### Initial Setup and Configuration

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/00-СОДЕРЖАНИЕ.md

Steps for the first-time installation of nfqws2-keenetic, including package installation, configuration check, adding domains, and starting the service.

```bash
# 1. Установить пакет
opkg install nfqws2-keenetic

# 2. Проверить конфигурацию (интерфейс должен быть определен автоматически)
cat /opt/etc/nfqws2/nfqws2.conf | grep ISP_INTERFACE

# 3. Добавить домены
vi /opt/etc/nfqws2/lists/user.list

# 4. Запустить сервис
/opt/etc/init.d/S51nfqws2 start
```

--------------------------------

### Nfqws2 Service Start Lifecycle

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/08-архитектура.md

Outlines the steps involved in starting the Nfqws2 service, including configuration validation, kernel module loading, process execution, and firewall rule setup. The service then runs in the background, processing packets from NFQUEUE.

```text
1. start
   ├─ is_running() → проверка не запущен ли уже
   ├─ validate_config() → проверка конфига
   ├─ create_running_config() → создание runtime конфига
   ├─ kernel_modules() → загрузка модулей
   ├─ nfqws2 --daemon --pidfile... → запуск процесса
   ├─ firewall_iptables() → добавление IPv4 правил
   ├─ firewall_ip6tables() → добавление IPv6 правил
   └─ system_config() → настройка sysctl параметров

2. Процесс nfqws2 работает в фоне
   ├─ Получает пакеты из NFQUEUE
   ├─ Анализирует полезную нагрузку
   ├─ Применяет стратегии
   └─ Отправляет результат обратно
```

--------------------------------

### Extended Management Script Example

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/03-интерфейс-управления.md

A bash script to check and restart the nfqws2 service if necessary. It validates the configuration and starts the service if it's not running.

```bash
#!/bin/bash
# Скрипт проверки и перезагрузки при необходимости

CONFFILE="/opt/etc/nfqws2/nfqws2.conf"
INIT_SCRIPT="/opt/etc/init.d/S51nfqws2"

source "$CONFFILE"

# Проверить конфиг
if ! $INIT_SCRIPT validate_config; then
  echo "Ошибка конфигурации!"
  exit 1
fi

# Проверить статус
$INIT_SCRIPT status

# Если не запущен, запустить
if ! $INIT_SCRIPT is_running; then
  echo "Запуск сервиса..."
  $INIT_SCRIPT start
fi

echo "Сервис готов к работе"
```

--------------------------------

### nfqws2-keenetic Configuration File Example

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/README.md

This is an example configuration file for nfqws2-keenetic, detailing various parameters for network interfaces, traffic processing strategies, IP lists, and logging.

```bash
# Интерфейс провайдера. Обычно `eth3` или `eth2.2` для проводного соединения, и `ppp0` для PPPoE
# Заполняется автоматически при установке
# Можно ввести несколько интерфейсов, например ISP_INTERFACE="eth3 nwg1"
# Для поиска интерфейса можно воспользоваться командами `route` или `ifconfig`
ISP_INTERFACE="..."

# Аргументы запуска nfqws2, сюда добавляйте ваши lua скрипты
NFQWS_BASE_ARGS="..."

# Стратегии обработки HTTPS и QUIC трафика
NFQWS_ARGS="..."
NFQWS_ARGS_QUIC="..."

# Стратегия обработки UDP трафика (не использует параметры из NFQWS_EXTRA_ARGS)
NFQWS_ARGS_UDP="..."

# Режим работы (auto, list, all)
NFQWS_EXTRA_ARGS="..."

# IP-списки
NFQWS_ARGS_IPSET="..."

# Дополнительные стратегии
NFQWS_ARGS_CUSTOM="..."

# Обрабатывать ли IPv6 соединения
IPV6_ENABLED=0|1

# TCP порты для iptables
# Оставьте пустым, если нужно отключить обработку TCP
# Добавьте порт 80 для обработки HTTP (TCP_PORTS=443,80)
TCP_PORTS=443(,80)

# UDP порты для iptables
# Оставьте пустым, если нужно отключить обработку UDP
# Удалите порт 443, если не нужно обрабатывать QUIC
UDP_PORTS=443(,50000:50099)

# Политика доступа (только для Keenetic/Netcraze)
POLICY_NAME="nfqws"

# Режим работы политики доступа
# 0 - обрабатывается трафик только для устройств в политике
# 1 - обрабатывается трафик для всех устройств, кроме добавленных в политику
POLICY_EXCLUDE=0|1
# Файл для записи дебаг-лога
LOG_DEBUG_PATH="@/opt/var/log/nfqws2-debug.log"

# Логирование в Syslog
LOG_LEVEL=0|1
```

--------------------------------

### Install nfqws2-keenetic with apk

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/README.md

Update the apk cache and install the nfqws2-keenetic package.

```bash
apk --update-cache add nfqws2-keenetic
```

