Marown/setup-ipsec-vpn
1
0
Fork 0
mirror of https://github.com/hwdsl2/setup-ipsec-vpn.git synced 2024-07-03 19:15:40 +02:00
Code Issues Packages Projects Releases Wiki Activity
785 Commits 1 Branch 0 Tags 20 MiB
c6cfd1fe49
Commit Graph

207 Commits

Author SHA1 Message Date
hwdsl2
f0c1f3bcb1 Update IKEv2 script 
- New: Create .sswan files to simplify Android IKEv2 client setup and
  improve VPN performance
- Cleanup
 2021-01-23 16:02:59 -06:00
hwdsl2
3611ed5981 Update IKEv2 script 
- Minor fix: Set permission for the generated .mobileconfig file to 600,
  same as the exported .p12 file.
 2021-01-23 00:20:09 -06:00
hwdsl2
47b5cd01c1 Update IKEv2 script 
- For the Ubuntu 18.04 NSS bug fix, use mirrors.kernel.org, which
  is an Ubuntu mirror that supports HTTPS, instead of HTTP-only
  security.ubuntu.com
- Minor fix: When uninstalling IKEv2, delete keys in addition to
  certificates from the IPsec database
 2021-01-21 23:07:24 -06:00
hwdsl2
5e1b3e1ae9 Update IKEv2 script 
- Apply fix for NSS bug on Ubuntu 18.04. Ubuntu 18.04 has NSS (libnss3)
  version 3.35, which has a bug with iteration counts that results in
  "incorrect password" errors when trying to import a generated ".p12"
  file to Windows. To fix this, we install newer versions of libnss3
  related packages from the official Ubuntu repo.
  Ref: #414
  https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.36.1_release_notes
  https://packages.ubuntu.com/focal/amd64/libnss3
- Other minor improvements
 2021-01-21 00:24:07 -06:00
hwdsl2
7d9f2c6603 Fix IKEv2 
- Fix an issue with IKEv2 disconnecting after one hour due to IKE SA
  expiration, by setting ikelifetime and salifetime to 24h.
  Ref: #913 #844 https://libreswan.org/man/ipsec.conf.5.html
 2021-01-20 01:39:07 -06:00
hwdsl2
9bf2b630ca Update IKEv2 script 
- Add option to remove IKEv2
 2021-01-19 01:05:06 -06:00
hwdsl2
819ff8a2b3 Update IKEv2 script 
- New feature: Export configuration for an existing IKEv2 client
- If IKEv2 has already been set up, users can now choose from a menu to
  either add a new client or export configuration for an existing client
 2021-01-18 21:57:09 -06:00
hwdsl2
ef93a9867b Update IKEv2 script 
- New feature: The IKEv2 helper script can now be run in "auto mode",
  which sets up IKEv2 using default options, no user input needed.
  To use this mode, add command-line parameter "--auto"
- Refactor entire script to remove duplicate code, improve structure
  and make it easier to read and maintain
- Add check for Libreswan version
- Update tests
 2021-01-18 00:01:46 -06:00
hwdsl2
b17ec88a0d Update IKEv2 script 
- Add the option for users to specify their own password to protect the
  exported VPN client configuration files
- Update tests
 2021-01-15 23:26:25 -06:00
hwdsl2
b004aaaf7c Support .mobileconfig for IKEv2 
- New feature: For macOS and iOS clients, the IKEv2 helper script
  can now create .mobileconfig files to simplify client setup
  and improve VPN performance with ciphers such as AES-GCM.
- New feature: VPN On Demand is now supported on macOS and iOS.
  See https://git.io/ikev2 for more details.
- The script no longer exports the IKEv2 VPN CA certificate, since
  .mobileconfig support has been added.
- A random password is now generated for the .p12 and .mobileconfig
  files, and displayed on the screen when finished. User input is
  no longer required for this password.
