From 0a4ec757f59c81816eca04ce7a2d23b70286dda0 Mon Sep 17 00:00:00 2001
From: sushen339 <sushen339@gmail.com>
Date: Tue, 18 Nov 2025 15:05:24 +0800
Subject: [PATCH]

---
 blockip/bip            | Bin 58392 -> 58392 bytes
 blockip/src/nftables.c |  15 +++++++++------
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/blockip/bip b/blockip/bip
index a52f2cc3fcb42aabe7ed0223c7c1d0ba737cb90a..639120f95dcd9b00a46341c8fd06ad5c46f3f28c 100644
GIT binary patch
delta 1633
zcmYk7dr(w$6vyvjL0BJzW%&ZZFj>QfhnkooFpIF}+G1c(XyAabj*`3#nVNydEJ)Xk
zqqaCcc(c3&x<ueBbkrfoe55nsj82%AYw0A@s9U3*z84#F|M-2*@7(kHo!{Ae?fp7?
zzpf*i^n)SF@NbY8(}S^n?T>d)$jjW)#v1lL);=L0bNhDOol`&FOS$QJZ)jADLH~RA
zSDTE#ol<w`?nlw<yu~<^HgJ!zm=e|SSWlt?er?faI>~*DZjp|g<L0}GnQz8*(hapT
z{-KUMdDoIh6vjKu3n^T^XwINX|HLUuSfA7KtH@EsO;JqcKgE_`GufW^Qxo1O_MlOG
zI?+Hs^Ph<Y^eSg3nJI?5lK!SFZeKouHgo^-NGjqHZ#|-8?4G=kj;qFGof~DT@o$F^
zy{i_z<4rL5BsHGW_-twx8Pqu|N_BKj?M|EONq2Z4%a0!L{jA;eA%Bs*jKcYPb^_hv
z+13;)Wt%k)2`^cf(I4vcH4YuU&*#>KQcgvVAAQPGax&>nbyH3np&QrVGor$v^<C7-
zSJp>P;+GZ0IYkvQm0vy>gx(${EGAoI4bRFwj$Yi)^(RmDg}fJuX7arJa3ornf6?tx
z5XTh6PE0cl8$au<C^1Q9+e^`76vb?N#WjQX6-<gx8h*NGnh#<+i`tOH7HNgfx%RQ#
zH68Njt;71ragY<C59@<fzGk(vPkS=w6PAJiG%=tsh<36GYdz;;J;L_FF3RPl8xm=O
zTD_s$SGOuNlUG&*;)b}SB6N70!+u_?GBQ@@7Cxn1S>dbC%wL~7JWEfR29ly~;{zj0
zTpx)<BaC&kh!wPhcJ1P~iuiyLHjz?|+e9LCijo4FK|5##2f*#1VY|pBu&hF4nmg=R
zBoo}YQ=|v%2XBDZT_V07(0?hC;GvW#JrHuCm|z##0Y-qWU|FSz6Lf-JBNWB88;QY)
zJqQR6?1kPFe)~m|z%sB7bXAMEG}emD^iq_bdXaRE4R{VlG>V)D4GxiU`VvKPK#0~u
z(S(XYd$UL%XlfC09|;FsTRLdPmGy%g+hIQnC+t9HKvyRMYJ1Gq?9uQC6TpbCMXEqY
zHx2?0e1n28HLhL}2WUDdawZdk6M_r09uf(~e0d#4N5GULNC=i4Lrb55<7ttt;Doax
zcR|BBT!|0-!BQ~g0tx{g;9X7s15P*=diJXdrchp76+#_cToptvuC5wCvEwt5d)i>c
zdi%KD_V(HX5woMX_(Iiw*yL3|=jXmfWZ{1{mXY3GF*xWn%>{#Q;OgoiistXCjb!FA
zH5OXID{G?YHt(%Tq#hos38pLTS38$td3o(D3gGfuf7mzG2I9~CeeHPqn189APj;SK
z=T8G1Q)i?)-dwkqHu6xNh59+BehD3BTfGHwuGS}_rm%)tbb?o7P2kD~BaP;(4Z)Po
z`bJG&+NjCJje+pm+n7q{`7h`faHK<%D;?R$MNLKMMR8LUG`&q0RHbjuAYaaDo{ZYc
zn=Q1RFE_`d{;4fmJ*!(jAQN9}38X^yXbmPOhqcZ{gf*>Euxx5grZT3sRPF3-*_6pA
z+cFSy#({WP=3!0e-UAlAy7cY-=>ClMKsv)q+oR~AYHK%+uF!d@=MR}iP@g*Sc(NPn
t&N~s0mtyaUlF4M?d4nPP|33hEgLCx(RoZPRN&t6a_vDkI4h;tB{sm_OiXZ?0

