mirror of
https://github.com/kiddin9/op-packages.git
synced 2026-11-03 00:03:56 +08:00
🤞 Sync 2026-10-06 13:52:46
This commit is contained in:
github-actions[bot] committed
1 parent
4d2d69bed9
commit
947eaea2ee
42 files changed
+2681
-1582
No files matched your search
@@ -6,13 +6,13 @@
|
||||
include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=luci-app-ipsec-server
|
||||
PKG_VERSION:=20211223
|
||||
PKG_RELEASE:=1
|
||||
PKG_VERSION:=20260815
|
||||
PKG_RELEASE:=2
|
||||
|
||||
PKG_MAINTAINER:=Lienol <lawlienol@gmail.com>
|
||||
|
||||
LUCI_TITLE:=LuCI support for IPSec VPN Server
|
||||
LUCI_DEPENDS:=+kmod-tun +luci-lib-jsonc +strongswan +strongswan-minimal +strongswan-mod-kernel-libipsec +strongswan-mod-openssl +strongswan-mod-xauth-generic +xl2tpd
|
||||
LUCI_DEPENDS:=+kmod-tun +luci-lib-jsonc +strongswan +strongswan-minimal +strongswan-mod-kernel-libipsec +strongswan-mod-openssl +strongswan-mod-xauth-generic +strongswan-mod-eap-mschapv2 +strongswan-mod-eap-identity +strongswan-mod-pem +strongswan-mod-pkcs1 +strongswan-mod-pkcs8 +strongswan-mod-dhcp +strongswan-mod-farp
|
||||
LUCI_PKGARCH:=all
|
||||
|
||||
define Package/$(PKG_NAME)/conffiles
|
||||
|
||||
@@ -0,0 +1,26 @@
|
||||
conn ikev2-EAP
|
||||
keyexchange=ikev2
|
||||
auto=add
|
||||
fragmentation=yes
|
||||
forceencaps=yes
|
||||
|
||||
left=%defaultroute
|
||||
leftid=@ns.miaogongzi.cc
|
||||
leftauth=pubkey
|
||||
leftcert=full.pem
|
||||
leftsendcert=always
|
||||
leftsubnet=0.0.0.0/0
|
||||
|
||||
right=%any
|
||||
rightid=%any
|
||||
rightauth=eap-mschapv2
|
||||
eap_identity=%identity
|
||||
rightsourceip=10.0.20.0/24
|
||||
rightdns=10.0.0.1
|
||||
|
||||
ike=aes256-sha256-modp1024,aes256-sha1-modp1024,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha256-modp2048,aes256-sha1-modp2048
|
||||
esp=aes256-sha256,aes128-sha256,aes256-sha1,aes128-sha1
|
||||
dpdaction=clear
|
||||
dpddelay=30s
|
||||
rekey=no
|
||||
compress=no
|
||||
@@ -11,14 +11,12 @@ function index()
|
||||
entry({"admin", "vpn", "ipsec-server", "settings"}, cbi("ipsec-server/settings"), _("General Settings"), 10).leaf = true
|
||||
entry({"admin", "vpn", "ipsec-server", "users"}, cbi("ipsec-server/users"), _("Users Manager"), 20).leaf = true
|
||||
entry({"admin", "vpn", "ipsec-server", "l2tp_user"}, cbi("ipsec-server/l2tp_user")).leaf = true
|
||||
entry({"admin", "vpn", "ipsec-server", "online"}, cbi("ipsec-server/online"), _("L2TP Online Users"), 30).leaf = true
|
||||
entry({"admin", "vpn", "ipsec-server", "status"}, call("act_status")).leaf = true
|
||||
end
|
||||
|
||||
function act_status()
|
||||
local e = {}
|
||||
e["ipsec_status"] = luci.sys.call("/usr/bin/pgrep ipsec >/dev/null") == 0
|
||||
e["l2tp_status"] = luci.sys.call("top -bn1 | grep -v grep | grep '/var/etc/xl2tpd' >/dev/null") == 0
|
||||
e["ipsec_status"] = luci.sys.call("pidof charon >/dev/null 2>&1") == 0
|
||||
luci.http.prepare_content("application/json")
|
||||
luci.http.write_json(e)
|
||||
end
|
||||
@@ -1,10 +1,10 @@
|
||||
local d = require "luci.dispatcher"
|
||||
local sys = require "luci.sys"
|
||||
local fs = require "nixio.fs"
|
||||
|
||||
m = Map("luci-app-ipsec-server", "L2TP/IPSec PSK " .. translate("Users Manager"))
|
||||
m.redirect = d.build_url("admin", "vpn", "ipsec-server", "users")
|
||||
|
||||
if sys.call("command -v xl2tpd > /dev/null") == 0 then
|
||||
if fs.access("/usr/sbin/xl2tpd") then
|
||||
s = m:section(NamedSection, arg[1], "l2tp_users", "")
|
||||
s.addremove = false
|
||||
s.anonymous = true
|
||||
@@ -19,6 +19,7 @@ if sys.call("command -v xl2tpd > /dev/null") == 0 then
|
||||
|
||||
o = s:option(Value, "password", translate("Password"))
|
||||
o.placeholder = translate("Password")
|
||||
o.password = true
|
||||
o.rmempty = false
|
||||
|
||||
o = s:option(Value, "ipaddress", translate("IP address"))
|
||||
|
||||
@@ -1,83 +0,0 @@
|
||||
local o = require "luci.dispatcher"
|
||||
local fs = require "nixio.fs"
|
||||
local jsonc = require "luci.jsonc"
|
||||
|
||||
local sessions = {}
|
||||
