1
#!/bin/bash
2
# ============================================================================
3
# 部署防火墙规则，本脚本只需执行一次
4
#
5
# 修改配置后重新执行即可，脚本会自动覆盖旧规则
6
# ============================================================================
7

8
# ===================== 用户配置区 =====================
9

10
SSH_PORT=43210
11

12
# BT 监听端口（TCP 与 UDP 通常相同）
13
BT_TCP_PORT=54321
14
BT_UDP_PORT=54321
15

16
# Web 端口（80 用于 HTTP，443 用于 HTTPS）
17
# 如需放行其他端口请在此添加
18
WEB_PORTS=(80 443)
19

20
# 是否启用 IPv6（1=启用，0=禁用）
21
ENABLE_IPV6=1
22

23
# 邻居网段全局阻断（设为 "-" 表示不启用）
24
# 示例: NEIGHBOR_V4="10.0.0.0/8"
25
NEIGHBOR_V4="-"
26
NEIGHBOR_V6="-"
27

28

29
export PATH="/usr/sbin:/sbin:$PATH"
30

31
# ===================== 日志与颜色 =====================
32

33
RED='\033[1;31m'
34
GREEN='\033[1;32m'
35
YELLOW='\033[1;33m'
36
BLUE='\033[1;34m'
37
CYAN='\033[1;36m'
38
NC='\033[0m'
39

40
log()  { echo -e "${BLUE}[INFO]${NC}  $1"; }
41
ok()   { echo -e "${GREEN}[OK]${NC}    $1"; }
42
warn() { echo -e "${YELLOW}[WARN]${NC}  $1"; }
43
err()  { echo -e "${RED}[ERR]${NC}   $1"; }
44
die()  { err "$1"; exit 1; }
45

46
# 检查 IPv6
47
check_v6() {
48
    if [ "$ENABLE_IPV6" != "1" ]; then echo 0; return; fi
49
    if [ -f /proc/net/if_inet6 ] && [ "$(wc -l < /proc/net/if_inet6)" -gt 0 ]; then
50
        command -v ip6tables &>/dev/null && echo 1 || echo 0
51
    else
52
        echo 0
53
    fi
54
}
55

56
# 依赖检查
57
check_deps() {
58
    local missing=()
59
    for cmd in ipset iptables; do
60
        command -v "$cmd" &>/dev/null || missing+=("$cmd")
61
    done
62
    if [ "${#missing[@]}" -gt 0 ]; then
63
        err "Missing dependencies: ${missing[*]}"
64
        err "Run: apt install -y ipset iptables"
65
        exit 1
66
    fi
67
    ok "Dependencies satisfied"
68

69
    if [ "$HAS_V6" = "1" ] && ! command -v ip6tables &>/dev/null; then
70
        warn "ip6tables not found, disabling IPv6"
71
        HAS_V6=0
72
    fi
73
}
74

75
# 安装 iptables-persistent 与 ipset-persistent
76
install_persistent() {
77
    if dpkg -l iptables-persistent 2>/dev/null | grep -q '^ii' && dpkg -l ipset-persistent 2>/dev/null | grep -q '^ii'; then
78
        return 0
79
    fi
80
    log "Installing iptables-persistent & ipset-persistent..."
81
    echo iptables-persistent iptables-persistent/autosave_v4 boolean true \
82
        | debconf-set-selections 2>/dev/null
83
    echo iptables-persistent iptables-persistent/autosave_v6 boolean true \
84
        | debconf-set-selections 2>/dev/null
85
    DEBIAN_FRONTEND=noninteractive apt-get install -y iptables-persistent ipset-persistent &>/dev/null \
86
        || warn "Could not install persistent packages, will fallback to manual save"
87
}
88

89
# 创建 ipset 集合
90
create_ipsets() {
91
    ipset create bad_asn_v4 hash:net family inet \
92
        hashsize 4096 maxelem 500000 -exist 2>/dev/null
93
    ipset create bad_p2p_v4 hash:net family inet \
94
        hashsize 65536 maxelem 1000000 -exist 2>/dev/null
95
    if [ "$HAS_V6" = "1" ]; then
96
        ipset create bad_asn_v6 hash:net family inet6 \
97
            hashsize 4096 maxelem 500000 -exist 2>/dev/null
98
    fi
99
    ok "ipset collections created"
100
}
101

102
# 部署 iptables 规则
103
deploy_v4() {
104
    iptables -P INPUT DROP
105
    iptables -P FORWARD DROP
106
    iptables -P OUTPUT ACCEPT
107