 2021-01-14 23:21:52 -06:00
hwdsl2
91b7e53004 Update IKEv2 script 
- Improve check for MOBIKE support
 2021-01-13 09:58:17 -06:00
hwdsl2
c0a212bfc8 Update IKEv2 script 
- Improve OS detection and Libreswan version handling
- Cleanup
 2021-01-10 18:28:52 -06:00
hwdsl2
3b90d2d394 Cleanup 2021-01-07 12:02:44 -06:00
hwdsl2
a5a1f4adb1 Cleanup 2021-01-03 14:05:13 -06:00
hwdsl2
dabf765978 Update year 2021-01-03 00:35:24 -06:00
hwdsl2
de7a529c6c Cleanup 
- Remove Debian 8 from VPN upgrade script, which is EOL on 06/30/2020
- Include OS arch when checking Libreswan version
- Other minor improvements
 2021-01-02 14:25:50 -06:00
hwdsl2
b3ad82fd48 Cleanup 2020-12-31 23:09:58 -06:00
hwdsl2
cac5191155 Add version check 
- Check for latest supported Libreswan version, and remind users who use
  a non-latest version of the VPN scripts that they can upgrade
- Other minor improvements
 2020-12-31 18:24:41 -06:00
hwdsl2
313502293f Update IKEv2 script 
- Add check for existing certificates for the VPN server and client
- Other minor improvements
 2020-12-30 22:53:19 -06:00
hwdsl2
e7bbb50670 Add Amazon Linux 2 2020-12-26 00:19:50 -06:00
hwdsl2
76c9d9c293 Update IKEv2 script 2020-12-20 01:15:00 -06:00
hwdsl2
3b1403668d Update upgrade scripts 
- Clean up Libreswan build flags for CentOS
- Minor improvements
 2020-12-14 23:12:15 -06:00
hwdsl2
f9d84216d6 Fix Libreswan flags 
- Fix Libreswan flags on e.g. Raspbian 10
 2020-12-14 14:17:54 -06:00
hwdsl2
599c1dab15 Update IKEv2 script 
- Minor improvements
 2020-12-13 15:52:03 -06:00
hwdsl2
c1fb45f942 Fix for CentOS 8 
- The repository ID "powertools" is now lower case in the latest
  CentOS release. Update to work in both cases.
 2020-12-07 11:37:48 -06:00
hwdsl2
027c70edb0 Update Debian check 
- Update upgrade scripts to work on Debian 8 for now. Debian 8 (Jessie)
  is EOL and users should upgrade to a newer Debian version.
 2020-12-07 10:28:28 -06:00
hwdsl2
8a3f22ba65 Update Debian check 
- Add check for Debian 8 (not supported)
 2020-12-04 23:39:35 -06:00
hwdsl2
00f9d2ba86 Clean up build flags 
- Clean up build flags for Libreswan. In Libreswan 4.1, these flags are
  now set automatically based on Ubuntu/Debian versions, and no longer
  needed for CentOS/RHEL 7 and 8.
- Ref: https://github.com/libreswan/libreswan/blob/main/mk/defaults/linux.mk
       https://github.com/libreswan/libreswan/commit/c01ffcc1
 2020-12-04 23:36:53 -06:00
hwdsl2
41142ee915 Remove CentOS 6 
- CentOS 6 was EOL as of Nov. 30, 2020, and the default yum repos are
  no longer available for installing new packages
  Ref: https://wiki.centos.org/About/Product
 2020-12-02 23:40:54 -06:00
hwdsl2
427e50a9ed Update upgrade scripts 
- Set sha2-truncbug to "no" when upgrading. This is required for
  iOS 13/14 and macOS 10.15/11 VPN clients to connect.
- References: 3353888 #882
 2020-11-27 11:16:12 -06:00
hwdsl2
cf1865a66e Improve RPi detection 
- Add check for 64-bit versions of Raspberry Pi OS, e.g. Ubuntu 20.04
  on Raspberry Pi 4
- Ref: #852
 2020-11-24 21:27:40 -06:00
hwdsl2
ccd072541b Update Debian check 
- Add check for Debian 10. See: https://git.io/vpndebian10
- Remove Debian 7 check
 2020-11-17 00:50:35 -06:00
hwdsl2
b57678b893 Update upgrade scripts 
- Remove support for upgrading to old Libreswan versions 3.19-3.25
- Minor improvements
 2020-11-15 11:47:14 -06:00
hwdsl2
ecd99a6bba Fix version detection 
- Fix Libreswan version detection in upgrade scripts
 2020-11-12 10:25:09 -06:00
hwdsl2
694679b59c Update upgrade scripts 
- Replace the obsolete ike-frag option in ikev2.conf (if exists),
  which was removed in Libreswan 4.1.
