mirror/setup-ipsec-vpn
1
0
Fork 0
mirror of synced 2024-11-29 08:06:04 +03:00
Code Issues Projects Releases Wiki Activity

Improve readability and clean up

Browse Source
This commit is contained in:
hwdsl2 2016-07-10 01:36:41 -05:00
parent 1f76dc169a
commit 004c68f6ad
4 changed files with 86 additions and 96 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
extras/vpnupgrade.sh
View File

@ -111,9 +111,9 @@ apt-get -yq install libnss3-dev libnspr4-dev pkg-config libpam0g-dev \
apt-get -yq --no-install-recommends install xmlto || exiterr2 apt-get -yq --no-install-recommends install xmlto || exiterr2
# Compile and install Libreswan # Compile and install Libreswan
swan_file="libreswan-${swan_ver}.tar.gz" swan_file="libreswan-$swan_ver.tar.gz"
swan_url1="https://download.libreswan.org/$swan_file" swan_url1="https://download.libreswan.org/$swan_file"
swan_url2="https://github.com/libreswan/libreswan/archive/v${swan_ver}.tar.gz" swan_url2="https://github.com/libreswan/libreswan/archive/v$swan_ver.tar.gz"
wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url1" || wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url2" wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url1" || wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url2"
[ "$?" != "0" ] && exiterr "Cannot download Libreswan source." [ "$?" != "0" ] && exiterr "Cannot download Libreswan source."
/bin/rm -rf "/opt/src/libreswan-$swan_ver" /bin/rm -rf "/opt/src/libreswan-$swan_ver"

4
extras/vpnupgrade_centos.sh
View File

@ -113,9 +113,9 @@ elif grep -qs "release 7" /etc/redhat-release; then
fi fi
# Compile and install Libreswan # Compile and install Libreswan
swan_file="libreswan-${swan_ver}.tar.gz" swan_file="libreswan-$swan_ver.tar.gz"
swan_url1="https://download.libreswan.org/$swan_file" swan_url1="https://download.libreswan.org/$swan_file"
swan_url2="https://github.com/libreswan/libreswan/archive/v${swan_ver}.tar.gz" swan_url2="https://github.com/libreswan/libreswan/archive/v$swan_ver.tar.gz"
wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url1" || wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url2" wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url1" || wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url2"
[ "$?" != "0" ] && exiterr "Cannot download Libreswan source." [ "$?" != "0" ] && exiterr "Cannot download Libreswan source."
/bin/rm -rf "/opt/src/libreswan-$swan_ver" /bin/rm -rf "/opt/src/libreswan-$swan_ver"

