前言
  ├─ DHT (Distributed Hash Table)
  ├─ PEX (Peer Exchange)
  ├─ STUN (Session Traversal Utilities for NAT)
  ├─ 传统 STUN 的局限性
  └─ nftables
  
  基本场景
  ├─ 1. NATMap 运行在 OpenWrt 主路由上
  ├─ 2. NATMap 运行在 OpenWrt 旁路由 / 二级路由上
  └─ 3. NATMap 运行在 WSL2 旁路由上
  
  系统要求
  
  安装 WSL2
  ├─ 启用 Hyper-V
  └─ 安装 WSL2 Linux 发行版
  
  配置 WSL2
  ├─ 配置桥接网络
  ├─ 配置 WSL2 开机自启动
  ├─ 修改 WSL2 Linux 发行版的软件源
  ├─ 配置 WSL2 Linux 发行版的自启动
  ├─ 重启 WSL2 Linux 发行版
  └─ 配置 WSL2 Linux 发行版为旁路由
  
  扩展阅读：关于旁路由
  
  准备工作
  ├─ OpenWrt 主路由 / 旁路由
  ├─ WSL2 旁路由
  └─ 配置代理服务器（可选）
  
  配置 STUN 脚本
  ├─ 脚本内容
  ├─ 初始化
  ├─ HTTP Tracker
  ├─ UDP Tracker
  └─ DNAT
  
  配置 NATMap
  ├─ OpenWrt 主路由 / 旁路由
  ├─ WSL2 旁路由
  └─ 配置选项

  其他
  ├─ 运行状况
  └─ 配置多个实例

Get-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V

Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All

wsl --update
wsl -v

wsl -l -o
wsl --install -d Debian

Get-NetAdapter
New-VMSwitch -SwitchName "VETH" -NetAdapterName "以太网" -AllowManagementOS $True -EnablePacketDirect $True -EnableIov $True

cd ~
New-Item .wslconfig
notepad .\.wslconfig

[wsl2]
networkingMode=bridged
vmSwitch=VETH
ipv6=true

New-Item WSL_AutoStart.vbs
notepad .\WSL_AutoStart.vbs

createobject("wscript.shell").run "wsl",0

$action = New-ScheduledTaskAction -Execute "$env:USERPROFILE\WSL_AutoStart.vbs"
$trigger = New-ScheduledTaskTrigger -AtStartup
$settings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries
$task = New-ScheduledTask -Action $action -Trigger $trigger -Settings $settings
Register-ScheduledTask WSL_AutoStart -InputObject $task

taskschd

wsl

sudo -i

cp /etc/apt/sources.list /etc/apt/sources.list.bak
sed -i 's_http:\/\/.*debian\.org_https://mirrors.tuna.tsinghua.edu.cn_' /etc/apt/sources.list
apt update
apt upgrade

mv /etc/apt/sources.list.bak /etc/apt/sources.list
apt update
apt install apt-transport-https ca-certificates

echo 'none none rc defaults 0 0' | tee -a /etc/fstab
touch /sbin/mount.rc
chmod +x /sbin/mount.rc

nano /sbin/mount.rc

#!/bin/bash

sysctl -w net.ipv4.ip_forward=1
sysctl -w net.ipv6.conf.all.forwarding=1

wsl --shutdown

wsl

ip a
sysctl net.ipv4.ip_forward
sysctl net.ipv6.conf.all.forwarding

Get-NetAdapter

$GWIP="192.168.5.1"
$PCIP="192.168.5.241"
Remove-NetIPAddress -InterfaceAlias "vEthernet (VETH)" -IPAddress $PCIP -PrefixLength 24 -DefaultGateway $GWIP -Confirm:$false
New-NetIPAddress -InterfaceAlias "vEthernet (VETH)" -IPAddress $PCIP -PrefixLength 24 -DefaultGateway $GWIP
Set-DnsClientServerAddress -InterfaceAlias "vEthernet (VETH)" -ServerAddresses ($GWIP,"119.29.29.29")

