[光猫/猫棒] <--PPPoE--> [OpenWrt (BPI-R4)] <--DHCP--> [UDM SE]
     eth2                                        eth1

wan_ip=$(ifstatus ppp | jsonfilter -e '@["ipv4-address"][0].address')
# → 58.32.1.100

IFS=. read i1 i2 i3 i4 <<< "$wan_ip"
gateway_ip="$i1.$i2.$(( i3 & 252 )).1"
# 58.32.1.100 → 1 & 252 = 0 → 网关 58.32.0.1

# 清除 PPPoE 接口上的 IP 地址，但 PPPoE 会话保持不断
ip addr flush dev pppoe-ppp

# 建立策略路由：来自 eth1（下游网关）的流量走 PPPoE 隧道
ip route add default dev pppoe-ppp table 100
ip rule add iif eth1 table 100

ifconfig eth1 down
ifconfig eth1 "$gateway_ip" netmask "255.255.252.0" up
# eth1 的 IP 变为 58.32.0.1/22

# 计算公网 IP 在 /22 子网中的偏移量
# 58.32.1.100 → 子网起始 58.32.0.0 → 偏移量 = 1*256 + 100 = 356
offset=$(( i3 * 256 + i4 - (i3 & 252) * 256 ))

# 修改 odhcpd 的 DHCP 起始地址并重启
uci -q set dhcp.lann.start="$offset"
uci -q commit dhcp
/etc/init.d/odhcpd restart

wan_idx=$(uci show firewall | grep -E "firewall.@zone\[[0-9]+\].name='wann'" \
          | cut -d'[' -f2 | cut -d']' -f1)
uci set firewall.@zone[$wan_idx].masq='0'
uci commit firewall
/etc/init.d/firewall reload

while true; do
    message=$(nc -l -p 99)
    message=$(echo "$message" | tr -d "\n\r\t ")
    if [ "$message" = "dhcp_renew" ]; then
        if killall -SIGUSR2 udhcpc && killall -SIGUSR1 udhcpc; then
            logger -t "dhcp_listener" "Successfully renewed DHCP"
        fi
    fi
done

echo "dhcp_renew" | nc 10.10.10.1 99

#!/bin/sh
[ "$ACTION" = "ifup" ] && [ "$INTERFACE" = "ppp" ] && {
    /root/start-half-bridge.sh
}

下游设备 → UDM SE (NAT, 源IP=公网IP) → eth1 → 策略路由 table 100 → pppoe-ppp → 运营商

运营商 → pppoe-ppp → 路由表匹配目的IP → eth1 → UDM SE (NAT) → 下游设备

config interface 'loopback'
    option device 'lo'
    option proto 'static'
    option ipaddr '127.0.0.1'
    option netmask '255.0.0.0'

config globals 'globals'
    option ula_prefix 'fd32:a520:fa07::/48'
    option packet_steering '1'

config device
    option name 'br-lan'
    option type 'bridge'
    list ports 'lan1'
    list ports 'lan2'
    list ports 'lan3'

config interface 'lan'
    option device 'br-lan'
    option proto 'static'
    option ipaddr '10.10.10.10'
    option netmask '255.255.255.0'
    option gateway '10.10.10.1'

config interface 'lann'
    option device 'eth1'
    option proto 'static'
    option defaultroute '0'
    option ipaddr '192.168.2.1'
    option netmask '255.255.255.0'

config device
    option name 'br-wan'
    option type 'bridge'
    list ports 'wan'
    list ports 'eth2'

config device
    option name 'wan'
    option macaddr 'fe:fe:b1:95:1f:1f'

config device
    option name 'eth2'
    option macaddr 'FE:FE:B1:95:1F:1D'

config interface 'wan'
    option device 'br-wan'
    option proto 'static'
    option ipaddr '192.168.0.2'
    option netmask '255.255.255.0'

config interface 'wan6'
    option device 'br-wan'
    option proto 'dhcpv6'

config interface 'ppp'
    option proto 'pppoe'
    option device 'br-wan'
    option ipv6 '0'
    option keepalive '0 1'
    option username 'ad12345'
    option password '12345'
    option defaultroute '0'

config defaults
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option synflood_protect '1'
    option flow_offloading '1'
    option flow_offloading_hw '1'

config zone
    option name 'lann'
    option input 'ACCEPT'
    option output 'ACCEPT'
    option forward 'ACCEPT'
    list network 'lann'

config zone
    option name 'wann'
    list network 'ppp'
    option input 'REJECT'
    option output 'ACCEPT'
    option forward 'REJECT'
    option mtu_fix '1'

config forwarding
    option src 'lann'
    option dest 'wann'

config forwarding
    option src 'wann'
    option dest 'lann'

config odhcpd 'odhcpd'
    option maindhcp '1'
    option leasefile '/tmp/hosts/odhcpd'
    option leasetrigger '/usr/sbin/odhcpd-update'
    option loglevel '4'

config dhcp 'lann'
    option interface 'lann'
    option dhcpv4 'server'
    option leasetime '60s'
    option start '2'
    option limit '1'
    option dns '223.5.5.5'

