mirror of
https://github.com/caiwx86/small-packages.git
synced 2026-08-03 13:29:24 +08:00
update 2026-08-01 21:06:47
This commit is contained in:
action
parent
1e452334dc
commit
3700eb016b
@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk
|
||||
|
||||
PKG_NAME:=luci-app-ipsec-server
|
||||
PKG_VERSION:=20260801
|
||||
PKG_RELEASE:=1
|
||||
PKG_RELEASE:=2
|
||||
|
||||
PKG_MAINTAINER:=Lienol <lawlienol@gmail.com>
|
||||
|
||||
|
||||
@ -12,7 +12,7 @@ function index()
|
||||
entry({"admin", "vpn", "ipsec-server", "users"}, cbi("ipsec-server/users"), _("Users Manager"), 20).leaf = true
|
||||
entry({"admin", "vpn", "ipsec-server", "l2tp_user"}, cbi("ipsec-server/l2tp_user")).leaf = true
|
||||
local uci = require "luci.model.uci".cursor()
|
||||
if uci:get("luci-app-ipsec-server", "ipsec", "type") == "IKEv1" then
|
||||
if uci:get("luci-app-ipsec-server", "ipsec", "type") == "L2TP" then
|
||||
entry({"admin", "vpn", "ipsec-server", "online"}, cbi("ipsec-server/online"), _("L2TP Online Users"), 30).leaf = true
|
||||
end
|
||||
entry({"admin", "vpn", "ipsec-server", "status"}, call("act_status")).leaf = true
|
||||
|
||||
@ -12,62 +12,61 @@ o.cfgvalue = function(t, n)
|
||||
return '<font class="ipsec-server_status"></font>'
|
||||
end
|
||||
|
||||
enabled = s:option(Flag, "enabled", translate("Enable"))
|
||||
enabled.default = 0
|
||||
enabled.rmempty = false
|
||||
o = s:option(Flag, "enabled", translate("Enable"))
|
||||
o.default = 0
|
||||
o.rmempty = false
|
||||
|
||||
type = s:option(ListValue, "type", translate("Type"))
|
||||
type:value("IKEv1", "IPSec Xauth PSK")
|
||||
type:value("IKEv2", "IKEv2/IPSec PSK")
|
||||
type:value("IKEv1", "IPSec Xauth PSK")
|
||||
type.default = "IKEv2"
|
||||
|
||||
clientip = s:option(Value, "clientip", translate("VPN Client IP"))
|
||||
clientip.description = translate("VPN Client reserved started IP addresses with the same subnet mask, such as: 192.168.100.10/24")
|
||||
clientip.datatype = "ip4addr"
|
||||
clientip.optional = false
|
||||
clientip.rmempty = false
|
||||
o = s:option(Value, "clientip", translate("VPN Client IP"))
|
||||
o.description = translate("VPN Client reserved started IP addresses with the same subnet mask, such as: 192.168.100.10/24")
|
||||
o.datatype = "ip4addr"
|
||||
o.optional = false
|
||||
o:depends("type", "IKEv2")
|
||||
o:depends("type", "IKEv1")
|
||||
|
||||
secret = s:option(Value, "secret", translate("Preshared Key"))
|
||||
secret.default = "ipsec"
|
||||
secret.password = true
|
||||
secret:depends("type", "IKEv1")
|
||||
|
||||
if sys.call("command -v xl2tpd > /dev/null") == 0 then
|
||||
type:value("L2TP", "L2TP/IPSec PSK")
|
||||
secret:depends("type", "L2TP")
|
||||
|
||||
o = s:option(DummyValue, "l2tp_status", "L2TP " .. translate("Current Condition"))
|
||||
o.rawhtml = true
|
||||
o.cfgvalue = function(t, n)
|
||||
return '<font class="l2tp_status"></font>'
|
||||
end
|
||||
o:depends("type", "IKEv1")
|
||||
|
||||
o = s:option(Flag, "l2tp_enable", "L2TP " .. translate("Enable"))
|
||||
o.description = translate("Use a client that supports L2TP over IPSec PSK to connect to this server.")
