From 5b8b41326ea8adb0cac13a1b12c8b9a9799b6f5d Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Tue, 21 Apr 2020 19:27:56 +0200 Subject: [PATCH 01/15] Latest VPS script updates --- debian9-x86_64.sh | 35 ++++++++++++++++++++---------- omr-6in4-run | 1 + openmptcprouter-shorewall.tar.gz | Bin 4017 -> 4062 bytes openmptcprouter-shorewall6.tar.gz | Bin 3744 -> 3799 bytes shorewall4/shorewall.conf | 5 +++-- shorewall6/shorewall6.conf | 5 +++-- 6 files changed, 30 insertions(+), 16 deletions(-) diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index 57726c3..a07055d 100644 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -15,24 +15,25 @@ MLVPN=${MLVPN:-yes} MLVPN_PASS=${MLVPN_PASS:-$(head -c 32 /dev/urandom | base64 -w0)} OPENVPN=${OPENVPN:-yes} DSVPN=${DSVPN:-yes} +NOINTERNET=${NOINTERNET:-no} INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | grep -m 1 -Po '(?<=dev )(\S+)' | tr -d "\n")} KERNEL_VERSION="5.4.0" KERNEL_PACKAGE_VERSION="1.8+1efcfb3" KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_${KERNEL_PACKAGE_VERSION}" -GLORYTUN_UDP_VERSION="c113724eb0370ecd80d038192deeeb82a13ebed3" +GLORYTUN_UDP_VERSION="3622f928caf03709c4031a34feec85c623bc5281" #MLVPN_VERSION="8f9720978b28c1954f9f229525333547283316d2" MLVPN_VERSION="f45cec350a6879b8b020143a78134a022b5df2a7" OBFS_VERSION="486bebd9208539058e57e23a12f23103016e09b4" -OMR_ADMIN_VERSION="d14741092dfe0ff550f09eee8a03865726114427" +OMR_ADMIN_VERSION="6e4a1e36ebdf8c7876573a4a4c3aafafe88cf5e9" DSVPN_VERSION="3b99d2ef6c02b2ef68b5784bec8adfdd55b29b1a" #V2RAY_VERSION="v1.1.0" V2RAY_VERSION="v1.2.0-8-g59b8f4f" EASYRSA_VERSION="3.0.6" -SHADOWSOCKS_VERSION="3.3.3" +SHADOWSOCKS_VERSION="3.3.4" VPS_DOMAIN=${VPS_DOMAIN:-$(wget -4 -qO- -T 2 http://hostname.openmptcprouter.com)} VPSPATH="server-test" -OMR_VERSION="0.1015" +OMR_VERSION="0.1016-test" set -e umask 0022 @@ -138,7 +139,7 @@ wget -O /tmp/linux-image-${KERNEL_RELEASE}_amd64.deb https://www.openmptcprouter wget -O /tmp/linux-headers-${KERNEL_RELEASE}_amd64.deb https://www.openmptcprouter.com/kernel/linux-headers-${KERNEL_RELEASE}_amd64.deb # Rename bzImage to vmlinuz, needed when custom kernel was used cd /boot -apt-get -y install rename curl +apt-get -y install rename curl libcurl4 rename 's/^bzImage/vmlinuz/s' * >/dev/null 2>&1 #apt-get -y install linux-mptcp #dpkg --remove --force-remove-reinstreq linux-image-${KERNEL_VERSION}-mptcp @@ -345,6 +346,9 @@ if [ "$OMR_ADMIN" = "yes" ]; then openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 -keyout key.pem -out cert.pem -subj "/C=US/ST=Oregon/L=Portland/O=OpenMPTCProuterVPS/OU=Org/CN=www.openmptcprouter.vps" sed -i "s:AdminMySecretKey:$OMR_ADMIN_PASS_ADMIN:g" /etc/openmptcprouter-vps-admin/omr-admin-config.json sed -i "s:MySecretKey:$OMR_ADMIN_PASS:g" /etc/openmptcprouter-vps-admin/omr-admin-config.json + [ "$NOINTERNET" = "yes" ] && { + sed -i 's/"port": 65500,/"port": 65500,\n "internet": false,/' /etc/openmptcprouter-vps-admin/omr-admin-config.json + } chmod u+x /usr/local/bin/omr-admin.py systemctl enable omr-admin.service rm -rf /tmp/tmp/openmptcprouter-vps-admin-${OMR_ADMIN_VERSION} @@ -353,23 +357,30 @@ fi # Get shadowsocks optimization wget -O /etc/sysctl.d/90-shadowsocks.conf https://www.openmptcprouter.com/${VPSPATH}/shadowsocks.conf -if [ "$update" != 0 ] && [ ! -f /etc/shadowsocks-libev/manager.json ]; then - SHADOWSOCKS_PASS=$(grep -Po '"'"key"'"\s*:\s*"\K([^"]*)' /etc/shadowsocks-libev/config.json | tr -d "\n" | sed 's/-/+/g; s/_/\//g;') +if [ "$update" != 0 ]; then + if [ ! -f /etc/shadowsocks-libev/manager.json ]; then + SHADOWSOCKS_PASS=$(grep -Po '"'"key"'"\s*:\s*"\K([^"]*)' /etc/shadowsocks-libev/config.json | tr -d "\n" | sed 's/-/+/g; s/_/\//g;') + else + SHADOWSOCKS_PASS=$(grep -Po '"'"65101"'":\s*"\K([^"]*)' /etc/shadowsocks-libev/manager.json | tr -d "\n" | sed 's/-/+/g; s/_/\//g;') + fi fi - # Install shadowsocks config and add a shadowsocks by CPU if [ "$update" = "0" ] || [ ! -f /etc/shadowsocks-libev/manager.json ]; then #wget -O /etc/shadowsocks-libev/config.json https://www.openmptcprouter.com/${VPSPATH}/config.json wget -O /etc/shadowsocks-libev/manager.json https://www.openmptcprouter.com/${VPSPATH}/manager.json SHADOWSOCKS_PASS_JSON=$(echo $SHADOWSOCKS_PASS | sed 's/+/-/g; s/\//_/g;') - if [ $NBCPU -gt 1 ]; then - for i in $NBCPU; do + if [ "$NBCPU" -gt "1" ]; then + for i in $(seq 2 NBCPU); do sed -i '0,/65101/ s/ "65101.*/&\n&/' /etc/shadowsocks-libev/manager.json done fi #sed -i "s:MySecretKey:$SHADOWSOCKS_PASS_JSON:g" /etc/shadowsocks-libev/config.json sed -i "s:MySecretKey:$SHADOWSOCKS_PASS_JSON:g" /etc/shadowsocks-libev/manager.json [ "$(ip -6 a)" = "" ] && sed -i '/"\[::0\]"/d' /etc/shadowsocks-libev/manager.json +elif [ "$update" != "0" ] && [ -f /etc/shadowsocks-libev/manager.json ] && [ "$(grep -c '65101' /etc/shadowsocks-libev/manager.json | tr -d '\n')" != "$NBCPU" ]; then + for i in $(seq 2 $NBCPU); do + sed -i '0,/65101/ s/ "65101.*/&\n&/' /etc/shadowsocks-libev/manager.json + done fi [ ! -f /etc/shadowsocks-libev/local.acl ] && touch /etc/shadowsocks-libev/local.acl #sed -i 's:aes-256-cfb:chacha20:g' /etc/shadowsocks-libev/config.json @@ -379,7 +390,7 @@ systemctl disable shadowsocks-libev [ -f /etc/shadowsocks-libev/config.json ] && systemctl disable shadowsocks-libev-server@config.service systemctl enable shadowsocks-libev-manager@manager.service if [ $NBCPU -gt 1 ]; then - for i in $NBCPU; do + for i in $(seq 1 $NBCPU); do [ -f /etc/shadowsocks-libev/config$i.json ] && systemctl disable shadowsocks-libev-server@config$i.service done fi @@ -771,7 +782,7 @@ fi if [ "$TLS" = "yes" ]; then VPS_CERT=0 apt-get -y install dnsutils socat - if [ "$VPS_DOMAIN" != "" ] && [ "$(dig +noall +answer $VPS_DOMAIN)" != "" ] && [ "$(ping -c 1 -w 1 $VPS_DOMAIN)" ]; then + if [ "$VPS_DOMAIN" != "" ] && [ "$(dig +noidnout +noall +answer $VPS_DOMAIN)" != "" ] && [ "$(ping -c 1 -w 1 $VPS_DOMAIN)" ]; then if [ ! -f "/root/.acme.sh/$VPS_DOMAIN/$VPS_DOMAIN.cer" ]; then echo "Generate certificate for V2Ray" set +e diff --git a/omr-6in4-run b/omr-6in4-run index 69f8d0d..faf15cb 100755 --- a/omr-6in4-run +++ b/omr-6in4-run @@ -16,6 +16,7 @@ if [ "$1" = "start" ]; then ip tunnel add ${DEV} mode sit remote ${REMOTEIP} local ${LOCALIP} ip -6 addr add ${LOCALIP6} dev ${DEV} ip link set ${DEV} up + [ -n "$ULA" ] && ip route replace ${ULA} via $(echo ${REMOTEIP6} | cut -d/ -f1) dev ${DEV} fi if [ "$1" = "stop" ]; then ip tunnel del ${DEV} diff --git a/openmptcprouter-shorewall.tar.gz b/openmptcprouter-shorewall.tar.gz index d8fc2a6ba4c20b348b24a9bdc11e225f1fa524a3..1fa23873d68587765bc932640adaf20d277ce300 100644 GIT binary patch delta 4022 zcmV;n4@vN`AKo8-ABzY8tIM5U00ZqDe|Mv}@&3i1LN7^syRV6V#da>a=Uy>jn+5|1 zIJw;Gdpu&3gm*T$fH#-k+wa~P2{6XadfTJTOB+gxE*U2I^Ph=r3zlv1#z3+dfo=06UKM$p5mf~1>dBog-0;eQKA1XJ zy2hPx_-{E~aE*HXyL#mZ*PnV1Y5BgTZx()t7ps!-WWhBXg<`|==J{qhgEtE`UNkOq z`9D@K&l~HU8yC%gVv}S;*ktX6ll6j~PUoUfP?fBnteLiIZkG4m_}&YmGe0V{@Vv-H z*SB@aVo~f9X!&`esL89+X3@y;-9p>joldc+yrt5}TdcRXUGEfo%T!0(O8WCc(MG2@ zhSt`xkJkntOLi_-1=;mW=fCI2ZusC#+-M)xWIOD%{})YvwEyRgPN#m+?4bScv`YK` zCa`Y*Ke%CpcD+@tlQUvE^To_1a;74r50;&P`6uynaF(eK0ki(#JuXA)6so{c2o^7) z_xKc(cfxzpgyBDHf_o?TFW@2ET!ohF%&BLw&~ePX`_Ktr2>OuFbx9OF#LrIXeotP4 zC7FOL3EioG7lF6AU&b!+Vgi=67KBiK9>8pPLDbTpx*@Fwnm3O~@IVs-bxagDiXd;` z`fljVh`zj^c@rqCcoWx;T;fDzfw<_&ou+N=V?)fOA>aUkJr(nN;(Cyeb*H`7tTxix z5{{~S#+Poka%$ML$LKVK9&({aK=4yPh~~@iAv%peeeC7C!eFpT$f6FC3TA zq#V+JY_RQ&WIM%t2EVVC{}k_O^jgWpb1a*_%7H?Fi|cuW^#;HJX$_Jx={={lrAksd}j`2 z@7+f*E6-p?fhk!oAm#xh4|aIw#xb?5aX`?2-h2Mz5{xoh$2oY0V4iEhG6L?@_W01= z7s`$rD|bz@MHoD0l1RT&&vu0gj!o{a8$Z>PR8QbdtJ^rQSDS6H>2Geb4I8Ss0Gp(E8bJYKEALbfILloW&p{h;+}~MFf3+ ziJr@2o`>-!PY!r6*M;s4J?Kn7s|w}hxPoxptK#h0+{&t;j75nswW>mciYTyGUwcmc zkzh3thpS_U{Ra=wDL(&cx9g?-e+$S$8)^W*c56y_Yj_K*yL0|uY|j6Sa{d1%aHE?x zFN#LDK?4E$zfsXf#s;=oL0V=j*ovlq{>4w9O8DBa2xi{o<*;?^nE&{A2qriCO_7DWRa(&oM3HVJ zB~8mC*}CeD4b!UN^RRqb0&AYNG%pB}Zf%e~Ja3~aU`esmD`cu*3hiTCL*#k9z0)qV)f70iWUj4OEdYb^oVucTvUwzvCEyT9Uno0AC5xy+WDC zEd(N)kqGV~%HfOjnjsHll}`hI6Jqd|lrN7Pj%sin@y0c#1x;0H^pfOT@@S2I2>O9r zk+SyDy-N9fx|!sd{C9wxpwjC*^L>Udik)vF!obkRdgTXGV!g*J$|?ax`JN)1LrGjA z4M~BX$RT9)hF9bqVys#QFI?woROz;oi6#dAw=qUc!82MT-as=1t#W#Dr4q3cTXUg3e6_{AA)TVj`+$uBK>J$Ag!cwKz!Yd=5g~ItNAG zu~?7wQ!k2jIlfYl=C1A>GUF(Ko z)kV#sS6bOwr`2U6);mu}~RwoVx9lHyEJmi$Dbahjia3TQh z!}By9Bo4UKMGR$RfOij}#dI3d!JsS}$h6bCyu8eFpUgZ|oBRY%H1t?hd05)u+fHPC zb&@{LWSa%gD63CU(LH(z)z^;C4h@CE6Zc+k1p+a{8tb;CLO>>o-8(m`96~xK-VF$0fG`?=h$(}Jcl#IUMlyPuDO-2l z#sLKZ&|z2xD9`?7(D{L6bPw44KJ>l;ZNCK>6r${3g1&4>w-E9lQV3XbfFcdxPlh=% z*uM}x1r{5yO0jH38`$(=GRTvxO4e|A-@}!ODkdpdyje1@nruQLW~G=-ih$mM#S0_v z%Zk*keQ?5m8brOdxf?}jc~}_*Q9cs5EV}say4L=$i{Y`9QNC3Z*B)=uti>rXDR4hTa`wBlWH&|rLyS4W1 zdsvS-R2u;_-vY(ahzi=Ikv@lW0*x##q>i!`hDlL2KCZg*>f|?b$Q#l+7Sv%NX|fL3ZfzNbkmH1I?bq0TbOUcu zQzX#bRV}hke@w}u3MgDt4Ftu}#4%7Hmr6zLLuif!tTDCd-t(_&^oQ1v-DNkkVB*Y* zNu+~+=IN55bW`%$!VPDrkEW#=60JORqZot%O&V&Q-`ute2x;`w9b9N|2AN9h( znNFN2W~<=S(Q+1hx%3oP+-eY;FR+-&CKJVfCXYSxXk4C)su{YA9QLS!oIbn8BhZ!~ z$I@6@Z~7J#d)@ROFg}b2F<>l*Fq#I8rOpX3nj<>0IPniKt_D~=K^x(@!0xvZtea1M z!>Bd-2sgN%`1rSz-=dc&cIO{qf=^xC=}hC^kKa}dbC@d|J#7{N%p{oO;X)ukNPiW7 zA_i(R_0_aE$VAYVe0sbo3pVqOjB_?WyGP*BPm=)QG;?RD!orZ3 zRofH{Fv1B}LE%UG$YeYOMdA$`Od897(nh)>S*${sDd2@+g4$p%HD!#?JsFuOA(3qj zB^4i6q)3a-FO*-_@hJwYK}6XV32-+Zh5$nfVJ5p(F<9U+dJ*qbegqP(q@rx4pLEba zo4!hxB{M^6hLt!ChU)VW2~ZVQyf_5a$0F6khMh(*ZO66LTblb3O zYgNTDikuv_G;JD4(ZXr?w616w)>3GQr4FDs*Vj!W9{NXQ?+aKJD6tJApY;Rk0m}hx z9P6qsvZk<3w9Rq9FaOm21qr}^Jj(R^0VN+>(oZ%%``5-+w^IlAJO&qOKuWTWzJR;* zDIuN{7|B0N-TLa@&dny3#(~rZvxZ^}DE&Bwh~3VPJ|$E%sH2|Q3FFLNr?#6_&O}eM zC<=u(Q@n+WpPz`V$!r2KB9p&?CT2kp5>XT#SeCYgtgB5A-$gRiPcU+SR!X27GE7sw zd(hAM=1GneRBMG` z!9J*|WSX#;OF9Ep6!b&jb;vifX?&|0*F5x!Dzd^qONM5%KBP%am74g|Jv)qT*J(g= z4c6UCVqOz$d%8xa7XFZbiz_fpIxdW`Kj`+AY>Ac6Nv*(Y9_DkILa!D$`MhLf&1#{u zSs`1}Y{9=;Vzr9d%v-HvwhOT5zT7g1Bl-yG8du0Xxq|^56Kns~;+*Tr7TWQ2CT*m( zexEHeM!b2Q=AtsQ`*Pp#{|-bDa2~pjo%??~?c)BQR=a%u|0Ym>IRBaM`N2TCHgckW zF5S?Xy6zWl|LK%Fe}2b1f6#^;Wr8H{R(8Etp{3}16)NT&(D_FEFYP1R^5GzE>;4~( zeme*QSb@V(F8>)J4tD_2?+pQIkMGHfY~4Ypfs6ccEE&8AT$9r_^=iG==$!te0`)XH zmw;=n<1RqoIt?^%6BK} znV|O^SFh5)S{+zs$A3!q{riC^4i*b{deCjayZnFiyj3{=1E})+@0-AD`+wWHSRkh& z|8*SDXqF+s?>Pj>>Bs?&0e#_S-1Tx_v?(^f88%68?4V13zW0-*&o(H|3Y?P?+c>44 z2KszXX^9Qm^fN-cxiHENvh-_0yBRRb4KntrqTR)5^UE;f4IrKz{tJM+&i^+$#q&SS zM!Q-1|F?kS;)l-|Sa*63A**LSUKMX;(aMe(Xk%-ItmHnC#!0`jk1@xG#8F=acs-HNT3^*B4FTrePs7y$>! zK3}DZ!V4^a5RzA$tmIAZXzvQ>>FJqndb)dtfl1)|ap+8b{^oE{ z2k5j~^axNqHo9=$IPcUOt#-G0e*R6p(P(wfzajMl_9=r7WfVIhA>V{S5PynpSNV~S z88&Jk6{PG3A@Tf&Ae=j~7x=`v50)`;fx>emC?WBa7m){V=AM%HW#N*ex#N?J+gZl# z2-tn!k=-SK7bZQ7P08TQTiFtZmCEes^-fV+raIbI)1McrHaf+7Xl=ds@!HMDnw^VPMRxqs@$dPu8$LJ_H`<3c*$zAX zf47N${=eC6fgyF<=>I#Ndg=e)0@nTi2RDq+ueYjoaz;#NzL>d0&P;^#!Lt)^|0I46 z&N9;>;MO0!$7M)^LKQd)!Qv(K9-m_JPIyn6aQn}i5Z=lC3q%Mv*P!J(a~fGJ3>-7> zK6Jttf-xj?T@nQk@v{@Ueic0CVq;|L#*R0Opu*W+VGpr=p}BX?$3JPRLcY_J9DUe?>>TCc?LHMOv!QqIS)8_@WV4Vj;Uvj1A_j4-t!-q z;FQrj&LJ`c^IQj(5pbuz$A|vDPHD@l!pyx)ONP z>NU>m)n*%fdL57Lq%83Zz4f6VK1>=Hjqmcz$-9CkSN;*A*dz$2?^*jf55ut&+CDo? z-4F|rF4T;cvlxT~k?vWzh(MQr7`Z$ac^Gf<pH5ArT>C56{$5@CV_szc>wd@VK^;i} zpVyHb=$ax6cdKhf8xTdhk(BgW9?90_)z~nt3a*Fc>k^prtX=bhAnDcy*~9ZTssff2 zYrR7DN}EMA4v##DhNkC#ukl{d^*xUMU@?xPp+x$cqG-3WI!JXh8iUHNB%<)31K`VX z^v96?CJ7eDQBGwX|J_2koE`GfAB7$9ztw6L_kYwo=iM^?zXg0o{5Q} z0e-_d0QDq$PXWFXqEh%3gHyqXAIO2_K zycRT7rP)hTZpouH`XSf{Zbi!aNB1h_%jss4WAfhtZh}gW@67iZz9@FSiwFZl8|#(t zO^IobSCrKSROPP}*&IsZ3Ta3RXd;J@)f--sbBM8O8N6_vr%|QbN+y~Z_}|8uF$K@) zjeK`P&3EBVeqJtr*wZ2$RrsjkxFY)>oS8R$hZz$}wJY(8Ckr|@8Ss;dyNHRXnz@#u zRT~dp;@09IZSy$@aqApZdB<`+rpuH5?OHpmcUe1B7~S(9Deqds?nYOE2+?_7#mo~} zZ_pH*gF3G_w?mX&yi-xcFjy3r9^E_BBdYU%1-@IYqWdO)i_rZ5UWU2IS&)$5yR_yk z2&V3|N*yF^IK6S3w{Dx<+i37XSaKtC=0Y1?1Yu16LON~8N~qh7o}6j$90ik~Bih%; zSrER&OP>V(nwEemYjsTx#iomvMUS+xvrfBx-u{nyET@}1J|UiI4%6GYmyS1^P1>9| z6m(P&ugLIg@P`Jfo~WK}GlIB~)KKKRYyJ@wOV&+~)!d$h(rpfIjQc=7BNL_U zju^j@<1d^?$n0lP08V@6`EVYSr#N0*)@sks&(&2m@C3CvqmK%mt3Ji^+5T6zI4<$2 zCb0-l4EP-rTim*LR={@*??J!Wh>giri;lSPckc6!{PZA&P-G>xq``?CG)Du z1{7jehS{VD&<;#q7tM}is*LN-cjaAFaHqXzav^|@dHg& z?s{rKFXBAec=^>5#|^_WAm5y0{-FdU7jU`-n7b2ui@$>Kzs2ZIvfC??}X09p-y z&SWg#zoGGlj`Ly31aV=u-@@A+2M<90rmm>wxXm zmQe^LPUzNtiS0)>@D?>i0?S>sBJ1?Wlq_n1!Zo!(FdR)B0|j!aRMbAC=19OgQ;Y6B z|FTAZXbag{b}|bl&a8NebkIFrGL&9_N?u#I;SBB3v@}DajfZX&gD_x8Lyb8P+Z;;Z zLMVOo1O?+O^UlQH_KuFwkPhQrM7YU)Fo7|cgGG%&NKFNdqeey)V_*BU`ll$mu!G?hM*n;l%sQh0;p$1 zRfQwz0E#lejR@KZU$pCe8^J{MP2EC|?fHcQQM6^< zh9JkA;4Cn-Aj*U}asfG#RoUc!uS`j`;8aZ0M|?jL)eGnqB6(qQg&6VI66JHno3dcD zV8b|Pfwy-AA@VedxTjfsfWdz(40&0#O~C-KmT(mmex#2~#zRmf-mt+(up(`wE0V<; zgy8^TO;k-A{Ew!LaUqeBi4qdo)=*M${+}W(I*3qyS;u7o)`Ez#D-z&;ZaNGBo(b|c zcB*3Z^AK98SD>6BAGqZW(Pr}D z8Zk7HDi?hEKn3qPR~?M2h3nF+0&<|FHdmSHW0<}B&}w7EVJ z8S$VWkuAWpCQxDPv;$TG);QKxU1VKhO0>;!zc2sT`xyzq2g-CqKP4Yq(vLPS zrfXxX*QrCi8$--7;7YQMzJS}_DIspWAIU#Sz543h&W$FOCRWsc(Xx(WQYHN`h7{P& z-X%(?XqH4nofF1c{7W4)Yn+Lm7Eu%mZKik&4L?5+S(n)WVnil?16|Cr3M8T^dSltO zC1k2LJ$$&wP(Q+*vr+=xkYSkWy`v^Mr+;{Cz+ZFy4}&p|OsJsU$YMH-8O|7|T^O4= zNt024IDL2r9)MSWY#1jwQZTI*f@RNOrjlvG>?lzNnkd+Z!0S+MX2bYaGp>2iiYl_o zKS_pWGab@PO_iGX(>ptiZ`Wyta1GwwN|Hzue0w_Sr5^r}vlVbmI?gmuA9O!RHfPC~ zq+Vb(4)dkVpjR`7d|9$nWi@lyY>>?nw%}i_v6>camaQg#2HOSLvo5#X#1UPSxyC6c zPwwCbj)}GZW^v42$rk$YbR=zDYyCdU+DE*3otC08v-2<5h#NtEw8!Pdt*~?dXQy4< z|Iuof`#;|V3h)1=dpl&JXkq2wao5E$Y>Jt-D~9Q)GTK zWOBW+gDUynOLl#>L2*{#oYdIHDg89e=W|MHY|y5kk=f0KQErf>Uz6F*fKhIcu}{_P zu1>puU#1yv0P*DTUx3^7{&%BOeE*}_XgACF{}ymu{O}b6>rT%hWcBQdSH)Xdw6ZPc z+SpnlE4fc(andjBV?34BjDh3iXyn1?OdVbyWK-0kYlgOFAd$Bue0rifL z={HdMyWKnKyl5ZwTJ7WRN$2S3MXTLDJ~?_pT04{}r)8Wt5g{+4AV@x!@2T|vQ`)QT z5%VsH+G~Hy{jPt1GG}Dk8<{bnP@%)=0S~!Up_{6ymmI-kohv&wSLXtZ# zCO6*PJs`!kbQn)X(LI|CBq~?{6K75uxyJrhLXiH*fu}r zRgt$@rkY@#-nsM8jZPhC`^-7jHLk(o|8f>`?N;ljR_%@J&%B$g{J_#T3*RK+s$?<^ zxlX%OY;@E)+AL@AW~s)L_Ul6WFNd#>+UuO#C!MlLvLS4;_M+)}!CtR-QYxrQ)|srC zwrXyc_ub^$3*v?!mn1wYbJ6w3x+DzCeFBmnm5Q3YDs2{x9p5d<-tG0uMde2-jlFPP z+HR{??k!UtKUUITl!~@{5@{KSoJoT(dchu>rLB>o?D z5&t_qfc;jth4|k)s__3=Xbu0#dpC*^)sGKbq(Mw)5zbvA=PE)5fa?UnpCtD|BUc>) zn118kE+c9Z4uPW(gb$H-dzX-x!Yk5&;cs-nyp!t(un%sbLd$g))UH@)Hs;=S*u?#zq9)?6CfDVRs-TK zViMfYz)+nK#f@V~8@j$5Idh^fujk$r3M<~!^<$SfF$pm)zH?`ptOFFpOa%e+2kdDx ze(Eh$zMpzk{xryV=V<^zrDt)_UU#UY}-?lZ+{e;feIq&_dsS+VXRxQaG@B%&~ zX*&7~W(`ahw+}YWmJ5lLW_Q!@01U~^+_{Ypq7ZrpI^Y005Hw}hZy!X^f9^FpPVYmX z3l>qM=lREtC8*%vGbVZY$BJzU;y+8F6FG|=Vn5PT_}}jIDE=QqpxZeC{BND~+7r?!C??j$+JqKh+?ijui-v!hJka8KE$qC|kyu7`2;{;M@zN{GW zoduM=c5eY#?g2=FDOrZ#`vA-X63^Wvq1c)P1QFl!Zr`f4Z)%y08FSEq3Gj- zzz>uig)4WxZDADL=1q})qsHwN100**eK)ylrJ;2C_vs|}gLtuwZq^Etm*sw1;U8G3 zX%Nj`G3EsXL2quqz&^EnE)^ms;I)G$e2;nK z9K(X9s?>U=>6ScR%Rd7BzzYeveDuabF`XVM?~$(~yb6(hzcgRv@#SV0MMN4J+C;Ct zF(uY}yrQfEP?SGYWOF2mt4KpqpeG6uvUAPjf_KI;<;ZEgVP4?eAb8q$%tuwajDJz~#LpnDZ@zbdrCPY-tLQV0i zjvFt9wIs;uybmJ0I0HpqGRJ}S<^JGutsW*_UJq@I?)kTrcQa*op{tOIvEev8RN{aS z$9duVUc;L%!u2%V7Jej+7NHqdX`ih6iDs?wEY*iR#V80%%<9+9tWNv=zk%-_9wLO3 zFmm4m(lD5u2Wj?emzJCd!OWc-+{eN6T}-9Cod?lFvh+#duk}mb5o_aFmawc>^qW@J=ykhC-QUe)Ioss% zndX`1C>y}72;S**Xm#R9&`ElHNmiP=sXk?Wp*lz})EqscxM>2`V1Ut&peb~A(ov$k z+gMxg`1R}8#cHQ>4>hSc?^9*n6IDLb3aIC_-8#g-4!cOypq&14Cl{*&tV49=c2dXZ z{r`5mcS7&~9G@Judk_HsztcUg_J5v*w(d8fC0Y6R7pZI9ee7hpqwkhj~#v32QD`k$6MI!@FcL z-~KKK$EE0M5{vM}fX@lR-2;h$4@J(10#D-B>#c!9W>^#5mQ--eB(Zw*Y)F^j`tPz4u=D^$8p59pb7Z*vMw}_I=z!IVWh>gyrkje;o^*Ax7KhJgxI$6I zG_+E~4vm1mfF%n{9LS2)Z@zb;CiuC{g&W6+G%Sf;a_iS~_&ohvjQ@3-N|#!Uhs6&y zRk`Y`L9I6Cg_4wPLoi)ftx0O=P`f1=8=1{d#g8Y(U^6y_4TxX0q;SRG^S$H{;%YTZ z(CvZ356ul8`KoSBz-^D>9*0^YfTCNVCmK;fc{DQMa0(!%;`*5f{So0?Os9nac{O;F zF@5`b1q=IuJhXM*8ujb@A22A&#>Ybcoi>+o1Ysv~i?RD3%n@%$>zP3{hLR@h5Zf;l z`z^6=-M|Z*iUc~V_i*7YnW(=y{V*k_Ny0f*N6;cooInm_Q>&>1aK|x&E*T1Ad+qtn z(2eE@PbhdZhM3bP{h-z6Px-?^ z`aZ0U3lNk=*Xi(am<~On z#101D0EiT{F}^|6|1pNu_5KI+YvYgbfNPGA|J?r&Kg5Z<_y`a%bMY=D^^8CMSToE~ zp=^A&Sp;IH!2(}Hg6uo#uaY-G0ajnlo1M%Q4XlT(4w=8Y3fmOs`s^Y$B#2{Kl}-N4 zlvE2I#mvLS7rL<9AbJ&%zTvfs81v^6wXkQrDGN5UkS2@CCT715cKslA3J!9c2C6BH zcv-bg!H{(;WhyBASRb2=g`h~hVFQ%WfHu|@$zs*PQ~*m1lhFp0)RYPCcrpf}gqdt> zB&jwpri~Fb6^%cSzK3|F@?(&7B_GWqz12ZOYENZ}mWv4hq1p#;D zk~c(~iHaN3EL+x7U`U24K=wpESG7y%14CwJ1`Es3BB;#*{lu}Eu(rvnBC8VcvV>8V z5si@z6{#?SsUR|V4Xkn;WzDbE&Lv5=4a-gq*%kAccrkr-%CxCJM58l@Xk8idSPT6O zm@z{|T3`2I18o?yyxBN{%*CReWSf)0Kz`eQhcOdNdTZmJyf(4=y;iM;H+skNuM#di zvS+)Xsw#EKDAuu)1$4)xUnbxx+xfc(X)fwtQM>3wNp37{1L~4c%C!9^e*tB&`&ds} zLf)V(_!j!c%0jv!gHr4LdWRg*Km2aPUuXRfO)Tm$6woeYF;jXLXH2pYo|rk5!^kj^ zFisy`!F=Hr8+5Ud6$Wn=!5m~z1j#gExsx^sl|WNOf!873%+>xb z#Z;zwt3^REExpf>uK_me%a;wCNo;|z8NYJ;H`7+G|KknVa$i0&h-13Ra*k_Ao?O8I zPKdSrYH`k;$rb`-Hj_5O+F-zZ@iA|nXQ`;n>=}S%4=;rfgiYK+6G7QDix|>ayO6fA zSsjBju?04tr6=xxbXu+B()*vSW5{0Z|2_k)-~Y((e3&Y4HOEf;pQRf)GuQpb>mR-9 z=Erw@^8+!Yo;M`jReyX(y}4eB?x)jcE+D!n#GmON$s@lW!99BagQLG7fi9WAp@UNV zF$oTDfY2YEfUIZynXJgx6?7T^KP-z4UIeZ;?oX}L(`LJM@b4PbaWiXS@F%YD1}b(k z%uRN_iRYc5)}TwY59xtRegqoVFyl+c(*aKHR~!fIT3qQ})W6)BXGJTDlOPP;*-o#4 zK6U@U+wGO?f2VU?