cat > /root/install-orange-ipv6.sh <<'INSTALL'
#!/bin/sh
set -eu
umask 077

PROTO=/lib/netifd/proto/quectel.sh
HOOK=/etc/hotplug.d/iface/98-orange-native-nat66
NFT=/etc/nftables.d/90-orange-lastshot.nft
MARKER=/root/orange-ipv6-installed

die() {
    echo "BLAD: $*" >&2
    exit 1
}

# Ochrona przed instalacja na innym modemie.
[ "$(id -u)" = 0 ] || die "Uruchom jako root."
[ -c /dev/mhi_QMI0 ] || die "Brak /dev/mhi_QMI0."
[ -f "$PROTO" ] || die "Brak protokolu quectel."

for cmd in uci ubus nft fw4 odhcp6c ip; do
    command -v "$cmd" >/dev/null 2>&1 ||
        die "Brak programu: $cmd"
done

sh -n "$PROTO" || die "Niepoprawny quectel.sh."

uci -q get network.lan >/dev/null ||
    die "Brak network.lan."
uci -q get dhcp.lan >/dev/null ||
    die "Brak dhcp.lan."
uci -q get firewall.@defaults[0] >/dev/null ||
    die "Brak ustawien domyslnych firewalla."

if uci -q get network.modem >/dev/null; then
    [ "$(uci -q get network.modem.proto)" = quectel ] ||
        die "network.modem nie korzysta z quectel."
    [ "$(uci -q get network.modem.device)" = /dev/mhi_QMI0 ] ||
        die "network.modem wskazuje inne urzadzenie."
fi

# Nie nakladamy poprawki na poprzednie eksperymenty.
[ ! -e "$MARKER" ] || die "Skrypt byl juz zainstalowany."

for path in \
    "$HOOK" \
    "$NFT" \
    /etc/hotplug.d/iface/99-quectel-ipv6 \
    /etc/nftables.d/10-custom-mss.nft; do
    [ ! -e "$path" ] ||
        die "Istnieje $path. Uzyj czystej konfiguracji."
done

if uci -q get network.orange6 >/dev/null; then
    die "Istnieje orange6. Uzyj czystej konfiguracji."
fi

if grep -Fq '[ "$dhcpv6" = "0" ] && return 0' "$PROTO"; then
    die "Wykryto poprzednia poprawke quectel.sh."
fi

for config in network dhcp firewall; do
    [ -z "$(uci changes "$config")" ] ||
        die "Niezapisane zmiany UCI: $config."
done

# Rozpoznanie stref bez zalozen o ich numeracji.
WAN_ZONE=''
LAN_ZONE=''

for section in $(uci show firewall |
    sed -n 's/^firewall\.\([^=]*\)=zone$/\1/p'); do
    name="$(uci -q get "firewall.$section.name" || true)"
    case "$name" in
        wan) WAN_ZONE="$section" ;;
        lan) LAN_ZONE="$section" ;;
    esac
done

[ -n "$WAN_ZONE" ] || die "Brak strefy wan."
[ -n "$LAN_ZONE" ] || die "Brak strefy lan."

# Kopia i wycofanie wszystkich zmian instalatora.
BACKUP="$(mktemp -d /root/orange-ipv6-backup.XXXXXX)"

for config in network dhcp firewall; do
    cp -p "/etc/config/$config" "$BACKUP/$config"
done

cat > "$BACKUP/restore.sh" <<'RESTORE'
#!/bin/sh
set -eu
DIR="$(CDPATH= cd "$(dirname "$0")" && pwd)"

rm -f \
    /etc/hotplug.d/iface/98-orange-native-nat66 \
    /etc/nftables.d/90-orange-lastshot.nft \
    /root/orange-ipv6-installed

ifdown modem 2>/dev/null || true

for config in network dhcp firewall; do
    uci -q revert "$config" || true
    cp -p "$DIR/$config" "/etc/config/$config"
done

/etc/init.d/network reload
/etc/init.d/firewall restart
/etc/init.d/odhcpd restart

if uci -q get network.modem >/dev/null; then
    ifup modem
fi

echo "Przywrocono konfiguracje sprzed instalacji."
RESTORE

chmod 700 "$BACKUP/restore.sh"

