$ show nfqws/nfqws-keenetic
nfqws-keenetic is a distribution and packaging repository that delivers the `nfqws` DPI-bypass utility (from the zapret project) as installable packages for embedded routers — primarily Zyxel Keenetic/Netcraze devices running Entware, plus OpenWRT. In production it functions as a service installer: post-install scripts detect the WAN interface and IPv6 availability, write a tuned nfqws.conf, install the correct architecture-specific nfqws binary, and register an init script that programs iptables/ip6tables POSTROUTING NFQUEUE rules for TCP/QUIC/UDP ports and manages the daemon lifecycle. The traffic-modifying logic itself lives in the upstream nfqws binary; this repo is the glue: packaging, configuration, firewall orchestration, and domain/IP lists (user.list, auto.list, exclude.list, ipset lists) for targeted DPI evasion. Architecturally it is a Makefile-driven build system (packages.mk, repository.mk) that downloads the latest zapret release binaries from GitHub at build time, cross-packages them into per-arch .ipk files (mipsel, mips, aarch64, and a multi-arch 'all' variant), and assembles an opkg/apk repository published to GitHub Pages via a GitHub Actions pipeline. The service layer is split into reusable POSIX-shell fragments: etc/init.d/common holds idempotent firewall rule management, kernel-module autoloading, runtime config generation, and validation; thin platform wrappers adapt it to Entware (S51nfqws) and OpenWRT (procd). A Keenetic netfilter hook (etc/ndm/netfilter.d/100-nfqws.sh) re-applies firewall rules whenever NDM regenerates them. Important maintenance truth: the README explicitly states the project no longer receives updates and all new features will appear in nfqws2-keenetic; this repo is the legacy v1 line (tag v2.11.4). An agent searching for an actively developed solution should evaluate the successor first, but the code that exists is well-crafted for its niche — config-versioned package migrations, layered architecture auto-detection in a single multi-arch package, and careful iptables rule idempotency. Technical drift is moderate: the release workflow relies on deprecated GitHub Actions (create-release v1, upload-release-asset v1), while the shell and packaging code targets stable router interfaces.
The LLM identified 3 files worth highlighting for reuse:
Self-contained post-install logic that detects the target CPU architecture through layered fallbacks (opkg.conf, opkg distfeeds.conf, uname -m, /proc/cpuinfo), including special cases that correct MediaTek-branded 'mips' to 'mipsel' and map 'rlx' to 'lexra', then copies the matching nfqws binary out of a bundled multi-arch set. This solves a recurring embedded-packaging problem — shipping one 'all'-architecture package that installs the correct binary on heterogeneous routers — and the detection/install functions can be lifted into any opkg/apk package with minimal modification.
The core service logic: idempotent iptables/ip6tables management (the _firewall helper probes rule existence with `-C` before inserting/removing with `-w`), NFQUEUE POSTROUTING rule construction with connbytes packet-window filtering, policy-marking and MASQUERADE fallbacks for modified UDP, plus a kernel_modules() function that tries modprobe and falls back to locating and insmod'ing .ko files under /lib/modules. These are reusable patterns for any embedded router daemon that must program netfilter reliably, although the file does reference nfqws-specific config variables.
A clean CONFIG_VERSION-based migration pattern for package upgrades: it compares the installed config schema version against the version embedded at build time, and if a migration is needed, renames the old nfqws.conf to nfqws.conf-old so postinst performs a fresh, correct install. It also persists the install-vs-upgrade mode in /opt/tmp/nfqws_install_type for postinst to consume. This is a small, extractable template for any opkg/Entware package that must evolve its configuration without destroying user customizations.