{r2hK}EjW4`_EP7vOt#0SY>@gVzAQ@iOLmxo^4@ zS-cFHhEY6rdnvQ4Tw@j2SVcd}4?6r#!b^C6@csXGw{yI4|G&cj=bc(pix zwTuS-geYH8MHN+4QAHJ1R8d70Ra8+$6;)JGMHN+4QAHJ1R8d70Ra8+$6;)JGMHPLI N^gpHT=ePiP001)yVU+*? literal 3744 zcmV;R4qx#fiwFSv%~)Ol1MOUGbDKyK&R6s+rflDCQfFCjmb~$mE{6e0oDr~q>^OB* z6qc~fMFI{`yuMWa`*qI%Ldc1;8_BzurR|bnUV3_ZdYAR73Di42 zrr$v2?^f@m{i4oT*I=LE<=3GA)kN z4b9RxQP&KMGwJ8Vlnls`{P))E-@7#IlMyC$+ede6%8dvA=e>n@eR`RH}0wa&S9(k_c68^R`QFPg4b?DcvlrHZO#oynSM ztLA2X-%YN)Ag=pyNy1K^PWk}xdm1SId2s+zniZB~sP-z~}B?e)r4MOH zZnIa`mZ^>(tLZOFRa?FC7+Q~xeX=(AShM$fRgryfXa0MB;zl>l)Qz{p?=gB3|2tj8 z|8}o+40k7p|GoA}h5ye%Yxqw-xKWI#etgs+VNGa%j~ zCczE88LAVaxN!`5L)UjBXHN9x_1v36WyPDie(Vw_CLyN9ckV2cb%27HsUYC~fIaQz z--zo$KDM1{t$ozWT1z<|642F4Cqelm5`icFHVPj7VHE>zn0r)gqE@V=g-A%(oa3nW#=Qci!LeLB-;1CoDmNM(N4kOT?dyRq9htTJO zMO5#3{&9T?CivHkNnZc4YFmQ%FH-14&SHnykMtD&x7t05|A79@ZX5BxdD3fD`2QUA zbo|dOgd!9l$KI_^@#}*VdCv75kRiEa_(pseP!mAPWpE}Zh~x3{_STIP$f4!3YQ%RI zQ1{xs1z@=cAO)sm8A9v>Fb_yPcawx-YZ4Gde9ymK0xTmwF2FYgi-G_!p=N}lj}HPr zP<9lq-1WYNQE;1gMf!z0w^O{~*!=Fh$z3zOOQ(OIPI5np7t82ots;3@*3%0Az)MYo zX!eRRFCYj;a|Z?XspoT{LcE+OAUU|iYvu)FP!KvKk2w^^lH57qm|Pch7I~l{KW_nL zNA?>6Zy7ITRZu3PM3_|^LDS_V0K4Y^u8Ouot8v_28&BXrt^msWKizJ#!vE)>JhY+c z_j^lI(R0%Zw0GCWlk*?0*W*8!|5g0=EEEQ?1b*0U8&AdmC#_}~{~@&+|L35u*#FU~ ziBx+()!xr%_kI|PY=7TppFOR~_gwIyO>qxK*A!W}THPz!kSNlHq-6K}at$#{S;Q#S)yNv%$d?Zle|1;26;J<+;@~!ZH2v;YS z5BQFK07a6myMW(`vI7G-%9b3_rYFLK1cmf+dCicAvdU+Ui5R@K_A~*H9W>y3%p2!; zFKDVty;quV$>X*1Bd`xVkdVtqPb?Jk=_BQR^4kcHLS)}B%~yGPx!Xk%k%opg(Q9u^ ziD{2ll+_JX<Csa9Pr^d zFZ|G}d(%a@o`>7QkL1xRw7@FwvrRwItu>yd_K>F-1!0NV-nBE^qk8{u;JZgh2;n4* z+z)^>3?}D6TKw9jHRnMvb7w~sByrqmOKaNuj25Usr99j(PlvH!EVQ{Wh!XO5((6J@ zLP0mab7sMP98BNGRLa|V5IrPIp9KDzUUEgOjb~ZHvR%<{+E~5U?RL7qn#Xds$>R&% zGtE&pfLjr~-EPz7#F3zr^zkKGS?Z?wlyDA@rH;;cgbSD{ap@@OVQON z7U78jpA&++2NHo8ikuMzuEedkTZ4eiuqL`KsSub+V*kpGYrE(j>)r))!hp_b&`lY- zc(wfwT}Z~6X3Ex8zqP}T0O>F+L+sD?`=Ikf$>{G;`~hg+0NF304+>GX--Cf{NS6@$ z@3IrH^Z-K|!k-LtWVroKoGGyAfYpj+E85Ven~Kn%bak?phSz7fLQ%!^Ze@mTngF_h zB@4?O$cof&d~l)$#JP=y8^?$=EQ=m;>+j|8dHRZ{7!E|A@CaIxA>y~6}6gEGXKAsqZ&D0b&Abr)7!V!PZ_mU$>tJN$)w+9M8G&gwU ztGYD-w>^sc99oG0hHinKXha3$(a3t`P9M}%)NofZO=)!<6T{O#KnEbIsJ z(AIft)ZaV!h_|9_d@AVgw6TmMxOXDAn0oNh9Px& zNI7lL587;gm0!$*sWUI%V!1suPSes1i8da&aRR*ovl?j(H*9kx0ea9z<2%ThoS9c9 zO55MtL!;Uau!u0=12BgPn1)3SL&(eq45dNFG{r#wwSBW-3m{vR2K+>^`aZ0UYq;3W zQ*bE_BlGh_nn>%#9!X-)2=X+;{WmP1c7(FS>5MmJ!Db%CWGR_1?eBpfJWQSFVeSK9QVSzqR&7%-WZg=c z3JO2g$0lPTC=zejF!kw;Hr5r%V$Fe(gXa=e(*{)0lnL$-G6tfAg=}jisWvaBoe?z^ zoh6UHTD(&EG03`-j~0>M>R=%@eK;peW}c`SR*I7>X~2Ugr1O>v0`B{gH$iW|AC zSf(ie-k}N*H&M@3?Gkig$PAXTvJ5?f)-1439GeO2o2)9bDgiG`7-a)A)fVX92{zG32Qh`em3gLq%F&CtwF{ z7_+?FID#xBp-QsN$zUMA?Z3yAi6yKppWBHwgfqHgr7fe;9Aq+(^ zwiA!xi}dpZLQ6Y8tDlyl@d))JPL$-%#WtWV38hT?Z}JyV7uCl!X$g6UvfHcf9R6Xj-i5fA&Z&OvovFpjqt?GK^jJeiG*qT=nCcwuh?LV zg`zNcs{|HMf+0wz3Cn}DLudq=A_}|?`DSkRmzr_TL+4eIRemQKn$7e;Z#7kF<43=~ z8-&xTpF9VQv(m821cb|0eH7<*8Lo@6sblbs`alo53fhY~*)&^OdNG$--YSSL=B3a7 z^O$+Fy*$j`%whrcX8I~n-ppHt%8z$o%es7I5XW>=;vCmpJh_4aoDggK&ElLplPv_w zY$k2oYl8ucUB|q6p5>x3vugmBeLO@#5H@kkNd#llEMiDw?Lzv~ZSH;r#Sk3rx{W8! zf3%y;@&hqs zFYidYtN!?odSks7-A||8TtISBh(FRfl1F|$f_wD*2Sx+n>0?8>pycn49eRCO+>3 zvj$tDI;0O=@<*U?4GX?xJRRWFdc|?TuE~|&MXlW8pP1q#2t#+a(_^4do&WE4dn^Bc z(!}S#?M|=q|Ib06JO9}&!~z8q`OR@at6hZv-*X61u#p|S2JnrCG1u#T)1k=XVaW6z z#bc+JGQY~zS84TC^0WM)!>=Sfg!en2|8I5M#~bJWkE`E*dlveN^Z)PAM5@=nD)j#> z`cn|u0qm#0&0}5Z6ztPq&Dg+YS=~sYq)n`^#`@3k&VH#Qdn+tI%$gmP#iPaft7Y`& z4~X&=Ra8+$6;)JGMHN+4QAHJ1R8d70Ra8+$6;)JGMHN+4QAHJ1R8d70RaDXUNdE)g KU(qrEcmM!AZdIWG diff --git a/shorewall4/shorewall.conf b/shorewall4/shorewall.conf index 2061a8e..5e800f8 100644 --- a/shorewall4/shorewall.conf +++ b/shorewall4/shorewall.conf @@ -108,10 +108,11 @@ TC= ############################################################################### ACCEPT_DEFAULT=none -DROP_DEFAULT=Drop +BLACKLIST_DEFAULT="Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL" +DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)" NFQUEUE_DEFAULT=none QUEUE_DEFAULT=none -REJECT_DEFAULT=Reject +REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)" ############################################################################### # R S H / R C P C O M M A N D S diff --git a/shorewall6/shorewall6.conf b/shorewall6/shorewall6.conf index 3c18dc3..8ab80ab 100644 --- a/shorewall6/shorewall6.conf +++ b/shorewall6/shorewall6.conf @@ -105,10 +105,11 @@ TC= ############################################################################### ACCEPT_DEFAULT=none -DROP_DEFAULT=Drop +BLACKLIST_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP),dropNotSyn:$LOG_LEVEL,dropInvalid:$LOG_LEVEL,DropDNSrep:$LOG_LEVEL" +DROP_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)" NFQUEUE_DEFAULT=none QUEUE_DEFAULT=none -REJECT_DEFAULT=Reject +REJECT_DEFAULT="AllowICMPs,Broadcast(DROP),Multicast(DROP)" ############################################################################### # R S H / R C P C O M M A N D S From ff74a1b29873d9d28b907c02bd1445e6a9938544 Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Mon, 20 Jul 2020 16:01:51 +0200 Subject: [PATCH 02/15] Update to latest API and scripts --- debian9-x86_64.sh | 568 ++++++++++++++------------ glorytun-tcp-post.sh | 4 + glorytun-udp-post.sh | 4 + omr-service | 31 +- omr.service.in | 2 +- openmptcprouter-shorewall6.tar.gz | Bin 3799 -> 3809 bytes shadowsocks-libev-manager@.service.in | 2 +- shadowsocks.conf | 18 +- shorewall6/snat | 2 +- tun0.glorytun | 2 +- 10 files changed, 362 insertions(+), 271 deletions(-) diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index a07055d..2f24620 100644 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -6,7 +6,8 @@ DSVPN_PASS=${DSVPN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lower:]' '[ NBCPU=${NBCPU:-$(grep -c '^processor' /proc/cpuinfo | tr -d "\n")} OBFS=${OBFS:-yes} V2RAY=${V2RAY:-yes} -UPDATE_DEBIAN=${UPDATE_DEBIAN:-yes} +UPDATE_OS=${UPDATE_OS:-yes} +UPDATE=${UPDATE:-yes} TLS=${TLS:-yes} OMR_ADMIN=${OMR_ADMIN:-yes} OMR_ADMIN_PASS=${OMR_ADMIN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lower:]' '[:upper:]' | tr -d " \n")} @@ -15,21 +16,22 @@ MLVPN=${MLVPN:-yes} MLVPN_PASS=${MLVPN_PASS:-$(head -c 32 /dev/urandom | base64 -w0)} OPENVPN=${OPENVPN:-yes} DSVPN=${DSVPN:-yes} +SOURCES=${SOURCES:-yes} NOINTERNET=${NOINTERNET:-no} INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | grep -m 1 -Po '(?<=dev )(\S+)' | tr -d "\n")} -KERNEL_VERSION="5.4.0" -KERNEL_PACKAGE_VERSION="1.8+1efcfb3" +KERNEL_VERSION="5.4.42" +KERNEL_PACKAGE_VERSION="1.9+1efcfb3" KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_${KERNEL_PACKAGE_VERSION}" GLORYTUN_UDP_VERSION="3622f928caf03709c4031a34feec85c623bc5281" #MLVPN_VERSION="8f9720978b28c1954f9f229525333547283316d2" MLVPN_VERSION="f45cec350a6879b8b020143a78134a022b5df2a7" OBFS_VERSION="486bebd9208539058e57e23a12f23103016e09b4" -OMR_ADMIN_VERSION="6e4a1e36ebdf8c7876573a4a4c3aafafe88cf5e9" +OMR_ADMIN_VERSION="af3b0d55aed7341c2e9e8f5012fc07300e48a8d0" DSVPN_VERSION="3b99d2ef6c02b2ef68b5784bec8adfdd55b29b1a" #V2RAY_VERSION="v1.1.0" V2RAY_VERSION="v1.2.0-8-g59b8f4f" EASYRSA_VERSION="3.0.6" -SHADOWSOCKS_VERSION="3.3.4" +SHADOWSOCKS_VERSION="38871da8baf5cfa400983dcdf918397e48655203" VPS_DOMAIN=${VPS_DOMAIN:-$(wget -4 -qO- -T 2 http://hostname.openmptcprouter.com)} VPSPATH="server-test" @@ -50,13 +52,18 @@ fi if [ "$ID" = "debian" ] && [ "$VERSION_ID" != "9" ] && [ "$VERSION_ID" != "10" ]; then echo "This script only work with Debian Stretch (9.x) or Debian Buster (10.x)" exit 1 -elif [ "$ID" = "ubuntu" ] && [ "$VERSION_ID" != "18.04" ] && [ "$VERSION_ID" != "19.04" ]; then - echo "This script only work with Ubuntu 18.04 or Ubuntu 19.04" +elif [ "$ID" = "ubuntu" ] && [ "$VERSION_ID" != "18.04" ] && [ "$VERSION_ID" != "19.04" ] && [ "$VERSION_ID" != "20.04" ]; then + echo "This script only work with Ubuntu 18.04, 19.04 or 20.04" exit 1 elif [ "$ID" != "debian" ] && [ "$ID" != "ubuntu" ]; then echo "This script only work with Ubuntu 18.04, Ubuntu 19.04, Debian Stretch (9.x) or Debian Buster (10.x)" exit 1 fi +ARCH=$(dpkg --print-architecture | tr -d "\n") +if [ "$ARCH" != "amd64" ]; then + echo "Only x86_64 (amd64) is supported" + exit 1 +fi # Check if DPKG is locked and for broken packages #dpkg -i /dev/zero 2>/dev/null @@ -81,12 +88,14 @@ fi # Check if OpenMPTCProuter VPS is already installed update="0" -if [ -f /etc/motd ] && grep --quiet 'OpenMPTCProuter VPS' /etc/motd ; then - update="1" -elif [ -f /etc/motd.head ] && grep --quiet 'OpenMPTCProuter VPS' /etc/motd.head ; then - update="1" -elif [ -f /root/openmptcprouter_config.txt ]; then - update="1" +if [ "$UPDATE" = "yes" ]; then + if [ -f /etc/motd ] && grep --quiet 'OpenMPTCProuter VPS' /etc/motd ; then + update="1" + elif [ -f /etc/motd.head ] && grep --quiet 'OpenMPTCProuter VPS' /etc/motd.head ; then + update="1" + elif [ -f /root/openmptcprouter_config.txt ]; then + update="1" + fi fi rm -f /var/lib/dpkg/lock @@ -99,7 +108,7 @@ rm -f /var/cache/apt/archives/lock apt-get -y install apt-transport-https gnupg #if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "9" ] && [ "$UPDATE_DEBIAN" = "yes" ] && [ "$update" = "0" ]; then -if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "9" ] && [ "$UPDATE_DEBIAN" = "yes" ]; then +if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "9" ] && [ "$UPDATE_OS" = "yes" ]; then echo "Update Debian 9 Stretch to Debian 10 Buster" apt-get -y -f --force-yes upgrade apt-get -y -f --force-yes dist-upgrade @@ -109,6 +118,16 @@ if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "9" ] && [ "$UPDATE_DEBIAN" = "yes" apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade VERSION_ID="10" fi +if [ "$ID" = "ubuntu" ] && [ "$VERSION_ID" = "18.04" ] && [ "$UPDATE_OS" = "yes" ]; then + echo "Update Ubutnu 18.04 to Ubuntu 20.04" + apt-get -y -f --force-yes upgrade + apt-get -y -f --force-yes dist-upgrade + sed -i 's:bionic:focal:g' /etc/apt/sources.list + apt-get update + apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" upgrade + apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confnew" dist-upgrade + VERSION_ID="20.04" +fi # Add OpenMPTCProuter repo echo 'deb [arch=amd64] https://repo.openmptcprouter.com stretch main' > /etc/apt/sources.list.d/openmptcprouter.list cat </dev/null 2>&1 #apt-get -y install linux-mptcp #dpkg --remove --force-remove-reinstreq linux-image-${KERNEL_VERSION}-mptcp @@ -158,80 +177,95 @@ cd /tmp bash update-grub.sh ${KERNEL_VERSION}-mptcp bash update-grub.sh ${KERNEL_RELEASE} -echo "Install tracebox and iperf3 OpenMPTCProuter edition" -apt-get -y -o Dpkg::Options::="--force-overwrite" install tracebox omr-iperf3 +echo "Install tracebox OpenMPTCProuter edition" +apt-get -y -o Dpkg::Options::="--force-overwrite" install tracebox +echo "Install iperf3 OpenMPTCProuter edition" +apt-get -y -o Dpkg::Options::="--force-overwrite" install omr-iperf3 -#apt -t stretch-backports -y install shadowsocks-libev -## Compile Shadowsocks -rm -rf /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION} -wget -O /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION}.tar.gz http://github.com/shadowsocks/shadowsocks-libev/releases/download/v${SHADOWSOCKS_VERSION}/shadowsocks-libev-${SHADOWSOCKS_VERSION}.tar.gz -cd /tmp -tar xzf shadowsocks-libev-${SHADOWSOCKS_VERSION}.tar.gz -cd shadowsocks-libev-${SHADOWSOCKS_VERSION} -wget https://raw.githubusercontent.com/Ysurac/openmptcprouter-feeds/master/shadowsocks-libev/patches/020-NOCRYPTO.patch -patch -p1 < 020-NOCRYPTO.patch -wget https://github.com/Ysurac/shadowsocks-libev/commit/31b93ac2b054bc3f68ea01569649e6882d72218e.patch -patch -p1 < 31b93ac2b054bc3f68ea01569649e6882d72218e.patch -wget https://github.com/Ysurac/shadowsocks-libev/commit/2e52734b3bf176966e78e77cf080a1e8c6b2b570.patch -patch -p1 < 2e52734b3bf176966e78e77cf080a1e8c6b2b570.patch -wget https://github.com/Ysurac/shadowsocks-libev/commit/dd1baa91e975a69508f9ad67d75d72624c773d24.patch -patch -p1 < dd1baa91e975a69508f9ad67d75d72624c773d24.patch -# Shadowsocks eBPF support -#wget https://raw.githubusercontent.com/Ysurac/openmptcprouter-feeds/master/shadowsocks-libev/patches/030-eBPF.patch -#patch -p1 < 030-eBPF.patch -#rm -f /var/lib/dpkg/lock -#apt-get install -y --no-install-recommends build-essential git ca-certificates libcap-dev libelf-dev libpcap-dev -#cd /tmp -#rm -rf libbpf -#git clone https://github.com/libbpf/libbpf.git -#cd libbpf -#if [ "$ID" = "debian" ]; then -# rm -f /var/lib/dpkg/lock -# apt -y -t stretch-backports install linux-libc-dev -#elif [ "$ID" = "ubuntu" ]; then -# rm -f /var/lib/dpkg/lock -# apt-get -y install linux-libc-dev -#fi -#BUILD_SHARED=y make -C src CFLAGS="$CFLAGS -DCOMPAT_NEED_REALLOCARRAY" -#cp /tmp/libbpf/src/libbpf.so /usr/lib -#cp /tmp/libbpf/src/*.h /usr/include/bpf -#cd /tmp -#rm -rf /tmp/libbpf -rm -f /var/lib/dpkg/lock -rm -f /var/lib/dpkg/lock-frontend -apt-get -y install --no-install-recommends devscripts equivs apg libcap2-bin libpam-cap libc-ares2 libc-ares-dev libev4 haveged -sleep 1 -rm -f /var/lib/dpkg/lock -rm -f /var/lib/dpkg/lock-frontend -systemctl enable haveged +apt-get -y remove shadowsocks-libev -if [ "$ID" = "debian" ]; then +if [ "$SOURCES" = "yes" ]; then + #apt -t stretch-backports -y install shadowsocks-libev + ## Compile Shadowsocks + #rm -rf /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION} + #wget -O /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION}.tar.gz http://github.com/shadowsocks/shadowsocks-libev/releases/download/v${SHADOWSOCKS_VERSION}/shadowsocks-libev-${SHADOWSOCKS_VERSION}.tar.gz + cd /tmp + rm -rf shadowsocks-libev + git clone https://github.com/Ysurac/shadowsocks-libev.git + cd shadowsocks-libev + git checkout ${SHADOWSOCKS_VERSION} + git submodule update --init --recursive + #tar xzf shadowsocks-libev-${SHADOWSOCKS_VERSION}.tar.gz + #cd shadowsocks-libev-${SHADOWSOCKS_VERSION} + #wget https://raw.githubusercontent.com/Ysurac/openmptcprouter-feeds/master/shadowsocks-libev/patches/020-NOCRYPTO.patch + #patch -p1 < 020-NOCRYPTO.patch + #wget https://github.com/Ysurac/shadowsocks-libev/commit/31b93ac2b054bc3f68ea01569649e6882d72218e.patch + #patch -p1 < 31b93ac2b054bc3f68ea01569649e6882d72218e.patch + #wget https://github.com/Ysurac/shadowsocks-libev/commit/2e52734b3bf176966e78e77cf080a1e8c6b2b570.patch + #patch -p1 < 2e52734b3bf176966e78e77cf080a1e8c6b2b570.patch + #wget https://github.com/Ysurac/shadowsocks-libev/commit/dd1baa91e975a69508f9ad67d75d72624c773d24.patch + #patch -p1 < dd1baa91e975a69508f9ad67d75d72624c773d24.patch + # Shadowsocks eBPF support + #wget https://raw.githubusercontent.com/Ysurac/openmptcprouter-feeds/master/shadowsocks-libev/patches/030-eBPF.patch + #patch -p1 < 030-eBPF.patch + #rm -f /var/lib/dpkg/lock + #apt-get install -y --no-install-recommends build-essential git ca-certificates libcap-dev libelf-dev libpcap-dev + #cd /tmp + #rm -rf libbpf + #git clone https://github.com/libbpf/libbpf.git + #cd libbpf + #if [ "$ID" = "debian" ]; then + # rm -f /var/lib/dpkg/lock + # apt -y -t stretch-backports install linux-libc-dev + #elif [ "$ID" = "ubuntu" ]; then + # rm -f /var/lib/dpkg/lock + # apt-get -y install linux-libc-dev + #fi + #BUILD_SHARED=y make -C src CFLAGS="$CFLAGS -DCOMPAT_NEED_REALLOCARRAY" + #cp /tmp/libbpf/src/libbpf.so /usr/lib + #cp /tmp/libbpf/src/*.h /usr/include/bpf + #cd /tmp + #rm -rf /tmp/libbpf rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock-frontend - if [ "$VERSION_ID" = "9" ]; then - apt -y -t stretch-backports install libsodium-dev - else - apt -y install libsodium-dev + apt-get -y install --no-install-recommends devscripts equivs apg libcap2-bin libpam-cap libc-ares2 libc-ares-dev libev4 haveged libpcre3-dev + sleep 1 + rm -f /var/lib/dpkg/lock + rm -f /var/lib/dpkg/lock-frontend + systemctl enable haveged + + if [ "$ID" = "debian" ]; then + rm -f /var/lib/dpkg/lock + rm -f /var/lib/dpkg/lock-frontend + if [ "$VERSION_ID" = "9" ]; then + apt -y -t stretch-backports install libsodium-dev + else + apt -y install libsodium-dev + fi + elif [ "$ID" = "ubuntu" ]; then + rm -f /var/lib/dpkg/lock + rm -f /var/lib/dpkg/lock-frontend + apt-get -y install libsodium-dev fi -elif [ "$ID" = "ubuntu" ]; then + #cd /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION} rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock-frontend - apt-get -y install libsodium-dev + mk-build-deps --install --tool "apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends -y" + rm -f /var/lib/dpkg/lock + rm -f /var/lib/dpkg/lock-frontend + dpkg-buildpackage -b -us -uc + rm -f /var/lib/dpkg/lock + rm -f /var/lib/dpkg/lock-frontend + cd /tmp + #dpkg -i shadowsocks-libev_*.deb + dpkg -i omr-shadowsocks-libev_*.deb + #mkdir -p /usr/lib/shadowsocks-libev + #cp -f /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION}/src/*.ebpf /usr/lib/shadowsocks-libev + #rm -rf /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION} + rm -rf /tmp/shadowsocks-libev +else + apt-get -y -o Dpkg::Options::="--force-overwrite" install omr-shadowsocks-libev fi -cd /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION} -rm -f /var/lib/dpkg/lock -rm -f /var/lib/dpkg/lock-frontend -mk-build-deps --install --tool "apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends -y" -rm -f /var/lib/dpkg/lock -rm -f /var/lib/dpkg/lock-frontend -dpkg-buildpackage -b -us -uc -rm -f /var/lib/dpkg/lock -rm -f /var/lib/dpkg/lock-frontend -cd /tmp -dpkg -i shadowsocks-libev_${SHADOWSOCKS_VERSION}-1_amd64.deb -#mkdir -p /usr/lib/shadowsocks-libev -#cp -f /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION}/src/*.ebpf /usr/lib/shadowsocks-libev -rm -rf /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION} # Load OLIA Congestion module at boot time if ! grep -q olia /etc/modules ; then @@ -284,7 +318,6 @@ if [ "$OMR_ADMIN" = "yes" ]; then #echo 'deb http://ftp.de.debian.org/debian buster main' > /etc/apt/sources.list.d/buster.list #echo 'APT::Default-Release "stretch";' | tee -a /etc/apt/apt.conf.d/00local #apt-get update - apt-get -y install unzip #apt-get -y -t buster install python3.7-dev #apt-get -y -t buster install python3-pip python3-setuptools python3-wheel if [ "$(whereis python3 | grep python3.7)" = "" ]; then @@ -305,7 +338,7 @@ if [ "$OMR_ADMIN" = "yes" ]; then pip3 -q install setuptools wheel pip3 -q install pyopenssl else - apt-get -y install unzip python3-openssl python3-pip python3-setuptools python3-wheel python3-dev + apt-get -y install python3-openssl python3-pip python3-setuptools python3-wheel python3-dev fi #apt-get -y install unzip gunicorn python3-flask-restful python3-openssl python3-pip python3-setuptools python3-wheel #apt-get -y install unzip python3-openssl python3-pip python3-setuptools python3-wheel @@ -316,42 +349,50 @@ if [ "$OMR_ADMIN" = "yes" ]; then else apt-get -y install python3-passlib python3-jwt python3-netaddr libuv1 python3-uvloop fi + apt-get -y install python3-uvicorn jq ipcalc python3-netifaces echo '-- pip3 install needed python modules' #pip3 install pyjwt passlib uvicorn fastapi netjsonconfig python-multipart netaddr - pip3 -q install fastapi netjsonconfig python-multipart uvicorn + #pip3 -q install fastapi netjsonconfig python-multipart uvicorn -U + pip3 -q install fastapi netjsonconfig python-multipart -U mkdir -p /etc/openmptcprouter-vps-admin/omr-6in4 + mkdir -p /etc/openmptcprouter-vps-admin/intf mkdir -p /var/opt/openmptcprouter - wget -O /lib/systemd/system/omr-admin.service https://www.openmptcprouter.com/${VPSPATH}/omr-admin.service.in - wget -O /tmp/openmptcprouter-vps-admin.zip https://github.com/Ysurac/openmptcprouter-vps-admin/archive/${OMR_ADMIN_VERSION}.zip - cd /tmp - unzip -q -o openmptcprouter-vps-admin.zip - if [ -f /usr/local/bin/omr-admin.py ]; then - apt-get -y install jq + if [ "$SOURCES" = "yes" ]; then + wget -O /lib/systemd/system/omr-admin.service https://www.openmptcprouter.com/${VPSPATH}/omr-admin.service.in + wget -O /tmp/openmptcprouter-vps-admin.zip https://github.com/Ysurac/openmptcprouter-vps-admin/archive/${OMR_ADMIN_VERSION}.zip + cd /tmp + unzip -q -o openmptcprouter-vps-admin.zip cp /tmp/openmptcprouter-vps-admin-${OMR_ADMIN_VERSION}/omr-admin.py /usr/local/bin/ - OMR_ADMIN_PASS2=$(grep -Po '"'"pass"'"\s*:\s*"\K([^"]*)' /etc/openmptcprouter-vps-admin/omr-admin-config.json | tr -d "\n") - [ -z "$OMR_ADMIN_PASS2" ] && OMR_ADMIN_PASS2=$(cat /etc/openmptcprouter-vps-admin/omr-admin-config.json | jq -r .users[0].openmptcprouter.user_password | tr -d "\n") - [ -n "$OMR_ADMIN_PASS2" ] && OMR_ADMIN_PASS=$OMR_ADMIN_PASS2 - OMR_ADMIN_PASS_ADMIN2=$(cat /etc/openmptcprouter-vps-admin/omr-admin-config.json | jq -r .users[0].admin.user_password | tr -d "\n") - [ -n "$OMR_ADMIN_PASS_ADMIN2" ] && OMR_ADMIN_PASS_ADMIN=$OMR_ADMIN_PASS_ADMIN2 + if [ -f /usr/local/bin/omr-admin.py ]; then + OMR_ADMIN_PASS2=$(grep -Po '"'"pass"'"\s*:\s*"\K([^"]*)' /etc/openmptcprouter-vps-admin/omr-admin-config.json | tr -d "\n") + [ -z "$OMR_ADMIN_PASS2" ] && OMR_ADMIN_PASS2=$(cat /etc/openmptcprouter-vps-admin/omr-admin-config.json | jq -r .users[0].openmptcprouter.user_password | tr -d "\n") + [ -n "$OMR_ADMIN_PASS2" ] && OMR_ADMIN_PASS=$OMR_ADMIN_PASS2 + OMR_ADMIN_PASS_ADMIN2=$(cat /etc/openmptcprouter-vps-admin/omr-admin-config.json | jq -r .users[0].admin.user_password | tr -d "\n") + [ -n "$OMR_ADMIN_PASS_ADMIN2" ] && OMR_ADMIN_PASS_ADMIN=$OMR_ADMIN_PASS_ADMIN2 + else + cp /tmp/openmptcprouter-vps-admin-${OMR_ADMIN_VERSION}/omr-admin.py /usr/local/bin/ + cd /etc/openmptcprouter-vps-admin + fi + if [ "$(grep user_password /etc/openmptcprouter-vps-admin/omr-admin-config.json)" = "" ]; then + cp /tmp/openmptcprouter-vps-admin-${OMR_ADMIN_VERSION}/omr-admin-config.json /etc/openmptcprouter-vps-admin/ + cp /tmp/openmptcprouter-vps-admin-${OMR_ADMIN_VERSION}/omr-admin.py /usr/local/bin/ + cd /etc/openmptcprouter-vps-admin + fi + openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 -keyout key.pem -out cert.pem -subj "/C=US/ST=Oregon/L=Portland/O=OpenMPTCProuterVPS/OU=Org/CN=www.openmptcprouter.vps" + sed -i "s:AdminMySecretKey:$OMR_ADMIN_PASS_ADMIN:g" /etc/openmptcprouter-vps-admin/omr-admin-config.json + sed -i "s:MySecretKey:$OMR_ADMIN_PASS:g" /etc/openmptcprouter-vps-admin/omr-admin-config.json + [ "$NOINTERNET" = "yes" ] && { + sed -i 's/"port": 65500,/"port": 65500,\n "internet": false,/' /etc/openmptcprouter-vps-admin/omr-admin-config.json + } + chmod u+x /usr/local/bin/omr-admin.py + systemctl enable omr-admin.service + rm -rf /tmp/tmp/openmptcprouter-vps-admin-${OMR_ADMIN_VERSION} else - cp /tmp/openmptcprouter-vps-admin-${OMR_ADMIN_VERSION}/omr-admin-config.json /etc/openmptcprouter-vps-admin/ - cp /tmp/openmptcprouter-vps-admin-${OMR_ADMIN_VERSION}/omr-admin.py /usr/local/bin/ - cd /etc/openmptcprouter-vps-admin + apt-get -y install omr-vps-admin + OMR_ADMIN_PASS=$(cat /etc/openmptcprouter-vps-admin/omr-admin-config.json | jq -r .users[0].openmptcprouter.user_password | tr -d "\n") + OMR_ADMIN_PASS_ADMIN=$(cat /etc/openmptcprouter-vps-admin/omr-admin-config.json | jq -r .users[0].admin.user_password | tr -d "\n") fi - if [ "$(grep user_password /etc/openmptcprouter-vps-admin/omr-admin-config.json)" = "" ]; then - cp /tmp/openmptcprouter-vps-admin-${OMR_ADMIN_VERSION}/omr-admin-config.json /etc/openmptcprouter-vps-admin/ - cp /tmp/openmptcprouter-vps-admin-${OMR_ADMIN_VERSION}/omr-admin.py /usr/local/bin/ - cd /etc/openmptcprouter-vps-admin - fi - openssl req -new -newkey rsa:2048 -days 3650 -nodes -x509 -keyout key.pem -out cert.pem -subj "/C=US/ST=Oregon/L=Portland/O=OpenMPTCProuterVPS/OU=Org/CN=www.openmptcprouter.vps" - sed -i "s:AdminMySecretKey:$OMR_ADMIN_PASS_ADMIN:g" /etc/openmptcprouter-vps-admin/omr-admin-config.json - sed -i "s:MySecretKey:$OMR_ADMIN_PASS:g" /etc/openmptcprouter-vps-admin/omr-admin-config.json - [ "$NOINTERNET" = "yes" ] && { - sed -i 's/"port": 65500,/"port": 65500,\n "internet": false,/' /etc/openmptcprouter-vps-admin/omr-admin-config.json - } - chmod u+x /usr/local/bin/omr-admin.py - systemctl enable omr-admin.service - rm -rf /tmp/tmp/openmptcprouter-vps-admin-${OMR_ADMIN_VERSION} + fi # Get shadowsocks optimization @@ -377,21 +418,24 @@ if [ "$update" = "0" ] || [ ! -f /etc/shadowsocks-libev/manager.json ]; then #sed -i "s:MySecretKey:$SHADOWSOCKS_PASS_JSON:g" /etc/shadowsocks-libev/config.json sed -i "s:MySecretKey:$SHADOWSOCKS_PASS_JSON:g" /etc/shadowsocks-libev/manager.json [ "$(ip -6 a)" = "" ] && sed -i '/"\[::0\]"/d' /etc/shadowsocks-libev/manager.json -elif [ "$update" != "0" ] && [ -f /etc/shadowsocks-libev/manager.json ] && [ "$(grep -c '65101' /etc/shadowsocks-libev/manager.json | tr -d '\n')" != "$NBCPU" ]; then +elif [ "$update" != "0" ] && [ -f /etc/shadowsocks-libev/manager.json ] && [ "$(grep -c '65101' /etc/shadowsocks-libev/manager.json | tr -d '\n')" != "$NBCPU" ] && [ -z "$(grep port_conf /etc/shadowsocks-libev/manager.json)" ]; then for i in $(seq 2 $NBCPU); do sed -i '0,/65101/ s/ "65101.*/&\n&/' /etc/shadowsocks-libev/manager.json done + sed -i 's/ "65101.*"$/&,/' /etc/shadowsocks-libev/manager.json fi [ ! -f /etc/shadowsocks-libev/local.acl ] && touch /etc/shadowsocks-libev/local.acl #sed -i 's:aes-256-cfb:chacha20:g' /etc/shadowsocks-libev/config.json #sed -i 's:json:json --no-delay:g' /lib/systemd/system/shadowsocks-libev-server@.service wget -O /lib/systemd/system/shadowsocks-libev-manager@.service https://www.openmptcprouter.com/${VPSPATH}/shadowsocks-libev-manager@.service.in -systemctl disable shadowsocks-libev +if systemctl -q is-enabled shadowsocks-libev; then + systemctl -q disable shadowsocks-libev +fi [ -f /etc/shadowsocks-libev/config.json ] && systemctl disable shadowsocks-libev-server@config.service systemctl enable shadowsocks-libev-manager@manager.service if [ $NBCPU -gt 1 ]; then for i in $(seq 1 $NBCPU); do - [ -f /etc/shadowsocks-libev/config$i.json ] && systemctl disable shadowsocks-libev-server@config$i.service + [ -f /etc/shadowsocks-libev/config$i.json ] && systemctl is-enabled shadowsocks-libev && systemctl disable shadowsocks-libev-server@config$i.service done fi if ! grep -q 'DefaultLimitNOFILE=65536' /etc/systemd/system.conf ; then @@ -400,26 +444,30 @@ fi # Install simple-obfs if [ "$OBFS" = "yes" ]; then echo "Install OBFS" - rm -rf /tmp/simple-obfs - cd /tmp - rm -f /var/lib/dpkg/lock - rm -f /var/lib/dpkg/lock-frontend - if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "9" ]; then - #apt-get install -y --no-install-recommends -t buster libssl-dev - apt-get install -y --no-install-recommends libssl-dev - apt-get install -y --no-install-recommends build-essential autoconf libtool libpcre3-dev libev-dev asciidoc xmlto automake git ca-certificates + if [ "$SOURCES" = "yes" ]; then + rm -rf /tmp/simple-obfs + cd /tmp + rm -f /var/lib/dpkg/lock + rm -f /var/lib/dpkg/lock-frontend + if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "9" ]; then + #apt-get install -y --no-install-recommends -t buster libssl-dev + apt-get install -y --no-install-recommends libssl-dev + apt-get install -y --no-install-recommends build-essential autoconf libtool libpcre3-dev libev-dev asciidoc xmlto automake git ca-certificates + else + apt-get install -y --no-install-recommends build-essential autoconf libtool libssl-dev libpcre3-dev libev-dev asciidoc xmlto automake git ca-certificates + fi + git clone https://github.com/shadowsocks/simple-obfs.git /tmp/simple-obfs + cd /tmp/simple-obfs + git checkout ${OBFS_VERSION} + git submodule update --init --recursive + ./autogen.sh + ./configure && make + make install + cd /tmp + rm -rf /tmp/simple-obfs else - apt-get install -y --no-install-recommends build-essential autoconf libtool libssl-dev libpcre3-dev libev-dev asciidoc xmlto automake git ca-certificates + apt-get -y -o Dpkg::Options::="--force-overwrite" install omr-simple-obfs fi - git clone https://github.com/shadowsocks/simple-obfs.git /tmp/simple-obfs - cd /tmp/simple-obfs - git checkout ${OBFS_VERSION} - git submodule update --init --recursive - ./autogen.sh - ./configure && make - make install - cd /tmp - rm -rf /tmp/simple-obfs #sed -i 's%"mptcp": true%"mptcp": true,\n"plugin": "/usr/local/bin/obfs-server",\n"plugin_opts": "obfs=http;mptcp;fast-open;t=400"%' /etc/shadowsocks-libev/config.json fi @@ -466,20 +514,26 @@ if [ "$MLVPN" = "yes" ]; then if [ -f /etc/mlvpn/mlvpn0.conf ]; then mlvpnupdate="1" fi - rm -f /var/lib/dpkg/lock - rm -f /var/lib/dpkg/lock-frontend - apt-get -y install build-essential pkg-config autoconf automake libpcap-dev unzip git - rm -rf /tmp/mlvpn - cd /tmp - #git clone https://github.com/markfoodyburton/MLVPN.git /tmp/mlvpn - git clone https://github.com/flohoff/MLVPN.git /tmp/mlvpn - #git clone https://github.com/link4all/MLVPN.git /tmp/mlvpn - cd /tmp/mlvpn - git checkout ${MLVPN_VERSION} - ./autogen.sh - ./configure --sysconfdir=/etc - make - make install + if [ "$SOURCES" = "yes" ]; then + rm -f /var/lib/dpkg/lock + rm -f /var/lib/dpkg/lock-frontend + apt-get -y install build-essential pkg-config autoconf automake libpcap-dev unzip git + rm -rf /tmp/mlvpn + cd /tmp + #git clone https://github.com/markfoodyburton/MLVPN.git /tmp/mlvpn + git clone https://github.com/flohoff/MLVPN.git /tmp/mlvpn + #git clone https://github.com/link4all/MLVPN.git /tmp/mlvpn + cd /tmp/mlvpn + git checkout ${MLVPN_VERSION} + ./autogen.sh + ./configure --sysconfdir=/etc + make + make install + cd /tmp + rm -rf /tmp/mlvpn + else + apt-get -y -o Dpkg::Options::="--force-overwrite" install mlvpn + fi wget -O /lib/systemd/network/mlvpn.network https://www.openmptcprouter.com/${VPSPATH}/mlvpn.network wget -O /lib/systemd/system/mlvpn@.service https://www.openmptcprouter.com/${VPSPATH}/mlvpn@.service.in mkdir -p /etc/mlvpn @@ -494,10 +548,8 @@ if [ "$MLVPN" = "yes" ]; then chown mlvpn /var/opt/mlvpn systemctl enable mlvpn@mlvpn0.service systemctl enable systemd-networkd.service - cd /tmp - rm -rf /tmp/mlvpn + echo "install mlvpn done" fi -echo "install mlvpn done" if systemctl -q is-active openvpn-server@tun0.service; then systemctl -q stop openvpn-server@tun0 > /dev/null 2>&1 systemctl -q disable openvpn-server@tun0 > /dev/null 2>&1 @@ -581,40 +633,45 @@ fi echo 'Glorytun UDP' # Install Glorytun UDP if systemctl -q is-active glorytun-udp@tun0.service; then - systemctl -q stop glorytun-udp@* > /dev/null 2>&1 + systemctl -q stop 'glorytun-udp@*' > /dev/null 2>&1 fi -rm -f /var/lib/dpkg/lock -rm -f /var/lib/dpkg/lock-frontend -apt-get install -y --no-install-recommends build-essential git ca-certificates meson pkg-config -rm -rf /tmp/glorytun-udp -cd /tmp -git clone https://github.com/angt/glorytun.git /tmp/glorytun-udp -cd /tmp/glorytun-udp -git checkout ${GLORYTUN_UDP_VERSION} -git submodule update --init --recursive -meson build -ninja -C build install -sed -i 's:EmitDNS=yes:EmitDNS=no:g' /lib/systemd/network/glorytun.network -rm /lib/systemd/system/glorytun* -rm /lib/systemd/network/glorytun* -wget -O /usr/local/bin/glorytun-udp-run https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp-run -chmod 755 /usr/local/bin/glorytun-udp-run -wget -O /lib/systemd/system/glorytun-udp@.service https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp%40.service.in -#wget -O /lib/systemd/network/glorytun-udp.network https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp.network -rm -f /lib/systemd/network/glorytun-udp.network -mkdir -p /etc/glorytun-udp -wget -O /etc/glorytun-udp/post.sh https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp-post.sh -chmod 755 /etc/glorytun-udp/post.sh -wget -O /etc/glorytun-udp/tun0 https://www.openmptcprouter.com/${VPSPATH}/tun0.glorytun-udp -if [ "$update" = "0" ] || [ ! -f /etc/glorytun-udp/tun0.key ]; then - echo "$GLORYTUN_PASS" > /etc/glorytun-udp/tun0.key -elif [ ! -f /etc/glorytun-udp/tun0.key ] && [ -f /etc/glorytun-tcp/tun0.key ]; then - cp /etc/glorytun-tcp/tun0.key /etc/glorytun-udp/tun0.key +if [ "$SOURCES" = "yes" ]; then + rm -f /var/lib/dpkg/lock + rm -f /var/lib/dpkg/lock-frontend + apt-get install -y --no-install-recommends build-essential git ca-certificates meson pkg-config + rm -rf /tmp/glorytun-udp + cd /tmp + git clone https://github.com/angt/glorytun.git /tmp/glorytun-udp + cd /tmp/glorytun-udp + git checkout ${GLORYTUN_UDP_VERSION} + git submodule update --init --recursive + meson build + ninja -C build install + sed -i 's:EmitDNS=yes:EmitDNS=no:g' /lib/systemd/network/glorytun.network + rm /lib/systemd/system/glorytun* + rm /lib/systemd/network/glorytun* + wget -O /usr/local/bin/glorytun-udp-run https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp-run + chmod 755 /usr/local/bin/glorytun-udp-run + wget -O /lib/systemd/system/glorytun-udp@.service https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp%40.service.in + #wget -O /lib/systemd/network/glorytun-udp.network https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp.network + rm -f /lib/systemd/network/glorytun-udp.network + mkdir -p /etc/glorytun-udp + wget -O /etc/glorytun-udp/post.sh https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp-post.sh + chmod 755 /etc/glorytun-udp/post.sh + wget -O /etc/glorytun-udp/tun0 https://www.openmptcprouter.com/${VPSPATH}/tun0.glorytun-udp + if [ "$update" = "0" ] || [ ! -f /etc/glorytun-udp/tun0.key ]; then + echo "$GLORYTUN_PASS" > /etc/glorytun-udp/tun0.key + elif [ ! -f /etc/glorytun-udp/tun0.key ] && [ -f /etc/glorytun-tcp/tun0.key ]; then + cp /etc/glorytun-tcp/tun0.key /etc/glorytun-udp/tun0.key + fi + systemctl enable glorytun-udp@tun0.service + systemctl enable systemd-networkd.service + cd /tmp + rm -rf /tmp/glorytun-udp +else + apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-overwrite" install omr-glorytun + GLORYTUN_PASS="$(cat /etc/glorytun-udp/tun0.key | tr -d '\n')" fi -systemctl enable glorytun-udp@tun0.service -systemctl enable systemd-networkd.service -cd /tmp -rm -rf /tmp/glorytun-udp # Add chrony for time sync apt-get install -y chrony @@ -627,77 +684,88 @@ if [ "$DSVPN" = "yes" ]; then systemctl -q disable dsvpn-server > /dev/null 2>&1 systemctl -q stop dsvpn-server > /dev/null 2>&1 fi - rm -f /var/lib/dpkg/lock - rm -f /var/lib/dpkg/lock-frontend - apt-get install -y --no-install-recommends build-essential git ca-certificates - rm -rf /tmp/dsvpn - cd /tmp - git clone https://github.com/jedisct1/dsvpn.git /tmp/dsvpn - cd /tmp/dsvpn - git checkout ${DSVPN_VERSION} - wget https://github.com/Ysurac/openmptcprouter-feeds/raw/develop/dsvpn/patches/nofirewall.patch - patch -p1 < nofirewall.patch - make CFLAGS='-DNO_DEFAULT_ROUTES -DNO_DEFAULT_FIREWALL' - make install - rm -f /lib/systemd/system/dsvpn/* - #wget -O /lib/systemd/system/dsvpn-server.service https://www.openmptcprouter.com/${VPSPATH}/dsvpn-server.service.in - wget -O /usr/local/bin/dsvpn-run https://www.openmptcprouter.com/${VPSPATH}/dsvpn-run - chmod 755 /usr/local/bin/dsvpn-run - wget -O /lib/systemd/system/dsvpn-server@.service https://www.openmptcprouter.com/${VPSPATH}/dsvpn-server%40.service.in - mkdir -p /etc/dsvpn - wget -O /etc/dsvpn/dsvpn0 https://www.openmptcprouter.com/${VPSPATH}/dsvpn0-config - if [ -f /etc/dsvpn/dsvpn.key ]; then - mv /etc/dsvpn/dsvpn.key /etc/dsvpn/dsvpn0.key + if [ "$SOURCES" = "yes" ]; then + rm -f /var/lib/dpkg/lock + rm -f /var/lib/dpkg/lock-frontend + apt-get install -y --no-install-recommends build-essential git ca-certificates + rm -rf /tmp/dsvpn + cd /tmp + git clone https://github.com/jedisct1/dsvpn.git /tmp/dsvpn + cd /tmp/dsvpn + git checkout ${DSVPN_VERSION} + wget https://github.com/Ysurac/openmptcprouter-feeds/raw/develop/dsvpn/patches/nofirewall.patch + patch -p1 < nofirewall.patch + make CFLAGS='-DNO_DEFAULT_ROUTES -DNO_DEFAULT_FIREWALL' + make install + rm -f /lib/systemd/system/dsvpn/* + #wget -O /lib/systemd/system/dsvpn-server.service https://www.openmptcprouter.com/${VPSPATH}/dsvpn-server.service.in + wget -O /usr/local/bin/dsvpn-run https://www.openmptcprouter.com/${VPSPATH}/dsvpn-run + chmod 755 /usr/local/bin/dsvpn-run + wget -O /lib/systemd/system/dsvpn-server@.service https://www.openmptcprouter.com/${VPSPATH}/dsvpn-server%40.service.in + mkdir -p /etc/dsvpn + wget -O /etc/dsvpn/dsvpn0 https://www.openmptcprouter.com/${VPSPATH}/dsvpn0-config + if [ -f /etc/dsvpn/dsvpn.key ]; then + mv /etc/dsvpn/dsvpn.key /etc/dsvpn/dsvpn0.key + fi + if [ "$update" = "0" ] || [ ! -f /etc/dsvpn/dsvpn0.key ]; then + echo "$DSVPN_PASS" > /etc/dsvpn/dsvpn0.key + fi + systemctl enable dsvpn-server@dsvpn0.service + cd /tmp + rm -rf /tmp/dsvpn + else + apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-overwrite" install omr-dsvpn + DSVPN_PASS=$(cat /etc/dsvpn/dsvpn0.key | tr -d "\n") fi - if [ "$update" = "0" ] || [ ! -f /etc/dsvpn/dsvpn0.key ]; then - echo "$DSVPN_PASS" > /etc/dsvpn/dsvpn0.key - fi - systemctl enable dsvpn-server@dsvpn0.service - cd /tmp - rm -rf /tmp/dsvpn fi # Install Glorytun TCP if systemctl -q is-active glorytun-tcp@tun0.service; then - systemctl -q stop glorytun-tcp@* > /dev/null 2>&1 + systemctl -q stop 'glorytun-tcp@*' > /dev/null 2>&1 fi -if [ "$ID" = "debian" ]; then - if [ "$VERSION_ID" = "9" ]; then - apt -t stretch-backports -y install libsodium-dev - else - apt -y install libsodium-dev +if [ "$SOURCES" = "yes" ]; then + if [ "$ID" = "debian" ]; then + if [ "$VERSION_ID" = "9" ]; then + apt -t stretch-backports -y install libsodium-dev + else + apt -y install libsodium-dev + fi + elif [ "$ID" = "ubuntu" ]; then + apt-get -y install libsodium-dev fi -elif [ "$ID" = "ubuntu" ]; then - apt-get -y install libsodium-dev + rm -f /var/lib/dpkg/lock + rm -f /var/lib/dpkg/lock-frontend + apt-get -y install build-essential pkg-config autoconf automake + rm -rf /tmp/glorytun-0.0.35 + cd /tmp + wget -O /tmp/glorytun-0.0.35.tar.gz http://github.com/angt/glorytun/releases/download/v0.0.35/glorytun-0.0.35.tar.gz + tar xzf glorytun-0.0.35.tar.gz + cd glorytun-0.0.35 + ./autogen.sh + ./configure + make + cp glorytun /usr/local/bin/glorytun-tcp + wget -O /usr/local/bin/glorytun-tcp-run https://www.openmptcprouter.com/${VPSPATH}/glorytun-tcp-run + chmod 755 /usr/local/bin/glorytun-tcp-run + wget -O /lib/systemd/system/glorytun-tcp@.service https://www.openmptcprouter.com/${VPSPATH}/glorytun-tcp%40.service.in + #wget -O /lib/systemd/network/glorytun-tcp.network https://www.openmptcprouter.com/${VPSPATH}/glorytun.network + rm -f /lib/systemd/network/glorytun-tcp.network + mkdir -p /etc/glorytun-tcp + wget -O /etc/glorytun-tcp/post.sh https://www.openmptcprouter.com/${VPSPATH}/glorytun-tcp-post.sh + chmod 755 /etc/glorytun-tcp/post.sh + wget -O /etc/glorytun-tcp/tun0 https://www.openmptcprouter.com/${VPSPATH}/tun0.glorytun + if [ "$update" = "0" ]; then + echo "$GLORYTUN_PASS" > /etc/glorytun-tcp/tun0.key + fi + systemctl enable glorytun-tcp@tun0.service + #systemctl enable systemd-networkd.service + cd /tmp + rm -rf /tmp/glorytun-0.0.35 +else + apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-overwrite" install omr-glorytun-tcp fi -rm -f /var/lib/dpkg/lock -rm -f /var/lib/dpkg/lock-frontend -apt-get -y install build-essential pkg-config autoconf automake -rm -rf /tmp/glorytun-0.0.35 -cd /tmp -wget -O /tmp/glorytun-0.0.35.tar.gz http://github.com/angt/glorytun/releases/download/v0.0.35/glorytun-0.0.35.tar.gz -tar xzf glorytun-0.0.35.tar.gz -cd glorytun-0.0.35 -./autogen.sh -./configure -make -cp glorytun /usr/local/bin/glorytun-tcp -wget -O /usr/local/bin/glorytun-tcp-run https://www.openmptcprouter.com/${VPSPATH}/glorytun-tcp-run -chmod 755 /usr/local/bin/glorytun-tcp-run -wget -O /lib/systemd/system/glorytun-tcp@.service https://www.openmptcprouter.com/${VPSPATH}/glorytun-tcp%40.service.in -#wget -O /lib/systemd/network/glorytun-tcp.network https://www.openmptcprouter.com/${VPSPATH}/glorytun.network -rm -f /lib/systemd/network/glorytun-tcp.network -mkdir -p /etc/glorytun-tcp -wget -O /etc/glorytun-tcp/post.sh https://www.openmptcprouter.com/${VPSPATH}/glorytun-tcp-post.sh -chmod 755 /etc/glorytun-tcp/post.sh -wget -O /etc/glorytun-tcp/tun0 https://www.openmptcprouter.com/${VPSPATH}/tun0.glorytun -if [ "$update" = "0" ]; then - echo "$GLORYTUN_PASS" > /etc/glorytun-tcp/tun0.key -fi -systemctl enable glorytun-tcp@tun0.service -systemctl enable systemd-networkd.service -cd /tmp -rm -rf /tmp/glorytun-0.0.35 + + # Load tun module at boot time if ! grep -q tun /etc/modules ; then @@ -772,7 +840,7 @@ if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "10" ]; then update-alternatives --set iptables /usr/sbin/iptables-legacy update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy fi -if ([ "$ID" = "debian" ] && [ "$VERSION_ID" = "10" ]) || ([ "$ID" = "ubuntu" ] && [ "$VERSION_ID" = "19.04" ]); then +if ([ "$ID" = "debian" ] && [ "$VERSION_ID" = "10" ]) || ([ "$ID" = "ubuntu" ] && [ "$VERSION_ID" = "19.04" ]) || ([ "$ID" = "ubuntu" ] && [ "$VERSION_ID" = "20.04" ]); then sed -i 's:DROP_DEFAULT=Drop:DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)":g' /etc/shorewall/shorewall.conf sed -i 's:REJECT_DEFAULT=Reject:REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)":g' /etc/shorewall/shorewall.conf sed -i 's:DROP_DEFAULT=Drop:DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)":g' /etc/shorewall6/shorewall6.conf @@ -874,7 +942,7 @@ if [ "$update" = "0" ]; then echo ' /!\ You need to reboot to enable MPTCP, shadowsocks, glorytun and shorewall /!\' echo '------------------------------------------------------------------------------------' echo ' After reboot, check with uname -a that the kernel name contain mptcp.' - echo ' Else, you may have to modify GRUB_DEFAULT in /etc/defaut/grub' + echo ' Else, you may have to modify GRUB_DEFAULT in /etc/default/grub' echo '====================================================================================' # Save info in file @@ -926,14 +994,14 @@ else if [ "$DSVPN" = "yes" ]; then echo 'Restarting dsvpn...' systemctl -q start dsvpn-server@dsvpn0 || true - systemctl -q restart dsvpn-server@* || true + systemctl -q restart 'dsvpn-server@*' || true echo 'done' fi echo 'Restarting glorytun...' systemctl -q start glorytun-tcp@tun0 || true - systemctl -q restart glorytun-tcp@* || true + systemctl -q restart 'glorytun-tcp@*' || true systemctl -q start glorytun-udp@tun0 || true - systemctl -q restart glorytun-udp@* || true + systemctl -q restart 'glorytun-udp@*' || true echo 'done' echo 'Restarting omr6in4...' systemctl -q start omr6in4@user0 || true diff --git a/glorytun-tcp-post.sh b/glorytun-tcp-post.sh index 1522d79..240599c 100644 --- a/glorytun-tcp-post.sh +++ b/glorytun-tcp-post.sh @@ -1,9 +1,13 @@ #!/bin/sh +[ ! -f $(readlink -f "$1") ] && exit 1 . "$(readlink -f "$1")" INTF=gt-${DEV} [ -z "$LOCALIP" ] && LOCALIP="10.255.255.1" [ -z "$BROADCASTIP" ] && BROADCASTIP="10.255.255.3" +while [ -z "$(ip link show $INTF)" ]; do + sleep 2 +done [ "$(ip addr show dev $INTF | grep -o 'inet [0-9]*\.[0-9]*\.[0-9]*\.[0-9]*' | grep -o '[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*')" != "$LOCALIP" ] && { ip link set dev ${INTF} up 2>&1 >/dev/null ip addr add ${LOCALIP}/30 brd ${BROADCASTIP} dev ${INTF} 2>&1 >/dev/null diff --git a/glorytun-udp-post.sh b/glorytun-udp-post.sh index be4d46a..5d8e7c4 100644 --- a/glorytun-udp-post.sh +++ b/glorytun-udp-post.sh @@ -1,9 +1,13 @@ #!/bin/sh +[ ! -f $(readlink -f "$1") ] && exit 1 . "$(readlink -f "$1")" INTF=gt-udp-${DEV} [ -z "$LOCALIP" ] && LOCALIP="10.255.254.1" [ -z "$BROADCASTIP" ] && BROADCASTIP="10.255.254.3" +while [ -z "$(ip link show $INTF)" ]; do + sleep 2 +done [ "$(ip addr show dev $INTF | grep -o 'inet [0-9]*\.[0-9]*\.[0-9]*\.[0-9]*' | grep -o '[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*')" != "$LOCALIP" ] && { ip link set dev ${INTF} up 2>&1 >/dev/null ip addr add ${LOCALIP}/30 brd ${BROADCASTIP} dev ${INTF} 2>&1 >/dev/null diff --git a/omr-service b/omr-service index 55c2c23..a4cc162 100755 --- a/omr-service +++ b/omr-service @@ -6,9 +6,9 @@ _multipath() { source /etc/shorewall/params.net for intf in `ls -1 /sys/class/net`; do if [ "$intf" = "$NET_IFACE" ]; then - multipath $intf on + [ "$(multipath $intf | tr -d '\n')" != "$intf is in default mode" ] && multipath $intf on else - multipath $intf off + [ "$(multipath $intf | tr -d '\n')" != "$intf is deactivated" ] && multipath $intf off fi done } @@ -16,30 +16,45 @@ _multipath() { _glorytun_udp() { [ -z "$(glorytun show dev gt-udp-tun0 2>/dev/null | grep server)" ] && { logger -t "OMR-Service" "Restart Glorytun-UDP" - systemctl -q restart glorytun-udp@* + systemctl -q restart 'glorytun-udp@*' } - for intf in /etc/glorytun-udp/*; do - /etc/glorytun-udp/post.sh /etc/glorytun-udp/${intf} + for intf in /etc/glorytun-udp/tun*; do + [ "$(echo $intf | grep key)" = "" ] && /etc/glorytun-udp/post.sh ${intf} done } _glorytun_tcp() { - for intf in /etc/glorytun-tcp/*; do - /etc/glorytun-tcp/post.sh /etc/glorytun-tcp/${intf} + for intf in /etc/glorytun-tcp/tun*; do + [ "$(echo $intf | grep key)" = "" ] && /etc/glorytun-tcp/post.sh ${intf} done } _omr_api() { - [ -z "$(curl -s -k -m 1 https://127.0.0.1:65500/)" ] && { + [ -z "$(curl -s -k -m 3 https://127.0.0.1:65500/)" ] && { logger -t "OMR-Service" "Restart OMR-Admin" systemctl -q restart omr-admin } } +_lan_route() { + cat /etc/openmptcprouter-vps-admin/omr-admin-config.json | jq -c '.users[0][]' | + while IFS=$"\n" read -r c; do + vpnremoteip=$(echo "$c" | jq -r '.vpnremoteip') + if [ -n "$vpnremoteip" ]; then + echo "$c" | jq -c '.lanips //empty' | + while IFS=$"\n" read -r d; do + network=$(ipcalc -n $d | grep Network | awk '{print $2}') + [ -n "$network" ] && [ -z "$(ip r show $network via $vpnremoteip)" ] && ip r replace $network via $vpnremoteip 2>&1 >/dev/null + done + fi + done +} + while true; do _glorytun_udp _glorytun_tcp _multipath _omr_api + _lan_route sleep 10 done diff --git a/omr.service.in b/omr.service.in index 9ce5fa5..4e17716 100644 --- a/omr.service.in +++ b/omr.service.in @@ -6,7 +6,7 @@ After=network.target network-online.target glorytun-tcp@.service glorytun-udp@.s Type=simple Restart=always ExecStart=/usr/local/bin/omr-service -ExecStop=/usr/local/bin/omr-service stop +KillSignal=9 CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW [Install] diff --git a/openmptcprouter-shorewall6.tar.gz b/openmptcprouter-shorewall6.tar.gz index d3d2d9c3c195c05bdfd30fb009748dfd6ee7412d..2f4dee49c8cd7be2a6734da76cc5f231add1b4f1 100644 GIT binary patch literal 3809 zcmV<74j%CziwFR@{mWhe1MOUUbE8HQ-+$4kn38?TZk=VlEII3xZVv;JI3pl{>^OB* z6qc|}MFI}cI=<9?_v@YkgphZ=*_E7JLfa)Vub!Tno?rJo&@Ax%BywgyzuF(QfchsV z^c$%B-R_@uUbVaZR{NxP+Ua&*wc72I)9x$M+M`T4t>VOq2zeC+LGr15&!zvL(n0Nj znD;^CJ~)d-pEMez=_a#goJTchnTFIb?=Xmn=idg=(n-9)C(ccMw;Ol@ii632;>X>pux zXqLu_x@K6MNk6BiWN_w{YzgC9?VWc^4*992jU`2w43m8G4Y6&(vMt^iNfygs+x&!A zMc!taYJzok?=C_&I&+}ybLULgxCV#+t9i(^TdnU}wRf&R_inTDLrdQ-e4B*plF2OO zI_*-iaktamE@$v&sm9ax+d}#e$8WpsP0sDpPFW<`5Vl!+(QLC|zu!MC6;vhbT-Hom zHMh(AZgS%Val?;G5_Zd6bp5F=3Bz)qfaKj$QIl7t?V_>cyCvCs{eHQq{6wX(7j8=1 zYxT>$WvY{>O8U!E(RRN)hSrl~pKJ_1mh8V>7i8bNng5=jxY4aMbK~9cdy1aL|85WQ zztacUZ}nP;|NU--|1Uxt_)p%uQH-d5a@-;fVmixk;SxDl5i$f^CjkB=c?cT0>JY&6 zTkmcaQIl{C9EBi!jJ&)1guE8skPZxgqXXuh+&qGPa0?Y$uCt_e#X_^O@NOa}dL(E; zBG)BxaGN|hk^4P)3|3?Yh9q+5UJSP8W|g?aO9XayM97Ed3_1(x>5PfyC@Mch0@n)_cyTpk}h;i|~JI`btq9A4}2$(-$Pn-EY zaXm=Ky0c#E9JjODQjSLi`s%flp!^XDLM-?OgnlFo2c*kN9@8!`p&~4c#*-KlFHWT6 zn;0Q9pd_~t$FSzbau}9;3rL$2qCg+Nyd;D@EJ+d z(O)oYV6wPFuxYkjNTf8spM^(YNNyL-U3?UU&@<2hN6>+wDf2=5D1!cTZ_sgiANpLd zj2eB$Kml@c$*~ zdHFmAVYG`@QwH`peBHn%iv5-5Xa-y-JKgJkV5li#fa}L zq3n%&2f*?GKnhIBDg@sLU>=Zo;U)>i)+8W^_?~~a0$4_TT!L)~mIVP|Ld^+9A0GsM zr0ghMxtnbZqu?%Yiu4OLZf6+a*!&*2$$cvgrPF^vC%GTQ%T;u{QINbY_tP5xz)H=6 zX#R#VFCYkdbB6`?spWH_K)hNcAUT-C8)gM!=pZym9y2J6CAoLNFu5-DS>!UakKaRpG`|LMUppu+zbpxm{g z==Xa|Q_)M)8npLU$FuVvo;UqJnE#dk_aYPqumpbGZynG1|EKL%8UG=+8vmD|&)EOb zsftv4Kh@sPNB4dhitK*h=YXBoLRWeMtFk$6FnbgOpzKt3lMc+8*7CK{Sv3}g4Au8$=$)D%U#lGRZr|6~fyI+uvT zgPdhX<**_BOA@RS<1b!uMXSX=xBe+Tga0QdoihHn@JOJ-{}-Uoz<&c(5=jQ`7*+*5ZU)@^GzOKZgx>bq>-Ub_1ZgA zV!g*J$~pi=`Ex}!$C9{?G$aLjq7Wggm%JhuBBrWk@WMqgk1Ac&@}`M_|80U+GI&5V z^4%F#-_V==yb9S~G0rO7sXVC3{(EQP&0nK+##TLN#gkb`=O!b5Hgm&-h^kqrDPGrc z>!q-k1X-OAL4+4)pvY_HIIzAv9A0hI!=%gWp^ec!|Bmu*rtB_t6*4h49EXQW9Pr^d zFMQu`c(Y}=nTFfKPo&WzG{ZXWqg6lCtPP%}`jDp>1!0L<{l=NsX}|wB@ZIBMgm4l@ z?t4HQ29t{*&3@z3l8YdiyYpiTk~nU(rj6eFNH0)rkj2kC{H?h}feCSVN)82t#ELT4u(CCa;v zwe?TlzI|J)cDC?PlZx{`Rn`MhhL+P}X{UE|(UC(9+>V`ZOqL+OdAo8UR{ z=iD--{OXM1#PLJt4xIZ%8~}1JJRhDDOu0{z@T}Q8bo z77S%Wx&qgKpN)W}2Po1A{$!XVqun>+T!BRgtX3>r(MC4iRD|}VtCNj5d_Kn&iYlg| zwHkJ41oQB4G5QbUK@Ey>u*YDECC3m~t673> z4;6l7Zt=)hbsGZidK3>h)Di&{-2y$)hziQ1ks*gu05KKU&phal2;X8lEdZ1a}`Grb|SYJd-$t4<_&2xGpNQ$(qtWC2Zdt4 zB=(&fcwtkKKxg$nF1#fZ^;f4Kro=Q!xS;9?TBM0n$boEXHFXH?IA+i#Lt$)hJii&b z(E{NK1#iX>bJnCEwA%bBe^>-FXHgDfzB($WX=#Q;E05ebf!2UpjWvcFwmFsnJ!qxz zJtR!e&1(~-9n|ZnRQmxI5e9q+>M#Y>u&81Pnc9G&G|7a<7-+wCuNG_pWQ)>}pDNbC zhqZA5g0kp3U7pLrM30ZoqrjQZoH${d8Ap@VBJm30Ijp_aATb~Pv%`Fj(b#koq!^70 zbx}1VH!Q@~Ysl$KDzAeM{V6%>A=PfW%_P$b^40m^7Vo9K#UvFczdfF*{>Xah=W$`p4z83R$mOtv+a zRGSym#)z7V#-B&uL%de`3COyZk7kj6)ImdRde|sSW*(^-R*L&9YRH3Sr#M6f0e9qz zH$iW}1`Th>!xNJc6^_Ef!4wJYcYLuO_M3(L?VsLcZX#Ic#Ow#lj@s}k_CgmIP; zjgbu%sW5`6AToFjta2P>&9BuiBuTdo%T5j1HS?HwF@1H)w5dNtqcewSQyKDD3;hh3 zF(XCVT=!rDZ5Xq>**JpC#iE^Lo73S?{&Da##!M~gM;rI#wW&4ew`w)K(L0fUl5pXX zJ=+CURjErxv5uWApgSi0Fa=lH&fh&qb5Z|_+C?Wya${*5P?v;KrtLTRODK!o$9mEd z@&;wWAE9roETkJUD78MQcSx81;ddMUI-7rJVo{HwfOaX1nbNa3W15Zd)XbqAMuv%m zar*cg<_oXbpo@j9FnH?-<{*P2NTvzPowPxy1eziWybkGRuJ%`&alu35Rgo3`NisB> z^#cuRs?@=cL1RA%r&GIs0T^ecZlVbYm#tzc&h2ygA3xQL4X|BbzHHb|Vhe=r__gD|owj!UpKid8`|^oFoX|~{3tU6;T1rL>F9 z>KL4f9kBT%J#+t~(`wQE-+t%xwBPA=@cze1@3h+geF@sU|B>JMFjd}aPMr8ZD>riH zuKShOKl;_pk3aFv55$mq-jH-x{plU`=4L6npH7>(gy^CWf24aPPyBiW_vHN#j{brK zx?}=}4odOIBsjbQLVt7uvYzwjvLaj8&}jhtuq-xs5xCyE-?h%pn(fxnziUv(?YxD- z@3_JnsMyIcH`)0no_B&;gD%lNqz5kf5olaHz?`ocQwLbJ-*6o8YjLHQQU7v>o)zU3 zCqWpx^SxdJeeV8$uh%dA{zIp8QvLqJi_pjJfA$K#KtV;m*biuTDi`3->;e>YWDl;8X*|1U$I zasU4(RFUfSuL}J?ivAQt_5l0oZ}V8!ItBamS2MP7Sys2AC}~scv$6hTyt7~G$leOe zFSBMBW$|ip{%RQw`~gwEqKYc2sG^E0s;HuhDypcWiYlt8qKYc2sG^E0s;HuhDypcW XiYlt8qKYc|Gt&P6b*62h0C)fZOlEnK literal 3799 zcmV;|4k+;-iwFR+%bi{T1MOUUbDKyK&%fwXOv%38q|UM)w&absbU6%2;*5X=WXD@q zMPUisR3zX4#p_GuyI=PVAcUMan@HZhENz#>yn1?OdVbyWK-0kYlgOFAd$Bue0rifL z={HdMyWKnKyl5ZwTJ7WRN$2S3MXTLDJ~?