SUCCESS=0

finish() {
    result=$?
    trap - EXIT HUP INT TERM

    if [ "$SUCCESS" != 1 ]; then
        echo "Instalacja przerwana. Przywracanie konfiguracji..."
        sh "$BACKUP/restore.sh" ||
            echo "Wycofanie reczne: sh $BACKUP/restore.sh"
    fi

    exit "$result"
}

trap finish EXIT
trap 'exit 1' HUP INT TERM

# Natywny modem6 zamiast drugiego klienta DHCPv6.
uci set network.modem='interface'
uci set network.modem.proto='quectel'
uci set network.modem.device='/dev/mhi_QMI0'
uci set network.modem.apn='internetipv6'
uci set network.modem.pdptype='ipv4v6'
uci set network.modem.force_apn='1'
uci set network.modem.dhcpv6='1'
uci set network.modem.mtu='1280'
uci set network.modem.sourcefilter='0'
uci set network.modem.delegate='0'
uci set network.modem.defaultroute='1'
uci set network.modem.peerdns='1'
uci set network.modem.metric='11'

# Staly LAN ULA bez przenoszenia publicznego /64 na LAN.
if [ -z "$(uci -q get network.globals.ula_prefix || true)" ]; then
    hex="$(tr -d '-' < /proc/sys/kernel/random/uuid |
        cut -c 1-10)"
    prefix="$(printf '%s' "$hex" |
        sed 's/^\(..\)\(....\)\(....\)$/fd\1:\2:\3::\/48/')"

    uci set network.globals='globals'
    uci set "network.globals.ula_prefix=$prefix"
fi

uci set network.lan.ip6assign='64'
uci -q delete network.lan.ip6class || true
uci add_list network.lan.ip6class='local'

# Brama IPv6 dla ULA; MTU oglaszane klientom.
uci set dhcp.lan.ra='server'
uci set dhcp.lan.dhcpv6='server'
uci set dhcp.lan.ra_slaac='1'
uci set dhcp.lan.ra_default='1'
uci set dhcp.lan.ra_mtu='1280'
uci set dhcp.lan.ndp='disabled'

# NAT44 + NAT66; zachowanie istniejacych sieci WAN.
uci set "firewall.$WAN_ZONE.masq=1"
uci set "firewall.$WAN_ZONE.masq6=1"
uci set "firewall.$WAN_ZONE.mtu_fix=1"

for net in modem modem6; do
    uci -q del_list "firewall.$WAN_ZONE.network=$net" || true
    uci add_list "firewall.$WAN_ZONE.network=$net"
done

# Zapewnienie przekazywania LAN -> WAN.
FORWARDING_FOUND=0

for section in $(uci show firewall |
    sed -n 's/^firewall\.\([^=]*\)=forwarding$/\1/p'); do
    src="$(uci -q get "firewall.$section.src" || true)"
    dst="$(uci -q get "firewall.$section.dest" || true)"

    if [ "$src" = lan ] && [ "$dst" = wan ]; then
        uci set "firewall.$section.enabled=1"
        FORWARDING_FOUND=1
    fi
done

if [ "$FORWARDING_FOUND" = 0 ]; then
    section="$(uci add firewall forwarding)"
    uci set "firewall.$section.src=lan"
    uci set "firewall.$section.dest=wan"
fi

# Wylaczenie standardowego flow offload; nie calego NSS.
uci set firewall.@defaults[0].flow_offloading='0'
uci set firewall.@defaults[0].flow_offloading_hw='0'

mkdir -p /etc/hotplug.d/iface /etc/nftables.d

# Odtworzenie IPv6 po MTU 1252 ustawianym przez modem.
cat > "$HOOK" <<'HOTPLUG'
#!/bin/sh

case "$INTERFACE:$ACTION" in
    modem:ifup|modem:ifupdate|modem6:ifup|modem6:ifupdate) ;;
    *) exit 0 ;;
esac

for dev in rmnet_mhi0 rmnet_mhi0.1; do
    [ -d "/sys/class/net/$dev" ] || continue

    ip link set dev "$dev" mtu 1280 2>/dev/null

    dir="/proc/sys/net/ipv6/conf/$dev"
    [ -d "$dir" ] || continue

    echo 0 > "$dir/disable_ipv6"
    echo 1 > "$dir/forwarding"
    echo 1 > "$dir/autoconf"
    echo 2 > "$dir/accept_ra"
done

logger -t orange-ipv6 \
    "event=$ACTION interface=$INTERFACE device=${DEVICE:-none}"
HOTPLUG

chmod 755 "$HOOK"
sh -n "$HOOK"

