From 4fbb8d08f3a3e39cea587602954e4ff9f02743a4 Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Tue, 9 Aug 2022 18:36:09 +0000 Subject: [PATCH 1/5] Push latest scripts changes --- debian9-x86_64.sh | 81 +++++++++++++++++++++++++------ multipath | 2 +- omr-service | 51 +++++++++++-------- openmptcprouter-shorewall.tar.gz | Bin 4136 -> 4192 bytes shorewall4/interfaces | 1 + shorewall4/policy | 2 + shorewall4/shorewall.conf | 10 ++-- shorewall4/stoppedrules | 2 + shorewall4/tcinterfaces | 2 +- shorewall4/zones | 1 + 10 files changed, 108 insertions(+), 44 deletions(-) diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index 3fcf1bc..232e25d 100755 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -38,12 +38,12 @@ REINSTALL=${REINSTALL:-yes} SPEEDTEST=${SPEEDTEST:-yes} LOCALFILES=${LOCALFILES:-no} INTERFACE=${INTERFACE:-$(ip -o -4 route show to default | grep -m 1 -Po '(?<=dev )(\S+)' | tr -d "\n")} -KERNEL_VERSION="5.4.132" -KERNEL_PACKAGE_VERSION="1.19+4f508aa" +KERNEL_VERSION="5.4.207" +KERNEL_PACKAGE_VERSION="1.22" KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_${KERNEL_PACKAGE_VERSION}" if [ "$UPSTREAM" = "yes" ]; then - KERNEL_VERSION="5.15.13" - KERNEL_PACKAGE_VERSION="1.5" + KERNEL_VERSION="5.15.57" + KERNEL_PACKAGE_VERSION="1.6" KERNEL_RELEASE="${KERNEL_VERSION}-mptcp_${KERNEL_VERSION}-${KERNEL_PACKAGE_VERSION}" fi GLORYTUN_UDP_VERSION="32267e86a6da05b285bb3bf2b136c105dc0af4bb" @@ -55,15 +55,12 @@ MLVPN_BINARY_VERSION="3.0.0+20211028.git.ddafba3" UBOND_VERSION="f9fb6aa0a65e8e20950977bda970c90012f830d7" OBFS_VERSION="486bebd9208539058e57e23a12f23103016e09b4" OBFS_BINARY_VERSION="0.0.5-1" -OMR_ADMIN_VERSION="027d5c8e80ef469d33e43f6cbf3103b30e55ea1c" -if [ "$UPSTREAM" = "yes" ]; then - OMR_ADMIN_VERSION="2a8f642f89a982d2c26c3e176f6c4c1e3e91ffcb" -fi -OMR_ADMIN_BINARY_VERSION="0.3+20210508" +OMR_ADMIN_VERSION="20314b11f21eb5878ba62c85d874528e0e394024" +OMR_ADMIN_BINARY_VERSION="0.3+20220715" DSVPN_VERSION="3b99d2ef6c02b2ef68b5784bec8adfdd55b29b1a" DSVPN_BINARY_VERSION="0.1.4-2" V2RAY_VERSION="4.43.0" -V2RAY_PLUGIN_VERSION="4.35.1" +V2RAY_PLUGIN_VERSION="4.43.0" EASYRSA_VERSION="3.0.6" SHADOWSOCKS_VERSION="7407b214f335f0e2068a8622ef3674d868218e17" if [ "$UPSTREAM" = "yes" ]; then @@ -73,6 +70,7 @@ IPROUTE2_VERSION="29da83f89f6e1fe528c59131a01f5d43bcd0a000" SHADOWSOCKS_BINARY_VERSION="3.3.5-3" DEFAULT_USER="openmptcprouter" VPS_DOMAIN=${VPS_DOMAIN:-$(wget -4 -qO- -T 2 http://hostname.openmptcprouter.com)} +VPS_PUBLIC_IP=${VPS_PUBLIC_IP:-$(wget -4 -qO- -T 2 http://ip.openmptcprouter.com)} VPSPATH="server-test" VPSURL="https://www.openmptcprouter.com/" REPO="repo.openmptcprouter.com" @@ -182,7 +180,11 @@ echo "Remove lock and update packages list..." rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock-frontend rm -f /var/cache/apt/archives/lock -apt-get update --allow-releaseinfo-change +if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "9" ]; then + apt-get update +else + apt-get update --allow-releaseinfo-change +fi rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock-frontend rm -f /var/cache/apt/archives/lock @@ -283,6 +285,18 @@ apt-get update --allow-releaseinfo-change sleep 2 apt-get -y install dirmngr patch rename curl libcurl4 unzip pkg-config +if [ -z "$(dpkg-query -l | grep grub)" ]; then + if [ -d /boot/grub2 ]; then + apt-get -y install grub2 + elif [ -d /boot/grub ]; then + apt-get -y install grub-legacy + fi + [ -n "$(grep 'net.ifnames=0' /boot/grub/grub.cfg)" ] && [ ! -f /etc/default/grub ] && { + echo 'GRUB_CMDLINE_LINUX="net.ifnames=0 biosdevname=0"' > /etc/default/grub + } +fi + + if [ "$SOURCES" = "yes" ]; then wget -O /tmp/linux-image-${KERNEL_RELEASE}_amd64.deb ${VPSURL}kernel/linux-image-${KERNEL_RELEASE}_amd64.deb wget -O /tmp/linux-headers-${KERNEL_RELEASE}_amd64.deb ${VPSURL}kernel/linux-headers-${KERNEL_RELEASE}_amd64.deb @@ -317,6 +331,7 @@ if [ "$LOCALFILES" = "no" ]; then else cd ${DIR} fi +[ -f /boot/grub/grub.cfg ] && [ -z "$(grep ${KERNEL_VERSION}-mptcp /boot/grub/grub.cfg)" ] && [ -n "$(which grub-mkconfig)" ] && grub-mkconfig -o /boot/grub/grub.cfg rm -f /etc/grub.d/30_os-prober bash update-grub.sh ${KERNEL_VERSION}-mptcp bash update-grub.sh ${KERNEL_RELEASE} @@ -430,7 +445,7 @@ if [ "$SOURCES" = "yes" ]; then rm -f /var/lib/dpkg/lock-frontend cd /tmp #dpkg -i shadowsocks-libev_*.deb - dpkg -i omr-shadowsocks-libev_*.deb + dpkg -i omr-shadowsocks-libev_*.deb 2>&1 >/dev/null #mkdir -p /usr/lib/shadowsocks-libev #cp -f /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION}/src/*.ebpf /usr/lib/shadowsocks-libev #rm -rf /tmp/shadowsocks-libev-${SHADOWSOCKS_VERSION} @@ -530,8 +545,9 @@ if [ "$OMR_ADMIN" = "yes" ]; then apt-get -y install python3-passlib python3-jwt python3-netaddr libuv1 python3-uvloop fi fi - apt-get -y --allow-downgrades install python3-uvicorn jq ipcalc python3-netifaces python3-aiofiles python3-psutil python3-requests + apt-get -y --allow-downgrades install python3-uvicorn jq ipcalc python3-netifaces python3-aiofiles python3-psutil python3-requests pwgen echo '-- pip3 install needed python modules' + echo "If you see any error here, I really don't care: it's about a not used module for home users" #pip3 install pyjwt passlib uvicorn fastapi netjsonconfig python-multipart netaddr #pip3 -q install fastapi netjsonconfig python-multipart uvicorn -U pip3 -q install fastapi jsonschema netjsonconfig python-multipart jinja2 -U @@ -901,6 +917,34 @@ if [ "$WIREGUARD" = "yes" ]; then EOF fi systemctl enable wg-quick@wg0 + if [ ! -f /etc/wireguard/client-wg0.conf ]; then + cd /etc/wireguard + umask 077; wg genkey | tee vpn-client-private.key | wg pubkey > vpn-client-public.key + cat > /etc/wireguard/client-wg0.conf <<-EOF + [Interface] + PrivateKey = $(cat /etc/wireguard/vpn-server-private.key | tr -d "\n") + ListenPort = 65311 + Address = 10.255.246.1/24 + SaveConfig = true + + [Peer] + PublicKey = $(cat /etc/wireguard/vpn-client-public.key | tr -d "\n") + AllowedIPs = 10.255.246.2/32 + EOF + fi + if [ ! -f /root/wireguard-client.conf ]; then + cat > /root/wireguard-client.conf <<-EOF + [Interface] + Address = 10.255.246.2/24 + PrivateKey = $(cat /etc/wireguard/vpn-client-private.key | tr -d "\n") + + [Peer] + PublicKey = $(cat /etc/wireguard/vpn-server-public.key | tr -d "\n") + Endpoint = ${VPS_PUBLIC_IP}:65312 + AllowedIPs = 0.0.0.0/0, ::/0, 192.168.100.0/24 + EOF + fi + systemctl enable wg-quick@client-wg0 echo "Install wireguard done" fi @@ -964,7 +1008,7 @@ if [ "$OPENVPN" = "yes" ]; then make-cadir /etc/openvpn/ca fi cd /etc/openvpn/ca - ./easyrsa init-pki + ./easyrsa init-pki 2>&1 >/dev/null ./easyrsa --batch build-ca nopass EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "openmptcprouter" nopass @@ -1024,6 +1068,7 @@ fi if [ "$SOURCES" = "yes" ]; then rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock-frontend + rm -f /usr/bin/glorytun apt-get install -y --no-install-recommends build-essential git ca-certificates meson pkg-config rm -rf /tmp/glorytun-udp cd /tmp @@ -1068,7 +1113,8 @@ if [ "$SOURCES" = "yes" ]; then cd /tmp rm -rf /tmp/glorytun-udp else - apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-overwrite" install omr-glorytun=${GLORYTUN_UDP_BINARY_VERSION} + rm -f /usr/local/bin/glorytun + apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-overwrite" install --reinstall omr-glorytun=${GLORYTUN_UDP_BINARY_VERSION} GLORYTUN_PASS="$(cat /etc/glorytun-udp/tun0.key | tr -d '\n')" fi [ "$(ip -6 a)" != "" ] && sed -i 's/0.0.0.0/::/g' /etc/glorytun-udp/tun0 @@ -1138,6 +1184,7 @@ if [ "$SOURCES" = "yes" ]; then fi rm -f /var/lib/dpkg/lock rm -f /var/lib/dpkg/lock-frontend + rm -f /usr/bin/glorytun-tcp apt-get -y install build-essential pkg-config autoconf automake rm -rf /tmp/glorytun-0.0.35 cd /tmp @@ -1172,7 +1219,8 @@ if [ "$SOURCES" = "yes" ]; then cd /tmp rm -rf /tmp/glorytun-0.0.35 else - apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-overwrite" install omr-glorytun-tcp=${GLORYTUN_TCP_BINARY_VERSION} + rm -f /usr/local/bin/glorytun-tcp + apt-get -y -o Dpkg::Options::="--force-confdef" -o Dpkg::Options::="--force-confold" -o Dpkg::Options::="--force-overwrite" install --reinstall omr-glorytun-tcp=${GLORYTUN_TCP_BINARY_VERSION} fi [ "$(ip -6 a)" != "" ] && sed -i 's/0.0.0.0/::/g' /etc/glorytun-tcp/tun0 @@ -1281,6 +1329,7 @@ else sed -i 's:10.0.0.2:$OMR_ADDR:g' /etc/shorewall/rules sed -i "s:eth0:$INTERFACE:g" /etc/shorewall6/* fi +[ -z "$(grep nf_conntrack_sip /etc/modprobe.d/blacklist.conf)" ] && echo 'blacklist nf_conntrack_sip' >> /etc/modprobe.d/blacklist.conf if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "10" ]; then apt-get -y install iptables update-alternatives --set iptables /usr/sbin/iptables-legacy diff --git a/multipath b/multipath index e92d0c6..41c3880 100755 --- a/multipath +++ b/multipath @@ -117,7 +117,7 @@ if [ -f /proc/sys/net/mptcp/mptcp_enabled ]; then else ID=$(ip mptcp endpoint show | grep "dev $DEVICE" | awk '{print $3}') IFF=$(ip mptcp endpoint show | grep "dev $DEVICE" | awk '{print $4}') - IP=$(ifconfig $DEVICE | sed -En 's/127.0.0.1//;s/.*inet (addr:)?(([0-9]*\.){3}[0-9]*).*/\2/p') + IP=$(ip a show $DEVICE | sed -En 's/127.0.0.1//;s/.*inet (addr:)?(([0-9]*\.){3}[0-9]*).*/\2/p') RMID=$(ip mptcp endpoint show | grep '::ffff' | awk '{ print $3 }') [ -n "$RMID" ] && ip mptcp endpoint delete id $RMID 2>&1 >/dev/null case $TYPE in diff --git a/omr-service b/omr-service index b55a9c4..9f8bb57 100755 --- a/omr-service +++ b/omr-service @@ -20,26 +20,32 @@ _multipath() { } _glorytun_udp() { - [ -z "$(glorytun show dev gt-udp-tun0 2>/dev/null | grep tunnel)" ] && { - logger -t "OMR-Service" "Restart Glorytun-UDP" - systemctl -q restart 'glorytun-udp@*' - } - for intf in /etc/glorytun-udp/tun*; do - [ "$(echo $intf | grep key)" = "" ] && /etc/glorytun-udp/post.sh ${intf} - done + if [ -n "$(systemctl -a | grep 'glorytun-udp')" ]; then + [ -z "$(glorytun show dev