_pT04{}r)8Wt5g{+4AV@x!@2T|vQ`)QT z5%VsH+G~Hy{jPt1GG}Dk8<{bnP@%)=0S~!Up_{6ymmI-kohv&wSLXtZ# zCO6*PJs`!kbQn)X(LI|CBq~?{6K75uxyJrhLXiH*fu}r zRgt$@rkY@#-nsM8jZPhC`^-7jHLk(o|8f>`?N;ljR_%@J&%B$g{J_#T3*RK+s$?<^ zxlX%OY;@E)+AL@AW~s)L_Ul6WFNd#>+UuO#C!MlLvLS4;_M+)}!CtR-QYxrQ)|srC zwrXyc_ub^$3*v?!mn1wYbJ6w3x+DzCeFBmnm5Q3YDs2{x9p5d<-tG0uMde2-jlFPP z+HR{??k!UtKUUITl!~@{5@{KSoJoT(dchu>rLB>o?D z5&t_qfc;jth4|k)s__3=Xbu0#dpC*^)sGKbq(Mw)5zbvA=PE)5fa?UnpCtD|BUc>) zn118kE+c9Z4uPW(gb$H-dzX-x!Yk5&;cs-nyp!t(un%sbLd$g))UH@)Hs;=S*u?#zq9)?6CfDVRs-TK zViMfYz)+nK#f@V~8@j$5Idh^fujk$r3M<~!^<$SfF$pm)zH?`ptOFFpOa%e+2kdDx ze(Eh$zMpzk{xryV=V<^zrDt)_UU#UY}-?lZ+{e;feIq&_dsS+VXRxQaG@B%&~ zX*&7~W(`ahw+}YWmJ5lLW_Q!@01U~^+_{Ypq7ZrpI^Y005Hw}hZy!X^f9^FpPVYmX z3l>qM=lREtC8*%vGbVZY$BJzU;y+8F6FG|=Vn5PT_}}jIDE=QqpxZeC{BND~+7r?!C??j$+JqKh+?ijui-v!hJka8KE$qC|kyu7`2;{;M@zN{GW zoduM=c5eY#?g2=FDOrZ#`vA-X63^Wvq1c)P1QFl!Zr`f4Z)%y08FSEq3Gj- zzz>uig)4WxZDADL=1q})qsHwN100**eK)ylrJ;2C_vs|}gLtuwZq^Etm*sw1;U8G3 zX%Nj`G3EsXL2quqz&^EnE)^ms;I)G$e2;nK z9K(X9s?>U=>6ScR%Rd7BzzYeveDuabF`XVM?~$(~yb6(hzcgRv@#SV0MMN4J+C;Ct zF(uY}yrQfEP?SGYWOF2mt4KpqpeG6uvUAPjf_KI;<;ZEgVP4?eAb8q$%tuwajDJz~#LpnDZ@zbdrCPY-tLQV0i zjvFt9wIs;uybmJ0I0HpqGRJ}S<^JGutsW*_UJq@I?)kTrcQa*op{tOIvEev8RN{aS z$9duVUc;L%!u2%V7Jej+7NHqdX`ih6iDs?wEY*iR#V80%%<9+9tWNv=zk%-_9wLO3 zFmm4m(lD5u2Wj?emzJCd!OWc-+{eN6T}-9Cod?lFvh+#duk}mb5o_aFmawc>^qW@J=ykhC-QUe)Ioss% zndX`1C>y}72;S**Xm#R9&`ElHNmiP=sXk?Wp*lz})EqscxM>2`V1Ut&peb~A(ov$k z+gMxg`1R}8#cHQ>4>hSc?^9*n6IDLb3aIC_-8#g-4!cOypq&14Cl{*&tV49=c2dXZ z{r`5mcS7&~9G@Judk_HsztcUg_J5v*w(d8fC0Y6R7pZI9ee7hpqwkhj~#v32QD`k$6MI!@FcL z-~KKK$EE0M5{vM}fX@lR-2;h$4@J(10#D-B>#c!9W>^#5mQ--eB(Zw*Y)F^j`tPz4u=D^$8p59pb7Z*vMw}_I=z!IVWh>gyrkje;o^*Ax7KhJgxI$6I zG_+E~4vm1mfF%n{9LS2)Z@zb;CiuC{g&W6+G%Sf;a_iS~_&ohvjQ@3-N|#!Uhs6&y zRk`Y`L9I6Cg_4wPLoi)ftx0O=P`f1=8=1{d#g8Y(U^6y_4TxX0q;SRG^S$H{;%YTZ z(CvZ356ul8`KoSBz-^D>9*0^YfTCNVCmK;fc{DQMa0(!%;`*5f{So0?Os9nac{O;F zF@5`b1q=IuJhXM*8ujb@A22A&#>Ybcoi>+o1Ysv~i?RD3%n@%$>zP3{hLR@h5Zf;l z`z^6=-M|Z*iUc~V_i*7YnW(=y{V*k_Ny0f*N6;cooInm_Q>&>1aK|x&E*T1Ad+qtn z(2eE@PbhdZhM3bP{h-z6Px-?^ z`aZ0U3lNk=*Xi(am<~On z#101D0EiT{F}^|6|1pNu_5KI+YvYgbfNPGA|J?r&Kg5Z<_y`a%bMY=D^^8CMSToE~ zp=^A&Sp;IH!2(}Hg6uo#uaY-G0ajnlo1M%Q4XlT(4w=8Y3fmOs`s^Y$B#2{Kl}-N4 zlvE2I#mvLS7rL<9AbJ&%zTvfs81v^6wXkQrDGN5UkS2@CCT715cKslA3J!9c2C6BH zcv-bg!H{(;WhyBASRb2=g`h~hVFQ%WfHu|@$zs*PQ~*m1lhFp0)RYPCcrpf}gqdt> zB&jwpri~Fb6^%cSzK3|F@?(&7B_GWqz12ZOYENZ}mWv4hq1p#;D zk~c(~iHaN3EL+x7U`U24K=wpESG7y%14CwJ1`Es3BB;#*{lu}Eu(rvnBC8VcvV>8V z5si@z6{#?SsUR|V4Xkn;WzDbE&Lv5=4a-gq*%kAccrkr-%CxCJM58l@Xk8idSPT6O zm@z{|T3`2I18o?yyxBN{%*CReWSf)0Kz`eQhcOdNdTZmJyf(4=y;iM;H+skNuM#di zvS+)Xsw#EKDAuu)1$4)xUnbxx+xfc(X)fwtQM>3wNp37{1L~4c%C!9^e*tB&`&ds} zLf)V(_!j!c%0jv!gHr4LdWRg*Km2aPUuXRfO)Tm$6woeYF;jXLXH2pYo|rk5!^kj^ zFisy`!F=Hr8+5Ud6$Wn=!5m~z1j#gExsx^sl|WNOf!873%+>xb z#Z;zwt3^REExpf>uK_me%a;wCNo;|z8NYJ;H`7+G|KknVa$i0&h-13Ra*k_Ao?O8I zPKdSrYH`k;$rb`-Hj_5O+F-zZ@iA|nXQ`;n>=}S%4=;rfgiYK+6G7QDix|>ayO6fA zSsjBju?04tr6=xxbXu+B()*vSW5{0Z|2_k)-~Y((e3&Y4HOEf;pQRf)GuQpb>mR-9 z=Erw@^8+!Yo;M`jReyX(y}4eB?x)jcE+D!n#GmON$s@lW!99BagQLG7fi9WAp@UNV zF$oTDfY2YEfUIZynXJgx6?7T^KP-z4UIeZ;?oX}L(`LJM@b4PbaWiXS@F%YD1}b(k z%uRN_iRYc5)}TwY59xtRegqoVFyl+c(*aKHR~!fIT3qQ})W6)BXGJTDlOPP;*-o#4 zK6U@U+wGO?f2VU?{r2hK}EjW4`_EP7vOt#0SY>@gVzAQ@iOLmxo^4@ zS-cFHhEY6rdnvQ4Tw@j2SVcd}4?6r#!b^C6@csXGw{yI4|G&cj=bc(pix zwTuS-geYH8MHN+4QAHJ1R8d70Ra8+$6;)JGMHN+4QAHJ1R8d70Ra8+$6;)JGMHPLI N^gpHT=ePiP001)yVU+*? diff --git a/shadowsocks-libev-manager@.service.in b/shadowsocks-libev-manager@.service.in index 3a5eaa8..e78d09c 100644 --- a/shadowsocks-libev-manager@.service.in +++ b/shadowsocks-libev-manager@.service.in @@ -8,7 +8,7 @@ CapabilityBoundingSet=CAP_NET_BIND_SERVICE AmbientCapabilities=CAP_NET_BIND_SERVICE LimitNOFILE=99999 LimitNPROC=99999 -ExecStart=/usr/bin/ss-manager -c /etc/shadowsocks-libev/%i.json +ExecStart=/usr/bin/ss-manager -c /etc/shadowsocks-libev/%i.json --manager-address 127.0.0.1:8839 Restart=always [Install] diff --git a/shadowsocks.conf b/shadowsocks.conf index 00337dc..f4e8a5a 100644 --- a/shadowsocks.conf +++ b/shadowsocks.conf @@ -2,10 +2,10 @@ # max open files fs.file-max = 512000 # max read buffer -net.core.rmem_max = 150000000 +net.core.rmem_max = 67108864 # max write buffer -net.core.wmem_max = 75000000 -net.core.optmem_max = 75000000 +net.core.wmem_max = 67108864 +net.core.optmem_max = 33554432 # default read buffer net.core.rmem_default = 131072 # default write buffer @@ -28,19 +28,19 @@ net.ipv4.tcp_keepalive_time = 7200 # outbound port range net.ipv4.ip_local_port_range = 9999 65000 # max SYN backlog -net.ipv4.tcp_max_syn_backlog = 4096 +net.ipv4.tcp_max_syn_backlog = 10240 # max timewait sockets held by system simultaneously net.ipv4.tcp_max_tw_buckets = 10000 # turn on TCP Fast Open on both client and server side net.ipv4.tcp_fastopen = 3 # TCP buffer -net.ipv4.tcp_mem = 768174 75000000 150000000 +net.ipv4.tcp_mem = 8092 131072 67108864 # UDP buffer -net.ipv4.udp_mem = 768174 75000000 150000000 +net.ipv4.udp_mem = 8092 131072 67108864 # TCP receive buffer -net.ipv4.tcp_rmem = 4096 524288 75000000 +net.ipv4.tcp_rmem = 4096 87380 33554432 # TCP write buffer -net.ipv4.tcp_wmem = 4096 524288 75000000 +net.ipv4.tcp_wmem = 4096 65536 33554432 # turn on path MTU discovery net.ipv4.tcp_mtu_probing = 0 @@ -54,5 +54,5 @@ net.ipv4.conf.all.log_martians = 0 # MPTCP settings net.mptcp.mptcp_checksum = 0 -net.mptcp.mptcp_syn_retries = 1 +net.mptcp.mptcp_syn_retries = 2 net.ipv4.tcp_ecn=1 \ No newline at end of file diff --git a/shorewall6/snat b/shorewall6/snat index ee175db..38df7be 100644 --- a/shorewall6/snat +++ b/shorewall6/snat @@ -18,4 +18,4 @@ MASQUERADE fe80::/10,\ fd00::/8 $NET_IFACE # SNAT from VPN server for all VPN clients -SNAT(fe80::a00:1) ::/0 omr-6in4-user+ +#SNAT(fe80::a00:1) ::/0 omr-6in4-user+ diff --git a/tun0.glorytun b/tun0.glorytun index 2e5ee3f..abd7ab1 100644 --- a/tun0.glorytun +++ b/tun0.glorytun @@ -3,4 +3,4 @@ DEV=tun0 SERVER=true MPTCP=true IPV6=true -OPTIONS="chacha20 retry count -1 const 5000000 timeout 10000 keepalive count 5 idle 20 interval 2 buffer-size 32768 multiqueue" \ No newline at end of file +OPTIONS="chacha20 retry count -1 const 500000 timeout 5000 keepalive count 5 idle 20 interval 2 buffer-size 32768 multiqueue" \ No newline at end of file From 129e6a9ae4bd4eecdeab5578fdba255de5dac538 Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Thu, 23 Jul 2020 17:01:34 +0200 Subject: [PATCH 03/15] Update Linux Kernel and add gre-tunnels creation --- debian9-x86_64.sh | 4 ++-- omr-service | 17 +++++++++++++++++ openmptcprouter-shorewall.tar.gz | Bin 4062 -> 4075 bytes shadowsocks.conf | 1 + shorewall4/interfaces | 1 + 5 files changed, 21 insertions(+), 2 deletions(-) diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index 2f24620..0df040c 100644 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -19,8 +19,8 @@ DSVPN=${DSVPN:-yes} SOURCES=${SOURCES:-yes} NOINTERNET=${NOINTERNET:-no} INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | grep -m 1 -Po '(?<=dev )(\S+)' | tr -d "\n")} -KERNEL_VERSION="5.4.42" -KERNEL_PACKAGE_VERSION="1.9+1efcfb3" +KERNEL_VERSION="5.4.52" +KERNEL_PACKAGE_VERSION="1.10+206826e" KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_${KERNEL_PACKAGE_VERSION}" GLORYTUN_UDP_VERSION="3622f928caf03709c4031a34feec85c623bc5281" #MLVPN_VERSION="8f9720978b28c1954f9f229525333547283316d2" diff --git a/omr-service b/omr-service index a4cc162..ecb1568 100755 --- a/omr-service +++ b/omr-service @@ -50,11 +50,28 @@ _lan_route() { done } +_gre_tunnels() { + . "$(readlink -f "/etc/shorewall/params.vpn")" + for intf in /etc/openmptcprouter-vps-admin/intf/*; do + . "$(readlink -f "$intf")" + iface="$(basename $intf)" + if [ "$(ip tunnel show $iface 2>/dev/null | awk '{print $4}')" != "$OMR_ADDR" ]; then + ip tunnel del $iface 2>&1 >/dev/null + ip tunnel add $iface mode gre local $INTFADDR remote $OMR_ADDR + ip link set $iface up + ip addr add $LOCALIP dev $iface + ip route add $NETWORK dev $iface 2>&1 >/dev/null + fi + done +} + + while true; do _glorytun_udp _glorytun_tcp _multipath _omr_api _lan_route + _gre_tunnels sleep 10 done diff --git a/openmptcprouter-shorewall.tar.gz b/openmptcprouter-shorewall.tar.gz index 1fa23873d68587765bc932640adaf20d277ce300..69fe33270e80b4aa2c3634eba31cbd64d03da7e8 100644 GIT binary patch delta 4003 zcmV;U4_xrxAL}1~ABzY8qlFk>00ZqDe|Mv}@&3i1LeEL>c3+eDw{uCKdnJHv8VnrZ zL)G1UV#r z@*?u!&D;|bzbsr*ojX3sxSeL)s=)4tzGjSgi?k|7ZvvGgUa(|MW8S=@UE!^S$X@e_kls=oZJ&+B){}+Tdf!?!|wqAiI9) z{P+CW4Ii9|8|}lIY=<58zgcfJ!Tz7uyN!CYTkoL#?>5d$`~McOZvQ{HVT5+QeO4!@ z#B}D1nM>qMMMxhkI|1`g;^*KrQyl_k{lR-&hSVvX0Y@QNyoBE4Q%v3o?@1Ge|FjA2 zo!q~Ghj4QhTCOvvp2b4PG4p@!LnnM8=tDx+B~kDYKRcoO7xEG;$pl~vXLuW?x<^9Z?Kw-t3 zxPIgkCn5{PMNjTDZEGJJVkQj%2MFw`n13Oz2l-fc+H1|TMp|3K@q~XsU%hi;Y=20C z1r~e{jea3B2U?ewJfmG;LPb~>-6t_5UK~kh@vkxM?}ufGm653%JKijU0;hY0J^1#O zC8_S)p=Y5&bMKswe%4fp5F)FVWb}Cf?-4W|Lj|(}&Wbw*Z)VGw$xWXoixco04>RX6 zItihNT<8%H{KOBU`7(ceh)yCH>WNFUdiBbOh0i_4r}5JNGsk5#DTg#0Y&#>_PBEXs z@2llM#d{iks^nwno-ScVY^(Q+Jxd9{2Us|vGe4m3N7%LgYc|`3^L9ZAeiSG0QPH2sPFNi zy)Tpo;iPcSLn%=e}pJz5`@$Dtp1#b;n)qWpWUWzh=oWll#G_M7=#3o?pe4H zL0@9z;<3ns@g`3WL@=%k-5Yw)nSNFk%E@sB;kZ}D*|WQqRY4hx5@Bj}1`R5rz%PC6 zIr0AltARLN9Xsqlcz|wk|F6@jm-hcHAPa4&0sPvnDdB&u;VrE0&iQ}7Isebg{r@+C z8{M>dQ8aoD8VJz;jfyrhHn7bK(lT4YRHv```CHVh?Ib3i!O1UHi=|)o0 zv^j|a|^0R|QlN71tO(X(p#e0rGZi2Qeehv1Vb z1{{AYMK*_$xI!9|0zHvK$m$KR$T`GVwG3Xk&eN#UZ6y;;4E*n6jF^IFv_`%=q3XNv zCci8f>}e6sDty#%RFVA;&di&>!-xr`+7)=klLeid4EV{!UBpCG&0I~7&< z*7+QScytnqykoH*>&xT*?OHvoby+=B7~OyKA1Uuz!tO>_fe6ugUd6~0SZ~l2tAjGH zSGPlyUA$9K#4uPCm{#wdX_fZ*zXIPqJ45qL7NPqAtPC@evmhbAcWKF45KP_a88wi! z;&k9Phi;qP+i37XSTc|~b)l6mf-ok3CEX50CDiOjPtG)Wj)KWA5pC<^EC^rXrB8nX zf325*DXVp@8;VsIHH%(pWvAUvr`7q7c`T=!JU$_wX%5rj+)Klo%_gl*911#i7kJ1i zS?TJgGT}r3+K1<9I!GLFr;8ZM$N=viLW}7%q=P|OG>~bxeQ|M-=RTQvs5bcto@nTi zsPeG1!KaPGJO}a_ktk(XW&B2t zzi=KQvY$l(810$o!+lJi;&^dct35wIpRJ04C8*6AeN<@N*;729?SFTR;}U&0ZmI2DMe;IUsAQ`;_Hop(OZ$R5`K?a2=`l+1Nf6+jturM#FYYz4OoArShk`KY`U2Y@+7O0H5}ew;mSl6lN2o8ESXnLHlYx+ zQp_erK<~ifg^~AVMe5Z)IAIN<-rC%aBD6d#iyn9GRWn0+`KJi~RcWrp4>VP|>!|@v z(lr>c9PvV--E4C=Sz@iV-O!k)@)BY@^xpg0;)L7Ozv=WtG-k;R2H4+;w}!py@o$(EW#i+jD=&|KGl#q(tz$tQ29hT0fbG?mQ3yFs z=+=IX?MFB87Bxiz&0T-hBJ1?Wlq{-%!Zp=EP#jGh0|j!aRMb9%=19OAQ;Y6B|FTAZ zXbst2b~6hm&a9Y3I%u9Q8A>lDuPxkghWcn)njz83LpO>+7|^7l#*Bw;4ka)llslK$Cpci{2={Rh#08N)K}BuAQM3Yhajs1=0aC# zn_96RJE9C3qG-#y4L+GS!M33%M3f0j`T}w!tFp;onUZS3t(Zo;_&P6kFQ8X{h~)j= z6=K9+OO($QZ_0wrd?VwW&CgyHJo-rzAe?0G3{_Yd^0I21f&oT2;VLNnNFSMuhoDHj zVS`CyS=vZfB#TuDGX=abOi&xlrKXH=-;9%3n)~bpl6ghd>*0gDVAVmwO;nTXJ zWmrq0A(lFT-dtZdjd1=c^B7#D0V&Bg`U0NPr-b;Pz)1dC>eW~Gc5XJQG!CRT zm^Bn*KRUp8MT0u(nVm4s+;wWZS>;UhG>f88XfwrIsQCGb$ePS15F;}A z8)#w{1R)Vc(Sc=YOUSy~^zd0EL;VCJXQc$XA;UD)d(|ds(LcO4;IFyP^}e$1^b|;l4-(!VlL?nR8i0mf!875 z%%<_JW?b{oE2_u}|124r&H9igHC1ZjPw(_Fwq2(I%{5qeD~Wkcu9{b${-DQKvL#kNC$$2rd6>^-3cXt3I40KqtHn8YC0l66)0wo9*7|+6$QbeFb()LH%bhTe{HI%<{P_c){6QO1 z%>+rFt?YWPLQB!-Dpbrlp!1FRUphy$<-<|j*7H9c{dN?82CxE$piGyZVvMRl#g~geL|N#N{=c>NcrwKeJAKW$JNj1U#$)-v)6x0_x;C# zC=M12cY4r&W5B!of3wvty#E8J^8Md8f!EIec5<;mPDTFfIH1uiLx4YW2$0i}1H1b@rr_C?Jj5mOIa`-Pm?t1^f(Jj7z|I=)Anx+4L3pgr%_>O^fr{@r| zdV0mH;;k%N*((Ox*jgbgxliPA(y#1eOqJD&f#c-l3r$~J-V)XU58{92_y1t7Z+!o) zTb}=Y8~BX(|9(alDPR9DqyJZa=Uy>jn+5|1 zIJw;Gdpu&3gm*T$fH#-k+wa~P2{6XadfT<1z7{D&Z%JFyq|#JLZaF>!&yb0f$h z@sk&k2XE${lK5relB2oflZ@M0#_b5${m|Ep5pR+6%JG{(<(L;NSyMTVGqtfHNE|0h zrp0l(p;;OtC+eC336oyNretvDt!xRyO63Rdft>JTOB+gxE*U2I^PiI*0TvnR$(=3S z@XCQcm^xRw#+`BaZ#i9Xje7mNlT85{fAi+~W;ug53pHLeE_3-mRxi&R>zo@G&0>>e zL)c{Pg_HGyolfVXP*9buo~)U+YHpVI-T2-MqBB1#wD7#hMc21=$zoCL6KMH)p{U8L z(q_@f@!dk(+nr9asJx}p$Xl$pwq5TOd&^Wu+e-TLLeWO2IEL2Nv5(gVA4_&Fe^&+B z^-Jf!=f`gN;7r_TAJ$|$?6m(EO|<{#jZUY2(d?l8@3cz$|0b|*|3A24gm%4Et&=li zI`hTMC32=Bqz{&zfcYo!b8wca4gs_N;5{xw>J+NLQ3w_<(uCnZYl3?x z_b=cf++2m0>&&TVvCwhMy!+4ze_sgtkkEBW6gejdPVctOIW7^*j%MdFgQ#W?JSp)^n_6mFO?JG-i zv~P!=g$m8Rb3XoAQzb%(tXh)M=LNh+&~ywH%nCRw?gYGcAS8%%&)h`>eTkmSW1ffcCQlA{FxQ3d z4L#^gKdTDmN|QMz=u&0s6mD(MHAw zwpl@1W-Hi=rvAlGpGx@Jun1<}c95m=)RobH8KuqK>41@9RhobWM?kyH#4z21Jo=BqdGDBiXv@jSbVP;PbG2 zSpsXGwKOjXf0Ax(kUczaqbguYvD7PMuhdyY~YvqQf6qp-vOw_2^@{*QX+ z{G#;#Zvmg-{|!`;FLnQ?aCcG00KelHfLfBhhX7v*A=14zBAby2?jg$Ii}acy z4`h{30~2EKmXt4#8;+9>1{Qx?k+SyDy-N9fx|!sd{C9wxpwjC*^L>Udik)vF!obkR zdgTXGV!g*J$|?ax`JN)1LrGjA4M~BX$RT9)hF9bqVys#QFI?woROz;oi6#dAw=qUc z!82MT-J$Ag!cwKz!Yd=5g~ItNAGu~?7wmnaEj?kl(ws zQ!k2jIlfYl=C1A>GUF(Ko)kV#sS6bOwr`2U6);mu}~ zRwoVx9lHxWcc5){=GAV&&r8{CE6Zc+k1p+a{8tb;CLO>>o-8(m`96~xK-VF$0 zfG`?}DT9c2`xod&GJ2XRTX)^Y0R;ijVORzz&;Di5`GJ3AbPw44KJ>l;ZNCK>6r${3 zg1&4>w-E9lQV3XbfFcdxPlh=%*uM}x1r{5yO0jH38`$(=GRTvxO4e|A-@}!ODkdpd zyje1@nruQLW~G=-ih$mM#S0_v%Zk*keQ?4WM7_1S8%1b&SQg#x+C9n)>D8Yi{C7li zEq%3Xg~4QP_C!GPt67YglW4|kI#)>_*Q9cs5EV}say4L=$i{Y`9QNC3Z*B)=ut zi>rXDR4hTa`wBlWH&|rLyS4W1dsvS-R2u;_-vY(ahzi=Ikv@lW0*x##q%2AW9-V*uhDlL2KCZg*>f|?b$Q#l+7Sv%N zX|fL3ZfzNbkmH1I?bq0TbOUcuQzX#bRV}hke@w}u3MgDt4Ftu}#4%7Hmr6zLLuif! ztTDCd-t(_&^oQ1v-DNkkVB*Y*Nu-13>5`#zQ}Wuv4QHs2rllDYtvqz27=!^$8fwgV z*yevw0uw^%qbJB1_slyJTiZQ4LPa`^brE5Z`=A12PzQ@DgOI8UC`XNqD8@i1b^ukN ziy>Q-`ute2x;`w9b9N|2AN9h(nNFN2W~<=S(Q+1hx%3oP+-eY;FR+-&CKJUbk3I5e zT%L=n8M=!c_NaoKKD)*v(3T&^(pXw=`W6Eed)Bd-2sgN% z`1rSz-=dc&cIO{qf=^xC=}hC^kKa}dbC@d|J#7{N%p{oO;X)ukNPiU~25K|))wDRs zM9{z?$m)Q(&{f)|R;xHZ1O!*QZ2X@(`Xlu zb7J=bdWC;T&Uda5BmP>Ve0sbo3pVqOjB_?WyGP*BPm=)QG;?RD!orZ3RofH{Fv1B} zLE%UG$YeYOMdA$`Od8A5M!F(dtU{P6;Dup=+F&j{k!=kn6(3imNQ=%d zlwa2IDF&-SMA;Pya5o)>07D94Cc9NJSl}^w5$}IgegqP(q@rx4pLEbao4!hxB{M^6 zhLt!ChU)VW2~ZZHCMo6qb~s3!o|s zR3C?Z%sS&(Rux&5fRiN*Q%dw>HdLd6b|lRJjYz6S4buEd3GQr4FDs*Vj!W9{NXQ?+aKJD6tJApY;Rk0m}hx9P6qsvZk<3 zw9Rq9FaOm21qr}B%JlpJB_CVTPc}aL*Tz=2QwR4v1{Y~SO0tcXT#SeCYgtgB5A-$gRiPcU*;N}wAuOjEsk)FkKh53ddQ zYp(xc?0_>93TQX7m`-DcGsbBX#%4~^WELP!AKrll;1wI@Nsbg$YlUFJKB%c=ny`PE zOF9Ep6!b&jb;vifX?&|0*F5x!Dzd^qONM5%KBP%am74g|Jv)qT*J(g=4c6UCVqOz$ zd%8xa7XFZnD=6ANve#bk1(1sjkf+X)&cD+}jrRaMVD&`!}`9}ON?IYUq;UI47{vVEhI|zRRSb@V( zF8>)J4tD_2?+pQIkMGHfY~4Ypfs6ccEE&8AT$9r_^=iG==$!te0`)XHmw;=n<1Rqo zItPj>>Bs?&0e#_S-1Tx_v?(^f88%68?4V1&_mid1HYm;toRbpUIHjKk`g~4li4EHH zGeWz$Fv< Date: Tue, 28 Jul 2020 15:51:00 +0200 Subject: [PATCH 04/15] Update API and fix omr-service script --- debian9-x86_64.sh | 2 +- omr-service | 18 ++++++++++-------- 2 files changed, 11 insertions(+), 9 deletions(-) diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index 0df040c..803ae86 100644 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -26,7 +26,7 @@ GLORYTUN_UDP_VERSION="3622f928caf03709c4031a34feec85c623bc5281" #MLVPN_VERSION="8f9720978b28c1954f9f229525333547283316d2" MLVPN_VERSION="f45cec350a6879b8b020143a78134a022b5df2a7" OBFS_VERSION="486bebd9208539058e57e23a12f23103016e09b4" -OMR_ADMIN_VERSION="af3b0d55aed7341c2e9e8f5012fc07300e48a8d0" +OMR_ADMIN_VERSION="c64b8e332407b0c8c413330c36409955d9249512" DSVPN_VERSION="3b99d2ef6c02b2ef68b5784bec8adfdd55b29b1a" #V2RAY_VERSION="v1.1.0" V2RAY_VERSION="v1.2.0-8-g59b8f4f" diff --git a/omr-service b/omr-service index ecb1568..ec37291 100755 --- a/omr-service +++ b/omr-service @@ -53,14 +53,16 @@ _lan_route() { _gre_tunnels() { . "$(readlink -f "/etc/shorewall/params.vpn")" for intf in /etc/openmptcprouter-vps-admin/intf/*; do - . "$(readlink -f "$intf")" - iface="$(basename $intf)" - if [ "$(ip tunnel show $iface 2>/dev/null | awk '{print $4}')" != "$OMR_ADDR" ]; then - ip tunnel del $iface 2>&1 >/dev/null - ip tunnel add $iface mode gre local $INTFADDR remote $OMR_ADDR - ip link set $iface up - ip addr add $LOCALIP dev $iface - ip route add $NETWORK dev $iface 2>&1 >/dev/null + if [ -f "$intf" ]; then + . "$(readlink -f "$intf")" + iface="$(basename $intf)" + if [ "$(ip tunnel show $iface 2>/dev/null | awk '{print $4}')" != "$OMR_ADDR" ]; then + ip tunnel del $iface 2>&1 >/dev/null + ip tunnel add $iface mode gre local $INTFADDR remote $OMR_ADDR + ip link set $iface up + ip addr add $LOCALIP dev $iface + ip route add $NETWORK dev $iface 2>&1 >/dev/null + fi fi done } From 53a50e015fa68fab7a5bc646a3466f8634c4c7a0 Mon Sep 17 00:00:00 2001 From: Ycarus Date: Tue, 28 Jul 2020 15:52:18 +0200 Subject: [PATCH 05/15] Allow to use file in same directory as script for installation --- debian9-x86_64.sh | 157 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 119 insertions(+), 38 deletions(-) diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index 803ae86..ea230cc 100644 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -18,6 +18,7 @@ OPENVPN=${OPENVPN:-yes} DSVPN=${DSVPN:-yes} SOURCES=${SOURCES:-yes} NOINTERNET=${NOINTERNET:-no} +LOCALFILES=${LOCALFILES:-no} INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | grep -m 1 -Po '(?