Marown/setup-ipsec-vpn
1
0
Fork 0
mirror of https://github.com/hwdsl2/setup-ipsec-vpn.git synced 2024-06-30 09:35:44 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,073 Commits 1 Branch 0 Tags 20 MiB
39f1e272a0
Commit Graph

280 Commits

Author SHA1 Message Date
hwdsl2
102ccbc17d Clean up VPN ciphers 
- Remove aes256-sha2_512
- Change sha2-truncbug to no for newer Android versions
- Fixes #303
 2018-05-05 18:51:24 -05:00
hwdsl2
0c6cb4b8a9 Update year 2018-05-05 18:49:38 -05:00
hwdsl2
240a0187f6 Update Linux kernel check 2018-05-04 03:16:58 -05:00
hwdsl2
6a5c14b873 Minor fix 2018-05-03 01:34:05 -05:00
hwdsl2
3c9c3d25a7 Add check for Linux kernel 4.15 2018-05-03 00:52:14 -05:00
hwdsl2
632165685a Add iptables dependency 
- Closes #363
- Thanks @rocboronat!
 2018-05-02 02:58:45 -05:00
Aofei Sheng
a06995d35d Fix iproute for Ubuntu 18.04 (#375) 
The iproute package has been deprecated in Ubuntu 18.04.
 2018-05-01 01:34:04 -05:00
hwdsl2
21228a8caf Improve RPi workarounds 
- Improve workarounds for systems with ARM CPU (e.g. Raspberry Pi)
- Check for ARM architecture instead of checking for Raspbian
 2018-02-03 16:55:54 -06:00
hwdsl2
0cf01c0eb8 Update ipsec.conf 
- Switch to new keyword 'modecfgdns' in Libreswan 3.23
 2018-01-29 02:11:16 -06:00
hwdsl2
3d2b6fc861 Remove RPi workaround 2018-01-29 02:06:08 -06:00
hwdsl2
c982502ad4 Upgrade Libreswan to 3.23 
- Remove 'docker-targets.mk' from Makefile to avoid git errors
  during compilation
 2018-01-29 01:22:24 -06:00
hwdsl2
cc64a29c01 Re-add RPi workaround 
- Libreswan 3.22 may fail to compile on Raspberry Pi w/ Raspbian 9
- Use version 3.21 instead of 3.22 for Raspbian systems
- Ref: d472c65
 2017-12-06 04:55:22 -06:00
hwdsl2
d472c65f8c Remove RPi workaround 
- No longer needed with fix 2dfa587 and 8b40709
- Ref: 1488ac0
 2017-11-13 00:19:21 -06:00
hwdsl2
8b40709d4d Improve VPN ciphers 
- Remove unsupported ESP algorithm on Raspbian
 2017-11-13 00:12:16 -06:00
hwdsl2
2dfa587a71 Fix Libreswan 3.22 bug 
- This bug causes Libreswan 3.22 fail to start on a Raspberry Pi
- Apply fix from Libreswan GitHub repo: libreswan/libreswan@e154ae7
- Ref: https://lists.libreswan.org/pipermail/swan/2017/002338.html
 2017-11-12 23:51:53 -06:00
hwdsl2
7190577c99 Minor clean up 2017-11-01 22:15:56 -05:00
hwdsl2
70c6d6b540 Various clean up 2017-11-01 01:01:49 -05:00
hwdsl2
b7a4bed866 Improve startup 
- Ubuntu 16.04 (and newer) may run apt tasks automatically on boot
- If used as a startup script, apt-get commands could fail due to this
- Wait for apt/dpkg lock (up to 60s) as a workaround
- Ref: #252
 2017-10-30 01:56:00 -05:00
hwdsl2
16e437f58e Minor clean up 
- Wrap the scripts in a big function which is only called at the very end,
  to protect against the possibility of connection interruptions
- Clean up some variables names
 2017-10-29 19:53:35 -05:00
hwdsl2
05c2cb911b Improve sysctl settings 
- Fix kernel.shmmax and kernel.shmall on 32-bit Linux. Thanks @komanshidaruma!
