mirror of
https://github.com/coolsnowwolf/lede.git
synced 2025-04-19 14:13:30 +00:00
re-add luci IPSEC vpn server
This commit is contained in:
coolsnowwolf
parent
ea2be9f69f
commit
78f10fee00
18
package/lean/luci-app-ipsec-vpnd/Makefile
Normal file
18
package/lean/luci-app-ipsec-vpnd/Makefile
Normal file
@ -0,0 +1,18 @@
|
||||
# Copyright (C) 2016 Openwrt.org
|
||||
#
|
||||
# This is free software, licensed under the Apache License, Version 2.0 .
|
||||
#
|
||||
|
||||
include $(TOPDIR)/rules.mk
|
||||
|
||||
LUCI_TITLE:=LuCI support for IPSec VPN Server (IKEv1 with PSK and Xauth)
|
||||
LUCI_DEPENDS:=+strongswan-minimal +strongswan-mod-xauth-generic
|
||||
LUCI_PKGARCH:=all
|
||||
PKG_VERSION:=1.0
|
||||
PKG_RELEASE:=7
|
||||
|
||||
include $(TOPDIR)/feeds/luci/luci.mk
|
||||
|
||||
# call BuildPackage - OpenWrt buildroot signature
|
||||
|
||||
|
||||
@ -0,0 +1,19 @@
|
||||
|
||||
module("luci.controller.ipsec-server", package.seeall)
|
||||
|
||||
function index()
|
||||
if not nixio.fs.access("/etc/config/ipsec") then
|
||||
return
|
||||
end
|
||||
|
||||
entry({"admin", "vpn"}, firstchild(), "VPN", 45).dependent = false
|
||||
entry({"admin", "vpn", "ipsec-server"}, cbi("ipsec-server/ipsec-server"), _("IPSec VPN Server"), 80).dependent=false
|
||||
entry({"admin", "vpn", "ipsec-server","status"},call("act_status")).leaf=true
|
||||
end
|
||||
|
||||
function act_status()
|
||||
local e={}
|
||||
e.running=luci.sys.call("pgrep ipsec >/dev/null")==0
|
||||
luci.http.prepare_content("application/json")
|
||||
luci.http.write_json(e)
|
||||
end
|
||||
@ -0,0 +1,35 @@
|
||||
|
||||
mp = Map("ipsec", translate("IPSec VPN Server"))
|
||||
mp.description = translate("IPSec VPN connectivity using the native built-in VPN Client on iOS or Andriod (IKEv1 with PSK and Xauth)")
|
||||
|
||||
mp:section(SimpleSection).template = "ipsec/ipsec_status"
|
||||
|
||||
s = mp:section(NamedSection, "ipsec", "service")
|
||||
s.anonymouse = true
|
||||
|
||||
enabled = s:option(Flag, "enabled", translate("Enable"))
|
||||
enabled.default = 0
|
||||
enabled.rmempty = false
|
||||
|
||||
clientip = s:option(Value, "clientip", translate("VPN Client IP"))
|
||||
clientip.datatype = "ip4addr"
|
||||
clientip.description = translate("LAN DHCP reserved started IP addresses with the same subnet mask")
|
||||
clientip.optional = false
|
||||
clientip.rmempty = false
|
||||
|
||||
clientdns = s:option(Value, "clientdns", translate("VPN Client DNS"))
|
||||
clientdns.datatype = "ip4addr"
|
||||
clientdns.description = translate("DNS using in VPN tunnel.Set to the router's LAN IP is recommended")
|
||||
clientdns.optional = false
|
||||
clientdns.rmempty = false
|
||||
|
||||
account = s:option(Value, "account", translate("Account"))
|
