mptcp/openmptcprouter-vps
1
0
Fork 0
mirror of https://github.com/Ysurac/openmptcprouter-vps.git synced 2025-03-09 15:50:00 +00:00
Code Issues Releases Wiki Activity

Update and change masquerade to 10.255.0.0/16

Browse source
This commit is contained in:
Ycarus (Yannick Chabanois) 2019-10-22 21:55:58 +02:00
parent 3b7063139e
commit 99e8a92274
2 changed files with 29 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

39
debian9-x86_64.sh
View file

@ -1,7 +1,7 @@
#!/bin/sh #!/bin/sh
SHADOWSOCKS_PASS=${SHADOWSOCKS_PASS:-$(head -c 32 /dev/urandom | base64 -w0)} SHADOWSOCKS_PASS=${SHADOWSOCKS_PASS:-$(head -c 32 /dev/urandom | base64 -w0)}
GLORYTUN_PASS=${GLORYTUN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lower:]' '[:upper:]' | tr -d " \n")} GLORYTUN_PASS=${GLORYTUN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lower:]' '[:upper:]' | tr -d " \n")}
DSVPN_PASS=${DSVPN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lower:]' '[:upper:]' | tr -d " \n")} DSVPN_PASS=${DSVPN_PASS:-$(od -vN "32" -An -tx1 /dev/urandom | tr '[:lower:]' '[:upper:]' | tr -d " \n")}
#NBCPU=${NBCPU:-$(nproc --all | tr -d "\n")} #NBCPU=${NBCPU:-$(nproc --all | tr -d "\n")}
NBCPU=${NBCPU:-$(grep -c '^processor' /proc/cpuinfo | tr -d "\n")} NBCPU=${NBCPU:-$(grep -c '^processor' /proc/cpuinfo | tr -d "\n")}
OBFS=${OBFS:-yes} OBFS=${OBFS:-yes}
@ -15,9 +15,8 @@ OPENVPN=${OPENVPN:-yes}
DSVPN=${DSVPN:-yes} DSVPN=${DSVPN:-yes}
INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | grep -m 1 -Po '(?<=dev )(\S+)' | tr -d "\n")} INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | grep -m 1 -Po '(?<=dev )(\S+)' | tr -d "\n")}
KERNEL_VERSION="4.19.67" KERNEL_VERSION="4.19.67"
#KERNEL_VERSION="4.14.110" KERNEL_PACKAGE_VERSION="1.4+4e10ec5"
KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_1.4+4e10ec5" KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_${KERNEL_PACKAGE_VERSION}"
#KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_1.0+4c83d3a"
GLORYTUN_UDP_VERSION="d451bc75b0c5784ce3851e8754fb824bffc3bcce" GLORYTUN_UDP_VERSION="d451bc75b0c5784ce3851e8754fb824bffc3bcce"
MLVPN_VERSION="8f9720978b28c1954f9f229525333547283316d2" MLVPN_VERSION="8f9720978b28c1954f9f229525333547283316d2"
OBFS_VERSION="5cbfdcc28cdc912852cc3c99e3c7f5603d337805" OBFS_VERSION="5cbfdcc28cdc912852cc3c99e3c7f5603d337805"
@ -108,9 +107,12 @@ rename 's/^bzImage/vmlinuz/s' * >/dev/null 2>&1
#apt-get -y install linux-mptcp #apt-get -y install linux-mptcp
#dpkg --remove --force-remove-reinstreq linux-image-${KERNEL_VERSION}-mptcp #dpkg --remove --force-remove-reinstreq linux-image-${KERNEL_VERSION}-mptcp
#dpkg --remove --force-remove-reinstreq linux-headers-${KERNEL_VERSION}-mptcp #dpkg --remove --force-remove-reinstreq linux-headers-${KERNEL_VERSION}-mptcp
dpkg --remove --force-remove-reinstreq linux-image-${KERNEL_VERSION}-mptcp if [ "$(dpkg -l | grep linux-image-${KERNEL_VERSION} | grep ${KERNEL_PACKAGE_VERSION})" = "" ]; then
dpkg --force-all -i -B /tmp/linux-image-${KERNEL_RELEASE}_amd64.deb echo "Install kernel linux-image-${KERNEL_RELEASE}"
dpkg --force-all -i -B /tmp/linux-headers-${KERNEL_RELEASE}_amd64.deb echo "if kernel install fail run: dpkg --remove --force-remove-reinstreq linux-image-${KERNEL_VERSION}-mptcp"
dpkg --force-all -i -B /tmp/linux-image-${KERNEL_RELEASE}_amd64.deb
dpkg --force-all -i -B /tmp/linux-headers-${KERNEL_RELEASE}_amd64.deb
fi
# Check if mptcp kernel is grub default kernel # Check if mptcp kernel is grub default kernel
echo "Set MPTCP kernel as grub default..." echo "Set MPTCP kernel as grub default..."