# MSS 1180: obejscie problemow duzych segmentow TCP/QMAP.
# Priorytet po automatycznej korekcie MSS przez fw4.
cat > "$NFT" <<'NFTABLES'
chain orange_lastshot_post {
    type filter hook postrouting priority 300; policy accept;

    oifname "rmnet_mhi0.1" tcp flags & (syn | rst) == syn tcp option maxseg size > 1180 counter tcp option maxseg size set 1180 comment "Orange MSS outgoing and router TCP"

    iifname "rmnet_mhi0.1" tcp flags & (syn | rst) == syn tcp option maxseg size > 1180 counter tcp option maxseg size set 1180 comment "Orange MSS forwarded incoming"
}

chain orange_lastshot_input {
    type filter hook input priority 10; policy accept;

    iifname "rmnet_mhi0.1" tcp flags & (syn | rst) == syn tcp option maxseg size > 1180 counter tcp option maxseg size set 1180 comment "Orange MSS incoming router TCP"
}
NFTABLES

chmod 644 "$NFT"

# Kontrola przed zastosowaniem konfiguracji.
if ! fw4 check > "$BACKUP/fw4-check.txt" 2>&1; then
    cat "$BACKUP/fw4-check.txt"
    die "Niepoprawna konfiguracja firewalla."
fi

for config in network dhcp firewall; do
    uci commit "$config"
done

echo "Zestawianie modemu..."
ifdown modem 2>/dev/null || true
sleep 2

/etc/init.d/network reload
/etc/init.d/firewall restart
/etc/init.d/odhcpd restart

nft list chain inet fw4 orange_lastshot_post >/dev/null
nft list chain inet fw4 orange_lastshot_input >/dev/null

ifup modem

printf '%s\n' "$BACKUP" > "$MARKER"
SUCCESS=1
trap - EXIT HUP INT TERM

echo
echo "Konfiguracja zainstalowana."
echo "Oczekiwanie na modem6: do 90 sekund..."

ready=0
i=0

while [ "$i" -lt 45 ]; do
    if ubus call network.interface.modem6 status 2>/dev/null |
        grep -q '"up": true'; then
        ready=1
        break
    fi

    sleep 2
    i=$((i + 1))
done

{
    echo "=== MODEM ==="
    ifstatus modem || true

    echo "=== MODEM6 ==="
    ifstatus modem6 || true

    echo "=== MTU ==="
    ip link show dev rmnet_mhi0 || true
    ip link show dev rmnet_mhi0.1 || true

    echo "=== TRASY IPv6 ==="
    ip -6 route show table all || true

    echo "=== TEST IPv4 ==="
    ping -4 -c 3 -W 2 1.1.1.1 || true

    echo "=== TEST IPv6 ==="
    ping -6 -c 3 -W 2 2606:4700:4700::1111 || true

    echo "=== MSS ==="
    nft list chain inet fw4 orange_lastshot_post || true
    nft list chain inet fw4 orange_lastshot_input || true

    echo "=== LOG ==="
    logread | tail -100
} > "$BACKUP/install-status.txt" 2>&1

if [ "$ready" = 1 ]; then
    echo "modem6 jest aktywny."
else
    echo "UWAGA: modem6 nie osiagnal stanu up w limicie."
    echo "Konfiguracja pozostala zapisana do diagnostyki."
fi

echo
echo "Status: $BACKUP/install-status.txt"
echo "Wycofanie: sh $BACKUP/restore.sh"
echo "Odswiez polaczenie LAN/Wi-Fi i uruchom ponownie przegladarke."
INSTALL

chmod 700 /root/install-orange-ipv6.sh
sh -n /root/install-orange-ipv6.sh &&
sh /root/install-orange-ipv6.sh

root@Exigo_IceG:~# apk update
ERROR: wget: exited with error 4
WARNING: updating and opening [url]https://github.com/4IceG/Modem-extras-apk/raw/refs/heads/main/myapk/packages.adb:[/url] unexpected end of file
ERROR: wget: exited with error 8
WARNING: updating and opening [url]https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/nss/packages.adb:[/url] unexpected end of file
 [[url]https://downloads.openwrt.org/snapshots/targets/qualcommax/ipq50xx/packages/packages.adb[/url]]
 [[url]https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/base/packages.adb[/url]]
 [[url]https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/luci/packages.adb[/url]]
 [[url]https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/packages/packages.adb[/url]]
 [[url]https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/routing/packages.adb[/url]]
 [[url]https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/telephony/packages.adb[/url]]
 [[url]https://downloads.openwrt.org/snapshots/packages/aarch64_cortex-a53/video/packages.adb[/url]]
2 unavailable, 0 stale; 10451 distinct packages available