Podkop is an OpenWrt package for traffic routing using sing-box as the proxy core. It provides a LuCI web interface (TypeScript frontend compiled to JavaScript) with tabs for Settings, Sections (proxy/VPN/block/exclusion), Dashboard (real-time traffic via Clash API WebSocket), and Diagnostic (checks for DNS, sing-box, nftables, FakeIP). The backend consists of shell scripts: /usr/bin/podkop (main entry), /etc/init.d/podkop (procd init), and libraries in /usr/lib/podkop/ (constants.sh, nft.sh, helpers.sh, sing_box_config_manager.sh, etc.). It uses nftables for traffic marking and TPROXY, dnsmasq for DNS hijacking with FakeIP, and downloads community domain/subnet lists from GitHub. It supports proxy protocols: VLESS, Shadowsocks, Trojan, SOCKS, Hysteria2. The architecture is monolithic: the frontend communicates with the backend via shell commands (exec) and WebSocket to the Clash API. The backend manages sing-box configuration, nftables rules, and list updates via cron. Key entry points include install.sh (installation), /usr/bin/podkop (service management), and the LuCI view files. External dependencies include sing-box, jq, curl, nft, coreutils-base64, bind-dig, and the diagnostic endpoints (ip.podkop.fyi, fakeip.podkop.fyi). The system is in beta, with breaking changes possible; users are advised to clear LuCI cache on updates. The codebase demonstrates solid engineering with modular shell libraries, a well-structured TypeScript frontend with unit tests for validators, and CI/CD pipelines. However, it has some drift risks: hardcoded version requirements, compiled JS committed to the repository, and reliance on external services. The frontend includes reusable components such as a reactive store service, WebSocket manager, and composable validators.
PassWall is a LuCI application for OpenWrt routers that provides a unified management interface and runtime orchestration for proxy/VPN clients. In production it runs as a daemon-managed transparent proxy: it generates per-core JSON configurations for xray, sing-box, shadowsocks-rust, SSR, hysteria2, naiveproxy, and other engines; builds iptables/nftables transparent-proxy rules; integrates DNS-level routing through dnsmasq, smartdns, chinadns-ng, or dns2socks; and exposes a full web UI for node management, subscriptions, ACLs, shunt rules, health checks, load balancing via HAProxy, and server-side inbound configuration. The service is configured through UCI (`/etc/config/passwall`), with shell scripts as the main runtime dispatchers and Lua modules as the configuration-generation and LuCI-controller layer.
This repository provides a transparent proxy package for OpenWrt using Mihomo (a clash-compatible rule-based proxy core) as the backend. It is a full LuCI application that allows users to configure proxy modes (redirect, TPROXY, TUN), manage subscriptions, define access control rules, and monitor logs through a web interface. The system is designed for OpenWrt ≥24.10 with firewall4 (nftables) and kernel ≥5.13. The architecture consists of three OpenWrt packages: `nikki` (main service and scripts), `mihomo-meta` (stable core), and `mihomo-alpha` (alpha variant). The service is managed via procd init script (`nikki.init`), which handles starting/stopping Mihomo, setting up routing rules and nftables tables, and scheduling tasks. Configuration is stored in UCI (OpenWrt's standard configuration system) and processed through a pipeline: UCI options → `mixin.uc` (ucode script) generates a JSON overlay → `yq` merges it with a base profile → final Mihomo config. Traffic interception rules are generated dynamically from a utpl template (`hijack.ut`) that produces nftables rulesets. Key entry points include the LuCI views (`app.js`, `profile.js`, `mixin.js`, `proxy.js`, `editor.js`, `log.js`) for web-based management, the init script for service lifecycle, and shell scripts for installation/upgrade. External dependencies are Mihomo core, `yq` for YAML processing, and standard OpenWrt tools (procd, nftables, ucode). The repository also includes a large hardcoded nftables set of Chinese IP prefixes (`geoip_cn.nft`) for bypassing mainland China traffic.
This repository provides a bash script (`mnf`) and an nftables rules file (`mullvad.rules`) that enable running Mullvad VPN alongside Tailscale or Zerotier on Linux. The script orchestrates the Mullvad CLI, nftables, and the mesh networking service to ensure traffic from the Tailscale/Zerotier network bypasses the VPN (or is correctly routed) while all other traffic goes through Mullvad. It supports country selection, RAM-only servers, custom DNS, and selective teardown. The code is a single, well-structured bash script with clear functions and argument parsing. It is not a library or framework but a purpose-built tool for a specific network configuration problem. The repository has a small footprint, no tests, and no CI/CD, but it is actively maintained (last commit dated 2026-05-07, though this appears anomalous). The nftables rules file is a simple configuration that marks packets from excluded IP ranges. There are no reusable software components beyond the script itself, which is tightly coupled to the Mullvad/Tailscale/Zerotier ecosystem.