gt-udp-tun0 2>/dev/null | grep tunnel)" ] && { + logger -t "OMR-Service" "Restart Glorytun-UDP" + systemctl -q restart 'glorytun-udp@*' + sleep 10 + } + for intf in /etc/glorytun-udp/tun*; do + [ "$(echo $intf | grep key)" = "" ] && /etc/glorytun-udp/post.sh ${intf} + done + fi } _glorytun_tcp() { - for intf in /etc/glorytun-tcp/tun*; do - [ "$(echo $intf | grep key)" = "" ] && /etc/glorytun-tcp/post.sh ${intf} - done - if [ -f /etc/openmptcprouter-vps-admin/current-vpn ] && [ "$(cat /etc/openmptcprouter-vps-admin/current-vpn)" = "glorytun_tcp" ]; then - localip="$(cat /etc/glorytun-tcp/tun0 | grep LOCALIP | cut -d '=' -f2)" - [ -z "$localip" ] && localip="10.255.255.1" - remoteip="$(echo $localip | sed 's/\.1/\.2/')" - if [ "$(ping -c 5 -w 5 $remoteip | grep '100%')" != "" ] && [ "$(expr $(date +%s) - $(stat -c %Y /proc/$(pgrep glorytun-tcp)/exe ))" -gt "300" ]; then - logger -t "OMR-Service" "No answer from VPN client end, restart Glorytun-TCP" - systemctl restart glorytun-tcp@tun0 + if [ -n "$(systemctl -a | grep 'glorytun-tcp')" ]; then + for intf in /etc/glorytun-tcp/tun*; do + [ "$(echo $intf | grep key)" = "" ] && /etc/glorytun-tcp/post.sh ${intf} + done + if [ -f /etc/openmptcprouter-vps-admin/current-vpn ] && [ "$(cat /etc/openmptcprouter-vps-admin/current-vpn)" = "glorytun_tcp" ]; then + localip="$(cat /etc/glorytun-tcp/tun0 | grep LOCALIP | cut -d '=' -f2)" + [ -z "$localip" ] && localip="10.255.255.1" + remoteip="$(echo $localip | sed 's/\.1/\.2/')" + if [ "$(ping -c 5 -w 5 $remoteip | grep '100%')" != "" ] && ([ -z "$(pgrep glorytun-tcp)" ] || [ "$(expr $(date +%s) - $(stat -c %Y /proc/$(pgrep glorytun-tcp)/exe ))" -gt "300" ]); then + logger -t "OMR-Service" "No answer from VPN client end, restart Glorytun-TCP" + systemctl restart glorytun-tcp@tun0 + sleep 10 + fi fi fi } @@ -49,19 +55,22 @@ _dsvpn() { } _shadowsocks() { - [ -z "$(pgrep ss-server)" ] && { + [ -n "$(systemctl -a | grep 'shadowsocks')" ] && [ -z "$(pgrep ss-server)" ] && { logger -t "OMR-Service" "ss-server not detected, restart Shadowsocks" systemctl restart shadowsocks-libev-manager@manager } } _wireguard() { - [ -z "$(ip a show dev wg0 | grep '10.255.247.1')" ] && ip a add 10.255.247.1/24 dev wg0 2>&1 >/dev/null + if [ -n "$(systemctl -a | grep 'wg')" ]; then + [ -z "$(ip a show dev wg0 | grep '10.255.247.1')" ] && ip a add 10.255.247.1/24 dev wg0 2>&1 >/dev/null + [ -z "$(ip a show dev client-wg0 | grep '10.255.246.1')" ] && ip a add 10.255.246.1/24 dev client-wg0 2>&1 >/dev/null + fi } _omr_api() { - [ -z "$(curl -s -k -m 30 https://127.0.0.1:65500/)" ] && { + [ -z "$(pgrep curl)" ] && [ -z "$(curl -s -k -m 30 https://127.0.0.1:65500/)" ] && { logger -t "OMR-Service" "Restart OMR-Admin" systemctl -q restart omr-admin } @@ -71,7 +80,7 @@ _lan_route() { cat /etc/openmptcprouter-vps-admin/omr-admin-config.json | jq -c '.users[0][]' | while IFS=$"\n" read -r c; do vpnremoteip=$(echo "$c" | jq -r '.vpnremoteip') - if [ -n "$vpnremoteip" ] && [ "$vpnremoteip" != "null" ]; then + if [ -n "$vpnremoteip" ] && [ "$vpnremoteip" != "null" ] && [ -n "$(grep lanips /etc/openmptcprouter-vps-admin/omr-admin-config.json)" ]; then echo "$c" | jq -c -r '.lanips[] //empty' | while IFS=$"\n" read -r d; do network=$(ipcalc -n $d | grep Network | awk '{print $2}') diff --git a/openmptcprouter-shorewall.tar.gz b/openmptcprouter-shorewall.tar.gz index 356841434047882f570e6ccb2c8c8c84ccfd1e9a..67d46c4e05633e7be5618a85267cacb4c9a732fd 100644 GIT binary patch literal 4192 zcmV-m5TEZKiwFPD=uCfpcRXkSbXqNP z1t?zGF5I&%uG4I`n%yqy*JNik%RlcVQ63pQGEC|33;Rl@nw>2BG`p z%;%_9Lv=Tv)}s_tpQidz!IXm_M4o>igbOG30v|bd!74^BPZ+lBAr<+@}%T{0Y7C^l+x z&FyjqZx$qW*^6BM59b$6c9S#P<%(634Pl$L7fv?