1
#!/usr/sbin/nft -f
2

3
flush ruleset
4

5
table inet xray {
6
        chain prerouting {
7
                type filter hook prerouting priority filter; policy accept;
8
                ip daddr { 127.0.0.0/8, 224.0.0.0/4, 255.255.255.255 } return
9
                meta l4proto tcp ip daddr 172.16.0.0/16 return
10
                ip daddr 172.16.0.0/16 udp dport != 53 return
11
                ip6 daddr { ::1, fe80::/10 } return
12
                meta l4proto tcp ip6 daddr fdac::/8 return
13
                ip6 daddr fdac::/8 udp dport != 53 return
14
                meta mark 0x000000ff return
15
                meta l4proto { tcp, udp } meta mark set 0x00000001 tproxy ip to 127.0.0.1:12345 accept
16
                meta l4proto { tcp, udp } meta mark set 0x00000001 tproxy ip6 to [::1]:12345 accept
17
        }
18

19
        chain output {
20
                type route hook output priority filter; policy accept;
21
                ip daddr { 127.0.0.0/8, 224.0.0.0/4, 255.255.255.255 } return
22
                meta l4proto tcp ip daddr 172.16.0.0/16 return
23
                ip daddr 172.16.0.0/16 udp dport != 53 return
24
                ip6 daddr { ::1, fe80::/10 } return
25
                meta l4proto tcp ip6 daddr fdac::/8 return
26
                ip6 daddr fdac::/8 udp dport != 53 return
27
                meta mark 0x000000ff return
28
                meta l4proto { tcp, udp } meta mark set 0x00000001 accept
29
        }
30

31
        chain divert {
32
                type filter hook prerouting priority mangle; policy accept;
33
                meta l4proto tcp socket transparent 1 meta mark set 0x00000001 accept
34
        }
35
}

1
[Unit]
2
Description=Tproxy rules for Side Gateway
3
After=network-online.target
4
Wants=network-online.target
5

6
[Service]
7
Type=oneshot
8
RemainAfterExit=yes
9

10
# 确保网关连通后再加载
11
ExecStartPre=/bin/sh -c "until ping -c1 172.16.1.1 >/dev/null 2>&1; do sleep 1; done"
12

13
ExecStart=/bin/sh -c "\
14
ip rule add fwmark 1 table 100 2>/dev/null || true; \
15
ip -6 rule add fwmark 1 table 106 2>/dev/null || true; \
16
ip route replace local default dev lo table 100; \
17
ip -6 route replace local default dev lo table 106; \
18
/usr/sbin/nft -f /etc/systemd/system/nftables.rulesv46"
19

20
ExecStop=/bin/sh -c "\
21
ip rule del fwmark 1 table 100 2>/dev/null || true; \
22
ip -6 rule del fwmark 1 table 106 2>/dev/null || true; \
23
nft flush ruleset"
24

25
[Install]
26
WantedBy=multi-user.target

1
#!/bin/bash
2

3
# 配置路径
4
XRAY_BIN="/usr/local/bin/xray"
5
LOG_FILE="/var/log/xray_update.log"
6

7
# --- 版本提取 ---
8
# 提取本地版本: Xray 26.2.6 -> 26.2.6
9
LOCAL_VER=$($XRAY_BIN --version 2>/dev/null | head -n 1 | awk '{print $2}')
10

11
# 提取远程版本: "tag_name": "v26.2.6" -> 26.2.6
12
# 增加 --connect-timeout 和 --retry 提高稳定性
13
REMOTE_VER=$(curl -s --connect-timeout 10 --retry 3 https://api.github.com/repos/XTLS/Xray-core/releases/latest | grep '"tag_name":' | sed -E 's/.*"v?([^"]+)".*/\1/')
14

15
echo "-------------------------------------------" >> $LOG_FILE
16
echo "$(date '+%Y-%m-%d %H:%M:%S') 检查 Xray-Core 更新..." >> $LOG_FILE
17