- Clean up other sysctl settings
 2017-10-28 15:40:24 -05:00
hwdsl2
1488ac0ce8 Workaround for Raspberry Pi 
- Libreswan version 3.22 does not start on Raspberry Pi
- Install version 3.21 on these systems as a workaround
 2017-10-27 00:14:38 -05:00
hwdsl2
ef90b6ff19 Upgrade Libreswan to 3.22 2017-10-26 01:48:15 -05:00
hwdsl2
47e1c92051 Clean up ipsec.conf 
- Remove unneeded option nhelpers=0
 2017-10-26 01:48:15 -05:00
hwdsl2
d7e420340c Workaround for Netplan 
- Newer Ubuntu versions use netplan instead of ifupdown by default for
  network configuration
- Scripts in /etc/network/if-pre-up.d/ does not work under netplan
- Add workaround in /etc/rc.local for the above
 2017-10-26 01:47:26 -05:00
hwdsl2
9cd6cb50b7 Clean up packages 
- Remove libunbound-dev / unbound-devel (these packages are not needed
  because we are not enabling DNSSEC)
  Ref: https://github.com/libreswan/libreswan/issues/117
 2017-10-02 20:33:24 -05:00
hwdsl2
23c4a287d3 Use parallel make 
- Speed up Libreswan compilation using parallel make ("-j" option)
 2017-09-28 01:11:03 -05:00
hwdsl2
f46e18cffc Skip building manpages 
- Skip building manpages for Libreswan
- No longer need/install "xmlto" package
- Reduce Libreswan compilation time by ~30%
 2017-09-28 00:15:08 -05:00
hwdsl2
536ac8f54b Update ipsec.conf 
- Replace obsolete keyword "virtual_private" with "virtual-private"
 2017-09-27 21:41:24 -05:00
hwdsl2
82da3121b1 Enable MS-CHAP v2 
- Allow MS-CHAP v2 for better compatibility with the built-in Windows 10
  VPN client. Thanks @remini1998!
 2017-09-25 00:28:10 -05:00
hwdsl2
98a3f29407 Improve RPi fix 
- Minor improvement to Raspberry Pi fix
 2017-09-23 14:26:55 -05:00
hwdsl2
dc71db3451 Fixes for Raspberry Pi 
- Change "start" to "restart", so that the 15-second delay actually works
  (wait for network interfaces to initialize)
- Workaround for Raspbian 9 (requires left=$PRIVATE_IP in ipsec.conf)
 2017-09-21 02:00:44 -05:00
hwdsl2
3f2b2cbc0b Remove Debian 7 
- Remove support for Debian 7 (Wheezy)
- Libreswan 3.21 no longer compiles on Debian 7 or Ubuntu 12.04
- Fix tests by switching to Ubuntu 14.04
 2017-08-20 11:50:46 -05:00
hwdsl2
caf9293b8a New Libreswan version 3.21 2017-08-20 10:52:28 -05:00
hwdsl2
8ac1573106 Minor clean up 2017-06-21 11:59:07 -05:00
hwdsl2
cf595eaee7 Improve services on boot 
- Systemd may run rc.local early during system boot
- Insert delay so that services can start correctly
 2017-06-21 00:02:03 -05:00
hwdsl2
5e3689198f Improve network interfaces 
- Better detection of default network interface when the 'route'
  command is not available
 2017-06-20 23:59:13 -05:00
hwdsl2
47a9015135 Improve VPN ciphers 
- Add 3des-sha2 to allowed VPN ciphers, and clean up
 2017-06-02 14:24:55 -05:00
DL6ER
748d89bb4b
Add 3des-sha2 to both ike= and phase2alg= lines. Fixes #154 2017-06-02 18:20:23 +02:00
hwdsl2
8fb4bf7897 Minor clean up 2017-05-22 11:46:28 -05:00
hwdsl2
d711e2aee6 Improve network interfaces 
- Try to auto detect server's default network interface
- Display a warning if the default interface is wlan*
 2017-05-17 17:24:19 -05:00
hwdsl2
cf75c2bb86 Improve network interfaces 
- Use eth0 instead of eth+ throughout for consistency
- Improve error messages when eth0 is unavailable
 2017-04-30 17:16:33 -05:00
hwdsl2
cebf9f4361 Minor clean up 2017-04-12 10:38:57 -05:00
hwdsl2
f58afbc84b Update VPN ciphers 
- Add aes256-sha2_512 to the list of allowed ciphers
- Required for Android 7.1.x and (possibly) Chromebook
 2017-04-12 10:17:08 -05:00
hwdsl2
67474fddc9 Improve VPN variables 
- Check VPN credentials for non-ASCII characters
- Ref: #130
 2017-04-07 13:55:46 -05:00
hwdsl2
222acbf5ae New Libreswan version 
- New Libreswan version 3.20
- Use GitHub as primary download source
 2017-03-23 13:55:51 -05:00
hwdsl2
6d9eb9a2fa Improve OS detection 
- Fix OS detection on Debian when lsb_release is not available
- Closes #123
 2017-03-23 12:39:01 -05:00
hwdsl2
347f3fdbfe Improve IPTables rules 
- Improve blocking of unencrypted L2TP without IPsec
- Closes #116. Thanks @ryt51V!
