Skip to content

net/shadowsocks: add explicit outbound blocklist #5541

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MrClayPole wants to merge 2 commits into
base: master
Choose a base branch
from
Open

net/shadowsocks: add explicit outbound blocklist #5541

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
182bb2e
net/shadowsocks: add explicit outbound blocklist
MrClayPole Jul 8, 2026
b27196d
net/shadowsocks: keep blocklist inputs as text fields
MrClayPole Jul 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion net/shadowsocks/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
PLUGIN_NAME= shadowsocks
PLUGIN_VERSION= 1.3
PLUGIN_VERSION= 1.4
PLUGIN_COMMENT= Secure socks5 proxy
PLUGIN_DEPENDS= shadowsocks-rust
PLUGIN_MAINTAINER= m.muenz@gmail.com
Expand Down
19 changes: 19 additions & 0 deletions net/shadowsocks/src/opnsense/mvc/app/controllers/OPNsense/Shadowsocks/forms/general.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,4 +54,23 @@
<type>checkbox</type>
<help>Allow IP fragmentation on the outbound UDP socket.</help>
</field>

<field>
<id>general.outbound_blocklist_enabled</id>
<label>Enable outbound destination blocklist</label>
<type>checkbox</type>
<help>Generate a Shadowsocks server ACL using [outbound_block_list]. This blocks destinations after sslocal has proxied traffic into this server. Add only the destinations you want to block below.</help>
</field>
<field>
<id>general.outbound_blocklist_ipv4</id>
<label>Blocked IPv4 destinations</label>
<type>text</type>
<help>Comma separated IPv4 addresses or CIDR networks to block, for example 172.28.0.0/16,10.1.0.0/16,10.152.183.0/24.</help>
</field>
<field>
<id>general.outbound_blocklist_ipv6</id>
<label>Blocked IPv6 destinations</label>
<type>text</type>
<help>Comma separated IPv6 addresses or CIDR networks to block, for example fd01::/108,fd98::/108,2a02:8010:6538::/48.</help>
</field>
</form>
16 changes: 15 additions & 1 deletion net/shadowsocks/src/opnsense/mvc/app/models/OPNsense/Shadowsocks/General.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<model>
<mount>//OPNsense/shadowsocks/general</mount>
<description>Shadowsocks configuration</description>
<version>1.0.2</version>
<version>1.0.3</version>
<items>
<enabled type="BooleanField">
<Default>0</Default>
Expand Down Expand Up @@ -71,5 +71,19 @@
<Default>0</Default>
<Required>Y</Required>
</fragmentation>
<outbound_blocklist_enabled type="BooleanField">
<Default>0</Default>
<Required>Y</Required>
</outbound_blocklist_enabled>
<outbound_blocklist_ipv4 type="TextField">
<Required>N</Required>
<Mask>/^([0-9\.\/ ]*?,)*([0-9\.\/ ]*)$/</Mask>
<ValidationMessage>Please provide a comma separated list of IPv4 addresses or CIDR networks.</ValidationMessage>
</outbound_blocklist_ipv4>
<outbound_blocklist_ipv6 type="TextField">
<Required>N</Required>
<Mask>/^([a-fA-F0-9\.:\[\]\/ ]*?,)*([a-fA-F0-9\.:\[\]\/ ]*)$/</Mask>
<ValidationMessage>Please provide a comma separated list of IPv6 addresses or CIDR networks.</ValidationMessage>
</outbound_blocklist_ipv6>
</items>
</model>
1 change: 1 addition & 0 deletions net/shadowsocks/src/opnsense/service/templates/OPNsense/Shadowsocks/+TARGETS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,3 +2,4 @@ ssserver:/etc/rc.conf.d/ssserver_rust
config.json:/usr/local/etc/shadowsocks-rust/config.json
sslocal:/etc/rc.conf.d/sslocal_rust
local.json:/usr/local/etc/shadowsocks-rust/local.json
server.acl:/usr/local/etc/shadowsocks-rust/server.acl
3 changes: 2 additions & 1 deletion net/shadowsocks/src/opnsense/service/templates/OPNsense/Shadowsocks/config.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@
"timeout":{{ OPNsense.shadowsocks.general.timeout }},
"mode":"{{ OPNsense.shadowsocks.general.tcpudpmode }}",
"method":"{{ OPNsense.shadowsocks.general.cipher }}",
"outbound_udp_allow_fragmentation":{{ "true" if OPNsense.shadowsocks.general.fragmentation == '1' else "false"}}
"outbound_udp_allow_fragmentation":{{ "true" if OPNsense.shadowsocks.general.fragmentation == '1' else "false"}}{% if helpers.exists('OPNsense.shadowsocks.general.outbound_blocklist_enabled') and OPNsense.shadowsocks.general.outbound_blocklist_enabled == '1' %},
"acl":"/usr/local/etc/shadowsocks-rust/server.acl"{% endif %}
}
{% endif %}
31 changes: 31 additions & 0 deletions net/shadowsocks/src/opnsense/service/templates/OPNsense/Shadowsocks/server.acl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
{% if helpers.exists('OPNsense.shadowsocks.general.enabled') and OPNsense.shadowsocks.general.enabled == '1' and helpers.exists('OPNsense.shadowsocks.general.outbound_blocklist_enabled') and OPNsense.shadowsocks.general.outbound_blocklist_enabled == '1' %}
# Generated by OPNsense os-shadowsocks.
# Applies to ssserver only. sslocal ACLs route/proxy/bypass; they do not block.
# Only user-specified destinations are emitted here; no default private/reserved ranges.

[accept_all]

[outbound_allow_all]

[outbound_block_list]
{% if helpers.exists('OPNsense.shadowsocks.general.outbound_blocklist_ipv4') and OPNsense.shadowsocks.general.outbound_blocklist_ipv4 != '' %}

# User IPv4 blocklist
{% for item in OPNsense.shadowsocks.general.outbound_blocklist_ipv4.split(',') %}
{% set entry = item.strip() %}
{% if entry != '' %}
{{ entry }}
{% endif %}
{% endfor %}
{% endif %}
{% if helpers.exists('OPNsense.shadowsocks.general.outbound_blocklist_ipv6') and OPNsense.shadowsocks.general.outbound_blocklist_ipv6 != '' %}

# User IPv6 blocklist
{% for item in OPNsense.shadowsocks.general.outbound_blocklist_ipv6.split(',') %}
{% set entry = item.strip() %}
{% if entry != '' %}
{{ entry }}
{% endif %}
{% endfor %}
{% endif %}
{% endif %}