delta 1701
zcmZ9NdrZ_v5XXOW$5SmFEm}b-P*m{Ia0&*{B4>`55evv!R4`(+fD!Q!jBhz>F=|DT
z5sQj?yx#)-QR}<-Xo99yteV!OO);7lP5(IiP}^vy-yc?+bd%qHW@l%1XJ;q-tL)WR
z_Ub!L<USCp47LHDMNhnXJ6?=lkyCYxy^Kd+XkU>p=)Umw%=3zfwl6tzc>9`Pa}Hbz
z+OXhmth!(SIELo($L2}2nNOP6Q-(Sv)|F@@Pm3#|uem4g0S)Dr_~|;=Is9{c7yY6h
zOn9azPd+gFIYsgQq!~0#y_vL>d|eV0Wpd9z@=qe?6`i6a?)))!=iS88;bYa5_trbp
z8+<h_gdXy5X@xX{b1X?Ti@Pm<Q9gIf8%d?yJ1?4w+2#G`bcLPLXV6vEoUYeVzM8Ng
zlqg$WyU>GRustJza`;+CHW}5anKnIrtDaaK=t_U^ciDa<{5bm%eZ>26QfV6B%SoX}
z9G*L$c5rEKJT|<Qn@UgAam$<Zw1uzd8EH-VN<Z4mZ>?NL3)O8a7Zb8^FW-y^gI9Ia
zDgJ&{wC~{wiZbw)Dw4SK&go#}_B^3WERAmAFzZF+;<44AJk=2eZxe-c)aohNC~x&m
zopT7!ER6NZ2^lng-9u4kT9Qh~nqE_sq|$ek34FBBHz9LywrY$4YYwb!$0nuGR_F#+
zypYe1gS@wGP#^6LISu;BJ+RuKSyl9CGgJ4l6b2xP0Y$-dgcH%Xvlac9Tv^mj>v+zZ
zG>TQL*PIybvOK@=gVja6usn!u<)JT!53Bt6dbv9(ys13wrE&=W&n8ga&c}xoJGP3L
zaK%|ABDr80SP7bTix@y-sfbPE9+61BqNIRHU>TST_JL(!K$*xb&{i%o#tC*TvJA9V
zh@1p_!24j<0g=(p(0?M5;;a-aoe->07%D~fgGR6ov>g-~0Q*5V7e#R#!p5Mn3JZdL
zN1%6w-!TyjXanm&N43aPjkO|^+!Up=UL;Fn1Li?vqeveZ&?MsRUaTl~2qt$Znh`Nr
z)*{janp#DihQI+AmIY?vvU)*l2keL9gq_F?=;*?N+89+8J`Da~3TXUH#17g|;2>b%
z=LiV(;y5MJ1e#8Zd{qpgAHq{G>x_sIm8G0TM!=MF*buZ`KuSH~cvWOKXt*Zg00XY$
zN(}G^ZD7g`1OnPYho=7qC-j2;HZlZi4OKVTXv18E))|P6b_1cd?V;4f1@>Sc$A?Jk
zzeXA~hfI7;++}~09DK!oY=mQ%$S7?RZ6v-B)cdntyrtTg0{CEcFh%l(YBR;Mb4@Z?
zcwS8m-RFv$H0tCBH52I;53h}&cX>{27>(quwf?ZLt_|`jLh1NuYsPvQEFNx3B*Yyk
zsZIPt?Q|+*pE`f)<ET0_Rq^J!6=dZHb;;DjQT4N_n@j4GvGVQuGz2-mA&k!QBJ_#8
zufa@Ce7j*H&1Y)V<hVvnE@%vbS4Cq6_3|U=!+C0xChu#?aW1P7(eaX23#T^wBRvJp
zF_`IUPDZ@cveeHTH8fd^G~UCoO}EU$ZRRB<3ByS!k4WCyl8i^{MoR+D>(i=5yQp;|
znfOj?5asdn)``^5<J%&z?vl0`SXQ^Cla2pu%W$!LDw6Nce>Vm3=JpuM<a6yyv1Q=#
z1h_0mKcBmfC*uvE4u9NNU`G&L=D3a+`duyQFb`Av&Lp}}uj+F#U5AN+%L#Z`PhBn^
jMMjS54|V_VCsNQK;T~ewPJr9vE{tCNcGO4x!TNsyzXO-z

diff --git a/blockip/src/nftables.c b/blockip/src/nftables.c
index c6b8070..b0e3867 100644
--- a/blockip/src/nftables.c
+++ b/blockip/src/nftables.c
@@ -88,25 +88,28 @@ int init_nftables_rules(void) {
              NFT_TABLE);
     system(command);
     
-    /* 添加白名单规则 */
+    /* 添加规则：白名单必须在黑名单之前，使用add按顺序添加 */
+    /* 1. IPv4白名单 accept */
     snprintf(command, sizeof(command),
-             "nft list chain %s input | grep -q '@%s' || nft insert rule %s input ip saddr @%s accept",
+             "nft list chain %s input | grep -q '@%s' || nft add rule %s input ip saddr @%s accept",
              NFT_TABLE, NFT_WHITELIST, NFT_TABLE, NFT_WHITELIST);
     system(command);
     
+    /* 2. IPv6白名单 accept */
     snprintf(command, sizeof(command),
-             "nft list chain %s input | grep -q '@%s' || nft insert rule %s input ip6 saddr @%s accept",
+             "nft list chain %s input | grep -q '@%s' || nft add rule %s input ip6 saddr @%s accept",
              NFT_TABLE, NFT_WHITELIST_V6, NFT_TABLE, NFT_WHITELIST_V6);
     system(command);
     
-    /* 添加黑名单规则 */
+    /* 3. IPv4黑名单 drop */
     snprintf(command, sizeof(command),
-             "nft list chain %s input | grep -q '@%s' || nft insert rule %s input ip saddr @%s drop",
+             "nft list chain %s input | grep -q '@%s' || nft add rule %s input ip saddr @%s drop",
              NFT_TABLE, NFT_SET, NFT_TABLE, NFT_SET);
     system(command);
     
+    /* 4. IPv6黑名单 drop */
     snprintf(command, sizeof(command),
-             "nft list chain %s input | grep -q '@%s' || nft insert rule %s input ip6 saddr @%s drop",
+             "nft list chain %s input | grep -q '@%s' || nft add rule %s input ip6 saddr @%s drop",
              NFT_TABLE, NFT_SET_V6, NFT_TABLE, NFT_SET_V6);
     system(command);