 2020-11-12 00:39:20 -06:00
hwdsl2
5a13026701 Apply Libreswan fix 
- Fix detection for sysvinit initsystem:
  cfe4dabab4
 2020-11-11 23:05:29 -06:00
hwdsl2
1dee0d4262 Update upgrade scripts 
- Support upgrading to Libreswan 4.1
 2020-11-11 01:10:27 -06:00
hwdsl2
afb8a7acce New Libreswan version 
- Upgrade Libreswan from 3.32 to 4.1
 2020-11-11 00:27:44 -06:00
hwdsl2
4fa17ce958 Fix for EPEL repo 
- Remove workaround for EPEL repo issues (bff3fe5)
- "yum makecache" may have higher disk space requirements that could
  cause issues on systems with low free disk space
 2020-09-30 22:49:49 -05:00
hwdsl2
5e090770c8 Update IKEv2 script 
- Allow specifying custom DNS servers
- Add notes about the IKEv2 MOBIKE extension
- Cleanup
 2020-07-12 17:14:30 -05:00
hwdsl2
bff3fe5a4b Fix for EPEL repo 
- Add workaround for EPEL repo issues
 2020-07-06 23:03:13 -05:00
hwdsl2
012c19fed1 Update IKEv2 script 
- Allow specifying the validity period of client certificates
 2020-07-02 11:48:35 -05:00
hwdsl2
cf2ed17ae6 Update IKEv2 script 
- Improve error handling and move ikev2 config to the last step
 2020-06-11 01:32:31 -05:00
hwdsl2
b7293e95da Cleanup 2020-06-05 11:00:23 -05:00
hwdsl2
333a63850e Update IKEv2 script 
- Support adding IKEv2 VPN clients
- Users can specify name for the first VPN client
 2020-06-05 00:29:15 -05:00
hwdsl2
e1e1b67afd Improve IKEv2 setup 
- Use /etc/ipsec.d/ikev2.conf for IKEv2 configuration
- Allow running from inside a container, so that it can be used with:
  https://github.com/hwdsl2/docker-ipsec-vpn-server
 2020-05-30 23:09:32 -05:00
hwdsl2
5894ea2e1f Update IKEv2 script 
- Allow running from inside a container, so that it can be used with:
  https://github.com/hwdsl2/docker-ipsec-vpn-server
 2020-05-30 17:35:27 -05:00
hwdsl2
5fe5f04835 Update upgrade scripts 
- Ref: 71d67ae
 2020-05-25 13:40:04 -05:00
hwdsl2
0a0607feb9 Update IKEv2 script 
- Save client configuration to home folder
 2020-05-17 18:09:40 -05:00
hwdsl2
b028661f6f Update IKEv2 script 
- Raspberry Pi (Raspbian) kernels do not support MOBIKE
 2020-05-16 22:11:01 -05:00
hwdsl2
f38e2ea4f2 Cleanup 2020-05-14 23:07:47 -05:00
hwdsl2
5bf8b86192 Update IKEv2 script 
- Fix CentOS detection
- Set MOBIKE question default to 'yes'
 2020-05-11 23:15:05 -05:00
hwdsl2
6a285499e3 Update upgrade scripts 
- Support upgrading to Libreswan 3.32
- Update ikev2 setup helper script
 2020-05-11 11:28:37 -05:00
hwdsl2
ace41ebc29 Add IKEv2 script 
- Add a helper script for automatic IKEv2 setup
- Update IKEv2 docs
 2020-05-11 01:18:34 -05:00
hwdsl2
f15db57ea5 Fix upgrade bug 
- Fixed an issue where the upgrade script could break the IKEv2 section
  of /etc/ipsec.conf for users who manually added IKEv2
 2020-04-30 00:12:56 -05:00
hwdsl2
