From 920e7a5fc8de70e95648d6db96e4330c1a91bc72 Mon Sep 17 00:00:00 2001
From: hwdsl2 <hwdsl2@users.noreply.github.com>
Date: Fri, 13 Aug 2021 02:11:49 -0500
Subject: [PATCH] Improve VPN setup

- Add a new wrapper script for IPsec VPN setup on all supported OS.
  The previous vpnsetup.sh has been moved to vpnsetup_ubuntu.sh.
---
 vpnsetup.sh | 232 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 232 insertions(+)
 create mode 100755 vpnsetup.sh

diff --git a/vpnsetup.sh b/vpnsetup.sh
new file mode 100755
index 0000000..3a0a4d6
--- /dev/null
+++ b/vpnsetup.sh
@@ -0,0 +1,232 @@
+#!/bin/sh
+#
+# Script for automatic setup of an IPsec VPN server on Ubuntu, Debian,
+# CentOS/RHEL, Rocky Linux, AlmaLinux and Amazon Linux 2
+# Works on any dedicated server or virtual private server (VPS)
+#
+# DO NOT RUN THIS SCRIPT ON YOUR PC OR MAC!
+#
+# The latest version of this script is available at:
+# https://github.com/hwdsl2/setup-ipsec-vpn
+#
+# Copyright (C) 2021 Lin Song <linsongui@gmail.com>
+#
+# This work is licensed under the Creative Commons Attribution-ShareAlike 3.0
+# Unported License: http://creativecommons.org/licenses/by-sa/3.0/
+#
+# Attribution required: please include my name in any derivative and let me
+# know how you have improved it!
+
+# =====================================================
+
+# Define your own values for these variables
+# - IPsec pre-shared key, VPN username and password
+# - All values MUST be placed inside 'single quotes'
+# - DO NOT use these special characters within values: \ " '
+
+YOUR_IPSEC_PSK=''
+YOUR_USERNAME=''
+YOUR_PASSWORD=''
+
+# Important notes:   https://git.io/vpnnotes
+# Setup VPN clients: https://git.io/vpnclients
+# IKEv2 guide:       https://git.io/ikev2
+
+# =====================================================
+
+export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+exiterr() { echo "Error: $1" >&2; exit 1; }
+
+check_ip() {
+  IP_REGEX='^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$'
+  printf '%s' "$1" | tr -d '\n' | grep -Eq "$IP_REGEX"
+}
+
+check_root() {
+  if [ "$(id -u)" != 0 ]; then
+    exiterr "Script must be run as root. Try 'sudo sh $0'"
+  fi
+}
+
+check_vz() {
+  if [ -f /proc/user_beancounters ]; then
+    exiterr "OpenVZ VPS is not supported."
+  fi
+}
+
+check_os() {
+  os_type=centos
+  rh_file="/etc/redhat-release"
+  if grep -qs "Red Hat" "$rh_file"; then
+    os_type=rhel
+  fi
+  if grep -qs "release 7" "$rh_file"; then
+    os_ver=7
+  elif grep -qs "release 8" "$rh_file"; then
+    os_ver=8
+    grep -qi stream "$rh_file" && os_ver=8s
+    grep -qi rocky "$rh_file" && os_type=rocky
+    grep -qi alma "$rh_file" && os_type=alma
+  elif grep -qs "Amazon Linux release 2" /etc/system-release; then
+    os_type=amzn
+    os_ver=2
+  else
+    os_type=$(lsb_release -si 2>/dev/null)
+    [ -z "$os_type" ] && [ -f /etc/os-release ] && os_type=$(. /etc/os-release && printf '%s' "$ID")
+    case $os_type in
+      [Uu]buntu)
+        os_type=ubuntu
+        ;;
+      [Dd]ebian)
+        os_type=debian
+        ;;
+      [Rr]aspbian)
+        os_type=raspbian
+        ;;
+      *)
+        exiterr "This script only supports Ubuntu, Debian, CentOS/RHEL 7/8 and Amazon Linux 2."
+        ;;
+    esac
+    os_ver=$(sed 's/\..*//' /etc/debian_version | tr -dc 'A-Za-z0-9')
+    if [ "$os_ver" = "8" ] || [ "$os_ver" = "jessiesid" ]; then
+      exiterr "Debian 8 or Ubuntu < 16.04 is not supported."
+    fi
+    if [ "$os_ver" = "10" ] && [ ! -e /dev/ppp ]; then
+      exiterr "/dev/ppp is missing. Debian 10 users, see: https://git.io/vpndebian10"
+    fi
+  fi
+}
+
+check_iface() {
+  def_iface=$(route 2>/dev/null | grep -m 1 '^default' | grep -o '[^ ]*$')
+  [ -z "$def_iface" ] && def_iface=$(ip -4 route list 0/0 2>/dev/null | grep -m 1 -Po '(?<=dev )(\S+)')
+  def_state=$(cat "/sys/class/net/$def_iface/operstate" 2>/dev/null)
+  check_wl=0
+  if [ -n "$def_state" ] && [ "$def_state" != "down" ]; then
+    if [ "$os_type" = "ubuntu" ] || [ "$os_type" = "debian" ] || [ "$os_type" = "raspbian" ]; then
+      if ! uname -m | grep -qi -e '^arm' -e '^aarch64'; then
+        check_wl=1
+      fi
+    else
+      check_wl=1
+    fi
+  fi
+  if [ "$check_wl" = "1" ]; then
+    case $def_iface in
+      wl*)
+        exiterr "Wireless interface '$def_iface' detected. DO NOT run this script on your PC or Mac!"