||||
account.datatype = "string"
|
||||
|
||||
password = s:option(Value, "password", translate("Password"))
|
||||
password.password = true
|
||||
|
||||
secret = s:option(Value, "secret", translate("Secret Pre-Shared Key"))
|
||||
secret.password = true
|
||||
|
||||
return mp
|
||||
@ -0,0 +1,22 @@
|
||||
<script type="text/javascript">//<![CDATA[
|
||||
XHR.poll(3, '<%=url([[admin]], [[vpn]], [[ipsec-server]], [[status]])%>', null,
|
||||
function(x, data) {
|
||||
var tb = document.getElementById('ipsec_status');
|
||||
if (data && tb) {
|
||||
if (data.running) {
|
||||
var links = '<em><b><font color=green>IPSec VPN <%:RUNNING%></font></b></em>';
|
||||
tb.innerHTML = links;
|
||||
} else {
|
||||
tb.innerHTML = '<em><b><font color=red>IPSec VPN <%:NOT RUNNING%></font></b></em>';
|
||||
}
|
||||
}
|
||||
}
|
||||
);
|
||||
//]]>
|
||||
</script>
|
||||
<style>.mar-10 {margin-left: 50px; margin-right: 10px;}</style>
|
||||
<fieldset class="cbi-section">
|
||||
<p id="ipsec_status">
|
||||
<em><%:Collecting data...%></em>
|
||||
</p>
|
||||
</fieldset>
|
||||
34
package/lean/luci-app-ipsec-vpnd/po/zh-cn/ipsec.po
Normal file
34
package/lean/luci-app-ipsec-vpnd/po/zh-cn/ipsec.po
Normal file
@ -0,0 +1,34 @@
|
||||
msgid "IPSec VPN Server"
|
||||
msgstr "IPSec VPN 服务器"
|
||||
|
||||
msgid "IPSec VPN connectivity using the native built-in VPN Client on iOS or Andriod (IKEv1 with PSK and Xauth)"
|
||||
msgstr "使用iOS 或者 Andriod (IKEv1 with PSK and Xauth) 原生内置 IPSec VPN 客户端进行连接"
|
||||
|
||||
msgid "VPN Client IP"
|
||||
msgstr "VPN客户端地址段"
|
||||
|
||||
msgid "LAN DHCP reserved started IP addresses with the same subnet mask"
|
||||
msgstr "VPN客户端使用DHCP保留空余IP的起始地址，必须和路由器LAN同一个子网掩码，例如 192.168.0.10/24"
|
||||
|
||||
msgid "VPN Client DNS"
|
||||
msgstr "VPN客户端DNS服务器"
|
||||
|
||||
msgid "DNS using in VPN tunnel.Set to the router's LAN IP is recommended"
|
||||
msgstr "指定VPN客户端的DNS地址。推荐设置为路由器的LAN IP，例如 192.168.0.1"
|
||||
|
||||
msgid "Account"
|
||||
msgstr "账户"
|
||||
|
||||
msgid "Secret Pre-Shared Key"
|
||||
msgstr "PSK密钥"
|
||||
|
||||
msgid "IPSec VPN Server status"
|
||||
msgstr "IPSec VPN 服务器运行状态"
|
||||
|
||||
msgid "Disable from startup"
|
||||
msgstr "禁止开机启动"
|
||||
|
||||
msgid "Enable on startup"
|
||||
msgstr "允许开机启动"
|
||||
|
||||
|
||||
9
package/lean/luci-app-ipsec-vpnd/root/etc/config/ipsec
Normal file
9
package/lean/luci-app-ipsec-vpnd/root/etc/config/ipsec
Normal file
@ -0,0 +1,9 @@
|
||||
|
||||
config service 'ipsec'
|
||||
option clientdns '192.168.0.1'
|
||||
option account 'lean'
|
||||
option secret 'myopenwrt'
|
||||
option enabled '0'
|
||||
option password '12345678'
|
||||
option clientip '192.168.0.10/24'
|
||||
|
||||
427
package/lean/luci-app-ipsec-vpnd/root/etc/init.d/ipsec
Executable file