@ -153,12 +155,15 @@ patch -p1 < 020-NOCRYPTO.patch
#cd /tmp #cd /tmp
#rm -rf /tmp/libbpf #rm -rf /tmp/libbpf
rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock
rm -f /var/lib/dpkg/lock-frontend
apt-get -y install --no-install-recommends devscripts equivs apg libcap2-bin libpam-cap libc-ares2 libc-ares-dev libev4 haveged apt-get -y install --no-install-recommends devscripts equivs apg libcap2-bin libpam-cap libc-ares2 libc-ares-dev libev4 haveged
rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock
rm -f /var/lib/dpkg/lock-frontend
systemctl enable haveged systemctl enable haveged
if [ "$ID" = "debian" ]; then if [ "$ID" = "debian" ]; then
rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock
rm -f /var/lib/dpkg/lock-frontend
if [ "$VERSION_ID" = "9" ]; then if [ "$VERSION_ID" = "9" ]; then
apt -y -t stretch-backports install libsodium-dev apt -y -t stretch-backports install libsodium-dev
else else
@ -166,15 +171,19 @@ if [ "$ID" = "debian" ]; then
fi fi
elif [ "$ID" = "ubuntu" ]; then elif [ "$ID" = "ubuntu" ]; then
rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock
rm -f /var/lib/dpkg/lock-frontend
apt-get -y install libsodium-dev apt-get -y install libsodium-dev
systemctl enable haveged systemctl enable haveged
fi fi
cd /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION} cd /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION}
rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock
rm -f /var/lib/dpkg/lock-frontend
mk-build-deps --install --tool "apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends -y" mk-build-deps --install --tool "apt-get -o Debug::pkgProblemResolver=yes --no-install-recommends -y"
rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock
rm -f /var/lib/dpkg/lock-frontend
dpkg-buildpackage -b -us -uc dpkg-buildpackage -b -us -uc
rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock
rm -f /var/lib/dpkg/lock-frontend
cd /tmp cd /tmp
dpkg -i shadowsocks-libev_${SHADOWSOCKS_VERSION}-1_amd64.deb dpkg -i shadowsocks-libev_${SHADOWSOCKS_VERSION}-1_amd64.deb
#mkdir -p /usr/lib/shadowsocks-libev #mkdir -p /usr/lib/shadowsocks-libev
@ -259,6 +268,7 @@ if [ "$OBFS" = "yes" ]; then
rm -rf /tmp/simple-obfs rm -rf /tmp/simple-obfs
cd /tmp cd /tmp
rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock
rm -f /var/lib/dpkg/lock-frontend
apt-get install -y --no-install-recommends build-essential autoconf libtool libssl-dev libpcre3-dev libev-dev asciidoc xmlto automake git ca-certificates apt-get install -y --no-install-recommends build-essential autoconf libtool libssl-dev libpcre3-dev libev-dev asciidoc xmlto automake git ca-certificates
git clone https://github.com/shadowsocks/simple-obfs.git /tmp/simple-obfs git clone https://github.com/shadowsocks/simple-obfs.git /tmp/simple-obfs
cd /tmp/simple-obfs cd /tmp/simple-obfs
@ -316,6 +326,7 @@ if [ "$MLVPN" = "yes" ]; then
mlvpnupdate="1" mlvpnupdate="1"
fi fi
rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock
rm -f /var/lib/dpkg/lock-frontend
