cwx/op-packages
1
0 Fork 0
mirror of https://github.com/kiddin9/op-packages.git synced 2026-11-06 11:24:07 +08:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

🍉 Sync 2026-10-06 20:57:57

Browse Source
This commit is contained in:
github-actions[bot] committed 2026-10-06 20:57:57 +08:00
1 parent d42f800eec
commit 6a9b13947b
23 files changed
+991 -507
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

luci-app-ipsec-server/Makefile
+8 -4
View File
@@ -1,4 +1,4 @@
# Copyright (C) 2018-2021 Lienol <lawlienol@gmail.com>
# Copyright (C) 2018-2026 Lienol <lawlienol@gmail.com>
#
# This is free software, licensed under the Apache License, Version 2.0 .
#
@@ -6,13 +6,17 @@
include $(TOPDIR)/rules.mk
PKG_NAME:=luci-app-ipsec-server
PKG_VERSION:=20260815
PKG_RELEASE:=2
PKG_VERSION:=20260807
PKG_RELEASE:=3
PKG_MAINTAINER:=Lienol <lawlienol@gmail.com>
LUCI_TITLE:=LuCI support for IPSec VPN Server
LUCI_DEPENDS:=+kmod-tun +luci-lib-jsonc +strongswan +strongswan-minimal +strongswan-mod-kernel-libipsec +strongswan-mod-openssl +strongswan-mod-xauth-generic +strongswan-mod-eap-mschapv2 +strongswan-mod-eap-identity +strongswan-mod-pem +strongswan-mod-pkcs1 +strongswan-mod-pkcs8 +strongswan-mod-dhcp +strongswan-mod-farp
LUCI_DEPENDS:=+kmod-tun +luci-lib-jsonc +xl2tpd +strongswan \
+PACKAGE_strongswan:strongswan-mod-kernel-libipsec \
+PACKAGE_strongswan:strongswan-mod-openssl \
+PACKAGE_strongswan:strongswan-mod-xauth-generic \
+(PACKAGE_strongswan-mod-kdf||PACKAGE_strongswan-mod-openssl||PACKAGE_strongswan-mod-wolfssl):strongswan-minimal
LUCI_PKGARCH:=all
define Package/$(PKG_NAME)/conffiles
luci-app-ipsec-server/example.config
-26
View File
@@ -1,26 +0,0 @@
conn ikev2-EAP
keyexchange=ikev2
auto=add
fragmentation=yes
forceencaps=yes
left=%defaultroute
leftid=@ns.miaogongzi.cc
leftauth=pubkey
leftcert=full.pem
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightid=%any
rightauth=eap-mschapv2
eap_identity=%identity
rightsourceip=10.0.20.0/24
rightdns=10.0.0.1
ike=aes256-sha256-modp1024,aes256-sha1-modp1024,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha256-modp2048,aes256-sha1-modp2048
esp=aes256-sha256,aes128-sha256,aes256-sha1,aes128-sha1
dpdaction=clear
dpddelay=30s
rekey=no
compress=no
luci-app-ipsec-server/luasrc/controller/ipsec-server.lua
+3 -1
View File
@@ -11,12 +11,14 @@ function index()
entry({"admin", "vpn", "ipsec-server", "settings"}, cbi("ipsec-server/settings"), _("General Settings"), 10).leaf = true
entry({"admin", "vpn", "ipsec-server", "users"}, cbi("ipsec-server/users"), _("Users Manager"), 20).leaf = true
entry({"admin", "vpn", "ipsec-server", "l2tp_user"}, cbi("ipsec-server/l2tp_user")).leaf = true
entry({"admin", "vpn", "ipsec-server", "online"}, cbi("ipsec-server/online"), _("Online Users"), 30).leaf = true
entry({"admin", "vpn", "ipsec-server", "status"}, call("act_status")).leaf = true
end
function act_status()
local e = {}
e["ipsec_status"] = luci.sys.call("pidof charon >/dev/null 2>&1") == 0
e["ipsec_status"] = luci.sys.call("/usr/bin/pgrep ipsec >/dev/null") == 0
e["l2tp_status"] = luci.sys.call("top -bn1 | grep -v grep | grep '/var/etc/xl2tpd' >/dev/null") == 0
luci.http.prepare_content("application/json")
luci.http.write_json(e)
end
luci-app-ipsec-server/luasrc/model/cbi/ipsec-server/l2tp_user.lua
+2 -3
View File
@@ -1,10 +1,10 @@
local d = require "luci.dispatcher"
local fs = require "nixio.fs"
local sys = require "luci.sys"
m = Map("luci-app-ipsec-server", "L2TP/IPSec PSK " .. translate("Users Manager"))
m.redirect = d.build_url("admin", "vpn", "ipsec-server", "users")
if fs.access("/usr/sbin/xl2tpd") then
if sys.call("command -v xl2tpd > /dev/null") == 0 then
s = m:section(NamedSection, arg[1], "l2tp_users", "")
s.addremove = false
s.anonymous = true
@@ -19,7 +19,6 @@ if fs.access("/usr/sbin/xl2tpd") then
o = s:option(Value, "password", translate("Password"))
o.placeholder = translate("Password")
o.password = true
o.rmempty = false
o = s:option(Value, "ipaddress", translate("IP address"))
luci-app-ipsec-server/luasrc/model/cbi/ipsec-server/online.lua
+148
View File
@@ -0,0 +1,148 @@
local d = require "luci.dispatcher"
local fs = require "nixio.fs"
local jsonc = require "luci.jsonc"
local sys = require "luci.sys"
local util = require "luci.util"
local uci = require "luci.model.uci".cursor()
f = SimpleForm("processes")
f.reset = false
f.submit = false
local firewall_user_path = "/etc/firewall.user"
if uci:get("luci-app-ipsec-server", "ipsec", "type") ~= "L2TP" then
local sessions = {}
local status_dump = io.popen('ipsec status 2>&1 | grep "ESTABLISHED"')
if status_dump then
local line
for line in status_dump:lines() do
local line = string.split(line, ",")
local s1 = string.split(line[1], " ")
local type_count = s1[1]
local user = line[2]
local user_split = string.split(user, "...")