$WSLIP="192.168.5.31"
route ADD -p 0.0.0.0 MASK 0.0.0.0 $WSLIP METRIC 1

$WSLIP="192.168.5.31"
Get-NetAdapter
Set-NetIPInterface -InterfaceAlias "vEthernet (VETH)" -InterfaceMetric 1000
route ADD -p 0.0.0.0 MASK 0.0.0.0 $WSLIP METRIC 1 IF 

sed -i 's_downloads.openwrt.org_mirrors.tuna.tsinghua.edu.cn/openwrt_' /etc/opkg/distfeeds.conf

opkg update
opkg install luci-app-natmap nano xxd miniupnpc proxychains-ng

apt update
apt install xxd miniupnpc proxychains4 dnsutils

curl -Lo /usr/bin/natmap https://github.com/heiher/natmap/releases/download/20240303/natmap-linux-x86_64
chmod +x /usr/bin/natmap

$URL = 'https://github.com/3proxy/3proxy/releases/download/0.9.4/3proxy-0.9.4-x64.zip'
$TMP = New-TemporaryFile
Invoke-WebRequest -OutFile "$TMP.zip" $URL
"$TMP.zip" | Expand-Archive -DestinationPath $env:USERPROFILE\3proxy
"$TMP.zip" | Remove-Item

New-Item .\3proxy\bin64\3proxy.cfg
notepad .\3proxy\bin64\3proxy.cfg

proxy

.\3proxy\bin64\3proxy.exe --install .\3proxy\bin64\3proxy.cfg

netstat -an | findstr 3128

net stop 3proxy
net start 3proxy

touch /usr/stun_bt.sh
chmod +x /usr/stun_bt.sh
nano /usr/stun_bt.sh

# 以下变量需按要求填写
IFNAME=					# 指定接口，可留空；仅在多 WAN 时需要；拨号接口的格式为 "pppoe-wancm"
GWLADDR=192.168.1.1		# 主路由 LAN 的 IPv4 地址
APPADDR=192.168.1.168	# 下载设备的 IPv4 地址，允许主路由或旁路由本身运行 BT 应用
APPPORT=12345			# BT 应用程序的监听端口，HTTP 改包要求 5 位数端口

WANADDR=$1
WANPORT=$2
LANPORT=$4
L4PROTO=$5
OWNADDR=$6

OWNNAME=$(echo $0 | awk -F / '{print$NF}' | awk -F . '{print$1}')
RELEASE=$(grep ^ID= /etc/os-release | awk -F '=' '{print$2}' | tr -d \")
STUNIFO=/tmp/$OWNNAME.info
OLDPORT=$(grep $L4PROTO $STUNIFO 2>/dev/null | awk -F ':| ' '{print$3}')

# 判断 TCP 或 UDP 的穿透是否启用
# 清理穿透信息中没有运行的协议
touch $STUNIFO
case $RELEASE in
	openwrt)
		for SECTION in $(uci show natmap | grep $0 | awk -F . '{print$2}'); do
			if [ "$(uci -q get natmap.$SECTION.enable)" = 1 ]; then
				case $(uci get natmap.$SECTION.udp_mode) in
					0) SECTTCP=$SECTION ;;
					1) SECTUDP=$SECTION ;;
				esac
			fi
		done
		[ $(uci -q get natmap.$SECTTCP) ] || ( \
		DISPORT="$(grep tcp $STUNIFO | awk -F ':| ' '{print$3}') tcp"; sed -i '/'tcp'/d' $STUNIFO )
		[ $(uci -q get natmap.$SECTUDP) ] || ( \
		DISPORT="$(grep udp $STUNIFO | awk -F ':| ' '{print$3}') udp"; sed -i '/'udp'/d' $STUNIFO )
		;;
	*)
		ps aux | grep $0 | grep "\-h" || ( \
		DISPORT="$(grep tcp $STUNIFO | awk -F ':| ' '{print$3}') tcp"; sed -i '/'tcp'/d' $STUNIFO )
		ps aux | grep $0 | grep "\-u" || ( \
		DISPORT="$(grep udp $STUNIFO | awk -F ':| ' '{print$3}') udp"; sed -i '/'udp'/d' $STUNIFO )
		;;
esac

# 更新保存穿透信息
sed -i '/'$L4PROTO'/d' $STUNIFO
echo $L4PROTO $WANADDR:$WANPORT '->' $OWNADDR:$LANPORT '->' $APPADDR:$APPPORT $(date +%s) >>$STUNIFO
echo $(date) $L4PROTO $WANADDR:$WANPORT '->' $OWNADDR:$LANPORT '->' $APPADDR:$APPPORT >>/tmp/$OWNNAME.log

