mirror of
https://github.com/caiwx86/small-packages.git
synced 2026-11-03 16:33:56 +08:00
update 2026-08-01 04:58:58
This commit is contained in:
action committed
1 parent
5a97078bb7
commit
f00c081748
1964 files changed
+1523362
-117
No files matched your search
@@ -1,7 +1,11 @@
|
||||
|
||||
config service 'ipsec'
|
||||
option enabled '0'
|
||||
option secret 'ipsec'
|
||||
option clientip '192.168.100.10/24'
|
||||
option type 'IKEv2'
|
||||
|
||||
config ikev2_users
|
||||
option enabled '1'
|
||||
option username '1'
|
||||
option secret 'ipsec'
|
||||
|
||||
@@ -12,11 +12,13 @@ L2TP_CONFIG_FILE=${L2TP_PATH}/xl2tpd.conf
|
||||
L2TP_OPTIONS_FILE=${L2TP_PATH}/options.xl2tpd
|
||||
L2TP_LOG_FILE=${L2TP_PATH}/xl2tpd.log
|
||||
|
||||
vt_clientip=$(uci -q get ${CONFIG}.@service[0].clientip)
|
||||
l2tp_enabled=$(uci -q get ${CONFIG}.@service[0].l2tp_enable)
|
||||
l2tp_localip=$(uci -q get ${CONFIG}.@service[0].l2tp_localip)
|
||||
ipt_comment="IPSec VPN Server"
|
||||
|
||||
ipt_flag="IPSec VPN Server"
|
||||
init_config() {
|
||||
vt_clientip=$(uci -q get ${CONFIG}.@service[0].clientip)
|
||||
l2tp_enabled=$(uci -q get ${CONFIG}.@service[0].l2tp_enable)
|
||||
l2tp_localip=$(uci -q get ${CONFIG}.@service[0].l2tp_localip)
|
||||
}
|
||||
|
||||
get_enabled_anonymous_secs() {
|
||||
uci -q show "${CONFIG}" | grep "${1}\[.*\.enabled='1'" | cut -d '.' -sf2
|
||||
@@ -24,29 +26,49 @@ get_enabled_anonymous_secs() {
|
||||
|
||||
ipt_rule() {
|
||||
if [ "$1" = "add" ]; then
|
||||
iptables -t nat -I postrouting_rule -s ${vt_clientip} -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
|
||||
iptables -I forwarding_rule -s ${vt_clientip} -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
|
||||
iptables -I forwarding_rule -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
|
||||
iptables -I forwarding_rule -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
|
||||
iptables -I input_rule -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
|
||||
iptables -t mangle -I OUTPUT -p udp -m multiport --sports 500,4500 -m comment --comment "${ipt_flag}" -j RETURN 2>/dev/null
|
||||
iptables -w -I input_rule -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -t mangle -I OUTPUT -p udp -m multiport --sports 500,4500 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
|
||||
iptables -w -I forwarding_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I forwarding_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I forwarding_rule -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I forwarding_rule -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -t nat -I postrouting_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
|
||||
[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -s ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
|
||||
iptables -w -t nat -I postrouting_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
|
||||
[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -d ${vt_clientip} -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
|
||||
|
||||
ip6tables -w -I input_rule -p udp -m multiport --dports 500,4500 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
ip6tables -w -t mangle -I OUTPUT -p udp -m multiport --sports 500,4500 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
|
||||
ip6tables -w -I forwarding_rule -m policy --dir in --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
