From 3700eb016bbda3aac2a7c6ccccbb4cb4061c3f57 Mon Sep 17 00:00:00 2001 From: action Date: Sat, 1 Aug 2026 21:06:47 +0800 Subject: [PATCH] update 2026-08-01 21:06:47 --- liep/luci-app-ipsec-server/Makefile | 2 +- .../luasrc/controller/ipsec-server.lua | 2 +- .../model/cbi/ipsec-server/settings.lua | 41 ++- .../luasrc/model/cbi/ipsec-server/users.lua | 73 ++--- .../root/etc/config/luci-app-ipsec-server | 7 +- .../root/etc/init.d/luci-app-ipsec-server | 310 +++++++++--------- v2ray-geodata/Makefile | 4 +- 7 files changed, 216 insertions(+), 223 deletions(-) diff --git a/liep/luci-app-ipsec-server/Makefile b/liep/luci-app-ipsec-server/Makefile index 645a5129..2228c49d 100644 --- a/liep/luci-app-ipsec-server/Makefile +++ b/liep/luci-app-ipsec-server/Makefile @@ -7,7 +7,7 @@ include $(TOPDIR)/rules.mk PKG_NAME:=luci-app-ipsec-server PKG_VERSION:=20260801 -PKG_RELEASE:=1 +PKG_RELEASE:=2 PKG_MAINTAINER:=Lienol diff --git a/liep/luci-app-ipsec-server/luasrc/controller/ipsec-server.lua b/liep/luci-app-ipsec-server/luasrc/controller/ipsec-server.lua index af902789..3c4fa08b 100644 --- a/liep/luci-app-ipsec-server/luasrc/controller/ipsec-server.lua +++ b/liep/luci-app-ipsec-server/luasrc/controller/ipsec-server.lua @@ -12,7 +12,7 @@ function index() entry({"admin", "vpn", "ipsec-server", "users"}, cbi("ipsec-server/users"), _("Users Manager"), 20).leaf = true entry({"admin", "vpn", "ipsec-server", "l2tp_user"}, cbi("ipsec-server/l2tp_user")).leaf = true local uci = require "luci.model.uci".cursor() - if uci:get("luci-app-ipsec-server", "ipsec", "type") == "IKEv1" then + if uci:get("luci-app-ipsec-server", "ipsec", "type") == "L2TP" then entry({"admin", "vpn", "ipsec-server", "online"}, cbi("ipsec-server/online"), _("L2TP Online Users"), 30).leaf = true end entry({"admin", "vpn", "ipsec-server", "status"}, call("act_status")).leaf = true diff --git a/liep/luci-app-ipsec-server/luasrc/model/cbi/ipsec-server/settings.lua b/liep/luci-app-ipsec-server/luasrc/model/cbi/ipsec-server/settings.lua index 78ea493c..cde365be 100644 --- a/liep/luci-app-ipsec-server/luasrc/model/cbi/ipsec-server/settings.lua +++ b/liep/luci-app-ipsec-server/luasrc/model/cbi/ipsec-server/settings.lua @@ -12,62 +12,61 @@ o.cfgvalue = function(t, n) return '' end -enabled = s:option(Flag, "enabled", translate("Enable")) -enabled.default = 0 -enabled.rmempty = false +o = s:option(Flag, "enabled", translate("Enable")) +o.default = 0 +o.rmempty = false type = s:option(ListValue, "type", translate("Type")) -type:value("IKEv1", "IPSec Xauth PSK") type:value("IKEv2", "IKEv2/IPSec PSK") +type:value("IKEv1", "IPSec Xauth PSK") type.default = "IKEv2" -clientip = s:option(Value, "clientip", translate("VPN Client IP")) -clientip.description = translate("VPN Client reserved started IP addresses with the same subnet mask, such as: 192.168.100.10/24") -clientip.datatype = "ip4addr" -clientip.optional = false -clientip.rmempty = false +o = s:option(Value, "clientip", translate("VPN Client IP")) +o.description = translate("VPN Client reserved started IP addresses with the same subnet mask, such as: 192.168.100.10/24") +o.datatype = "ip4addr" +o.optional = false +o:depends("type", "IKEv2") +o:depends("type", "IKEv1") secret = s:option(Value, "secret", translate("Preshared Key")) +secret.default = "ipsec" secret.password = true secret:depends("type", "IKEv1") if sys.call("command -v xl2tpd > /dev/null") == 0 then + type:value("L2TP", "L2TP/IPSec PSK") + secret:depends("type", "L2TP") + o = s:option(DummyValue, "l2tp_status", "L2TP " .. translate("Current Condition")) o.rawhtml = true o.cfgvalue = function(t, n) return '' end - o:depends("type", "IKEv1") - - o = s:option(Flag, "l2tp_enable", "L2TP " .. translate("Enable")) - o.description = translate("Use a client that supports L2TP over IPSec PSK to connect to this server.") - o.default = 0 - o.rmempty = false - o:depends("type", "IKEv1") + o:depends("type", "L2TP") o = s:option(Value, "l2tp_localip", "L2TP " .. translate("Server IP")) o.description = translate("VPN Server IP address, such as: 192.168.101.1") o.datatype = "ip4addr" - o.rmempty = true o.default = "192.168.101.1" o.placeholder = o.default - o:depends("type", "IKEv1") + o:depends("type", "L2TP") o = s:option(Value, "l2tp_remoteip", "L2TP " .. translate("Client IP")) o.description = translate("VPN Client IP address range, such as: 192.168.101.10-20") - o.rmempty = true o.default = "192.168.101.10-20" o.placeholder = o.default - o:depends("type", "IKEv1") + o:depends("type", "L2TP") +--[[ if sys.call("ls -L /usr/lib/ipsec/libipsec* 2>/dev/null >/dev/null") == 0 then o = s:option(DummyValue, "_o", " ") o.rawhtml = true o.cfgvalue = function(t, n) return string.format('%s', translate("L2TP/IPSec is not compatible with kernel-libipsec, which will disable this module.")) end - o:depends("l2tp_enable", true) + o:depends("type", "L2TP") end +]]-- end return m diff --git a/liep/luci-app-ipsec-server/luasrc/model/cbi/ipsec-server/users.lua b/liep/luci-app-ipsec-server/luasrc/model/cbi/ipsec-server/users.lua index 37113109..adf7c9af 100644 --- a/liep/luci-app-ipsec-server/luasrc/model/cbi/ipsec-server/users.lua +++ b/liep/luci-app-ipsec-server/luasrc/model/cbi/ipsec-server/users.lua @@ -5,6 +5,25 @@ m = Map("luci-app-ipsec-server") local type = m:get("ipsec", "type") +if type == "IKEv2" then + s = m:section(TypedSection, "ikev2_users", "IKEv2/IPSec PSK " .. translate("Users Manager")) + s.description = translate("Use a client that supports IKEv2/IPSec PSK (iOS or Android) to connect to this server.") + s.addremove = true + s.anonymous = true + s.template = "cbi/tblsection" + + o = s:option(Flag, "enabled", translate("Enabled")) + o.default = 1 + o.rmempty = false + + o = s:option(Value, "identifier", translate("Identifier")) + o.placeholder = translate("Identifier") + o.rmempty = false + + o = s:option(Value, "secret", translate("Preshared Key")) + o.placeholder = translate("Preshared Key") + o.rmempty = false +end if type == "IKEv1" then s = m:section(TypedSection, "ipsec_users", "IPSec Xauth PSK " .. translate("Users Manager")) s.description = translate("Use a client that supports IPSec Xauth PSK (iOS or Android) to connect to this server.") @@ -23,55 +42,35 @@ if type == "IKEv1" then o = s:option(Value, "password", translate("Password")) o.placeholder = translate("Password") o.rmempty = false - - if sys.call("command -v xl2tpd > /dev/null") == 0 then - s = m:section(TypedSection, "l2tp_users", "L2TP/IPSec PSK " .. translate("Users Manager")) - s.description = translate("Use a client that supports L2TP over IPSec PSK to connect to this server.") - s.addremove = true - s.anonymous = true - s.template = "cbi/tblsection" - s.extedit = d.build_url("admin", "vpn", "ipsec-server", "l2tp_user", "%s") - function s.create(e, t) - t = TypedSection.create(e, t) - luci.http.redirect(e.extedit:format(t)) - end - - o = s:option(Flag, "enabled", translate("Enabled")) - o.default = 1 - o.rmempty = false - - o = s:option(Value, "username", translate("Username")) - o.placeholder = translate("Username") - o.rmempty = false - - o = s:option(Value, "password", translate("Password")) - o.placeholder = translate("Password") - o.rmempty = false - - o = s:option(Value, "ipaddress", translate("IP address")) - o.placeholder = translate("Automatically") - o.datatype = "ip4addr" - o.rmempty = true - end end -if type == "IKEv2" then - s = m:section(TypedSection, "ikev2_users", "IKEv2/IPSec PSK " .. translate("Users Manager")) - s.description = translate("Use a client that supports IKEv2/IPSec PSK (iOS or Android) to connect to this server.") +if type == "L2TP" and sys.call("command -v xl2tpd > /dev/null") == 0 then + s = m:section(TypedSection, "l2tp_users", "L2TP/IPSec PSK " .. translate("Users Manager")) + s.description = translate("Use a client that supports L2TP over IPSec PSK to connect to this server.") s.addremove = true s.anonymous = true s.template = "cbi/tblsection" + s.extedit = d.build_url("admin", "vpn", "ipsec-server", "l2tp_user", "%s") + function s.create(e, t) + t = TypedSection.create(e, t) + luci.http.redirect(e.extedit:format(t)) + end o = s:option(Flag, "enabled", translate("Enabled")) o.default = 1 o.rmempty = false - o = s:option(Value, "username", translate("Identifier")) - o.placeholder = translate("Identifier") + o = s:option(Value, "username", translate("Username")) + o.placeholder = translate("Username") o.rmempty = false - o = s:option(Value, "secret", translate("Preshared Key")) - o.placeholder = translate("Preshared Key") + o = s:option(Value, "password", translate("Password")) + o.placeholder = translate("Password") o.rmempty = false + + o = s:option(Value, "ipaddress", translate("IP address")) + o.placeholder = translate("Automatically") + o.datatype = "ip4addr" + o.rmempty = true end return m diff --git a/liep/luci-app-ipsec-server/root/etc/config/luci-app-ipsec-server b/liep/luci-app-ipsec-server/root/etc/config/luci-app-ipsec-server index c28432b3..397f55ee 100644 --- a/liep/luci-app-ipsec-server/root/etc/config/luci-app-ipsec-server +++ b/liep/luci-app-ipsec-server/root/etc/config/luci-app-ipsec-server @@ -1,11 +1,6 @@ config service 'ipsec' option enabled '0' - option clientip '192.168.100.10/24' option type 'IKEv2' - -config ikev2_users - option enabled '1' - option username '1' - option secret 'ipsec' + option clientip '192.168.100.10/24' diff --git a/liep/luci-app-ipsec-server/root/etc/init.d/luci-app-ipsec-server b/liep/luci-app-ipsec-server/root/etc/init.d/luci-app-ipsec-server index d15bd46e..2ab7c36d 100755 --- a/liep/luci-app-ipsec-server/root/etc/init.d/luci-app-ipsec-server +++ b/liep/luci-app-ipsec-server/root/etc/init.d/luci-app-ipsec-server @@ -15,8 +15,8 @@ L2TP_LOG_FILE=${L2TP_PATH}/xl2tpd.log ipt_comment="IPSec VPN Server" init_config() { + vt_type=$(uci -q get ${CONFIG}.@service[0].type) vt_clientip=$(uci -q get ${CONFIG}.@service[0].clientip) - l2tp_enabled=$(uci -q get ${CONFIG}.@service[0].l2tp_enable) l2tp_localip=$(uci -q get ${CONFIG}.@service[0].l2tp_localip) } @@ -26,35 +26,53 @@ get_enabled_anonymous_secs() { ipt_rule() { if [ "$1" = "add" ]; then - iptables -w -I input_rule -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null iptables -w -t mangle -I OUTPUT -p udp -m multiport --sports 500,4500 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null - iptables -w -I forwarding_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null - iptables -w -I forwarding_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null + iptables -w -I input_rule -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null iptables -w -I forwarding_rule -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null iptables -w -I forwarding_rule -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null - iptables -w -t nat -I postrouting_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null - [ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null - iptables -w -t nat -I postrouting_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null - [ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null - ip6tables -w -I input_rule -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null ip6tables -w -t mangle -I OUTPUT -p udp -m multiport --sports 500,4500 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null + ip6tables -w -I input_rule -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null ip6tables -w -I forwarding_rule -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null ip6tables -w -I forwarding_rule -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null - [ "${l2tp_enabled}" = 1 ] && { - iptables -w -I input_rule -p udp --dport 1701 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null + if [ "${vt_type}" = "L2TP" ]; then iptables -w -t mangle -I OUTPUT -p udp --sport 1701 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null + iptables -w -I input_rule -p udp --dport 1701 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null + iptables -w -I input_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null + iptables -w -I input_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null iptables -w -I forwarding_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null iptables -w -I forwarding_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null + iptables -w -I output_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null + iptables -w -I output_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null iptables -w -t nat -I postrouting_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null [ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null iptables -w -t nat -I postrouting_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null [ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null + else + iptables -w -I input_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null + iptables -w -I input_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null + iptables -w -I forwarding_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null + iptables -w -I forwarding_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null + iptables -w -I output_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null + iptables -w -I output_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null + iptables -w -t nat -I postrouting_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null + [ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null + iptables -w -t nat -I postrouting_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null + [ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null + - ip6tables -w -I input_rule -p udp --dport 1701 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null - ip6tables -w -t mangle -I OUTPUT -p udp --sport 1701 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null - } + uci -q batch <<-EOF >/dev/null + delete network.ipsec_server + set network.ipsec_server=interface + set network.ipsec_server.ifname="ipsec0" + set network.ipsec_server.device="ipsec0" + set network.ipsec_server.proto="static" + set network.ipsec_server.ipaddr="${vt_clientip%.*}.1" + set network.ipsec_server.netmask="255.255.255.0" + commit network + EOF + fi else ipt_del() { for i in $(seq 1 $($1 -nL $2 | grep -c "${ipt_comment}")); do @@ -62,13 +80,19 @@ ipt_rule() { $1 -w -D $2 $index 2>/dev/null done } - ipt_del "iptables -w" "forwarding_rule" ipt_del "iptables -w" "input_rule" + ipt_del "iptables -w" "forwarding_rule" + ipt_del "iptables -w" "output_rule" ipt_del "iptables -w -t nat" "postrouting_rule" ipt_del "iptables -w -t mangle" "OUTPUT" - ipt_del "ip6tables -w" "forwarding_rule" ipt_del "ip6tables -w" "input_rule" + ipt_del "ip6tables -w" "forwarding_rule" ipt_del "ip6tables -w -t mangle" "OUTPUT" + uci -q batch <<-EOF >/dev/null + delete network.ipsec_server + commit network + EOF + ifup ipsec_server > /dev/null 2>&1 fi } @@ -108,25 +132,121 @@ start() { local vt_enabled=$(uci -q get ${CONFIG}.@service[0].enabled) [ "$vt_enabled" = 0 ] && return 1 - local vt_type=$(uci -q get ${CONFIG}.@service[0].type) - local vt_gateway="${vt_clientip%.*}.1" + cat > ${IPSEC_CONN_FILE} <<-EOF + # ipsec.conf - strongSwan IPsec configuration file - local l2tp_enabled=$(uci -q get ${CONFIG}.@service[0].l2tp_enable) - [ "${vt_type}" = "IKEv1" ] && [ "${l2tp_enabled}" = 1 ] && { - touch ${CHAP_SECRETS} - local vt_remoteip=$(uci -q get ${CONFIG}.