# 防止脚本同时操作 nftables 导致冲突
[ $L4PROTO = udp ] && sleep 1 && \
[ $(($(date +%s) - $(grep tcp $STUNIFO | awk '{print$NF}'))) -lt 3 ] && sleep 3

# 初始化 nftables
nft add table ip STUN
nft add chain ip STUN BTTR { type filter hook postrouting priority filter \; }
nft flush chain ip STUN BTTR
WANTCP=$(grep tcp $STUNIFO | awk -F ':| ' '{print$3}')
WANUDP=$(grep udp $STUNIFO | awk -F ':| ' '{print$3}')
if [ -n "$IFNAME" ]; then
	IIFNAME="iifname $IFNAME"
	OIFNAME="oifname $IFNAME"
fi

# HTTP Tracker
STRAPP=0x706f72743d$(printf $APPPORT | xxd -p)
STRTCP=0x3d$(printf 30$(printf "$WANTCP" | xxd -p) | tail -c 10)
STRUDP=0x3d$(printf 30$(printf "$WANUDP" | xxd -p) | tail -c 10)
if [ -n "$WANTCP" ] && [ -n "$WANUDP" ]; then
	SETSTR="numgen inc mod 2 map { 0 : $STRTCP, 1 : $STRUDP }"
elif [ -n "$WANTCP" ]; then
	SETSTR=$STRTCP
elif [ -n "$WANUDP" ]; then
	SETSTR=$STRUDP
fi
nft add set ip STUN BTTR_HTTP "{ type ipv4_addr . inet_service; flags dynamic; timeout 1h; }"
nft add chain ip STUN BTTR_HTTP
nft insert rule ip STUN BTTR ip daddr . tcp dport @BTTR_HTTP goto BTTR_HTTP
nft add rule ip STUN BTTR meta l4proto tcp @ih,0,112 0x474554202f616e6e6f756e63653f add @BTTR_HTTP { ip daddr . tcp dport } goto BTTR_HTTP
for HANDLE in $(nft -a list chain ip STUN BTTR_HTTP | grep \"$OWNNAME\" | awk '{print$NF}'); do
	nft delete rule ip STUN BTTR_HTTP handle $HANDLE
done
for OFFSET in $(seq 768 16 1056); do
	nft add rule ip STUN BTTR_HTTP $OIFNAME ip saddr $APPADDR @ih,$OFFSET,80 $STRAPP @ih,$(($OFFSET+32)),48 set $SETSTR update @BTTR_HTTP { ip daddr . tcp dport } counter accept comment $OWNNAME
done

# UDP Tracker
if [ -n "$WANTCP" ] && [ -n "$WANUDP" ]; then
	SETNUM="numgen inc mod 2 map { 0 : $WANTCP, 1 : $WANUDP }"
elif [ -n "$WANTCP" ]; then
	SETNUM=$WANTCP
elif [ -n "$WANUDP" ]; then
	SETNUM=$WANUDP
fi
nft add set ip STUN BTTR_UDP "{ type ipv4_addr . inet_service; flags dynamic; timeout 1h; }"
nft add chain ip STUN BTTR_UDP
nft insert rule ip STUN BTTR ip daddr . udp dport @BTTR_UDP goto BTTR_UDP
nft add rule ip STUN BTTR meta l4proto udp @ih,0,64 0x41727101980 @ih,64,32 0 add @BTTR_UDP { ip daddr . udp dport } goto BTTR_UDP
nft delete rule ip STUN BTTR_UDP handle $(nft -a list chain ip STUN BTTR_UDP 2>/dev/null | grep \"$OWNNAME\" | awk '{print$NF}') 2>/dev/null
nft add rule ip STUN BTTR_UDP $OIFNAME ip saddr $APPADDR @ih,64,32 1 @ih,768,16 $APPPORT @ih,768,16 set $SETNUM update @BTTR_UDP { ip daddr . udp dport } counter accept comment $OWNNAME