427
package/lean/luci-app-ipsec-vpnd/root/etc/init.d/ipsec
Executable file
@ -0,0 +1,427 @@
|
||||
#!/bin/sh /etc/rc.common
|
||||
|
||||
START=90
|
||||
STOP=10
|
||||
|
||||
USE_PROCD=1
|
||||
PROG=/usr/lib/ipsec/starter
|
||||
|
||||
. $IPKG_INSTROOT/lib/functions.sh
|
||||
. $IPKG_INSTROOT/lib/functions/network.sh
|
||||
|
||||
IPSEC_SECRETS_FILE=/etc/ipsec.secrets
|
||||
IPSEC_CONN_FILE=/etc/ipsec.conf
|
||||
STRONGSWAN_CONF_FILE=/etc/strongswan.conf
|
||||
|
||||
IPSEC_VAR_SECRETS_FILE=/var/ipsec/ipsec.secrets
|
||||
IPSEC_VAR_CONN_FILE=/var/ipsec/ipsec.conf
|
||||
STRONGSWAN_VAR_CONF_FILE=/var/ipsec/strongswan.conf
|
||||
|
||||
WAIT_FOR_INTF=0
|
||||
|
||||
file_reset() {
|
||||
: > "$1"
|
||||
}
|
||||
|
||||
xappend() {
|
||||
local file="$1"
|
||||
shift
|
||||
|
||||
echo "${@}" >> "${file}"
|
||||
}
|
||||
|
||||
remove_include() {
|
||||
local file="$1"
|
||||
local include="$2"
|
||||
|
||||
sed -i "\_${include}_d" "${file}"
|
||||
}
|
||||
|
||||
remove_includes() {
|
||||
remove_include "${IPSEC_CONN_FILE}" "${IPSEC_VAR_CONN_FILE}"
|
||||
remove_include "${IPSEC_SECRETS_FILE}" "${IPSEC_VAR_SECRETS_FILE}"
|
||||
remove_include "${STRONGSWAN_CONF_FILE}" "${STRONGSWAN_VAR_CONF_FILE}"
|
||||
}
|
||||
|
||||
do_include() {
|
||||
local conf="$1"
|
||||
local uciconf="$2"
|
||||
local backup=`mktemp -t -p /tmp/ ipsec-init-XXXXXX`
|
||||
|
||||
[ ! -f "${conf}" ] && rm -rf "${conf}"
|
||||
touch "${conf}"
|
||||
|
||||
cat "${conf}" | grep -v "${uciconf}" > "${backup}"
|
||||
mv "${backup}" "${conf}"
|
||||
xappend "${conf}" "include ${uciconf}"
|
||||
file_reset "${uciconf}"
|
||||
}
|
||||
|
||||
ipsec_reset() {
|
||||
do_include "${IPSEC_CONN_FILE}" "${IPSEC_VAR_CONN_FILE}"
|
||||
}
|
||||
|
||||
ipsec_xappend() {
|
||||
xappend "${IPSEC_VAR_CONN_FILE}" "$@"
|
||||
}
|
||||
|
||||
swan_reset() {
|
||||
do_include "${STRONGSWAN_CONF_FILE}" "${STRONGSWAN_VAR_CONF_FILE}"
|
||||
}
|
||||
|
||||
swan_xappend() {
|
||||
xappend "${STRONGSWAN_VAR_CONF_FILE}" "$@"
|
||||
}
|
||||
|
||||
secret_reset() {
|
||||
do_include "${IPSEC_SECRETS_FILE}" "${IPSEC_VAR_SECRETS_FILE}"
|
||||
}
|
||||
|
||||
secret_xappend() {
|
||||
xappend "${IPSEC_VAR_SECRETS_FILE}" "$@"
|
||||
}
|
||||
|
||||
warning() {
|
||||
echo "WARNING: $@" >&2
|
||||
}
|
||||
|
||||
add_crypto_proposal() {
|
||||
local encryption_algorithm
|
||||
local hash_algorithm
|
||||
local dh_group
|
||||
|
||||
config_get encryption_algorithm "$1" encryption_algorithm
|
||||
config_get hash_algorithm "$1" hash_algorithm
|
||||
config_get dh_group "$1" dh_group
|
||||
|
||||
[ -n "${encryption_algorithm}" ] && \
|
||||
crypto="${crypto:+${crypto},}${encryption_algorithm}${hash_algorithm:+-${hash_algorithm}}${dh_group:+-${dh_group}}"
|
||||
}
|
||||