108
    iptables -F
109
    iptables -X
110

111
    # 基础放行
112
    iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
113
    iptables -A INPUT -i lo -j ACCEPT
114

115
    # 全局阻断：邻居网段
116
    if [ "$NEIGHBOR_V4" != "-" ]; then
117
        iptables -A INPUT -s "$NEIGHBOR_V4" -j DROP
118
        ok "Neighbor v4 blocked globally: $NEIGHBOR_V4"
119
    fi
120

121
    # 全局阻断：ASN & P2P 黑名单
122
    iptables -A INPUT -m set --match-set bad_asn_v4 src -j DROP
123
    iptables -A INPUT -m set --match-set bad_p2p_v4 src -j DROP
124
    ok "Global blacklist: DROP(ASN) -> DROP(P2P)"
125

126
    # SSH
127
    iptables -A INPUT -p tcp --dport "$SSH_PORT" -j ACCEPT
128
    ok "Allow TCP port $SSH_PORT (SSH)"
129

130
    # Web (80, 443)
131
    for port in "${WEB_PORTS[@]}"; do
132
        iptables -A INPUT -p tcp --dport "$port" -j ACCEPT
133
        ok "Allow TCP port $port (Web)"
134
    done
135

136
    # BT
137
    iptables -A INPUT -p tcp --dport "$BT_TCP_PORT" -j ACCEPT
138
    ok "Allow TCP port $BT_TCP_PORT (BT)"
139
    iptables -A INPUT -p udp --dport "$BT_UDP_PORT" -j ACCEPT
140
    ok "Allow UDP port $BT_UDP_PORT (BT DHT)"
141
}
142

143
# 部署 ip6tables 规则
144
deploy_v6() {
145
    ip6tables -P INPUT DROP
146
    ip6tables -P FORWARD DROP
147
    ip6tables -P OUTPUT ACCEPT
148

149
    ip6tables -F
150
    ip6tables -X
151

152
    ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
153
    ip6tables -A INPUT -i lo -j ACCEPT
154

155
    # 全局阻断：邻居网段
156
    if [ "$NEIGHBOR_V6" != "-" ]; then
157
        ip6tables -A INPUT -s "$NEIGHBOR_V6" -j DROP
158
        ok "Neighbor v6 blocked globally: $NEIGHBOR_V6"
159
    fi
160

161
    # 全局阻断：ASN 黑名单
162
    ip6tables -A INPUT -m set --match-set bad_asn_v6 src -j DROP
163
    ok "Global blacklist: DROP(ASN)"
164

165
    # SSH
166
    ip6tables -A INPUT -p tcp --dport "$SSH_PORT" -j ACCEPT
167

168
    # Web (80, 443)
169
    for port in "${WEB_PORTS[@]}"; do
170
        ip6tables -A INPUT -p tcp --dport "$port" -j ACCEPT
171
    done
172

173
    # BT
174
    ip6tables -A INPUT -p tcp --dport "$BT_TCP_PORT" -j ACCEPT
175
    ip6tables -A INPUT -p udp --dport "$BT_UDP_PORT" -j ACCEPT
176
}
177

178
# 持久化
179
persist() {
180
    if command -v netfilter-persistent &>/dev/null; then
181
        netfilter-persistent save 2>/dev/null
182
        ok "Rules saved via netfilter-persistent"
183
    else
184
        mkdir -p /etc/iptables
185
        ipset save > /etc/iptables/ipsets 2>/dev/null
186
        iptables-save > /etc/iptables/rules.v4
187
        [ "$HAS_V6" = "1" ] && ip6tables-save > /etc/iptables/rules.v6
188
        ok "Rules saved to /etc/iptables/"
189
        warn "Consider installing iptables-persistent for automatic restore on boot"
190
    fi
191
}
192

193
# 打印当前规则
194
print_rules() {
195
    echo ""
196
    echo -e "${CYAN}=== IPv4 INPUT Rules ===${NC}"
197
    iptables -L INPUT -v -n --line-numbers 2>/dev/null | head -20
198
    if [ "$HAS_V6" = "1" ]; then
199
        echo ""
200
        echo -e "${CYAN}=== IPv6 INPUT Rules ===${NC}"
201
        ip6tables -L INPUT -v -n --line-numbers 2>/dev/null | head -15
202
    fi
203
}
204

205
# 主流程
206
main() {
207
    if [ "$(id -u)" != "0" ]; then
208
        die "This script must be run as root"
209
    fi
210

