mirror of
https://github.com/Ysurac/openmptcprouter-vps.git
synced 2025-02-14 12:21:56 +00:00
Add MLVPN support, change glorytun network
This commit is contained in:
Ycarus (Yannick Chabanois)
parent
ef77d27737
commit
55433c52e4
13 changed files with 231 additions and 28 deletions
127
debian9-x86_64-mlvpn.sh
Normal file
127
debian9-x86_64-mlvpn.sh
Normal file
|
|
@ -0,0 +1,127 @@
|
|||
#!/bin/sh
|
||||
MLVPN_PASS=${MLVPN_PASS:-$(head -c 32 /dev/urandom | base64 -w0)}
|
||||
INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | awk '{print $5}' | tr -d "\n")}
|
||||
DEBIAN_VERSION=$(sed 's/\..*//' /etc/debian_version)
|
||||
|
||||
set -e
|
||||
umask 0022
|
||||
update="0"
|
||||
if [ $DEBIAN_VERSION -ne 9 ]; then
|
||||
echo "This script only work with Debian Stretch (9.x)"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -f "/etc/mlvpn/mlvpn0.conf" ] ; then
|
||||
update="1"
|
||||
fi
|
||||
if ! grep -q 'DefaultLimitNOFILE=65536' /etc/systemd/system.conf ; then
|
||||
echo 'DefaultLimitNOFILE=65536' >> /etc/systemd/system.conf
|
||||
fi
|
||||
|
||||
# Install MLVPN
|
||||
if systemctl -q is-active mlvpn@mlvpn0.service; then
|
||||
systemctl -q stop mlvpn@mlvpn0 > /dev/null 2>&1
|
||||
fi
|
||||
apt-get -y install build-essential pkg-config autoconf automake
|
||||
cd /tmp
|
||||
wget -O /tmp/mlvpn-2.3.2.tar.gz https://github.com/zehome/MLVPN/archive/2.3.2.tar.gz
|
||||
cd /tmp
|
||||
tar xzf mlvpn-2.3.2.tar.gz
|
||||
cd MLVPN-2.3.2
|
||||
./autogen.sh
|
||||
./configure
|
||||
make
|
||||
make install
|
||||
wget -O /lib/systemd/network/mlvpn.network http://www.openmptcprouter.com/server/mlvpn.network
|
||||
mkdir -p /etc/mlvpn
|
||||
if [ "$update" = "0" ]; then
|
||||
wget -O /etc/mlvpn/mlvpn0.conf http://www.openmptcprouter.com/server/mlvpn0.conf
|
||||
sed -i "s:MLVPN_PASS:$MLVPN_PASS:" /etc/mlvpn/mlvpn0.conf
|
||||
fi
|
||||
systemctl enable mlvpn@mlvpn0.service
|
||||
systemctl enable systemd-networkd.service
|
||||
cd /tmp
|
||||
rm -r /tmp/MLVPN-2.3.2
|
||||
|
||||
# Add 6in4 support
|
||||
wget -O /usr/local/bin/omr-6in4 http://www.openmptcprouter.com/server/omr-6in4
|
||||
chmod 755 /usr/local/bin/omr-6in4
|
||||
wget -O /usr/local/bin/omr-6in4-service http://www.openmptcprouter.com/server/omr-6in4-service
|
||||
chmod 755 /usr/local/bin/omr-6in4-service
|
||||
wget -O /lib/systemd/system/omr-6in4.service http://www.openmptcprouter.com/server/omr-6in4.service.in
|
||||
systemctl enable omr-6in4.service
|
||||
|
||||
# Change SSH port to 65222
|
||||
sed -i 's:#Port 22:Port 65222:g' /etc/ssh/sshd_config
|
||||
sed -i 's:Port 22:Port 65222:g' /etc/ssh/sshd_config
|
||||
|
||||
# Remove Bind9 if available
|
||||
#systemctl -q disable bind9
|
||||
|
||||
# Remove fail2ban if available
|
||||
#systemctl -q disable fail2ban
|
||||
|
||||
if [ "$update" = "0" ]; then
|
||||
# Install and configure the firewall using shorewall
|
||||
apt-get -y install shorewall shorewall6
|
||||
wget -O /etc/shorewall/openmptcprouter-shorewall.tar.gz http://www.openmptcprouter.com/server/openmptcprouter-shorewall.tar.gz
|
||||
tar xzf /etc/shorewall/openmptcprouter-shorewall.tar.gz -C /etc/shorewall
|
||||
rm /etc/shorewall/openmptcprouter-shorewall.tar.gz
|
||||
sed -i "s:eth0:$INTERFACE:g" /etc/shorewall/*
|
||||
systemctl enable shorewall
|
||||
wget -O /etc/shorewall6/openmptcprouter-shorewall6.tar.gz http://www.openmptcprouter.com/server/openmptcprouter-shorewall6.tar.gz
|
||||
tar xzf /etc/shorewall6/openmptcprouter-shorewall6.tar.gz -C /etc/shorewall6
|
||||