|
||||
set_crypto_proposal() {
|
||||
local conf="$1"
|
||||
local proposal
|
||||
|
||||
crypto=""
|
||||
|
||||
config_get crypto_proposal "$conf" crypto_proposal ""
|
||||
for proposal in $crypto_proposal; do
|
||||
add_crypto_proposal "$proposal"
|
||||
done
|
||||
|
||||
[ -n "${crypto}" ] && {
|
||||
local force_crypto_proposal
|
||||
|
||||
config_get_bool force_crypto_proposal "$conf" force_crypto_proposal
|
||||
|
||||
[ "${force_crypto_proposal}" = "1" ] && crypto="${crypto}!"
|
||||
}
|
||||
|
||||
crypto_proposal="${crypto}"
|
||||
}
|
||||
|
||||
config_conn() {
|
||||
# Generic ipsec conn section shared by tunnel and transport
|
||||
local mode
|
||||
local local_subnet
|
||||
local local_nat
|
||||
local local_sourceip
|
||||
local local_updown
|
||||
local local_firewall
|
||||
local remote_subnet
|
||||
local remote_sourceip
|
||||
local remote_updown
|
||||
local remote_firewall
|
||||
local ikelifetime
|
||||
local lifetime
|
||||
local margintime
|
||||
local keyingtries
|
||||
local dpdaction
|
||||
local dpddelay
|
||||
local inactivity
|
||||
local keyexchange
|
||||
|
||||
config_get mode "$1" mode "route"
|
||||
config_get local_subnet "$1" local_subnet ""
|
||||
config_get local_nat "$1" local_nat ""
|
||||
config_get local_sourceip "$1" local_sourceip ""
|
||||
config_get local_updown "$1" local_updown ""
|
||||
config_get local_firewall "$1" local_firewall ""
|
||||
config_get remote_subnet "$1" remote_subnet ""
|
||||
config_get remote_sourceip "$1" remote_sourceip ""
|
||||
config_get remote_updown "$1" remote_updown ""
|
||||
config_get remote_firewall "$1" remote_firewall ""
|
||||
config_get ikelifetime "$1" ikelifetime "3h"
|
||||
config_get lifetime "$1" lifetime "1h"
|
||||
config_get margintime "$1" margintime "9m"
|
||||
config_get keyingtries "$1" keyingtries "3"
|
||||
config_get dpdaction "$1" dpdaction "none"
|
||||
config_get dpddelay "$1" dpddelay "30s"
|
||||
config_get inactivity "$1" inactivity
|
||||
config_get keyexchange "$1" keyexchange "ikev2"
|
||||
|
||||
[ -n "$local_nat" ] && local_subnet=$local_nat
|
||||
|
||||
ipsec_xappend "conn $config_name-$1"
|
||||
ipsec_xappend " left=%any"
|
||||
ipsec_xappend " right=$remote_gateway"
|
||||
|
||||
[ -n "$local_sourceip" ] && ipsec_xappend " leftsourceip=$local_sourceip"
|
||||
[ -n "$local_subnet" ] && ipsec_xappend " leftsubnet=$local_subnet"
|
||||
|
||||
[ -n "$local_firewall" ] && ipsec_xappend " leftfirewall=$local_firewall"
|
||||
[ -n "$remote_firewall" ] && ipsec_xappend " rightfirewall=$remote_firewall"
|
||||
|
||||
ipsec_xappend " ikelifetime=$ikelifetime"
|
||||
ipsec_xappend " lifetime=$lifetime"
|
||||
ipsec_xappend " margintime=$margintime"
|
||||
ipsec_xappend " keyingtries=$keyingtries"
|
||||