211
    echo ""
212
    echo -e "${CYAN}========================================${NC}"
213
    echo -e "${GREEN}  Firewall Deployment (One-Time Setup)${NC}"
214
    echo -e "${CYAN}========================================${NC}"
215
    echo ""
216

217
    HAS_V6=$(check_v6)
218
    [ "$HAS_V6" = "1" ] && ok "IPv6 enabled" || warn "IPv6 disabled"
219

220
    check_deps
221
    create_ipsets
222

223
    echo ""
224
    log "Deploying IPv4 rules..."
225
    deploy_v4
226

227
    if [ "$HAS_V6" = "1" ]; then
228
        echo ""
229
        log "Deploying IPv6 rules..."
230
        deploy_v6
231
    fi
232

233
    echo ""
234
    log "Persisting rules..."
235
    install_persistent
236
    persist
237

238
    print_rules
239

240
    echo ""
241
    echo -e "${GREEN}Firewall deployed.${NC}"
242
    echo -e "${YELLOW}Next: run update_blacklists.sh to load ASN/P2P blacklists.${NC}"
243
    echo ""
244
}
245

246
main "$@"

1
#!/bin/bash
2
# ============================================================================
3
# 更新 ASN & P2P 黑名单
4
# ============================================================================
5

6
# 需要屏蔽的 ASN
7
ASNS=(
8
    "14061|DigitalOcean"
9
    "16509|AWS"
10
    "15169|Google_Cloud"
11
    "8075|Azure"
12
    "20473|Vultr"
13
    "31898|Oracle"
14
)
15

16
# P2P 黑名单数据源
17
declare -A P2P_SOURCES=(
18
    ["Naunter_Mega"]="https://raw.githubusercontent.com/Naunter/BT_BlockLists/master/bt_blocklists.gz"
19
    ["mxdpeep_Comprehensive"]="https://raw.githubusercontent.com/mxdpeep/p2p-blocklist-creator/master/blocklist.p2p"
20
    ["eMule_Security"]="http://upd.emule-security.org/ipfilter.zip"
21
)
22

23
# 缓存目录
24
CACHE_DIR="/var/lib/seedbox-firewall"
25

26

27
export PATH="/usr/sbin:/sbin:$PATH"
28
set -o pipefail
29

30
# ===================== 日志与颜色 =====================
31

32
RED='\033[1;31m'
33
GREEN='\033[1;32m'
34
YELLOW='\033[1;33m'
35
BLUE='\033[1;34m'
36
CYAN='\033[1;36m'
37
NC='\033[0m'
38

39
log()  { echo -e "${BLUE}[INFO]${NC}  $1"; }
40
ok()   { echo -e "${GREEN}[OK]${NC}    $1"; }
41
warn() { echo -e "${YELLOW}[WARN]${NC}  $1"; }
42
err()  { echo -e "${RED}[ERR]${NC}   $1"; }
43
die()  { err "$1"; exit 1; }
44
ln()   { echo "------------------------------"; }
45
fmt()  { printf "%'d" "$1"; }
46

47
# 检查 IPv6
48
check_v6() {
49
    if [ -f /proc/net/if_inet6 ] && [ "$(wc -l < /proc/net/if_inet6)" -gt 0 ]; then
50
        command -v ip6tables &>/dev/null && echo 1 || echo 0
51
    else
52
        echo 0
53
    fi
54
}
55

56
# 依赖检查
57
check_deps() {
58
    local missing=()
59
    for cmd in curl gunzip unzip awk python3 ipset whois md5sum sha256sum; do
60
        command -v "$cmd" &>/dev/null || missing+=("$cmd")
61
    done
62
    if [ "${#missing[@]}" -gt 0 ]; then
63
        die "Missing: ${missing[*]}. Run: apt install -y curl gzip unzip gawk python3 ipset iproute2 whois"
64
    fi
65

66
    # 检查 ipsets 是否存在
67
    if ! ipset list bad_asn_v4 &>/dev/null || ! ipset list bad_p2p_v4 &>/dev/null; then
68
        die "ipsets not found. Run deploy_firewall.sh first."
69
    fi
70
}
71

72
# ===================== 缓存函数 =====================
73

74
init_cache() {
75
    mkdir -p "$CACHE_DIR" 2>/dev/null || { die "Cannot create $CACHE_DIR"; }
76
}
77

78
get_cached_hash() {
79
    local name="$1"
80
    local hashfile="${CACHE_DIR}/${name}.sha256"
81
    [ -f "$hashfile" ] && cat "$hashfile" || echo ""
82
}
83