if #user_split == 2 then
local leftid = string.match(user_split[1], "%[(.-)%]")
local username = string.match(user_split[2], "%[(.-)%]")
local remote_ip = string.split(user_split[2], "[")[1]
local a = {}
for i, v in ipairs(s1) do
if i > 2 then
a[#a + 1] = v
end
end
local login_time = table.concat(a, " ")
sessions[#sessions + 1] = {
username = username,
remote_ip = remote_ip,
login_time = login_time
}
end
end
end
for i, v in ipairs(sessions) do
local ip = util.exec("ipsec leases 2>/dev/null | grep 'online' | grep '%s' | awk '{print $1}'" % { v.username })
v.ip = ip
end
t = f:section(Table, sessions, translate("Online Users"))
t:option(DummyValue, "username", translate("Username") .. "/" .. translate("Identifier"))
t:option(DummyValue, "ip", translate("Client IP"))
t:option(DummyValue, "login_time", translate("Login Time"))
t:option(DummyValue, "remote_ip", translate("IP address"))
add_blacklist = t:option(Button, "add_blacklist", translate("Blacklist"))
function add_blacklist.render(e, t, a)
e.title = translate("Add to Blacklist")
e.inputstyle = "remove"
Button.render(e, t, a)
end
function add_blacklist.write(t, s)
local e = t.map:get(s, "remote_ip")
util.execi("echo 'iptables -I INPUT -s %s -p udp -m multiport --dports 500,4500 -j DROP ## ipsec-blacklist-%s' >> %s" % {e, e, firewall_user_path})
util.execi("iptables -I INPUT -s %s -p udp -m multiport --dports 500,4500 -j DROP" % {e})
luci.http.redirect(d.build_url("admin/vpn/ipsec-server/online"))
end
else
local l2tp_sessions = {}
local l2tp_session_path = "/var/etc/xl2tpd/session"
if fs.access(l2tp_session_path) then
for filename in fs.dir(l2tp_session_path) do
local session_file = l2tp_session_path .. "/" .. filename
local file = io.open(session_file, "r")
local t = jsonc.parse(file:read("*a"))
if t then
t.session_file = session_file
l2tp_sessions[#l2tp_sessions + 1] = t
end
file:close()
end
end
t = f:section(Table, l2tp_sessions, translate("L2TP Online Users"))
t:option(DummyValue, "username", translate("Username"))
t:option(DummyValue, "interface", translate("Interface"))
t:option(DummyValue, "ip", translate("Client IP"))
t:option(DummyValue, "remote_ip", translate("IP address"))
t:option(DummyValue, "login_time", translate("Login Time"))
_blacklist = t:option(Button, "_blacklist", translate("Blacklist"))
function _blacklist.render(e, t, a)
e.title = translate("Add to Blacklist")
e.inputstyle = "remove"
Button.render(e, t, a)
end
function _blacklist.write(t, s)
local e = t.map:get(s, "remote_ip")
util.execi("echo 'iptables -I INPUT -s %s -p udp -m multiport --dports 500,4500,1701 -j DROP ## xl2tpd-blacklist-%s' >> %s" % {e, e, firewall_user_path})
util.execi("iptables -I INPUT -s %s -p udp -m multiport --dports 500,4500,1701 -j DROP" % {e})
util.execi("rm -f " .. t.map:get(s, "session_file"))
null, t.tag_error[s] = sys.process.signal(t.map:get(s, "pid"), 9)
luci.http.redirect(d.build_url("admin/vpn/ipsec-server/online"))
end
_kill = t:option(Button, "_kill", translate("Forced offline"))
_kill.inputstyle = "remove"
function _kill.write(t, s)
util.execi("rm -f " .. t.map:get(s, "session_file"))
null, t.tag_error[t] = sys.process.signal(t.map:get(s, "pid"), 9)
luci.http.redirect(d.build_url("admin/vpn/ipsec-server/online"))
end
end
local blacklist = {}
if fs.access(firewall_user_path) then
for line in io.lines(firewall_user_path) do
local m = line:match('ipsec%-blacklist%-([^\n]+)')
if m then
local t = {}
t.ip = m
blacklist[#blacklist + 1] = t
end
local m = line:match('xl2tpd%-blacklist%-([^\n]+)')
if m then
local t = {}
t.ip = m
blacklist[#blacklist + 1] = t
end
end
end
t = f:section(Table, blacklist, translate("Blacklist"))
t:option(DummyValue, "ip", translate("IP address"))
remove_blacklist = t:option(Button, "remove_blacklist", translate("Blacklist"))
function remove_blacklist.render(e, t, a)
e.title = translate("Remove from Blacklist")
e.inputstyle = "apply"
Button.render(e, t, a)
end
function remove_blacklist.write(t, s)
local e = t.map:get(s, "ip")
util.execi("sed -i -e '/## ipsec-blacklist-%s/d' %s" % {e, firewall_user_path})
util.execi("sed -i -e '/## xl2tpd-blacklist-%s/d' %s" % {e, firewall_user_path})
util.execi("iptables -D INPUT -s %s -p udp -m multiport --dports 500,4500 -j DROP 2>/dev/null" % {e})
util.execi("iptables -D INPUT -s %s -p udp -m multiport --dports 500,4500,1701 -j DROP 2>/dev/null" % {e})
luci.http.redirect(d.build_url("admin/vpn/ipsec-server/online"))
end
return f
luci-app-ipsec-server/luasrc/model/cbi/ipsec-server/settings.lua
+55 -42
View File
@@ -1,3 +1,5 @@
local sys = require "luci.sys"
m = Map("luci-app-ipsec-server", translate("IPSec VPN Server"))
m.template = "ipsec-server/ipsec-server_status"
@@ -7,53 +9,64 @@ s.anonymous = true
o = s:option(DummyValue, "ipsec-server_status", translate("Current Condition"))
o.rawhtml = true
o.cfgvalue = function(t, n)
return '<span class="ipsec-server-status is-loading" role="status" aria-live="polite">' .. translate("Checking...") .. '</span>'
return '<font class="ipsec-server_status"></font>'
end
enabled = s:option(Flag, "enabled", translate("Enable"))
enabled.description = translate("Enable IPsec access for IKEv2 PSK, IKEv1 XAuth PSK, and IKEv2 EAP clients.")