 2017-02-18 08:53:00 -06:00
hwdsl2
08e08c6924 Improve customization 
- Use variables for easier customization of VPN subnets and DNS
- Other minor improvements
 2017-02-11 21:36:37 -06:00
hwdsl2
03007079e6 Improve VPN IPs 
- Use %defaultroute and iptables MASQUERADE, no need to detect private IP
- Use %any for the first field of ipsec.secrets, instead of public IP
- As a result, the VPN server should now better adapt to IP changes.
 2017-02-10 18:00:29 -06:00
hwdsl2
63697214b4 Improve VPN ciphers 
- Consolidate VPN ciphers for "ike=" and "phase2alg=" in ipsec.conf.
 2017-01-18 23:01:09 -06:00
hwdsl2
e40dd6219b Bugfix 
- Libreswan 3.19 removed MODP1024 from the ike= default list,
  which breaks compatibility with Android 5.x and others
- This commit explicitly adds MODP1024 back to the ike= list
- Fixes #101. Thanks @keijodputt!
 2017-01-18 20:10:43 -06:00
hwdsl2
2727f1a1a0 Update year 2017-01-16 22:13:13 -06:00
hwdsl2
85ac19fc70 Minor fix 
- Use the "fixed strings" option in "grep" commands for "swan_ver",
  so that the "." in this variable is treated literally.
 2017-01-16 17:31:38 -06:00
hwdsl2
2dbdee1287 Upgrade to Libreswan 3.19 
- Upgrade to new Libreswan version 3.19
- Some changes are required in the VPN config files
- Ref:
  https://lists.libreswan.org/pipermail/swan-announce/2017/000023.html
 2017-01-16 12:30:37 -06:00
hwdsl2
ba0fbb3860 Improve script outputs 2017-01-09 02:50:03 -06:00
hwdsl2
9500da3231 Bugfix 
- Fix commit ca84aa7 to avoid a possible race condition
  when starting ipsec and xl2tpd services on boot
 2017-01-06 00:51:59 -06:00
hwdsl2
ca84aa7a13 Improve services on boot 2017-01-04 02:21:09 -06:00
hwdsl2
89d75f7243 Bugfix for Android 6 and 7 
- Add "sha2-truncbug=yes" to /etc/ipsec.conf to fix VPN connections
  on Android 6 (Marshmallow) and 7 (Nougat)
- Ref: https://libreswan.org/wiki/FAQ#Configuration_Matters
 2017-01-03 22:40:48 -06:00
hwdsl2
9ea2b50dae Improve OS detection 
- Check /etc/lsb-release if command "lsb_release" is missing
 2017-01-02 09:16:01 -06:00
hwdsl2
69caa65512 Improve options 
- Remove some xl2tpd (pppd) options for Ubuntu/Debian
- They are not recognized in the new xl2tpd version 1.3.8
- Ref: 261e472
 2016-12-30 16:16:33 -06:00
hwdsl2
6479212c45 Improve workaround 
- Improve workaround for non-eth0 network interfaces
- Fixed an issue where it cannot be used with sudo
 2016-11-28 13:11:57 -06:00
hwdsl2
61bd1254ed Minor clean up 2016-11-10 13:02:04 -06:00
hwdsl2
6d99a01b0a Remove SHA2 workaround 
- Libreswan 3.18 and higher prefers sha2_512 over sha2_256
- The 'sha2-truncbug=yes' workaround is no longer needed
- Ref: https://libreswan.org/wiki/FAQ#Configuration_Matters
 2016-11-06 14:40:30 -06:00
hwdsl2
6e16712bc5 Minor clean up 2016-10-31 01:59:11 -05:00
hwdsl2