dae0c03356 Improve output 
- Inhibit warning messages from Libreswan compilation
 2020-04-29 11:00:25 -05:00
hwdsl2
5983c79904 Fix IKEv2 
- Apply fix for an IKEv2 regression in Libreswan
- Ref: https://github.com/libreswan/libreswan/commit/90f8a09
  https://github.com/libreswan/libreswan/issues/333
  https://github.com/libreswan/libreswan/issues/329
 2020-04-26 16:27:00 -05:00
hwdsl2
dbb3c6b436 Improve RPi workaround 
- Newer Raspbian kernels now support SHA512
 2020-04-26 00:32:54 -05:00
hwdsl2
48d9b06bab Update upgrade scripts 
- Support upgrading to Libreswan 3.31
 2020-04-12 00:28:00 -05:00
hwdsl2
53a4bbb06a Add install note 2020-01-13 00:09:30 -08:00
hwdsl2
4360737eaf Improve OS detection 2020-01-13 00:07:39 -08:00
hwdsl2
99e194e683 Add CentOS 8 
- Add support for CentOS/RHEL 8
 2019-11-01 13:31:23 -07:00
hwdsl2
609f24257d New Libreswan version 
- Upgrade Libreswan to 3.29
 2019-06-10 21:05:51 -05:00
hwdsl2
6c0c006d24 Cleanup 2019-06-09 00:14:33 -05:00
hwdsl2
62d9b845d6 Cleanup 2019-06-03 22:02:14 -05:00
hwdsl2
1659d0336c Support Libreswan 3.28 
- Support upgrading to new Libreswan version 3.28
- Patch applied for Debian 9/8. See:
  https://lists.libreswan.org/pipermail/swan/2019/003210.html
- Patch applied for CentOS 6. See:
  5db185497d
  and 4b93354f35
 2019-06-02 21:08:43 -05:00
hwdsl2
d382350bde Improve VPN users 
- Check VPN users for duplicates in the helper script
 2019-01-13 11:51:47 -06:00
hwdsl2
6fb35e25cb Update year 2019-01-12 11:34:10 -06:00
hwdsl2
997cacdaeb Cleanup 2019-01-12 01:08:04 -06:00
hwdsl2
03e587d834 Cleanup 2018-12-19 00:14:31 -06:00
hwdsl2
ddaa0ee99c Improve DNS servers 
- Improve modecfgdns format
- Better parsing of DNS servers in upgrade scripts
- Add usage of DNS server variables to README and allow users to specify
  only one or both alternative DNS servers
 2018-12-17 00:07:04 -06:00
hwdsl2
ff82c3fb6e Improve VPN ciphers 
- Optimize order of VPN ciphers for performance
 2018-11-24 10:30:42 -06:00
hwdsl2
83b0663318 Add more helper scripts 
- Create additional helper scripts for managing VPN users
- Update docs
- Closes: #355
 2018-11-22 16:49:56 -06:00
hwdsl2
b979d1f15d Add helper script 
- Create a helper script for updating VPN users
- Update docs
 2018-11-22 02:46:28 -06:00
hwdsl2
f1c8c06af1 Improve VPN ciphers 
- Replace "aes_gcm256-null,aes_gcm128-null" with "aes_gcm-null" to
  improve compatibility with some Linux kernels
- Ref: https://libreswan.org/wiki/FAQ#Using_aes_gcm_or_aes_ctr_results_in_ERROR:_netlink_response_for_Add_SA_esp.XXXXXXXX.40IPADDRESS_included_errno_22:_Invalid_argument
 2018-11-02 01:54:49 -05:00
hwdsl2
5f75a7306a Improve VPN ciphers 
- Revert 'sha2-truncbug' from 'no' to 'yes' to fix compatibility with
  Android versions 6.x and 7.x.