84
set_cached_hash() {
85
    local name="$1" hash="$2"
86
    echo "$hash" > "${CACHE_DIR}/${name}.sha256"
87
}
88

89
is_changed() {
90
    local name="$1" cidr_file="$2"
91
    if [ ! -s "$cidr_file" ]; then
92
        return 0  # 空文件视为有变化（或错误）
93
    fi
94
    local new_hash=$(sha256sum "$cidr_file" | awk '{print $1}')
95
    local old_hash=$(get_cached_hash "$name")
96
    if [ "$new_hash" = "$old_hash" ] && [ -n "$old_hash" ]; then
97
        return 1  # 未变化
98
    fi
99
    return 0  # 有变化
100
}
101

102
update_cache() {
103
    local name="$1" cidr_file="$2"
104
    local new_hash=$(sha256sum "$cidr_file" | awk '{print $1}')
105
    set_cached_hash "$name" "$new_hash"
106
}
107

108
# ===================== ASN 更新 =====================
109

110
update_asn() {
111
    log "Fetching ASN routes from RADb..."
112

113
    local work="/tmp/asn-update-$$"
114
    mkdir -p "$work"
115
    local v4_cidr="${CACHE_DIR}/asn_v4.cidr"
116
    local v6_cidr="${CACHE_DIR}/asn_v6.cidr"
117
    local v4_tmp="${work}/asn_v4.cidr"
118
    local v6_tmp="${work}/asn_v6.cidr"
119

120
    true > "$v4_tmp"
121
    [ "$HAS_V6" = "1" ] && true > "$v6_tmp"
122

123
    local v4_total=0 v6_total=0
124

125
    for ITEM in "${ASNS[@]}"; do
126
        ASN="${ITEM%%|*}"
127
        NAME="${ITEM##*|}"
128

129
        local whois_out="${work}/whois_${ASN}.txt"
130
        if ! timeout 20 whois -h whois.radb.net -- "-i origin AS${ASN}" > "$whois_out" 2>/dev/null; then
131
            warn "AS${ASN} ${NAME}: whois timeout or failed"
132
            rm -f "$whois_out"
133
            continue
134
        fi
135

136
        # 提取 v4 路由
137
        local v4_count=$(awk '/^route:/ {print $2}' "$whois_out" | grep -v '^$' | tee -a "$v4_tmp" | wc -l)
138
        v4_total=$((v4_total + v4_count))
139

140
        if [ "$HAS_V6" = "1" ]; then
141
            local v6_count=$(awk '/^route6:/ {print $2}' "$whois_out" | grep -v '^$' | tee -a "$v6_tmp" | wc -l)
142
            v6_total=$((v6_total + v6_count))
143
        fi
144

145
        log "  AS${ASN} ${NAME}: v4=${v4_count} v6=${HAS_V6:+"$v6_count"}"
146
        rm -f "$whois_out"
147
    done
148

149
    # 更新 v4
150
    local v4_updated=0
151
    if [ "$v4_total" -lt 50 ]; then
152
        warn "ASN v4 too few entries ($v4_total), keeping existing set"
153
    elif is_changed "asn_v4" "$v4_tmp"; then
154
        log "ASN v4 changed, swapping ipset..."
155
        local new_set="bad_asn_v4_new"
156
        ipset create "$new_set" hash:net family inet hashsize 4096 maxelem 500000 -exist 2>/dev/null
157
        {
158
            echo "create $new_set hash:net family inet hashsize 4096 maxelem 500000 -exist"
159
            awk '{print "add '"$new_set"' " $0}' "$v4_tmp"
160
        } | ipset restore -exist 2>/dev/null
161
        ipset swap "$new_set" bad_asn_v4
162
        ipset destroy "$new_set" 2>/dev/null
163
        cp "$v4_tmp" "$v4_cidr"
164
        update_cache "asn_v4" "$v4_tmp"
165
        v4_updated=1
166
        ok "ASN v4 updated: $(fmt $(wc -l < "$v4_cidr")) entries"
167
    else
168
        ok "ASN v4 unchanged ($(fmt $v4_total) entries), skipped"
169
    fi
170