# 判断脚本运行的环境，选择 DNAT 方式
# 先排除需要 UPnP 的情况
DNAT=0
for LANADDR in $(ip -4 a show dev br-lan | grep inet | awk '{print$2}' | awk -F '/' '{print$1}'); do
	[ $DNAT = 1 ] && break
	[ "$LANADDR" = $GWLADDR ] && DNAT=1
done
for LANADDR in $(nslookup -type=A $HOSTNAME | grep Address | grep -v :53 | awk '{print$2}'); do
	[ $DNAT = 1 ] && break
	[ "$LANADDR" = $GWLADDR ] && DNAT=1
done
[ $APPADDR = $GWLADDR ] && DNAT=2

# 若未排除，则尝试直连 UPnP
if [ $DNAT = 0 ]; then
	[ -n "$OLDPORT" ] && upnpc -i -d $OLDPORT $L4PROTO
	[ -n "$DISPORT" ] && upnpc -i -d $DISPORT
	upnpc -i -e "STUN BT $L4PROTO $WANPORT->$LANPORT->$APPPORT" -a $APPADDR $APPPORT $LANPORT $L4PROTO | \
	grep $APPADDR | grep $APPPORT | grep $LANPORT | grep -v failed
	[ $? = 0 ] && DNAT=3
fi

# 直连失败，则尝试代理 UPnP
if [ $DNAT = 0 ]; then
	PROXYCONF=/tmp/proxychains.conf
	echo [ProxyList] >$PROXYCONF
	echo http $APPADDR 3128 >>$PROXYCONF
	[ -n "$OLDPORT" ] && proxychains -f $PROXYCONF upnpc -i -d $OLDPORT $L4PROTO
	[ -n "$DISPORT" ] && proxychains -f $PROXYCONF upnpc -i -d $DISPORT
	proxychains -f $PROXYCONF \
	upnpc -i -e "STUN BT $L4PROTO $WANPORT->$LANPORT->$APPPORT" -a $APPADDR $APPPORT $LANPORT $L4PROTO | \
	grep $APPADDR | grep $APPPORT | grep $LANPORT | grep -v failed
	[ $? = 0 ] && DNAT=3
fi

# 代理失败，则启用本机 UPnP
[ $DNAT = 0 ] && (upnpc -i -e "STUN BT $L4PROTO $WANPORT->$LANPORT" -a @ $LANPORT $LANPORT $L4PROTO; DNAT=4)

# 清理不需要的规则
if [ $DNAT = 3 ]; then
	[ "$RELEASE" = "openwrt" ] && uci -q delete firewall.${OWNNAME}_tcp
	[ "$RELEASE" = "openwrt" ] && uci -q delete firewall.${OWNNAME}_udp
	nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep tcp | awk '{print$NF}') 2>/dev/null
	nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep udp | awk '{print$NF}') 2>/dev/null
fi
if [ $DNAT != 3 ]; then
	[ -z "$WANTCP" ] && uci -q delete firewall.${OWNNAME}_tcp
	[ -z "$WANUDP" ] && uci -q delete firewall.${OWNNAME}_udp
	[ -z "$WANTCP" ] && \
	nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep tcp | awk '{print$NF}') 2>/dev/null
	[ -z "$WANUDP" ] && \
	nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep udp | awk '{print$NF}') 2>/dev/null
fi