|
||||
o.default = 0
|
||||
o.rmempty = false
|
||||
o:depends("type", "IKEv1")
|
||||
o:depends("type", "L2TP")
|
||||
|
||||
o = s:option(Value, "l2tp_localip", "L2TP " .. translate("Server IP"))
|
||||
o.description = translate("VPN Server IP address, such as: 192.168.101.1")
|
||||
o.datatype = "ip4addr"
|
||||
o.rmempty = true
|
||||
o.default = "192.168.101.1"
|
||||
o.placeholder = o.default
|
||||
o:depends("type", "IKEv1")
|
||||
o:depends("type", "L2TP")
|
||||
|
||||
o = s:option(Value, "l2tp_remoteip", "L2TP " .. translate("Client IP"))
|
||||
o.description = translate("VPN Client IP address range, such as: 192.168.101.10-20")
|
||||
o.rmempty = true
|
||||
o.default = "192.168.101.10-20"
|
||||
o.placeholder = o.default
|
||||
o:depends("type", "IKEv1")
|
||||
o:depends("type", "L2TP")
|
||||
|
||||
--[[
|
||||
if sys.call("ls -L /usr/lib/ipsec/libipsec* 2>/dev/null >/dev/null") == 0 then
|
||||
o = s:option(DummyValue, "_o", " ")
|
||||
o.rawhtml = true
|
||||
o.cfgvalue = function(t, n)
|
||||
return string.format('<a style="color: red">%s</a>', translate("L2TP/IPSec is not compatible with kernel-libipsec, which will disable this module."))
|
||||
end
|
||||
o:depends("l2tp_enable", true)
|
||||
o:depends("type", "L2TP")
|
||||
end
|
||||
]]--
|
||||
end
|
||||
|
||||
return m
|
||||
|
||||
@ -5,6 +5,25 @@ m = Map("luci-app-ipsec-server")
|
||||
|
||||
local type = m:get("ipsec", "type")
|
||||
|
||||
if type == "IKEv2" then
|
||||
s = m:section(TypedSection, "ikev2_users", "IKEv2/IPSec PSK " .. translate("Users Manager"))
|
||||
s.description = translate("Use a client that supports IKEv2/IPSec PSK (iOS or Android) to connect to this server.")
|
||||
s.addremove = true
|
||||
s.anonymous = true
|
||||
s.template = "cbi/tblsection"
|
||||
|
||||
o = s:option(Flag, "enabled", translate("Enabled"))
|
||||
o.default = 1
|
||||
o.rmempty = false
|
||||
|
||||
o = s:option(Value, "identifier", translate("Identifier"))
|
||||
o.placeholder = translate("Identifier")
|
||||
o.rmempty = false
|
||||
|
||||
o = s:option(Value, "secret", translate("Preshared Key"))
|
||||
o.placeholder = translate("Preshared Key")
|
||||
o.rmempty = false
|
||||
end
|
||||
if type == "IKEv1" then
|
||||
s = m:section(TypedSection, "ipsec_users", "IPSec Xauth PSK " .. translate("Users Manager"))
|
||||
s.description = translate("Use a client that supports IPSec Xauth PSK (iOS or Android) to connect to this server.")
|
||||
@ -23,55 +42,35 @@ if type == "IKEv1" then
|
||||
o = s:option(Value, "password", translate("Password"))
|
||||
o.placeholder = translate("Password")
|
||||
o.rmempty = false
|
||||
|
||||
if sys.call("command -v xl2tpd > /dev/null") == 0 then
|
||||
s = m:section(TypedSection, "l2tp_users", "L2TP/IPSec PSK " .. translate("Users Manager"))
|
||||
s.description = translate("Use a client that supports L2TP over IPSec PSK to connect to this server.")
|
||||
s.addremove = true
|
||||
s.anonymous = true
|
||||
s.template = "cbi/tblsection"
|
||||
s.extedit = d.build_url("admin", "vpn", "ipsec-server", "l2tp_user", "%s")
|
||||
function s.create(e, t)
|
||||
t = TypedSection.create(e, t)
|
||||
luci.http.redirect(e.extedit:format(t))
|
||||
end
|
||||
|
||||
o = s:option(Flag, "enabled", translate("Enabled"))
|
||||
o.default = 1
|
||||
o.rmempty = false
|
||||
|
||||
o = s:option(Value, "username", translate("Username"))
|
||||
o.placeholder = translate("Username")
|
||||
o.rmempty = false
|
||||
|
||||
o = s:option(Value, "password", translate("Password"))
|
||||
o.placeholder = translate("Password")
|
||||
o.rmempty = false
|
||||
|
||||
o = s:option(Value, "ipaddress", translate("IP address"))
|
||||
o.placeholder = translate("Automatically")
|
||||
o.datatype = "ip4addr"
|
||||
o.rmempty = true
|
||||
end
|
||||
end
|
||||
if type == "IKEv2" then
|
||||
s = m:section(TypedSection, "ikev2_users", "IKEv2/IPSec PSK " .. translate("Users Manager"))
|
||||
s.description = translate("Use a client that supports IKEv2/IPSec PSK (iOS or Android) to connect to this server.")