17
vpnsetup.sh
View File

@ -54,6 +54,7 @@ if [ -z "$eth0_state" ] || [ "$eth0_state" = "down" ]; then
cat 1>&2 <<'EOF' cat 1>&2 <<'EOF'
Error: Network interface 'eth0' is not available. Error: Network interface 'eth0' is not available.
Please DO NOT run this script on your PC or Mac!
Run 'cat /proc/net/dev' to find the active network interface, Run 'cat /proc/net/dev' to find the active network interface,
then use it to replace ALL 'eth0' and 'eth+' in this script. then use it to replace ALL 'eth0' and 'eth+' in this script.
EOF EOF
@ -82,16 +83,14 @@ IMPORTANT: Workaround required for Debian 7 (Wheezy).
You must first run the script at: https://git.io/vpndeb7 You must first run the script at: https://git.io/vpndeb7
If not already done so, press Ctrl-C to interrupt now. If not already done so, press Ctrl-C to interrupt now.
Pausing for 30 seconds... Continuing in 30 seconds ...
EOF EOF
sleep 30 sleep 30
fi fi
cat <<'EOF' echo "VPN setup in progress... Please be patient."
VPN setup in progress... Please be patient. echo
EOF
# Create and change to working dir # Create and change to working dir
mkdir -p /opt/src mkdir -p /opt/src
@ -152,9 +151,9 @@ apt-get -yq install fail2ban || exiterr2
# Compile and install Libreswan # Compile and install Libreswan
swan_ver=3.17 swan_ver=3.17
swan_file="libreswan-${swan_ver}.tar.gz" swan_file="libreswan-$swan_ver.tar.gz"
swan_url1="https://download.libreswan.org/$swan_file" swan_url1="https://download.libreswan.org/$swan_file"
swan_url2="https://github.com/libreswan/libreswan/archive/v${swan_ver}.tar.gz" swan_url2="https://github.com/libreswan/libreswan/archive/v$swan_ver.tar.gz"
wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url1" || wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url2" wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url1" || wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url2"
[ "$?" != "0" ] && exiterr "Cannot download Libreswan source." [ "$?" != "0" ] && exiterr "Cannot download Libreswan source."
/bin/rm -rf "/opt/src/libreswan-$swan_ver" /bin/rm -rf "/opt/src/libreswan-$swan_ver"
@ -326,7 +325,6 @@ if ! grep -qs "hwdsl2 VPN script" /etc/iptables.rules; then
service fail2ban stop >/dev/null 2>&1 service fail2ban stop >/dev/null 2>&1
iptables-save > "/etc/iptables.rules.old-$sys_dt" iptables-save > "/etc/iptables.rules.old-$sys_dt"
sshd_port="$(ss -nlput | grep sshd | awk '{print $5}' | head -n 1 | grep -Eo '[0-9]{1,5}$')" sshd_port="$(ss -nlput | grep sshd | awk '{print $5}' | head -n 1 | grep -Eo '[0-9]{1,5}$')"
if [ "$(iptables-save | grep -c '^\-')" = "0" ] && [ "$sshd_port" = "22" ]; then if [ "$(iptables-save | grep -c '^\-')" = "0" ] && [ "$sshd_port" = "22" ]; then
cat > /etc/iptables.rules <<EOF cat > /etc/iptables.rules <<EOF
# Added by hwdsl2 VPN script # Added by hwdsl2 VPN script
@ -365,9 +363,7 @@ COMMIT
-A POSTROUTING -s 192.168.43.0/24 -o eth+ -m policy --dir out --pol none -j SNAT --to-source $PRIVATE_IP -A POSTROUTING -s 192.168.43.0/24 -o eth+ -m policy --dir out --pol none -j SNAT --to-source $PRIVATE_IP
COMMIT COMMIT
EOF EOF
else else
iptables -I INPUT 1 -p udp -m multiport --dports 500,4500 -j ACCEPT iptables -I INPUT 1 -p udp -m multiport --dports 500,4500 -j ACCEPT
iptables -I INPUT 2 -p udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT iptables -I INPUT 2 -p udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT
iptables -I INPUT 3 -p udp --dport 1701 -j DROP iptables -I INPUT 3 -p udp --dport 1701 -j DROP
@ -383,7 +379,6 @@ iptables -I FORWARD 6 -s 192.168.43.0/24 -o eth+ -j ACCEPT
iptables -A FORWARD -j DROP iptables -A FORWARD -j DROP
iptables -t nat -I POSTROUTING -s 192.168.43.0/24 -o eth+ -m policy --dir out --pol none -j SNAT --to-source "$PRIVATE_IP" iptables -t nat -I POSTROUTING -s 192.168.43.0/24 -o eth+ -m policy --dir out --pol none -j SNAT --to-source "$PRIVATE_IP"
iptables -t nat -I POSTROUTING -s 192.168.42.0/24 -o eth+ -j SNAT --to-source "$PRIVATE_IP" iptables -t nat -I POSTROUTING -s 192.168.42.0/24 -o eth+ -j SNAT --to-source "$PRIVATE_IP"
echo "# Modified by hwdsl2 VPN script" > /etc/iptables.rules echo "# Modified by hwdsl2 VPN script" > /etc/iptables.rules
iptables-save >> /etc/iptables.rules iptables-save >> /etc/iptables.rules
fi fi