enabled.default = 0
enabled.rmempty = false
o = s:option(Flag, "enabled", translate("Enable"))
o.default = 0
o.rmempty = false
clientip = s:option(Value, "clientip", translate("VPN Client IP"))
clientip.description = translate("VPN client address pool in CIDR notation, such as: 10.0.10.0/24")
clientip.datatype = "ip4addr"
clientip.optional = false
clientip.rmempty = false
clientip.placeholder = "10.0.10.0/24"
type = s:option(ListValue, "type", translate("Type"))
type:value("IKEv2", "IKEv2/IPSec PSK")
type:value("IKEv1", "IPSec Xauth PSK")
type.default = "IKEv2"
serverip = s:option(Value, "serverip", translate("VPN Server IP"))
serverip.description = translate("VPN server address and subnet in CIDR notation, such as: 10.0.0.1/24")
serverip.datatype = "ip4addr"
serverip.optional = false
serverip.rmempty = false
serverip.placeholder = "10.0.0.1/24"
o = s:option(Value, "clientip", translate("VPN Client IP"))
o.description = translate("VPN Client reserved started IP addresses with the same subnet mask, such as: 192.168.100.10/24")
o.datatype = "ip4addr"
o.optional = false
o:depends("type", "IKEv2")
o:depends("type", "IKEv1")
domain = s:option(Value, "domain", translate("VPN Domain"))
domain.description = translate("Domain name used for IKEv2 certificate and Remote ID, such as: ns.miaogongzi.cc")
domain.datatype = "host"
domain.optional = false
domain.rmempty = false
domain.placeholder = "ns.miaogongzi.cc"
domain.default = "ns.miaogongzi.cc"
certs_name = s:option(Value, "certs_name", translate("Certificate File Name"))
certs_name.description = translate("Server certificate file name under /etc/ipsec.d/certs/, such as: server.pem")
certs_name.optional = false
certs_name.rmempty = false
certs_name.placeholder = "server.pem"
certs_name.default = "server.pem"
private_key = s:option(Value, "private_key", translate("Private Key File Name"))
private_key.description = translate("Server private key file name under /etc/ipsec.d/private/, such as: server_key.pem")
private_key.optional = false
private_key.rmempty = false
private_key.placeholder = "server_key.pem"
private_key.default = "server_key.pem"
secret = s:option(Value, "secret", translate("Secret Pre-Shared Key"))
secret.description = translate("Used by IKEv2 PSK and IKEv1 XAuth PSK clients.")
secret = s:option(Value, "secret", translate("Preshared Key"))
secret.default = "ipsec"
secret.password = true
secret.rmempty = false
secret:depends("type", "IKEv1")
if sys.call("command -v xl2tpd > /dev/null") == 0 then
type:value("L2TP", "L2TP/IPSec PSK")
secret:depends("type", "L2TP")
o = s:option(DummyValue, "l2tp_status", "L2TP " .. translate("Current Condition"))
o.rawhtml = true
o.cfgvalue = function(t, n)
return '<font class="l2tp_status"></font>'
end
o:depends("type", "L2TP")
o = s:option(Value, "l2tp_localip", "L2TP " .. translate("Server IP"))
o.description = translate("VPN Server IP address, such as: 192.168.101.1")
o.datatype = "ip4addr"
o.default = "192.168.101.1"
o.placeholder = o.default
o:depends("type", "L2TP")
o = s:option(Value, "l2tp_remoteip", "L2TP " .. translate("Client IP"))
o.description = translate("VPN Client IP address range, such as: 192.168.101.10-20")
o.default = "192.168.101.10-20"
o.placeholder = o.default
o:depends("type", "L2TP")
--[[
if sys.call("ls -L /usr/lib/ipsec/libipsec* 2>/dev/null >/dev/null") == 0 then
o = s:option(DummyValue, "_o", " ")
o.rawhtml = true
o.cfgvalue = function(t, n)
return string.format('<a style="color: red">%s</a>', translate("L2TP/IPSec is not compatible with kernel-libipsec, which will disable this module."))
end
o:depends("type", "L2TP")
end
]]--
end
return m
luci-app-ipsec-server/luasrc/model/cbi/ipsec-server/users.lua
+38 -18
View File
@@ -1,28 +1,49 @@
local d = require "luci.dispatcher"
local fs = require "nixio.fs"
local sys = require "luci.sys"
m = Map("luci-app-ipsec-server")
s = m:section(TypedSection, "ipsec_users", "IPSec Xauth PSK/EAP " .. translate("Users Manager"))
s.description = translate("Use a client that supports IPSec Xauth PSK or IPSec EAP (iOS, Android, macOS, or Windows) to connect to this server.")
s.addremove = true
s.anonymous = true
s.template = "cbi/tblsection"
local type = m:get("ipsec", "type")
o = s:option(Flag, "enabled", translate("Enabled"))
o.default = 1
o.rmempty = false
if type == "IKEv2" then
s = m:section(TypedSection, "ikev2_users", "IKEv2/IPSec PSK " .. translate("Users Manager"))
s.description = translate("Use a client that supports IKEv2/IPSec PSK (iOS or Android) to connect to this server.")
s.addremove = true
s.anonymous = true
s.template = "cbi/tblsection"
o = s:option(Value, "username", translate("Username"))
o.placeholder = translate("Username")
o.rmempty = false
o = s:option(Flag, "enabled", translate("Enabled"))
o.default = 1
o.rmempty = false
o = s:option(Value, "password", translate("Password"))
o.placeholder = translate("Password")
o.password = true
o.rmempty = false
o = s:option(Value, "identifier", translate("Identifier"))
o.placeholder = translate("Identifier")
o.rmempty = false
if fs.access("/usr/sbin/xl2tpd") then
o = s:option(Value, "secret", translate("Preshared Key"))
o.placeholder = translate("Preshared Key")
o.rmempty = false
end
if type == "IKEv1" then
s = m:section(TypedSection, "ipsec_users", "IPSec Xauth PSK " .. translate("Users Manager"))
s.description = translate("Use a client that supports IPSec Xauth PSK (iOS or Android) to connect to this server.")
s.addremove = true
s.anonymous = true
s.template = "cbi/tblsection"
o = s:option(Flag, "enabled", translate("Enabled"))
o.default = 1
o.rmempty = false
o = s:option(Value, "username", translate("Username"))
o.placeholder = translate("Username")
o.rmempty = false
o = s:option(Value, "password", translate("Password"))
o.placeholder = translate("Password")
o.rmempty = false
end
if type == "L2TP" and sys.call("command -v xl2tpd > /dev/null") == 0 then
s = m:section(TypedSection, "l2tp_users", "L2TP/IPSec PSK " .. translate("Users Manager"))
s.description = translate("Use a client that supports L2TP over IPSec PSK to connect to this server.")