ipsec_xappend " dpdaction=$dpdaction"
|
||||
ipsec_xappend " dpddelay=$dpddelay"
|
||||
|
||||
[ -n "$inactivity" ] && ipsec_xappend " inactivity=$inactivity"
|
||||
|
||||
if [ "$auth_method" = "psk" ]; then
|
||||
ipsec_xappend " leftauth=psk"
|
||||
ipsec_xappend " rightauth=psk"
|
||||
|
||||
[ "$remote_sourceip" != "" ] && ipsec_xappend " rightsourceip=$remote_sourceip"
|
||||
[ "$remote_subnet" != "" ] && ipsec_xappend " rightsubnet=$remote_subnet"
|
||||
|
||||
ipsec_xappend " auto=$mode"
|
||||
else
|
||||
warning "AuthenticationMethod $auth_method not supported"
|
||||
fi
|
||||
|
||||
[ -n "$local_identifier" ] && ipsec_xappend " leftid=$local_identifier"
|
||||
[ -n "$remote_identifier" ] && ipsec_xappend " rightid=$remote_identifier"
|
||||
[ -n "$local_updown" ] && ipsec_xappend " leftupdown=$local_updown"
|
||||
[ -n "$remote_updown" ] && ipsec_xappend " rightupdown=$remote_updown"
|
||||
ipsec_xappend " keyexchange=$keyexchange"
|
||||
|
||||
set_crypto_proposal "$1"
|
||||
[ -n "${crypto_proposal}" ] && ipsec_xappend " esp=$crypto_proposal"
|
||||
[ -n "${ike_proposal}" ] && ipsec_xappend " ike=$ike_proposal"
|
||||
}
|
||||
|
||||
config_tunnel() {
|
||||
config_conn "$1"
|
||||
|
||||
# Specific for the tunnel part
|
||||
ipsec_xappend " type=tunnel"
|
||||
}
|
||||
|
||||
config_transport() {
|
||||
config_conn "$1"
|
||||
|
||||
# Specific for the transport part
|
||||
ipsec_xappend " type=transport"
|
||||
}
|
||||
|
||||
config_remote() {
|
||||
local enabled
|
||||
local gateway
|
||||
local pre_shared_key
|
||||
local auth_method
|
||||
|
||||
config_name=$1
|
||||
|
||||
config_get_bool enabled "$1" enabled 0
|
||||
[ $enabled -eq 0 ] && return
|
||||
|
||||
config_get gateway "$1" gateway
|
||||
config_get pre_shared_key "$1" pre_shared_key
|
||||
config_get auth_method "$1" authentication_method
|
||||
config_get local_identifier "$1" local_identifier ""
|
||||
config_get remote_identifier "$1" remote_identifier ""
|
||||
|
||||
[ "$gateway" = "any" ] && remote_gateway="%any" || remote_gateway="$gateway"
|
||||
|
||||
[ -z "$local_identifier" ] && {
|
||||
local ipdest
|
||||
|
||||
[ "$remote_gateway" = "%any" ] && ipdest="1.1.1.1" || ipdest="$remote_gateway"
|
||||
local_gateway=`ip route get $ipdest | awk -F"src" '/src/{gsub(/ /,"");print $2}'`
|
||||
}
|
||||
|
||||
[ -n "$local_identifier" ] && secret_xappend -n "$local_identifier " || secret_xappend -n "$local_gateway "
|
||||
[ -n "$remote_identifier" ] && secret_xappend -n "$remote_identifier " || secret_xappend -n "$remote_gateway "
|
||||
|
||||
secret_xappend ": PSK \"$pre_shared_key\""
|
||||
|
||||
set_crypto_proposal "$1"
|
||||
ike_proposal="$crypto_proposal"
|
||||
|
||||
config_list_foreach "$1" tunnel config_tunnel
|