ip6tables -w -I forwarding_rule -m policy --dir out --pol ipsec --proto esp -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
|
||||
[ "${l2tp_enabled}" = 1 ] && {
|
||||
iptables -t nat -I postrouting_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j MASQUERADE 2>/dev/null
|
||||
iptables -I forwarding_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
|
||||
iptables -I input_rule -p udp --dport 1701 -m comment --comment "${ipt_flag}" -j ACCEPT 2>/dev/null
|
||||
iptables -t mangle -I OUTPUT -p udp --sport 1701 -m comment --comment "${ipt_flag}" -j RETURN 2>/dev/null
|
||||
iptables -w -I input_rule -p udp --dport 1701 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -t mangle -I OUTPUT -p udp --sport 1701 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
|
||||
iptables -w -I forwarding_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -I forwarding_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
iptables -w -t nat -I postrouting_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
|
||||
[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -s ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
|
||||
iptables -w -t nat -I postrouting_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j FULLCONENAT 2>/dev/null
|
||||
[ "$?" != "0" ] && iptables -w -t nat -I postrouting_rule -d ${l2tp_localip%.*}.0/24 -m comment --comment "${ipt_comment}" -j MASQUERADE 2>/dev/null
|
||||
|
||||
ip6tables -w -I input_rule -p udp --dport 1701 -m comment --comment "${ipt_comment}" -j ACCEPT 2>/dev/null
|
||||
ip6tables -w -t mangle -I OUTPUT -p udp --sport 1701 -m comment --comment "${ipt_comment}" -j RETURN 2>/dev/null
|
||||
}
|
||||
else
|
||||
ipt_del() {
|
||||
for i in $(seq 1 $($1 -nL $2 | grep -c "${ipt_flag}")); do
|
||||
local index=$($1 --line-number -nL $2 | grep "${ipt_flag}" | head -1 | awk '{print $1}')
|
||||
for i in $(seq 1 $($1 -nL $2 | grep -c "${ipt_comment}")); do
|
||||
local index=$($1 --line-number -nL $2 | grep "${ipt_comment}" | head -1 | awk '{print $1}')
|
||||
$1 -w -D $2 $index 2>/dev/null
|
||||
done
|
||||
}
|
||||
ipt_del "iptables" "forwarding_rule"
|
||||
ipt_del "iptables" "input_rule"
|
||||
ipt_del "iptables -t nat" "postrouting_rule"
|
||||
ipt_del "iptables -t mangle" "OUTPUT"
|
||||
ipt_del "iptables -w" "forwarding_rule"
|
||||
ipt_del "iptables -w" "input_rule"
|
||||
ipt_del "iptables -w -t nat" "postrouting_rule"
|
||||
ipt_del "iptables -w -t mangle" "OUTPUT"
|
||||
ipt_del "ip6tables -w" "forwarding_rule"
|
||||
ipt_del "ip6tables -w" "input_rule"
|
||||
ipt_del "ip6tables -w -t mangle" "OUTPUT"
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -54,36 +76,46 @@ gen_include() {
|
||||
echo '#!/bin/sh' > /var/etc/ipsecvpn.include
|
||||
extract_rules() {
|
||||
echo "*$1"
|
||||
iptables-save -t $1 | grep "${ipt_flag}" | \
|
||||
iptables-save -t $1 | grep "${ipt_comment}" | \
|
||||
sed -e "s/^-A \(INPUT\)/-I \1 1/"
|
||||
echo 'COMMIT'
|
||||
}
|
||||
extract_rules6() {
|
||||
echo "*$1"
|
||||
ip6tables-save -t $1 | grep "${ipt_comment}" | \
|
||||
sed -e "s/^-A \(INPUT\)/-I \1 1/"
|
||||
echo 'COMMIT'
|
||||
}
|
||||
cat <<-EOF >> /var/etc/ipsecvpn.include
|
||||
iptables-save -c | grep -v "${ipt_flag}" | iptables-restore -c
|
||||
iptables-save -c | grep -v "${ipt_comment}" | iptables-restore -c
|
||||
iptables-restore -n <<-EOT
|
||||
$(extract_rules filter)
|
||||
$(extract_rules nat)
|
||||
$(extract_rules mangle)
|
||||
EOT
|
||||
|
||||