local session_path = "/var/etc/xl2tpd/session"
|
||||
if fs.access(session_path) then
|
||||
for filename in fs.dir(session_path) do
|
||||
local session_file = session_path .. "/" .. filename
|
||||
local file = io.open(session_file, "r")
|
||||
local t = jsonc.parse(file:read("*a"))
|
||||
if t then
|
||||
t.session_file = session_file
|
||||
sessions[#sessions + 1] = t
|
||||
end
|
||||
file:close()
|
||||
end
|
||||
end
|
||||
|
||||
local blacklist = {}
|
||||
local firewall_user_path = "/etc/firewall.user"
|
||||
if fs.access(firewall_user_path) then
|
||||
for line in io.lines(firewall_user_path) do
|
||||
local m = line:match('xl2tpd%-blacklist%-([^\n]+)')
|
||||
if m then
|
||||
local t = {}
|
||||
t.ip = m
|
||||
blacklist[#blacklist + 1] = t
|
||||
end
|
||||
end
|
||||
end
|
||||
|
||||
f = SimpleForm("processes")
|
||||
f.reset = false
|
||||
f.submit = false
|
||||
|
||||
t = f:section(Table, sessions, translate("L2TP Online Users"))
|
||||
t:option(DummyValue, "username", translate("Username"))
|
||||
t:option(DummyValue, "interface", translate("Interface"))
|
||||
t:option(DummyValue, "ip", translate("Client IP"))
|
||||
t:option(DummyValue, "remote_ip", translate("IP address"))
|
||||
t:option(DummyValue, "login_time", translate("Login Time"))
|
||||
|
||||
_blacklist = t:option(Button, "_blacklist", translate("Blacklist"))
|
||||
function _blacklist.render(e, t, a)
|
||||
e.title = translate("Add to Blacklist")
|
||||
e.inputstyle = "remove"
|
||||
Button.render(e, t, a)
|
||||
end
|
||||
function _blacklist.write(t, s)
|
||||
local e = t.map:get(s, "remote_ip")
|
||||
luci.util.execi("echo 'iptables -I INPUT -s %s -p udp -m multiport --dports 500,4500,1701 -j DROP ## xl2tpd-blacklist-%s' >> /etc/firewall.user" % {e, e})
|
||||
luci.util.execi("iptables -I INPUT -s %s -p udp -m multiport --dports 500,4500,1701 -j DROP" % {e})
|
||||
luci.util.execi("rm -f " .. t.map:get(s, "session_file"))
|
||||
null, t.tag_error[s] = luci.sys.process.signal(t.map:get(s, "pid"), 9)
|
||||
luci.http.redirect(o.build_url("admin/vpn/ipsec-server/online"))
|
||||
end
|
||||
|
||||
_kill = t:option(Button, "_kill", translate("Forced offline"))
|
||||
_kill.inputstyle = "remove"
|
||||
function _kill.write(t, s)
|
||||
luci.util.execi("rm -f " .. t.map:get(s, "session_file"))
|
||||
null, t.tag_error[t] = luci.sys.process.signal(t.map:get(s, "pid"), 9)
|
||||
luci.http.redirect(o.build_url("admin/vpn/ipsec-server/online"))
|
||||
end
|
||||
|
||||
t = f:section(Table, blacklist, translate("Blacklist"))
|
||||
t:option(DummyValue, "ip", translate("IP address"))
|
||||
|
||||
_blacklist2 = t:option(Button, "_blacklist2", translate("Blacklist"))
|
||||
function _blacklist2.render(e, t, a)
|
||||
e.title = translate("Remove from Blacklist")
|
||||
e.inputstyle = "apply"
|
||||
Button.render(e, t, a)
|
||||
end
|
||||
function _blacklist2.write(t, s)
|
||||
local e = t.map:get(s, "ip")
|
||||
luci.util.execi("sed -i -e '/## xl2tpd-blacklist-%s/d' /etc/firewall.user" % {e})
|
||||
luci.util.execi("iptables -D INPUT -s %s -p udp -m multiport --dports 500,4500,1701 -j DROP" % {e})
|
||||
luci.http.redirect(o.build_url("admin/vpn/ipsec-server/online"))
|
||||
end
|
||||
|
||||
return f
|
||||
@@ -1,5 +1,3 @@
|
||||
local sys = require "luci.sys"
|
||||
|
||||
m = Map("luci-app-ipsec-server", translate("IPSec VPN Server"))
|
||||
m.template = "ipsec-server/ipsec-server_status"
|
||||
|
||||
@@ -9,56 +7,53 @@ s.anonymous = true
|
||||
o = s:option(DummyValue, "ipsec-server_status", translate("Current Condition"))
|
||||
o.rawhtml = true
|
||||
o.cfgvalue = function(t, n)
|
||||
return '<font class="ipsec-server_status"></font>'
|
||||
return '<span class="ipsec-server-status is-loading" role="status" aria-live="polite">' .. translate("Checking...") .. '</span>'
|
||||
end
|
||||
|
||||
enabled = s:option(Flag, "enabled", translate("Enable"))
|
||||
enabled.description = translate("Use a client that supports IPSec Xauth PSK (iOS or Android) to connect to this server.")