|
||||
if type == "L2TP" and sys.call("command -v xl2tpd > /dev/null") == 0 then
|
||||
s = m:section(TypedSection, "l2tp_users", "L2TP/IPSec PSK " .. translate("Users Manager"))
|
||||
s.description = translate("Use a client that supports L2TP over IPSec PSK to connect to this server.")
|
||||
s.addremove = true
|
||||
s.anonymous = true
|
||||
s.template = "cbi/tblsection"
|
||||
s.extedit = d.build_url("admin", "vpn", "ipsec-server", "l2tp_user", "%s")
|
||||
function s.create(e, t)
|
||||
t = TypedSection.create(e, t)
|
||||
luci.http.redirect(e.extedit:format(t))
|
||||
end
|
||||
|
||||
o = s:option(Flag, "enabled", translate("Enabled"))
|
||||
o.default = 1
|
||||
o.rmempty = false
|
||||
|
||||
o = s:option(Value, "username", translate("Identifier"))
|
||||
o.placeholder = translate("Identifier")
|
||||
o = s:option(Value, "username", translate("Username"))
|
||||
o.placeholder = translate("Username")
|
||||
o.rmempty = false
|
||||
|
||||
o = s:option(Value, "secret", translate("Preshared Key"))
|
||||
o.placeholder = translate("Preshared Key")
|
||||
o = s:option(Value, "password", translate("Password"))
|
||||
o.placeholder = translate("Password")
|
||||
o.rmempty = false
|
||||
|
||||
o = s:option(Value, "ipaddress", translate("IP address"))
|
||||
o.placeholder = translate("Automatically")
|
||||
o.datatype = "ip4addr"
|
||||
o.rmempty = true
|
||||
end
|
||||
|
||||
return m
|
||||
|
||||
@ -1,11 +1,6 @@
|
||||
|
||||
config service 'ipsec'
|
||||
option enabled '0'
|
||||
option clientip '192.168.100.10/24'
|
||||
option type 'IKEv2'
|
||||
|
||||
config ikev2_users
|
||||
option enabled '1'
|
||||
option username '1'
|
||||
option secret 'ipsec'
|
||||
option clientip '192.168.100.10/24'
|
||||
|
||||
|
||||
@ -15,8 +15,8 @@ L2TP_LOG_FILE=${L2TP_PATH}/xl2tpd.log
|
||||
ipt_comment="IPSec VPN Server"
|
||||
|
||||
init_config() {
|
||||
vt_type=$(uci -q get ${CONFIG}.@service[0].type)
|
||||
vt_clientip=$(uci -q get ${CONFIG}.@service[0].clientip)
|
||||
l2tp_enabled=$(uci -q get ${CONFIG}.@service[0].l2tp_enable)
|
||||
l2tp_localip=$(uci -q get ${CONFIG}.@service[0].l2tp_localip)
|
||||
}
|
||||
|
||||
@ -26,35 +26,53 @@ get_enabled_anonymous_secs() {
|
||||
|
||||
ipt_rule() {
|
||||
if [ "$1" = "add" ]; then
|
||||
iptables -w -I input_rule -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -t mangle -I OUTPUT -p udp -m multiport --sports 500,4500 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
|
||||
iptables -w -I forwarding_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I forwarding_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I input_rule -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I forwarding_rule -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I forwarding_rule -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -t nat -I postrouting_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
|
||||
[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
|
||||
iptables -w -t nat -I postrouting_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
|
||||
[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
|
||||
|
||||
ip6tables -w -I input_rule -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
ip6tables -w -t mangle -I OUTPUT -p udp -m multiport --sports 500,4500 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