s.addremove = true
@@ -44,7 +65,6 @@ if fs.access("/usr/sbin/xl2tpd") then
o = s:option(Value, "password", translate("Password"))
o.placeholder = translate("Password")
o.password = true
o.rmempty = false
o = s:option(Value, "ipaddress", translate("IP address"))
luci-app-ipsec-server/luasrc/view/ipsec-server/ipsec-server_status.htm
+16 -56
View File
@@ -1,61 +1,21 @@
<style>
.cbi-map {
padding-bottom: 30px;
}
.ipsec-server-status {
display: inline-flex;
align-items: center;
font-weight: 600;
}
.ipsec-server-status::before {
width: .65em;
height: .65em;
margin-right: .55em;
border-radius: 50%;
background: #6b7280;
content: "";
}
.ipsec-server-status.is-running::before {
background: #198754;
}
.ipsec-server-status.is-stopped::before {
background: #c0392b;
}
</style>
<% include("cbi/map") %>
<script type="text/javascript">//<![CDATA[
(function() {
var status = document.getElementsByClassName('ipsec-server-status')[0];
if (!status) {
return;
}
XHR.poll(5, '<%=luci.dispatcher.build_url("admin", "vpn", "ipsec-server", "status")%>', null,
function(x, result) {
var className;
var label;
if (!result || typeof result.ipsec_status !== 'boolean') {
className = 'ipsec-server-status is-unknown';
label = '<%=translate("Status unavailable")%>';
}
else {
className = 'ipsec-server-status ' + (result.ipsec_status ? 'is-running' : 'is-stopped');
label = result.ipsec_status ? '<%=translate("RUNNING")%>' : '<%=translate("NOT RUNNING")%>';
}
if (status.className !== className) {
status.className = className;
status.textContent = label;
}
XHR.poll(2, '<%=luci.dispatcher.build_url("admin", "vpn", "ipsec-server", "status")%>', null,
function(x, result)
{
var ipsec_status = document.getElementsByClassName('ipsec-server_status')[0];
if (ipsec_status) {
ipsec_status.setAttribute("style","font-weight:bold;");
ipsec_status.setAttribute("color",result.ipsec_status ? "green":"red");
ipsec_status.innerHTML = result.ipsec_status?'<%=translate("RUNNING")%>':'<%=translate("NOT RUNNING")%>';
}
);
})();
var l2tp_status = document.getElementsByClassName('l2tp_status')[0];
if (l2tp_status) {
l2tp_status.setAttribute("style","font-weight:bold;");
l2tp_status.setAttribute("color",result.l2tp_status ? "green":"red");
l2tp_status.innerHTML = result.l2tp_status?'<%=translate("RUNNING")%>':'<%=translate("NOT RUNNING")%>';
}
}
)
//]]>
</script>
luci-app-ipsec-server/po/zh-cn/ipsec-server.po
+44 -47
View File
@@ -1,60 +1,51 @@
msgid "IPSec VPN Server"
msgstr "IPSec VPN 服务器"
msgid "Enable IPsec access for IKEv2 PSK, IKEv1 XAuth PSK, and IKEv2 EAP clients."
msgstr "启用 IKEv2 PSK、IKEv1 XAuth PSK 和 IKEv2 EAP 客户端接入。"
msgid "Type"
msgstr "类型"
msgid "Use a client that supports IPSec Xauth PSK or IPSec EAP (iOS, Android, macOS, or Windows) to connect to this server."
msgstr "请使用支持 IPSec Xauth PSK 或 IPSec EAP 的客户端（iOS、Android、macOS、Windows）连接到此服务器。"
msgid "Use a client that supports IKEv2/IPSec PSK (iOS or Android) to connect to this server."
msgstr "使用支持 IKEv2/IPSec PSK（iOS 或 Android）的客户端连接到此服务端。"
msgid "Use a client that supports IPSec Xauth PSK (iOS or Android) to connect to this server."
msgstr "使用支持 IPSec Xauth PSK（iOS 或 Android）的客户端连接到此服务端。"
msgid "Use a client that supports L2TP over IPSec PSK to connect to this server."
msgstr "使用支持 L2TP over IPSec PSK 的客户端连接到此服务端。"
msgid "Current Condition"
msgstr "当前状态"
msgid "Checking..."
msgstr "正在检查..."
msgid "Status unavailable"
msgstr "状态不可用"
msgid "General Settings"
msgid "General settings"
msgstr "基本设置"
msgid "Enable"
msgstr "启用"
msgid "Enabled"
msgstr "启用"
msgid "VPN Client IP"
msgstr "VPN 客户端地址池"
msgstr "VPN客户端地址段"
msgid "VPN Server IP"
msgstr "VPN 服务端地址"
msgid "VPN Client reserved started IP addresses with the same subnet mask, such as: 192.168.100.10/24"
msgstr "VPN客户端获取IP的起始地址，例如：192.168.100.10/24"
msgid "VPN client address pool in CIDR notation, such as: 10.0.10.0/24"
msgstr "VPN 客户端地址池（CIDR 格式），例如：10.0.10.0/24"
msgid "Preshared Key"
msgstr "预共享密钥"
msgid "VPN server address and subnet in CIDR notation, such as: 10.0.0.1/24"
msgstr "VPN 服务端地址和子网（CIDR 格式），例如：10.0.0.1/24"
msgid "VPN Server IP address, such as: 192.168.101.1"
msgstr "VPN服务端IP地址，例如：192.168.101.1"
msgid "Domain name used for IKEv2 certificate and Remote ID, such as: ns.miaogongzi.cc"
msgstr "用于 IKEv2 证书和远程 ID 的域名，例如：ns.miaogongzi.cc"
msgid "VPN Client IP address range, such as: 192.168.101.10-20"
msgstr "VPN客户端获取IP范围，例如：192.168.101.10-20"
msgid "Server private key file name under /etc/ipsec.d/private/, such as: server_key.pem"
msgstr "位于 /etc/ipsec.d/private/ 的服务器私钥文件名，例如：server_key.pem"
msgid "Server certificate file name under /etc/ipsec.d/certs/, such as: server.pem"
msgstr "位于 /etc/ipsec.d/certs/ 的服务器证书文件名，例如：server.pem"
msgid "Secret Pre-Shared Key"
msgstr "PSK 密钥"
msgid "Used by IKEv2 PSK and IKEv1 XAuth PSK clients."
msgstr "供 IKEv2 PSK 和 IKEv1 XAuth PSK 客户端使用。"
msgid "L2TP/IPSec is not compatible with kernel-libipsec, which will disable this module."