|
||||
enabled.description = translate("Enable IPsec access for IKEv2 PSK, IKEv1 XAuth PSK, and IKEv2 EAP clients.")
|
||||
enabled.default = 0
|
||||
enabled.rmempty = false
|
||||
|
||||
clientip = s:option(Value, "clientip", translate("VPN Client IP"))
|
||||
clientip.description = translate("VPN Client reserved started IP addresses with the same subnet mask, such as: 192.168.100.10/24")
|
||||
clientip.description = translate("VPN client address pool in CIDR notation, such as: 10.0.10.0/24")
|
||||
clientip.datatype = "ip4addr"
|
||||
clientip.optional = false
|
||||
clientip.rmempty = false
|
||||
clientip.placeholder = "10.0.10.0/24"
|
||||
|
||||
serverip = s:option(Value, "serverip", translate("VPN Server IP"))
|
||||
serverip.description = translate("VPN server address and subnet in CIDR notation, such as: 10.0.0.1/24")
|
||||
serverip.datatype = "ip4addr"
|
||||
serverip.optional = false
|
||||
serverip.rmempty = false
|
||||
serverip.placeholder = "10.0.0.1/24"
|
||||
|
||||
domain = s:option(Value, "domain", translate("VPN Domain"))
|
||||
domain.description = translate("Domain name used for IKEv2 certificate and Remote ID, such as: ns.miaogongzi.cc")
|
||||
domain.datatype = "host"
|
||||
domain.optional = false
|
||||
domain.rmempty = false
|
||||
domain.placeholder = "ns.miaogongzi.cc"
|
||||
domain.default = "ns.miaogongzi.cc"
|
||||
|
||||
certs_name = s:option(Value, "certs_name", translate("Certificate File Name"))
|
||||
certs_name.description = translate("Server certificate file name under /etc/ipsec.d/certs/, such as: server.pem")
|
||||
certs_name.optional = false
|
||||
certs_name.rmempty = false
|
||||
certs_name.placeholder = "server.pem"
|
||||
certs_name.default = "server.pem"
|
||||
|
||||
private_key = s:option(Value, "private_key", translate("Private Key File Name"))
|
||||
private_key.description = translate("Server private key file name under /etc/ipsec.d/private/, such as: server_key.pem")
|
||||
private_key.optional = false
|
||||
private_key.rmempty = false
|
||||
private_key.placeholder = "server_key.pem"
|
||||
private_key.default = "server_key.pem"
|
||||
|
||||
secret = s:option(Value, "secret", translate("Secret Pre-Shared Key"))
|
||||
secret.description = translate("Used by IKEv2 PSK and IKEv1 XAuth PSK clients.")
|
||||
secret.password = true
|
||||
|
||||
if sys.call("command -v xl2tpd > /dev/null") == 0 then
|
||||
o = s:option(DummyValue, "l2tp_status", "L2TP " .. translate("Current Condition"))
|
||||
o.rawhtml = true
|
||||
o.cfgvalue = function(t, n)
|
||||
return '<font class="l2tp_status"></font>'
|
||||
end
|
||||
|
||||
o = s:option(Flag, "l2tp_enable", "L2TP " .. translate("Enable"))
|
||||
o.description = translate("Use a client that supports L2TP over IPSec PSK to connect to this server.")
|
||||
o.default = 0
|
||||
o.rmempty = false
|
||||
|
||||
o = s:option(Value, "l2tp_localip", "L2TP " .. translate("Server IP"))
|
||||
o.description = translate("VPN Server IP address, such as: 192.168.101.1")
|
||||
o.datatype = "ip4addr"
|
||||
o.rmempty = true
|
||||
o.default = "192.168.101.1"
|
||||
o.placeholder = o.default
|
||||
|
||||
o = s:option(Value, "l2tp_remoteip", "L2TP " .. translate("Client IP"))
|
||||
o.description = translate("VPN Client IP address range, such as: 192.168.101.10-20")
|
||||
o.rmempty = true
|
||||
o.default = "192.168.101.10-20"
|
||||
o.placeholder = o.default
|
||||
|
||||
if sys.call("ls -L /usr/lib/ipsec/libipsec* 2>/dev/null >/dev/null") == 0 then
|
||||
o = s:option(DummyValue, "_o", " ")
|
||||
o.rawhtml = true
|
||||
o.cfgvalue = function(t, n)
|
||||
return string.format('<a style="color: red">%s</a>', translate("L2TP/IPSec is not compatible with kernel-libipsec, which will disable this module."))