rm /etc/shorewall6/openmptcprouter-shorewall6.tar.gz
|
||||
sed -i "s:eth0:$INTERFACE:g" /etc/shorewall6/*
|
||||
systemctl enable shorewall6
|
||||
else
|
||||
# Update only needed firewall files
|
||||
wget -O /etc/shorewall/interfaces http://www.openmptcprouter.com/server/shorewall4/interfaces
|
||||
wget -O /etc/shorewall/snat http://www.openmptcprouter.com/server/shorewall4/snat
|
||||
wget -O /etc/shorewall/stoppedrules http://www.openmptcprouter.com/server/shorewall4/stoppedrules
|
||||
sed -i "s:eth0:$INTERFACE:g" /etc/shorewall/*
|
||||
wget -O /etc/shorewall6/interfaces http://www.openmptcprouter.com/server/shorewall6/interfaces
|
||||
wget -O /etc/shorewall6/stoppedrules http://www.openmptcprouter.com/server/shorewall6/stoppedrules
|
||||
sed -i "s:eth0:$INTERFACE:g" /etc/shorewall6/*
|
||||
fi
|
||||
|
||||
if [ "$update" = "0" ]; then
|
||||
# Display important info
|
||||
echo '=========================================================================================='
|
||||
echo 'OpenMPTCProuter VPS MLVPN is now configured !'
|
||||
echo 'SSH port: 65222 (instead of port 22)'
|
||||
echo 'MLVPN first port: 65201'
|
||||
echo 'Your MLVPN password: '
|
||||
echo $MLVPN_PASS
|
||||
echo '=========================================================================================='
|
||||
echo 'Keys are also saved in /root/openmptcprouter_mlvpn_config.txt, you are free to remove them'
|
||||
echo '=========================================================================================='
|
||||
|
||||
# Save info in file
|
||||
cat > /root/openmptcprouter_mlvpn_config.txt <<-EOF
|
||||
SSH port: 65222 (instead of port 22)
|
||||
MLVPN first port: 65201
|
||||
Your MLVPN password:
|
||||
${MLVPN_PASS}
|
||||
EOF
|
||||
if [ -f "/root/openmptcprouter_config.txt" ]; then
|
||||
cat >> /root/openmptcprouter_config.txt <<-EOF
|
||||
MLVPN first port: 65201
|
||||
Your MLVPN password:
|
||||
${MLVPN_PASS}
|
||||
EOF
|
||||
fi
|
||||
else
|
||||
echo '===================================================================================='
|
||||
echo 'OpenMPTCProuter VPS MLVPN is now updated !'
|
||||
echo 'Keys are not changed, shorewall rules files preserved'
|
||||
echo '===================================================================================='
|
||||
echo 'Restarting mlvpn and omr-6in4...'
|
||||
systemctl -q start mlvpn@mlvpn0
|
||||
systemctl -q restart omr-6in4
|
||||
echo 'done'
|
||||
echo 'Restarting shorewall...'
|
||||
systemctl -q restart shorewall
|
||||
systemctl -q restart shorewall6
|
||||
echo 'done'
|
||||
fi
|
||||
|
|
@ -4,6 +4,7 @@ GLORYTUN_PASS=${GLORYTUN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lowe
|
|||
#NBCPU=${NBCPU:-$(nproc --all | tr -d "\n")}
|
||||
NBCPU=${NBCPU:-$(grep -c '^processor' /proc/cpuinfo | tr -d "\n")}
|
||||
OBFS=${OBFS:-no}
|
||||
MLVPN=${MLVPN:-no}
|
||||
INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | awk '{print $5}' | tr -d "\n")}
|
||||
DEBIAN_VERSION=$(sed 's/\..*//' /etc/debian_version)
|
||||
|
||||
|
|
@ -35,8 +36,8 @@ cd /boot
|
|||
apt-get -y install rename
|
||||
rename 's/^bzImage/vmlinuz/s' * >/dev/null 2>&1
|
||||
#apt-get -y install linux-mptcp
|
||||
dpkg -i /tmp/linux-image-4.14.24-mptcp-64056fa.amd64.deb
|
||||
dpkg -i /tmp/linux-headers-4.14.24-mptcp-64056fa.amd64.deb
|
||||
dpkg -E -i /tmp/linux-image-4.14.24-mptcp-64056fa.amd64.deb
|
||||
dpkg -E -i /tmp/linux-headers-4.14.24-mptcp-64056fa.amd64.deb
|
||||
|
||||
# Check if mptcp kernel is grub default kernel
|
||||
echo "Set MPTCP kernel as grub default..."
