GLOBALCMAKEARGS=(
DENABLE_OMIT_FRAME_POINTER=OFF/ON( в зависимости от того, найден ли -fomit-frame-pointer в CFLAGS.)

#!/bin/bash
#iptables_torify.bash

dns_port=9053
tor_port=9040
virt_addr="10.192.0.0/10"
non_tor="127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 0.0.0.0/8 100.64.0.0/10 169.254.0.0/16 192.0.0.0/24 192.0.2.0/24 192.88.99.0/24 198.18.0.0/15 198.51.100.0/24 203.0.113.0/24 224.0.0.0/3"

RED='\033[0;31m'
NC='\033[0m'

if [[ "$UID" != "0" ]]; then
    echo -e "${RED}Нужен root!${NC}"
    exit 1
fi

if [[ "$1" == "add" ]]; then
    op="-A"
elif [[ "$1" == "del" ]]; then
    op="-D"
else
    echo -e "${RED}Неизвестная операция '$1'${NC}"
    exit 1
fi

if [[ "$2" == "uid" ]]; then
    if [[ ! "$3" =~ ^[0-9]+$ ]]; then
        echo -e "${RED}Неверный UID '$3'${NC}"
        exit 1
    fi
    filter="--uid-owner"
    owner="$3"
elif [[ "$2" == "gid" ]]; then
    if [[ ! "$3" =~ ^[0-9]+$ ]]; then
        echo -e "${RED}Неверный GID '$3'${NC}"
        exit 1
    fi
    filter="--gid-owner"
    owner="$3"
elif [[ "$2" == "user" ]]; then
    owner=`id -u "$3" 2>/dev/null`
    if [[ ! "$owner" =~ ^[0-9]+$ ]]; then
        echo -e "${RED}Пользователь '$3' не существует${NC}"
        exit 1
    fi
    filter="--uid-owner"
elif [[ "$2" == "group" ]]; then
    owner=`id -g "$3" 2>/dev/null`
    if [[ ! "$owner" =~ ^[0-9]+$ ]]; then
        echo -e "${RED}Пользователь '$3' не существует${NC}"
        exit 1
    fi
    filter="--gid-owner"
else
    echo -e "${RED}Неизвестный фильтр '$2'${NC}"
    exit 1
fi

iptables -t nat "$op" OUTPUT -d "$virt_addr" -p tcp -m tcp -m owner "$filter" "$owner" --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports "$tor_port"
iptables -t nat "$op" OUTPUT -p udp -m udp -m owner "$filter" "$owner" --dport 53 -j REDIRECT --to-ports "$dns_port"
for lan in $non_tor; do
    iptables -t nat "$op" OUTPUT -m owner "$filter" "$owner" -d "$lan" -j RETURN
done
iptables -t nat "$op" OUTPUT -m owner "$filter" "$owner" -o lo -j RETURN
iptables -t nat "$op" OUTPUT -p tcp -m tcp -m owner "$filter" "$owner" --tcp-flags FIN,SYN,RST,ACK SYN -j REDIRECT --to-ports "$tor_port"

iptables "$op" OUTPUT -m owner "$filter" "$owner" -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT
for lan in $non_tor; do
    iptables "$op" OUTPUT -m owner "$filter" "$owner" -d "$lan" -j ACCEPT
done
iptables "$op" OUTPUT -m owner "$filter" "$owner" -d 127.0.0.1/32 -o lo -j ACCEPT
iptables "$op" OUTPUT -m owner "$filter" "$owner" -d 127.0.0.1/32 -p tcp -m tcp --dport "$tor_port" --tcp-flags FIN,SYN,RST,ACK SYN -j ACCEPT
iptables "$op" OUTPUT -m owner "$filter" "$owner" -d 127.0.0.1/32 -p udp -m udp --dport "$dns_port" -j ACCEPT
iptables "$op" OUTPUT -m owner "$filter" "$owner" -j DROP

#/etc/tor/torrc
VirtualAddrNetworkIPv4 10.192.0.0/10
AutomapHostsOnResolve 1
TransPort 9040
DNSPort 9053

su
useradd torify -m
iptables_torify.bash add group torify
iptables-save >> "/etc/iptables/iptables.rules"
systemctl enable iptables.service
systemctl enable tor
reboot