msgstr "L2TP/IPSec不兼容kernel-libipsec，开启将会禁用此模块。"
msgid "Users Manager"
msgstr "用户管理"
msgid "Identifier"
msgstr "标识符"
msgid "Username"
msgstr "用户名"
@@ -67,23 +58,29 @@ msgstr "IP 地址"
msgid "Automatically"
msgstr "自动分配"
msgid "Static Routes"
msgstr "静态路由"
msgid "Online Users"
msgstr "在线用户"
msgid "Use a client that supports L2TP over IPSec PSK to connect to this server."
msgstr "使用支持 L2TP over IPSec PSK 的客户端连接到此服务器。"
msgid "L2TP Online Users"
msgstr "L2TP 在线用户"
msgid "Login Time"
msgstr "登录时间"
msgid "Blacklist"
msgstr "黑名单"
msgid "Add to Blacklist"
msgstr "加入黑名单"
msgid "Remove from Blacklist"
msgstr "移出黑名单"
msgid "Forced offline"
msgstr "强制下线"
msgid "NOT RUNNING"
msgstr "未运行"
msgid "RUNNING"
msgstr "运行中"
msgid "Certificate File Name"
msgstr "证书文件名"
msgid "Private Key File Name"
msgstr "私钥文件名"
msgid "VPN Domain"
msgstr "VPN 域名"
luci-app-ipsec-server/root/etc/config/luci-app-ipsec-server
+2 -6
View File
@@ -1,10 +1,6 @@
config service 'ipsec'
option enabled '0'
option secret 'ipsec'
option clientip '10.0.10.0/24'
option serverip '10.0.0.1/24'
option certs_name 'server.pem'
option private_key 'server_key.pem'
option domain 'ns.miaogongzi.cc'
option type 'IKEv2'
option clientip '192.168.100.10/24'
luci-app-ipsec-server/root/etc/init.d/luci-app-ipsec-server
+211 -206
View File
@@ -12,15 +12,13 @@ L2TP_CONFIG_FILE=${L2TP_PATH}/xl2tpd.conf
L2TP_OPTIONS_FILE=${L2TP_PATH}/options.xl2tpd
L2TP_LOG_FILE=${L2TP_PATH}/xl2tpd.log
vt_clientip=$(uci -q get ${CONFIG}.@service[0].clientip)
vt_serverip=$(uci -q get ${CONFIG}.@service[0].serverip)
certs_name=$(uci -q get ${CONFIG}.@service[0].certs_name)
private_key=$(uci -q get ${CONFIG}.@service[0].private_key)
vpn_domain=$(uci -q get ${CONFIG}.@service[0].domain)
l2tp_enabled=$(uci -q get ${CONFIG}.@service[0].l2tp_enable)
l2tp_localip=$(uci -q get ${CONFIG}.@service[0].l2tp_localip)
ipt_comment="IPSec VPN Server"
ipt_flag="IPSec VPN Server"
init_config() {
vt_type=$(uci -q get ${CONFIG}.@service[0].type)
vt_clientip=$(uci -q get ${CONFIG}.@service[0].clientip)
l2tp_localip=$(uci -q get ${CONFIG}.@service[0].l2tp_localip)
}
get_enabled_anonymous_secs() {
uci -q show "${CONFIG}" | grep "${1}\[.*\.enabled='1'" | cut -d '.' -sf2
@@ -28,29 +26,73 @@ get_enabled_anonymous_secs() {
ipt_rule() {
if [ "$1" = "add" ]; then
iptables -t nat -I POSTROUTING -s ${vt_serverip} -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
iptables -I forwarding_rule -s ${vt_serverip} -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
iptables -I forwarding_rule -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
iptables -I forwarding_rule -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
iptables -I INPUT -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
iptables -t mangle -I OUTPUT -p udp -m multiport --sports 500,4500 -m comment --comment "${ipt_flag}" -j RETURN 2>/dev/null
[ "${l2tp_enabled}" = 1 ] && {
iptables -t nat -I POSTROUTING -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
iptables -I forwarding_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
iptables -I INPUT -p udp --dport 1701 -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
iptables -t mangle -I OUTPUT -p udp --sport 1701 -m comment --comment "${ipt_flag}" -j RETURN 2>/dev/null
}
iptables -w -t mangle -I OUTPUT -p udp -m multiport --sports 500,4500 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
iptables -w -I INPUT -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -I FORWARD -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -I FORWARD -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
ip6tables -w -t mangle -I OUTPUT -p udp -m multiport --sports 500,4500 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
ip6tables -w -I INPUT -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
ip6tables -w -I FORWARD -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
ip6tables -w -I FORWARD -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
if [ "${vt_type}" = "L2TP" ]; then
iptables -w -t mangle -I OUTPUT -p udp --sport 1701 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
iptables -w -I INPUT -p udp --dport 1701 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -I INPUT -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -I INPUT -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -I FORWARD -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -I FORWARD -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -I OUTPUT -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -I OUTPUT -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -t nat -I POSTROUTING -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
[ "$?" != "0" ] && iptables -w -t nat -I POSTROUTING -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
iptables -w -t nat -I POSTROUTING -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
[ "$?" != "0" ] && iptables -w -t nat -I POSTROUTING -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
else