<=dev )(\S+)' | tr -d "\n")} KERNEL_VERSION="5.4.52" KERNEL_PACKAGE_VERSION="1.10+206826e" @@ -37,6 +38,8 @@ VPSPATH="server-test" OMR_VERSION="0.1016-test" +DIR=$( pwd ) +#" set -e umask 0022 export LC_ALL=C @@ -172,8 +175,12 @@ fi # Check if mptcp kernel is grub default kernel echo "Set MPTCP kernel as grub default..." -wget -O /tmp/update-grub.sh https://www.openmptcprouter.com/${VPSPATH}/update-grub.sh -cd /tmp +if [ "$LOCALFILES" = "no" ]; then + wget -O /tmp/update-grub.sh https://www.openmptcprouter.com/${VPSPATH}/update-grub.sh + cd /tmp +else + cd ${DIR} +fi bash update-grub.sh ${KERNEL_VERSION}-mptcp bash update-grub.sh ${KERNEL_RELEASE} @@ -396,7 +403,11 @@ if [ "$OMR_ADMIN" = "yes" ]; then fi # Get shadowsocks optimization -wget -O /etc/sysctl.d/90-shadowsocks.conf https://www.openmptcprouter.com/${VPSPATH}/shadowsocks.conf +if [ "$LOCALFILES" = "no" ]; then + wget -O /etc/sysctl.d/90-shadowsocks.conf https://www.openmptcprouter.com/${VPSPATH}/shadowsocks.conf +else + cp ${DIR}/shadowsocks.conf /etc/sysctl.d/90-shadowsocks.conf +fi if [ "$update" != 0 ]; then if [ ! -f /etc/shadowsocks-libev/manager.json ]; then @@ -407,8 +418,11 @@ if [ "$update" != 0 ]; then fi # Install shadowsocks config and add a shadowsocks by CPU if [ "$update" = "0" ] || [ ! -f /etc/shadowsocks-libev/manager.json ]; then - #wget -O /etc/shadowsocks-libev/config.json https://www.openmptcprouter.com/${VPSPATH}/config.json - wget -O /etc/shadowsocks-libev/manager.json https://www.openmptcprouter.com/${VPSPATH}/manager.json + if [ "$LOCALFILES" = "no" ]; then + wget -O /etc/shadowsocks-libev/manager.json https://www.openmptcprouter.com/${VPSPATH}/manager.json + else + cp ${DIR}/manager.json /etc/shadowsocks-libev/manager.json + fi SHADOWSOCKS_PASS_JSON=$(echo $SHADOWSOCKS_PASS | sed 's/+/-/g; s/\//_/g;') if [ "$NBCPU" -gt "1" ]; then for i in $(seq 2 NBCPU); do @@ -427,7 +441,11 @@ fi [ ! -f /etc/shadowsocks-libev/local.acl ] && touch /etc/shadowsocks-libev/local.acl #sed -i 's:aes-256-cfb:chacha20:g' /etc/shadowsocks-libev/config.json #sed -i 's:json:json --no-delay:g' /lib/systemd/system/shadowsocks-libev-server@.service -wget -O /lib/systemd/system/shadowsocks-libev-manager@.service https://www.openmptcprouter.com/${VPSPATH}/shadowsocks-libev-manager@.service.in +if [ "$LOCALFILES" = "no" ]; then + wget -O /lib/systemd/system/shadowsocks-libev-manager@.service https://www.openmptcprouter.com/${VPSPATH}/shadowsocks-libev-manager@.service.in +else + cp ${DIR}/shadowsocks-libev-manager@.service.in /lib/systemd/system/shadowsocks-libev-manager@.service +fi if systemctl -q is-enabled shadowsocks-libev; then systemctl -q disable shadowsocks-libev fi @@ -534,11 +552,20 @@ if [ "$MLVPN" = "yes" ]; then else apt-get -y -o Dpkg::Options::="--force-overwrite" install mlvpn fi - wget -O /lib/systemd/network/mlvpn.network https://www.openmptcprouter.com/${VPSPATH}/mlvpn.network - wget -O /lib/systemd/system/mlvpn@.service https://www.openmptcprouter.com/${VPSPATH}/mlvpn@.service.in + if [ "$LOCALFILES" = "no" ]; then + wget -O /lib/systemd/network/mlvpn.network https://www.openmptcprouter.com/${VPSPATH}/mlvpn.network + wget -O /lib/systemd/system/mlvpn@.service https://www.openmptcprouter.com/${VPSPATH}/mlvpn@.service.in + else + cp ${DIR}/mlvpn.network /lib/systemd/network/mlvpn.network + cp ${DIR}/mlvpn@.service.in /lib/systemd/system/mlvpn@.service + fi mkdir -p /etc/mlvpn if [ "$mlvpnupdate" = "0" ]; then - wget -O /etc/mlvpn/mlvpn0.conf https://www.openmptcprouter.com/${VPSPATH}/mlvpn0.conf + if [ "$LOCALFILES" = "no" ]; then + wget -O /etc/mlvpn/mlvpn0.conf https://www.openmptcprouter.com/${VPSPATH}/mlvpn0.conf + else + cp ${DIR}/mlvpn0.conf /etc/mlvpn/mlvpn0.conf + fi sed -i "s:MLVPN_PASS:$MLVPN_PASS:" /etc/mlvpn/mlvpn0.conf fi chmod 0600 /etc/mlvpn/mlvpn0.conf @@ -623,8 +650,13 @@ if [ "$OPENVPN" = "yes" ]; then if [ ! -f "/etc/openvpn/server/dh2048.pem" ]; then openssl dhparam -out /etc/openvpn/server/dh2048.pem 2048 fi - wget -O /etc/openvpn/tun0.conf https://www.openmptcprouter.com/${VPSPATH}/openvpn-tun0.conf - wget -O /etc/openvpn/tun1.conf https://www.openmptcprouter.com/${VPSPATH}/openvpn-tun1.conf + if [ "$LOCALFILES" = "no" ]; then + wget -O /etc/openvpn/tun0.conf https://www.openmptcprouter.com/${VPSPATH}/openvpn-tun0.conf + wget -O /etc/openvpn/tun1.conf https://www.openmptcprouter.com/${VPSPATH}/openvpn-tun1.conf + else + cp ${DIR}/openvpn-tun0.conf /etc/openvpn/tun0.conf + cp ${DIR}/openvpn-tun1.conf /etc/openvpn/tun1.conf + fi mkdir -p /etc/openvpn/ccd systemctl enable openvpn@tun0.service systemctl enable openvpn@tun1.service @@ -650,15 +682,28 @@ if [ "$SOURCES" = "yes" ]; then sed -i 's:EmitDNS=yes:EmitDNS=no:g' /lib/systemd/network/glorytun.network rm /lib/systemd/system/glorytun* rm /lib/systemd/network/glorytun* - wget -O /usr/local/bin/glorytun-udp-run https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp-run + if [ "$LOCALFILES" = "no" ]; then + wget -O /usr/local/bin/glorytun-udp-run https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp-run + else + cp ${DIR}/glorytun-udp-run /usr/local/bin/glorytun-udp-run + fi chmod 755 /usr/local/bin/glorytun-udp-run - wget -O /lib/systemd/system/glorytun-udp@.service https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp%40.service.in + if [ "$LOCALFILES" = "no" ]; then + wget -O /lib/systemd/system/glorytun-udp@.service https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp%40.service.in + else + cp ${DIR}/glorytun-udp@.service.in /lib/systemd/system/glorytun-udp@.service + fi #wget -O /lib/systemd/network/glorytun-udp.network https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp.network rm -f /lib/systemd/network/glorytun-udp.network mkdir -p /etc/glorytun-udp - wget -O /etc/glorytun-udp/post.sh https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp-post.sh + if [ "$LOCALFILES" = "no" ]; then + wget -O /etc/glorytun-udp/post.sh https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp-post.sh + wget -O /etc/glorytun-udp/tun0 https://www.openmptcprouter.com/${VPSPATH}/tun0.glorytun-udp + else + cp ${DIR}/glorytun-udp-post.sh /etc/glorytun-udp/post.sh + cp ${DIR}/tun0.glorytun-udp /etc/glorytun-udp/tun0 + fi chmod 755 /etc/glorytun-udp/post.sh - wget -O /etc/glorytun-udp/tun0 https://www.openmptcprouter.com/${VPSPATH}/tun0.glorytun-udp if [ "$update" = "0" ] || [ ! -f /etc/glorytun-udp/tun0.key ]; then echo "$GLORYTUN_PASS" > /etc/glorytun-udp/tun0.key elif [ ! -f /etc/glorytun-udp/tun0.key ] && [ -f /etc/glorytun-tcp/tun0.key ]; then @@ -698,7 +743,6 @@ if [ "$DSVPN" = "yes" ]; then make CFLAGS='-DNO_DEFAULT_ROUTES -DNO_DEFAULT_FIREWALL' make install rm -f /lib/systemd/system/dsvpn/* - #wget -O /lib/systemd/system/dsvpn-server.service https://www.openmptcprouter.com/${VPSPATH}/dsvpn-server.service.in wget -O /usr/local/bin/dsvpn-run https://www.openmptcprouter.com/${VPSPATH}/dsvpn-run chmod 755 /usr/local/bin/dsvpn-run wget -O /lib/systemd/system/dsvpn-server@.service https://www.openmptcprouter.com/${VPSPATH}/dsvpn-server%40.service.in @@ -773,16 +817,27 @@ if ! grep -q tun /etc/modules ; then fi # Add multipath utility -wget -O /usr/local/bin/multipath https://www.openmptcprouter.com/${VPSPATH}/multipath +if [ "$LOCALFILES" = "no" ]; then + wget -O /usr/local/bin/multipath https://www.openmptcprouter.com/${VPSPATH}/multipath +else + cp ${DIR}/multipath /usr/local/bin/multipath +fi chmod 755 /usr/local/bin/multipath # Add OpenMPTCProuter service -wget -O /usr/local/bin/omr-service https://www.openmptcprouter.com/${VPSPATH}/omr-service +if [ "$LOCALFILES" = "no" ]; then + wget -O /usr/local/bin/omr-service https://www.openmptcprouter.com/${VPSPATH}/omr-service + wget -O /lib/systemd/system/omr.service https://www.openmptcprouter.com/${VPSPATH}/omr.service.in + wget -O /usr/local/bin/omr-6in4-run https://www.openmptcprouter.com/${VPSPATH}/omr-6in4-run + wget -O /lib/systemd/system/omr6in4@.service https://www.openmptcprouter.com/${VPSPATH}/omr6in4%40.service.in +else + cp ${DIR}/omr-service /usr/local/bin/omr-service + cp ${DIR}/omr.service.in /lib/systemd/system/omr.service + cp ${DIR}/omr-6in4-run /usr/local/bin/omr-6in4-run + cp ${DIR}/omr6in4@.service.in /lib/systemd/system/omr6in4@.service +fi chmod 755 /usr/local/bin/omr-service -wget -O /lib/systemd/system/omr.service https://www.openmptcprouter.com/${VPSPATH}/omr.service.in -wget -O /usr/local/bin/omr-6in4-run https://www.openmptcprouter.com/${VPSPATH}/omr-6in4-run chmod 755 /usr/local/bin/omr-6in4-run -wget -O /lib/systemd/system/omr6in4@.service https://www.openmptcprouter.com/${VPSPATH}/omr6in4%40.service.in if systemctl -q is-active omr-6in4.service; then systemctl -q stop omr-6in4 > /dev/null 2>&1 systemctl -q disable omr-6in4 > /dev/null 2>&1 @@ -803,36 +858,62 @@ sed -i 's:Port 22:Port 65222:g' /etc/ssh/sshd_config if [ "$update" = "0" ]; then # Install and configure the firewall using shorewall apt-get -y install shorewall shorewall6 - wget -O /etc/shorewall/openmptcprouter-shorewall.tar.gz https://www.openmptcprouter.com/${VPSPATH}/openmptcprouter-shorewall.tar.gz + if [ "$LOCALFILES" = "no" ]; then + wget -O /etc/shorewall/openmptcprouter-shorewall.tar.gz https://www.openmptcprouter.com/${VPSPATH}/openmptcprouter-shorewall.tar.gz + else + cp ${DIR}/openmptcprouter-shorewall.tar.gz /etc/shorewall/openmptcprouter-shorewall.tar.gz + fi tar xzf /etc/shorewall/openmptcprouter-shorewall.tar.gz -C /etc/shorewall rm /etc/shorewall/openmptcprouter-shorewall.tar.gz sed -i "s:eth0:$INTERFACE:g" /etc/shorewall/* systemctl enable shorewall - wget -O /etc/shorewall6/openmptcprouter-shorewall6.tar.gz https://www.openmptcprouter.com/${VPSPATH}/openmptcprouter-shorewall6.tar.gz + if [ "$LOCALFILES" = "no" ]; then + wget -O /etc/shorewall6/openmptcprouter-shorewall6.tar.gz https://www.openmptcprouter.com/${VPSPATH}/openmptcprouter-shorewall6.tar.gz + else + cp ${DIR}/openmptcprouter-shorewall6.tar.gz /etc/shorewall6/openmptcprouter-shorewall6.tar.gz + fi tar xzf /etc/shorewall6/openmptcprouter-shorewall6.tar.gz -C /etc/shorewall6 rm /etc/shorewall6/openmptcprouter-shorewall6.tar.gz sed -i "s:eth0:$INTERFACE:g" /etc/shorewall6/* systemctl enable shorewall6 else # Update only needed firewall files - wget -O /etc/shorewall/interfaces https://www.openmptcprouter.com/${VPSPATH}/shorewall4/interfaces - wget -O /etc/shorewall/snat https://www.openmptcprouter.com/${VPSPATH}/shorewall4/snat - wget -O /etc/shorewall/stoppedrules https://www.openmptcprouter.com/${VPSPATH}/shorewall4/stoppedrules - wget -O /etc/shorewall/tcinterfaces https://www.openmptcprouter.com/${VPSPATH}/shorewall4/tcinterfaces - wget -O /etc/shorewall/shorewall.conf https://www.openmptcprouter.com/${VPSPATH}/shorewall4/shorewall.conf - wget -O /etc/shorewall/policy https://www.openmptcprouter.com/${VPSPATH}/shorewall4/policy - wget -O /etc/shorewall/params https://www.openmptcprouter.com/${VPSPATH}/shorewall4/params - wget -O /etc/shorewall/params.vpn https://www.openmptcprouter.com/${VPSPATH}/shorewall4/params.vpn - wget -O /etc/shorewall/params.net https://www.openmptcprouter.com/${VPSPATH}/shorewall4/params.net + if [ "$LOCALFILES" = "no" ]; then + wget -O /etc/shorewall/interfaces https://www.openmptcprouter.com/${VPSPATH}/shorewall4/interfaces + wget -O /etc/shorewall/snat https://www.openmptcprouter.com/${VPSPATH}/shorewall4/snat + wget -O /etc/shorewall/stoppedrules https://www.openmptcprouter.com/${VPSPATH}/shorewall4/stoppedrules + wget -O /etc/shorewall/tcinterfaces https://www.openmptcprouter.com/${VPSPATH}/shorewall4/tcinterfaces + wget -O /etc/shorewall/shorewall.conf https://www.openmptcprouter.com/${VPSPATH}/shorewall4/shorewall.conf + wget -O /etc/shorewall/policy https://www.openmptcprouter.com/${VPSPATH}/shorewall4/policy + wget -O /etc/shorewall/params https://www.openmptcprouter.com/${VPSPATH}/shorewall4/params + wget -O /etc/shorewall/params.vpn https://www.openmptcprouter.com/${VPSPATH}/shorewall4/params.vpn + wget -O /etc/shorewall/params.net https://www.openmptcprouter.com/${VPSPATH}/shorewall4/params.net + wget -O /etc/shorewall6/params https://www.openmptcprouter.com/${VPSPATH}/shorewall6/params + wget -O /etc/shorewall6/params.net https://www.openmptcprouter.com/${VPSPATH}/shorewall6/params.net + wget -O /etc/shorewall6/params.vpn https://www.openmptcprouter.com/${VPSPATH}/shorewall6/params.vpn + wget -O /etc/shorewall6/interfaces https://www.openmptcprouter.com/${VPSPATH}/shorewall6/interfaces + wget -O /etc/shorewall6/stoppedrules https://www.openmptcprouter.com/${VPSPATH}/shorewall6/stoppedrules + wget -O /etc/shorewall6/snat https://www.openmptcprouter.com/${VPSPATH}/shorewall6/snat + else + cp ${DIR}/shorewall4/interfaces /etc/shorewall/interfaces + cp ${DIR}/shorewall4/snat /etc/shorewall/snat + cp ${DIR}/shorewall4/stoppedrules /etc/shorewall/stoppedrules + cp ${DIR}/shorewall4/tcinterfaces /etc/shorewall/tcinterfaces + cp ${DIR}/shorewall4/shorewall.conf /etc/shorewall/shorewall.conf + cp ${DIR}/shorewall4/policy /etc/shorewall/policy + cp ${DIR}/shorewall4/params /etc/shorewall/params + cp ${DIR}/shorewall4/params.vpn /etc/shorewall/params.vpn + cp ${DIR}/shorewall4/params.net /etc/shorewall/params.net + cp ${DIR}/shorewall6/params /etc/shorewall6/params + cp ${DIR}/shorewall6/params.net /etc/shorewall6/params.net + cp ${DIR}/shorewall6/params.vpn /etc/shorewall6/params.vpn + cp ${DIR}/shorewall6/interfaces /etc/shorewall6/interfaces + cp ${DIR}/shorewall6/stoppedrules /etc/shorewall6/stoppedrules + cp ${DIR}/shorewall6/snat /etc/shorewall6/snat + fi sed -i "s:eth0:$INTERFACE:g" /etc/shorewall/* sed -i 's/^.*#DNAT/#DNAT/g' /etc/shorewall/rules sed -i 's:10.0.0.2:$OMR_ADDR:g' /etc/shorewall/rules - wget -O /etc/shorewall6/params https://www.openmptcprouter.com/${VPSPATH}/shorewall6/params - wget -O /etc/shorewall6/params.net https://www.openmptcprouter.com/${VPSPATH}/shorewall6/params.net - wget -O /etc/shorewall6/params.vpn https://www.openmptcprouter.com/${VPSPATH}/shorewall6/params.vpn - wget -O /etc/shorewall6/interfaces https://www.openmptcprouter.com/${VPSPATH}/shorewall6/interfaces - wget -O /etc/shorewall6/stoppedrules https://www.openmptcprouter.com/${VPSPATH}/shorewall6/stoppedrules - wget -O /etc/shorewall6/snat https://www.openmptcprouter.com/${VPSPATH}/shorewall6/snat sed -i "s:eth0:$INTERFACE:g" /etc/shorewall6/* fi if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "10" ]; then From 4c2e6cdf0d33ddbdf11e9402e085c59bf0e6d049 Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Mon, 10 Aug 2020 14:41:23 +0200 Subject: [PATCH 06/15] Add v2ray support and add some color in terminal --- debian9-x86_64.sh | 72 ++++++++++++++++++++++++++++++++++++----------- 1 file changed, 55 insertions(+), 17 deletions(-) diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index ea230cc..21f7afc 100644 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -1,11 +1,20 @@ #!/bin/sh +# +# Copyright (C) 2018-2020 Ycarus (Yannick Chabanois) for OpenMPTCProuter +# +# This is free software, licensed under the GNU General Public License v3 or later. +# See /LICENSE for more information. +# + SHADOWSOCKS_PASS=${SHADOWSOCKS_PASS:-$(head -c 32 /dev/urandom | base64 -w0)} GLORYTUN_PASS=${GLORYTUN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lower:]' '[:upper:]' | tr -d " \n")} DSVPN_PASS=${DSVPN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lower:]' '[:upper:]' | tr -d " \n")} #NBCPU=${NBCPU:-$(nproc --all | tr -d "\n")} NBCPU=${NBCPU:-$(grep -c '^processor' /proc/cpuinfo | tr -d "\n")} OBFS=${OBFS:-yes} -V2RAY=${V2RAY:-yes} +V2RAY_PLUGIN=${V2RAY_PLUGIN:-yes} +V2RAY=${V2RAY:-no} +V2RAY_UUID=${V2RAY_UUID:-$(cat /proc/sys/kernel/random/uuid | tr -d "\n")} UPDATE_OS=${UPDATE_OS:-yes} UPDATE=${UPDATE:-yes} TLS=${TLS:-yes} @@ -18,10 +27,11 @@ OPENVPN=${OPENVPN:-yes} DSVPN=${DSVPN:-yes} SOURCES=${SOURCES:-yes} NOINTERNET=${NOINTERNET:-no} +SPEEDTEST=${SPEEDTEST:-no} LOCALFILES=${LOCALFILES:-no} INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | grep -m 1 -Po '(?