#setgid_torify.cpp
#include <cstdlib>
#include <unistd.h>
#include <string>
#include <cstring>
#include <cassert>
#include <cstdio>

using namespace std;

string e(const char *s) {
    string res;
    for (size_t i = 0, l = strlen(s); i < l; ++i) {
        if(s[i] == '\'') res += "'\\''";
        else res.push_back(s[i]);
    }
    return res;
}

uint32_t id(const char *s) {
    FILE *p = popen(s, "r");
    assert(p);
    char ch;
    uint32_t i = 0;
    do {
        ch = fgetc(p);
        if (ch >= '0' && ch <= '9') i = i * 10 + (ch - '0');
    } while(ch != EOF);
    pclose(p);
    assert(i != 0);
    return i;
}

int main(int argc, const char *argv[]) {
    string s;
    for (int i = 1; i < argc; ++i) {
        s.push_back('\'');
        s += e(argv[i]);
        s.push_back('\'');
        if (i + 1 < argc) s.push_back(' ');
    }
    uint32_t torify_gid = id("id -g torify");
    setgid(torify_gid);
    setuid(getuid());
    if (getgid() == torify_gid)
        return system(s.c_str());
    else
        printf("setgid_torify: failed to setgid\n");
    return 1;
}

g++ setgid_torify.cpp -o setgid_torify -O2 -Wall
sudo chown root:root setgid_torify
sudo chmod 4755 setgid_torify
# Если кто не умеет

[Match]
Name=enp3s0

[Network]
# IPv6
Address=2a01:***:***::55/64
Gateway=fe80::1

[Unit]
Description=WireGuard Client

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/ip netns add vpn0
ExecStart=/bin/ip link set enp3s0 down
ExecStart=/bin/ip link set enp3s0 netns vpn0
ExecStart=/bin/ip -n vpn0 link add wg0 type wireguard
ExecStart=/bin/ip -n vpn0 link set wg0 netns 1

# Здесь нужно как-то запустить networkd-unit внутри network namespace, чтобы был выход в интернет.

ExecStart=/bin/ip address add fc00::10/64  dev wg0
ExecStart=/bin/ip address add 192.168.***.5/24 dev wg0
ExecStart=/bin/wg setconf wg0 /etc/wireguard/client.conf
ExecStart=/bin/ip link set mtu 1400 dev wg0
ExecStart=/bin/ip link set wg0 up 
ExecStart=/bin/ip route add default dev wg0
ExecStart=/bin/ip -6 route add default dev wg0

ExecStart=/bin/dnscrypt-proxy /etc/dnscrypt-proxy.conf

ExecStop=/bin/ip -n vpn0 link set enp3s0 down
ExecStop=/bin/ip -n vpn0 link set enp3s0 netns 1
ExecStop=/bin/ip link del wg0
ExecStop=/bin/ip netns del vpn0
ExecStop=/bin/killall dnscrypt-proxy

[Install]
WantedBy=multi-user.target

port 1194
proto tcp
dev tun
sndbuf 0
rcvbuf 0
ca ca.crt
cert server.crt
key server.key
dh dh.pem
tls-auth ta.key 0
topology subnet
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "redirect-gateway def1 bypass-dhcp"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 10 120
cipher AES-256-CBC
comp-lzo
user nobody
group nogroup
persist-key
persist-tun
status openvpn-status.log
verb 3
crl-verify crl.pem

client
dev tun
proto tcp
sndbuf 0
rcvbuf 0
remote xxx.xxx.xxx.xxx 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-CBC
comp-lzo
setenv opt block-outside-dns
key-direction 1
verb 3

route-nopull
route 54.82.83.140 #Сервис проверки ip

modprobe mpls_router
modprobe mpls_gso
modprobe mpls_iptunnel
sysctl -w net.mpls.conf.lo.input=1
sysctl -w net.mpls.platform_labels=1048575
ip link add veth0 type veth peer name veth1
ip link add veth2 type veth peer name veth3
sysctl -w net.mpls.conf.veth0.input=1
sysctl -w net.mpls.conf.veth2.input=1
ifconfig veth0 10.3.3.1/24 up
ifconfig veth2 10.4.4.1/24 up
ip netns add host1
ip netns add host2
ip link set veth1 netns host1
ip link set veth3 netns host2
ip netns exec host1 ifconfig veth1 10.3.3.2/24 up
ip netns exec host2 ifconfig veth3 10.4.4.2/24 up
ip netns exec host1 ip route add 10.10.10.2/32 encap mpls 112 via inet 10.3.3.1
ip netns exec host2 ip route add 10.10.10.1/32 encap mpls 111 via inet 10.4.4.1
ip -f mpls route add 111 via inet 10.3.3.2
ip -f mpls route add 112 via inet 10.4.4.2
ip netns exec host1 bash
ifconfig lo up
ip addr add 10.10.10.1/32 dev lo
ip netns exec host2 bash
ifconfig lo up
ip addr add 10.10.10.2/32 dev lo
ip netns exec host1 bash