|b~>GIp`a>ReOWVY)!Z)cyYZbD zL^VGu)Ua9PqU*c5WVtN%3DmqsUammibx*)xN?fm!r*bVQUsT&=_n(T%>_MZdQ#P+}2?6z2z zW3m13aP89mzXojD|Br4MVY}WsZ=f17oyBtQA~{nLGyuzv!2F~5DX3+tgTSocdk?FS zIE8cIC82o2P-rMR}#82F9L6Kw~Afl#Rx2GJqV%vB7oWOj8Q9p=7vNJRBsWX;GQIg z>I5ln6hYq5_1(~!BYkx@_oh%-@usdHxyXso662yrcb3+5fGc7q6#)kb>`62KhFlNw zvFx)`8vI zT#Hx!Ul}H&Njaq1VB0ClZi>YmeqSvAIo?kXFJ(>V%yjO-@YXQR?$Wd9b8;U-x3+@$ z^it_y5!UVk@KXN64vM!nd?gTAI-#>TqVLDBZ~ez{t#=UoK?u-lbedi8|BY_9QTqSa zfPL#fsvpEZ@loVG_{4jCbVAR$n}c77AE|dkz6(ART$D?lnH*y;9<3f8+$e?|LYEdp zzO#U`ckTnYl_zkcz!a^P5c7hQ2R}S_Mqk!{8xniS!GJY%Xzvp~k)E#*d98)fafv>aoqnIoAfC-oV#(l9%{} z-lpjf@2Bhq`(2(ndSB?twSR;tW*UUE4^)26!!Y!Q$fvid8=@hS3nin~JcdR>lkRA^ z5J6w!$i<_P2jz_(9f)9D7rHm}pfmkU6mBQO6dK38*qj5qTUiy9i6|keR_9QmA__dm zThEFACs+@}@nr0=|KI^S1^dso+s)GczXoKXEir&^U7HeK8(zce?w$YL?fDO=a{j*p zTb#s6)B(nmd}1)eD+JN$l;&+p3oPyCMaTdh{3`24riD);}q3Veb8H?WF)t@}TNyKWf+{E1@#Vo44j0=yBV zd&M#jTnI$ABN4oZEQc@BYlb|ORXz<&kilD0zC7M=R)_1DH?DA6&{UN~FG;>7k2mN? zpdWZET2?=@S1q4UHWQto-v@XTTzY+Pe#r2}X6LJjVQ6R*z4E;&(ca?~Wu1Vcd|#2x zktD8>hNM7G+`?0Sj@E3y12N=bEmskHYRwYp(mosTMT*IiCJHs zrjIk}X3-j9^%*L%M>C;%>-g;0kooU(9LXI=#^>XImSel*`Cq5OwKxvbv0STJ#{aJZ z2alVuS6RpR*GXvH-m$f0Q}t-c-9aeX=HSM7AIKL(qJ&+Q@*6w;(s_W$ejWv2wCA1= z_c3~mg!)K< zJMrLhD-eho){j*djJx!jC7$U>lp*5x}oolHU>T#pi&kR4hTa2MRwlw^(GWyN&uCdQ?vs ztTh5Cz6E-tAr+KKLjwj+32bBWI+_Q465%Q)(?kGT4en%|e|SCP4IM9sB@>zpi~WH- zv~}JZ^{S`8;-n}WpVnP@dHSn4;tgpN3+gbGG+761ufB>x$ZxPiBj|B&LJv z>5`%JQu6xJ4d+-NO-nN*B0O}X7#ahbG}5T;u+5PK7KG48kB~9xo3|#eZLeCzigX;~ zBEldKKm{hC4i-@cAypMnjyf6>jDdaF5mbS!g=|q8@Ds)A`LH(5nV}S2?T3Lgn>tZU z7r|%a)jalc=@~4z)gU&XVJ(wQCW1|#dgRe~buOxA=q_{EY6WxpVu@AImLDe4MB1$S z4itT_^cxr-$AK6ymLnKV1IAKk1Q^XR8Cg8>k1(zVSUo`-<71({ZzEVXpZ(L#`kRgh;tlQv{c~he97Nbm9(HD?oS(Qz`Z%V2Kw_+OX z;?umidjY*hB*%McNl1_RD~TlfyeSJdb&WJTo1VQYIP|k5JUGj|8P;H7#LKE}3I^C< zlS&a3eyop8%0o~j-mt-vhUsa8vDB0ae&|UVh!Q5Ut&ybSXB7#x zMJ5++ysYCV7?i(=8?H!zyY5f~SWyTu>8*+*1zzm=_jYzF+m5^?JWN&a}71-p?^gB?tqHGEw(`qvVOo? zL32PgC%UTBQ9PlYXq%J4K>o4!GbR9ADU-7ZgnVL2Kic>`fHtvuod)>o3HVC`Qj%>9 z1iWLP5aKffWBDhk*I3`%xv8a+ppY13T2UMjNdbhJ# zKd7i=ny{!#Is&UF=!U@SkZ)!)`bIOZc<2#Tq=kQy49%wfN0OQc zX5LDIUlWXcx>hHq{+Np_Fj6{RA>sZY+gh@vRz4@S0P8uJ&rNr&q${0#Ua}2lz2eyx zNY^$y@Gq8FFK4#%)(e{54LERL?ij=|d6aa8SIRuPg#nx(>+oXnoa@ULw&Cea+DdDK z0bOm3dGjjG#mY?Y%l*S|4-rJ1$Cj~g|8JA!-m$Glhi!KN8hHOttKBM}|Gx$l&VQzR zesCmRA3M>%S8nLcT=y%t|8&ZoKY!w#KiGy;vxX$^R`$JDA*INB71GQFp!1dZBkd#F z@!=?D=l&mtd^-vUtpbBXxcq0N7`y|Bd~XU!`+Q$kWa}0>4P4_76UpF3;F_McX?4#V zb*^>xuL_exezybJZtOy`yO7*2WOEm?wF}wKBRdzA3~+2G!F6F0bSR2TP!|~WT|&m> zzN3Lv1uP7Gd5>S_!{me+K{SE9Hq74dN0k#y`TjILsPuth8t3G%-T;=_nWQq7_+1di z!E))&j=BwapZ{+)yX*5m?GAqb4?0}>|JQ(*_W!nXu|Q5mes>(ea%BkcXAS{!I&y?# zKwr5TceC7AZHmorhE392JLr<{J!R?I7DcVVIVrJ=Q~GJBFXxn&*rH88BekCkrQ9M* zzX!FS0j1m`qo1nUUwmiv$+xWbmj$vdn%tMJ_A^)${~sKLil@i_0_48)|7?eR|FPX| zG#gE>jr~8{F2DcuDsWQ#@Erx~R?i`1wbtiV@kSP{?1+IjvDU~+?h|>8^b7qMQ{`kG zoimJ_e4^>C8(hK$;EniieEyGZx7Oc(<+?0A|5twh<5l1b&j0;{Rir%rUq=5gM*qZ! z93kvazRj9CqvT_Fs0gyUg-Tu27svW9@lHR$mmcKLj@UKTz%nt5}Qb34ts9Ra(adWJO=9dcefeiNu2i;|-nI>&LgF|s6u<7CBlIL@>T z$KYhsu;9X`hmoyVoPDc0(x6uRDR?07#gStS6wOpDoBZu>#C0XdbwsPLIE=t`#i6Ln zqRWVCl5_dwPZxf4=|LY%yi3#IPC5LyoGduL(fF}Z`^leAf`_br&oMVEKO~D)&1Agb z1in;la4wv0*0V&rB(cL^6v}@-yEy09IrAN%+$7bKHdzPJc)en~-R_hs>WXuv8n&z3 zoAu{@avy~8={zpA@Vv~$G`DrhVo~lBX!