update 2026-07-28 01:38:11

2026-10-30 07:35:13 +08:00 · 2026-07-28 01:38:11 +08:00
1 parent 20b786ab77
commit 25d570431d
@@ -0,0 +1,41 @@
+
+config openvpn 'myvpn'
+	option enabled '0'
+	option proto 'tcp4'
+	option dev 'tun'
+	option topology 'subnet'
+	option server '10.8.0.0 255.255.255.0'
+	option comp_lzo 'adaptive'
+	option ca '/etc/openvpn/pki/ca.crt'
+	option dh '/etc/openvpn/pki/dh.pem'
+	option cert '/etc/openvpn/pki/server.crt'
+	option key '/etc/openvpn/pki/server.key'
+	option persist_key '1'
+	option persist_tun '1'
+	option max_clients '88'
+	option keepalive '10 120'
+	option verb '3'
+	option status '/var/log/openvpn_status.log'
+	option log '/tmp/openvpn.log'
+	option port '1194'
+	option ddns 'myserver.f3322.net'
+	option auth_user_pass_verify '/etc/openvpn/server/checkpsw.sh via-env'
+	option script_security '3'
+	list push 'route 192.168.9.0 255.255.255.0'
+	list push 'comp-lzo adaptive'
+	list push 'redirect-gateway def1 bypass-dhcp'
+	list push 'dhcp-option DNS 192.168.9.1'
+
+config openvpn 'client1'
+	option enabled '0'
+	option config '/etc/openvpn/client1.conf'
+
+config openvpn 'client2'
+	option enabled '0'
+	option config '/etc/openvpn/client2.conf'
+
+config openvpnpassword 'pwd1'
+	option pwdfile '/etc/openvpn/pass.txt'
+
+config openvpnpassword 'pwd2'
+	option pwdfile '/etc/openvpn/pass2.txt'
@@ -0,0 +1,2 @@
+V	270821142642Z		01	unknown	/C=CN/ST=ZJ/L=ZJ/O=ZJ/OU=ZJ/CN=server/name=EasyRSA/emailAddress=ZJ@ZJ.com
+V	270821142658Z		02	unknown	/C=CN/ST=ZJ/L=ZJ/O=ZJ/OU=ZJ/CN=client1/name=EasyRSA/emailAddress=ZJ@ZJ.com
@@ -0,0 +1 @@
+03
@@ -0,0 +1,10 @@
+set_var EASYRSA_OPENSSL	"openssl"
+set_var EASYRSA_KEY_SIZE	2048
+set_var EASYRSA_REQ_COUNTRY	"lunatickochiya"
+set_var EASYRSA_REQ_PROVINCE	"github"
+set_var EASYRSA_REQ_CITY	"github"
+set_var EASYRSA_REQ_ORG	"github"
+set_var EASYRSA_REQ_EMAIL	"lunatickochiya@github.com"
+set_var EASYRSA_REQ_OU	"github"
+set_var EASYRSA_CA_EXPIRE	3650
+set_var EASYRSA_CERT_EXPIRE	3650
@@ -0,0 +1,27 @@
+#!/bin/sh
+
+ddns=`uci get openvpn.myvpn.ddns`
+port=`uci get openvpn.myvpn.port`
+proto=`uci get openvpn.myvpn.proto`
+
+cat > /tmp/my.ovpn  <<EOF
+client
+dev tun
+proto $proto
+remote $ddns $port
+resolv-retry infinite
+nobind
+persist-key
+persist-tun
+verb 3
+EOF
+echo '<ca>' >> /tmp/my.ovpn
+cat /etc/openvpn/pki/ca.crt >> /tmp/my.ovpn
+echo '</ca>' >> /tmp/my.ovpn
+echo '<cert>' >> /tmp/my.ovpn
+cat /etc/openvpn/pki/client1.crt >> /tmp/my.ovpn
+echo '</cert>' >> /tmp/my.ovpn
+echo '<key>' >> /tmp/my.ovpn
+cat /etc/openvpn/pki/client1.key >> /tmp/my.ovpn
+echo '</key>' >> /tmp/my.ovpn
+[ -f /etc/ovpnadd.conf ] && cat /etc/ovpnadd.conf >> /tmp/my.ovpn
@@ -0,0 +1,5 @@
+#!/bin/sh
+/etc/init.d/openvpn stop
+sleep 3
+rm /etc/openvpn/client.conf
+rm /etc/openvpn/pass.txt
@@ -0,0 +1,4 @@
+#!/bin/sh
+/etc/init.d/openvpn enable
+sleep 3
+/etc/init.d/openvpn restart
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+sleep 2
+/etc/init.d/openvpn stop
+sleep 2
+/etc/init.d/openvpn disable
@@ -0,0 +1,34 @@
+#!/bin/sh
+###########################################################
+# checkpsw.sh (C) 2004 Mathias Sundman 
+#
+# This script will authenticate OpenVPN users against
+# a plain text file. The passfile should simply contain
+# one row per user with the username first followed by
+# one or more space(s) or tab(s) and then the password.
