NATMap 打洞后自动更新 qBittorrent/Transmission 监听端口和 OpenWrt 防火墙规则并推送到 Telegram

qbittorrent.sh

#!/bin/sh

protocol=$5
inner_ip=$6
inner_port=$4
outter_ip=$1
outter_port=$2
ip4p=$3

qbv4="10.0.0.123"
qbv6="::abcd/-64 ::1234/-64"
qbwebport="8080"
qbusername=""
qbpassword=""
tgid=""
bottoken=""

  # OpenWrt Firewall
  # ipv6 allow
  uci set firewall.allowqbv6_${inner_port}=rule
  uci set firewall.allowqbv6_${inner_port}.name="Allow-qBittorrent-${inner_port}"
  uci set firewall.allowqbv6_${inner_port}.src='wan'
  uci set firewall.allowqbv6_${inner_port}.dest='lan'
  uci set firewall.allowqbv6_${inner_port}.target='ACCEPT'
  uci set firewall.allowqbv6_${inner_port}.dest_ip="${qbv6}"
  uci set firewall.allowqbv6_${inner_port}.family='ipv6'
  uci set firewall.allowqbv6_${inner_port}.dest_port="${outter_port}"
  # ipv4 redirect
  uci set firewall.redirectqbv4_${inner_port}=redirect
  uci set firewall.redirectqbv4_${inner_port}.name="Redirect-qBittorrent-${protocol}-${inner_port}"
  uci set firewall.redirectqbv4_${inner_port}.proto="${protocol}"
  uci set firewall.redirectqbv4_${inner_port}.src='wan'
  uci set firewall.redirectqbv4_${inner_port}.dest='lan'
  uci set firewall.redirectqbv4_${inner_port}.target='DNAT'
  uci set firewall.redirectqbv4_${inner_port}.src_dip="${inner_ip}"
  uci set firewall.redirectqbv4_${inner_port}.src_dport="${inner_port}"
  uci set firewall.redirectqbv4_${inner_port}.dest_ip="${qbv4}"
  uci set firewall.redirectqbv4_${inner_port}.dest_port="${outter_port}"
  # reload
  uci commit firewall
  /etc/init.d/firewall reload
  sleep 3

# update port
date=$(date +%s); echo $date > /tmp/natter${inner_port}
while true; do
  [[ $(cat /tmp/natter$inner_port) != $date ]] && exit 0
  tcping -c1 -p${qbwebport} ${qbv4} >/dev/null
  if [ $? -eq 0 ]; then
    qbcookie=$(\
      curl -Ssi -X POST \
        -d "username=${qbusername}&password=${qbpassword}" \
        "http://${qbv4}:${qbwebport}/api/v2/auth/login" | \
      sed -n 's/.*\(SID=.\{32\}\);.*/\1/p' )
    curl -X POST \
      -b "${qbcookie}" \
      -d 'json={"listen_port":"'${outter_port}'"}' \
      "http://${qbv4}:${qbwebport}/api/v2/app/setPreferences"
    text="[Natter] qBittorrent TCP Port:\n$outter_ip:$outter_port -> $inner_ip:$inner_port -> $qbv4:$outter_port"
    break
  fi
  sleep 3
done


if [ "${text}" ]; then
  echo "${text}"
  logger -t "Natter" "${text}"
  curl -Ss -o /dev/null --retry 30 --retry-delay 5 -X POST \
    -H 'Content-Type: application/json' \
    -d '{"chat_id": "'${tgid}'", "text": "'"${text}"'", "parse_mode": "HTML", "disable_notification": "false"}' \
    "https://api.telegram.org/bot${bottoken}/sendMessage"
fi

transmission.sh

#!/bin/sh

protocol=$5
inner_ip=$6
inner_port=$4
outter_ip=$1
outter_port=$2
ip4p=$3

trv4="10.0.0.123"
trv6="::abcd/-64 ::1234/-64"
trwebport="9091"
trusername=""
trpassword=""
tgid=""
bottoken=""

  # OpenWrt Firewall
  # ipv6 allow
  uci set firewall.allowtrv6_${inner_port}=rule
  uci set firewall.allowtrv6_${inner_port}.name="Allow-Transmission-${inner_port}"
  uci set firewall.allowtrv6_${inner_port}.src='wan'
  uci set firewall.allowtrv6_${inner_port}.dest='lan'
  uci set firewall.allowtrv6_${inner_port}.target='ACCEPT'
  uci set firewall.allowtrv6_${inner_port}.dest_ip="${trv6}"
  uci set firewall.allowtrv6_${inner_port}.family='ipv6'
  uci set firewall.allowtrv6_${inner_port}.dest_port="${outter_port}"
  # ipv4 redirect
  uci set firewall.redirecttrv4_${inner_port}=redirect
  uci set firewall.redirecttrv4_${inner_port}.name="Redirect-Transmission-${protocol}-${inner_port}"
  uci set firewall.redirecttrv4_${inner_port}.proto="${protocol}"
  uci set firewall.redirecttrv4_${inner_port}.src='wan'
  uci set firewall.redirecttrv4_${inner_port}.dest='lan'
  uci set firewall.redirecttrv4_${inner_port}.target='DNAT'
  uci set firewall.redirecttrv4_${inner_port}.src_dip="${inner_ip}"
  uci set firewall.redirecttrv4_${inner_port}.src_dport="${inner_port}"
  uci set firewall.redirecttrv4_${inner_port}.dest_ip="${trv4}"
  uci set firewall.redirecttrv4_${inner_port}.dest_port="${outter_port}"
  # reload
  uci commit firewall
  /etc/init.d/firewall reload
  sleep 3

# update port
date=$(date +%s); echo $date > /tmp/natter${inner_port}
while true; do
  [[ $(cat /tmp/natter$inner_port) != $date ]] && exit 0
  tcping -c1 -p${trwebport} ${trv4} >/dev/null
  if [ $? -eq 0 ]; then
    if [ -n ${trusername} ]; then
      trauth="-u $trusername:$trpassword"
    fi
    trsid=$(curl -s $trauth http://${trv4}:${trwebport}/transmission/rpc | sed 's/.*<code>//g;s/<\/code>.*//g')
    curl -X POST \
      -H "${trsid}" $trauth \
      -d '{"method":"session-set","arguments":{"peer-port":'${outter_port}'}}' \
      "http://${trv4}:${trwebport}/transmission/rpc"
    text="[Natter] Transmission TCP Port:\n$outter_ip:$outter_port -&gt; $inner_ip:$inner_port -&gt; $trv4:$outter_port"
    break
  fi
  sleep 3
done


if [ "${text}" ]; then
  echo "${text}"
  logger -t "Natter" "${text}"
  curl -Ss -o /dev/null --retry 30 --retry-delay 5 -X POST \
    -H 'Content-Type: application/json' \
    -d '{"chat_id": "'${tgid}'", "text": "'"${text}"'", "parse_mode": "HTML", "disable_notification": "false"}' \
    "https://api.telegram.org/bot${bottoken}/sendMessage"
fi

如果只有来自路由器 IP 的传入连接，可能需要禁用 OpenWrt 的地址重写。
防火墙 - NAT 规则 ，添加