|
||||
|
|
@ -46,19 +47,19 @@ bash update-grub.sh 4.14.24-mptcp
|
|||
|
||||
#apt -t stretch-backports -y install shadowsocks-libev
|
||||
## Compile Shadowsocks
|
||||
wget -O /tmp/shadowsocks-libev-3.1.3.tar.gz http://github.com/shadowsocks/shadowsocks-libev/releases/download/v3.1.3/shadowsocks-libev-3.1.3.tar.gz
|
||||
wget -O /tmp/shadowsocks-libev-3.2.0.tar.gz http://github.com/shadowsocks/shadowsocks-libev/releases/download/v3.2.0/shadowsocks-libev-3.2.0.tar.gz
|
||||
cd /tmp
|
||||
tar xzf shadowsocks-libev-3.1.3.tar.gz
|
||||
cd shadowsocks-libev-3.1.3
|
||||
wget https://github.com/Ysurac/openmptcprouter-feeds/raw/5b2caab3f98cc14e6b5fdb80a95fcd1ac61630ff/shadowsocks-libev/patches/020-NOCRYPTO.patch
|
||||
tar xzf shadowsocks-libev-3.2.0.tar.gz
|
||||
cd shadowsocks-libev-3.2.0
|
||||
wget https://raw.githubusercontent.com/Ysurac/openmptcprouter-feeds/master/shadowsocks-libev/patches/020-NOCRYPTO.patch
|
||||
patch -p1 < 020-NOCRYPTO.patch
|
||||
apt-get -y install --no-install-recommends devscripts equivs apg libcap2-bin libpam-cap
|
||||
apt -y -t stretch-backports install libsodium-dev
|
||||
mk-build-deps --install --tool "apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends -y"
|
||||
dpkg-buildpackage -b -us -uc
|
||||
cd ..
|
||||
dpkg -i shadowsocks-libev_3.1.3-1_amd64.deb
|
||||
rm -r /tmp/shadowsocks-libev-3.1.3
|
||||
dpkg -i shadowsocks-libev_3.2.0-1_amd64.deb
|
||||
rm -r /tmp/shadowsocks-libev-3.2.0
|
||||
|
||||
# Load OLIA Congestion module at boot time
|
||||
if ! grep -q olia /etc/modules ; then
|
||||
|
|
@ -102,6 +103,14 @@ if [ "$OBFS" = "yes" ]; then
|
|||
sed -i 's%"mptcp": true%"mptcp": true,\n"plugin": "/usr/local/bin/obfs-server --obfs http --mptcp --fast-open"%' /etc/shadowsocks-libev/config.json
|
||||
fi
|
||||
|
||||
if [ "$MLVPN" = "yes" ]; then
|
||||
cd /tmp
|
||||
wget http://www.openmptcprouter.com/server/debian9-x86_64-mlvpn.sh
|
||||
chmod u+x debian9-x86_64-mlvpn.sh
|
||||
sh debian9-x86_64-mlvpn.sh
|
||||
rm debian9-x86_64-mlvpn.sh
|
||||
fi
|
||||
|
||||
# Install Glorytun UDP
|
||||
if systemctl -q is-active glorytun-udp@tun0.service; then
|
||||
systemctl -q stop glorytun-udp@tun0 > /dev/null 2>&1
|
||||
|
|
@ -212,9 +221,9 @@ fi
|
|||
|
||||
# Add OpenMPTCProuter VPS script version to /etc/motd
|
||||
if grep --quiet 'OpenMPTCProuter VPS' /etc/motd; then
|
||||
sed -i 's:< OpenMPTCProuter VPS [0-9]*\.[0-9]* >:< OpenMPCTProuter VPS 0.20 >:' /etc/motd
|
||||
sed -i 's:< OpenMPTCProuter VPS [0-9]*\.[0-9]* >:< OpenMPCTProuter VPS 0.21 >:' /etc/motd
|
||||
else
|
||||
echo '< OpenMPTCProuter VPS 0.20 >' >> /etc/motd
|
||||
echo '< OpenMPTCProuter VPS 0.21 >' >> /etc/motd
|
||||
fi
|
||||
|
||||
if [ "$update" = "0" ]; then
|
||||
|
|
@ -251,6 +260,9 @@ if [ "$update" = "0" ]; then
|
|||
Your glorytun key:
|
||||
${GLORYTUN_PASS}
|
||||
EOF
|
||||
if [ -f "/root/openmptcprouter_mlvpn_config.txt" ]; then
|
||||
cat /root/openmptcprouter_mlvpn_config.txt >> /root/openmptcprouter_config.txt
|
||||
fi
|
||||
else
|
||||
echo '===================================================================================='
|
||||
echo 'OpenMPTCProuter VPS is now updated !'