iptables -w -I INPUT -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -I INPUT -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -I FORWARD -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -I FORWARD -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -I OUTPUT -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -I OUTPUT -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
iptables -w -t nat -I POSTROUTING -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
[ "$?" != "0" ] && iptables -w -t nat -I POSTROUTING -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
iptables -w -t nat -I POSTROUTING -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
[ "$?" != "0" ] && iptables -w -t nat -I POSTROUTING -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
uci -q batch <<-EOF >/dev/null
delete network.ipsec_server
set network.ipsec_server=interface
set network.ipsec_server.device="ipsec0"
set network.ipsec_server.device="ipsec0"
set network.ipsec_server.proto="static"
set network.ipsec_server.ipaddr="${vt_clientip%.*}.1"
set network.ipsec_server.netmask="255.255.255.0"
commit network
EOF
fi
else
ipt_del() {
for i in $(seq 1 $($1 -nL $2 | grep -c "${ipt_flag}")); do
local index=$($1 --line-number -nL $2 | grep "${ipt_flag}" | head -1 | awk '{print $1}')
for i in $(seq 1 $($1 -nL $2 | grep -c "${ipt_comment}")); do
local index=$($1 --line-number -nL $2 | grep "${ipt_comment}" | head -1 | awk '{print $1}')
$1 -w -D $2 $index 2>/dev/null
done
}
ipt_del "iptables" "forwarding_rule"
ipt_del "iptables" "INPUT"
ipt_del "iptables -t nat" "POSTROUTING"
ipt_del "iptables -t mangle" "OUTPUT"
ipt_del "iptables -w" "INPUT"
ipt_del "iptables -w" "FORWARD"
ipt_del "iptables -w" "OUTPUT"
ipt_del "iptables -w -t nat" "POSTROUTING"
ipt_del "iptables -w -t mangle" "OUTPUT"
ipt_del "ip6tables -w" "INPUT"
ipt_del "ip6tables -w" "FORWARD"
ipt_del "ip6tables -w -t mangle" "OUTPUT"
uci -q batch <<-EOF >/dev/null
delete network.ipsec_server
commit network
EOF
ifup ipsec_server > /dev/null 2>&1
fi
}
@@ -58,50 +100,155 @@ gen_include() {
echo '#!/bin/sh' > /var/etc/ipsecvpn.include
extract_rules() {
echo "*$1"
iptables-save -t $1 | grep "${ipt_flag}" | \
iptables-save -t $1 | grep "${ipt_comment}" | \
sed -e "s/^-A \(INPUT\)/-I \1 1/"
echo 'COMMIT'
}
extract_rules6() {
echo "*$1"
ip6tables-save -t $1 | grep "${ipt_comment}" | \
sed -e "s/^-A \(INPUT\)/-I \1 1/"
echo 'COMMIT'
}
cat <<-EOF >> /var/etc/ipsecvpn.include
iptables-save -c | grep -v "${ipt_flag}" | iptables-restore -c
iptables-save -c | grep -v "${ipt_comment}" | iptables-restore -c
iptables-restore -n <<-EOT
$(extract_rules filter)
$(extract_rules nat)
$(extract_rules mangle)
EOT
ip6tables-save -c | grep -v "${ipt_comment}" | ip6tables-restore -c
ip6tables-restore -n <<-EOT
$(extract_rules6 filter)
$(extract_rules6 mangle)
EOT
exit 0
EOF
return 0
}
start() {
init_config
local vt_enabled=$(uci -q get ${CONFIG}.@service[0].enabled)
[ "$vt_enabled" = 1 ] || return 0
local vt_gateway="${vt_serverip%.*}.1"
local vt_secret=$(uci -q get ${CONFIG}.@service[0].secret)
local l2tp_enabled=$(uci -q get ${CONFIG}.@service[0].l2tp_enable)
[ "${l2tp_enabled}" = 1 ] && {
touch ${CHAP_SECRETS}
local vt_remoteip=$(uci -q get ${CONFIG}.@service[0].l2tp_remoteip)
local ipsec_l2tp_config=$(cat <<-EOF
#######################################
# L2TP Connections
#######################################
[ "$vt_enabled" = 0 ] && return 1
conn L2TP-IKEv1-PSK
type=transport
keyexchange=ikev1
authby=secret
leftprotoport=udp/l2tp
left=%any
right=%any
cat > ${IPSEC_CONN_FILE} <<-EOF
# ipsec.conf - strongSwan IPsec configuration file
config setup
uniqueids=no
charondebug="cfg 2, dmn 2, ike 2, net 0"
conn %default
dpdaction=clear
dpddelay=300s
rekey=no
forceencaps=yes
left=%any
leftfirewall=yes
right=%any
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
auto=add
ike=aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1536
esp=aes128-sha1,3des-sha1
esp=aes128-sha1,aes256-sha256,3des-sha1
EOF
cat > ${IPSEC_SECRETS_FILE} <<-EOF
# /etc/ipsec.secrets - strongSwan IPsec secrets file
EOF
([ "${vt_type}" = "IKEv1" ] || [ "${vt_type}" = "IKEv2" ]) && {
local vt_gateway="${vt_clientip%.*}.1"
cat >> ${IPSEC_CONN_FILE} <<-EOF
conn conn-ipsec
leftsubnet=0.0.0.0/0
rightsubnet=${vt_clientip}
rightsourceip=${vt_clientip}
rightdns=${vt_gateway}
EOF
)
}
[ "${vt_type}" = "IKEv2" ] && {
cat >> ${IPSEC_CONN_FILE} <<-EOF
conn IKEv2-PSK-XAuth
also=conn-ipsec
keyexchange=ikev2
leftauth=psk
rightauth=psk
EOF
local ikev2_users=$(get_enabled_anonymous_secs "@ikev2_users")
[ -n "${ikev2_users}" ] && {
for _user in ${ikev2_users}; do
local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled)
[ "${u_enabled}" -eq 1 ] || continue
local u_identifier=$(uci -q get ${CONFIG}.${_user}.identifier)
[ -n "${u_identifier}" ] || continue
local u_secret=$(uci -q get ${CONFIG}.${_user}.secret)
[ -n "${u_secret}" ] || continue
echo "${u_identifier} : PSK '${u_secret}'" >> ${IPSEC_SECRETS_FILE}