||||
|
||||
config_list_foreach "$1" transport config_transport
|
||||
|
||||
ipsec_xappend ""
|
||||
}
|
||||
|
||||
config_ipsec() {
|
||||
local debug
|
||||
local rtinstall_enabled
|
||||
local routing_tables_ignored
|
||||
local routing_table
|
||||
local routing_table_id
|
||||
local interface
|
||||
local device_list
|
||||
|
||||
ipsec_reset
|
||||
secret_reset
|
||||
swan_reset
|
||||
|
||||
ipsec_xappend "# generated by /etc/init.d/ipsec"
|
||||
ipsec_xappend "version 2"
|
||||
ipsec_xappend ""
|
||||
|
||||
secret_xappend "# generated by /etc/init.d/ipsec"
|
||||
|
||||
config_get debug "$1" debug 0
|
||||
config_get_bool rtinstall_enabled "$1" rtinstall_enabled 1
|
||||
[ $rtinstall_enabled -eq 1 ] && install_routes=yes || install_routes=no
|
||||
|
||||
# prepare extra charon config option ignore_routing_tables
|
||||
for routing_table in $(config_get "$1" "ignore_routing_tables"); do
|
||||
if [ "$routing_table" -ge 0 ] 2>/dev/null; then
|
||||
routing_table_id=$routing_table
|
||||
else
|
||||
routing_table_id=$(sed -n '/[ \t]*[0-9]\+[ \t]\+'$routing_table'[ \t]*$/s/[ \t]*\([0-9]\+\).*/\1/p' /etc/iproute2/rt_tables)
|
||||
fi
|
||||
|
||||
[ -n "$routing_table_id" ] && append routing_tables_ignored "$routing_table_id"
|
||||
done
|
||||
|
||||
local interface_list=$(config_get "$1" "interface")
|
||||
if [ -z "$interface_list" ]; then
|
||||
WAIT_FOR_INTF=0
|
||||
else
|
||||
for interface in $interface_list; do
|
||||
network_get_device device $interface
|
||||
[ -n "$device" ] && append device_list "$device" ","
|
||||
done
|
||||
[ -n "$device_list" ] && WAIT_FOR_INTF=0 || WAIT_FOR_INTF=1
|
||||
fi
|
||||
|
||||
swan_xappend "# generated by /etc/init.d/ipsec"
|
||||
swan_xappend "charon {"
|
||||
swan_xappend " load_modular = yes"
|
||||
swan_xappend " install_routes = $install_routes"
|
||||
[ -n "$routing_tables_ignored" ] && swan_xappend " ignore_routing_tables = $routing_tables_ignored"
|
||||
[ -n "$device_list" ] && swan_xappend " interfaces_use = $device_list"
|
||||
swan_xappend " plugins {"
|
||||
swan_xappend " include /etc/strongswan.d/charon/*.conf"
|
||||
swan_xappend " }"
|
||||
swan_xappend " syslog {"
|
||||
swan_xappend " identifier = ipsec"
|
||||
swan_xappend " daemon {"
|
||||
swan_xappend " default = $debug"
|
||||
swan_xappend " }"
|
||||
swan_xappend " auth {"
|
||||
swan_xappend " default = $debug"
|
||||
swan_xappend " }"
|
||||
swan_xappend " }"
|
||||
swan_xappend "}"
|
||||
}
|
||||
|
||||
prepare_env() {
|
||||
mkdir -p /var/ipsec
|
||||
remove_includes
|
||||
config_load ipsec
|
||||
config_foreach config_ipsec ipsec
|
||||
config_foreach config_remote remote
|
||||
}
|
||||
|
||||
service_running() {
|
||||
ipsec status > /dev/null 2>&1
|
||||
}
|
||||
|
||||