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@ Name=gt-udp-*
|
|||
|
||||
[Network]
|
||||
Description=Glorytun server device
|
||||
Address=0.0.0.0/24
|
||||
Address=10.255.254.1/24
|
||||
DHCPServer=yes
|
||||
IPMasquerade=yes
|
||||
|
||||
|
|
|
|||
|
|
@ -2,17 +2,17 @@
|
|||
Name=gt-*
|
||||
|
||||
[Link]
|
||||
MTUBytes=1280
|
||||
MTUBytes=1400
|
||||
|
||||
[Network]
|
||||
Description=Glorytun server device
|
||||
Address=0.0.0.0/24
|
||||
Address=10.255.255.1/24
|
||||
DHCPServer=yes
|
||||
IPMasquerade=yes
|
||||
|
||||
[DHCPServer]
|
||||
PoolOffset=2
|
||||
PoolSize=1
|
||||
PoolOffset=1
|
||||
PoolSize=2
|
||||
EmitDNS=no
|
||||
EmitNTP=no
|
||||
DNS=9.9.9.9
|
||||
|
|
|
|||
17
mlvpn.network
Normal file
17
mlvpn.network
Normal file
|
|
@ -0,0 +1,17 @@
|
|||
[Match]
|
||||
Name=mlvpn*
|
||||
|
||||
[Network]
|
||||
Description=MLVPN tunnel
|
||||
Address=10.255.253.1/24
|
||||
DHCPServer=yes
|
||||
IPMasquerade=yes
|
||||
|
||||
[DHCPServer]
|
||||
PoolOffset=2
|
||||
PoolSize=1
|
||||
EmitDNS=no
|
||||
EmitNTP=no
|
||||
DNS=9.9.9.9
|
||||
DefaultLeaseTimeSec=12h
|
||||
MaxLeaseTimeSec=24h
|
||||
41
mlvpn0.conf
Normal file
41
mlvpn0.conf
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
[general]
|
||||
tuntap = "tun"
|
||||
mode = "server"
|
||||
interface_name = "mlvpn0"
|
||||
timeout = 30
|
||||
password = "MLVPN_PASS"
|
||||
reorder_buffer_size = 64
|
||||
loss_tolerence = 50
|
||||
|
||||
[wan1]
|
||||
bindport = 65201
|
||||
bindhost = "0.0.0.0"
|
||||
|
||||
[wan2]
|
||||
bindport = 65202
|
||||
bindhost = "0.0.0.0"
|
||||
|
||||
[wan3]
|
||||
bindport = 65203
|
||||
bindhost = "0.0.0.0"
|
||||
|
||||
[wan4]
|
||||
bindport = 65204
|
||||
bindhost = "0.0.0.0"
|
||||
|
||||
[wan5]
|
||||
bindport = 65205
|
||||
bindhost = "0.0.0.0"
|
||||
|
||||
[wan6]
|
||||
bindport = 65206
|
||||
bindhost = "0.0.0.0"
|
||||
|
||||
[wan7]
|
||||
bindport = 65207
|
||||
bindhost = "0.0.0.0"
|
||||
|
||||
[wan8]
|
||||
bindport = 65208
|
||||
bindhost = "0.0.0.0"
|
||||
|
||||
|
|
@ -10,9 +10,9 @@ fi
|
|||
|
||||
# Add IPv6 tunnel
|
||||
if [ "$(ip link show omr-6in4 up)" ]; then
|
||||
ip tunnel change omr-6in4 mode sit remote 10.0.0.2 local 10.0.0.1
|
||||
ip tunnel change omr-6in4 mode sit remote 10.255.255.2 local 10.255.255.1
|
||||
else
|
||||
ip tunnel add omr-6in4 mode sit remote 10.0.0.2 local 10.0.0.1
|
||||
ip tunnel add omr-6in4 mode sit remote 10.255.255.2 local 10.255.255.1
|
||||
fi
|
||||
ip link set omr-6in4 up
|
||||
ip route replace fd00::/8 via fe80::a00:2 dev omr-6in4
|
||||
|
|
@ -38,8 +38,10 @@ while true; do
|
|||
if ! $(exit $status); then
|
||||
allip_tcp=$(ip -4 addr show gt-tun0 | grep inet)
|
||||
allip_udp=$(ip -4 addr show gt-udp-tun0 | grep inet)
|
||||
allip_mlvpn=$(ip -4 addr show mlvpn0 | grep inet)
|
||||
allip="$allip_tcp
|
||||
$allip_udp"
|
||||
$allip_udp
|
||||
$allip_mlvpn"
|
||||
while IFS= read -r inet; do
|
||||
ip=$(echo $inet | awk '{print $2}' | cut -d/ -f1 | tr -d "\n")
|
||||
ipd=$(echo $ip | sed 's/.1/.2/' | tr -d "\n")
|
||||
|
|
@ -47,6 +49,10 @@ $allip_udp"
|
|||
status=$?