done
}
}
([ "${vt_type}" = "IKEv1" ] || [ "${vt_type}" = "L2TP" ]) && {
cat >> ${IPSEC_CONN_FILE} <<-EOF
conn IKEv1-PSK-XAuth
keyexchange=ikev1
EOF
local vt_secret=$(uci -q get ${CONFIG}.@service[0].secret)
cat >> ${IPSEC_SECRETS_FILE} <<-EOF
: PSK "$vt_secret"
EOF
}
[ "${vt_type}" = "IKEv1" ] && {
cat >> ${IPSEC_CONN_FILE} <<-EOF
also=conn-ipsec
leftauth=psk
rightauth=psk
rightauth2=xauth
EOF
local ipsec_users=$(get_enabled_anonymous_secs "@ipsec_users")
[ -n "${ipsec_users}" ] && {
for _user in ${ipsec_users}; do
local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled)
[ "${u_enabled}" -eq 1 ] || continue
local u_username=$(uci -q get ${CONFIG}.${_user}.username)
[ -n "${u_username}" ] || continue
local u_password=$(uci -q get ${CONFIG}.${_user}.password)
[ -n "${u_password}" ] || continue
echo "${u_username} : XAUTH '${u_password}'" >> ${IPSEC_SECRETS_FILE}
done
}
}
[ "${vt_type}" = "L2TP" ] && {
cat >> ${IPSEC_CONN_FILE} <<-EOF
conn L2TP-IKEv1-PSK
type=transport
keyexchange=ikev1
authby=secret
leftprotoport=udp/1701
left=%any
right=%any
rekey=no
forceencaps=yes
EOF
mkdir -p ${L2TP_PATH}
cat > ${L2TP_OPTIONS_FILE} <<-EOF
name "l2tp-server"
@@ -117,6 +264,7 @@ start() {
lcp-echo-interval 60
connect-delay 5000
EOF
local l2tp_remoteip=$(uci -q get ${CONFIG}.@service[0].l2tp_remoteip)
cat > ${L2TP_CONFIG_FILE} <<-EOF
[global]
port = 1701
@@ -125,7 +273,7 @@ start() {
;debug state = yes
;debug tunnel = yes
[lns default]
ip range = ${vt_remoteip}
ip range = ${l2tp_remoteip}
local ip = ${l2tp_localip}
require chap = yes
refuse pap = yes
@@ -135,192 +283,49 @@ start() {
pppoptfile = ${L2TP_OPTIONS_FILE}
length bit = yes
EOF
touch ${CHAP_SECRETS}
local l2tp_users=$(get_enabled_anonymous_secs "@l2tp_users")
[ -n "${l2tp_users}" ] && {
for _user in ${l2tp_users}; do
local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled)
[ "${u_enabled}" -eq 1 ] || continue
local u_username=$(uci -q get ${CONFIG}.${_user}.username)
[ -n "${u_username}" ] || continue
local u_password=$(uci -q get ${CONFIG}.${_user}.password)
[ -n "${u_password}" ] || continue
local u_ipaddress=$(uci -q get ${CONFIG}.${_user}.ipaddress)
[ -n "${u_ipaddress}" ] || u_ipaddress="*"
echo "${u_username} l2tp-server ${u_password} ${u_ipaddress}" >> ${CHAP_SECRETS}
done
}
unset user
echo "ip-up-script /usr/share/xl2tpd/ip-up" >> ${L2TP_OPTIONS_FILE}
echo "ip-down-script /usr/share/xl2tpd/ip-down" >> ${L2TP_OPTIONS_FILE}
xl2tpd -c ${L2TP_CONFIG_FILE} -C ${L2TP_CONTROL_FILE} -D >${L2TP_LOG_FILE} 2>&1 &
rm -f "/usr/lib/ipsec/libipsec.so.0"
}
cat > ${IPSEC_CONN_FILE} <<-EOF
# ipsec.conf - strongSwan IPsec configuration file
config setup
uniqueids=no
charondebug="cfg 2, dmn 2, ike 2, net 0"
conn %default
dpdaction=clear
dpddelay=300s
rekey=no
left=%defaultroute
leftfirewall=yes
right=%any
ikelifetime=60m
keylife=20m
rekeymargin=3m
keyingtries=1
auto=add
#######################################
# Default non L2TP Connections
#######################################
conn Non-L2TP
leftsubnet=0.0.0.0/0
rightsubnet=${vt_serverip}
rightsourceip=${vt_serverip}
rightdns=${vt_gateway}
ike=aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1536
esp=aes128-sha1,3des-sha1
# Cisco IPSec
conn IKEv1-PSK-XAuth
also=Non-L2TP
keyexchange=ikev1
leftauth=psk
rightauth=psk
rightauth2=xauth
conn IKEv2-PSK
keyexchange=ikev2
auto=add
left=%defaultroute
leftauth=psk
leftsubnet=0.0.0.0/0
right=%any
rightauth=psk
rightsourceip=${vt_clientip}
ike=aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1536
esp=aes128-sha1,3des-sha1
dpdaction=clear
dpddelay=30s
rekey=no
compress=no
conn ikev2-EAP
keyexchange=ikev2
auto=add
fragmentation=yes
forceencaps=yes
left=%defaultroute
leftid=@$vpn_domain
leftauth=pubkey
leftcert=${certs_name}
leftsendcert=always
leftsubnet=0.0.0.0/0
right=%any
rightid=%any
rightauth=eap-mschapv2
eap_identity=%identity
rightsourceip=${vt_clientip}
rightdns=10.0.0.1
ike=aes256-sha256-modp1024,aes256-sha1-modp1024,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha256-modp2048,aes256-sha1-modp2048
esp=aes256-sha256,aes128-sha256,aes256-sha1,aes128-sha1
dpdaction=clear
dpddelay=30s
rekey=no
compress=no
$ipsec_l2tp_config
EOF
cat > /etc/ipsec.secrets <<-EOF
# /etc/ipsec.secrets - strongSwan IPsec secrets file
: PSK "$vt_secret"
: RSA /etc/ipsec.d/private/$private_key
EOF
local ipsec_users=$(get_enabled_anonymous_secs "@ipsec_users")
[ -n "${ipsec_users}" ] && {
for _user in ${ipsec_users}; do
local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled)
[ "${u_enabled}" -eq 1 ] || continue
local u_username=$(uci -q get ${CONFIG}.${_user}.username)
[ -n "${u_username}" ] || continue
local u_password=$(uci -q get ${CONFIG}.${_user}.password)
[ -n "${u_password}" ] || continue
echo "${u_username} : XAUTH '${u_password}'" >> ${IPSEC_SECRETS_FILE}
echo "${u_username} : EAP '${u_password}'" >> ${IPSEC_SECRETS_FILE}
done
}
unset user
ipt_rule add
/usr/lib/ipsec/starter --daemon charon --nofork > /dev/null 2>&1 &