171
    # 更新 v6
172
    if [ "$HAS_V6" = "1" ]; then
173
        if [ "$v6_total" -lt 50 ]; then
174
            warn "ASN v6 too few entries ($v6_total), keeping existing set"
175
        elif is_changed "asn_v6" "$v6_tmp"; then
176
            log "ASN v6 changed, swapping ipset..."
177
            local new_set="bad_asn_v6_new"
178
            ipset create "$new_set" hash:net family inet6 hashsize 4096 maxelem 500000 -exist 2>/dev/null
179
            {
180
                echo "create $new_set hash:net family inet6 hashsize 4096 maxelem 500000 -exist"
181
                awk '{print "add '"$new_set"' " $0}' "$v6_tmp"
182
            } | ipset restore -exist 2>/dev/null
183
            ipset swap "$new_set" bad_asn_v6
184
            ipset destroy "$new_set" 2>/dev/null
185
            cp "$v6_tmp" "$v6_cidr"
186
            update_cache "asn_v6" "$v6_tmp"
187
            ok "ASN v6 updated: $(fmt $(wc -l < "$v6_cidr")) entries"
188
        else
189
            ok "ASN v6 unchanged ($(fmt $v6_total) entries), skipped"
190
        fi
191
    fi
192

193
    rm -rf "$work"
194
}
195

196
# ===================== P2P 更新 =====================
197

198
download_p2p_source() {
199
    local name="$1" url="$2" out="$3"
200
    printf "  %-25s " "${name}..."
201

202
    if ! curl -sL --connect-timeout 15 --max-time 120 --retry 3 --retry-delay 2 \
203
        "$url" -o "$out"; then
204
        echo -e "${RED}FAIL${NC}"
205
        return 1
206
    fi
207

208
    # Auto-detect compression and decompress
209
    if command -v file &>/dev/null; then
210
        if file "$out" | grep -q "gzip compressed"; then
211
            mv "$out" "${out}.gz"
212
            gunzip -c "${out}.gz" > "$out" 2>/dev/null
213
            rm -f "${out}.gz"
214
        elif file "$out" | grep -q "Zip archive"; then
215
            mv "$out" "${out}.zip"
216
            unzip -p "${out}.zip" > "$out" 2>/dev/null
217
            rm -f "${out}.zip"
218
        fi
219
    fi
220

221
    if [ -s "$out" ]; then
222
        echo -e "${GREEN}OK${NC} ($(fmt $(wc -l < "$out")) lines)"
223
        return 0
224
    fi
225

226
    echo -e "${RED}FAIL${NC}"
227
    return 1
228
}
229

230
update_p2p() {
231
    log "Fetching P2P blocklists..."
232

233
    local work="/tmp/p2p-update-$$"
234
    mkdir -p "$work/cache"
235
    local raw="${work}/raw.tmp"
236
    local cidr_out="${CACHE_DIR}/p2p_v4.cidr"
237
    local cidr_tmp="${work}/p2p_v4.cidr"
238

239
    > "$raw"
240

241
    local ok_count=0 fail_count=0
242
    for name in "${!P2P_SOURCES[@]}"; do
243
        local url="${P2P_SOURCES[$name]}"
244
        local cache_file="${work}/cache/$(echo "$url" | md5sum | cut -d' ' -f1).dat"
245
        if download_p2p_source "$name" "$url" "$cache_file"; then
246
            cat "$cache_file" >> "$raw"
247
            ((ok_count++))
248
        else
249
            ((fail_count++))
250
        fi
251
    done
252

253
    if [ "$ok_count" -eq 0 ]; then
254
        err "All P2P sources failed, keeping existing ipset"
255
        rm -rf "$work"
256
        return 1
257
    fi
258

259
    log "P2P raw lines: $(fmt $(wc -l < "$raw")) | ${ok_count} OK, ${fail_count} failed"
260

261
    # 解析 IP 范围（支持 range 和 CIDR 格式）
262
    local processed="${work}/processed.tmp"
263
    awk '
264
    function ip2dec(ip) {
265
        split(ip, a, ".")
266
        return (a[1]*16777216) + (a[2]*65536) + (a[3]*256) + a[4]
267
    }
268
    {
269
        content = $0
270
        if ($0 ~ /^[A-Za-z0-9_]+:/) {
271
            split($0, p, ":")
272
            content = p[2]
273
        }
274
        # IP-range: 1.2.3.4-5.6.7.8
275
        if (match(content, /[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+-[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+/)) {
276
            split(substr(content, RSTART, RLENGTH), ips, "-")
277
            s = ip2dec(ips[1]); e = ip2dec(ips[2])
278
            if (s <= e) print s "," e
279
        }
280
        # CIDR: 1.2.3.0/24
281
        else if (match(content, /[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\/[0-9]+/)) {
282
            split(substr(content, RSTART, RLENGTH), parts, "/")
283
            s = ip2dec(parts[1])
284
            e = s + (2 ^ (32 - parts[2])) - 1
285
            print s "," e
286
        }
287
    }' "$raw" | sort -t',' -k1,1n > "$processed"
288

