s $f3") \
         $([ "$f4" ] && echo "-d $f4") -j REJECT
 done
 
 # force LAN->WAN traffic thru user-defined chain for inspection
 iptables -I FORWARD -i br+ -o $WAN_IF $FW_STATE -j $FW_CHAIN
 
 exit 0
 } 2>&1 | logger -t $(basename $0 .sh)[$$]
 EOF
 [ ${DEBUG+x} ] && sed -ri '2 s/^#(set -x)/\1/' $SCRIPT1
 chmod +x $SCRIPT1
 echo "installed: $SCRIPT1"
 # -------------------- end merlin-ovpn-client-killswitch --------------------- #
 
 # --------------------------- begin firewall-start --------------------------- #
 create_script() {
 cat << 'EOF' > $SCRIPT2
 #!/bin/sh
 #set -x # comment/uncomment to disable/enable debug mode
 {
 $SCRIPT1
 } 2>&1 | logger -t $(basename $0)[$$]
 EOF
 [ ${DEBUG+x} ] && sed -ri '2 s/^#(set -x)/\1/' $SCRIPT2
 sed "s:\$SCRIPT1:$SCRIPT1:g" -i $SCRIPT2
 chmod +x $SCRIPT2
 }
 
 if [ -f $SCRIPT2 ]; then
     echo "error: $SCRIPT2 already exists; requires manual installation"
 else
     create_script
     echo "installed: $SCRIPT2"
 fi
 # ---------------------------- end firewall-start ---------------------------- #