ip6tables-save -c | grep -v "${ipt_comment}" | ip6tables-restore -c
|
||||
ip6tables-restore -n <<-EOT
|
||||
$(extract_rules6 filter)
|
||||
$(extract_rules6 mangle)
|
||||
EOT
|
||||
EOF
|
||||
return 0
|
||||
}
|
||||
|
||||
start() {
|
||||
init_config
|
||||
local vt_enabled=$(uci -q get ${CONFIG}.@service[0].enabled)
|
||||
[ "$vt_enabled" = 0 ] && return 1
|
||||
|
||||
|
||||
local vt_type=$(uci -q get ${CONFIG}.@service[0].type)
|
||||
local vt_gateway="${vt_clientip%.*}.1"
|
||||
local vt_secret=$(uci -q get ${CONFIG}.@service[0].secret)
|
||||
|
||||
|
||||
local l2tp_enabled=$(uci -q get ${CONFIG}.@service[0].l2tp_enable)
|
||||
[ "${l2tp_enabled}" = 1 ] && {
|
||||
[ "${vt_type}" = "IKEv1" ] && [ "${l2tp_enabled}" = 1 ] && {
|
||||
touch ${CHAP_SECRETS}
|
||||
local vt_remoteip=$(uci -q get ${CONFIG}.@service[0].l2tp_remoteip)
|
||||
local ipsec_l2tp_config=$(cat <<-EOF
|
||||
#######################################
|
||||
# L2TP Connections
|
||||
#######################################
|
||||
|
||||
conn L2TP-IKEv1-PSK
|
||||
type=transport
|
||||
keyexchange=ikev1
|
||||
@@ -93,11 +125,9 @@ start() {
|
||||
right=%any
|
||||
rekey=no
|
||||
forceencaps=yes
|
||||
ike=aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1536
|
||||
esp=aes128-sha1,3des-sha1
|
||||
EOF
|
||||
)
|
||||
|
||||
|
||||
mkdir -p ${L2TP_PATH}
|
||||
cat > ${L2TP_OPTIONS_FILE} <<-EOF
|
||||
name "l2tp-server"
|
||||
@@ -131,34 +161,33 @@ start() {
|
||||
pppoptfile = ${L2TP_OPTIONS_FILE}
|
||||
length bit = yes
|
||||
EOF
|
||||
|
||||
|
||||
local l2tp_users=$(get_enabled_anonymous_secs "@l2tp_users")
|
||||
[ -n "${l2tp_users}" ] && {
|
||||
for _user in ${l2tp_users}; do
|
||||
local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled)
|
||||
[ "${u_enabled}" -eq 1 ] || continue
|
||||
|
||||
|
||||
local u_username=$(uci -q get ${CONFIG}.${_user}.username)
|
||||
[ -n "${u_username}" ] || continue
|
||||
|
||||
|
||||
local u_password=$(uci -q get ${CONFIG}.${_user}.password)
|
||||
[ -n "${u_password}" ] || continue
|
||||
|
||||
|
||||
local u_ipaddress=$(uci -q get ${CONFIG}.${_user}.ipaddress)
|
||||
[ -n "${u_ipaddress}" ] || u_ipaddress="*"
|
||||
|
||||
|
||||
echo "${u_username} l2tp-server ${u_password} ${u_ipaddress}" >> ${CHAP_SECRETS}
|
||||
done
|
||||
}
|
||||
unset user
|
||||
|
||||
|
||||
echo "ip-up-script /usr/share/xl2tpd/ip-up" >> ${L2TP_OPTIONS_FILE}
|
||||
echo "ip-down-script /usr/share/xl2tpd/ip-down" >> ${L2TP_OPTIONS_FILE}
|
||||
|
||||
xl2tpd -c ${L2TP_CONFIG_FILE} -C ${L2TP_CONTROL_FILE} -D >${L2TP_LOG_FILE} 2>&1 &
|
||||
rm -f "/usr/lib/ipsec/libipsec.so.0"
|
||||
}
|
||||
|
||||
|
||||
cat > ${IPSEC_CONN_FILE} <<-EOF
|
||||
# ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
@@ -178,57 +207,83 @@ start() {
|
||||
rekeymargin=3m
|
||||
keyingtries=1
|
||||
auto=add
|
||||
|
||||
#######################################
|
||||
# Default non L2TP Connections
|
||||
#######################################
|
||||
ike=aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1536
|
||||
esp=aes256-sha256,aes128-sha1,3des-sha1
|
||||
|
||||
conn Non-L2TP
|
||||
conn conn-ipsec
|
||||
leftsubnet=0.0.0.0/0
|
||||
rightsubnet=${vt_clientip}
|
||||
rightsourceip=${vt_clientip}
|
||||
rightdns=${vt_gateway}
|
||||
ike=aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1536
|
||||
esp=aes128-sha1,3des-sha1
|
||||
|
||||
# Cisco IPSec
|
||||
conn IKEv1-PSK-XAuth
|
||||
also=Non-L2TP
|
