DOCSEARCHbyAlgolia
Submit Docs

nfqws2-keenetic

repository·master·Indexed 21 days ago

https://github.com/nfqws/nfqws2-keenetic

A utility for modifying TCP connections at the packet level using NFQUEUE and raw sockets, designed for routers (Keenetic, Netcraze, OpenWRT, Padavan) to bypass DPI-based restrictions. It supports multiple operating modes (list, auto, all) for domain processing and provides custom strategy configurations for HTTPS, QUIC, and UDP traffic.

Tokens
2.2K
Snippets
5
Records
8
Agent score
27%

What's inside nfqws2-keenetic

  1. How nfqws2 operating modes work

    master

    The NFQWS_EXTRA_ARGS parameter determines how nfqws2 selects domains for processing. Strategies are applied to domains in user.list and auto.list, excluding those in exclude.list.

    • Mode list: Only domains explicitly listed in /opt/etc/nfqws2/lists/user.list are processed.
    • Mode auto: Processes domains in user.list AND automatically detects unreachable domains. A domain is added to the processing list if it is determined to be unreachable 3 times within 60 seconds. Automatically added domains are logged to /opt/var/log/nfqws2.log and stored in /opt/etc/nfqws2/lists/auto.list.
    • Mode all: Processes all traffic except for domains listed in /opt/etc/nfqws2/lists/exclude.list.

    IP Lists: ipset.list and ipset_exclude.list are applied regardless of the operating mode.

  2. Install nfqws2-keenetic on Keenetic/Netcraze with Entware

    master

    To install nfqws2-keenetic on Keenetic or Netcraze devices using Entware, follow these steps:

    1. Prepare the system: Ensure you have Entware installed and the Kernel modules for Netfilter (OPKG > Kernel modules for Netfilter) installed via the web interface. On older firmwares, you must enable IPv6 (Network functions > IPv6) first to see this module.
    2. Install dependencies:
      opkg update
opkg install ca-certificates wget-ssl
opkg remove wget-nossl
    3. Add the repository (use the universal repository or a specific architecture one):
      mkdir -p /opt/etc/opkg
echo "src/gz nfqws2-keenetic https://nfqws.github.io/nfqws2-keenetic/all" > /opt/etc/opkg/nfqws2-keenetic.conf
    4. Install the package:
      opkg update
opkg install nfqws2-keenetic

    Note: If you are upgrading from nfqws-keenetic, remove it first using opkg remove nfqws-keenetic-web nfqws-keenetic.

    opkg update
opkg install ca-certificates wget-ssl
opkg remove wget-nossl

mkdir -p /opt/etc/opkg
echo "src/gz nfqws2-keenetic https://nfqws.github.io/nfqws2-keenetic/all" > /opt/etc/opkg/nfqws2-keenetic.conf

opkg update
opkg install nfqws2-keenetic

  3. Install nfqws2-keenetic on OpenWRT

    master

    Installation methods for OpenWRT depend on your version:

    For versions up to 24.10 (using opkg)

    1. Install dependencies:
      opkg update
opkg install ca-certificates wget-ssl
opkg remove wget-nossl
    2. Add public key and repository:
      wget -O "/tmp/nfqws2-keenetic.pub" "https://nfqws.github.io/nfqws2-keenetic/openwrt/nfqws2-keenetic.pub"
opkg-key add /tmp/nfqws2-keenetic.pub
echo "src/gz nfqws2-keenetic https://nfqws.github.io/nfqws2-keenetic/openwrt" > /etc/opkg/nfqws2-keenetic.conf
    3. Install package:
      opkg update
opkg install nfqws2-keenetic

    For versions 25.xx and Snapshots (using apk)

    1. Install dependencies:
      apk --update-cache add ca-certificates wget-ssl
apk del wget-nossl
    2. Add public key and repository:
      wget -O "/etc/apk/keys/nfqws2-keenetic.pem" "https://nfqws.github.io/nfqws2-keenetic/openwrt/nfqws2-keenetic.pem"
echo "https://nfqws.github.io/nfqws2-keenetic/openwrt/packages.adb" > /etc/apk/repositories.d/nfqws2-keenetic.list
    3. Install package:
      apk --update-cache add nfqws2-keenetic

    Note: On OpenWRT, configuration files are located at the root / instead of /opt. Use service nfqws2-keenetic {start|stop|restart|reload|status} to manage the service.