reload_service() {
|
||||
local bool vt_enabled=`uci get ipsec.@service[0].enabled 2>/dev/null`
|
||||
[ "$vt_enabled" = 0 ] && /etc/init.d/ipsec stop && return
|
||||
running && {
|
||||
prepare_env
|
||||
[ $WAIT_FOR_INTF -eq 0 ] && {
|
||||
ipsec rereadall
|
||||
ipsec reload
|
||||
return
|
||||
}
|
||||
}
|
||||
[ "$vt_enabled" = 1 ] && start
|
||||
}
|
||||
|
||||
check_ipsec_interface() {
|
||||
local intf
|
||||
|
||||
for intf in $(config_get "$1" interface); do
|
||||
procd_add_interface_trigger "interface.*" "$intf" /etc/init.d/ipsec reload
|
||||
done
|
||||
}
|
||||
|
||||
service_triggers() {
|
||||
procd_add_reload_trigger "ipsec"
|
||||
config load "ipsec"
|
||||
config_foreach check_ipsec_interface ipsec
|
||||
}
|
||||
|
||||
start_service() {
|
||||
local vt_enabled=`uci get ipsec.@service[0].enabled 2>/dev/null`
|
||||
local vt_clientip=`uci get ipsec.@service[0].clientip`
|
||||
local vt_clientdns=`uci get ipsec.@service[0].clientdns`
|
||||
local vt_account=`uci get ipsec.@service[0].account`
|
||||
local vt_password=`uci get ipsec.@service[0].password 2>/dev/null`
|
||||
local vt_secret=`uci get ipsec.@service[0].secret 2>/dev/null`
|
||||
|
||||
[ "$vt_enabled" = 0 ] && /etc/init.d/ipsec stop && return
|
||||
|
||||
cat > /etc/ipsec.conf <<EOF
|
||||
# ipsec.conf - strongSwan IPsec configuration file
|
||||
|
||||
# basic configuration
|
||||
|
||||
config setup
|
||||
# strictcrlpolicy=yes
|
||||
uniqueids=never
|
||||
|
||||
# Add connections here.
|
||||
|
||||
conn xauth_psk
|
||||
keyexchange=ikev1
|
||||
ike=aes128-sha1-modp2048,aes128-sha1-modp1024,3des-sha1-modp1024,3des-sha1-modp1536
|
||||
esp=aes128-sha1,3des-sha1
|
||||
left=%defaultroute
|
||||
leftauth=psk
|
||||
leftsubnet=0.0.0.0/0
|
||||
right=%any
|
||||
rightauth=psk
|
||||
rightauth2=xauth
|
||||
rightsourceip=$vt_clientip
|
||||
rightdns=$vt_clientdns
|
||||
auto=add
|
||||
EOF
|
||||
|
||||
cat > /etc/ipsec.secrets <<EOF
|
||||
# /etc/ipsec.secrets - strongSwan IPsec secrets file
|
||||
: PSK "$vt_secret"
|
||||
$vt_account : XAUTH "$vt_password"
|
||||
EOF
|
||||
|
||||
prepare_env
|
||||
|
||||
[ $WAIT_FOR_INTF -eq 1 ] && return
|
||||
|
||||
procd_open_instance
|
||||
|
||||
procd_set_param command $PROG --daemon charon --nofork
|
||||
|
||||
procd_set_param file $IPSEC_CONN_FILE
|
||||
procd_append_param file $IPSEC_SECRETS_FILE
|
||||
procd_append_param file $STRONGSWAN_CONF_FILE
|
||||
procd_append_param file /etc/strongswan.d/*.conf
|
||||
procd_append_param file /etc/strongswan.d/charon/*.conf
|
||||
|
||||
procd_set_param respawn
|
||||
|
||||
procd_close_instance
|
||||
}
|
||||
11
package/lean/luci-app-ipsec-vpnd/root/etc/ipsec.include
Executable file
11
package/lean/luci-app-ipsec-vpnd/root/etc/ipsec.include