|
||||
ip6tables -w -I input_rule -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
ip6tables -w -I forwarding_rule -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
ip6tables -w -I forwarding_rule -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
|
||||
[ "${l2tp_enabled}" = 1 ] && {
|
||||
iptables -w -I input_rule -p udp --dport 1701 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
if [ "${vt_type}" = "L2TP" ]; then
|
||||
iptables -w -t mangle -I OUTPUT -p udp --sport 1701 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
|
||||
iptables -w -I input_rule -p udp --dport 1701 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I input_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I input_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I forwarding_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I forwarding_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I output_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I output_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -t nat -I postrouting_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
|
||||
[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
|
||||
iptables -w -t nat -I postrouting_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
|
||||
[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
|
||||
else
|
||||
iptables -w -I input_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I input_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I forwarding_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I forwarding_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I output_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I output_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -t nat -I postrouting_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
|
||||
[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
|
||||
iptables -w -t nat -I postrouting_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
|
||||
[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
|
||||
|
||||
|
||||
ip6tables -w -I input_rule -p udp --dport 1701 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
ip6tables -w -t mangle -I OUTPUT -p udp --sport 1701 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
|
||||
}
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
delete network.ipsec_server
|
||||
set network.ipsec_server=interface
|
||||
set network.ipsec_server.ifname="ipsec0"
|
||||
set network.ipsec_server.device="ipsec0"
|
||||
set network.ipsec_server.proto="static"
|
||||
set network.ipsec_server.ipaddr="${vt_clientip%.*}.1"
|
||||
set network.ipsec_server.netmask="255.255.255.0"
|
||||
commit network
|
||||
EOF
|
||||
fi
|
||||
else
|
||||
ipt_del() {
|
||||
for i in $(seq 1 $($1 -nL $2 | grep -c "${ipt_comment}")); do
|
||||
@ -62,13 +80,19 @@ ipt_rule() {
|
||||
$1 -w -D $2 $index 2>/dev/null
|
||||
done
|
||||
}
|
||||
ipt_del "iptables -w" "forwarding_rule"
|
||||
ipt_del "iptables -w" "input_rule"
|
||||
ipt_del "iptables -w" "forwarding_rule"
|
||||
ipt_del "iptables -w" "output_rule"
|
||||
ipt_del "iptables -w -t nat" "postrouting_rule"
|
||||
ipt_del "iptables -w -t mangle" "OUTPUT"
|
||||
ipt_del "ip6tables -w" "forwarding_rule"
|
||||
ipt_del "ip6tables -w" "input_rule"
|
||||
ipt_del "ip6tables -w" "forwarding_rule"
|
||||