--------------------------------

### Install missing dependencies for nfqws2

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/05-установка.md

Install essential libraries like libc and libm if nfqws2 fails to open shared objects. Use 'ldd' to check all dependencies.

```bash
opkg install libc
opkg install libm
ldd /opt/usr/bin/nfqws2  # Проверить все зависимости
```

--------------------------------

### User Domain List Example

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/02-списки.md

Example content for user.list, containing domains for traffic processing. Each domain should be on a new line. Comments start with '#'.

```plaintext
google.com
youtube.com
facebook.com
twitter.com
instagram.com
# Социальные сети
tiktok.com
reddit.com
# Видео сервисы
netflix.com
```

--------------------------------

### Configure opkg Repository

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/README.md

Add the nfqws2-keenetic repository source to the opkg configuration to enable package installation.

```bash
echo "src/gz nfqws2-keenetic https://nfqws.github.io/nfqws2-keenetic/openwrt" > /etc/opkg/nfqws2-keenetic.conf
```

--------------------------------

### List nfqws2 configuration files

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/05-установка.md

This command lists the essential configuration files and directories for nfqws2, ensuring they are present after installation.

```bash
ls -la /opt/etc/nfqws2/
# Должны быть: nfqws2.conf, lists/, blobs/
```

--------------------------------

### Debug nfqws2 service startup issues

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/05-установка.md

Use these commands to validate the configuration, load kernel modules manually, and start the nfqws2 service with debug logging enabled to diagnose startup failures.

```bash
# Проверить конфиг
/opt/etc/init.d/S51nfqws2 validate_config

# Загрузить модули вручную
/opt/etc/init.d/S51nfqws2 kernel_modules

# Запустить с отладкой
LOG_LEVEL=1 /opt/etc/init.d/S51nfqws2 start
tail -f /opt/var/log/nfqws2-debug.log
```

--------------------------------

### Install Dependencies with apk

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/README.md

Update the apk cache and install required dependencies such as ca-certificates and wget-ssl. Remove the non-SSL version of wget.

```bash
apk --update-cache add ca-certificates wget-ssl
apk del wget-nossl
```

--------------------------------

### Manually set architecture and install nfqws2 binary

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/05-установка.md

Use these commands to manually set the system architecture and copy the correct nfqws2 binary if automatic detection fails. Ensure the binary is executable.

```bash
# Проверить архитектуру вручную
uname -m

# Проверить opkg конфиг
cat /opt/etc/opkg.conf | grep arch

# Установить вручную
cp /opt/tmp/nfqws2_binary/nfqws2-ARCH /opt/usr/bin/nfqws2
chmod +x /opt/usr/bin/nfqws2
```

--------------------------------

### Supported Architecture Transformations

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/05-установка.md

Lists the transformations applied to architecture strings during the installation process to map them to supported formats.

```bash
mips-3         → mips
mipsel-3       → mipsel
aarch64-3      → aarch64
armv7          → armv7 (без изменений)
arm            → armv7
i386/i686      → x86
x86_64         → x86_64 (без изменений)
rlx (MikroTik) → lexra
```

--------------------------------

### Check installed version of nfqws2-keenetic

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/05-установка.md

Use this command to verify the currently installed version of the nfqws2-keenetic package. The output will display the version number.

```bash
opkg info nfqws2-keenetic
# Вывод включает Version: X.Y.Z
```

--------------------------------

### IPv6 Address List Example

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/02-списки.md

Example content for ipset.list, demonstrating IPv6 addresses for traffic processing. Each address is on a new line.

```plaintext
2001:4860:4860::8888
2606:4700:4700::1111
2001:db8::/32
```

--------------------------------

### Configuration for Multiple Interfaces

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/01-конфигурация.md

Example configuration for handling traffic across multiple ISP interfaces. Specifies 'eth3' and 'nwg1', and sets both TCP and UDP ports.

```bash
ISP_INTERFACE="eth3 nwg1"
TCP_PORTS=443,80
UDP_PORTS=443
IPV6_ENABLED=1
```

--------------------------------

### Configuration with Auto-Detection

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/01-конфигурация.md

Example configuration for automatic traffic detection. Enables IPv6 and uses the auto-detection mode for extra arguments.

```bash
ISP_INTERFACE="eth3"
IPV6_ENABLED=1
NFQWS_EXTRA_ARGS="$MODE_AUTO"
```

--------------------------------

### Auto Domain List Example

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/02-списки.md

Example content for auto.list, which stores domains automatically added by the service. Format is similar to user.list.

```plaintext
blocked-site.example
news-outlet.local
# Автоматически добавленные домены
censored-service.org
```

--------------------------------

### IPv4 Address and Subnet List Example

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/02-списки.md

Example content for ipset.list, showing individual IPv4 addresses and CIDR subnets for traffic processing. Each entry is on a new line.

```plaintext
# Отдельные адреса
8.8.8.8
1.1.1.1

# CIDR подсети
8.8.0.0/24
1.0.0.0/8
```

--------------------------------

### Example Logged Domains

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/02-списки.md

Sample content of the automatically added domains log file. Each entry is a domain name added in MODE_AUTO.

```text
blocked-site-1.example
censored-domain.local
inaccessible-resource.org
another-blocked.com
```