18
# 检查远程版本是否获取成功
19
if [ -z "$REMOTE_VER" ]; then
20
    echo "错误: 无法获取远程版本，可能是 GitHub API 访问受限或网络连接失败。" >> $LOG_FILE
21
    exit 1
22
fi
23

24
echo "当前本地版本: ${LOCAL_VER:-未知}" >> $LOG_FILE
25
echo "当前远程版本: ${REMOTE_VER}" >> $LOG_FILE
26

27
# --- 核心判断逻辑 ---
28
if [ "$LOCAL_VER" == "$REMOTE_VER" ]; then
29
    echo "结果: 已经是最新版本，跳过更新。" >> $LOG_FILE
30
else
31
    echo "结果: 发现新版本 ${REMOTE_VER}，准备开始升级..." >> $LOG_FILE
32

33
    # 执行官方安装/更新脚本
34
    if bash -c "$(curl -L -s --connect-timeout 10 https://github.com/XTLS/Xray-install/raw/main/install-release.sh)" @ install -u root >> $LOG_FILE 2>&1; then
35
        echo "$(date '+%Y-%m-%d %H:%M:%S') 升级完成！" >> $LOG_FILE
36
    else
37
        echo "$(date '+%Y-%m-%d %H:%M:%S') 升级脚本执行失败，请检查上方日志。" >> $LOG_FILE
38
        exit 1
39
    fi
40
fi

1
#!/bin/bash
2

3
# 配置变量
4
DEST_DIR="/usr/local/share/xray"
5
TMP_DIR="/tmp"
6
MAX_RETRIES=3
7
FILES=("geoip.dat" "geosite.dat")
8
BASE_URL="https://github.com/Loyalsoldier/v2ray-rules-dat/releases/latest/download"
9

10
# 确保目标目录存在
11
mkdir -p "$DEST_DIR"
12

13
download_and_verify() {
14
    local file=$1
15
    local retry=0
16
    local success=false
17

18
    while [ $retry -lt $MAX_RETRIES ]; do
19
        ((retry++))
20
        echo "正在下载 $file (尝试 $retry/$MAX_RETRIES)..."
21

22
        # 下载文件和对应的 sha256sum
23
        curl -L -s -o "$TMP_DIR/$file" "$BASE_URL/$file"
24
        curl -L -s -o "$TMP_DIR/$file.sha256sum" "$BASE_URL/$file.sha256sum"
25

26
        # 进入 tmp 目录执行校验
27
        # 因为校验文件内容是 "hash  filename"，需要 cd 过去确保文件名匹配
28
        cd "$TMP_DIR" || exit 1
29
        if sha256sum -c "$file.sha256sum" > /dev/null 2>&1; then
30
            echo "$file 校验通过！"
31
            success=true
32
            break
33
        else
34
            echo "$file 校验失败，正在重试..."
35
            rm -f "$TMP_DIR/$file" "$TMP_DIR/$file.sha256sum"
36
        fi
37
    done
38

39
    if [ "$success" = false ]; then
40
        echo "错误: $file 在 $MAX_RETRIES 次尝试后仍下载失败或校验不匹配，退出脚本。"
41
        exit 1
42
    fi
43
}
44

45
# 1. 处理两个文件
46
for f in "${FILES[@]}"; do
47
    download_and_verify "$f"
48
done
49

50
# 2. 如果运行到这里，说明全部校验通过，开始移动文件
51
echo "所有文件校验成功，正在移动到 $DEST_DIR..."
52
for f in "${FILES[@]}"; do
53
    mv -f "$TMP_DIR/$f" "$DEST_DIR/$f"
54
    rm -f "$TMP_DIR/$f.sha256sum"
55
done
56

57
# 3. 重启 xray 服务
58
echo "正在重启 Xray 服务..."
59
systemctl restart xray
60

61
if [ $? -eq 0 ]; then
62
    echo "完成！规则已更新并重启服务。"
63
else
64
    echo "服务重启失败，请检查 systemctl status xray。"
65
    exit 1
66
fi