# 选择使用 uci 或 nft
SETDNAT() {
	if [ -n "$*" ]; then
		nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep tcp | awk '{print$NF}') 2>/dev/null
		nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep udp | awk '{print$NF}') 2>/dev/null
		uci -q delete firewall.stun_foo
		uci -q delete firewall.${OWNNAME}_$L4PROTO
		uci set firewall.${OWNNAME}_$L4PROTO=redirect
		uci set firewall.${OWNNAME}_$L4PROTO.name=${OWNNAME}_${L4PROTO}_$1'->'$2
		uci set firewall.${OWNNAME}_$L4PROTO.src=wan
		uci set firewall.${OWNNAME}_$L4PROTO.proto=$L4PROTO
		uci set firewall.${OWNNAME}_$L4PROTO.src_dport=$1
		uci set firewall.${OWNNAME}_$L4PROTO.dest_port=$2
		uci -q set firewall.${OWNNAME}_$L4PROTO.dest_ip=$3
		uci commit firewall
		fw4 -q reload
		UCI=1
	else
		nft add chain ip STUN DNAT { type nat hook prerouting priority dstnat \; }
		nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep $L4PROTO | awk '{print$NF}') 2>/dev/null
	fi
	if [ "$RELEASE" = "openwrt" ] && [ "$UCI" != 1 ]; then
		uci -q delete firewall.stun_foo && RELOAD=1
		uci -q delete firewall.${OWNNAME}_tcp && RELOAD=1
		uci -q delete firewall.${OWNNAME}_udp && RELOAD=1
		if uci show firewall | grep =redirect >/dev/null; then
			i=0
			for CONFIG in $(uci show firewall | grep =redirect | awk -F = '{print$1}'); do
				[ "$(uci -q get $CONFIG.enabled)" = 0 ] && let i++ && break
				[ "$(uci -q get $CONFIG.src)" != "wan" ] && let i++
			done
			[ $(uci show firewall | grep =redirect | wc -l) -gt $i ] && RULE=1
		fi
		if [ "$RULE" != 1 ]; then
			uci set firewall.stun_foo=redirect
			uci set firewall.stun_foo.name=stun_foo
			uci set firewall.stun_foo.src=wan
			uci set firewall.stun_foo.mark=$RANDOM
			RELOAD=1
		fi
		uci commit firewall
		[ "$RELOAD" = 1 ] && fw4 -q reload
	fi
}

# BT 应用运行在路由器下，使用 dnat
[ $DNAT = 1 ] || [ $DNAT = 4 ] && \
if [ "$RELEASE" = "openwrt" ] && [ -z "$IFNAME" ]; then
	SETDNAT $LANPORT $APPPORT $APPADDR
else
	SETDNAT
	nft add rule ip STUN DNAT $IIFNAME $L4PROTO dport $LANPORT counter dnat ip to $APPADDR:$APPPORT comment $OWNNAME
fi

# BT 应用运行在路由器上，使用 redirect
[ $DNAT = 2 ] && \
if [ "$RELEASE" = "openwrt" ] && [ -z "$IFNAME" ]; then
	SETDNAT $LANPORT $APPPORT
else
	SETDNAT
	nft add rule ip STUN DNAT $IIFNAME $L4PROTO dport $LANPORT counter redirect to :$APPPORT comment $OWNNAME
fi

chmod +x /usr/stun_bt.sh

IFNAME=
GWLADDR=192.168.1.1
APPADDR=192.168.1.168
APPPORT=12345

WANADDR=$1
WANPORT=$2
LANPORT=$4
L4PROTO=$5
OWNADDR=$6

OWNNAME=$(echo $0 | awk -F / '{print$NF}' | awk -F . '{print$1}')
RELEASE=$(grep ^ID= /etc/os-release | awk -F '=' '{print$2}' | tr -d \")
STUNIFO=/tmp/$OWNNAME.info
OLDPORT=$(grep $L4PROTO $STUNIFO 2>/dev/null | awk -F ':| ' '{print$3}')

touch $STUNIFO
case $RELEASE in
	openwrt)
		for SECTION in $(uci show natmap | grep $0 | awk -F . '{print$2}'); do
			if [ "$(uci -q get natmap.$SECTION.enable)" = 1 ]; then
				case $(uci get natmap.$SECTION.udp_mode) in
					0) SECTTCP=$SECTION ;;
					1) SECTUDP=$SECTION ;;
				esac
			fi
		done
		[ $(uci -q get natmap.$SECTTCP) ] || ( \
		DISPORT="$(grep tcp $STUNIFO | awk -F ':| ' '{print$3}') tcp"; sed -i '/'tcp'/d' $STUNIFO )
		[ $(uci -q get natmap.$SECTUDP) ] || ( \
		DISPORT="$(grep udp $STUNIFO | awk -F ':| ' '{print$3}') udp"; sed -i '/'udp'/d' $STUNIFO )
		;;
	*)
		ps aux | grep $0 | grep "\-h" || ( \
		DISPORT="$(grep tcp $STUNIFO | awk -F ':| ' '{print$3}') tcp"; sed -i '/'tcp'/d' $STUNIFO )
		ps aux | grep $0 | grep "\-u" || ( \
		DISPORT="$(grep udp $STUNIFO | awk -F ':| ' '{print$3}') udp"; sed -i '/'udp'/d' $STUNIFO )
		;;
esac

sed -i '/'$L4PROTO'/d' $STUNIFO
echo $L4PROTO $WANADDR:$WANPORT '->' $OWNADDR:$LANPORT '->' $APPADDR:$APPPORT $(date +%s) >>$STUNIFO
echo $(date) $L4PROTO $WANADDR:$WANPORT '->' $OWNADDR:$LANPORT '->' $APPADDR:$APPPORT >>/tmp/$OWNNAME.log