||||
keyexchange=ikev1
|
||||
leftauth=psk
|
||||
rightauth=psk
|
||||
rightauth2=xauth
|
||||
|
||||
$ipsec_l2tp_config
|
||||
EOF
|
||||
|
||||
cat > /etc/ipsec.secrets <<-EOF
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
: PSK "$vt_secret"
|
||||
EOF
|
||||
|
||||
local ipsec_users=$(get_enabled_anonymous_secs "@ipsec_users")
|
||||
[ -n "${ipsec_users}" ] && {
|
||||
for _user in ${ipsec_users}; do
|
||||
local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled)
|
||||
[ "${u_enabled}" -eq 1 ] || continue
|
||||
|
||||
local u_username=$(uci -q get ${CONFIG}.${_user}.username)
|
||||
[ -n "${u_username}" ] || continue
|
||||
|
||||
local u_password=$(uci -q get ${CONFIG}.${_user}.password)
|
||||
[ -n "${u_password}" ] || continue
|
||||
|
||||
echo "${u_username} : XAUTH '${u_password}'" >> ${IPSEC_SECRETS_FILE}
|
||||
done
|
||||
[ "${vt_type}" = "IKEv1" ] && {
|
||||
cat >> ${IPSEC_CONN_FILE} <<-EOF
|
||||
conn IKEv1-PSK-XAuth
|
||||
also=conn-ipsec
|
||||
keyexchange=ikev1
|
||||
leftauth=psk
|
||||
rightauth=psk
|
||||
rightauth2=xauth
|
||||
|
||||
$ipsec_l2tp_config
|
||||
EOF
|
||||
local vt_secret=$(uci -q get ${CONFIG}.@service[0].secret)
|
||||
cat > /etc/ipsec.secrets <<-EOF
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
: PSK "$vt_secret"
|
||||
EOF
|
||||
local ipsec_users=$(get_enabled_anonymous_secs "@ipsec_users")
|
||||
[ -n "${ipsec_users}" ] && {
|
||||
for _user in ${ipsec_users}; do
|
||||
local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled)
|
||||
[ "${u_enabled}" -eq 1 ] || continue
|
||||
|
||||
local u_username=$(uci -q get ${CONFIG}.${_user}.username)
|
||||
[ -n "${u_username}" ] || continue
|
||||
|
||||
local u_password=$(uci -q get ${CONFIG}.${_user}.password)
|
||||
[ -n "${u_password}" ] || continue
|
||||
|
||||
echo "${u_username} : XAUTH '${u_password}'" >> ${IPSEC_SECRETS_FILE}
|
||||
done
|
||||
}
|
||||
}
|
||||
unset user
|
||||
|
||||
[ "${vt_type}" = "IKEv2" ] && {
|
||||
cat >> ${IPSEC_CONN_FILE} <<-EOF
|
||||
conn IKEv2-PSK-XAuth
|
||||
also=conn-ipsec
|
||||
keyexchange=ikev2
|
||||
leftauth=psk
|
||||
rightauth=psk
|
||||
EOF
|
||||
cat > /etc/ipsec.secrets <<-EOF
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
EOF
|
||||
local ikev2_users=$(get_enabled_anonymous_secs "@ikev2_users")
|
||||
[ -n "${ikev2_users}" ] && {
|
||||
for _user in ${ikev2_users}; do
|
||||
local u_enabled=$(uci -q get ${CONFIG}.${_user}.enabled)
|
||||
[ "${u_enabled}" -eq 1 ] || continue
|
||||
|
||||
local u_username=$(uci -q get ${CONFIG}.${_user}.username)
|
||||
[ -n "${u_username}" ] || continue
|
||||
|
||||
local u_secret=$(uci -q get ${CONFIG}.${_user}.secret)
|
||||
[ -n "${u_secret}" ] || continue
|
||||
|
||||
echo "${u_username} : PSK '${u_secret}'" >> ${IPSEC_SECRETS_FILE}
|
||||
done
|
||||
}
|
||||
}
|
||||
|
||||
ipt_rule add
|
||||
|
||||
|
||||
/usr/lib/ipsec/starter --daemon charon --nofork > /dev/null 2>&1 &
|
||||
gen_include
|
||||
|
||||
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
set network.ipsec_server.ipaddr="${vt_clientip%.*}.1"
|
||||
commit network
|
||||
@@ -237,6 +292,7 @@ start() {
|
||||
}
|
||||
|
||||
stop() {
|
||||
init_config
|
||||
ifdown ipsec_server > /dev/null 2>&1
|
||||
sed -i '/l2tp-server/d' ${CHAP_SECRETS} 2>/dev/null
|
||||
top -bn1 | grep "${L2TP_PATH}" | grep -v "grep" | awk '{print $1}' | xargs kill -9 >/dev/null 2>&1
|
||||
|
||||
Reference in new issue
Block a user