@service[0].l2tp_remoteip) - local ipsec_l2tp_config=$(cat <<-EOF - conn L2TP-IKEv1-PSK - type=transport - keyexchange=ikev1 - authby=secret - leftprotoport=udp/l2tp - left=%any - right=%any + config setup + uniqueids=no + charondebug="cfg 2, dmn 2, ike 2, net 0" + + conn %default + dpdaction=clear + dpddelay=300s rekey=no - forceencaps=yes + left=%any + leftfirewall=yes + right=%any + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + auto=add + ike=aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1536 + esp=aes128-sha1,aes256-sha256,3des-sha1 + + EOF + + cat > ${IPSEC_SECRETS_FILE} <<-EOF + # /etc/ipsec.secrets - strongSwan IPsec secrets file + EOF + + ([ "${vt_type}" = "IKEv1" ] || [ "${vt_type}" = "IKEv2" ]) && { + local vt_gateway="${vt_clientip%.*}.1" + cat >> ${IPSEC_CONN_FILE} <<-EOF + conn conn-ipsec + leftsubnet=0.0.0.0/0 + rightsubnet=${vt_clientip} + rightsourceip=${vt_clientip} + rightdns=${vt_gateway} + + EOF + } + + [ "${vt_type}" = "IKEv2" ] && { + cat >> ${IPSEC_CONN_FILE} <<-EOF + conn IKEv2-PSK-XAuth + also=conn-ipsec + keyexchange=ikev2 + leftauth=psk + rightauth=psk + + EOF + local ikev2_users=$(get_enabled_anonymous_secs "@ikev2_users") + [ -n "${ikev2_users}" ] && { + for _user in ${ikev2_users}; do + local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled) + [ "${u_enabled}" -eq 1 ] || continue + + local u_identifier=$(uci -q get ${CONFIG}.${_user}.identifier) + [ -n "${u_identifier}" ] || continue + + local u_secret=$(uci -q get ${CONFIG}.${_user}.secret) + [ -n "${u_secret}" ] || continue + + echo "${u_identifier} : PSK '${u_secret}'" >> ${IPSEC_SECRETS_FILE} + done + } + } + + ([ "${vt_type}" = "IKEv1" ] || [ "${vt_type}" = "L2TP" ]) && { + cat >> ${IPSEC_CONN_FILE} <<-EOF + conn IKEv1-PSK-XAuth + keyexchange=ikev1 + EOF + local vt_secret=$(uci -q get ${CONFIG}.@service[0].secret) + cat >> ${IPSEC_SECRETS_FILE} <<-EOF + : PSK "$vt_secret" + EOF + } + + [ "${vt_type}" = "IKEv1" ] && { + cat >> ${IPSEC_CONN_FILE} <<-EOF + also=conn-ipsec + leftauth=psk + rightauth=psk + rightauth2=xauth + EOF + local ipsec_users=$(get_enabled_anonymous_secs "@ipsec_users") + [ -n "${ipsec_users}" ] && { + for _user in ${ipsec_users}; do + local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled) + [ "${u_enabled}" -eq 1 ] || continue + + local u_username=$(uci -q get ${CONFIG}.${_user}.username) + [ -n "${u_username}" ] || continue + + local u_password=$(uci -q get ${CONFIG}.${_user}.password) + [ -n "${u_password}" ] || continue + + echo "${u_username} : XAUTH '${u_password}'" >> ${IPSEC_SECRETS_FILE} + done + } + } + + [ "${vt_type}" = "L2TP" ] && { + cat >> ${IPSEC_CONN_FILE} <<-EOF + + conn L2TP-IKEv1-PSK + type=transport + keyexchange=ikev1 + authby=secret + leftprotoport=udp/1701 + left=%any + right=%any + rekey=no + forceencaps=yes + EOF - ) mkdir -p ${L2TP_PATH} cat > ${L2TP_OPTIONS_FILE} <<-EOF @@ -143,6 +263,7 @@ start() { lcp-echo-interval 60 connect-delay 5000 EOF + local l2tp_remoteip=$(uci -q get ${CONFIG}.@service[0].l2tp_remoteip) cat > ${L2TP_CONFIG_FILE} <<-EOF [global] port = 1701 @@ -151,7 +272,7 @@ start() { ;debug state = yes ;debug tunnel = yes [lns default] - ip range = ${vt_remoteip} + ip range = ${l2tp_remoteip} local ip = ${l2tp_localip} require chap = yes refuse pap = yes @@ -162,6 +283,7 @@ start() { length bit = yes EOF + touch ${CHAP_SECRETS} local l2tp_users=$(get_enabled_anonymous_secs "@l2tp_users") [ -n "${l2tp_users}" ] && { for _user in ${l2tp_users}; do @@ -188,106 +310,10 @@ start() { rm -f "/usr/lib/ipsec/libipsec.so.0" } - cat > ${IPSEC_CONN_FILE} <<-EOF - # ipsec.conf - strongSwan IPsec configuration file - - config setup - uniqueids=no - charondebug="cfg 2, dmn 2, ike 2, net 0" - - conn %default - dpdaction=clear - dpddelay=300s - rekey=no - left=%defaultroute - leftfirewall=yes - right=%any - ikelifetime=60m - keylife=20m - rekeymargin=3m - keyingtries=1 - auto=add - ike=aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1536 - esp=aes256-sha256,aes128-sha1,3des-sha1 - - conn conn-ipsec - leftsubnet=0.0.0.0/0 - rightsubnet=${vt_clientip} - rightsourceip=${vt_clientip} - rightdns=${vt_gateway} - - EOF - - [ "${vt_type}" = "IKEv1" ] && { - cat >> ${IPSEC_CONN_FILE} <<-EOF - conn IKEv1-PSK-XAuth - also=conn-ipsec - keyexchange=ikev1 - leftauth=psk - rightauth=psk - rightauth2=xauth - - $ipsec_l2tp_config - EOF - local vt_secret=$(uci -q get ${CONFIG}.