ipt_del "ip6tables -w -t mangle" "OUTPUT"
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
delete network.ipsec_server
|
||||
commit network
|
||||
EOF
|
||||
ifup ipsec_server > /dev/null 2>&1
|
||||
fi
|
||||
}
|
||||
|
||||
@ -108,25 +132,121 @@ start() {
|
||||
local vt_enabled=$(uci -q get ${CONFIG}.@service[0].enabled)
|
||||
[ "$vt_enabled" = 0 ] && return 1
|
||||
|
||||
local vt_type=$(uci -q get ${CONFIG}.@service[0].type)
|
||||
local vt_gateway="${vt_clientip%.*}.1"
|
||||
cat > ${IPSEC_CONN_FILE} <<-EOF
|
||||
# ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
local l2tp_enabled=$(uci -q get ${CONFIG}.@service[0].l2tp_enable)
|
||||
[ "${vt_type}" = "IKEv1" ] && [ "${l2tp_enabled}" = 1 ] && {
|
||||
touch ${CHAP_SECRETS}
|
||||
local vt_remoteip=$(uci -q get ${CONFIG}.@service[0].l2tp_remoteip)
|
||||
local ipsec_l2tp_config=$(cat <<-EOF
|
||||
conn L2TP-IKEv1-PSK
|
||||
type=transport
|
||||
keyexchange=ikev1
|
||||
authby=secret
|
||||
leftprotoport=udp/l2tp
|
||||
left=%any
|
||||
right=%any
|
||||
config setup
|
||||
uniqueids=no
|
||||
charondebug="cfg 2, dmn 2, ike 2, net 0"
|
||||
|
||||
conn %default
|
||||
dpdaction=clear
|
||||
dpddelay=300s
|
||||
rekey=no
|
||||
forceencaps=yes
|
||||
left=%any
|
||||
leftfirewall=yes
|
||||
right=%any
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
auto=add
|
||||
ike=aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1536
|
||||
esp=aes128-sha1,aes256-sha256,3des-sha1
|
||||
|
||||
EOF
|
||||
|
||||
cat > ${IPSEC_SECRETS_FILE} <<-EOF
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
EOF
|
||||
|
||||
([ "${vt_type}" = "IKEv1" ] || [ "${vt_type}" = "IKEv2" ]) && {
|
||||
local vt_gateway="${vt_clientip%.*}.1"
|
||||
cat >> ${IPSEC_CONN_FILE} <<-EOF
|
||||
conn conn-ipsec
|
||||
leftsubnet=0.0.0.0/0
|
||||
rightsubnet=${vt_clientip}
|
||||
rightsourceip=${vt_clientip}
|
||||
rightdns=${vt_gateway}
|
||||
|
||||
EOF
|
||||
}
|
||||
|
||||
[ "${vt_type}" = "IKEv2" ] && {
|
||||
cat >> ${IPSEC_CONN_FILE} <<-EOF
|
||||
conn IKEv2-PSK-XAuth
|
||||
also=conn-ipsec
|
||||
keyexchange=ikev2
|
||||
leftauth=psk
|
||||
rightauth=psk
|
||||
|
||||
EOF
|
||||
local ikev2_users=$(get_enabled_anonymous_secs "@ikev2_users")
|
||||
[ -n "${ikev2_users}" ] && {
|
||||
for _user in ${ikev2_users}; do
|
||||
local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled)
|
||||
[ "${u_enabled}" -eq 1 ] || continue
|
||||
|
||||
local u_identifier=$(uci -q get ${CONFIG}.${_user}.identifier)
|
||||
[ -n "${u_identifier}" ] || continue
|
||||
|
||||
local u_secret=$(uci -q get ${CONFIG}.${_user}.secret)
|
||||
[ -n "${u_secret}" ] || continue
|
||||
|
||||
echo "${u_identifier} : PSK '${u_secret}'" >> ${IPSEC_SECRETS_FILE}
|
||||
done
|
||||
}
|
||||
}
|
||||
|
||||
([ "${vt_type}" = "IKEv1" ] || [ "${vt_type}" = "L2TP" ]) && {
|
||||
cat >> ${IPSEC_CONN_FILE} <<-EOF
|
||||
conn IKEv1-PSK-XAuth
|
||||
keyexchange=ikev1
|
||||
EOF
|
||||
local vt_secret=$(uci -q get ${CONFIG}.@service[0].secret)
|
||||
cat >> ${IPSEC_SECRETS_FILE} <<-EOF
|
||||
: PSK "$vt_secret"
|
||||
EOF
|
||||
}
|
||||
|
||||
[ "${vt_type}" = "IKEv1" ] && {
|
||||
cat >> ${IPSEC_CONN_FILE} <<-EOF
|
||||
also=conn-ipsec
|
||||
leftauth=psk
|
||||
rightauth=psk
|
||||
rightauth2=xauth
|
||||
EOF
|
||||
local ipsec_users=$(get_enabled_anonymous_secs "@ipsec_users")