|
||||
if $(exit $status); then
|
||||
ip tunnel change omr-6in4 mode sit remote $ipd local $ip
|
||||
echo "OMR_ADDR=$ipd" > /etc/shorewall/params.vpn
|
||||
iface=$(ip -4 addr | grep $ip | awk '{print $7}' | tr -d "\n")
|
||||
echo "OMR_IFACE=$iface" >> /etc/shorewall/params.vpn
|
||||
systemctl reload shorewall
|
||||
break
|
||||
fi
|
||||
done < <(printf '%s\n' "$allip")
|
||||
|
|
|
|||
|
|
@ -17,4 +17,5 @@
|
|||
net eth0 dhcp,tcpflags,routefilter,nosmurfs,logmartians,sourceroute=0
|
||||
vpn gt-tun0 nosmurfs,routefilter,logmartians,tcpflags
|
||||
vpn gt-udp-tun0 nosmurfs,routefilter,logmartians,tcpflags
|
||||
vpn mlvpn0 nosmurfs,routefilter,logmartians,tcpflags
|
||||
|
||||
|
|
|
|||
|
|
@ -22,3 +22,4 @@
|
|||
# net eth0 130.252.100.255 routefilter,norfc1918
|
||||
#
|
||||
###############################################################################
|
||||
INCLUDE params.vpn
|
||||
2
shorewall4/params.vpn
Normal file
2
shorewall4/params.vpn
Normal file
|
|
@ -0,0 +1,2 @@
|
|||
OMR_ADDR=10.0.0.1
|
||||
OMR_IFACE=gt-tun0
|
||||
|
|
@ -55,12 +55,7 @@ ACCEPT net $FW tcp 65222
|
|||
#
|
||||
DHCPfwd(ACCEPT) $FW vpn
|
||||
#
|
||||
# Redirect all port from 1 to 64999 to the VPN UDP client from the network
|
||||
# Redirect all port from 1 to 64999 to the VPN client from the network
|
||||
#
|
||||
#DNAT net vpn:10.0.1.2 tcp 1-64999
|
||||
#DNAT net vpn:10.0.1.2 udp 1-64999
|
||||
#
|
||||
# Redirect all port from 1 to 64999 to the VPN TCP client from the network
|
||||
#
|
||||
#DNAT net vpn:10.0.0.2 tcp 1-64999
|
||||
#DNAT net vpn:10.0.0.2 udp 1-64999
|
||||
#DNAT net vpn:$OMR_ADDR tcp 1-64999
|
||||
#DNAT net vpn:$OMR_ADDR udp 1-64999
|
||||
|
|
|
|||
|
|
@ -20,5 +20,4 @@ MASQUERADE 10.0.0.0/8,\
|
|||
172.16.0.0/12,\
|
||||
192.168.0.0/16 eth0
|
||||
# SNAT from VPN server for all VPN clients
|
||||
SNAT(10.0.0.1) 0.0.0.0/0 gt-tun0
|
||||
SNAT(10.0.1.1) 0.0.0.0/0 gt-udp-tun0
|
||||
SNAT($OMR_ADDR) 0.0.0.0/0 $OMR_IFACE
|
||||
|
|
|
|||
|
|
@ -17,4 +17,6 @@ ACCEPT gt-tun0 -
|
|||
ACCEPT - gt-tun0
|
||||
ACCEPT gt-udp-tun0 -
|
||||
ACCEPT - gt-udp-tun0
|
||||
ACCEPT mlvpn0 -
|
||||
ACCEPT - mlvpn0
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue