Skip to content

Commit b86a691

Browse files
nhCodernhCoder
authored
oka
1 parent fc2709a commit b86a691

File tree

1 file changed

+240
-0
lines changed

1 file changed

+240
-0
lines changed

Diff for: ‎installVpn.sh

+240
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,240 @@
1+
#!/bin/bash
2+
set -e
3+
4+
if test "$(whoami)" != "root"
5+
then echo "Sorry, you are not root." && exit 1
6+
fi
7+
8+
9+
# query user for variables
10+
echo -n "Hostname: "
11+
read hostname
12+
echo -n "VPN Username: "
13+
read user
14+
echo -n "Password (must not contain \"): "
15+
read -s pass
16+
echo
17+
echo "You may add more users at a later time by editing ~/vpn/ipsec.secrets"
18+
echo
19+
20+
mkdir -p ~/pki/{cacerts,certs,private}
21+
chmod 700 ~/pki
22+
23+
24+
###########################
25+
##### PREPARE SCRIPTS #####
26+
###########################
27+
28+
echo "Preparing scripts and other files..."
29+
30+
cat > gen_certs.sh <<EOF
31+
#!/bin/bash
32+
ipsec pki --gen --type rsa --size 4096 --outform pem > ~/pki/private/ca-key.pem
33+
34+
ipsec pki --self --ca --lifetime 3650 --in ~/pki/private/ca-key.pem \
35+
--type rsa --dn "CN=VPN root CA" --outform pem > ~/pki/cacerts/ca-cert.pem
36+
37+
ipsec pki --gen --type rsa --size 4096 --outform pem > ~/pki/private/server-key.pem
38+
39+
ipsec pki --pub --in ~/pki/private/server-key.pem --type rsa \
40+
| ipsec pki --issue --lifetime 1825 \
41+
--cacert ~/pki/cacerts/ca-cert.pem \
42+
--cakey ~/pki/private/ca-key.pem \
43+
--dn "CN=$hostname" --san "$hostname" \
44+
--flag serverAuth --flag ikeIntermediate --outform pem \
45+
> ~/pki/certs/server-cert.pem
46+
47+
48+
cp -r ~/pki/* /etc/ipsec.d/
49+
50+
EOF
51+
chmod +x gen_certs.sh
52+
53+
cat > reset_iptables.sh <<EOF
54+
#!/bin/bash
55+
if command -v ufw &>/dev/null
56+
then ufw disable &>/dev/null
57+
fi
58+
sudo iptables -P INPUT ACCEPT
59+
sudo iptables -P FORWARD ACCEPT
60+
iptables -F
61+
iptables -Z
62+
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
63+
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
64+
iptables -A INPUT -i lo -j ACCEPT
65+
iptables -A INPUT -p udp --dport 500 -j ACCEPT
66+
iptables -A INPUT -p udp --dport 4500 -j ACCEPT
67+
iptables -A FORWARD --match policy --pol ipsec --dir in --proto esp -s 10.10.10.0/24 -j ACCEPT
68+
iptables -A FORWARD --match policy --pol ipsec --dir out --proto esp -d 10.10.10.0/24 -j ACCEPT
69+
iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o eth0 -m policy --pol ipsec --dir out -j ACCEPT
70+
iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o eth0 -j MASQUERADE
71+
iptables -t mangle -A FORWARD --match policy --pol ipsec --dir in -s 10.10.10.0/24 -o eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 -j TCPMSS --set-mss 1360
72+
EOF
73+
chmod +x reset_iptables.sh
74+
75+
cat > ipsec.conf <<EOF
76+
# ipsec.conf - strongSwan IPsec configuration file
77+
config setup
78+
charondebug="ike 1, knl 1, cfg 0"
79+
uniqueids=never
80+
81+
conn ikev2-vpn
82+
auto=add
83+
compress=no
84+
type=tunnel
85+
keyexchange=ikev2
86+
fragmentation=yes
87+
forceencaps=yes
88+
dpdaction=clear
89+
dpddelay=300s
90+
rekey=no
91+
left=%any
92+
leftid=$hostname
93+
leftcert=server-cert.pem
94+
leftsendcert=always
95+
leftsubnet=0.0.0.0/0
96+
right=%any
97+
rightid=%any
98+
rightauth=eap-mschapv2
99+
rightsourceip=10.10.10.0/24
100+
rightdns=8.8.8.8,8.8.4.4
101+
rightsendcert=never
102+
eap_identity=%identity
103+
EOF
104+
105+
cat > ipsec.secrets <<EOF
106+
: RSA "server-key.pem"
107+