|
||||
[ -n "${ipsec_users}" ] && {
|
||||
for _user in ${ipsec_users}; do
|
||||
local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled)
|
||||
[ "${u_enabled}" -eq 1 ] || continue
|
||||
|
||||
local u_username=$(uci -q get ${CONFIG}.${_user}.username)
|
||||
[ -n "${u_username}" ] || continue
|
||||
|
||||
local u_password=$(uci -q get ${CONFIG}.${_user}.password)
|
||||
[ -n "${u_password}" ] || continue
|
||||
|
||||
echo "${u_username} : XAUTH '${u_password}'" >> ${IPSEC_SECRETS_FILE}
|
||||
done
|
||||
}
|
||||
}
|
||||
|
||||
[ "${vt_type}" = "L2TP" ] && {
|
||||
cat >> ${IPSEC_CONN_FILE} <<-EOF
|
||||
|
||||
conn L2TP-IKEv1-PSK
|
||||
type=transport
|
||||
keyexchange=ikev1
|
||||
authby=secret
|
||||
leftprotoport=udp/1701
|
||||
left=%any
|
||||
right=%any
|
||||
rekey=no
|
||||
forceencaps=yes
|
||||
|
||||
EOF
|
||||
)
|
||||
|
||||
mkdir -p ${L2TP_PATH}
|
||||
cat > ${L2TP_OPTIONS_FILE} <<-EOF
|
||||
@ -143,6 +263,7 @@ start() {
|
||||
lcp-echo-interval 60
|
||||
connect-delay 5000
|
||||
EOF
|
||||
local l2tp_remoteip=$(uci -q get ${CONFIG}.@service[0].l2tp_remoteip)
|
||||
cat > ${L2TP_CONFIG_FILE} <<-EOF
|
||||
[global]
|
||||
port = 1701
|
||||
@ -151,7 +272,7 @@ start() {
|
||||
;debug state = yes
|
||||
;debug tunnel = yes
|
||||
[lns default]
|
||||
ip range = ${vt_remoteip}
|
||||
ip range = ${l2tp_remoteip}
|
||||
local ip = ${l2tp_localip}
|
||||
require chap = yes
|
||||
refuse pap = yes
|
||||
@ -162,6 +283,7 @@ start() {
|
||||
length bit = yes
|
||||
EOF
|
||||
|
||||
touch ${CHAP_SECRETS}
|
||||
local l2tp_users=$(get_enabled_anonymous_secs "@l2tp_users")
|
||||
[ -n "${l2tp_users}" ] && {
|
||||
for _user in ${l2tp_users}; do
|
||||
@ -188,106 +310,10 @@ start() {
|
||||
rm -f "/usr/lib/ipsec/libipsec.so.0"
|
||||
}
|
||||
|
||||
cat > ${IPSEC_CONN_FILE} <<-EOF
|
||||
# ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
config setup
|
||||
uniqueids=no
|
||||
charondebug="cfg 2, dmn 2, ike 2, net 0"
|
||||
|
||||
conn %default
|
||||
dpdaction=clear
|
||||
dpddelay=300s
|
||||
rekey=no
|
||||
left=%defaultroute
|
||||
leftfirewall=yes
|
||||
right=%any
|
||||
ikelifetime=60m
|
||||
keylife=20m
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
auto=add
|
||||
ike=aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1536
|
||||
esp=aes256-sha256,aes128-sha1,3des-sha1
|
||||
|
||||
conn conn-ipsec
|
||||
leftsubnet=0.0.0.0/0
|
||||
rightsubnet=${vt_clientip}
|
||||
rightsourceip=${vt_clientip}
|
||||
rightdns=${vt_gateway}
|
||||
|
||||
EOF
|
||||
|
||||
[ "${vt_type}" = "IKEv1" ] && {
|
||||
cat >> ${IPSEC_CONN_FILE} <<-EOF
|
||||
conn IKEv1-PSK-XAuth
|
||||
also=conn-ipsec
|
||||
keyexchange=ikev1
|
||||
leftauth=psk
|
||||
rightauth=psk
|
||||
rightauth2=xauth
|
||||
|
||||
$ipsec_l2tp_config
|
||||
EOF
|
||||
local vt_secret=$(uci -q get ${CONFIG}.@service[0].secret)
|
||||
cat > /etc/ipsec.secrets <<-EOF
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
: PSK "$vt_secret"
|
||||
EOF
|
||||
local ipsec_users=$(get_enabled_anonymous_secs "@ipsec_users")
|
||||
[ -n "${ipsec_users}" ] && {
|
||||
for _user in ${ipsec_users}; do
|
||||
local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled)
|
||||
[ "${u_enabled}" -eq 1 ] || continue
|
||||
|
||||
local u_username=$(uci -q get ${CONFIG}.${_user}.username)
|
||||