Executable file
@ -0,0 +1,11 @@
|
||||
iptables -D FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT 2>/dev/null
|
||||
iptables -D FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT 2>/dev/null
|
||||
iptables -D INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT 2>/dev/null
|
||||
iptables -D OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT 2>/dev/null
|
||||
|
||||
iptables -I FORWARD -m policy --dir in --pol ipsec --proto esp -j ACCEPT
|
||||
iptables -I FORWARD -m policy --dir out --pol ipsec --proto esp -j ACCEPT
|
||||
iptables -I INPUT -m policy --dir in --pol ipsec --proto esp -j ACCEPT
|
||||
iptables -I OUTPUT -m policy --dir out --pol ipsec --proto esp -j ACCEPT
|
||||
|
||||
echo 1 > /proc/sys/net/ipv4/conf/br-lan/proxy_arp
|
||||
54
package/lean/luci-app-ipsec-vpnd/root/etc/uci-defaults/ipsec
Executable file
54
package/lean/luci-app-ipsec-vpnd/root/etc/uci-defaults/ipsec
Executable file
@ -0,0 +1,54 @@
|
||||
#!/bin/sh
|
||||
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
delete firewall.ipsecd
|
||||
set firewall.ipsecd=include
|
||||
set firewall.ipsecd.type=script
|
||||
set firewall.ipsecd.path=/etc/ipsec.include
|
||||
set firewall.ipsecd.reload=1
|
||||
commit firewall
|
||||
EOF
|
||||
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
delete firewall.ike
|
||||
add firewall rule
|
||||
rename firewall.@rule[-1]="ike"
|
||||
set firewall.@rule[-1].name="ike"
|
||||
set firewall.@rule[-1].target="ACCEPT"
|
||||
set firewall.@rule[-1].src="wan"
|
||||
set firewall.@rule[-1].proto="udp"
|
||||
set firewall.@rule[-1].dest_port="500"
|
||||
delete firewall.ipsec
|
||||
add firewall rule
|
||||
rename firewall.@rule[-1]="ipsec"
|
||||
set firewall.@rule[-1].name="ipsec"
|
||||
set firewall.@rule[-1].target="ACCEPT"
|
||||
set firewall.@rule[-1].src="wan"
|
||||
set firewall.@rule[-1].proto="udp"
|
||||
set firewall.@rule[-1].dest_port="4500"
|
||||
delete firewall.ah
|
||||
add firewall rule
|
||||
rename firewall.@rule[-1]="ah"
|
||||
set firewall.@rule[-1].name="ah"
|
||||
set firewall.@rule[-1].target="ACCEPT"
|
||||
set firewall.@rule[-1].src="wan"
|
||||
set firewall.@rule[-1].proto="ah"
|
||||
delete firewall.esp
|
||||
add firewall rule
|
||||
rename firewall.@rule[-1]="esp"
|
||||
set firewall.@rule[-1].name="esp"
|
||||
set firewall.@rule[-1].target="ACCEPT"
|
||||
set firewall.@rule[-1].src="wan"
|
||||
set firewall.@rule[-1].proto="esp"
|
||||
commit firewall
|
||||
EOF
|
||||
|
||||
uci -q batch <<-EOF >/dev/null
|
||||
delete ucitrack.@ipsec[-1]
|
||||
add ucitrack ipsec
|
||||
set ucitrack.@ipsec[-1].init=ipsec
|
||||
commit ucitrack
|
||||
EOF
|
||||
|
||||
rm -f /tmp/luci-indexcache
|
||||
exit 0
|
||||
Loading…
Reference in New Issue
Block a user