&`msx9iuX4Tl6`=z$G+U;^xb&JqASgg0U z)o7P{%hre6YR+e+s(iaVhR)WpPu2z>Yql>|71{Ay=YKFy{OG|O`|&=!$#&S`{{>!X zzvG(_2imR9d83K`zkM!L{{Jmt-T!~`qZs{q^Q=KmiS5l6Q=h20iI5(6b^`97B+ub# zZaM_q`a|%zjA&3e1CCO-c!`3?r-XcvJ`w?j|5Rx3O>+MN5yCGBbbN0{Ba4H9V;bB? zUi3mRhD5$k;_xAP_9Fl9PoBL(rlOQ4BS?gg0^=Bc>h8ILF=Mz7o zVxW1mn1m1XqOXsL=EpIV_5HaYc~fF8@29~SDr>>mpT|D&VzNM7{Nzuvw)U_gcG?gK zfWV%r`FG+6P>!;*UK7svOj^qEgg{??@Dgl)M8XAD{0NPHAyW@pm(@I@U0{PCtc&53 zSc)hQm9ymcg!cEtGD2Zw;wN4(jiJKnUSSWhedS4x_8rjkR6*D~=i^@uT_J?1x}#V< zQNnWs!^Bj;w4E-0-Z&Fl5YroYY^7ysT&cp=|T*BiJ42lG7rX^ zJb948_&#)R6hLRrb5W=#$CZ@hUR7t$;a1fpZ6qs%nbjFIsEmT(^1bK8|0h@t#NlM@ z@c$42+U5Iyt=4(v|K9@g)RsEH@7+YQYoz3~*sqX*33EY^rE6TFf z;{LBmO{BW_TiyG8_1-V@BKyDZd(0lxk__;9Eh&I$XsUF#y4H+7(UcoS%dXX->Reup zEZeE!ZOdX^0&AYNYf+LE)7c<Rt*ZC4z8H?6i>?%+iJ&v^;W+wZDgUKN&fO?X>hk)+{*~>@DQ_R$t5htfn@Ntzp99pfA^Ru@oJywX&ApvWtvrD)I-1%#^Kh?-hJjC98mrRyS% zuH4pg)#PygLxK@Ad`53H_s7(H7s2?q<$^sez*&X2nvZMh{F65gCLb_@qE@>CZ!%uc zxye8rkNrhLWZf=EidQlog4C@gVJ7oAjBx85RQbSSJ?qQ&z1uZ8taZ5@s*D-TA1Uv8 z%I?P0fe6t>UggXKSZ~mj#X+6d#qCgK7w=3JISLmgrbqYQYrOH`Tb3r8n?D=Em$`_R&#q2 zN*{Ck3GM^oY%&(ebb%y4$sTl>5=k ze~a#Fk+tb9py}=@1-L186-=liWq18xW_zu{OL3A)CgY-C@66j-b9W8=A z$#9g@X(9ow0cR?f@88Zu%f#idVuQM{*zc)**A$&W_vrl}cqyya=T%o;zW>7>h?cUB z1#{>thH3(~TVKWzlz5R}|2=UZ{V-V6H3bZJB}FyqkF7Y=0HtecfnYd>JOT>jQmg4b z$jp&|HKrcl2lLB1{h<=_v;1Tlj=gF566v6MrebN`jJ&?^qbb^>?HHCqg-3pzfHGi7 z1B3Yv*B&U~K`4Fv1O=lj`_9JJc8`wGkPhQqWEkWgn7|0k!J)<=Wu^kgQ71!+u`q@m zz!d0O$d#3zIMST%9M;AKHj^Bl^)RttU@enRCW=k( zdKA&PI+t}j@)rf{Q4KkLwZtQ^mY+w;NLg?C78HB>@DDIPOaQT9EC(=}7L29INidp2 zILpuTsK5eWtmZ76+LK1_T6E@3WM2b?s6w)@3_Xp+J^h z)pQ{wi?+hTEuw5#(U*`zRab5C%2sp-PUS4w#kV=JdjY*dq_20b5JT}=p?t1HTa{cE z8yV+(es+%_qMxMs!ATy@(1fLdsOqjQS>S|Iu97AW&7sYBNSY#AF1R#SWDHGBahO1u zDG-HWg1X=?4Q+(CJsFv-Ad%|~6dmtYWJrh3FVtT(@g@e7AfxV@0=SztLx3ZNER&t; zm@J5xyvTRDI0Ow>T2Z#jFDBTZOP?&Nik%}3%SnR&7i~o29Y^0ubeZ>Ep1ESZ5rox~A$1aB`$UMu~CE1u;5U zN7@Xqh*UIMkTI{-t`)^}Eys0MB92kz^j%BarHK@+oTX3ehL&R;jiy+7A9{0r*)$ZP ze`NN!fQdkjT^RYiAJ7h130ULE)J>T+g>|B9k9s}zm+o&!0Pazx+s`Ta$WeZA@z%dF za=PsXgy#{2NDHnM*Xl{QNt+VlHu0hQtI}<(&fUUn(rF$@eK2b%=77r2BS_fY{LQD7 ziY9e5GJ8>yhwIFDGvQ42tcapeX*xj+A$` z9pIx#hWZ6Y&dCT&OND7_c8>&dPXF-8!=JGJhq(jJOsHVosB$)q8O|DIO&Hk)P19L` zICF3Z9zfJwm?s5NFs&7WCHr8eifzMMF6|67QLqn5G@;zir}3>}U5n5wy38v7s#u20 z`jB24x+36D_w+En-J}W4HF$R?&3SF`?b#BYdiX=Gt-vvvxG=*0pt~9J6;`n%^8%}R zSS-!9G-L~$Vp+PcVztoO6v&n|Tkx;eSgm3<%U0`{?F#IZo9$+Y zZ?gSA%~rMl^G%@i{$IA|2Q%sV(2M_P=||qg_rG!bPrKUr^B3OvgFfUaS0sJ5vg^4D ztwo=!P&H?OE;izyX&=#+4+n8u_y2J8+d-JYN*v~L#m@+FxC4lOZwN@Q#4A-(ojd3> zh><^!6ibwWYxcH9vvby{3(b@Nu5ktAk6Vzf#x^9s4Jm9xo^L}ow;@|aWcz}V0gi8{ zxDHH$HbV(1>H<+eres{GKLv3TE*Adepxc0V#($y1zW>wV`G(NK=l??W{hzmi*Y^Lm3b{bR zME-OhzzbCh@K;U&3N~_p*Fe5;Gwyo5Z`u@F+zgvuZ|tB;zxR`0pKef`mN=(1wsFcn z4fOS#vKkw-*=K}yb77PlWZ5T!b~9j<8)WQLMZ2qSZ9e^$(eAoHw)vV%1+PFdKKvH| zcfJ43x6AMU2z;wm#s9Z}j03&OXLd zTP5clr>0-%`QG|gunxEp|2x0`$G0}W|J80*-+y=$_=@-cenk_hUjMGL|5vkr>O>BZ z_NU+G%z{z+F*H&JRo_5mA?mAh{nvPBA7IN~3M#0ef(k0Apn?i2sGx%H3jYU#_)+BmcmM$Jc}Y+J diff --git a/shorewall4/interfaces b/shorewall4/interfaces index