[ -n "${u_username}" ] || continue
|
||||
|
||||
local u_password=$(uci -q get ${CONFIG}.${_user}.password)
|
||||
[ -n "${u_password}" ] || continue
|
||||
|
||||
echo "${u_username} : XAUTH '${u_password}'" >> ${IPSEC_SECRETS_FILE}
|
||||
done
|
||||
}
|
||||
}
|
||||
|
||||
[ "${vt_type}" = "IKEv2" ] && {
|
||||
cat >> ${IPSEC_CONN_FILE} <<-EOF
|
||||
conn IKEv2-PSK-XAuth
|
||||
also=conn-ipsec
|
||||
keyexchange=ikev2
|
||||
leftauth=psk
|
||||
rightauth=psk
|
||||
EOF
|
||||
cat > /etc/ipsec.secrets <<-EOF
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
EOF
|
||||
local ikev2_users=$(get_enabled_anonymous_secs "@ikev2_users")
|
||||
[ -n "${ikev2_users}" ] && {
|
||||
for _user in ${ikev2_users}; do
|
||||
local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled)
|
||||
[ "${u_enabled}" -eq 1 ] || continue
|
||||
|
||||
local u_username=$(uci -q get ${CONFIG}.${_user}.username)
|
||||
[ -n "${u_username}" ] || continue
|
||||
|
||||
local u_secret=$(uci -q get ${CONFIG}.${_user}.secret)
|
||||
[ -n "${u_secret}" ] || continue
|
||||
|
||||
echo "${u_username} : PSK '${u_secret}'" >> ${IPSEC_SECRETS_FILE}
|
||||
done
|
||||
}
|
||||
}
|
||||
|
||||
ipt_rule add
|
||||
|
||||
/usr/lib/ipsec/starter --daemon charon --nofork > /dev/null 2>&1 &
|
||||
gen_include
|
||||
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
set network.ipsec_server.ipaddr="${vt_clientip%.*}.1"
|
||||
commit network
|
||||
EOF
|
||||
ifup ipsec_server > /dev/null 2>&1
|
||||
}
|
||||
|
||||
@ -302,29 +328,3 @@ stop() {
|
||||
rm -rf /var/etc/ipsecvpn.include
|
||||
ln -s "libipsec.so.0.0.0" "/usr/lib/ipsec/libipsec.so.0" >/dev/null 2>&1
|
||||
}
|
||||
|
||||
gen_iface_and_firewall() {
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
delete network.ipsec_server
|
||||
set network.ipsec_server=interface
|
||||
set network.ipsec_server.ifname="ipsec0"
|
||||
set network.ipsec_server.device="ipsec0"
|
||||
set network.ipsec_server.proto="static"
|
||||
set network.ipsec_server.ipaddr="${vt_clientip%.*}.1"
|
||||
set network.ipsec_server.netmask="255.255.255.0"
|
||||
commit network
|
||||
|
||||
delete firewall.ipsecserver
|
||||
set firewall.ipsecserver=zone
|
||||
set firewall.ipsecserver.name="ipsecserver"
|
||||
set firewall.ipsecserver.input="ACCEPT"
|
||||
set firewall.ipsecserver.forward="ACCEPT"
|
||||
set firewall.ipsecserver.output="ACCEPT"
|
||||
set firewall.ipsecserver.network="ipsec_server"
|
||||
commit firewall
|
||||
EOF
|
||||
}
|
||||
|
||||
if [ -z "$(uci -q get network.ipsec_server)" ] || [ -z "$(uci -q get firewall.ipsecserver)" ]; then
|
||||
gen_iface_and_firewall
|
||||
fi
|
||||
|
||||
@ -21,13 +21,13 @@ define Download/geoip
|
||||
HASH:=b71d1999439dde2de2d2b6844a2befa50c50211ff739785c005ca7c230a17d6a
|
||||
endef
|
||||
|
||||
GEOSITE_VER:=20260731062338
|
||||
GEOSITE_VER:=20260801093436
|
||||
GEOSITE_FILE:=dlc.dat.$(GEOSITE_VER)
|
||||
define Download/geosite
|
||||
URL:=https://github.com/v2fly/domain-list-community/releases/download/$(GEOSITE_VER)/
|
||||
URL_FILE:=dlc.dat
|
||||
FILE:=$(GEOSITE_FILE)
|
||||
HASH:=3912cba980259a6443cb76413a22cbd4a979641439625ed5db8a3bdf6c238311
|
||||
HASH:=02dfe674d58e5ae6b803a96e910c61fd0fe0ee9d898152805bcfad687f3d0fcf
|
||||
endef
|
||||
|
||||
GEOSITE_IRAN_VER:=202607270122
|
||||
|
||||
Loading…
Reference in New Issue
Block a user