Host1:
root@ne-vlezay80:~# ping 10.10.10.2 -I 10.10.10.1
PING 10.10.10.2 (10.10.10.2) from 10.10.10.1 : 56(84) bytes of data.
64 bytes from 10.10.10.2: icmp_seq=1 ttl=63 time=0.043 ms
64 bytes from 10.10.10.2: icmp_seq=2 ttl=63 time=0.038 ms
64 bytes from 10.10.10.2: icmp_seq=3 ttl=63 time=0.049 ms
64 bytes from 10.10.10.2: icmp_seq=4 ttl=63 time=0.048 ms
64 bytes from 10.10.10.2: icmp_seq=5 ttl=63 time=0.048 ms
64 bytes from 10.10.10.2: icmp_seq=6 ttl=63 time=0.047 ms
64 bytes from 10.10.10.2: icmp_seq=7 ttl=63 time=0.044 ms
64 bytes from 10.10.10.2: icmp_seq=8 ttl=63 time=0.046 ms
^C
--- 10.10.10.2 ping statistics ---
8 packets transmitted, 8 received, 0% packet loss, time 7174ms
rtt min/avg/max/mdev = 0.038/0.045/0.049/0.006 ms
Host2:
root@ne-vlezay80:~# ping 10.10.10.1 -I 10.10.10.2
PING 10.10.10.1 (10.10.10.1) from 10.10.10.2 : 56(84) bytes of data.
64 bytes from 10.10.10.1: icmp_seq=1 ttl=63 time=0.040 ms
64 bytes from 10.10.10.1: icmp_seq=2 ttl=63 time=0.037 ms
64 bytes from 10.10.10.1: icmp_seq=3 ttl=63 time=0.037 ms
64 bytes from 10.10.10.1: icmp_seq=4 ttl=63 time=0.042 ms
64 bytes from 10.10.10.1: icmp_seq=5 ttl=63 time=0.042 ms
64 bytes from 10.10.10.1: icmp_seq=6 ttl=63 time=0.045 ms
64 bytes from 10.10.10.1: icmp_seq=7 ttl=63 time=0.045 ms
64 bytes from 10.10.10.1: icmp_seq=8 ttl=63 time=0.038 ms
^C
--- 10.10.10.1 ping statistics ---
8 packets transmitted, 8 received, 0% packet loss, time 7176ms
rtt min/avg/max/mdev = 0.037/0.040/0.045/0.008 ms

Host1:
iperf3 -s -B 10.10.10.2 -D
Host2:
root@ne-vlezay80:~# ip netns exec host1 bash
root@ne-vlezay80:~# iperf3 -c 10.10.10.2 -B 10.10.10.1   
Connecting to host 10.10.10.2, port 5201
[  4] local 10.10.10.1 port 57039 connected to 10.10.10.2 port 5201
[ ID] Interval           Transfer     Bandwidth       Retr  Cwnd
[  4]   0.00-1.00   sec  2.00 GBytes  17.2 Gbits/sec    0   1.95 MBytes       
[  4]   1.00-2.00   sec  2.01 GBytes  17.2 Gbits/sec    0   1.95 MBytes       
[  4]   2.00-3.00   sec  2.01 GBytes  17.2 Gbits/sec    0   1.95 MBytes       
[  4]   3.00-4.00   sec  2.01 GBytes  17.3 Gbits/sec    0   1.95 MBytes       
[  4]   4.00-5.00   sec  2.01 GBytes  17.2 Gbits/sec    0   1.95 MBytes       
[  4]   5.00-6.00   sec  2.01 GBytes  17.2 Gbits/sec    0   1.95 MBytes       
[  4]   6.00-7.00   sec  2.01 GBytes  17.3 Gbits/sec    0   1.95 MBytes       
[  4]   7.00-8.00   sec  2.01 GBytes  17.3 Gbits/sec    0   1.95 MBytes       
[  4]   8.00-9.00   sec  2.01 GBytes  17.3 Gbits/sec    0   1.95 MBytes       
[  4]   9.00-10.00  sec  2.01 GBytes  17.3 Gbits/sec    0   1.95 MBytes       
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bandwidth       Retr
[  4]   0.00-10.00  sec  20.1 GBytes  17.3 Gbits/sec    0             sender
[  4]   0.00-10.00  sec  20.1 GBytes  17.3 Gbits/sec                  receiver

iperf Done.