[ $L4PROTO = udp ] && sleep 1 && \
[ $(($(date +%s) - $(grep tcp $STUNIFO | awk '{print$NF}'))) -lt 3 ] && sleep 3

nft add table ip STUN
nft add chain ip STUN BTTR { type filter hook postrouting priority filter \; }
nft flush chain ip STUN BTTR
WANTCP=$(grep tcp $STUNIFO | awk -F ':| ' '{print$3}')
WANUDP=$(grep udp $STUNIFO | awk -F ':| ' '{print$3}')
if [ -n "$IFNAME" ]; then
	IIFNAME="iifname $IFNAME"
	OIFNAME="oifname $IFNAME"
fi

STRAPP=0x706f72743d$(printf $APPPORT | xxd -p)
STRTCP=0x3d$(printf 30$(printf "$WANTCP" | xxd -p) | tail -c 10)
STRUDP=0x3d$(printf 30$(printf "$WANUDP" | xxd -p) | tail -c 10)

if [ -n "$WANTCP" ] && [ -n "$WANUDP" ]; then
	SETSTR="numgen inc mod 2 map { 0 : $STRTCP, 1 : $STRUDP }"
elif [ -n "$WANTCP" ]; then
	SETSTR=$STRTCP
elif [ -n "$WANUDP" ]; then
	SETSTR=$STRUDP
fi

nft add set ip STUN BTTR_HTTP "{ type ipv4_addr . inet_service; flags dynamic; timeout 1h; }"
nft add chain ip STUN BTTR_HTTP

nft insert rule ip STUN BTTR ip daddr . tcp dport @BTTR_HTTP goto BTTR_HTTP
nft add rule ip STUN BTTR meta l4proto tcp @ih,0,112 0x474554202f616e6e6f756e63653f add @BTTR_HTTP { ip daddr . tcp dport } goto BTTR_HTTP
for HANDLE in $(nft -a list chain ip STUN BTTR_HTTP | grep \"$OWNNAME\" | awk '{print$NF}'); do
	nft delete rule ip STUN BTTR_HTTP handle $HANDLE
done

for OFFSET in $(seq 768 16 1056); do
	nft add rule ip STUN BTTR_HTTP $OIFNAME ip saddr $APPADDR @ih,$OFFSET,80 $STRAPP @ih,$(($OFFSET+32)),48 set $SETSTR update @BTTR_HTTP { ip daddr . tcp dport } counter accept comment $OWNNAME
done

if [ -n "$WANTCP" ] && [ -n "$WANUDP" ]; then
	SETNUM="numgen inc mod 2 map { 0 : $WANTCP, 1 : $WANUDP }"
elif [ -n "$WANTCP" ]; then
	SETNUM=$WANTCP
elif [ -n "$WANUDP" ]; then
	SETNUM=$WANUDP
fi

nft add set ip STUN BTTR_UDP "{ type ipv4_addr . inet_service; flags dynamic; timeout 1h; }"
nft add chain ip STUN BTTR_UDP

nft insert rule ip STUN BTTR ip daddr . udp dport @BTTR_UDP goto BTTR_UDP
nft add rule ip STUN BTTR meta l4proto udp @ih,0,64 0x41727101980 @ih,64,32 0 add @BTTR_UDP { ip daddr . udp dport } goto BTTR_UDP
nft delete rule ip STUN BTTR_UDP handle $(nft -a list chain ip STUN BTTR_UDP 2>/dev/null | grep \"$OWNNAME\" | awk '{print$NF}') 2>/dev/null

nft add rule ip STUN BTTR_UDP $OIFNAME ip saddr $APPADDR @ih,64,32 1 @ih,768,16 $APPPORT @ih,768,16 set $SETNUM update @BTTR_UDP { ip daddr . udp dport } counter accept comment $OWNNAME