--------------------------------

### Check System Reboots and Autostart

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Review system reboot history to identify if a restart caused firewall rules to be lost. Ensure the NFQWS2 service is configured to start automatically on boot.

```bash
# Проверить были ли перезагрузки
last -f /var/log/wtmp | head -5

# Если была перезагрузка, сервис должен автоматически запуститься
# (если не произошла, добавить в автозагрузку через /opt/etc/init.d/S51nfqws2)
```

--------------------------------

### Install Netfilter kernel modules on OpenWRT

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/05-установка.md

Install the required Netfilter kernel modules for iptables on OpenWRT systems to resolve 'iptables: No chain/target/match by that name' errors.

```bash
opkg install kmod-nfnetlink-queue
opkg install kmod-ipt-nfqueue
opkg install kmod-nf-conntrack
```

--------------------------------

### Manage nfqws2 Service

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/00-СОДЕРЖАНИЕ.md

Provides commands to start, stop, restart, reload, and check the status of the nfqws2 service.

```bash
/opt/etc/init.d/S51nfqws2 start      # Запуск
/opt/etc/init.d/S51nfqws2 stop       # Остановка
/opt/etc/init.d/S51nfqws2 restart    # Перезагрузка
/opt/etc/init.d/S51nfqws2 reload     # Перезагрузка конфига
/opt/etc/init.d/S51nfqws2 status     # Проверка статуса
```

--------------------------------

### Start Firewall Configuration

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/03-интерфейс-управления.md

Adds iptables/ip6tables rules for traffic processing. It configures mangle and nat tables, creates specific chains, and applies rules for both incoming and outgoing traffic, optimizing for performance by limiting packets per connection.

```bash
_firewall_start() {
  local CMD=$1 # iptables или ip6tables
}
```

--------------------------------

### Exclusion List Example

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/02-списки.md

Example content for exclude.list, specifying domains that should not be processed. Subdomains are automatically included. This list has higher priority than user.list and auto.list.

```plaintext
# Локальные сервисы
localhost
192.168.1.1
# Сервисы без DPI-фильтрации
trusted-service.local
bank.example
government.gov
```

--------------------------------

### Minimal Configuration for HTTPS Only

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/01-конфигурация.md

Example configuration for processing only HTTPS traffic. Sets the ISP interface, TCP port to 443, and disables IPv6.

```bash
ISP_INTERFACE="eth3"
TCP_PORTS=443
UDP_PORTS=""
IPV6_ENABLED=0
NFQWS_EXTRA_ARGS="$MODE_ALL"
```

--------------------------------

### Custom Strategy Configuration

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/01-конфигурация.md

Example configuration for a custom traffic processing strategy. Uses NFQWS_ARGS_CUSTOM to specify filter ports, DPI desync, and a hostlist file.

```bash
NFQWS_ARGS_CUSTOM="--filter-tcp=8443 --dpi-desync=fake --hostlist=/opt/etc/nfqws2/lists/custom.list"
```

--------------------------------

### Mixed IPv4 and IPv6 List Example

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/02-списки.md

Example content for ipset.list, combining IPv4 and IPv6 addresses and subnets for traffic processing. This list can be used for comprehensive IP-based filtering.

```plaintext
# Google DNS
8.8.8.8
8.8.4.4
2001:4860:4860::8888
2001:4860:4860::8844

# Cloudflare DNS
1.1.1.1
1.0.0.1
2606:4700:4700::1111
2606:4700:4700::1001
```

--------------------------------

### IP Exclusion List Example

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/02-списки.md

Example content for ipset_exclude.list, specifying IP addresses and subnets to be excluded from IP-based traffic processing. The format is identical to ipset.list.

```plaintext
# Локальные сервисы
127.0.0.1
192.168.0.0/16
10.0.0.0/8
```

--------------------------------

### View All nfqws2 Firewall Rules

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/04-firewall-правила.md

Use this command to list all iptables rules related to nfqws2. It helps in getting a comprehensive overview of the firewall configuration.

```bash
iptables-save | grep nfqws
```

--------------------------------

### Configure Extra Arguments for Service Mode

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/01-конфигурация.md

Sets the service mode and domain filtering. This example uses MODE_AUTO, which automatically detects unavailable domains based on failure rates and logs debug information.

```bash
NFQWS_EXTRA_ARGS="$MODE_AUTO"
```

--------------------------------

### Initialize NFQWS2 with Base Arguments

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/01-конфигурация.md

Defines essential arguments for NFQWS2 startup, including Lua scripts and binary data blobs for initialization.

```bash
NFQWS_BASE_ARGS="--lua-init=@/opt/etc/nfqws2/lua/zapret-lib.lua
                 --lua-init=@/opt/etc/nfqws2/lua/zapret-antidpi.lua
                 --lua-init=@/opt/etc/nfqws2/lua/zapret-auto.lua
                 --blob=quic_initial:@/opt/etc/nfqws2/blobs/quic_initial.bin
                 --blob=tls_clienthello:@/opt/etc/nfqws2/blobs/tls_clienthello.bin"
```