root@ne-vlezay80:~# iperf3 -c 10.10.10.2 -B 10.10.10.1 -b -b 1tb
Connecting to host 10.10.10.2, port 5201
[  4] local 10.10.10.1 port 57609 connected to 10.10.10.2 port 5201
[ ID] Interval           Transfer     Bandwidth       Retr  Cwnd
[  4]   0.00-1.00   sec  2.11 GBytes  18.1 Gbits/sec    0   1.95 MBytes       
[  4]   1.00-2.00   sec  2.11 GBytes  18.1 Gbits/sec    0   1.95 MBytes       
[  4]   2.00-3.00   sec  2.11 GBytes  18.1 Gbits/sec    0   1.95 MBytes       
[  4]   3.00-4.00   sec  2.11 GBytes  18.1 Gbits/sec    0   1.95 MBytes       
[  4]   4.00-5.00   sec  2.11 GBytes  18.1 Gbits/sec    0   1.95 MBytes       
[  4]   5.00-6.00   sec  2.11 GBytes  18.1 Gbits/sec    0   1.95 MBytes       
[  4]   6.00-7.00   sec  2.11 GBytes  18.1 Gbits/sec    0   1.95 MBytes       
[  4]   7.00-8.00   sec  2.11 GBytes  18.1 Gbits/sec    0   1.95 MBytes       
[  4]   8.00-9.00   sec  2.11 GBytes  18.1 Gbits/sec    0   1.95 MBytes       
[  4]   9.00-10.00  sec  2.11 GBytes  18.2 Gbits/sec    0   1.95 MBytes       
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bandwidth       Retr
[  4]   0.00-10.00  sec  21.1 GBytes  18.1 Gbits/sec    0             sender
[  4]   0.00-10.00  sec  21.1 GBytes  18.1 Gbits/sec                  receiver

iperf Done.

root@ne-vlezay80:~# tcpdump -i veth2 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on veth2, link-type EN10MB (Ethernet), capture size 262144 bytes
07:02:36.886598 IP 10.10.10.1 > 10.10.10.2: ICMP echo request, id 1677, seq 1, length 64
07:02:36.886617 MPLS (label 111, exp 0, [S], ttl 64) IP 10.10.10.2 > 10.10.10.1: ICMP echo reply, id 1677, seq 1, length 64
07:02:37.895065 IP 10.10.10.1 > 10.10.10.2: ICMP echo request, id 1677, seq 2, length 64
07:02:37.895081 MPLS (label 111, exp 0, [S], ttl 64) IP 10.10.10.2 > 10.10.10.1: ICMP echo reply, id 1677, seq 2, length 64

root@ne-vlezay80:~# tcpdump -i veth0 -n
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on veth0, link-type EN10MB (Ethernet), capture size 262144 bytes
07:03:30.368146 MPLS (label 112, exp 0, [S], ttl 64) IP 10.10.10.1 > 10.10.10.2: ICMP echo request, id 1679, seq 1, length 64
07:03:30.368172 IP 10.10.10.2 > 10.10.10.1: ICMP echo reply, id 1679, seq 1, length 64
07:03:31.399057 MPLS (label 112, exp 0, [S], ttl 64) IP 10.10.10.1 > 10.10.10.2: ICMP echo request, id 1679, seq 2, length 64
07:03:31.399080 IP 10.10.10.2 > 10.10.10.1: ICMP echo reply, id 1679, seq 2, length 64
07:03:32.423182 MPLS (label 112, exp 0, [S], ttl 64) IP 10.10.10.1 > 10.10.10.2: ICMP echo request, id 1679, seq 3, length 64
07:03:32.423210 IP 10.10.10.2 > 10.10.10.1: ICMP echo reply, id 1679, seq 3, length 64
07:03:33.447195 MPLS (label 112, exp 0, [S], ttl 64) IP 10.10.10.1 > 10.10.10.2: ICMP echo request, id 1679, seq 4, length 64
07:03:33.447214 IP 10.10.10.2 > 10.10.10.1: ICMP echo reply, id 1679, seq 4, length 64
07:03:34.471219 MPLS (label 112, exp 0, [S], ttl 64) IP 10.10.10.1 > 10.10.10.2: ICMP echo request, id 1679, seq 5, length 64
07:03:34.471239 IP 10.10.10.2 > 10.10.10.1: ICMP echo reply, id 1679, seq 5, length 64

root@ne-vlezay80:~# ifconfig
lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:2 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:100 (100.0 B)  TX bytes:100 (100.0 B)

veth1     Link encap:Ethernet  HWaddr d2:60:95:e8:a4:d6  
          inet addr:10.3.3.2  Bcast:10.3.3.255  Mask:255.255.255.0
          inet6 addr: fe80::d060:95ff:fee8:a4d6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1047404 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2164674 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:22610878516 (21.0 GiB)  TX bytes:104546390092 (97.3 GiB)

http://api.deckchair.com/v1/cameras

http://api.deckchair.com/v1/viewer/camera/:id

http://api.deckchair.com/v1/viewer/camera/5568862a7b28535025280c72

*/5 * * * * wget -O ~/live_wallpaper/wallpaper.jpg http://api.deckchair.com/v1/viewer/camera/5568862a7b28535025280c72