@service[0].secret) - cat > /etc/ipsec.secrets <<-EOF - # /etc/ipsec.secrets - strongSwan IPsec secrets file - : PSK "$vt_secret" - EOF - local ipsec_users=$(get_enabled_anonymous_secs "@ipsec_users") - [ -n "${ipsec_users}" ] && { - for _user in ${ipsec_users}; do - local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled) - [ "${u_enabled}" -eq 1 ] || continue - - local u_username=$(uci -q get ${CONFIG}.${_user}.username) - [ -n "${u_username}" ] || continue - - local u_password=$(uci -q get ${CONFIG}.${_user}.password) - [ -n "${u_password}" ] || continue - - echo "${u_username} : XAUTH '${u_password}'" >> ${IPSEC_SECRETS_FILE} - done - } - } - - [ "${vt_type}" = "IKEv2" ] && { - cat >> ${IPSEC_CONN_FILE} <<-EOF - conn IKEv2-PSK-XAuth - also=conn-ipsec - keyexchange=ikev2 - leftauth=psk - rightauth=psk - EOF - cat > /etc/ipsec.secrets <<-EOF - # /etc/ipsec.secrets - strongSwan IPsec secrets file - EOF - local ikev2_users=$(get_enabled_anonymous_secs "@ikev2_users") - [ -n "${ikev2_users}" ] && { - for _user in ${ikev2_users}; do - local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled) - [ "${u_enabled}" -eq 1 ] || continue - - local u_username=$(uci -q get ${CONFIG}.${_user}.username) - [ -n "${u_username}" ] || continue - - local u_secret=$(uci -q get ${CONFIG}.${_user}.secret) - [ -n "${u_secret}" ] || continue - - echo "${u_username} : PSK '${u_secret}'" >> ${IPSEC_SECRETS_FILE} - done - } - } - ipt_rule add /usr/lib/ipsec/starter --daemon charon --nofork > /dev/null 2>&1 & gen_include - - uci -q batch <<-EOF >/dev/null - set network.ipsec_server.ipaddr="${vt_clientip%.*}.1" - commit network - EOF ifup ipsec_server > /dev/null 2>&1 } @@ -302,29 +328,3 @@ stop() { rm -rf /var/etc/ipsecvpn.include ln -s "libipsec.so.0.0.0" "/usr/lib/ipsec/libipsec.so.0" >/dev/null 2>&1 } - -gen_iface_and_firewall() { - uci -q batch <<-EOF >/dev/null - delete network.ipsec_server - set network.ipsec_server=interface - set network.ipsec_server.ifname="ipsec0" - set network.ipsec_server.device="ipsec0" - set network.ipsec_server.proto="static" - set network.ipsec_server.ipaddr="${vt_clientip%.*}.1" - set network.ipsec_server.netmask="255.255.255.0" - commit network - - delete firewall.ipsecserver - set firewall.ipsecserver=zone - set firewall.ipsecserver.name="ipsecserver" - set firewall.ipsecserver.input="ACCEPT" - set firewall.ipsecserver.forward="ACCEPT" - set firewall.ipsecserver.output="ACCEPT" - set firewall.ipsecserver.network="ipsec_server" - commit firewall - EOF -} - -if [ -z "$(uci -q get network.ipsec_server)" ] || [ -z "$(uci -q get firewall.ipsecserver)" ]; then - gen_iface_and_firewall -fi diff --git a/v2ray-geodata/Makefile b/v2ray-geodata/Makefile index be20ec9f..049f5085 100644 --- a/v2ray-geodata/Makefile +++ b/v2ray-geodata/Makefile @@ -21,13 +21,13 @@ define Download/geoip HASH:=b71d1999439dde2de2d2b6844a2befa50c50211ff739785c005ca7c230a17d6a endef -GEOSITE_VER:=20260731062338 +GEOSITE_VER:=20260801093436 GEOSITE_FILE:=dlc.dat.$(GEOSITE_VER) define Download/geosite URL:=https://github.com/v2fly/domain-list-community/releases/download/$(GEOSITE_VER)/ URL_FILE:=dlc.dat FILE:=$(GEOSITE_FILE) - HASH:=3912cba980259a6443cb76413a22cbd4a979641439625ed5db8a3bdf6c238311 + HASH:=02dfe674d58e5ae6b803a96e910c61fd0fe0ee9d898152805bcfad687f3d0fcf endef GEOSITE_IRAN_VER:=202607270122