fa28d7d..bb8b644 100644 --- a/shorewall4/interfaces +++ b/shorewall4/interfaces @@ -20,6 +20,7 @@ vpn gt-udp-tun+ nosmurfs,tcpflags vpn mlvpn+ nosmurfs,tcpflags vpn tun+ nosmurfs,tcpflags vpn wg+ nosmurfs,tcpflags +vpncl client-wg+ nosmurfs,tcpflags vpn dsvpn+ nosmurfs,tcpflags vpn gre-user+ nosmurfs,tcpflags vpn omr-bonding nosmurfs,tcpflags diff --git a/shorewall4/policy b/shorewall4/policy index 2e5fe13..910acb0 100644 --- a/shorewall4/policy +++ b/shorewall4/policy @@ -19,6 +19,8 @@ fw vpn ACCEPT fw net ACCEPT net all DROP vpn vpn DROP +vpncl vpn ACCEPT +vpn vpncl ACCEPT # THE FOLLOWING POLICY MUST BE LAST all all REJECT diff --git a/shorewall4/shorewall.conf b/shorewall4/shorewall.conf index 11bd54a..be836d4 100644 --- a/shorewall4/shorewall.conf +++ b/shorewall4/shorewall.conf @@ -137,7 +137,7 @@ ADMINISABSENTMINDED=Yes AUTOCOMMENT=Yes -AUTOHELPERS=Yes +AUTOHELPERS=No AUTOMAKE=No @@ -149,13 +149,13 @@ BLACKLIST="NEW,INVALID,UNTRACKED" CLAMPMSS=No -CLEAR_TC=Yes +CLEAR_TC=No COMPLETE=No DEFER_DNS_RESOLUTION=Yes -DELETE_THEN_ADD=Yes +DELETE_THEN_ADD=No DETECT_DNAT_IPADDRS=No @@ -163,7 +163,7 @@ DISABLE_IPV6=No DOCKER=No -DONT_LOAD= +DONT_LOAD=nf_conntrack_sip DYNAMIC_BLACKLIST=Yes @@ -233,7 +233,7 @@ SAVE_ARPTABLES=No SAVE_IPSETS=No -TC_ENABLED=Simple +TC_ENABLED=No TC_EXPERT=No diff --git a/shorewall4/stoppedrules b/shorewall4/stoppedrules index 203a000..30eeac9 100644 --- a/shorewall4/stoppedrules +++ b/shorewall4/stoppedrules @@ -25,4 +25,6 @@ ACCEPT tun+ - ACCEPT - tun+ ACCEPT wg+ - ACCEPT - wg+ +ACCEPT client-wg+ - +ACCEPT - client-wg+ diff --git a/shorewall4/tcinterfaces b/shorewall4/tcinterfaces index 106fbc6..376cc36 100644 --- a/shorewall4/tcinterfaces +++ b/shorewall4/tcinterfaces @@ -1,3 +1,3 @@ #INTERFACE TYPE IN-BANDWIDTH OUT-BANDWIDTH $NET_IFACE External -$VPS_IFACE Internal \ No newline at end of file +#$VPS_IFACE Internal \ No newline at end of file diff --git a/shorewall4/zones b/shorewall4/zones index 62fff26..095a8e6 100644 --- a/shorewall4/zones +++ b/shorewall4/zones @@ -16,4 +16,5 @@ fw firewall net ipv4 vpn ipv4 +vpncl ipv4 From ade517b142296b99e5ee6de93c23346ba21f922b Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Fri, 12 Aug 2022 05:56:12 +0000 Subject: [PATCH 2/5] Fix shorewall configuration on update --- debian9-x86_64.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index 232e25d..edec086 100755 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -1316,6 +1316,7 @@ else cp ${DIR}/shorewall4/shorewall.conf /etc/shorewall/shorewall.conf cp ${DIR}/shorewall4/policy /etc/shorewall/policy cp ${DIR}/shorewall4/params /etc/shorewall/params + cp ${DIR}/shorewall4/zones /etc/shorewall/zones #cp ${DIR}/shorewall4/params.vpn /etc/shorewall/params.vpn #cp ${DIR}/shorewall4/params.net /etc/shorewall/params.net cp ${DIR}/shorewall6/params /etc/shorewall6/params @@ -1328,6 +1329,12 @@ else sed -i 's/^.*#DNAT/#DNAT/g' /etc/shorewall/rules sed -i 's:10.0.0.2:$OMR_ADDR:g' /etc/shorewall/rules sed -i "s:eth0:$INTERFACE:g" /etc/shorewall6/* + if [ "$LOCALFILES" = "no" ]; then + rm -rf ${DIR}/shorewall4 + rm -rf ${DIR}/shorewall6 + rm -f ${DIR}/openmptcprouter-shorewall.tar.gz + rm -f ${DIR}/openmptcprouter-shorewall6.tar.gz + fi fi [ -z "$(grep nf_conntrack_sip /etc/modprobe.d/blacklist.conf)" ] && echo 'blacklist nf_conntrack_sip' >> /etc/modprobe.d/blacklist.conf if [ "$ID" = "debian" ] && [ "$VERSION_ID" = "10" ]; then From c232d34169194820a1d65237dc5a2ccd2f428484 Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Sun, 14 Aug 2022 04:45:44 +0000 Subject: [PATCH 3/5] Fix WG client port --- debian9-x86_64.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index edec086..1b2badf 100755 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -923,7 +923,7 @@ if [ "$WIREGUARD" = "yes" ]; then cat > /etc/wireguard/client-wg0.conf <<-EOF [Interface] PrivateKey = $(cat /etc/wireguard/vpn-server-private.key | tr -d "\n") - ListenPort = 65311 + ListenPort = 65312 Address = 10.255.246.1/24 SaveConfig = true From 657c2b386c436d78de152b85683c492c402a0fc1 Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Tue, 16 Aug 2022 19:47:12 +0000 Subject: [PATCH 4/5] Add Ubuntu 22.04 support --- debian9-x86_64.sh | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/debian9-x86_64.sh b/debian9-x86_64.sh index 1b2badf..879f751 100755 --- a/debian9-x86_64.sh +++ b/debian9-x86_64.sh @@ -99,11 +99,13 @@ fi if [ "$ID" = "debian" ] && [ "$VERSION_ID" != "9" ] && [ "$VERSION_ID" != "10" ] && [ "$VERSION_ID" != "11" ]; then echo "This script only work with Debian Stretch (9.x), Debian Buster (10.x) or Debian Bullseye (11.x)" exit 1 -elif [ "$ID" = "ubuntu" ] && [ "$VERSION_ID" != "18.04" ] && [ "$VERSION_ID" != "19.04" ] && [ "$VERSION_ID" != "20.04" ]; then - echo "This script only work with Ubuntu 18.04, 19.04 or 20.04" +elif [ "$ID" = "ubuntu" ] && [ "$VERSION_ID" != "18.04" ] && [ "$VERSION_ID" != "19.04" ] && [ "$VERSION_ID" != "20.04" ] && [ "$VERSION_ID" != "22.04" ]; then + echo "This script only work with Ubuntu 18.04, 19.04, 20.04 or 22.04" + echo "Use debian when possible" exit 1 elif [ "$ID" != "debian" ] && [ "$ID" != "ubuntu" ]; then - echo "This script only work with Ubuntu 18.04, Ubuntu 19.04, Ubutun 20.04, Debian Stretch (9.x), Debian Buster (10.x) or Debian Bullseye (11.x)" + echo "This script only work with Ubuntu 18.04, Ubuntu 19.04, Ubutun 20.04, Ubuntu 22.04, Debian Stretch (9.x), Debian Buster (10.x) or Debian Bullseye (11.x)" + echo "Use Debian when possible" exit 1 fi @@ -278,6 +280,10 @@ if [ "$ID" = "debian" ]; then elif [ "$ID" = "ubuntu" ]; then echo 'deb http://archive.ubuntu.com/ubuntu bionic-backports main' > /etc/apt/sources.list.d/bionic-backports.list echo 'deb http://archive.ubuntu.com/ubuntu bionic universe' > /etc/apt/sources.list.d/bionic-universe.list + [ "$VERSION_ID" = "22.04" ] && { + apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 3B4FE6ACC0B21F32 + echo 'deb http://old-releases.ubuntu.com/ubuntu impish main universe' > /etc/apt/sources.list.d/impish-universe.list + } fi # Install mptcp kernel and shadowsocks echo "Install mptcp kernel and shadowsocks..." From 3dc18b63b83a68c31475a465043ebb757d9b8aa6 Mon Sep 17 00:00:00 2001 From: "Ycarus (Yannick Chabanois)" Date: Tue, 16 Aug 2022 19:48:58 +0000 Subject: [PATCH 5/5] Add Debian 11 symbolic link --- debian11-x86_64.sh | 1 + 1 file changed, 1 insertion(+) create mode 120000 debian11-x86_64.sh diff --git a/debian11-x86_64.sh b/debian11-x86_64.sh new file mode 120000 index 0000000..814a06c --- /dev/null +++ b/debian11-x86_64.sh @@ -0,0 +1 @@ +debian9-x86_64.sh \ No newline at end of file