|
||||
end
|
||||
o:depends("l2tp_enable", true)
|
||||
end
|
||||
end
|
||||
secret.rmempty = false
|
||||
|
||||
return m
|
||||
@@ -1,10 +1,10 @@
|
||||
local d = require "luci.dispatcher"
|
||||
local sys = require "luci.sys"
|
||||
local fs = require "nixio.fs"
|
||||
|
||||
m = Map("luci-app-ipsec-server")
|
||||
|
||||
s = m:section(TypedSection, "ipsec_users", "IPSec Xauth PSK " .. translate("Users Manager"))
|
||||
s.description = translate("Use a client that supports IPSec Xauth PSK (iOS or Android) to connect to this server.")
|
||||
s = m:section(TypedSection, "ipsec_users", "IPSec Xauth PSK/EAP " .. translate("Users Manager"))
|
||||
s.description = translate("Use a client that supports IPSec Xauth PSK or IPSec EAP (iOS, Android, macOS, or Windows) to connect to this server.")
|
||||
s.addremove = true
|
||||
s.anonymous = true
|
||||
s.template = "cbi/tblsection"
|
||||
@@ -19,9 +19,10 @@ o.rmempty = false
|
||||
|
||||
o = s:option(Value, "password", translate("Password"))
|
||||
o.placeholder = translate("Password")
|
||||
o.password = true
|
||||
o.rmempty = false
|
||||
|
||||
if sys.call("command -v xl2tpd > /dev/null") == 0 then
|
||||
if fs.access("/usr/sbin/xl2tpd") then
|
||||
s = m:section(TypedSection, "l2tp_users", "L2TP/IPSec PSK " .. translate("Users Manager"))
|
||||
s.description = translate("Use a client that supports L2TP over IPSec PSK to connect to this server.")
|
||||
s.addremove = true
|
||||
@@ -31,7 +32,7 @@ if sys.call("command -v xl2tpd > /dev/null") == 0 then
|
||||
function s.create(e, t)
|
||||
t = TypedSection.create(e, t)
|
||||
luci.http.redirect(e.extedit:format(t))
|
||||
end
|
||||
end
|
||||
|
||||
o = s:option(Flag, "enabled", translate("Enabled"))
|
||||
o.default = 1
|
||||
@@ -43,6 +44,7 @@ if sys.call("command -v xl2tpd > /dev/null") == 0 then
|
||||
|
||||
o = s:option(Value, "password", translate("Password"))
|
||||
o.placeholder = translate("Password")
|
||||
o.password = true
|
||||
o.rmempty = false
|
||||
|
||||
o = s:option(Value, "ipaddress", translate("IP address"))
|
||||
|
||||
@@ -1,21 +1,61 @@
|
||||
<style>
|
||||
.cbi-map {
|
||||
padding-bottom: 30px;
|
||||
}
|
||||
|
||||
.ipsec-server-status {
|
||||
display: inline-flex;
|
||||
align-items: center;
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
.ipsec-server-status::before {
|
||||
width: .65em;
|
||||
height: .65em;
|
||||
margin-right: .55em;
|
||||
border-radius: 50%;
|
||||
background: #6b7280;
|
||||
content: "";
|
||||
}
|
||||
|
||||
.ipsec-server-status.is-running::before {
|
||||
background: #198754;
|
||||
}
|
||||
|
||||
.ipsec-server-status.is-stopped::before {
|
||||
background: #c0392b;
|
||||
}
|
||||
</style>
|
||||
|
||||
<% include("cbi/map") %>
|
||||
|
||||
<script type="text/javascript">//<![CDATA[
|
||||
XHR.poll(2, '<%=luci.dispatcher.build_url("admin", "vpn", "ipsec-server", "status")%>', null,
|
||||
function(x, result)
|
||||
{
|
||||
var ipsec_status = document.getElementsByClassName('ipsec-server_status')[0];
|
||||
if (ipsec_status) {
|
||||
ipsec_status.setAttribute("style","font-weight:bold;");
|
||||
ipsec_status.setAttribute("color",result.ipsec_status ? "green":"red");
|
||||
ipsec_status.innerHTML = result.ipsec_status?'<%=translate("RUNNING")%>':'<%=translate("NOT RUNNING")%>';
|
||||
}
|
||||
var l2tp_status = document.getElementsByClassName('l2tp_status')[0];
|
||||
if (l2tp_status) {
|
||||
l2tp_status.setAttribute("style","font-weight:bold;");
|
||||
l2tp_status.setAttribute("color",result.l2tp_status ? "green":"red");
|
||||
l2tp_status.innerHTML = result.l2tp_status?'<%=translate("RUNNING")%>':'<%=translate("NOT RUNNING")%>';
|
||||
}
|
||||
(function() {
|
||||
var status = document.getElementsByClassName('ipsec-server-status')[0];
|
||||
if (!status) {
|
||||
return;
|
||||
}
|
||||
)
|
||||
|
||||
XHR.poll(5, '<%=luci.dispatcher.build_url("admin", "vpn", "ipsec-server", "status")%>', null,
|
||||
function(x, result) {
|
||||
var className;
|
||||
var label;
|
||||
|
||||
if (!result || typeof result.ipsec_status !== 'boolean') {
|
||||
className = 'ipsec-server-status is-unknown';
|
||||
label = '<%=translate("Status unavailable")%>';
|
||||
}
|
||||
else {
|
||||
className = 'ipsec-server-status ' + (result.ipsec_status ? 'is-running' : 'is-stopped');
|
||||
label = result.ipsec_status ? '<%=translate("RUNNING")%>' : '<%=translate("NOT RUNNING")%>';
|
||||
}
|
||||
|
||||
if (status.className !== className) {
|
||||
status.className = className;
|
||||
status.textContent = label;
|
||||
}
|
||||
}
|
||||
);
|
||||
})();
|
||||
//]]>
|
||||
</script>
|
||||
@@ -1,38 +1,56 @@
|
||||
msgid "IPSec VPN Server"
|
||||
msgstr "IPSec VPN 服务器"
|
||||
|
||||
msgid "Use a client that supports IPSec Xauth PSK (iOS or Android) to connect to this server."