15
vpnsetup_centos.sh
View File

@ -57,6 +57,7 @@ if [ -z "$eth0_state" ] || [ "$eth0_state" = "down" ]; then
cat 1>&2 <<'EOF' cat 1>&2 <<'EOF'
Error: Network interface 'eth0' is not available. Error: Network interface 'eth0' is not available.
Please DO NOT run this script on your PC or Mac!
Run 'cat /proc/net/dev' to find the active network interface, Run 'cat /proc/net/dev' to find the active network interface,
then use it to replace ALL 'eth0' and 'eth+' in this script. then use it to replace ALL 'eth0' and 'eth+' in this script.
EOF EOF
@ -79,10 +80,8 @@ if [ -z "$VPN_IPSEC_PSK" ] || [ -z "$VPN_USER" ] || [ -z "$VPN_PASSWORD" ]; then
exiterr "All VPN credentials must be specified. Edit the script and re-enter them." exiterr "All VPN credentials must be specified. Edit the script and re-enter them."
fi fi
cat <<'EOF' echo "VPN setup in progress... Please be patient."
VPN setup in progress... Please be patient. echo
EOF
# Create and change to working dir # Create and change to working dir
mkdir -p /opt/src mkdir -p /opt/src
@ -149,9 +148,9 @@ fi
# Compile and install Libreswan # Compile and install Libreswan
swan_ver=3.17 swan_ver=3.17
swan_file="libreswan-${swan_ver}.tar.gz" swan_file="libreswan-$swan_ver.tar.gz"
swan_url1="https://download.libreswan.org/$swan_file" swan_url1="https://download.libreswan.org/$swan_file"
swan_url2="https://github.com/libreswan/libreswan/archive/v${swan_ver}.tar.gz" swan_url2="https://github.com/libreswan/libreswan/archive/v$swan_ver.tar.gz"
wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url1" || wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url2" wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url1" || wget -t 3 -T 30 -nv -O "$swan_file" "$swan_url2"
[ "$?" != "0" ] && exiterr "Cannot download Libreswan source." [ "$?" != "0" ] && exiterr "Cannot download Libreswan source."
/bin/rm -rf "/opt/src/libreswan-$swan_ver" /bin/rm -rf "/opt/src/libreswan-$swan_ver"
@ -320,7 +319,6 @@ if ! grep -qs "hwdsl2 VPN script" /etc/sysconfig/iptables; then
service fail2ban stop >/dev/null 2>&1 service fail2ban stop >/dev/null 2>&1
iptables-save > "/etc/sysconfig/iptables.old-$sys_dt" iptables-save > "/etc/sysconfig/iptables.old-$sys_dt"
sshd_port="$(ss -nlput | grep sshd | awk '{print $5}' | head -n 1 | grep -Eo '[0-9]{1,5}$')" sshd_port="$(ss -nlput | grep sshd | awk '{print $5}' | head -n 1 | grep -Eo '[0-9]{1,5}$')"
if [ "$(iptables-save | grep -c '^\-')" = "0" ] && [ "$sshd_port" = "22" ]; then if [ "$(iptables-save | grep -c '^\-')" = "0" ] && [ "$sshd_port" = "22" ]; then
cat > /etc/sysconfig/iptables <<EOF cat > /etc/sysconfig/iptables <<EOF
# Added by hwdsl2 VPN script # Added by hwdsl2 VPN script
@ -358,9 +356,7 @@ COMMIT
-A POSTROUTING -s 192.168.43.0/24 -o eth+ -m policy --dir out --pol none -j SNAT --to-source $PRIVATE_IP -A POSTROUTING -s 192.168.43.0/24 -o eth+ -m policy --dir out --pol none -j SNAT --to-source $PRIVATE_IP
COMMIT COMMIT
EOF EOF
else else
iptables -I INPUT 1 -p udp -m multiport --dports 500,4500 -j ACCEPT iptables -I INPUT 1 -p udp -m multiport --dports 500,4500 -j ACCEPT
iptables -I INPUT 2 -p udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT iptables -I INPUT 2 -p udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT
iptables -I INPUT 3 -p udp --dport 1701 -j DROP iptables -I INPUT 3 -p udp --dport 1701 -j DROP
@ -376,7 +372,6 @@ iptables -I FORWARD 6 -s 192.168.43.0/24 -o eth+ -j ACCEPT
iptables -A FORWARD -j DROP iptables -A FORWARD -j DROP
iptables -t nat -I POSTROUTING -s 192.168.43.0/24 -o eth+ -m policy --dir out --pol none -j SNAT --to-source "$PRIVATE_IP" iptables -t nat -I POSTROUTING -s 192.168.43.0/24 -o eth+ -m policy --dir out --pol none -j SNAT --to-source "$PRIVATE_IP"
iptables -t nat -I POSTROUTING -s 192.168.42.0/24 -o eth+ -j SNAT --to-source "$PRIVATE_IP" iptables -t nat -I POSTROUTING -s 192.168.42.0/24 -o eth+ -j SNAT --to-source "$PRIVATE_IP"
echo "# Modified by hwdsl2 VPN script" > /etc/sysconfig/iptables echo "# Modified by hwdsl2 VPN script" > /etc/sysconfig/iptables
iptables-save >> /etc/sysconfig/iptables iptables-save >> /etc/sysconfig/iptables
fi fi