    # OpenWRT (opkg)
opkg update
opkg install ca-certificates wget-ssl
opkg remove wget-nossl
wget -O "/tmp/nfqws2-keenetic.pub" "https://nfqws.github.io/nfqws2-keenetic/openwrt/nfqws2-keenetic.pub"
opkg-key add /tmp/nfqws2-keenetic.pub
echo "src/gz nfqws2-keenetic https://nfqws.github.io/nfqws2-keenetic/openwrt" > /etc/opkg/nfqws2-keenetic.conf
opkg update
opkg install nfqws2-keenetic

  4. Configure nfqws2-keenetic settings

    master

    The configuration file is located at /opt/etc/nfqws2/nfqws2.conf (on OpenWRT, it is /etc/nfqws2/nfqws2.conf).

    Key Configuration Options

    • ISP_INTERFACE: The provider interface (e.g., eth3, eth2.2, or ppp0). Can accept multiple interfaces like ISP_INTERFACE="eth3 nwg1".
    • NFQWS_BASE_ARGS: Base arguments for nfqws2 (e.g., Lua scripts).
    • NFQWS_ARGS: HTTPS/QUIC traffic strategies.
    • NFQWS_ARGS_QUIC: Specific strategies for QUIC.
    • NFQWS_ARGS_UDP: UDP traffic strategy.
    • NFQWS_EXTRA_ARGS: Defines the operating mode:
      • auto: Processes user.list domains and automatically detects/adds unreachable domains.
      • list: Processes only domains in user.list.
      • all: Processes all traffic except domains in exclude.list.
    • NFQWS_ARGS_IPSET: IP lists for processing.
    • IPV6_ENABLED: Enable/disable IPv6 (0 or 1).
    • TCP_PORTS: TCP ports for iptables (e.g., 443(,80)).
    • UDP_PORTS: UDP ports for iptables (e.g., 443(,50000:50099)).
    • POLICY_NAME: Name of the Keenetic access policy (default nfqws).
    • POLICY_EXCLUDE: Mode for the access policy:
      • 0: Only devices in the specified policy are processed.
      • 1: All devices are processed EXCEPT those in the specified policy.
    • LOG_DEBUG_PATH: Path for debug logs.
    • LOG_LEVEL: Logging level (0 or 1).

  5. Generate keys for OpenWRT apk repositories

    master

    For OpenWRT repositories using the apk package manager, use openssl to generate an Elliptic Curve (EC) key pair using the prime256v1 curve.

    # Generate private key
openssl ecparam -name prime256v1 -genkey -noout -out private-key.pem

# Extract public key
openssl ec -in private-key.pem -pubout > public-key.pem

  6. Sign Packages.sig for OpenWRT opkg repositories

    master

    To sign an OpenWRT opkg repository using usign, you must first build the usign tool, generate a key pair, and then sign the Packages file. This process ensures the integrity of the repository for clients.

    # 1. Build usign
git clone https://git.openwrt.org/project/usign.git
cd usign/
cmake .
make

# 2. Generate keys
./usign -G -s secret.key -p public.key -c "nfqws2-keenetic OpenWRT repository"

# 3. Sign the Packages file
./usign -S -m out/_pages/openwrt/Packages -s secret.key -c "nfqws2-keenetic OpenWRT repository"

  7. Troubleshoot nfqws2-keenetic issues

    master

    Common Errors

    • iptables: No chain/target/match by that name: The Kernel modules for Netfilter package is not installed. On Keenetic, ensure IPv6 is enabled in the web interface to see this package.
    • can't initialize ip6tables table or Perhaps ip6tables or your kernel needs to be upgraded: The IPv6 Protocol package is not installed, or you are on an old 2.xx firmware. Try disabling IPv6 in the config.
    • readlink: not found or dirname: not found: Install busybox (opkg install busybox) or coreutils-readlink and coreutils-dirname.
    • Failed to download the package list...: wget-ssl is likely not installed or broken. Try opkg install --force-reinstall wget-ssl.

    Connectivity/Performance Issues

    • Hardware Acceleration: If flow offloading, hardware NAT, or hardware acceleration is enabled, iptables rules might be bypassed. Try disabling these features or managing them selectively.
    • Keenetic Specifics: Try togging the Network Accelerator (сетевой ускоритель) or disabling the IntelliQOS traffic classification service.
    • IPv6: Try disabling IPv6 on the provider interface via the router's web interface.

  8. Use multiple strategies with NFQWS_ARGS_CUSTOM

    master

    You can apply different strategies to different types of traffic by using the NFQWS_ARGS_CUSTOM option in the config file. Separate different strategy blocks using the --new parameter.

    Example: Applying a specific strategy for HTTPS (port 443) using a custom list, and a different strategy for HTTP (port 80):

    NFQWS_ARGS_CUSTOM="--filter-tcp=443 --dpi-desync=fake,split2 --hostlist=custom.list --new --filter-tcp=80 --dpi-desync=disorder2 --dpi-desync-fooling=md5sig,badseq"