Intel ACPI Component Architecture
ASL+ Optimizing Compiler version 20160212-64
Copyright (c) 2000 - 2016 Intel Corporation

Input file dsdt.dat, Length 0x161BD (90557) bytes
ACPI: DSDT 0x0000000000000000 0161BD (v02 _ASUS_ Notebook 00000012 INTL 20120711)
Pass 1 parse of [DSDT]
Pass 2 parse of [DSDT]
Parsing Deferred Opcodes (Methods/Buffers/Packages/Regions)

Parsing completed

Found 18 external control methods, reparsing with new information
Pass 1 parse of [DSDT]
Pass 2 parse of [DSDT]
Parsing Deferred Opcodes (Methods/Buffers/Packages/Regions)

Parsing completed
Disassembly completed
ASL Output:    dsdt.dsl - 750692 bytes

Intel ACPI Component Architecture
ASL+ Optimizing Compiler version 20160212-64
Copyright (c) 2000 - 2016 Intel Corporation

Compiler aborting due to parser-detected syntax error(s)
dsdt.dsl   2399:                 Zero
Error    6126 -                    ^ syntax error, unexpected PARSEOP_ZERO

dsdt.dsl   2483:                         Zero
Error    6126 -                            ^ syntax error, unexpected PARSEOP_ZERO

dsdt.dsl  12338:         }
Error    6126 -         ^ syntax error, unexpected '}'

dsdt.dsl  21771:                 Local1 = (0x0A - Local0)
Error    6126 -                      ^ syntax error, unexpected PARSEOP_LOCAL1

dsdt.dsl  24058: 
Error    6126 - syntax error, unexpected $end and premature End-Of-File

ASL Input:     dsdt.dsl - 24058 lines, 750692 bytes, 11855 keywords
Hex Dump:      dsdt.hex - 203 bytes

Compilation complete. 5 Errors, 0 Warnings, 0 Remarks, 0 Optimizations

    + /* Recent (304.64, possibly earlier) versions of the nvidia driver only
    + * report a DFP's native mode through RandR 1.2 / 1.3. Standard DMT modes
    + * are only listed through RandR 1.0 / 1.1. This is completely useless,
    + * but NVIDIA considers this a feature, so it's unlikely to change. The
    + * best we can do is to fall back to RandR 1.0 and encourage users to
    + * consider more cooperative driver vendors when we detect such a
    + * configuration. */

Cmnd_Alias POWER = /usr/bin/systemctl poweroff, \
                   /usr/bin/systemctl halt, \
                   /usr/bin/systemctl reboot

hamsteri ALL=(ALL) ALL
hamsteri ALL=(ALL) NOPASSWD: POWER

$ systemctl reboot
Failed to execute operation: Access denied
Failed to start reboot.target: Access denied

$ sudo systemctl reboot

Section "ServerLayout"
    Identifier  "Layout0"
    Option      "AutoAddDevices" "false"
    Option      "AutoAddGPU" "false"
EndSection

Section "Device"
    Identifier  "DiscreteNvidia"
    Driver      "nvidia"
    VendorName  "NVIDIA Corporation"

#   If the X server does not automatically detect your VGA device,
#   you can manually set it here.
#   To get the BusID prop, run `lspci | egrep 'VGA|3D'` and input the data
#   as you see in the commented example.
#   This Setting may be needed in some platforms with more than one
#   nvidia card, which may confuse the proprietary driver (e.g.,
#   trying to take ownership of the wrong device). Also needed on Ubuntu 13.04.
#   BusID "PCI:01:00:0"

#   Setting ProbeAllGpus to false prevents the new proprietary driver
#   instance spawned to try to control the integrated graphics card,
#   which is already being managed outside bumblebee.
#   This option doesn't hurt and it is required on platforms running
#   more than one nvidia graphics card with the proprietary driver.
#   (E.g. Macbook Pro pre-2010 with nVidia 9400M + 9600M GT).
#   If this option is not set, the new Xorg may blacken the screen and
#   render it unusable (unless you have some way to run killall Xorg).
    Option "ProbeAllGpus" "false"

    Option "NoLogo" "true"
    Option "UseEDID" "false"
    Option "UseDisplayDevice" "none"


EndSection

Section "Screen"
    Identifier "Default Screen"
    Device "DiscreteNvidia"
EndSection