<=dev )(\S+)' | tr -d "\n")} KERNEL_VERSION="5.4.52" -KERNEL_PACKAGE_VERSION="1.10+206826e" +KERNEL_PACKAGE_VERSION="1.11+206826e" KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_${KERNEL_PACKAGE_VERSION}" GLORYTUN_UDP_VERSION="3622f928caf03709c4031a34feec85c623bc5281" #MLVPN_VERSION="8f9720978b28c1954f9f229525333547283316d2" @@ -30,7 +40,7 @@ OBFS_VERSION="486bebd9208539058e57e23a12f23103016e09b4" OMR_ADMIN_VERSION="c64b8e332407b0c8c413330c36409955d9249512" DSVPN_VERSION="3b99d2ef6c02b2ef68b5784bec8adfdd55b29b1a" #V2RAY_VERSION="v1.1.0" -V2RAY_VERSION="v1.2.0-8-g59b8f4f" +V2RAY_PLUGIN_VERSION="v1.2.0-8-g59b8f4f" EASYRSA_VERSION="3.0.6" SHADOWSOCKS_VERSION="38871da8baf5cfa400983dcdf918397e48655203" VPS_DOMAIN=${VPS_DOMAIN:-$(wget -4 -qO- -T 2 http://hostname.openmptcprouter.com)} @@ -168,7 +178,7 @@ rename 's/^bzImage/vmlinuz/s' * >/dev/null 2>&1 #dpkg --remove --force-remove-reinstreq linux-headers-${KERNEL_VERSION}-mptcp if [ "$(dpkg -l | grep linux-image-${KERNEL_VERSION} | grep ${KERNEL_PACKAGE_VERSION})" = "" ]; then echo "Install kernel linux-image-${KERNEL_RELEASE}" - echo "if kernel install fail run: dpkg --remove --force-remove-reinstreq linux-image-${KERNEL_VERSION}-mptcp" + echo "\033[1m !!! if kernel install fail run: dpkg --remove --force-remove-reinstreq linux-image-${KERNEL_VERSION}-mptcp !!! \033[0m" dpkg --force-all -i -B /tmp/linux-image-${KERNEL_RELEASE}_amd64.deb dpkg --force-all -i -B /tmp/linux-headers-${KERNEL_RELEASE}_amd64.deb fi @@ -356,7 +366,7 @@ if [ "$OMR_ADMIN" = "yes" ]; then else apt-get -y install python3-passlib python3-jwt python3-netaddr libuv1 python3-uvloop fi - apt-get -y install python3-uvicorn jq ipcalc python3-netifaces + apt-get -y install python3-uvicorn jq ipcalc python3-netifaces python3-aiofiles echo '-- pip3 install needed python modules' #pip3 install pyjwt passlib uvicorn fastapi netjsonconfig python-multipart netaddr #pip3 -q install fastapi netjsonconfig python-multipart uvicorn -U @@ -490,17 +500,17 @@ if [ "$OBFS" = "yes" ]; then fi # Install v2ray-plugin -if [ "$V2RAY" = "yes" ]; then +if [ "$V2RAY_PLUGIN" = "yes" ]; then echo "Install v2ray plugin" - rm -rf /tmp/v2ray-plugin-linux-amd64-${V2RAY_VERSION}.tar.gz - #wget -O /tmp/v2ray-plugin-linux-amd64-${V2RAY_VERSION}.tar.gz https://github.com/shadowsocks/v2ray-plugin/releases/download/${V2RAY_VERSION}/v2ray-plugin-linux-amd64-${V2RAY_VERSION}.tar.gz - wget -O /tmp/v2ray-plugin-linux-amd64-${V2RAY_VERSION}.tar.gz https://www.openmptcprouter.com/${VPSPATH}/bin/v2ray-plugin-linux-amd64-${V2RAY_VERSION}.tar.gz + rm -rf /tmp/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz + #wget -O /tmp/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz https://github.com/shadowsocks/v2ray-plugin/releases/download/${V2RAY_PLUGIN_VERSION}/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz + wget -O /tmp/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz https://www.openmptcprouter.com/${VPSPATH}/bin/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz cd /tmp - tar xzvf v2ray-plugin-linux-amd64-${V2RAY_VERSION}.tar.gz + tar xzvf v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz cp v2ray-plugin_linux_amd64 /usr/local/bin/v2ray-plugin cd /tmp rm -rf /tmp/v2ray-plugin_linux_amd64 - rm -rf /tmp/v2ray-plugin-linux-amd64-${V2RAY_VERSION}.tar.gz + rm -rf /tmp/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz #rm -rf /tmp/v2ray-plugin #cd /tmp @@ -508,7 +518,7 @@ if [ "$V2RAY" = "yes" ]; then #apt-get install -y --no-install-recommends git ca-certificates golang-go #git clone https://github.com/shadowsocks/v2ray-plugin.git /tmp/v2ray-plugin #cd /tmp/v2ray-plugin - #git checkout ${V2RAY_VERSION} + #git checkout ${V2RAY_PLUGIN_VERSION} #git submodule update --init --recursive #CGO_ENABLED=0 go build -o v2ray-plugin #cp v2ray-plugin /usr/local/bin/v2ray-plugin @@ -516,10 +526,26 @@ if [ "$V2RAY" = "yes" ]; then #rm -rf /tmp/simple-obfs fi -if [ "$OBFS" = "no" ] && [ "$V2RAYPLUGIN" = "no" ]; then +if [ "$OBFS" = "no" ] && [ "$V2RAY_PLUGIN" = "no" ]; then sed -i -e '/plugin/d' -e 's/,,//' /etc/shadowsocks-libev/config.json fi +if systemctl -q is-active v2ray.service; then + systemctl -q stop v2ray > /dev/null 2>&1 + systemctl -q disable v2ray > /dev/null 2>&1 +fi + +if [ "$V2RAY" = "yes" ]; then + apt-get -y -o Dpkg::Options::="--force-overwrite" install v2ray + if [ ! -f /etc/v2ray/v2ray-server.json ]; then + wget -O /etc/v2ray/v2ray-server.json https://www.openmptcprouter.com/${VPSPATH}/v2ray-server.json + sed -i "s:V2RAY_UUID:$V2RAY_UUID:g" /etc/v2ray/v2ray-server.json + rm /etc/v2ray/config.json + ln -s /etc/v2ray/v2ray-server.json /etc/v2ray/config.json + fi + systemctl enable v2ray.service +fi + if systemctl -q is-active mlvpn@mlvpn0.service; then systemctl -q stop mlvpn@mlvpn0 > /dev/null 2>&1 systemctl -q disable mlvpn@mlvpn0 > /dev/null 2>&1 @@ -951,7 +977,14 @@ if [ "$TLS" = "yes" ]; then fi fi - +if [ "$SPEEDTEST" = "yes" ]; then + if [ ! -f /usr/share/omr-server/speedtest/test.img ]; then + echo "Generate speedtest image..." + mkdir -p /usr/share/omr-server/speedtest + dd if=/dev/urandom of=/usr/share/omr-server/speedtest/test.img count=1024 bs=1048576 + echo "Done" + fi +fi # Add OpenMPTCProuter VPS script version to /etc/motd if [ -f /etc/motd.head ]; then @@ -976,7 +1009,7 @@ if [ "$update" = "0" ]; then # Display important info echo '====================================================================================' echo "OpenMPTCProuter Server $OMR_VERSION is now installed !" - echo 'SSH port: 65222 (instead of port 22)' + echo '\033[4m\0331mSSH port: 65222 (instead of port 22)\033[0m' if [ "$OMR_ADMIN" = "yes" ]; then echo '====================================================================================' echo '!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!' @@ -1009,7 +1042,7 @@ if [ "$update" = "0" ]; then echo "OpenMPTCProuter API Admin key (only for configuration via API, you don't need it): " echo $OMR_ADMIN_PASS_ADMIN echo 'OpenMPTCProuter Server key: ' - echo $OMR_ADMIN_PASS + echo "\033[1m${OMR_ADMIN_PASS}\033[0m" echo 'OpenMPTCProuter Server username: ' echo 'openmptcprouter' fi @@ -1020,7 +1053,7 @@ if [ "$update" = "0" ]; then echo '====================================================================================' echo 'Keys are also saved in /root/openmptcprouter_config.txt, you are free to remove them' echo '====================================================================================' - echo ' /!\ You need to reboot to enable MPTCP, shadowsocks, glorytun and shorewall /!\' + echo '\033[1m /!\ You need to reboot to enable MPTCP, shadowsocks, glorytun and shorewall /!\ \033[0m' echo '------------------------------------------------------------------------------------' echo ' After reboot, check with uname -a that the kernel name contain mptcp.' echo ' Else, you may have to modify GRUB_DEFAULT in /etc/default/grub' @@ -1072,6 +1105,11 @@ else systemctl -q restart mlvpn@mlvpn0 echo 'done' fi + if [ "$V2RAY" = "yes" ]; then + echo 'Restarting v2ray...' + systemctl -q restart v2ray + echo 'done' + fi if [ "$DSVPN" = "yes" ]; then echo 'Restarting dsvpn...' systemctl -q start dsvpn-server@dsvpn0 || true From b2cddfca388ca493aa8d7f60d6d1a4fa905756d7 Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Mon, 10 Aug 2020 17:12:38 +0000 Subject: [PATCH 07/15] Fix path --- debian9-x86_64.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index 21f7afc..20347ce 100644 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -44,9 +44,9 @@ V2RAY_PLUGIN_VERSION="v1.2.0-8-g59b8f4f" EASYRSA_VERSION="3.0.6" SHADOWSOCKS_VERSION="38871da8baf5cfa400983dcdf918397e48655203" VPS_DOMAIN=${VPS_DOMAIN:-$(wget -4 -qO- -T 2 http://hostname.openmptcprouter.com)} -VPSPATH="server-test" +VPSPATH="server" -OMR_VERSION="0.1016-test" +OMR_VERSION="0.1017" DIR=$( pwd ) #" From fd1106901279f1592ae588ede77d8cc6ec932699 Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Fri, 14 Aug 2020 08:18:13 +0000 Subject: [PATCH 08/15] Check if user is root, fix error in omr-service --- debian9-x86_64.sh | 4 +++- omr-service | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index 20347ce..46b6755 100644 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -56,6 +56,8 @@ export LC_ALL=C export PATH=$PATH:/sbin export DEBIAN_FRONTEND=noninteractive +if [ "$(id -u)" -ne 0 ]; then echo 'Please run as root.' >&2; exit 1; fi + # Check Linux version if test -f /etc/os-release ; then . /etc/os-release @@ -132,7 +134,7 @@ if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "9" ] && [ "$UPDATE_OS" = "yes" ]; VERSION_ID="10" fi if [ "$ID" = "ubuntu" ] && [ "$VERSION_ID" = "18.04" ] && [ "$UPDATE_OS" = "yes" ]; then - echo "Update Ubutnu 18.04 to Ubuntu 20.04" + echo "Update Ubuntu 18.04 to Ubuntu 20.04" apt-get -y -f --force-yes upgrade apt-get -y -f --force-yes dist-upgrade sed -i 's:bionic:focal:g' /etc/apt/sources.list diff --git a/omr-service b/omr-service index ec37291..fd8d77d 100755 --- a/omr-service +++ b/omr-service @@ -40,7 +40,7 @@ _lan_route() { cat /etc/openmptcprouter-vps-admin/omr-admin-config.json | jq -c '.users[0][]' | while IFS=$"\n" read -r c; do vpnremoteip=$(echo "$c" | jq -r '.vpnremoteip') - if [ -n "$vpnremoteip" ]; then + if [ -n "$vpnremoteip" ] && [ "$vpnremoteip" != "null" ]; then echo "$c" | jq -c '.lanips //empty' | while IFS=$"\n" read -r d; do network=$(ipcalc -n $d | grep Network | awk '{print $2}') From da1a6c35607e359c2a284425cc9807230c1fcafe Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Thu, 20 Aug 2020 13:35:49 +0000 Subject: [PATCH 09/15] Run dsvpn and mlvpn after network online --- dsvpn-server.service.in | 1 + dsvpn-server@.service.in | 1 + mlvpn@.service.in | 1 + 3 files changed, 3 insertions(+) diff --git a/dsvpn-server.service.in b/dsvpn-server.service.in index 24dfe90..765f46a 100644 --- a/dsvpn-server.service.in +++ b/dsvpn-server.service.in @@ -1,5 +1,6 @@ [Unit] Description=Dead Simple VPN - Server +After=network.target network-online.target [Service] ExecStart=/usr/local/sbin/dsvpn server /etc/dsvpn/dsvpn.key auto 65011 dsvpn0 10.255.251.1 10.255.251.2 diff --git a/dsvpn-server@.service.in b/dsvpn-server@.service.in index 25cc20e..2365398 100644 --- a/dsvpn-server@.service.in +++ b/dsvpn-server@.service.in @@ -1,5 +1,6 @@ [Unit] Description=Dead Simple VPN - Server on %I +After=network.target network-online.target [Service] ExecStart=/usr/local/bin/dsvpn-run /etc/dsvpn/%i diff --git a/mlvpn@.service.in b/mlvpn@.service.in index bda7c50..263a63b 100644 --- a/mlvpn@.service.in +++ b/mlvpn@.service.in @@ -2,6 +2,7 @@ Description=MLVPN connection to %i PartOf=mlvpn.service ReloadPropagatedFrom=mlvpn.service +After=network.target network-online.target [Service] Type=notify From df3f4ccaff196f7954ed4a63b800ed915b281f65 Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Thu, 20 Aug 2020 13:42:40 +0000 Subject: [PATCH 10/15] Add v2ray support --- debian9-x86_64.sh | 6 +-- v2ray-server.json | 124 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 127 insertions(+), 3 deletions(-) create mode 100644 v2ray-server.json diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index 46b6755..11851f2 100644 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -13,7 +13,7 @@ DSVPN_PASS=${DSVPN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lower:]' '[ NBCPU=${NBCPU:-$(grep -c '^processor' /proc/cpuinfo | tr -d "\n")} OBFS=${OBFS:-yes} V2RAY_PLUGIN=${V2RAY_PLUGIN:-yes} -V2RAY=${V2RAY:-no} +V2RAY=${V2RAY:-yes} V2RAY_UUID=${V2RAY_UUID:-$(cat /proc/sys/kernel/random/uuid | tr -d "\n")} UPDATE_OS=${UPDATE_OS:-yes} UPDATE=${UPDATE:-yes} @@ -44,9 +44,9 @@ V2RAY_PLUGIN_VERSION="v1.2.0-8-g59b8f4f" EASYRSA_VERSION="3.0.6" SHADOWSOCKS_VERSION="38871da8baf5cfa400983dcdf918397e48655203" VPS_DOMAIN=${VPS_DOMAIN:-$(wget -4 -qO- -T 2 http://hostname.openmptcprouter.com)} -VPSPATH="server" +VPSPATH="server-test" -OMR_VERSION="0.1017" +OMR_VERSION="0.1018-test" DIR=$( pwd ) #" diff --git a/v2ray-server.json b/v2ray-server.json new file mode 100644 index 0000000..326474a --- /dev/null +++ b/v2ray-server.json @@ -0,0 +1,124 @@ +{ + "log": { + "loglevel": "debug", + "error": "/tmp/v2rayError.log" + }, + "transport": { + "tcpSettings": {}, + "wsSettings": {}, + "kcpSettings": { + "mtu": 1460, + "tti": 10, + "uplinkCapacity": 100, + "downlinkCapacity": 100, + "congestion": false, + "readBufferSize": 8, + "writeBufferSize": 8 + } + }, + "inbounds": [ + { + "tag": "Vmess-In1", + "port": 65228, + "protocol": "vless", + "settings": { + "disableInsecureEncryption": false, + "clients": [ + { + "id": "V2RAY_UUID", + "level": 0, + "alterId": 0, + "email": "openmptcprouter" + } + ] + }, + "streamSettings": { + "sockopt": { + "mark": 0 + }, + "network": "tcp", + "security": "tls", + "tlsSettings": { + "certificates": [ + { + "certificateFile": "/etc/openvpn/ca/pki/issued/server.crt", + "keyFile": "/etc/openvpn/ca/pki/private/server.key" + } + ] + } + } + }, + { + "listen": "127.0.0.1", + "port": 10085, + "protocol": "dokodemo-door", + "settings": { + "address": "127.0.0.1" + }, + "tag": "api" + } + ], + "outbounds": [ + { + "protocol": "freedom", + "settings": { + "userLevel": 0 + }, + "tag": "direct" + } + ], + "routing": { + "rules": [ + { + "type": "field", + "inboundTag": [ + "Vmess-In1" + ], + "outboundTag": "WH-Lan1", + "domain": [ + "full:WH-Lan1" + ] + }, + { + "inboundTag": [ + "api" + ], + "outboundTag": "api", + "type": "field" + } + ] + }, + "reverse": { + "portals": [ + { + "tag": "WH-Lan1", + "domain": "WH-Lan1" + } + ] + }, + "stats": {}, + "api": { + "tag": "api", + "services": [ + "HandlserService", + "LoggerService", + "StatsService" + ] + }, + "policy": { + "levels": { + "0": { + "uplinkOnly": 0, + "downlinkOnly": 0, + "bufferSize": 512, + "connIdle": 600, + "statsUserUplink": true, + "statsUserDownlink": true + } + }, + "system": { + "statsInboundUplink": true, + "statsInboundDownlink": true + } + } +} From 8267f6b2ff0648572273396da8d7f0d105783bad Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Tue, 15 Sep 2020 12:25:59 +0000 Subject: [PATCH 11/15] Update kernel, VPS API, and make VPS URL as setting --- debian9-x86_64.sh | 111 +++++++++++++++++++++++----------------------- 1 file changed, 56 insertions(+), 55 deletions(-) diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index 11851f2..752e3ce 100644 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -30,14 +30,14 @@ NOINTERNET=${NOINTERNET:-no} SPEEDTEST=${SPEEDTEST:-no} LOCALFILES=${LOCALFILES:-no} INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | grep -m 1 -Po '(?<=dev )(\S+)' | tr -d "\n")} -KERNEL_VERSION="5.4.52" -KERNEL_PACKAGE_VERSION="1.11+206826e" +KERNEL_VERSION="5.4.64" +KERNEL_PACKAGE_VERSION="1.12+9d3f35b" KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_${KERNEL_PACKAGE_VERSION}" GLORYTUN_UDP_VERSION="3622f928caf03709c4031a34feec85c623bc5281" #MLVPN_VERSION="8f9720978b28c1954f9f229525333547283316d2" MLVPN_VERSION="f45cec350a6879b8b020143a78134a022b5df2a7" OBFS_VERSION="486bebd9208539058e57e23a12f23103016e09b4" -OMR_ADMIN_VERSION="c64b8e332407b0c8c413330c36409955d9249512" +OMR_ADMIN_VERSION="2737c91e17731f82c96e579b4f963e0136e4df27" DSVPN_VERSION="3b99d2ef6c02b2ef68b5784bec8adfdd55b29b1a" #V2RAY_VERSION="v1.1.0" V2RAY_PLUGIN_VERSION="v1.2.0-8-g59b8f4f" @@ -45,6 +45,7 @@ EASYRSA_VERSION="3.0.6" SHADOWSOCKS_VERSION="38871da8baf5cfa400983dcdf918397e48655203" VPS_DOMAIN=${VPS_DOMAIN:-$(wget -4 -qO- -T 2 http://hostname.openmptcprouter.com)} VPSPATH="server-test" +VPSURL="https://www.openmptcprouter.com/" OMR_VERSION="0.1018-test" @@ -169,8 +170,8 @@ elif [ "$ID" = "ubuntu" ]; then fi apt-get update sleep 2 -wget -O /tmp/linux-image-${KERNEL_RELEASE}_amd64.deb https://www.openmptcprouter.com/kernel/linux-image-${KERNEL_RELEASE}_amd64.deb -wget -O /tmp/linux-headers-${KERNEL_RELEASE}_amd64.deb https://www.openmptcprouter.com/kernel/linux-headers-${KERNEL_RELEASE}_amd64.deb +wget -O /tmp/linux-image-${KERNEL_RELEASE}_amd64.deb ${VPSURL}kernel/linux-image-${KERNEL_RELEASE}_amd64.deb +wget -O /tmp/linux-headers-${KERNEL_RELEASE}_amd64.deb ${VPSURL}kernel/linux-headers-${KERNEL_RELEASE}_amd64.deb # Rename bzImage to vmlinuz, needed when custom kernel was used cd /boot apt-get -y install rename curl libcurl4 unzip git @@ -188,7 +189,7 @@ fi # Check if mptcp kernel is grub default kernel echo "Set MPTCP kernel as grub default..." if [ "$LOCALFILES" = "no" ]; then - wget -O /tmp/update-grub.sh https://www.openmptcprouter.com/${VPSPATH}/update-grub.sh + wget -O /tmp/update-grub.sh ${VPSURL}${VPSPATH}/update-grub.sh cd /tmp else cd ${DIR} @@ -368,7 +369,7 @@ if [ "$OMR_ADMIN" = "yes" ]; then else apt-get -y install python3-passlib python3-jwt python3-netaddr libuv1 python3-uvloop fi - apt-get -y install python3-uvicorn jq ipcalc python3-netifaces python3-aiofiles + apt-get -y install python3-uvicorn jq ipcalc python3-netifaces python3-aiofiles python3-psutil echo '-- pip3 install needed python modules' #pip3 install pyjwt passlib uvicorn fastapi netjsonconfig python-multipart netaddr #pip3 -q install fastapi netjsonconfig python-multipart uvicorn -U @@ -377,7 +378,7 @@ if [ "$OMR_ADMIN" = "yes" ]; then