|
||||
msgstr "使用支持 IPSec Xauth PSK（iOS 或 Android）的客户端连接到此服务端。"
|
||||
msgid "Enable IPsec access for IKEv2 PSK, IKEv1 XAuth PSK, and IKEv2 EAP clients."
|
||||
msgstr "启用 IKEv2 PSK、IKEv1 XAuth PSK 和 IKEv2 EAP 客户端接入。"
|
||||
|
||||
msgid "Use a client that supports L2TP over IPSec PSK to connect to this server."
|
||||
msgstr "使用支持 L2TP over IPSec PSK 的客户端连接到此服务端。"
|
||||
msgid "Use a client that supports IPSec Xauth PSK or IPSec EAP (iOS, Android, macOS, or Windows) to connect to this server."
|
||||
msgstr "请使用支持 IPSec Xauth PSK 或 IPSec EAP 的客户端（iOS、Android、macOS、Windows）连接到此服务器。"
|
||||
|
||||
msgid "Current Condition"
|
||||
msgstr "当前状态"
|
||||
|
||||
msgid "General settings"
|
||||
msgid "Checking..."
|
||||
msgstr "正在检查..."
|
||||
|
||||
msgid "Status unavailable"
|
||||
msgstr "状态不可用"
|
||||
|
||||
msgid "General Settings"
|
||||
msgstr "基本设置"
|
||||
|
||||
msgid "Enable"
|
||||
msgstr "启用"
|
||||
|
||||
msgid "Enabled"
|
||||
msgstr "启用"
|
||||
|
||||
msgid "VPN Client IP"
|
||||
msgstr "VPN客户端地址段"
|
||||
msgstr "VPN 客户端地址池"
|
||||
|
||||
msgid "VPN Client reserved started IP addresses with the same subnet mask, such as: 192.168.100.10/24"
|
||||
msgstr "VPN客户端获取IP的起始地址，例如：192.168.100.10/24"
|
||||
msgid "VPN Server IP"
|
||||
msgstr "VPN 服务端地址"
|
||||
|
||||
msgid "VPN client address pool in CIDR notation, such as: 10.0.10.0/24"
|
||||
msgstr "VPN 客户端地址池（CIDR 格式），例如：10.0.10.0/24"
|
||||
|
||||
msgid "VPN server address and subnet in CIDR notation, such as: 10.0.0.1/24"
|
||||
msgstr "VPN 服务端地址和子网（CIDR 格式），例如：10.0.0.1/24"
|
||||
|
||||
msgid "Domain name used for IKEv2 certificate and Remote ID, such as: ns.miaogongzi.cc"
|
||||
msgstr "用于 IKEv2 证书和远程 ID 的域名，例如：ns.miaogongzi.cc"
|
||||
|
||||
msgid "Server private key file name under /etc/ipsec.d/private/, such as: server_key.pem"
|
||||
msgstr "位于 /etc/ipsec.d/private/ 的服务器私钥文件名，例如：server_key.pem"
|
||||
|
||||
msgid "Server certificate file name under /etc/ipsec.d/certs/, such as: server.pem"
|
||||
msgstr "位于 /etc/ipsec.d/certs/ 的服务器证书文件名，例如：server.pem"
|
||||
|
||||
msgid "Secret Pre-Shared Key"
|
||||
msgstr "PSK密钥"
|
||||
msgstr "PSK 密钥"
|
||||
|
||||
msgid "VPN Server IP address, such as: 192.168.101.1"
|
||||
msgstr "VPN服务端IP地址，例如：192.168.101.1"
|
||||
|
||||
msgid "VPN Client IP address range, such as: 192.168.101.10-20"
|
||||
msgstr "VPN客户端获取IP范围，例如：192.168.101.10-20"
|
||||
|
||||
msgid "L2TP/IPSec is not compatible with kernel-libipsec, which will disable this module."