+
+PASSFILE="/etc/openvpn/server/psw-file"
+LOG_FILE="/etc/openvpn/openvpn-password.log"
+TIME_STAMP=`date "+%Y-%m-%d %T"`
+
+###########################################################
+
+if [ ! -r "${PASSFILE}" ]; then
+  echo "${TIME_STAMP}: Could not open password file \"${PASSFILE}\" for reading." >> ${LOG_FILE}
+  exit 1
+fi
+
+CORRECT_PASSWORD=`awk '!/^;/&&!/^#/&&$1=="'${username}'"{print $2;exit}' ${PASSFILE}`
+
+if [ "${CORRECT_PASSWORD}" = "" ]; then
+  echo "${TIME_STAMP}: User does not exist: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
+  exit 1
+fi
+
+if [ "${password}" = "${CORRECT_PASSWORD}" ]; then
+  echo "${TIME_STAMP}: Successful authentication: username=\"${username}\"." >> ${LOG_FILE}
+  exit 0
+fi
+
+echo "${TIME_STAMP}: Incorrect password: username=\"${username}\", password=\"${password}\"." >> ${LOG_FILE}
+exit 1
@@ -0,0 +1 @@
+lunatic urey
@@ -0,0 +1,62 @@
+#!/bin/sh
+
+
+function rand_str() {
+	(base64 /dev/urandom | tr -dc 'A-Za-z' | head -c $1) 2>/dev/null
+}
+
+function rand_str_upper() {
+	(rand_str $1 | tr 'a-z' 'A-Z') 2>/dev/null
+}
+
+function rand_str_lower() {
+	(rand_str $1 | tr 'A-Z' 'a-z') 2>/dev/null
+}
+
+function rand_easy_rsa_vars() {
+	local KEY_PROVINCE="$(rand_str_upper 6)"
+	local KEY_CITY="$(rand_str 8)"
+	local KEY_ORG="$(rand_str 8)"
+	local KEY_EMAIL="$(rand_str_lower 8)@$(rand_str_lower 4).$(rand_str_lower 3)"
+	local KEY_OU="$(rand_str 8)"
+	sed -i \
+		-e "s/^[[:space:]]*set_var[[:space:]]\+EASYRSA_REQ_COUNTRY[[:space:]]\+\".*\"$/set_var EASYRSA_REQ_COUNTRY\t\"$KEY_PROVINCE\"/" \
+		-e "s/^[[:space:]]*set_var[[:space:]]\+EASYRSA_REQ_PROVINCE[[:space:]]\+\".*\"$/set_var EASYRSA_REQ_PROVINCE\t\"$KEY_CITY\"/" \
+		-e "s/^[[:space:]]*set_var[[:space:]]\+EASYRSA_REQ_CITY[[:space:]]\+\".*\"$/set_var EASYRSA_REQ_CITY\t\"$KEY_ORG\"/" \
+		-e "s/^[[:space:]]*set_var[[:space:]]\+EASYRSA_REQ_ORG[[:space:]]\+\".*\"$/set_var EASYRSA_REQ_ORG\t\"$KEY_ORG\"/" \
+		-e "s/^[[:space:]]*set_var[[:space:]]\+EASYRSA_REQ_EMAIL[[:space:]]\+\".*\"$/set_var EASYRSA_REQ_EMAIL\t\"$KEY_EMAIL\"/" \
+		-e "s/^[[:space:]]*set_var[[:space:]]\+EASYRSA_REQ_OU[[:space:]]\+\".*\"$/set_var EASYRSA_REQ_OU\t\"$KEY_OU\"/" \
+		/etc/easy-rsa/vars
+}
+
+rand_easy_rsa_vars