apt-get -y install build-essential pkg-config autoconf automake libpcap-dev unzip git apt-get -y install build-essential pkg-config autoconf automake libpcap-dev unzip git
rm -rf /tmp/mlvpn rm -rf /tmp/mlvpn
cd /tmp cd /tmp
@ -353,6 +364,7 @@ fi
if [ "$OPENVPN" = "yes" ]; then if [ "$OPENVPN" = "yes" ]; then
echo "Install OpenVPN" echo "Install OpenVPN"
rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock
rm -f /var/lib/dpkg/lock-frontend
apt-get -y install openvpn apt-get -y install openvpn
wget -O /lib/systemd/network/openvpn.network https://www.openmptcprouter.com/server/openvpn.network wget -O /lib/systemd/network/openvpn.network https://www.openmptcprouter.com/server/openvpn.network
if [ ! -f "/etc/openvpn/server/static.key" ]; then if [ ! -f "/etc/openvpn/server/static.key" ]; then
@ -369,6 +381,7 @@ if systemctl -q is-active glorytun-udp@tun0.service; then
systemctl -q stop glorytun-udp@tun0 > /dev/null 2>&1 systemctl -q stop glorytun-udp@tun0 > /dev/null 2>&1
fi fi
rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock
rm -f /var/lib/dpkg/lock-frontend
apt-get install -y --no-install-recommends build-essential git ca-certificates meson pkg-config apt-get install -y --no-install-recommends build-essential git ca-certificates meson pkg-config
rm -rf /tmp/glorytun-udp rm -rf /tmp/glorytun-udp
cd /tmp cd /tmp
@ -387,7 +400,7 @@ wget -O /lib/systemd/system/glorytun-udp@.service https://www.openmptcprouter.co
wget -O /lib/systemd/network/glorytun-udp.network https://www.openmptcprouter.com/server/glorytun-udp.network wget -O /lib/systemd/network/glorytun-udp.network https://www.openmptcprouter.com/server/glorytun-udp.network
mkdir -p /etc/glorytun-udp mkdir -p /etc/glorytun-udp
wget -O /etc/glorytun-udp/tun0 https://www.openmptcprouter.com/server/tun0.glorytun-udp wget -O /etc/glorytun-udp/tun0 https://www.openmptcprouter.com/server/tun0.glorytun-udp
if [ "$update" = "0" ]; then if [ "$update" = "0" ] || [ ! -f /etc/glorytun-udp/tun0.key ]; then
echo "$GLORYTUN_PASS" > /etc/glorytun-udp/tun0.key echo "$GLORYTUN_PASS" > /etc/glorytun-udp/tun0.key
elif [ ! -f /etc/glorytun-udp/tun0.key ] && [ -f /etc/glorytun-tcp/tun0.key ]; then elif [ ! -f /etc/glorytun-udp/tun0.key ] && [ -f /etc/glorytun-tcp/tun0.key ]; then
cp /etc/glorytun-tcp/tun0.key /etc/glorytun-udp/tun0.key cp /etc/glorytun-tcp/tun0.key /etc/glorytun-udp/tun0.key
@ -404,6 +417,7 @@ if [ "$DSVPN" = "yes" ]; then
systemctl -q stop dsvpn-server > /dev/null 2>&1 systemctl -q stop dsvpn-server > /dev/null 2>&1
fi fi
rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock
rm -f /var/lib/dpkg/lock-frontend
apt-get install -y --no-install-recommends build-essential git ca-certificates apt-get install -y --no-install-recommends build-essential git ca-certificates
rm -rf /tmp/dsvpn rm -rf /tmp/dsvpn
cd /tmp cd /tmp
@ -417,7 +431,7 @@ if [ "$DSVPN" = "yes" ]; then
rm -f /lib/systemd/system/dsvpn/* rm -f /lib/systemd/system/dsvpn/*