|
||||
msgstr "L2TP/IPSec不兼容kernel-libipsec，开启将会禁用此模块。"
|
||||
msgid "Used by IKEv2 PSK and IKEv1 XAuth PSK clients."
|
||||
msgstr "供 IKEv2 PSK 和 IKEv1 XAuth PSK 客户端使用。"
|
||||
|
||||
msgid "Users Manager"
|
||||
msgstr "用户管理"
|
||||
@@ -49,29 +67,23 @@ msgstr "IP 地址"
|
||||
msgid "Automatically"
|
||||
msgstr "自动分配"
|
||||
|
||||
msgid "Online Users"
|
||||
msgstr "在线用户"
|
||||
msgid "Static Routes"
|
||||
msgstr "静态路由"
|
||||
|
||||
msgid "L2TP Online Users"
|
||||
msgstr "L2TP 在线用户"
|
||||
|
||||
msgid "Login Time"
|
||||
msgstr "登录时间"
|
||||
|
||||
msgid "Blacklist"
|
||||
msgstr "黑名单"
|
||||
|
||||
msgid "Add to Blacklist"
|
||||
msgstr "加入黑名单"
|
||||
|
||||
msgid "Remove from Blacklist"
|
||||
msgstr "移出黑名单"
|
||||
|
||||
msgid "Forced offline"
|
||||
msgstr "强制下线"
|
||||
msgid "Use a client that supports L2TP over IPSec PSK to connect to this server."
|
||||
msgstr "使用支持 L2TP over IPSec PSK 的客户端连接到此服务器。"
|
||||
|
||||
msgid "NOT RUNNING"
|
||||
msgstr "未运行"
|
||||
|
||||
msgid "RUNNING"
|
||||
msgstr "运行中"
|
||||
|
||||
msgid "Certificate File Name"
|
||||
msgstr "证书文件名"
|
||||
|
||||
msgid "Private Key File Name"
|
||||
msgstr "私钥文件名"
|
||||
|
||||
msgid "VPN Domain"
|
||||
msgstr "VPN 域名"
|
||||
@@ -2,6 +2,9 @@
|
||||
config service 'ipsec'
|
||||
option enabled '0'
|
||||
option secret 'ipsec'
|
||||
option clientip '192.168.100.10/24'
|
||||
|
||||
option clientip '10.0.10.0/24'
|
||||
option serverip '10.0.0.1/24'
|
||||
option certs_name 'server.pem'
|
||||
option private_key 'server_key.pem'
|
||||
option domain 'ns.miaogongzi.cc'
|
||||
|
||||
@@ -13,6 +13,10 @@ L2TP_OPTIONS_FILE=${L2TP_PATH}/options.xl2tpd
|
||||
L2TP_LOG_FILE=${L2TP_PATH}/xl2tpd.log
|
||||
|
||||
vt_clientip=$(uci -q get ${CONFIG}.@service[0].clientip)
|
||||
vt_serverip=$(uci -q get ${CONFIG}.@service[0].serverip)
|
||||
certs_name=$(uci -q get ${CONFIG}.@service[0].certs_name)
|
||||
private_key=$(uci -q get ${CONFIG}.@service[0].private_key)
|
||||
vpn_domain=$(uci -q get ${CONFIG}.@service[0].domain)
|
||||
l2tp_enabled=$(uci -q get ${CONFIG}.@service[0].l2tp_enable)
|
||||
l2tp_localip=$(uci -q get ${CONFIG}.@service[0].l2tp_localip)
|
||||
|
||||
@@ -24,8 +28,8 @@ get_enabled_anonymous_secs() {
|
||||
|
||||
ipt_rule() {
|
||||
if [ "$1" = "add" ]; then
|
||||
iptables -t nat -I POSTROUTING -s ${vt_clientip} -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
|
||||
iptables -I forwarding_rule -s ${vt_clientip} -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
|
||||
iptables -t nat -I POSTROUTING -s ${vt_serverip} -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
|
||||
iptables -I forwarding_rule -s ${vt_serverip} -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
|
||||
iptables -I forwarding_rule -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
|
||||
iptables -I forwarding_rule -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
|
||||
iptables -I INPUT -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
|
||||
@@ -70,9 +74,9 @@ gen_include() {
|
||||
|
||||
start() {
|
||||
local vt_enabled=$(uci -q get ${CONFIG}.@service[0].enabled)
|
||||
[ "$vt_enabled" = 0 ] && return 1
|
||||
[ "$vt_enabled" = 1 ] || return 0
|
||||
|
||||
local vt_gateway="${vt_clientip%.*}.1"
