mirror/setup-ipsec-vpn
1
0
Fork 0
mirror of synced 2024-11-22 21:16:02 +03:00
Code Issues Projects Releases Wiki Activity
455 Commits 1 Branch 0 Tags 20 MiB
4f64a72ed1
Commit Graph

207 Commits

Author SHA1 Message Date
hwdsl2
ff82c3fb6e Improve VPN ciphers 
- Optimize order of VPN ciphers for performance
 2018-11-24 10:30:42 -06:00
hwdsl2
f1c8c06af1 Improve VPN ciphers 
- Replace "aes_gcm256-null,aes_gcm128-null" with "aes_gcm-null" to
  improve compatibility with some Linux kernels
- Ref: https://libreswan.org/wiki/FAQ#Using_aes_gcm_or_aes_ctr_results_in_ERROR:_netlink_response_for_Add_SA_esp.XXXXXXXX.40IPADDRESS_included_errno_22:_Invalid_argument
 2018-11-02 01:54:49 -05:00
hwdsl2
5f75a7306a Improve VPN ciphers 
- Revert 'sha2-truncbug' from 'no' to 'yes' to fix compatibility with
  Android versions 6.x and 7.x.
- Remove aes128-sha2_512 algorithm
- Ref: 732ad1e
 2018-10-28 00:33:42 -05:00
hwdsl2
e8723245f0 Improve VPN config 
- Increase auto-generated IPsec PSK length to 20 characters
- Add a note to README
 2018-10-27 15:22:53 -05:00
hwdsl2
732ad1e941 Improve VPN ciphers 
- Optimize VPN ciphers and their order for improved security and
  compatibility with different OS. Remove 3DES algorithm
- Change 'sha2-truncbug' from 'yes' to 'no'
- Update docs
 2018-10-27 00:53:19 -05:00
hwdsl2
9db710090d Improve VPN ciphers 
- Add AES-GCM cipher for Chromebook compatibility and performance
 2018-10-25 01:25:35 -05:00
hwdsl2
69d1bfe06f Improve IPTables on boot 
- Improve checking for iptables-persistent, and do not add ifupdown
  script /etc/network/if-pre-up.d/iptablesload if it is in use
 2018-10-24 00:56:37 -05:00
hwdsl2
39a92e52c0 Improve IPTables on boot 
- For systems with "netplan" (e.g. Ubuntu 18.04), do not create
  load-iptables-rules service if iptables-persistent is installed
  (to avoid conflicts on boot)
- Ref: cf77372
 2018-10-21 22:05:00 -05:00
hwdsl2
804211c101 Cleanup 2018-10-21 00:20:54 -05:00
hwdsl2
cf7737238d Improve IPTables on boot 
- Improve loading of IPTables rules on boot for systems with "netplan"
  such as Ubuntu 18.04, by creating a systemd service. This is needed
  because ifupdown scripts do not run under netplan
 2018-10-21 00:05:21 -05:00
hwdsl2
a04d2d32e8 New Libreswan version 
- Upgrade Libreswan to 3.27
- Cleanup
 2018-10-09 12:32:28 -05:00
hwdsl2
b803f32b71 New Libreswan version 
- Upgrade to new Libreswan version 3.26
- Ref: https://github.com/libreswan/libreswan/issues/202
- Cleanup
 2018-09-21 23:47:17 -05:00
hwdsl2
95c8a178e7 Improve variables 
- Move SWAN_VER to the top of the scripts
- Add check for Libreswan version
- Cleanup
 2018-09-18 00:57:03 -05:00
hwdsl2
2fe44b172e Improve Libreswan versions 
- Add compilation workarounds specific to Libreswan 3.23/3.25 to the VPN
  setup scripts, so that users may install those versions by modifying
  SWAN_VER before running the scripts
- Cleanup
 2018-09-11 00:03:04 -05:00
hwdsl2
8d90a3877c Add version note 2018-09-10 01:26:31 -05:00
hwdsl2
1227a0ed5d Improve xl2tpd workaround 
- Exclude Ubuntu from xl2tpd 1.3.12 workaround (Ref: 3f8e79b), because
  updated xl2tpd packages are now available for Ubuntu 16.04 and 18.04
  See: https://bugs.launchpad.net/ubuntu/+source/xl2tpd/+bug/1760796
- Add Linux kernel 4.16 to the list of kernels to work around
- Cleanup
 2018-09-04 23:11:59 -05:00
hwdsl2
59f817575c Create rundir 
- Create /run/pluto which is used as rundir in Libreswan 3.22 and newer
- Fixes #407
 2018-06-10 16:08:12 -05:00
hwdsl2
1ff393b91c Use Libreswan 3.22 
- Use Libreswan 3.22 instead of 3.23 due to an issue with connecting
  multiple IPsec/XAuth VPN clients from behind the same NAT
- Ref: c982502 0cf01c0
 2018-06-06 00:40:09 -05:00
hwdsl2
f838fcfe12 Fix IP parsing 
- Fix parsing private IP on some systems such as Ubuntu 18.04
 2018-06-03 23:24:37 -05:00
hwdsl2
95bcadb2c2 Improve VPN ciphers 
- Add back aes256-sha2_512 to phase2alg, required on some Android systems
- Fixes #391
 2018-05-23 19:54:37 -05:00
hwdsl2
8e15eb683c Cleanup 2018-05-23 01:39:53 -05:00
hwdsl2
3f8e79b8e4 Use xl2tpd 1.3.12 