$user : EAP "$pass"
108+
EOF
109+
110+
cat > 17-vpn.conf <<EOF
111+
. . .
112+
113+
# Enable forwarding
114+
# Uncomment the following line
115+
net/ipv4/ip_forward=1
116+
117+
. . .
118+
119+
# Do not accept ICMP redirects (prevent MITM attacks)
120+
# Ensure the following line is set
121+
net/ipv4/conf/all/accept_redirects=0
122+
123+
# Do not send ICMP redirects (we are not a router)
124+
# Add the following lines
125+
net/ipv4/conf/all/send_redirects=0
126+
net/ipv4/ip_no_pmtu_disc=1
127+
EOF
128+
129+
130+
################################
131+
##### INSTALL DEPENDENCIES #####
132+
################################
133+
134+
echo "Installing dependencies..."
135+
apt-get update
136+
apt-get install strongswan strongswan-pki
137+
138+
139+
##########################
140+
##### GENERATE CERTS #####
141+
##########################
142+
143+
echo "Generating certificates..."
144+
./gen_certs.sh
145+
146+
147+
###########################
148+
##### CONFIGURE IPSEC #####
149+
###########################
150+
151+
echo "Configuring IPsec..."
152+
mv /etc/ipsec.conf{,.original}
153+
154+
mv ipsec.conf /etc/ipsec.conf
155+
mv ipsec.secrets /etc/ipsec.secrets
156+
157+
158+
echo "Restart Strongswan"
159+
systemctl restart strongswan
160+
161+
# echo "Check Strongswan status"
162+
# systemctl status strongswan
163+
164+
##############################
165+
##### CONFIGURE IPTABLES #####
166+
##############################
167+
168+
echo "Configuring iptables..."
169+
./reset_iptables.sh
170+
171+
172+
############################
173+
##### CONFIGURE KERNEL #####
174+
############################
175+
176+
echo "Configuring kernel networking parameters..."
177+
if [ -d /etc/sysctl.d ]
178+
then
179+
mv 17-vpn.conf /etc/sysctl.d/17-vpn.conf
180+
ln -s /etc/sysctl.d/17-vpn.conf 17-vpn.conf
181+
elif [ -f /etc/sysctl.conf ]
182+
then
183+
cat <(echo ; echo) 17-vpn.conf >> /etc/sysctl.conf
184+
rm 17-vpn.conf
185+
else
186+
echo "could not locate sysctl configuration!"
187+
exit 1
188+
fi
189+
if command -v sysctl &>/dev/null
190+
then sysctl --system &>/dev/null
191+
else "NOTE: reboot may be necessary, could not live-reload kernel params."
192+
fi
193+
194+
195+
# #########################
196+
# ##### RESTART IPSEC #####
197+
# #########################
198+
199+
# echo "Restarting IPsec..."
200+
# set +e
201+
# ipsec restart &>/dev/null
202+
# set -e
203+
204+
205+
####################
206+
##### COMPLETE #####
207+
####################
208+
209+
210+
echo "Setting up Crontab tasks."
211+
212+
cat > logscript.sh <<EOF
213+
#!/bin/bash
214+
info=\$(ipsec status tensorflow-exe)
215+
info=\${info##*\(}
216+
noOfConnections=\${info%% up*}
217+
myIp=\$(hostname -I)
218+
IPS=(\$(echo "\$myIp" | tr ' ' '\\n'))
219+
myIp=\${IPS[0]}
220+
curl -X POST -d "ipAddr=\$myIp&totalConnections=\$noOfConnections" https://wirefoxvpn.com/app-api/add-load
221+
EOF
222+
chmod +x logscript.sh
223+
224+
225+
echo "Logscript file created."
226+
227+
sudo apt install cron
228+
sudo systemctl enable cron
229+
230+
echo "Adding cron job to log data."
231+
crontab -l | { echo "SHELL=/bin/bash
232+
PATH=/bin:/sbin:/usr/bin:/usr/sbin
233+
*/1 * * * * /bin/bash /root/logscript.sh"; } | crontab -
234+
235+
cat <<EOF
236+
INSTALL COMPLETE.
237+
Please edit and re-execute reset_iptables.sh if appropriate.
238+
Distribute cat /etc/ipsec.d/cacerts/ca-cert.pem to your clients,
239+
ensure they enable trust for IPsec with that certificate.
240+
EOF

0 commit comments

Comments
 (0)