gen_include
uci -q batch <<-EOF >/dev/null
set network.ipsec_server.ipaddr="${vt_serverip%.*}.1"
commit network
EOF
ifup ipsec_server > /dev/null 2>&1
}
stop() {
init_config
ifdown ipsec_server > /dev/null 2>&1
sed -i '/l2tp-server/d' ${CHAP_SECRETS} 2>/dev/null
top -bn1 | grep "${L2TP_PATH}" | grep -v "grep" | awk '{print $1}' | xargs kill -9 >/dev/null 2>&1
rm -rf ${L2TP_PATH}
ps -w | grep "/usr/lib/ipsec" | grep -v "grep" | awk '{print $1}' | xargs kill -9 >/dev/null 2>&1
busybox ps -w | grep "/usr/lib/ipsec" | grep -v "grep" | awk '{print $1}' | xargs kill -9 >/dev/null 2>&1
ipt_rule del
rm -rf /var/etc/ipsecvpn.include
ln -s "libipsec.so.0.0.0" "/usr/lib/ipsec/libipsec.so.0" >/dev/null 2>&1
}
gen_iface_and_firewall() {
uci -q batch <<-EOF >/dev/null
delete network.ipsec_server
set network.ipsec_server=interface
set network.ipsec_server.device="ipsec0"
set network.ipsec_server.device="ipsec0"
set network.ipsec_server.proto="static"
set network.ipsec_server.ipaddr="${vt_serverip%.*}.1"
set network.ipsec_server.netmask="255.255.255.0"
commit network
delete firewall.ipsecserver
set firewall.ipsecserver=zone
set firewall.ipsecserver.name="ipsecserver"
set firewall.ipsecserver.input="ACCEPT"
set firewall.ipsecserver.forward="ACCEPT"
set firewall.ipsecserver.output="ACCEPT"
set firewall.ipsecserver.network="ipsec_server"
commit firewall
EOF
}
if [ -z "$(uci -q get network.ipsec_server)" ] || [ -z "$(uci -q get firewall.ipsecserver)" ]; then
gen_iface_and_firewall
fi
luci-app-ipsec-server/root/etc/uci-defaults/luci-app-ipsec-server
Regular → Executable
+7 -17
View File
@@ -1,29 +1,19 @@
#!/bin/sh
[ ! -f "/usr/share/ucitrack/luci-app-luci-app-ipsec-server.json" ] && {
cat > /usr/share/ucitrack/luci-app-luci-app-ipsec-server.json << EEOF
{
"config": "luci-app-ipsec-server",
"init": "luci-app-ipsec-server"
}
EEOF
}
rm -f /usr/share/ucitrack/luci-app-luci-app-ipsec-server.json
uci -q batch <<-EOF >/dev/null
delete firewall.luci_app_ipsec_server
set firewall.luci_app_ipsec_server=include
set firewall.luci_app_ipsec_server.type=script
set firewall.luci_app_ipsec_server.path=/var/etc/ipsecvpn.include
set firewall.luci_app_ipsec_server.reload=1
commit firewall
EOF
uci -q batch <<-EOF >/dev/null
delete ucitrack.@luci-app-ipsec-server[-1]
add ucitrack luci-app-ipsec-server
set ucitrack.@luci-app-ipsec-server[-1].init=luci-app-ipsec-server
commit ucitrack
EOF
if [ -x "/sbin/fw3" ] && [ ! -L "/sbin/fw3" ]; then
uci -q set firewall.luci_app_ipsec_server.reload='1'
else
uci -q delete firewall.luci_app_ipsec_server.reload
uci -q delete firewall.luci_app_ipsec_server.fw4_compatible
fi
uci commit firewall
/etc/init.d/ipsec disable 2>/dev/null
/etc/init.d/ipsec stop 2>/dev/null
luci-app-ipsec-server/root/usr/share/xl2tpd/ip-down
Executable
+27
View File
@@ -0,0 +1,27 @@
#!/bin/sh
_LOGOUT_TIME="$(date "+%Y-%m-%d %H:%M:%S")"
CONFIG="luci-app-ipsec-server"
L2TP_PATH=/var/etc/xl2tpd
L2TP_SESSION_PATH=${L2TP_PATH}/session
_USERNAME=${PEERNAME}
_IFACE=${1}
_TTY=${2}
_SPEED=${3}
_LOCALIP=${4}
_PEERIP=${5}
_REMOTEIP=${6}
_BYTES_SENT=${BYTES_SENT}
_BYTES_RCVD=${BYTES_RCVD}
_CONNECT_TIME=${CONNECT_TIME}
rm -f ${L2TP_SESSION_PATH}/${_USERNAME}.${_IFACE}
rm -f /var/run/${_IFACE}.pid
#可根据退出的账号自定义脚本，如静态路由表，组网等。
SCRIPT="/usr/share/xl2tpd/ip-down.d/${_USERNAME}"
[ -s "$SCRIPT" ] && {
[ ! -x "$SCRIPT" ] && chmod 0755 "$SCRIPT"
"$SCRIPT" "$@"
}
luci-app-ipsec-server/root/usr/share/xl2tpd/ip-up
Executable
+58
View File
@@ -0,0 +1,58 @@
#!/bin/sh
_LOGIN_TIME="$(date "+%Y-%m-%d %H:%M:%S")"
CONFIG="luci-app-ipsec-server"
L2TP_PATH=/var/etc/xl2tpd
L2TP_SESSION_PATH=${L2TP_PATH}/session
_USERNAME=${PEERNAME}
_IFACE=${1}
_TTY=${2}
_SPEED=${3}
_LOCALIP=${4}
_PEERIP=${5}
_PID=$(cat /var/run/${_IFACE}.pid 2>/dev/null)
_REMOTEIP=$(cat /var/etc/xl2tpd/xl2tpd.log 2>/dev/null | grep "PID: ${_PID}" | grep -o -E '([0-9]{1,3}[\.]){3}[0-9]{1,3}')
mkdir -p ${L2TP_SESSION_PATH}
cat <<-EOF > ${L2TP_SESSION_PATH}/${_USERNAME}.${_IFACE}
{
"username": "${_USERNAME}",
"interface": "${_IFACE}",
"tty": "${_TTY}",
"speed": "${_SPEED}",
"ip": "${_PEERIP}",
"remote_ip": "${_REMOTEIP}",
"pid": "${_PID}",
"login_time": "${_LOGIN_TIME}"
}
EOF
#只能单用户使用
cfgid=$(uci show ${CONFIG} | grep "@l2tp_users" | grep "\.username='${_USERNAME}'" | cut -d '.' -sf 2)
[ -n "$cfgid" ] && {
HAS_LOGIN=$(ls ${L2TP_SESSION_PATH} | grep "^${_USERNAME}\.ppp" | grep -v "${_IFACE}")
[ -n "$HAS_LOGIN" ] && {
#踢出之前的用户
KO_IFACE=$(echo $HAS_LOGIN | awk -F '.' '{print $2}')
KO_PID=$(cat /var/run/${KO_IFACE}.pid 2>/dev/null)
[ -n "$KO_PID" ] && kill -9 ${KO_PID} >/dev/null 2>&1
rm -f ${L2TP_SESSION_PATH}/${HAS_LOGIN}
rm -f /var/run/${KO_IFACE}.pid
}
routes=$(uci -q get ${CONFIG}.${cfgid}.routes)
[ -n "$routes" ] && {
for router in ${routes}; do
route add -net ${router} dev ${_IFACE} >/dev/null 2>&1
done
}
}
#可根据登录的账号自定义脚本，如组网、日志、限速、权限等特殊待遇。
SCRIPT="/usr/share/xl2tpd/ip-up.d/${_USERNAME}"
[ -s "$SCRIPT" ] && {
[ ! -x "$SCRIPT" ] && chmod 0755 "$SCRIPT"
"$SCRIPT" "$@"
}