wget -O /lib/systemd/system/dsvpn-server.service https://www.openmptcprouter.com/server/dsvpn-server.service.in wget -O /lib/systemd/system/dsvpn-server.service https://www.openmptcprouter.com/server/dsvpn-server.service.in
mkdir -p /etc/dsvpn mkdir -p /etc/dsvpn
if [ "$update" = "0" ]; then if [ "$update" = "0" ] || [ ! -f /etc/dsvpn/dsvpn.key ]; then
echo "$DSVPN_PASS" > /etc/dsvpn/dsvpn.key echo "$DSVPN_PASS" > /etc/dsvpn/dsvpn.key
fi fi
systemctl enable dsvpn-server.service systemctl enable dsvpn-server.service
@ -439,6 +453,7 @@ elif [ "$ID" = "ubuntu" ]; then
apt-get -y install libsodium-dev apt-get -y install libsodium-dev
fi fi
rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock
rm -f /var/lib/dpkg/lock-frontend
apt-get -y install build-essential pkg-config autoconf automake apt-get -y install build-essential pkg-config autoconf automake
rm -rf /tmp/glorytun-0.0.35 rm -rf /tmp/glorytun-0.0.35
cd /tmp cd /tmp
@ -527,9 +542,11 @@ else
fi fi
if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "10" ]; then if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "10" ]; then
update-alternatives --set iptables /usr/sbin/iptables-legacy update-alternatives --set iptables /usr/sbin/iptables-legacy
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
fi
if ([ "$ID" = "debian" ] && [ "$VERSION_ID" = "10" ]) || ([ "$ID" = "ubuntu" ] && [ "$VERSION_ID" = "19.04" ]); then
sed -i 's:DROP_DEFAULT=Drop:DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)":g' /etc/shorewall/shorewall.conf sed -i 's:DROP_DEFAULT=Drop:DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)":g' /etc/shorewall/shorewall.conf
sed -i 's:REJECT_DEFAULT=Reject:REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)":g' /etc/shorewall/shorewall.conf sed -i 's:REJECT_DEFAULT=Reject:REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)":g' /etc/shorewall/shorewall.conf
update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy
sed -i 's:DROP_DEFAULT=Drop:DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)":g' /etc/shorewall6/shorewall6.conf sed -i 's:DROP_DEFAULT=Drop:DROP_DEFAULT="Broadcast(DROP),Multicast(DROP)":g' /etc/shorewall6/shorewall6.conf
sed -i 's:REJECT_DEFAULT=Reject:REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)":g' /etc/shorewall6/shorewall6.conf sed -i 's:REJECT_DEFAULT=Reject:REJECT_DEFAULT="Broadcast(DROP),Multicast(DROP)":g' /etc/shorewall6/shorewall6.conf
fi fi

2
shorewall4/snat
View file

@ -15,7 +15,7 @@
########################################################################################################################################### ###########################################################################################################################################
#ACTION SOURCE DEST PROTO PORT IPSEC MARK USER SWITCH ORIGDEST PROBABILITY #ACTION SOURCE DEST PROTO PORT IPSEC MARK USER SWITCH ORIGDEST PROBABILITY
# #
MASQUERADE 10.0.0.0/8,\ MASQUERADE 10.255.0.0/16,\
169.254.0.0/16,\ 169.254.0.0/16,\
172.16.0.0/12,\ 172.16.0.0/12,\
192.168.0.0/16 $NET_IFACE 192.168.0.0/16 $NET_IFACE