--------------------------------

### Generate Startup Arguments

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/03-интерфейс-управления.md

Constructs the complete set of arguments for launching the nfqws2 binary. The order of arguments is critical when using multiple strategies with the '--new' flag.

```bash
_startup_args()
```

--------------------------------

### Configure apk Repository

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/README.md

Create a repository list file for apk to include the nfqws2-keenetic repository.

```bash
echo "https://nfqws.github.io/nfqws2-keenetic/openwrt/packages.adb" > /etc/apk/repositories.d/nfqws2-keenetic.list
```

--------------------------------

### Check Dependencies

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

List the dynamic dependencies of the NFQWS2 binary. Ensure all required libraries are present.

```bash
ldd /opt/usr/bin/nfqws2
```

--------------------------------

### Check System Architecture

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Verify the architecture of the NFQWS2 binary. This should match the router's architecture.

```bash
file /opt/usr/bin/nfqws2
```

--------------------------------

### Create Running Configuration

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/03-интерфейс-управления.md

Creates a runtime configuration file with auto-detected values. It determines Keenetic policy labels, generates the nfqws2.conf.run file, and outputs policy information.

```bash
create_running_config()
```

--------------------------------

### Add Repository Key with opkg

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/README.md

Download the public key for the nfqws2-keenetic repository and add it to the opkg key list.

```bash
wget -O "/tmp/nfqws2-keenetic.pub" "https://nfqws.github.io/nfqws2-keenetic/openwrt/nfqws2-keenetic.pub"
opkg-key add /tmp/nfqws2-keenetic.pub
```

--------------------------------

### Configure NFQWS2 for Mode List

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/02-списки.md

Steps to configure NFQWS2 for MODE_LIST, including editing the configuration file, setting NFQWS_EXTRA_ARGS, adding domains to user.list, and restarting the service.

```bash
# Отредактировать конфиг
vi /opt/etc/nfqws2/nfqws2.conf
# Установить NFQWS_EXTRA_ARGS="$MODE_LIST"

# Добавить домены в user.list
cat > /opt/etc/nfqws2/lists/user.list << 'EOF'
google.com
youtube.com
facebook.com
EOF

# Перезагрузить сервис
/opt/etc/init.d/S51nfqws2 restart
```

--------------------------------

### Count Packets Processed by NFQUEUE

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Get a count of packets that have been processed by the NFQUEUE target in the iptables mangle table.

```bash
iptables -t mangle -L nfqws_post -n -v -x | grep NFQUEUE
```

--------------------------------

### Utility Dependencies

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/08-архитектура.md

Essential command-line utilities for managing NFQWS2 and system network configurations, including firewall tools and package managers.

```text
iptables (IPv4 firewall)
ip6tables (IPv6 firewall)
sysctl (настройка параметров kernel)
opkg (пакетный менеджер, на Entware)
```

--------------------------------

### Check Hardware Acceleration Settings

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Investigate hardware acceleration settings on Keenetic or OpenWRT systems. If enabled, it might interfere with NFQWS2's packet processing. Disable it if necessary.

```bash
# На Keenetic проверить сетевой ускоритель
# Через веб-интерфейс: Система > Администрирование > Сетевой ускоритель

# На OpenWRT проверить hw flow offloading
uci get network.@switch_vlan[0].description

# Если включено, отключить:
# На Keenetic: Через веб-интерфейс
# На OpenWRT: uci set network.@switch_vlan[0].description=0
```

--------------------------------

### Runtime Dependencies

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/08-архитектура.md

List of essential C libraries required for NFQWS2 to run, including standard C library, math library, and threading library.

```text
libc (C библиотека)
libm (математика)
libpthread (многопоточность)
```

--------------------------------

### Get NFQWS2 Process ID (PID)

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Retrieve the Process ID (PID) of the running NFQWS2 service to help identify and manage the process.

```bash
cat /opt/var/run/nfqws2.pid
```

--------------------------------

### Configure multiple strategies

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/README.md

Apply multiple DPI desync strategies by adding them to the NFQWS_ARGS_CUSTOM variable in the configuration file, separated by the --new parameter.

```bash
NFQWS_ARGS_CUSTOM="--filter-tcp=443 --dpi-desync=fake,split2 --hostlist=custom.list --new --filter-tcp=80 --dpi-desync=disorder2 --dpi-desync-fooling=md5sig,badseq"
```

--------------------------------

### Validate NFQWS2 Configuration

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/03-интерфейс-управления.md

The `validate_config` function checks for correct configuration settings before starting the service. It ensures that the `--new` flag is not used improperly.

```bash
validate_config()
```

```bash
validate_config || exit 1
echo "Конфигурация проверена"
```

--------------------------------

### Manually Add an Additional Port Rule

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/04-firewall-правила.md

An example of how to manually add a new iptables rule to the 'nfqws_post' chain to process traffic on an additional port, such as 8080.

```bash
# Например, добавить порт 8080
iptables -t mangle -A nfqws_post -o eth3 -p tcp --dport 8080 \
  ! -m mark --mark 0x40000000/0x40000000 \
  -j NFQUEUE --queue-num 300 --queue-bypass
```