9319ce8ae2 Clean up IPTables rules 
- Only add the necessary IPTables rules for the VPN
- Other minor clean ups
 2016-10-29 18:00:24 -05:00
hwdsl2
e3d830dfd4 Improve services on boot 
- Better handling of starting IPTables & Fail2Ban on boot
- Use iptables-services and disable firewalld for CentOS 7
 2016-10-29 18:00:11 -05:00
hwdsl2
895d46c0c9 Fix for Raspbian 
- On Raspberry Pis /etc/rc.local can run early during boot
- If the network is not ready, IPsec may fail to start
- A delay has been added as a workaround. Ref: #76
 2016-10-25 21:32:52 -05:00
hwdsl2
6f2818753a Minor improvements and clean up 2016-10-10 22:34:51 -05:00
hwdsl2
4c6de2af29 Improve network interfaces 
- Better handling of non-eth0 network interfaces
- Now easier to use on servers with new interface names
 2016-10-10 16:49:46 -05:00
hwdsl2
0e51150d84 Check VPN credentials 
- If the provided VPN credentials contain \ " or ', exit with error
- The above special characters can cause issues with the VPN
 2016-09-23 14:31:10 -05:00
hwdsl2
cce15b7f08 Improve IP checking 
- Use a function to simplify code for IP checking
- Remove new lines before matching with IP regex
 2016-09-23 00:39:36 -05:00
hwdsl2
7cdd372a6e Improve IPTables rules 
- Fixed an uncommon use case where the setup script is run again after
  a server IP change. Make sure to update IPTables rules in this case.
- Thanks @larryisthere! Ref: #17
 2016-09-21 21:06:22 -05:00
hwdsl2
7937a74469 Improve IP detection 
- Remove unneeded code for Amazon EC2
- Check IPs for correct format after each try
 2016-09-09 15:41:02 -05:00
hwdsl2
96a071ebc5 Improve VPN ciphers 
- Add stronger cipher options
- Fix for Android 6.0 VPN clients
 2016-08-26 00:21:10 -05:00
hwdsl2
14767d354f Reduce wget timeout 2016-08-11 22:12:22 -05:00
Kenneth Endfinger
d3651890bd Add support for Raspbian 2016-08-11 15:06:50 -04:00
hwdsl2
335b4035b9 Minor clean up 2016-08-07 14:00:07 -05:00
hwdsl2
077b119274 New Libreswan version 3.18 2016-07-29 12:55:08 -05:00
hwdsl2
004c68f6ad Improve readability and clean up 2016-07-12 22:43:41 -05:00
hwdsl2
1f76dc169a Better handling of custom SSH port 2016-07-10 00:47:41 -05:00
hwdsl2
7bece1681d Minor improvements and clean up 2016-07-03 21:28:27 -05:00
hwdsl2
ac91fa9b79 Improve error output 2016-06-29 03:22:21 -05:00
hwdsl2
8336260799 Minor improvement to 'tr' 2016-06-29 03:20:49 -05:00
hwdsl2
c28f9b0928 Prepare for new requirements 
- New requirements in Libreswan 3.18 (not released yet)
- libsystemd-dev (Ubuntu/Debian) or systemd-devel (CentOS)
- Applies only to systemd-based Linux distributions
 2016-06-28 17:49:18 -05:00
hwdsl2
d32b449f46 Improve IP detection 2016-06-26 13:00:11 -05:00
hwdsl2
f0804e5184 Remove IP6Tables rules 
- Not needed for the VPN to work
 2016-06-26 01:09:13 -05:00
hwdsl2