DNAT=0
for LANADDR in $(ip -4 a show dev br-lan | grep inet | awk '{print$2}' | awk -F '/' '{print$1}'); do
	[ $DNAT = 1 ] && break
	[ "$LANADDR" = $GWLADDR ] && DNAT=1
done
for LANADDR in $(nslookup -type=A $HOSTNAME | grep Address | grep -v :53 | awk '{print$2}'); do
	[ $DNAT = 1 ] && break
	[ "$LANADDR" = $GWLADDR ] && DNAT=1
done
[ $APPADDR = $GWLADDR ] && DNAT=2

if [ $DNAT = 0 ]; then
	[ -n "$OLDPORT" ] && upnpc -i -d $OLDPORT $L4PROTO
	[ -n "$DISPORT" ] && upnpc -i -d $DISPORT
	upnpc -i -e "STUN BT $L4PROTO $WANPORT->$LANPORT->$APPPORT" -a $APPADDR $APPPORT $LANPORT $L4PROTO | \
	grep $APPADDR | grep $APPPORT | grep $LANPORT | grep -v failed
	[ $? = 0 ] && DNAT=3
fi

if [ $DNAT = 0 ]; then
	PROXYCONF=/tmp/proxychains.conf
	echo [ProxyList] >$PROXYCONF
	echo http $APPADDR 3128 >>$PROXYCONF
	[ -n "$OLDPORT" ] && proxychains -f $PROXYCONF upnpc -i -d $OLDPORT $L4PROTO
	[ -n "$DISPORT" ] && proxychains -f $PROXYCONF upnpc -i -d $DISPORT
	proxychains -f $PROXYCONF \
	upnpc -i -e "STUN BT $L4PROTO $WANPORT->$LANPORT->$APPPORT" -a $APPADDR $APPPORT $LANPORT $L4PROTO | \
	grep $APPADDR | grep $APPPORT | grep $LANPORT | grep -v failed
	[ $? = 0 ] && DNAT=3
fi

[ $DNAT = 0 ] && (upnpc -i -e "STUN BT $L4PROTO $WANPORT->$LANPORT" -a @ $LANPORT $LANPORT $L4PROTO; DNAT=4)

if [ $DNAT = 3 ]; then
	[ "$RELEASE" = "openwrt" ] && uci -q delete firewall.${OWNNAME}_tcp
	[ "$RELEASE" = "openwrt" ] && uci -q delete firewall.${OWNNAME}_udp
	nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep tcp | awk '{print$NF}') 2>/dev/null
	nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep udp | awk '{print$NF}') 2>/dev/null
fi
if [ $DNAT != 3 ]; then
	[ -z "$WANTCP" ] && uci -q delete firewall.${OWNNAME}_tcp
	[ -z "$WANUDP" ] && uci -q delete firewall.${OWNNAME}_udp
	[ -z "$WANTCP" ] && \
	nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep tcp | awk '{print$NF}') 2>/dev/null
	[ -z "$WANUDP" ] && \
	nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep udp | awk '{print$NF}') 2>/dev/null
fi

SETDNAT() {
	if [ -n "$*" ]; then
		nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep tcp | awk '{print$NF}') 2>/dev/null
		nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep udp | awk '{print$NF}') 2>/dev/null
		uci -q delete firewall.stun_foo
		uci -q delete firewall.${OWNNAME}_$L4PROTO
		uci set firewall.${OWNNAME}_$L4PROTO=redirect
		uci set firewall.${OWNNAME}_$L4PROTO.name=${OWNNAME}_${L4PROTO}_$1'->'$2
		uci set firewall.${OWNNAME}_$L4PROTO.src=wan
		uci set firewall.${OWNNAME}_$L4PROTO.proto=$L4PROTO
		uci set firewall.${OWNNAME}_$L4PROTO.src_dport=$1
		uci set firewall.${OWNNAME}_$L4PROTO.dest_port=$2
		uci -q set firewall.${OWNNAME}_$L4PROTO.dest_ip=$3
		uci commit firewall
		fw4 -q reload
		UCI=1
	else
		nft add chain ip STUN DNAT { type nat hook prerouting priority dstnat \; }
		nft delete rule ip STUN DNAT handle $(nft -a list chain ip STUN DNAT 2>/dev/null | grep \"$OWNNAME\" | grep $L4PROTO | awk '{print$NF}') 2>/dev/null
	fi
	if [ "$RELEASE" = "openwrt" ] && [ "$UCI" != 1 ]; then
		uci -q delete firewall.stun_foo && RELOAD=1
		uci -q delete firewall.${OWNNAME}_tcp && RELOAD=1
		uci -q delete firewall.${OWNNAME}_udp && RELOAD=1
		if uci show firewall | grep =redirect >/dev/null; then
			i=0
			for CONFIG in $(uci show firewall | grep =redirect | awk -F = '{print$1}'); do
				[ "$(uci -q get $CONFIG.enabled)" = 0 ] && let i++ && break
				[ "$(uci -q get $CONFIG.src)" != "wan" ] && let i++
			done
			[ $(uci show firewall | grep =redirect | wc -l) -gt $i ] && RULE=1
		fi
		if [ "$RULE" != 1 ]; then
			uci set firewall.stun_foo=redirect
			uci set firewall.stun_foo.name=stun_foo
			uci set firewall.stun_foo.src=wan
			uci set firewall.stun_foo.mark=$RANDOM
			RELOAD=1
		fi
		uci commit firewall
		[ "$RELOAD" = 1 ] && fw4 -q reload
	fi
}

