Linux Zapret Kurulum Rehberi

ordinary · January 9, 2025, 5:41pm

/etc/resolv.conf dosyası her NetworkManager yeniden başladığında eski haline dönüyor ve dnscrypt bağlanmıyor. Nasıl çözerim?

Biraz araştırınca buldum çözümü

/etc/NetworkManager/NetworkManager.conf

bu config dosyasını

[main]
dns=none

şeklinde düzenliyoruz ve çözülüyor.

Arseniy_Sandalov · January 10, 2025, 10:20pm

Arkadaşlar lütfen yardım edin, sorunun ne olduğunu bilmiyorum

● zapret.service
     Loaded: loaded (/usr/lib/systemd/system/zapret.service; enabled; preset: disabled)
    Drop-In: /usr/lib/systemd/system/service.d
             └─10-timeout-abort.conf, 50-keep-warm.conf
     Active: active (running) since Sat 2025-01-11 01:15:24 MSK; 11s ago
 Invocation: a7d3656b44f74fdca9c4824279e75e0b
    Process: 20320 ExecStart=/opt/zapret/init.d/sysv/zapret start (code=exited, status=0/SUCCESS)
      Tasks: 1 (limit: 18891)
     Memory: 428K (peak: 7.7M)
        CPU: 141ms
     CGroup: /system.slice/zapret.service
             └─20356 /opt/zapret/nfq/nfqws --user=tpws --dpi-desync-fwmark=0x40000000 --qnum=200 --dpi-desync=fake --dpi-desync-ttl=3

янв 11 01:15:24 192.168.1.187 systemd[1]: Starting zapret.service...
янв 11 01:15:24 192.168.1.187 zapret[20320]: Starting daemon 3: /opt/zapret/nfq/nfqws --user=tpws --dpi-desync-fwmark=0x40000000 --qnum=200 --dpi-desy>
янв 11 01:15:24 192.168.1.187 zapret[20320]: Applying nftables
янв 11 01:15:24 192.168.1.187 zapret[20320]: Creating ip list table (firewall type nftables)
янв 11 01:15:24 192.168.1.187 zapret[20362]: setting high oom kill priority
янв 11 01:15:24 192.168.1.187 zapret[20362]: reloading nftables set backend (no-update)
янв 11 01:15:24 192.168.1.187 zapret[20320]: Inserting nftables ipv4 rule for nfqws postrouting (qnum 200) : tcp dport {80,443} ct original packets 1-9
янв 11 01:15:24 192.168.1.187 zapret[20320]: Inserting nftables ipv4 rule for nfqws prerouting (qnum 200) : tcp sport {80,443} ct reply packets 1-3
янв 11 01:15:24 192.168.1.187 zapret[20320]: Inserting nftables ipv4 rule for nfqws postrouting (qnum 200) : udp dport {443} ct original packets 1-9
янв 11 01:15:24 192.168.1.187 systemd[1]: Started zapret.service.

Metin · January 10, 2025, 10:31pm

Hata yok çalışıyor gösteriyor sizin attığınız logda. Acaba engelleri aşmıyor mu? Düzgünce kurulumu ve ayarlamaları yaptınız mı?

Sype · January 11, 2025, 2:25pm

Zapret’i kurdum fakat hala Discord’a erişim sağlayamıyorum.

zapret config dosyası:

# this file is included from init scripts
# change values here

# can help in case /tmp has not enough space
#TMPDIR=/opt/zapret/tmp

# redefine user for zapret daemons. required on Keenetic
#WS_USER=nobody

# override firewall type : iptables,nftables,ipfw
FWTYPE=iptables
# nftables only : set this to 0 to use pre-nat mode. default is post-nat.
# pre-nat mode disables some bypass techniques for forwarded traffic but allows to see client IP addresses in debug log
#POSTNAT=0

# options for ipsets
# maximum number of elements in sets. also used for nft sets
SET_MAXELEM=522288
# too low hashsize can cause memory allocation errors on low RAM systems , even if RAM is enough
# too large hashsize will waste lots of RAM
IPSET_OPT="hashsize 262144 maxelem $SET_MAXELEM"
# dynamically generate additional ip. $1 = ipset/nfset/table name
#IPSET_HOOK="/etc/zapret.ipset.hook"

# options for ip2net. "-4" or "-6" auto added by ipset create script
IP2NET_OPT4="--prefix-length=22-30 --v4-threshold=3/4"
IP2NET_OPT6="--prefix-length=56-64 --v6-threshold=5"
# options for auto hostlist
AUTOHOSTLIST_RETRANS_THRESHOLD=3
AUTOHOSTLIST_FAIL_THRESHOLD=3
AUTOHOSTLIST_FAIL_TIME=60
# 1 = debug autohostlist positives to ipset/zapret-hosts-auto-debug.log
AUTOHOSTLIST_DEBUGLOG=0

# number of parallel threads for domain list resolves
MDIG_THREADS=30

# ipset/*.sh can compress large lists
GZIP_LISTS=1
# command to reload ip/host lists after update
# comment or leave empty for auto backend selection : ipset or ipfw if present
# on BSD systems with PF no auto reloading happens. you must provide your own command
# set to "-" to disable reload
#LISTS_RELOAD="pfctl -f /etc/pf.conf"

# mark bit used by nfqws to prevent loop
DESYNC_MARK=0x40000000
DESYNC_MARK_POSTNAT=0x20000000

TPWS_SOCKS_ENABLE=0
# tpws socks listens on this port on localhost and LAN interfaces
TPPORT_SOCKS=987
# use <HOSTLIST> and <HOSTLIST_NOAUTO> placeholders to engage standard hostlists and autohostlist in ipset dir
# hostlist markers are replaced to empty string if MODE_FILTER does not satisfy
# <HOSTLIST_NOAUTO> appends ipset/zapret-hosts-auto.txt as normal list
TPWS_SOCKS_OPT="
--filter-tcp=80 --methodeol <HOSTLIST> --new
--filter-tcp=443 --split-pos=1,midsld --disorder <HOSTLIST>
"

TPWS_ENABLE=0
TPWS_PORTS=80,443
# use <HOSTLIST> and <HOSTLIST_NOAUTO> placeholders to engage standard hostlists and autohostlist in ipset dir
# hostlist markers are replaced to empty string if MODE_FILTER does not satisfy
# <HOSTLIST_NOAUTO> appends ipset/zapret-hosts-auto.txt as normal list
TPWS_OPT="
--filter-tcp=80 --methodeol <HOSTLIST> --new
--filter-tcp=443 --split-pos=1,midsld --disorder <HOSTLIST>
"

NFQWS_ENABLE=1
# redirect outgoing traffic with connbytes limiter applied in both directions.
NFQWS_PORTS_TCP=80,443
NFQWS_PORTS_UDP=443
# PKT_OUT means connbytes dir original
# PKT_IN means connbytes dir reply
# this is --dpi-desync-cutoff=nX kernel mode implementation for linux. it saves a lot of CPU.
NFQWS_TCP_PKT_OUT=9
NFQWS_TCP_PKT_IN=3
NFQWS_UDP_PKT_OUT=9
NFQWS_UDP_PKT_IN=0
# redirect outgoing traffic without connbytes limiter and incoming with connbytes limiter
# normally it's needed only for stateless DPI that matches every packet in a single TCP session
# typical example are plain HTTP keep alives
# this mode can be very CPU consuming. enable with care !
#NFQWS_PORTS_TCP_KEEPALIVE=
#NFQWS_PORTS_UDP_KEEPALIVE=
# use <HOSTLIST> and <HOSTLIST_NOAUTO> placeholders to engage standard hostlists and autohostlist in ipset dir
# hostlist markers are replaced to empty string if MODE_FILTER does not satisfy
# <HOSTLIST_NOAUTO> appends ipset/zapret-hosts-auto.txt as normal list
NFQWS_OPT="--dpi-desync=fakeddisorder --dpi-desync-ttl=1 --dpi-desync-autottl=5 --dpi-desync-split-pos=1"

# none,ipset,hostlist,autohostlist
MODE_FILTER=none

# openwrt only : donttouch,none,software,hardware
FLOWOFFLOAD=donttouch

# openwrt: specify networks to be treated as LAN. default is "lan"
#OPENWRT_LAN="lan lan2 lan3"
# openwrt: specify networks to be treated as WAN. default wans are interfaces with default route
#OPENWRT_WAN4="wan vpn"
#OPENWRT_WAN6="wan6 vpn6"