|
||||
local vt_gateway="${vt_serverip%.*}.1"
|
||||
local vt_secret=$(uci -q get ${CONFIG}.@service[0].secret)
|
||||
|
||||
local l2tp_enabled=$(uci -q get ${CONFIG}.@service[0].l2tp_enable)
|
||||
@@ -185,8 +189,8 @@ start() {
|
||||
|
||||
conn Non-L2TP
|
||||
leftsubnet=0.0.0.0/0
|
||||
rightsubnet=${vt_clientip}
|
||||
rightsourceip=${vt_clientip}
|
||||
rightsubnet=${vt_serverip}
|
||||
rightsourceip=${vt_serverip}
|
||||
rightdns=${vt_gateway}
|
||||
ike=aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1536
|
||||
esp=aes128-sha1,3des-sha1
|
||||
@@ -198,6 +202,52 @@ start() {
|
||||
leftauth=psk
|
||||
rightauth=psk
|
||||
rightauth2=xauth
|
||||
|
||||
conn IKEv2-PSK
|
||||
keyexchange=ikev2
|
||||
auto=add
|
||||
left=%defaultroute
|
||||
leftauth=psk
|
||||
leftsubnet=0.0.0.0/0
|
||||
right=%any
|
||||
rightauth=psk
|
||||
rightsourceip=${vt_clientip}
|
||||
|
||||
ike=aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1536
|
||||
esp=aes128-sha1,3des-sha1
|
||||
dpdaction=clear
|
||||
dpddelay=30s
|
||||
rekey=no
|
||||
compress=no
|
||||
|
||||
conn ikev2-EAP
|
||||
keyexchange=ikev2
|
||||
auto=add
|
||||
fragmentation=yes
|
||||
forceencaps=yes
|
||||
|
||||
left=%defaultroute
|
||||
leftid=@$vpn_domain
|
||||
leftauth=pubkey
|
||||
leftcert=${certs_name}
|
||||
leftsendcert=always
|
||||
leftsubnet=0.0.0.0/0
|
||||
|
||||
right=%any
|
||||
rightid=%any
|
||||
rightauth=eap-mschapv2
|
||||
eap_identity=%identity
|
||||
rightsourceip=${vt_clientip}
|
||||
rightdns=10.0.0.1
|
||||
|
||||
ike=aes256-sha256-modp1024,aes256-sha1-modp1024,aes128-sha256-modp1024,aes128-sha1-modp1024,aes256-sha256-modp2048,aes256-sha1-modp2048
|
||||
esp=aes256-sha256,aes128-sha256,aes256-sha1,aes128-sha1
|
||||
dpdaction=clear
|
||||
dpddelay=30s
|
||||
rekey=no
|
||||
compress=no
|
||||
|
||||
|
||||
|
||||
$ipsec_l2tp_config
|
||||
EOF
|
||||
@@ -205,6 +255,7 @@ start() {
|
||||
cat > /etc/ipsec.secrets <<-EOF
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
: PSK "$vt_secret"
|
||||
: RSA /etc/ipsec.d/private/$private_key
|
||||
EOF
|
||||
|
||||
local ipsec_users=$(get_enabled_anonymous_secs "@ipsec_users")
|
||||
@@ -220,6 +271,7 @@ start() {
|
||||
[ -n "${u_password}" ] || continue
|
||||
|
||||
echo "${u_username} : XAUTH '${u_password}'" >> ${IPSEC_SECRETS_FILE}
|
||||
echo "${u_username} : EAP '${u_password}'" >> ${IPSEC_SECRETS_FILE}
|
||||
done
|
||||
}
|
||||
unset user
|
||||
@@ -230,7 +282,7 @@ start() {
|
||||
gen_include
|
||||
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
set network.ipsec_server.ipaddr="${vt_clientip%.*}.1"
|
||||
set network.ipsec_server.ipaddr="${vt_serverip%.*}.1"
|
||||
commit network
|
||||
EOF
|
||||
ifup ipsec_server > /dev/null 2>&1
|
||||
@@ -254,7 +306,7 @@ gen_iface_and_firewall() {
|
||||
set network.ipsec_server.device="ipsec0"
|
||||
set network.ipsec_server.device="ipsec0"
|
||||
set network.ipsec_server.proto="static"
|
||||
set network.ipsec_server.ipaddr="${vt_clientip%.*}.1"
|
||||
set network.ipsec_server.ipaddr="${vt_serverip%.*}.1"
|
||||
set network.ipsec_server.netmask="255.255.255.0"
|
||||
commit network
|
||||
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
}
|
||||
EEOF
|
||||
}
|
||||