[ $DNAT = 1 ] || [ $DNAT = 4 ] && \
if [ "$RELEASE" = "openwrt" ] && [ -z "$IFNAME" ]; then
	SETDNAT $LANPORT $APPPORT $APPADDR
else
	SETDNAT
	nft add rule ip STUN DNAT $IIFNAME $L4PROTO dport $LANPORT counter dnat ip to $APPADDR:$APPPORT comment $OWNNAME
fi

[ $DNAT = 2 ] && \
if [ "$RELEASE" = "openwrt" ] && [ -z "$IFNAME" ]; then
	SETDNAT $LANPORT $APPPORT
else
	SETDNAT
	nft add rule ip STUN DNAT $IIFNAME $L4PROTO dport $LANPORT counter redirect to :$APPPORT comment $OWNNAME
fi

chmod +x /usr/stun_bt.sh

nano /etc/config/natmap

config natmap
	option udp_mode '0'
	option family 'ipv4'
	option interval '25'
	option stun_server 'turn.cloudflare.com'
	option http_server 'qq.com'
	option port '0'
	option notify_script '/usr/stun_bt.sh'
	option enable '1'

config natmap
	option udp_mode '1'
	option family 'ipv4'
	option interval '25'
	option stun_server 'turn.cloudflare.com'
	option http_server 'qq.com'
	option port '0'
	option notify_script '/usr/stun_bt.sh'
	option enable '1'

/etc/init.d/natmap restart

nano /sbin/mount.rc

natmap -d -4 -k 25 -s turn.cloudflare.com -h qq.com -e "/usr/stun_bt.sh"
natmap -d -4 -k 25 -s turn.cloudflare.com -u -e "/usr/stun_bt.sh"

wsl --shutdown
wsl

cat /tmp/stun_bt.info
cat /tmp/stun_bt.log

nft list table ip STUN

upnpc -i -l

cat /tmp/proxychains.conf

/usr/stun_bt_wanct_PC1_BC.sh	+	/usr/stun_bt_wancm_PC1_BC.sh
IFNAME=pppoe-wanct				+	IFNAME=pppoe-wancm
APPADDR=192.168.1.168			+	APPADDR=192.168.1.168
APPPORT=12345					+	APPPORT=12345

/usr/stun_bt_PC1_BC.sh			+	/usr/stun_bt_PC2_BC.sh
IFNAME=							+	IFNAME=
APPADDR=192.168.1.168			+	APPADDR=192.168.1.169
APPPORT=12345					+	APPPORT=12345

/usr/stun_bt_PC1_BC.sh			+	/usr/stun_bt_PC1_qB.sh
IFNAME=							+	IFNAME=
APPADDR=192.168.1.168			+	APPADDR=192.168.1.168
APPPORT=12345					+	APPPORT=23456

/usr/stun_bt_wanct_PC1_BC.sh	+	/usr/stun_bt_wancm_PC2_qB.sh
IFNAME=pppoe-wanct				+	IFNAME=pppoe-wancm
APPADDR=192.168.1.168			+	APPADDR=192.168.1.169
APPPORT=12345					+	APPPORT=23456