--------------------------------

### NFQWS2 Configuration File Structure

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/08-архитектура.md

Outlines the main configuration parameters found in the nfqws2.conf file, covering interface settings, port configurations, arguments for different strategies, and IP filtering.

```text
┌─────────────────────────────────────┐
│  nfqws2.conf                        │
│  ├─ ISP_INTERFACE                  │
│  ├─ TCP_PORTS / UDP_PORTS          │
│  ├─ NFQWS_BASE_ARGS                │
│  ├─ NFQWS_ARGS (стратегия TCP)     │
│  ├─ NFQWS_ARGS_UDP (стратегия UDP)│
│  ├─ NFQWS_ARGS_QUIC (стратегия UDP/443)
│  ├─ NFQWS_EXTRA_ARGS (режим)      │
│  ├─ NFQWS_ARGS_IPSET (IP фильтр)  │
│  └─ NFQWS_ARGS_CUSTOM (пользов.)  │
└─────────────────────────────────────┘
```

--------------------------------

### Check NFQWS2 Kernel Modules

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Attempt to load NFQWS2 kernel modules manually and verify their presence. This is a crucial step for diagnosing startup issues if the service fails to initialize.

```bash
# Попытаться загрузить вручную
/opt/etc/init.d/S51nfqws2 kernel_modules
```

```bash
# Проверить загруженные модули
lsmod | grep nfnetlink_queue
lsmod | grep xt_NFQUEUE
lsmod | grep xt_multiport
```

--------------------------------

### Reload NFQWS2 Service Configuration

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/03-интерфейс-управления.md

The `reload_service` function reloads the configuration of a running NFQWS2 service by sending a SIGHUP signal. It requires the service to be already started.

```bash
reload_service()
```

```bash
reload_service
# Вывод: Reloading NFQWS2 service...
```

--------------------------------

### Add Repository Key with apk

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/README.md

Download the public key for the nfqws2-keenetic repository and save it to the apk keys directory.

```bash
wget -O "/etc/apk/keys/nfqws2-keenetic.pem" "https://nfqws.github.io/nfqws2-keenetic/openwrt/nfqws2-keenetic.pem"
```

--------------------------------

### Configure NFQWS2 for Mode Auto

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/02-списки.md

Steps to configure NFQWS2 for MODE_AUTO, including setting NFQWS_EXTRA_ARGS, monitoring the log file, and moving verified domains to user.list.

```bash
# Установить в конфиге
NFQWS_EXTRA_ARGS="$MODE_AUTO"

# Сервис автоматически добавляет домены в auto.list
# Проверить лог
tail -f /opt/var/log/nfqws2.log

# Переместить проверенные домены в user.list
cat /opt/var/log/nfqws2.log >> /opt/etc/nfqws2/lists/user.list
echo "" > /opt/var/log/nfqws2.log
```

--------------------------------

### HTTP and HTTPS Processing Configuration

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Configure NFQWS2 to process both HTTP and HTTPS traffic, excluding domains listed in exclude.list. This setup handles general web traffic while allowing specific services to bypass processing.

```bash
# /opt/etc/nfqws2/nfqws2.conf
ISP_INTERFACE="eth3"
TCP_PORTS=443,80
UDP_PORTS=""
IPV6_ENABLED=0
NFQWS_EXTRA_ARGS="$MODE_ALL"
```

```bash
# /opt/etc/nfqws2/lists/exclude.list
# Исключить работающие сервисы
banking.example
government.gov
```

--------------------------------

### View Loaded NFQWS2 Configuration

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Source the main and runtime configuration files to view the currently loaded configuration variables, including ISP_INTERFACE and TCP_PORTS.

```bash
source /opt/etc/nfqws2/nfqws2.conf
source /opt/etc/nfqws2/nfqws2.conf.run 2>/dev/null
echo "ISP_INTERFACE=$ISP_INTERFACE"
echo "TCP_PORTS=$TCP_PORTS"
```

--------------------------------

### Check Firewall Rules for NFQWS2

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Inspect the current iptables rules to ensure NFQWS2 has the necessary configurations. If rules are missing, this command will add them.

```bash
# Проверить наличие правил
iptables-save | grep nfqws

# Если пусто, добавить вручную
/opt/etc/init.d/S51nfqws2 firewall_iptables

# Проверить для IPv6 (если включено)
ip6tables-save | grep nfqws
```

--------------------------------

### Configure Custom Strategies for Special Traffic

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/01-конфигурация.md

Defines custom strategies for special traffic, allowing additional rules to be set using the --new separator. This example applies different DPI desync methods to HTTP and HTTPS traffic.

```bash
NFQWS_ARGS_CUSTOM="--filter-tcp=80 --dpi-desync=fakedsplit --new --filter-tcp=443 --dpi-desync=fake"
```

```bash
NFQWS_ARGS_CUSTOM="--filter-tcp=443 --dpi-desync=fake,split2 --hostlist=custom.list --new --filter-tcp=80 --dpi-desync=disorder2 --dpi-desync-fooling=md5sig,badseq"
```