fa704629f0 Improve backup of IPTables rules 2016-06-26 00:56:12 -05:00
hwdsl2
de6f4a45ad Minor improvements and clean up 2016-06-21 03:54:47 -05:00
hwdsl2
59c7227587 Improve defining VPN variables 2016-06-11 15:36:43 -05:00
hwdsl2
deb2f75eb9 Improve eth0 detection 2016-06-10 22:05:26 -05:00
hwdsl2
8a75d02751 Improve xl2tpd options 2016-06-10 19:34:59 -05:00
hwdsl2
e3bdaeba52 Improve error output and clean up 
- Output all error messages to STDERR
- Minor improvements and clean up
 2016-06-07 19:29:30 -05:00
hwdsl2
feaeadb41a Minor fix for IPTables rules 2016-06-06 12:18:22 -05:00
hwdsl2
6643a8cd87 Add fallback URL for Libreswan 2016-06-05 18:24:15 -05:00
hwdsl2
9317f4824d Improve IPTables rules for VPN 
- Allow traffic between VPN clients themselves by default
- Add notes on how to change this behavior (uncomment rules)
 2016-06-05 17:34:24 -05:00
hwdsl2
371b5c3e7f Minor improvements and clean up 2016-06-05 00:26:56 -05:00
hwdsl2
9ce1769208 Minor improvement to IPsec config 2016-06-03 16:44:37 -05:00
hwdsl2
96d6f4b3e3 Improve Debian 7 workaround note 2016-06-02 11:09:17 -05:00
hwdsl2
3e1ea78f15 Improve defining VPN variables 2016-06-01 21:27:29 -05:00
Dustin Oprea
34c6511ebe Added execute bit to scripts. 2016-05-27 21:06:25 -04:00
hwdsl2
a1dd7c687b Minor changes in wording 2016-05-26 14:31:11 -05:00
hwdsl2
9e300f3907 Use lowercase variable names 2016-05-21 05:34:19 -05:00
hwdsl2
8628301d28 Minor improvements and clean up 2016-05-21 03:59:08 -05:00
hwdsl2
b25e88c1b1 Minor improvements and clean up 2016-05-19 11:10:36 -05:00
Dustin Oprea
d692e243c0 Renamed PSK variable and adjusted IP variables. 2016-05-18 22:46:28 -04:00
Dustin Oprea
6fb736775b Removed quotes due to restrictions. 2016-05-18 02:53:30 -04:00
Dustin Oprea
cb946063d2 We default the IPs from the environment, too. 2016-05-18 02:53:30 -04:00
Dustin Oprea
4c0c134102 Default the PSK, username, and password from the environment. 2016-05-18 02:53:30 -04:00
hwdsl2
f38f8a7a36 Reduce output verbosity and clean up 2016-05-17 00:13:16 -05:00
hwdsl2
ff8dd58749 🎉 Feature: Add support for IPsec/XAUTH 2016-05-16 13:56:05 -05:00
hwdsl2
49a74df63b Feature: Auto-generate VPN credentials 2016-05-14 11:01:32 -05:00
hwdsl2
018309a328 Improve Debian 7 workaround 2016-05-11 17:18:18 -05:00
hwdsl2
81a731eb5d Set PATH to avoid issues on some systems 
Reference: #19
 2016-05-11 16:36:07 -05:00
hwdsl2
a166285504 Use git.io shortened URLs 2016-05-11 16:26:30 -05:00
hwdsl2
f5e2c87db9 Minor improvements and clean up 2016-04-22 11:54:14 -05:00
hwdsl2
4003b82485 Make sure basic commands exist 2016-04-22 11:52:33 -05:00
hwdsl2
3ca9af7858 Fix detection of Wget errors 
Wget writes out a zero-byte file on certain failures such as 404.
We should check its exit code instead of checking whether the file exists.