mkdir -p /etc/openmptcprouter-vps-admin/intf mkdir -p /var/opt/openmptcprouter if [ "$SOURCES" = "yes" ]; then - wget -O /lib/systemd/system/omr-admin.service https://www.openmptcprouter.com/${VPSPATH}/omr-admin.service.in + wget -O /lib/systemd/system/omr-admin.service ${VPSURL}${VPSPATH}/omr-admin.service.in wget -O /tmp/openmptcprouter-vps-admin.zip https://github.com/Ysurac/openmptcprouter-vps-admin/archive/${OMR_ADMIN_VERSION}.zip cd /tmp unzip -q -o openmptcprouter-vps-admin.zip @@ -416,7 +417,7 @@ fi # Get shadowsocks optimization if [ "$LOCALFILES" = "no" ]; then - wget -O /etc/sysctl.d/90-shadowsocks.conf https://www.openmptcprouter.com/${VPSPATH}/shadowsocks.conf + wget -O /etc/sysctl.d/90-shadowsocks.conf ${VPSURL}${VPSPATH}/shadowsocks.conf else cp ${DIR}/shadowsocks.conf /etc/sysctl.d/90-shadowsocks.conf fi @@ -431,7 +432,7 @@ fi # Install shadowsocks config and add a shadowsocks by CPU if [ "$update" = "0" ] || [ ! -f /etc/shadowsocks-libev/manager.json ]; then if [ "$LOCALFILES" = "no" ]; then - wget -O /etc/shadowsocks-libev/manager.json https://www.openmptcprouter.com/${VPSPATH}/manager.json + wget -O /etc/shadowsocks-libev/manager.json ${VPSURL}${VPSPATH}/manager.json else cp ${DIR}/manager.json /etc/shadowsocks-libev/manager.json fi @@ -454,7 +455,7 @@ fi #sed -i 's:aes-256-cfb:chacha20:g' /etc/shadowsocks-libev/config.json #sed -i 's:json:json --no-delay:g' /lib/systemd/system/shadowsocks-libev-server@.service if [ "$LOCALFILES" = "no" ]; then - wget -O /lib/systemd/system/shadowsocks-libev-manager@.service https://www.openmptcprouter.com/${VPSPATH}/shadowsocks-libev-manager@.service.in + wget -O /lib/systemd/system/shadowsocks-libev-manager@.service ${VPSURL}${VPSPATH}/shadowsocks-libev-manager@.service.in else cp ${DIR}/shadowsocks-libev-manager@.service.in /lib/systemd/system/shadowsocks-libev-manager@.service fi @@ -506,7 +507,7 @@ if [ "$V2RAY_PLUGIN" = "yes" ]; then echo "Install v2ray plugin" rm -rf /tmp/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz #wget -O /tmp/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz https://github.com/shadowsocks/v2ray-plugin/releases/download/${V2RAY_PLUGIN_VERSION}/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz - wget -O /tmp/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz https://www.openmptcprouter.com/${VPSPATH}/bin/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz + wget -O /tmp/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz ${VPSURL}${VPSPATH}/bin/v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz cd /tmp tar xzvf v2ray-plugin-linux-amd64-${V2RAY_PLUGIN_VERSION}.tar.gz cp v2ray-plugin_linux_amd64 /usr/local/bin/v2ray-plugin @@ -540,7 +541,7 @@ fi if [ "$V2RAY" = "yes" ]; then apt-get -y -o Dpkg::Options::="--force-overwrite" install v2ray if [ ! -f /etc/v2ray/v2ray-server.json ]; then - wget -O /etc/v2ray/v2ray-server.json https://www.openmptcprouter.com/${VPSPATH}/v2ray-server.json + wget -O /etc/v2ray/v2ray-server.json ${VPSURL}${VPSPATH}/v2ray-server.json sed -i "s:V2RAY_UUID:$V2RAY_UUID:g" /etc/v2ray/v2ray-server.json rm /etc/v2ray/config.json ln -s /etc/v2ray/v2ray-server.json /etc/v2ray/config.json @@ -581,8 +582,8 @@ if [ "$MLVPN" = "yes" ]; then apt-get -y -o Dpkg::Options::="--force-overwrite" install mlvpn fi if [ "$LOCALFILES" = "no" ]; then - wget -O /lib/systemd/network/mlvpn.network https://www.openmptcprouter.com/${VPSPATH}/mlvpn.network - wget -O /lib/systemd/system/mlvpn@.service https://www.openmptcprouter.com/${VPSPATH}/mlvpn@.service.in + wget -O /lib/systemd/network/mlvpn.network ${VPSURL}${VPSPATH}/mlvpn.network + wget -O /lib/systemd/system/mlvpn@.service ${VPSURL}${VPSPATH}/mlvpn@.service.in else cp ${DIR}/mlvpn.network /lib/systemd/network/mlvpn.network cp ${DIR}/mlvpn@.service.in /lib/systemd/system/mlvpn@.service @@ -590,7 +591,7 @@ if [ "$MLVPN" = "yes" ]; then mkdir -p /etc/mlvpn if [ "$mlvpnupdate" = "0" ]; then if [ "$LOCALFILES" = "no" ]; then - wget -O /etc/mlvpn/mlvpn0.conf https://www.openmptcprouter.com/${VPSPATH}/mlvpn0.conf + wget -O /etc/mlvpn/mlvpn0.conf ${VPSURL}${VPSPATH}/mlvpn0.conf else cp ${DIR}/mlvpn0.conf /etc/mlvpn/mlvpn0.conf fi @@ -614,10 +615,10 @@ if [ "$OPENVPN" = "yes" ]; then rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock-frontend apt-get -y install openvpn easy-rsa - #wget -O /lib/systemd/network/openvpn.network https://www.openmptcprouter.com/${VPSPATH}/openvpn.network + #wget -O /lib/systemd/network/openvpn.network ${VPSURL}${VPSPATH}/openvpn.network rm -f /lib/systemd/network/openvpn.network #if [ ! -f "/etc/openvpn/server/static.key" ]; then - # wget -O /etc/openvpn/tun0.conf https://www.openmptcprouter.com/${VPSPATH}/openvpn-tun0.conf + # wget -O /etc/openvpn/tun0.conf ${VPSURL}${VPSPATH}/openvpn-tun0.conf # cd /etc/openvpn/server # openvpn --genkey --secret static.key #fi @@ -679,8 +680,8 @@ if [ "$OPENVPN" = "yes" ]; then openssl dhparam -out /etc/openvpn/server/dh2048.pem 2048 fi if [ "$LOCALFILES" = "no" ]; then - wget -O /etc/openvpn/tun0.conf https://www.openmptcprouter.com/${VPSPATH}/openvpn-tun0.conf - wget -O /etc/openvpn/tun1.conf https://www.openmptcprouter.com/${VPSPATH}/openvpn-tun1.conf + wget -O /etc/openvpn/tun0.conf ${VPSURL}${VPSPATH}/openvpn-tun0.conf + wget -O /etc/openvpn/tun1.conf ${VPSURL}${VPSPATH}/openvpn-tun1.conf else cp ${DIR}/openvpn-tun0.conf /etc/openvpn/tun0.conf cp ${DIR}/openvpn-tun1.conf /etc/openvpn/tun1.conf @@ -711,22 +712,22 @@ if [ "$SOURCES" = "yes" ]; then rm /lib/systemd/system/glorytun* rm /lib/systemd/network/glorytun* if [ "$LOCALFILES" = "no" ]; then - wget -O /usr/local/bin/glorytun-udp-run https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp-run + wget -O /usr/local/bin/glorytun-udp-run ${VPSURL}${VPSPATH}/glorytun-udp-run else cp ${DIR}/glorytun-udp-run /usr/local/bin/glorytun-udp-run fi chmod 755 /usr/local/bin/glorytun-udp-run if [ "$LOCALFILES" = "no" ]; then - wget -O /lib/systemd/system/glorytun-udp@.service https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp%40.service.in + wget -O /lib/systemd/system/glorytun-udp@.service ${VPSURL}${VPSPATH}/glorytun-udp%40.service.in else cp ${DIR}/glorytun-udp@.service.in /lib/systemd/system/glorytun-udp@.service fi - #wget -O /lib/systemd/network/glorytun-udp.network https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp.network + #wget -O /lib/systemd/network/glorytun-udp.network ${VPSURL}${VPSPATH}/glorytun-udp.network rm -f /lib/systemd/network/glorytun-udp.network mkdir -p /etc/glorytun-udp if [ "$LOCALFILES" = "no" ]; then - wget -O /etc/glorytun-udp/post.sh https://www.openmptcprouter.com/${VPSPATH}/glorytun-udp-post.sh - wget -O /etc/glorytun-udp/tun0 https://www.openmptcprouter.com/${VPSPATH}/tun0.glorytun-udp + wget -O /etc/glorytun-udp/post.sh ${VPSURL}${VPSPATH}/glorytun-udp-post.sh + wget -O /etc/glorytun-udp/tun0 ${VPSURL}${VPSPATH}/tun0.glorytun-udp else cp ${DIR}/glorytun-udp-post.sh /etc/glorytun-udp/post.sh cp ${DIR}/tun0.glorytun-udp /etc/glorytun-udp/tun0 @@ -771,11 +772,11 @@ if [ "$DSVPN" = "yes" ]; then make CFLAGS='-DNO_DEFAULT_ROUTES -DNO_DEFAULT_FIREWALL' make install rm -f /lib/systemd/system/dsvpn/* - wget -O /usr/local/bin/dsvpn-run https://www.openmptcprouter.com/${VPSPATH}/dsvpn-run + wget -O /usr/local/bin/dsvpn-run ${VPSURL}${VPSPATH}/dsvpn-run chmod 755 /usr/local/bin/dsvpn-run - wget -O /lib/systemd/system/dsvpn-server@.service https://www.openmptcprouter.com/${VPSPATH}/dsvpn-server%40.service.in + wget -O /lib/systemd/system/dsvpn-server@.service ${VPSURL}${VPSPATH}/dsvpn-server%40.service.in mkdir -p /etc/dsvpn - wget -O /etc/dsvpn/dsvpn0 https://www.openmptcprouter.com/${VPSPATH}/dsvpn0-config + wget -O /etc/dsvpn/dsvpn0 ${VPSURL}${VPSPATH}/dsvpn0-config if [ -f /etc/dsvpn/dsvpn.key ]; then mv /etc/dsvpn/dsvpn.key /etc/dsvpn/dsvpn0.key fi @@ -817,15 +818,15 @@ if [ "$SOURCES" = "yes" ]; then ./configure make cp glorytun /usr/local/bin/glorytun-tcp - wget -O /usr/local/bin/glorytun-tcp-run https://www.openmptcprouter.com/${VPSPATH}/glorytun-tcp-run + wget -O /usr/local/bin/glorytun-tcp-run ${VPSURL}${VPSPATH}/glorytun-tcp-run chmod 755 /usr/local/bin/glorytun-tcp-run - wget -O /lib/systemd/system/glorytun-tcp@.service https://www.openmptcprouter.com/${VPSPATH}/glorytun-tcp%40.service.in - #wget -O /lib/systemd/network/glorytun-tcp.network https://www.openmptcprouter.com/${VPSPATH}/glorytun.network + wget -O /lib/systemd/system/glorytun-tcp@.service ${VPSURL}${VPSPATH}/glorytun-tcp%40.service.in + #wget -O /lib/systemd/network/glorytun-tcp.network ${VPSURL}${VPSPATH}/glorytun.network rm -f /lib/systemd/network/glorytun-tcp.network mkdir -p /etc/glorytun-tcp - wget -O /etc/glorytun-tcp/post.sh https://www.openmptcprouter.com/${VPSPATH}/glorytun-tcp-post.sh + wget -O /etc/glorytun-tcp/post.sh ${VPSURL}${VPSPATH}/glorytun-tcp-post.sh chmod 755 /etc/glorytun-tcp/post.sh - wget -O /etc/glorytun-tcp/tun0 https://www.openmptcprouter.com/${VPSPATH}/tun0.glorytun + wget -O /etc/glorytun-tcp/tun0 ${VPSURL}${VPSPATH}/tun0.glorytun if [ "$update" = "0" ]; then echo "$GLORYTUN_PASS" > /etc/glorytun-tcp/tun0.key fi @@ -846,7 +847,7 @@ fi # Add multipath utility if [ "$LOCALFILES" = "no" ]; then - wget -O /usr/local/bin/multipath https://www.openmptcprouter.com/${VPSPATH}/multipath + wget -O /usr/local/bin/multipath ${VPSURL}${VPSPATH}/multipath else cp ${DIR}/multipath /usr/local/bin/multipath fi @@ -854,10 +855,10 @@ chmod 755 /usr/local/bin/multipath # Add OpenMPTCProuter service if [ "$LOCALFILES" = "no" ]; then - wget -O /usr/local/bin/omr-service https://www.openmptcprouter.com/${VPSPATH}/omr-service - wget -O /lib/systemd/system/omr.service https://www.openmptcprouter.com/${VPSPATH}/omr.service.in - wget -O /usr/local/bin/omr-6in4-run https://www.openmptcprouter.com/${VPSPATH}/omr-6in4-run - wget -O /lib/systemd/system/omr6in4@.service https://www.openmptcprouter.com/${VPSPATH}/omr6in4%40.service.in + wget -O /usr/local/bin/omr-service ${VPSURL}${VPSPATH}/omr-service + wget -O /lib/systemd/system/omr.service ${VPSURL}${VPSPATH}/omr.service.in + wget -O /usr/local/bin/omr-6in4-run ${VPSURL}${VPSPATH}/omr-6in4-run + wget -O /lib/systemd/system/omr6in4@.service ${VPSURL}${VPSPATH}/omr6in4%40.service.in else cp ${DIR}/omr-service /usr/local/bin/omr-service cp ${DIR}/omr.service.in /lib/systemd/system/omr.service @@ -887,7 +888,7 @@ if [ "$update" = "0" ]; then # Install and configure the firewall using shorewall apt-get -y install shorewall shorewall6 if [ "$LOCALFILES" = "no" ]; then - wget -O /etc/shorewall/openmptcprouter-shorewall.tar.gz https://www.openmptcprouter.com/${VPSPATH}/openmptcprouter-shorewall.tar.gz + wget -O /etc/shorewall/openmptcprouter-shorewall.tar.gz ${VPSURL}${VPSPATH}/openmptcprouter-shorewall.tar.gz else cp ${DIR}/openmptcprouter-shorewall.tar.gz /etc/shorewall/openmptcprouter-shorewall.tar.gz fi @@ -896,7 +897,7 @@ if [ "$update" = "0" ]; then sed -i "s:eth0:$INTERFACE:g" /etc/shorewall/* systemctl enable shorewall if [ "$LOCALFILES" = "no" ]; then - wget -O /etc/shorewall6/openmptcprouter-shorewall6.tar.gz https://www.openmptcprouter.com/${VPSPATH}/openmptcprouter-shorewall6.tar.gz + wget -O /etc/shorewall6/openmptcprouter-shorewall6.tar.gz ${VPSURL}${VPSPATH}/openmptcprouter-shorewall6.tar.gz else cp ${DIR}/openmptcprouter-shorewall6.tar.gz /etc/shorewall6/openmptcprouter-shorewall6.tar.gz fi @@ -907,21 +908,21 @@ if [ "$update" = "0" ]; then else # Update only needed firewall files if [ "$LOCALFILES" = "no" ]; then - wget -O /etc/shorewall/interfaces https://www.openmptcprouter.com/${VPSPATH}/shorewall4/interfaces - wget -O /etc/shorewall/snat https://www.openmptcprouter.com/${VPSPATH}/shorewall4/snat - wget -O /etc/shorewall/stoppedrules https://www.openmptcprouter.com/${VPSPATH}/shorewall4/stoppedrules - wget -O /etc/shorewall/tcinterfaces https://www.openmptcprouter.com/${VPSPATH}/shorewall4/tcinterfaces - wget -O /etc/shorewall/shorewall.conf https://www.openmptcprouter.com/${VPSPATH}/shorewall4/shorewall.conf - wget -O /etc/shorewall/policy https://www.openmptcprouter.com/${VPSPATH}/shorewall4/policy - wget -O /etc/shorewall/params https://www.openmptcprouter.com/${VPSPATH}/shorewall4/params - wget -O /etc/shorewall/params.vpn https://www.openmptcprouter.com/${VPSPATH}/shorewall4/params.vpn - wget -O /etc/shorewall/params.net https://www.openmptcprouter.com/${VPSPATH}/shorewall4/params.net - wget -O /etc/shorewall6/params https://www.openmptcprouter.com/${VPSPATH}/shorewall6/params - wget -O /etc/shorewall6/params.net https://www.openmptcprouter.com/${VPSPATH}/shorewall6/params.net - wget -O /etc/shorewall6/params.vpn https://www.openmptcprouter.com/${VPSPATH}/shorewall6/params.vpn - wget -O /etc/shorewall6/interfaces https://www.openmptcprouter.com/${VPSPATH}/shorewall6/interfaces - wget -O /etc/shorewall6/stoppedrules https://www.openmptcprouter.com/${VPSPATH}/shorewall6/stoppedrules - wget -O /etc/shorewall6/snat https://www.openmptcprouter.com/${VPSPATH}/shorewall6/snat + wget -O /etc/shorewall/interfaces ${VPSURL}${VPSPATH}/shorewall4/interfaces + wget -O /etc/shorewall/snat ${VPSURL}${VPSPATH}/shorewall4/snat + wget -O /etc/shorewall/stoppedrules ${VPSURL}${VPSPATH}/shorewall4/stoppedrules + wget -O /etc/shorewall/tcinterfaces ${VPSURL}${VPSPATH}/shorewall4/tcinterfaces + wget -O /etc/shorewall/shorewall.conf ${VPSURL}${VPSPATH}/shorewall4/shorewall.conf + wget -O /etc/shorewall/policy ${VPSURL}${VPSPATH}/shorewall4/policy + wget -O /etc/shorewall/params ${VPSURL}${VPSPATH}/shorewall4/params + wget -O /etc/shorewall/params.vpn ${VPSURL}${VPSPATH}/shorewall4/params.vpn + wget -O /etc/shorewall/params.net ${VPSURL}${VPSPATH}/shorewall4/params.net + wget -O /etc/shorewall6/params ${VPSURL}${VPSPATH}/shorewall6/params + wget -O /etc/shorewall6/params.net ${VPSURL}${VPSPATH}/shorewall6/params.net + wget -O /etc/shorewall6/params.vpn ${VPSURL}${VPSPATH}/shorewall6/params.vpn + wget -O /etc/shorewall6/interfaces ${VPSURL}${VPSPATH}/shorewall6/interfaces + wget -O /etc/shorewall6/stoppedrules ${VPSURL}${VPSPATH}/shorewall6/stoppedrules + wget -O /etc/shorewall6/snat ${VPSURL}${VPSPATH}/shorewall6/snat else cp ${DIR}/shorewall4/interfaces /etc/shorewall/interfaces cp ${DIR}/shorewall4/snat /etc/shorewall/snat From 30d5d851847817089146c86c1447c6ec9ae4b83a Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Tue, 15 Sep 2020 12:26:38 +0000 Subject: [PATCH 12/15] Set txqlen to 100 for glorytun udp --- glorytun-udp-post.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/glorytun-udp-post.sh b/glorytun-udp-post.sh index 5d8e7c4..09cba72 100644 --- a/glorytun-udp-post.sh +++ b/glorytun-udp-post.sh @@ -12,3 +12,4 @@ done ip link set dev ${INTF} up 2>&1 >/dev/null ip addr add ${LOCALIP}/30 brd ${BROADCASTIP} dev ${INTF} 2>&1 >/dev/null } +ip link set $INTF txqlen 100 \ No newline at end of file From a3aaeac2d3e7dfbf0b239e6e6ff72aaa547276e9 Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Tue, 15 Sep 2020 12:26:51 +0000 Subject: [PATCH 13/15] Increase shadowsocks timeout --- manager.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/manager.json b/manager.json index 7e1ace6..00923b9 100644 --- a/manager.json +++ b/manager.json @@ -9,7 +9,7 @@ ], "method": "chacha20-ietf-poly1305", "fast_open": true, - "timeout": 600, + "timeout": 1000, "port_key": { "65101": "MySecretKey", }, From d5a9321d6592df6e8184c850421f4c0ef52c9cf4 Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Tue, 15 Sep 2020 12:27:08 +0000 Subject: [PATCH 14/15] Increase VPS API check timeout --- omr-service | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/omr-service b/omr-service index fd8d77d..3890f2b 100755 --- a/omr-service +++ b/omr-service @@ -30,7 +30,7 @@ _glorytun_tcp() { } _omr_api() { - [ -z "$(curl -s -k -m 3 https://127.0.0.1:65500/)" ] && { + [ -z "$(curl -s -k -m 30 https://127.0.0.1:65500/)" ] && { logger -t "OMR-Service" "Restart OMR-Admin" systemctl -q restart omr-admin } From d6b3042be467c146fc2c4874e7114268e4ec06aa Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Tue, 15 Sep 2020 12:27:28 +0000 Subject: [PATCH 15/15] Fix typo in v2ray config --- v2ray-server.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/v2ray-server.json b/v2ray-server.json index 326474a..c8754bd 100644 --- a/v2ray-server.json +++ b/v2ray-server.json @@ -100,7 +100,7 @@ "api": { "tag": "api", "services": [ - "HandlserService", + "HandlerService", "LoggerService", "StatsService" ] @@ -111,7 +111,7 @@ "uplinkOnly": 0, "downlinkOnly": 0, "bufferSize": 512, - "connIdle": 600, + "connIdle": 1200, "statsUserUplink": true, "statsUserDownlink": true }