--------------------------------

### Configure System Parameters

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/03-интерфейс-управления.md

Sets sysctl system parameters for optimal operation, disabling checksum verification and relaxing TCP flag checks to prevent packet drops during DPI desynchronization.

```bash
system_config()
```

--------------------------------

### Multiple Interface Configuration

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Configure NFQWS2 to process traffic across multiple network interfaces. The init script automatically adds bind-fix options. Verify iptables rules show entries for each specified interface.

```bash
# /opt/etc/nfqws2/nfqws2.conf
ISP_INTERFACE="eth3 nwg1"
TCP_PORTS=443,80
IPV6_ENABLED=1
```

```bash
# Остальные параметры обычные
```

```bash
# Должны быть правила для обоих интерфейсов
iptables -t mangle -L nfqws_post -n -v
# Вывод должен содержать "-o eth3" и "-o nwg1"
```

--------------------------------

### OpenWRT Service Management Commands

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/03-интерфейс-управления.md

Manage the NFQWS2 service on OpenWRT using the 'service' command or the init script at /etc/init.d/nfqws2-keenetic.

```bash
# Запуск сервиса
service nfqws2-keenetic start
# или
/etc/init.d/nfqws2-keenetic start
```

```bash
# Остановка сервиса
service nfqws2-keenetic stop
```

```bash
# Перезагрузка сервиса
service nfqws2-keenetic restart
```

```bash
# Перезагрузка конфигурации
service nfqws2-keenetic reload
```

```bash
# Проверка статуса
service nfqws2-keenetic status
```

```bash
# Дополнительные команды (через init скрипт)
/etc/init.d/nfqws2-keenetic firewall_iptables
```

```bash
/etc/init.d/nfqws2-keenetic firewall_ip6tables
```

```bash
/etc/init.d/nfqws2-keenetic firewall_stop
```

```bash
/etc/init.d/nfqws2-keenetic kernel_modules
```

--------------------------------

### Enable IPv6 Support

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/01-конфигурация.md

Set IPV6_ENABLED to 1 to enable IPv6 support. Requires the 'IPv6 Protocol' package.

```bash
IPV6_ENABLED=1
```

--------------------------------

### Initialize Lua Script for Custom Strategies

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/08-архитектура.md

Add this argument to NFQWS_BASE_ARGS to initialize a custom Lua script for defining strategies, modifying filtering logic, or adding new protocols.

```bash
# Добавить в NFQWS_BASE_ARGS
--lua-init=@/opt/etc/nfqws2/lua/custom-strategy.lua
```

--------------------------------

### Run NFQWS2 with Debugging

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Execute the NFQWS2 service with debug logging enabled to capture detailed error messages in the console. This is useful for diagnosing startup or runtime issues.

```bash
/opt/usr/bin/nfqws2 --debug=syslog \
  --qnum=300 --user=nobody \
  --lua-init=@/opt/etc/nfqws2/lua/zapret-lib.lua \
  --filter-tcp=443 \
  --lua-desync=fake:repeats=2

# Смотреть ошибку, которая выведется в консоль
```

--------------------------------

### Add Firewall Rules (IPv4)

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/03-интерфейс-управления.md

Adds IPv4 firewall rules using iptables. This is equivalent to calling '_firewall_start iptables'.

```bash
firewall_iptables()
```

--------------------------------

### Add IPv6 Firewall Rules

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/03-интерфейс-управления.md

Adds IPv6 firewall rules if IPv6 support is enabled. This is equivalent to '_firewall_start ip6tables' when IPv6 is active.

```bash
firewall_ip6tables()
```

```bash
firewall_ip6tables
# Добавляет правила в IPv6 таблицы ip6tables (если включено)
```

--------------------------------

### Init Script Functions for NFQWS2 Service

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/08-архитектура.md

Lists the primary functions available in the init scripts for managing the NFQWS2 service, including status checks, configuration validation, and firewall rule management.

```shell
is_running()
validate_config()
create_running_config()
kernel_modules()
firewall_iptables()
firewall_ip6tables()
firewall_stop()
_startup_args()
```

--------------------------------

### Migrate configuration from nfqws-keenetic to nfqws2-keenetic

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/05-установка.md

Follow these steps to migrate your existing configuration from the older nfqws-keenetic version to the new nfqws2-keenetic package, including backing up and restoring lists.

```bash
# 1. Сохранить конфиги старой версии:
cp -r /opt/etc/nfqws/ /opt/etc/nfqws-backup/

# 2. Удалить старый пакет:
opkg remove nfqws-keenetic-web
opkg remove nfqws-keenetic

# 3. Установить новый пакет:
opkg install nfqws2-keenetic

# 4. Восстановить списки доменов (если необходимо):
cp /opt/etc/nfqws-backup/lists/*.list /opt/etc/nfqws2/lists/

# 5. Перезагрузить сервис:
/opt/etc/init.d/S51nfqws2 restart
```

--------------------------------

### Configure Custom DPI Desync Strategy

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/08-архитектура.md

Use the --new flag with custom DPI desync configurations to define specific filtering rules and strategies.

```bash
NFQWS_ARGS_CUSTOM="--filter-tcp=8443 --dpi-desync=custom --new ..."
```

--------------------------------

### QUIC Initial Blob Configuration

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/02-списки.md

Configuration parameter for specifying the QUIC initial packet binary blob. Used for payload substitution in QUIC traffic desynchronization.

```text
--blob=quic_initial:@/opt/etc/nfqws2/blobs/quic_initial.bin
```

--------------------------------

### nfqws2 Firewall Rule Application Order

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/04-firewall-правила.md

Details the sequence in which nfqws2 applies its firewall rules upon service startup. This includes chain creation, attachment to main chains, interface-specific rules, and system configuration adjustments.

```bash
# 1. Создание цепочек:
#    iptables -t mangle -N nfqws_post
#    iptables -t mangle -N nfqws_pre
#    iptables -t nat -N nfqws_nat (IPv4)

# 2. Присоединение к основным цепочкам:
#    iptables -t mangle -A POSTROUTING -j nfqws_post
#    iptables -t mangle -A PREROUTING -j nfqws_pre
#    iptables -t nat -A POSTROUTING -j nfqws_nat (IPv4)

# 3. Для каждого интерфейса в `ISP_INTERFACE`:
#    Добавление правил политики (если применимо)
#    Добавление правил исключения
#    Добавление правил NFQUEUE для начальных пакетов
#    Добавление правил NFQUEUE для TCP флагов
#    Добавление NAT правил (IPv4)
#    Аналогично для PREROUTING

# 4. Загрузка системной конфигурации:
#    sysctl net.netfilter.nf_conntrack_checksum=0
#    sysctl net.netfilter.nf_conntrack_tcp_be_liberal=1
```

--------------------------------

### Verify architecture of nfqws2 binary

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/05-установка.md

This command checks the architecture of the nfqws2 executable to ensure it matches the system's architecture. It helps diagnose 'Failed to detect architecture' errors.

```bash
file /opt/usr/bin/nfqws2
# Пример вывода:
# ELF 32-bit LSB executable, MIPS, MIPS32 rel2, version 1 (SYSV)
```

--------------------------------

### Automatic Detection Configuration and Monitoring

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Configure NFQWS2 for automatic detection of blocked resources, enabling debug logging. Monitor the log file for automatically added domains and append them to user.list.

```bash
# /opt/etc/nfqws2/nfqws2.conf
NFQWS_EXTRA_ARGS="$MODE_AUTO"
LOG_LEVEL=1
LOG_DEBUG_PATH="@/opt/var/log/nfqws2-debug.log"
```

```bash
# Остальные параметры из примера 1
```

```bash
# Просмотр автоматически добавленных доменов
tail -f /opt/var/log/nfqws2.log
```

```bash
# После анализа переместить в user.list
cat /opt/var/log/nfqws2.log >> /opt/etc/nfqws2/lists/user.list
echo "" > /opt/var/log/nfqws2.log
```

--------------------------------

### Entware/Keenetic Service Management Commands

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/03-интерфейс-управления.md

Use these commands to manage the NFQWS2 service on Entware/Keenetic platforms. The script is located at /opt/etc/init.d/S51nfqws2.

```bash
# Запуск сервиса
/opt/etc/init.d/S51nfqws2 start
```

```bash
# Остановка сервиса
/opt/etc/init.d/S51nfqws2 stop
```

```bash
# Перезагрузка сервиса
/opt/etc/init.d/S51nfqws2 restart
```

```bash
# Перезагрузка конфигурации (без остановки)
/opt/etc/init.d/S51nfqws2 reload
```

```bash
# Проверка статуса
/opt/etc/init.d/S51nfqws2 status
```

```bash
# Загрузка IPv4 firewall правил
/opt/etc/init.d/S51nfqws2 firewall_iptables
```

```bash
# Загрузка IPv6 firewall правил
/opt/etc/init.d/S51nfqws2 firewall_ip6tables
```

```bash
# Выгрузка всех firewall правил
/opt/etc/init.d/S51nfqws2 firewall_stop
```

```bash
# Загрузка kernel модулей
/opt/etc/init.d/S51nfqws2 kernel_modules
```

--------------------------------

### Check Configured Interface for NFQWS2

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Verify the network interface configured for NFQWS2 in its configuration file and compare it with the actual network interfaces and routing table.

```bash
# Проверить конфигурированный интерфейс
grep ISP_INTERFACE /opt/etc/nfqws2/nfqws2.conf

# Сравнить с реальными интерфейсами
ifconfig | grep -E "^[a-z]"

# Или использовать ip
ip link show | grep "LOWER_UP"

# Проверить таблицу маршрутизации
route | grep '^default'
```

--------------------------------

### Check nfqws2 Kernel Modules

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/00-СОДЕРЖАНИЕ.md

Lists loaded kernel modules to verify if the nfqueue module is present.

```bash
lsmod | grep nfqueue
```

--------------------------------

### Custom Strategy Configuration with IP Sets

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Apply different processing strategies to specific ports and domains using custom arguments and IP set lists. This allows fine-grained control over traffic handling based on port and IP address.

```bash
# /opt/etc/nfqws2/nfqws2.conf
NFQWS_ARGS_CUSTOM="--filter-tcp=8443 --dpi-desync=fake,split2 --hostlist=/opt/etc/nfqws2/lists/custom.list --new --filter-tcp=9443 --dpi-desync=disorder2"
```

```bash
cat > /opt/etc/nfqws2/lists/custom.list << 'EOF'
custom-service.example
special-app.local
EOF
```

```bash
# /opt/etc/nfqws2/nfqws2.conf
NFQWS_ARGS_IPSET="--ipset=/opt/etc/nfqws2/lists/ipset.list --ipset-exclude=/opt/etc/nfqws2/lists/ipset_exclude.list"
```

```bash
# /opt/etc/nfqws2/lists/ipset.list
8.8.8.8
8.8.4.4
1.1.1.1
1.0.0.1
2001:4860:4860::8888
```

```bash
# /opt/etc/nfqws2/lists/ipset_exclude.list
192.168.1.1
10.0.0.0/8
fc00::/7
```

--------------------------------

### Check for kernel modules

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/05-установка.md

Verify that the necessary Netfilter kernel modules, nfnetlink_queue and xt_NFQUEUE, are loaded or available on the system.

```bash
modprobe -l | grep nfnetlink_queue
modprobe -l | grep xt_NFQUEUE
```

--------------------------------

### Configure NFQWS2 IP Filtering

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/02-списки.md

Steps to configure IP filtering by adding IP addresses to ipset.list and exclusions to ipset_exclude.list, followed by a service restart.

```bash
# Добавить IP-адреса для обработки
cat > /opt/etc/nfqws2/lists/ipset.list << 'EOF'
8.8.8.8
8.8.4.4
1.1.1.1
EOF

# Добавить исключения
cat > /opt/etc/nfqws2/lists/ipset_exclude.list << 'EOF'
192.168.1.1
10.0.0.0/8
EOF

# Перезагрузить сервис
/opt/etc/init.d/S51nfqws2 restart
```

--------------------------------

### Подключение к роутеру

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/README.md

Команды для доступа к среде entware через telnet или ssh.

```bash
telnet 192.168.1.1
exec sh
```

```bash
ssh 192.168.1.1 -l root -p 222
```

--------------------------------

### Удаление пакета

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/README.md

Полное удаление пакета со всеми зависимостями.

```bash
opkg remove --autoremove nfqws2-keenetic
```

--------------------------------

### View All IPv6 nfqws2 Firewall Rules

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/04-firewall-правила.md

Similar to the IPv4 command, this lists all ip6tables rules associated with nfqws2, essential for verifying IPv6 firewall configuration.

```bash
ip6tables-save | grep nfqws
```

--------------------------------

### Set Process User

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/01-конфигурация.md

Specify the user for running the nfqws2 process. The default user is 'nobody'.

```bash
USER=nobody
```

--------------------------------

### Check Size of Domain Lists

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/07-примеры-и-диагностика.md

Determine the number of entries in the user and auto domain lists. Very large lists can impact performance, suggesting the use of MODE_ALL or list splitting.

```bash
# Большой список доменов замедляет поиск
wc -l /opt/etc/nfqws2/lists/user.list
wc -l /opt/etc/nfqws2/lists/auto.list

# Если очень большой (> 100000 доменов), использовать режим MODE_ALL вместо MODE_LIST
# или разделить на несколько списков через --new
```

--------------------------------

### Run NFQWS2 as a Non-Privileged User

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/08-архитектура.md

Execute NFQWS2 with the --user flag set to 'nobody' to enhance security by running as an unprivileged user.

```bash
nfqws2 --user=nobody
```

--------------------------------

### Configure Policy Mode

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/01-конфигурация.md

Set POLICY_EXCLUDE to 0 for inclusion mode (process traffic only for devices in POLICY_NAME) or 1 for exclusion mode (process traffic for all devices except those in POLICY_NAME).

```bash
POLICY_EXCLUDE=0
```

--------------------------------

### Entware Service Update

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/05-установка.md

Commands to update the NFQWS2 service on Entware-based systems using opkg.

```bash
opkg update
opkg upgrade nfqws2-keenetic
```

--------------------------------

### Restart nfqws2 with Debugging

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/00-СОДЕРЖАНИЕ.md

Restarts the nfqws2 service after enabling debug logging.

```bash
/opt/etc/init.d/S51nfqws2 restart
```

--------------------------------

### OpenWRT 25.xx Service Update

Source: https://github.com/nfqws/nfqws2-keenetic/blob/master/_autodocs/05-установка.md

Commands to update the NFQWS2 service on OpenWRT 25.xx and snapshot versions using apk.

```bash
apk update
apk upgrade nfqws2-keenetic
```