# for routers based on desktop linux and macos. has no effect in openwrt.
# CHOOSE LAN and optinally WAN/WAN6 NETWORK INTERFACES
# or leave them commented if its not router
# it's possible to specify multiple interfaces like this : IFACE_LAN="eth0 eth1 eth2"
# if IFACE_WAN6 is not defined it take the value of IFACE_WAN
#IFACE_LAN=
#IFACE_WAN=
#IFACE_WAN6="ipsec0 wireguard0 he_net"

# should start/stop command of init scripts apply firewall rules ?
# not applicable to openwrt with firewall3+iptables
INIT_APPLY_FW=1
# firewall apply hooks
#INIT_FW_PRE_UP_HOOK="/etc/firewall.zapret.hook.pre_up"
#INIT_FW_POST_UP_HOOK="/etc/firewall.zapret.hook.post_up"
#INIT_FW_PRE_DOWN_HOOK="/etc/firewall.zapret.hook.pre_down"
#INIT_FW_POST_DOWN_HOOK="/etc/firewall.zapret.hook.post_down"

# do not work with ipv4
#DISABLE_IPV4=1
# do not work with ipv6
DISABLE_IPV6=1

# select which init script will be used to get ip or host list
# possible values : get_user.sh get_antizapret.sh get_combined.sh get_reestr.sh get_hostlist.sh
# comment if not required
#GETLIST=

systemctl status zapret :

● zapret.service
     Loaded: loaded (/usr/lib/systemd/system/zapret.service; enabled; preset: disabled)
     Active: active (running) since Sat 2025-01-11 17:19:27 +03; 4min 45s ago
 Invocation: 71633d3370de44c58e09aef291eb0581
    Process: 36252 ExecStart=/opt/zapret/init.d/sysv/zapret start (code=exited, status=0/SUCCESS)
      Tasks: 1 (limit: 18874)
     Memory: 500K (peak: 8M)
        CPU: 318ms
     CGroup: /system.slice/zapret.service
             └─36288 /opt/zapret/nfq/nfqws --user=tpws --dpi-desync-fwmark=0x40000000 --qnum=200 --dpi-desync=fakeddisorder --dpi-desync-ttl=1 --dpi-desync-autottl=5 --dpi-desync-split-pos=1

Oca 11 17:19:27 ThinkPad-E480 systemd[1]: Starting zapret.service...
Oca 11 17:19:27 ThinkPad-E480 zapret[36252]: Starting daemon 3: /opt/zapret/nfq/nfqws --user=tpws --dpi-desync-fwmark=0x40000000 --qnum=200 --dpi-desync=fakeddisorder --dpi-desync-ttl=1 --dpi-desync-autottl=5 --dpi-desync-split-pos=1
Oca 11 17:19:27 ThinkPad-E480 zapret[36252]: Applying iptables
Oca 11 17:19:27 ThinkPad-E480 zapret[36252]: Creating ip list table (firewall type iptables)
Oca 11 17:19:27 ThinkPad-E480 zapret[36294]: setting high oom kill priority
Oca 11 17:19:27 ThinkPad-E480 zapret[36294]: reloading ipset backend (no-update)
Oca 11 17:19:27 ThinkPad-E480 zapret[36252]: Inserting iptables rule for nfqws postrouting (qnum 200) : -p tcp -m multiport --dports 80,443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9
Oca 11 17:19:27 ThinkPad-E480 zapret[36252]: Inserting iptables rule for nfqws input+forward (qnum 200) : -p tcp -m multiport --sports 80,443  -m connbytes --connbytes-dir=reply --connbytes-mode=packets --connbytes 1:3
Oca 11 17:19:27 ThinkPad-E480 zapret[36252]: Inserting iptables rule for nfqws postrouting (qnum 200) : -p udp -m multiport --dports 443 -m connbytes --connbytes-dir=original --connbytes-mode=packets --connbytes 1:9
Oca 11 17:19:27 ThinkPad-E480 systemd[1]: Started zapret.service.