289
    local range_count=$(wc -l < "$processed")
290

291
    # 合并连续范围，转换为 CIDR
292
    awk -F',' '
293
    function dec2ip(d) {
294
        return sprintf("%d.%d.%d.%d",
295
            int(d/16777216)%256, int(d/65536)%256, int(d/256)%256, d%256)
296
    }
297
    NR==1 { s=$1; e=$2; next }
298
    $1<=e+1 { if($2>e) e=$2; next }
299
    { printf "%s %s\n", dec2ip(s), dec2ip(e); s=$1; e=$2 }
300
    END { if(NR>0) printf "%s %s\n", dec2ip(s), dec2ip(e) }
301
    ' "$processed" | sort -u | python3 -c "
302
import sys, ipaddress
303
for line in sys.stdin:
304
    start, end = line.strip().split()
305
    for net in ipaddress.summarize_address_range(
306
        ipaddress.IPv4Address(start), ipaddress.IPv4Address(end)
307
    ):
308
        print(net)
309
" > "$cidr_tmp"
310

311
    local final_count=$(wc -l < "$cidr_tmp")
312
    local savings=$((range_count - final_count))
313
    local pct=$((range_count > 0 ? (savings * 100 / range_count) : 0))
314
    log "P2P merged: $(fmt $final_count) CIDR entries (${pct}% reduction)"
315

316
    # 缓存检查 + 原子更新
317
    if is_changed "p2p_v4" "$cidr_tmp"; then
318
        log "P2P data changed, swapping ipset..."
319
        local new_set="bad_p2p_v4_new"
320
        ipset create "$new_set" hash:net family inet hashsize 65536 maxelem 1000000 -exist 2>/dev/null
321
        {
322
            echo "create $new_set hash:net family inet hashsize 65536 maxelem 1000000 -exist"
323
            awk '{print "add '"$new_set"' " $0}' "$cidr_tmp"
324
        } | ipset restore -exist 2>/dev/null
325
        ipset swap "$new_set" bad_p2p_v4
326
        ipset destroy "$new_set" 2>/dev/null
327
        cp "$cidr_tmp" "$cidr_out"
328
        update_cache "p2p_v4" "$cidr_tmp"
329
        ok "P2P v4 updated: $(fmt $final_count) entries"
330
    else
331
        ok "P2P v4 unchanged ($(fmt $final_count) entries), skipped"
332
    fi
333

334
    rm -rf "$work"
335
}
336

337
# ===================== 打印统计 =====================
338

339
print_summary() {
340
    echo ""
341
    ln
342
    local asn_v4=$(ipset list bad_asn_v4 2>/dev/null | grep "Number of entries" | awk '{print $NF}')
343
    local p2p_v4=$(ipset list bad_p2p_v4 2>/dev/null | grep "Number of entries" | awk '{print $NF}')
344
    echo "  ASN v4:  ${asn_v4:-0} entries"
345
    echo "  P2P v4:  ${p2p_v4:-0} entries"
346
    if [ "$HAS_V6" = "1" ]; then
347
        local asn_v6=$(ipset list bad_asn_v6 2>/dev/null | grep "Number of entries" | awk '{print $NF}')
348
        echo "  ASN v6:  ${asn_v6:-0} entries"
349
    fi
350
    ln
351
}
352

353
# ===================== 主流程 =====================
354

355
main() {
356
    if [ "$(id -u)" != "0" ]; then
357
        die "This script must be run as root"
358
    fi
359

360
    echo ""
361
    echo -e "${CYAN}========================================${NC}"
362
    echo -e "${GREEN}  Blacklist Update${NC}"
363
    echo -e "${CYAN}========================================${NC}"
364
    echo ""
365

366
    HAS_V6=$(check_v6)
367
    [ "$HAS_V6" = "1" ] && ok "IPv6 enabled" || warn "IPv6 disabled"
368

369
    check_deps
370
    init_cache
371

372
    echo ""
373
    log "Updating ASN blacklists..."
374
    update_asn
375

376
    echo ""
377
    log "Updating P2P blacklists..."
378
    update_p2p
379

380
    print_summary
381

382
    echo -e "${GREEN}Blacklist update complete.${NC}"
383
    echo ""
384
}
385

386
main "$@"