#!/bin/ash

# 日志函数
log() {
    echo "$1"
    logger -t pppoe-half-bridge "$1"
}

# 获取 WAN IP 并验证
get_wan_ip() {
    local wan_ip=$(ifstatus ppp | jsonfilter -e '@["ipv4-address"][0].address')
    if [ -z "$wan_ip" ]; then
        log "获取 WAN IP 失败"
        exit 1
    fi
    echo "$wan_ip"
}

# 计算网关地址（22位子网掩码）
get_gateway_address() {
    local ip="$1"
    IFS=. read i1 i2 i3 i4 << EOF
$ip
EOF
    echo "$i1.$i2.$(( i3 & 252 )).1"
}

# 计算 DHCP 起始地址偏移量（22位子网掩码）
get_ip_offset() {
    local ip="$1"
    IFS=. read i1 i2 i3 i4 << EOF
$ip
EOF
    echo "$(( i3 * 256 + i4 - (i3 & 252) * 256 ))"
}

# 配置 DHCP 服务
configure_dhcp_service() {
    local start="$1"
    local current_start=$(uci -q get dhcp.lann.start)
    
    if [ "$current_start" = "$start" ]; then
        log "DHCP 无需配置"
        return
    fi
    
    uci -q set dhcp.lann.start="$start"
    uci -q commit dhcp
    /etc/init.d/odhcpd restart
    log "DHCP 配置完成"
}

# 配置防火墙
configure_firewall() {
    wan_idx=$(uci show firewall | grep -E "firewall.@zone\[[0-9]+\].name='wann'" | cut -d'[' -f2 | cut -d']' -f1)
    
    if [ -z "$wan_idx" ]; then
        log "未找到 wan zone"
        return
    fi

    masq_val=$(uci -q get firewall.@zone[$wan_idx].masq)
    if [ "$masq_val" = "0" ]; then
        log "防火墙无需配置"
        return
    fi
    uci set firewall.@zone[$wan_idx].masq='0'
    uci commit firewall
    /etc/init.d/firewall reload
    log "防火墙配置完成"
}

# 配置 eth1 IP 地址
configure_eth1_ip() {
    local gateway_ip="$1"
    local current_ip=$(ip addr show dev eth1 | grep -w "inet" | awk '{print $2}')
    
    if [ "$current_ip" = "$gateway_ip/22" ]; then
        log "eth1 IP 无需配置"
        return
    else
        ifconfig eth1 down 
        ifconfig eth1 "$gateway_ip" netmask "255.255.252.0" up
        log "eth1 IP 配置完成"
    fi
}

# 主函数
main() {
    local wan_ip=$(get_wan_ip)
    local gateway_ip=$(get_gateway_address "$wan_ip")
    log "WAN IP: $wan_ip, 网关: $gateway_ip"

    # Step 1 & 2: 清除 PPPoE 接口 IP，建立策略路由
    ip addr flush dev pppoe-ppp
    ip route add default dev pppoe-ppp table 100
    ip rule add iif eth1 table 100
    log "PPPoE 接口配置完成"

    # Step 3: 将 eth1 配置为下游网关的网关
    configure_eth1_ip "$gateway_ip"

    # Step 4: 动态调整 DHCP 范围
    configure_dhcp_service "$(get_ip_offset "$wan_ip")"

    # Step 5: 确保 PPPoE zone 不做 NAT
    configure_firewall

    # Step 6: 通知下游网关刷新 DHCP
    echo "dhcp_renew" | nc 10.10.10.1 99
    log "UDM DHCP 刷新完成"
}

# 执行主函数
main

[Unit]
Description=DHCP Listener Service

[Service]
User=root
ExecStart=/bin/bash -c 'while true; do \
    message=$(nc -l -p 99); \
    message=$(echo "$message" | tr -d "\n\r\t "); \
    if [ "$message" = "dhcp_renew" ]; then \
        if killall -SIGUSR2 udhcpc && killall -SIGUSR1 udhcpc; then \
            logger -t "dhcp_listener" "Successfully renewed DHCP"; \
        fi; \
    fi; \
done'
Restart=always

[Install]
WantedBy=multi-user.target