- Remove aes128-sha2_512 algorithm
- Ref: 732ad1e
 2018-10-28 00:33:42 -05:00
hwdsl2
732ad1e941 Improve VPN ciphers 
- Optimize VPN ciphers and their order for improved security and
  compatibility with different OS. Remove 3DES algorithm
- Change 'sha2-truncbug' from 'yes' to 'no'
- Update docs
 2018-10-27 00:53:19 -05:00
hwdsl2
9db710090d Improve VPN ciphers 
- Add AES-GCM cipher for Chromebook compatibility and performance
 2018-10-25 01:25:35 -05:00
hwdsl2
804211c101 Cleanup 2018-10-21 00:20:54 -05:00
hwdsl2
a04d2d32e8 New Libreswan version 
- Upgrade Libreswan to 3.27
- Cleanup
 2018-10-09 12:32:28 -05:00
hwdsl2
4f41fcba9a Improve upgrade config 
- Replace all occurrences when updating /etc/ipsec.conf
- Prompt the user to edit manually if more than one modecfgdns1= or
  modecfgdns= line is present
 2018-09-30 20:04:21 -05:00
hwdsl2
e22664f7a2 Improve upgrade config 
- Try to automatically update modecfgdns lines in /etc/ipsec.conf
  in the Libreswan upgrade scripts
- Cleanup
 2018-09-22 12:10:02 -05:00
hwdsl2
b803f32b71 New Libreswan version 
- Upgrade to new Libreswan version 3.26
- Ref: https://github.com/libreswan/libreswan/issues/202
- Cleanup
 2018-09-21 23:47:17 -05:00
hwdsl2
95c8a178e7 Improve variables 
- Move SWAN_VER to the top of the scripts
- Add check for Libreswan version
- Cleanup
 2018-09-18 00:57:03 -05:00
hwdsl2
329a5ecf50 Cleanup 
- Improve display of Libreswan versions in upgrade scripts
- Clean up notes
 2018-09-16 21:36:49 -05:00
hwdsl2
dfc5fce92c Improve version check 
- Improve Libreswan version check in upgrade scripts, including
  checking for supported versions and showing upgrade/downgrade info
- Clean up notes
 2018-09-16 01:05:29 -05:00
hwdsl2
b8088d3934 Improve EPEL repo 
- Improve handling of the EPEL repository. Although uncommon, some systems
  can have epel-release installed but disabled in /etc/yum.repos.d/epel.repo
- Fixes #210
 2018-07-04 20:07:32 -05:00
hwdsl2
145f29b477 Improve version check 
- Add check for some Libreswan versions that are not available
- Include Libreswan 3.25 in multiple IPsec/XAuth clients warning
- Cleanup notes
 2018-06-30 00:42:08 -05:00
hwdsl2
41ce696f08 Add new version 
- Add support for upgrading to new Libreswan version 3.25
- "USE_GLIBC_KERN_FLIP_HEADERS = true" is required for compilation
- Fixes #412
 2018-06-28 00:49:49 -05:00
hwdsl2
0c151515fe Improve upgrade scripts 
- Add note for users downgrading to 3.22
- Add check for Libreswan 3.25 (not yet supported)
- Print Libreswan versions and improve message
- Cleanup
 2018-06-28 00:03:42 -05:00
hwdsl2
59f817575c Create rundir 
- Create /run/pluto which is used as rundir in Libreswan 3.22 and newer
- Fixes #407
 2018-06-10 16:08:12 -05:00
hwdsl2
1ff393b91c Use Libreswan 3.22 
- Use Libreswan 3.22 instead of 3.23 due to an issue with connecting
  multiple IPsec/XAuth VPN clients from behind the same NAT
- Ref: c982502 0cf01c0
 2018-06-06 00:40:09 -05:00
hwdsl2
95bcadb2c2 Improve VPN ciphers 
- Add back aes256-sha2_512 to phase2alg, required on some Android systems
- Fixes #391
 2018-05-23 19:54:37 -05:00
hwdsl2
8e15eb683c Cleanup 2018-05-23 01:39:53 -05:00
hwdsl2
73a97f2ba4 Cleanup 2018-05-10 21:18:58 -05:00
hwdsl2
102ccbc17d Clean up VPN ciphers 
- Remove aes256-sha2_512
- Change sha2-truncbug to no for newer Android versions
- Fixes #303
 2018-05-05 18:51:24 -05:00
hwdsl2
0c6cb4b8a9 Update year 2018-05-05 18:49:38 -05:00
hwdsl2
4c47137e7f Add modecfgdns note 2018-02-11 01:05:13 -06:00
hwdsl2
21228a8caf Improve RPi workarounds 
- Improve workarounds for systems with ARM CPU (e.g. Raspberry Pi)
- Check for ARM architecture instead of checking for Raspbian
 2018-02-03 16:55:54 -06:00
hwdsl2
3d2b6fc861 Remove RPi workaround 2018-01-29 02:06:08 -06:00