iyi günler

ahmetcetinkaya · January 11, 2025, 2:58pm

blockcheck.sh scriptin size verdiği çeşitli stratejilerden, https olanları dikkate alabilirsiniz, seçmeniz gerekiyor. Bu sağlayıcıdan sağlayıcıya seçmeniz gereken strateji değişebilir.

acura · January 12, 2025, 6:04am

Burada yasagidim sorunu cozdugunuz icin ayrica rehber icin de cok tesekkur ederim. Ancak bir sorum var, zapret sadece tarayicida mi calisiyor yoksa masaustu uygulamalari icin de calisiyor mu? Discord’a webden girmek zorunda miyim acaba?

f0q · January 12, 2025, 6:55am

Bu rehberdeki amacimiz sistem geneli etkinlestirmek, yani hem tarayici hemde sistem uygulamalarinizda calisiyor olmalidir.

acura · January 12, 2025, 6:56am

ne yazik ki sistem uygulamalari calismiyor yardimci olma sansiniz var mi? atmam gerken dosya icerikleri veya loglar?

f0q · January 12, 2025, 6:58am

Eğerki hata almiyorsaniz, farkli stratejiler deneyin, hata aldiginizi dusunuyorsaniz veya hata aldiginiz konusunda eminseniz log atabilirsiniz.

acura · January 12, 2025, 6:59am

discordun uygulamasi internete baglanmiyor. VPN kullandigim zaman acabiliyorum ancak zapret ile sadece tarayicidan erisimim oluyor. Strateji degistirip deneyecegim, tesekkurler

yukarida stratejilerin outputunu atmistim, bazilari direkt calismiyor. Hangilerini kullanmami onerirsiniz?

f0q · January 12, 2025, 7:06am

nfqws --dpi-desync=fake --dpi-desync-ttl=3

Belki bu yardimci olur, nasil kullanacaginizi biliyorsunuzdur. Rehberde mevcut, egerki olmazsa siz kendiniz random bir strateji secin veya sirasiyla vaktiniz var ise bir kismini deneyin.

murat1534 · January 12, 2025, 4:41pm

Bunu kurunca ne Yapıkredi banka uygulamasına erişebiliyorum ne de sitesine. Var mıdır bir çözümü ?

Bugavus · January 13, 2025, 6:17am

Bazı sitelere ben de giremiyorum Zapret açık iken. O sitelere gireceğimde systemctl stop zapret yapıyorum.

f0q · January 13, 2025, 7:05am

sanirim blacklist ve whitelist var ama nasil calistiklarini bilmiyorum, bilen var ise yazabilir ogrenmek icin vaktim olunca yazacagim

murat1534 · January 13, 2025, 7:37am

Openwrt’de zapret üzerinde onları denedim ama ne hostname ne de ip’ler çalışmadı. Aksine blacklist yada whitelist düzenleyince zapret çalışmayı durduruyor garip bi şekilde.

f0q · January 13, 2025, 7:57am

bu gun doluyum aksam bakabilirim biraz arastirip kullanimi hakkinda bilgi edinmem gerekiyor

Maedre · January 13, 2025, 5:46pm

ben kurarken /opt dizinine taşıdığım için uyarı vermişti zaten bu dizin dolu filan diye. İsterseniz Downloads dizininde kurulumu başlatabilirsiniz kendisi /opt’e dizine taşıyor.

Teşekkürler ayrıntılı yazınız için

f0q · January 15, 2025, 4:27pm

Tesekkurler bilgi icin. Rica ederim.

Buyuk-Gondor-un-Kral · January 16, 2025, 7:31pm

Hocam zapret modeme kurdum ve şuanda e-devlet anadolu üniversitesi gibi sitelerde girmekte sıkıntı yaşıyorum bunun sebebi nedir?

Maedre · January 16, 2025, 8:01pm

config dosyasında ki sanırım ayarlardan dolayı oldu bende ilk yaptığımda bazı sitelere girememiştim. Blocklist scriptinden verdiği şeylerin hepini eklemedim bir deneme yanılma yolu ile her yere girdiğimi seçtim.

sudo vim /opt/zapret/config

sudo vim /opt/zapret/config
TPWS_OPT="
--tlsrec=midsld
--tlsrec=midsld --oob
--tlsrec=midsld --disorder
"