 2016-04-20 21:42:55 -05:00
hwdsl2
af23dd290f Minor improvements and clean up 2016-04-20 17:31:29 -05:00
hwdsl2
8e388a07d3 Display VPN details after install 2016-04-17 17:10:33 -05:00
hwdsl2
04c8155791 Minor improvements and clean up 2016-04-07 12:20:08 -05:00
Lin Song
d909b986cf Add support for Ubuntu 16.04 (Xenial) 2016-04-07 12:18:06 -05:00
hwdsl2
4976bde854 Update Libreswan version to 3.17 2016-04-05 23:51:54 -05:00
hwdsl2
01b5cf1c6b Minor improvement to ignore IPv6 errors 2016-02-08 10:46:06 -06:00
hwdsl2
39c9249c3b Minor improvements and clean up 2016-01-30 13:12:15 -06:00
hwdsl2
5f617a30cb Update copyright year 2016-01-25 10:38:07 -06:00
hwdsl2
f8b91f65a4 Check for iptables-persistent and copy new rules 2016-01-22 11:14:58 -06:00
hwdsl2
ab98a9e6b0 Clean up sysctl.conf settings 2016-01-21 17:00:51 -06:00
hwdsl2
684761015e Minor improvements and clean up 2016-01-21 11:50:35 -06:00
hwdsl2
b61035137f Important: Fixed an error in IP format checking. 
- Due to a mistake in the "grep" command, empty strings would pass the IP
  regex checks, which is not OK.
- Please update your VPN scripts with this commit!
 2016-01-21 09:45:31 -06:00
hwdsl2
f47d78b0f1 Improve the process of defining VPN variables 
- Put variables inside single quotes to avoid escaping them
- Make clear which characters should not be used in values

Thanks for your helpful suggestions, @Langleson !
 2016-01-21 02:12:30 -06:00
hwdsl2
acb2000e40 Minor changes in wording and some optimizations 2016-01-19 02:29:01 -06:00
hwdsl2
9609b0b7b5 Add check for network interface eth0 2016-01-19 01:26:12 -06:00
hwdsl2
7ca9723e45 Minor changes in wording 2016-01-19 01:23:17 -06:00
hwdsl2
7f3b94308d Small improvement to OS detection 2016-01-17 20:17:18 -06:00
hwdsl2
d82d6d00b3 Update comments in the VPN scripts 2016-01-17 17:05:35 -06:00
hwdsl2
4ab84f14aa Update sysctl.conf settings and IPTables rules 2016-01-17 14:29:30 -06:00
hwdsl2
a15e502056 Update sysctl.conf settings, and add IP6Tables rules 2016-01-17 12:17:26 -06:00
hwdsl2
28d7da66c8 Better handling of existing config files 2016-01-17 00:41:12 -06:00
hwdsl2
9010327a33 Correct small error in notes about escaping characters 2016-01-15 11:05:40 -06:00
hwdsl2
79887bb458 Add notes about escaping characters in VPN variables 
Thanks to @sohailmamdani for reminding me on this!
 2016-01-15 10:01:40 -06:00
hwdsl2
7cfe17f1a2 Update important notes 2016-01-14 23:27:34 -06:00
hwdsl2
21629ae178 Update VPN scripts for better usability 
- Improve detection of public and private IPs
- Test for empty IPSEC_PSK, VPN_USER and/or VPN_PASSWORD
- Check for OpenVZ VPS, which is unsupported
 2016-01-14 17:42:32 -06:00
hwdsl2
59c2817731 Quote VPN credentials in chap-secrets for safety 2016-01-14 15:05:50 -06:00
hwdsl2
46a3f9e0b1 Added note for Android 6.0 users 
Android 6.0 users must enable SHA2 in /etc/ipsec.conf.
Thanks @rodolfobandeira for the hint!
Ref: 544a25ab77
 2016-01-14 14:33:51 -06:00
hwdsl2
dec1b44091 Update VPN scripts for better security and usability 
- Install Fail2Ban to protect SSH server from web attacks
- Check public/private IPs against regex for the correct format
- Use printf instead of "read -r -p" for better POSIX compliance
- Other small code enhancements to the scripts
- Update README.md to add "OS update" to Installation
 2016-01-12 21:33:16 -06:00
hwdsl2
965ec7ff39 Create working dir before package install 2016-01-08 09:40:57 -06:00
Lin Song
2aaaf44385 Combined Revisions 
combined revisions
 2016-01-04 15:13:10 -06:00
Lin Song
ec06bfae19 2015-07-23 12:49:02 -05:00
hwdsl2
d541f0d9b4 Merge serveral revisions 2015-07-14 11:57:38 -05:00
hwdsl2
734f561494 Merged revisions 2015-07-04 00:49:31 -05:00