- Install xl2tpd 1.3.12 for systems with Linux kernel 4.14/4.15
- This version fixes an xl2tpd issue under the above Linux kernels
- Remove Linux kernel check and notes which are no longer needed
- Ref: xelerance/xl2tpd#147
- Ref: https://github.com/xelerance/xl2tpd/releases
 2018-05-23 00:38:01 -05:00
hwdsl2
e3fe8b05bf Improve workaround 
- Specify "left=" in ipsec.conf for servers with 'src' in default route
- Ref: https://github.com/libreswan/libreswan/issues/177
 2018-05-21 00:58:24 -05:00
hwdsl2
3b7039ef78 Update Linux kernel check 2018-05-16 22:34:33 -05:00
hwdsl2
738f5d4764 Improve check for apt/dpkg lock 2018-05-13 00:58:43 -05:00
hwdsl2
73a97f2ba4 Cleanup 2018-05-10 21:18:58 -05:00
hwdsl2
f2f6524201 Re-add Android workaround 
- VPN on Android 6.0, 7.0 and 7.1.1 requires sha2-truncbug=yes to work
- Android 5.1, 8.0 and 8.1 also connect OK with this setting
- Ref: https://libreswan.org/wiki/FAQ#Configuration_Matters
 2018-05-08 00:39:52 -05:00
hwdsl2
102ccbc17d Clean up VPN ciphers 
- Remove aes256-sha2_512
- Change sha2-truncbug to no for newer Android versions
- Fixes #303
 2018-05-05 18:51:24 -05:00
hwdsl2
0c6cb4b8a9 Update year 2018-05-05 18:49:38 -05:00
hwdsl2
240a0187f6 Update Linux kernel check 2018-05-04 03:16:58 -05:00
hwdsl2
6a5c14b873 Minor fix 2018-05-03 01:34:05 -05:00
hwdsl2
3c9c3d25a7 Add check for Linux kernel 4.15 2018-05-03 00:52:14 -05:00
hwdsl2
632165685a Add iptables dependency 
- Closes #363
- Thanks @rocboronat!
 2018-05-02 02:58:45 -05:00
Aofei Sheng
a06995d35d Fix iproute for Ubuntu 18.04 (#375) 
The iproute package has been deprecated in Ubuntu 18.04.
 2018-05-01 01:34:04 -05:00
hwdsl2
21228a8caf Improve RPi workarounds 
- Improve workarounds for systems with ARM CPU (e.g. Raspberry Pi)
- Check for ARM architecture instead of checking for Raspbian
 2018-02-03 16:55:54 -06:00
hwdsl2
0cf01c0eb8 Update ipsec.conf 
- Switch to new keyword 'modecfgdns' in Libreswan 3.23
 2018-01-29 02:11:16 -06:00
hwdsl2
3d2b6fc861 Remove RPi workaround 2018-01-29 02:06:08 -06:00
hwdsl2
c982502ad4 Upgrade Libreswan to 3.23 
- Remove 'docker-targets.mk' from Makefile to avoid git errors
  during compilation
 2018-01-29 01:22:24 -06:00
hwdsl2
cc64a29c01 Re-add RPi workaround 
- Libreswan 3.22 may fail to compile on Raspberry Pi w/ Raspbian 9
- Use version 3.21 instead of 3.22 for Raspbian systems
- Ref: d472c65
 2017-12-06 04:55:22 -06:00
hwdsl2
d472c65f8c Remove RPi workaround 
- No longer needed with fix 2dfa587 and 8b40709
- Ref: 1488ac0
 2017-11-13 00:19:21 -06:00
hwdsl2
8b40709d4d Improve VPN ciphers 
- Remove unsupported ESP algorithm on Raspbian
 2017-11-13 00:12:16 -06:00
hwdsl2
2dfa587a71 Fix Libreswan 3.22 bug 
- This bug causes Libreswan 3.22 fail to start on a Raspberry Pi
- Apply fix from Libreswan GitHub repo: libreswan/libreswan@e154ae7
- Ref: https://lists.libreswan.org/pipermail/swan/2017/002338.html
 2017-11-12 23:51:53 -06:00
hwdsl2
7190577c99 Minor clean up 2017-11-01 22:15:56 -05:00
hwdsl2
70c6d6b540 Various clean up 2017-11-01 01:01:49 -05:00
hwdsl2
b7a4bed866 Improve startup 
- Ubuntu 16.04 (and newer) may run apt tasks automatically on boot
- If used as a startup script, apt-get commands could fail due to this
- Wait for apt/dpkg lock (up to 60s) as a workaround
- Ref: #252
 2017-10-30 01:56:00 -05:00
hwdsl2
16e437f58e Minor clean up 
- Wrap the scripts in a big function which is only called at the very end,
  to protect against the possibility of connection interruptions
- Clean up some variables names
 2017-10-29 19:53:35 -05:00
hwdsl2
05c2cb911b Improve sysctl settings 
- Fix kernel.shmmax and kernel.shmall on 32-bit Linux. Thanks @komanshidaruma!
- Clean up other sysctl settings
 2017-10-28 15:40:24 -05:00
hwdsl2
1488ac0ce8 Workaround for Raspberry Pi 
- Libreswan version 3.22 does not start on Raspberry Pi
- Install version 3.21 on these systems as a workaround
 2017-10-27 00:14:38 -05:00
hwdsl2
ef90b6ff19 Upgrade Libreswan to 3.22 2017-10-26 01:48:15 -05:00
hwdsl2
47e1c92051 Clean up ipsec.conf 
- Remove unneeded option nhelpers=0
 2017-10-26 01:48:15 -05:00