+
+
+rm -rf /root/pki
+
+export EASYRSA_PKI="/etc/easy-rsa/pki"
+export EASYRSA_VARS_FILE="/etc/easy-rsa/vars"
+export EASYRSA_CLI="easyrsa --batch"
+
+echo -en "yes\nyes\n" | $EASYRSA_CLI init-pki
+# Generate DH
+$EASYRSA_CLI gen-dh
+
+# Generate for the CA
+$EASYRSA_CLI build-ca nopass
+
+# Generate for the server
+$EASYRSA_CLI build-server-full server nopass
+
+# Generate for the client
+$EASYRSA_CLI build-client-full client1 nopass
+
+# Copy files
+mkdir -p /etc/openvpn/pki
+cp /etc/easy-rsa/pki/ca.crt /etc/openvpn/pki/
+cp /etc/easy-rsa/pki/dh.pem /etc/openvpn/pki/
+cp /etc/easy-rsa/pki/issued/server.crt /etc/openvpn/pki/
+cp /etc/easy-rsa/pki/private/server.key /etc/openvpn/pki/
+cp /etc/easy-rsa/pki/issued/client1.crt /etc/openvpn/pki/
+cp /etc/easy-rsa/pki/private/client1.key /etc/openvpn/pki/
+echo "OpenVPN Cert renew successfully"
@@ -0,0 +1 @@
+auth-user-pass
@@ -0,0 +1,46 @@
+#!/bin/sh
+
+openvpn_port="$(uci -q get openvpn.myvpn.port)"
+[ -z "$openvpn_port" ] && openvpn_port=1194
+
+uci -q batch <<-EOF >/dev/null
+	delete network.vpn0
+	set network.vpn0=interface
+	set network.vpn0.ifname='tun0'
+	set network.vpn0.proto='none'
+	
+	commit network
+	delete firewall.openvpn
+	set firewall.openvpn=rule
+	set firewall.openvpn.name='openvpn'
+	set firewall.openvpn.target='ACCEPT'
+	set firewall.openvpn.src='wan'
+	set firewall.openvpn.proto='tcp udp'
+	set firewall.openvpn.dest_port="$openvpn_port"
+	delete firewall.vpn
+	set firewall.vpn=zone
+	set firewall.vpn.name='vpn'
+	set firewall.vpn.input='ACCEPT'
+	set firewall.vpn.forward='ACCEPT'
+	set firewall.vpn.output='ACCEPT'
+	set firewall.vpn.masq='1'
+	set firewall.vpn.network='vpn0'
+	delete firewall.vpntowan
+	set firewall.vpntowan=forwarding
+	set firewall.vpntowan.src='vpn'
+	set firewall.vpntowan.dest='wan'
+	delete firewall.vpntolan
+	set firewall.vpntolan=forwarding
+	set firewall.vpntolan.src='vpn'
+	set firewall.vpntolan.dest='lan'
+	delete firewall.lantovpn
+	set firewall.lantovpn=forwarding
+	set firewall.lantovpn.src='lan'
+	set firewall.lantovpn.dest='vpn'
+	commit firewall
+EOF
+
+chmod 0777 /etc/openvpn/server/checkpsw.sh
+
+rm -f /tmp/luci-indexcache
+exit 0
@@ -0,0 +1,4 @@
+{
+	"config": "openvpn",
+	"init": ""
+}