+        ;;
+    esac
+  fi
+}
+
+check_creds() {
+  [ -n "$YOUR_IPSEC_PSK" ] && VPN_IPSEC_PSK="$YOUR_IPSEC_PSK"
+  [ -n "$YOUR_USERNAME" ] && VPN_USER="$YOUR_USERNAME"
+  [ -n "$YOUR_PASSWORD" ] && VPN_PASSWORD="$YOUR_PASSWORD"
+
+  if [ -z "$VPN_IPSEC_PSK" ] && [ -z "$VPN_USER" ] && [ -z "$VPN_PASSWORD" ]; then
+    return 0
+  fi
+
+  if [ -z "$VPN_IPSEC_PSK" ] || [ -z "$VPN_USER" ] || [ -z "$VPN_PASSWORD" ]; then
+    exiterr "All VPN credentials must be specified. Edit the script and re-enter them."
+  fi
+
+  if printf '%s' "$VPN_IPSEC_PSK $VPN_USER $VPN_PASSWORD" | LC_ALL=C grep -q '[^ -~]\+'; then
+    exiterr "VPN credentials must not contain non-ASCII characters."
+  fi
+
+  case "$VPN_IPSEC_PSK $VPN_USER $VPN_PASSWORD" in
+    *[\\\"\']*)
+      exiterr "VPN credentials must not contain these special characters: \\ \" '"
+      ;;
+  esac
+}
+
+check_dns() {
+  if { [ -n "$VPN_DNS_SRV1" ] && ! check_ip "$VPN_DNS_SRV1"; } \
+    || { [ -n "$VPN_DNS_SRV2" ] && ! check_ip "$VPN_DNS_SRV2"; } then
+    exiterr "The DNS server specified is invalid."
+  fi
+}
+
+check_iptables() {
+  if [ "$os_type" = "ubuntu" ] || [ "$os_type" = "debian" ] || [ "$os_type" = "raspbian" ]; then
+    if [ -x /sbin/iptables ] && ! iptables -nL INPUT >/dev/null 2>&1; then
+      exiterr "IPTables check failed. Reboot and re-run this script."
+    fi
+  fi
+}
+
+install_wget() {
+  if [ "$os_type" = "ubuntu" ] || [ "$os_type" = "debian" ] || [ "$os_type" = "raspbian" ]; then
+    export DEBIAN_FRONTEND=noninteractive
+    (
+      set -x
+      apt-get -yqq update
+    ) || exiterr "'apt-get update' failed."
+    (
+      set -x
+      apt-get -yqq install wget >/dev/null
+    ) || exiterr "'apt-get install wget' failed."
+  else
+    (
+      set -x
+      yum -y -q install wget >/dev/null
+    ) || exiterr "'yum install wget' failed."
+  fi
+}
+
+get_setup_url() {
+  base_url="https://github.com/hwdsl2/setup-ipsec-vpn/raw/master"
+  sh_file="vpnsetup_ubuntu.sh"
+  if [ "$os_type" = "centos" ] || [ "$os_type" = "rhel" ] || [ "$os_type" = "rocky" ] || [ "$os_type" = "alma" ]; then
+    sh_file="vpnsetup_centos.sh"
+  elif [ "$os_type" = "amzn" ]; then
+    sh_file="vpnsetup_amzn.sh"
+  fi
+  setup_url="$base_url/$sh_file"
+}
+
+run_setup() {
+  status=0
+  get_setup_url
+  TMPDIR=$(mktemp -d /tmp/vpnsetup.XXXXX 2>/dev/null)
+  if [ -d "$TMPDIR" ]; then
+    if ( set -x; wget -t 3 -T 30 -q -O "$TMPDIR/vpn.sh" "$setup_url" ); then
+      VPN_IPSEC_PSK="$VPN_IPSEC_PSK" VPN_USER="$VPN_USER" VPN_PASSWORD="$VPN_PASSWORD" \
+      VPN_PUBLIC_IP="$VPN_PUBLIC_IP" VPN_L2TP_NET="$VPN_L2TP_NET" \
+      VPN_L2TP_LOCAL="$VPN_L2TP_LOCAL" VPN_L2TP_POOL="$VPN_L2TP_POOL" \
+      VPN_XAUTH_NET="$VPN_XAUTH_NET" VPN_XAUTH_POOL="$VPN_XAUTH_POOL" \
+      VPN_DNS_SRV1="$VPN_DNS_SRV1" VPN_DNS_SRV2="$VPN_DNS_SRV2" \
+      /bin/sh "$TMPDIR/vpn.sh" || status=1
+    else
+      status=1
+      echo "Error: Could not download VPN setup script." >&2
+    fi
+    /bin/rm -f "$TMPDIR/vpn.sh"
+    /bin/rmdir "$TMPDIR"
+  else
+    exiterr "Could not create temporary directory."
+  fi
+}
+
+vpnsetup() {
+  check_root
+  check_vz
+  check_os
+  check_iface
+  check_creds
+  check_dns
+  check_iptables
+  install_wget
+  get_setup_url
+  run_setup
+}
+
+## Defer setup until we have the complete script
+vpnsetup "$@"
+
+exit "$status"