rm -f /usr/share/ucitrack/luci-app-luci-app-ipsec-server.json
|
||||
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
delete firewall.luci_app_ipsec_server
|
||||
@@ -14,6 +15,7 @@ uci -q batch <<-EOF >/dev/null
|
||||
set firewall.luci_app_ipsec_server.type=script
|
||||
set firewall.luci_app_ipsec_server.path=/var/etc/ipsecvpn.include
|
||||
set firewall.luci_app_ipsec_server.reload=1
|
||||
commit firewall
|
||||
EOF
|
||||
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
|
||||
@@ -1,27 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
_LOGOUT_TIME="$(date "+%Y-%m-%d %H:%M:%S")"
|
||||
CONFIG="luci-app-ipsec-server"
|
||||
L2TP_PATH=/var/etc/xl2tpd
|
||||
L2TP_SESSION_PATH=${L2TP_PATH}/session
|
||||
|
||||
_USERNAME=${PEERNAME}
|
||||
_IFACE=${1}
|
||||
_TTY=${2}
|
||||
_SPEED=${3}
|
||||
_LOCALIP=${4}
|
||||
_PEERIP=${5}
|
||||
_REMOTEIP=${6}
|
||||
_BYTES_SENT=${BYTES_SENT}
|
||||
_BYTES_RCVD=${BYTES_RCVD}
|
||||
_CONNECT_TIME=${CONNECT_TIME}
|
||||
|
||||
rm -f ${L2TP_SESSION_PATH}/${_USERNAME}.${_IFACE}
|
||||
rm -f /var/run/${_IFACE}.pid
|
||||
|
||||
#可根据退出的账号自定义脚本，如静态路由表，组网等。
|
||||
SCRIPT="/usr/share/xl2tpd/ip-down.d/${_USERNAME}"
|
||||
[ -s "$SCRIPT" ] && {
|
||||
[ ! -x "$SCRIPT" ] && chmod 0755 "$SCRIPT"
|
||||
"$SCRIPT" "$@"
|
||||
}
|
||||
@@ -1,58 +0,0 @@
|
||||
#!/bin/sh
|
||||
|
||||
_LOGIN_TIME="$(date "+%Y-%m-%d %H:%M:%S")"
|
||||
CONFIG="luci-app-ipsec-server"
|
||||
L2TP_PATH=/var/etc/xl2tpd
|
||||
L2TP_SESSION_PATH=${L2TP_PATH}/session
|
||||
|
||||
_USERNAME=${PEERNAME}
|
||||
_IFACE=${1}
|
||||
_TTY=${2}
|
||||
_SPEED=${3}
|
||||
_LOCALIP=${4}
|
||||
_PEERIP=${5}
|
||||
|
||||
_PID=$(cat /var/run/${_IFACE}.pid 2>/dev/null)
|
||||
_REMOTEIP=$(cat /var/etc/xl2tpd/xl2tpd.log 2>/dev/null | grep "PID: ${_PID}" | grep -o -E '([0-9]{1,3}[\.]){3}[0-9]{1,3}')
|
||||
|
||||
mkdir -p ${L2TP_SESSION_PATH}
|
||||
|
||||
cat <<-EOF > ${L2TP_SESSION_PATH}/${_USERNAME}.${_IFACE}
|
||||
{
|
||||
"username": "${_USERNAME}",
|
||||
"interface": "${_IFACE}",
|
||||
"tty": "${_TTY}",
|
||||
"speed": "${_SPEED}",
|
||||
"ip": "${_PEERIP}",
|
||||
"remote_ip": "${_REMOTEIP}",
|
||||
"pid": "${_PID}",
|
||||
"login_time": "${_LOGIN_TIME}"
|
||||
}
|
||||
EOF
|
||||
|
||||
#只能单用户使用
|
||||
cfgid=$(uci show ${CONFIG} | grep "@l2tp_users" | grep "\.username='${_USERNAME}'" | cut -d '.' -sf 2)
|
||||
[ -n "$cfgid" ] && {
|
||||
HAS_LOGIN=$(ls ${L2TP_SESSION_PATH} | grep "^${_USERNAME}\.ppp" | grep -v "${_IFACE}")
|
||||
[ -n "$HAS_LOGIN" ] && {
|
||||
#踢出之前的用户
|
||||
KO_IFACE=$(echo $HAS_LOGIN | awk -F '.' '{print $2}')
|
||||
KO_PID=$(cat /var/run/${KO_IFACE}.pid 2>/dev/null)
|
||||
[ -n "$KO_PID" ] && kill -9 ${KO_PID} >/dev/null 2>&1
|
||||
rm -f ${L2TP_SESSION_PATH}/${HAS_LOGIN}
|
||||
rm -f /var/run/${KO_IFACE}.pid
|
||||
}
|
||||
routes=$(uci -q get ${CONFIG}.${cfgid}.routes)
|
||||
[ -n "$routes" ] && {
|
||||
for router in ${routes}; do
|
||||
route add -net ${router} dev ${_IFACE} >/dev/null 2>&1
|
||||
done
|
||||
}
|
||||
}
|
||||
|
||||
#可根据登录的账号自定义脚本，如组网、日志、限速、权限等特殊待遇。
|
||||
SCRIPT="/usr/share/xl2tpd/ip-up.d/${_USERNAME}"
|
||||
[ -s "$SCRIPT" ] && {
|
||||
[ ! -x "$SCRIPT" ] && chmod 0755 "$SCRIPT"
|
||||
"$SCRIPT" "$@"
|
||||
}
|
||||
Reference in new issue
Block a user