224 lines
5.5 KiB
Bash
224 lines
5.5 KiB
Bash
#!/bin/bash
|
|
|
|
# 退出时显示错误
|
|
set -e
|
|
|
|
# 颜色定义
|
|
RED='\033[0;31m'
|
|
GREEN='\033[0;32m'
|
|
YELLOW='\033[1;33m'
|
|
NC='\033[0m' # No Color
|
|
|
|
# 函数定义
|
|
print_info() {
|
|
echo -e "${YELLOW}[INFO] $1${NC}"
|
|
}
|
|
|
|
print_success() {
|
|
echo -e "${GREEN}[SUCCESS] $1${NC}"
|
|
}
|
|
|
|
print_error() {
|
|
echo -e "${RED}[ERROR] $1${NC}"
|
|
}
|
|
|
|
check_service_status() {
|
|
if systemctl is-active --quiet $1; then
|
|
print_success "$1 服务正在运行"
|
|
else
|
|
print_error "$1 服务未运行"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
# 检测系统类型
|
|
if [ -f /etc/os-release ]; then
|
|
. /etc/os-release
|
|
OS=$NAME
|
|
else
|
|
print_error "无法检测操作系统类型，脚本可能无法正常工作。"
|
|
exit 1
|
|
fi
|
|
|
|
print_info "检测到的操作系统: $OS"
|
|
|
|
# 更新系统包列表
|
|
print_info "正在更新系统包列表..."
|
|
if apt update; then
|
|
print_success "系统包列表更新成功"
|
|
else
|
|
print_error "系统包列表更新失败"
|
|
exit 1
|
|
fi
|
|
|
|
# 安装必要的软件包
|
|
print_info "正在安装 StrongSwan 和 xl2tpd..."
|
|
if DEBIAN_FRONTEND=noninteractive apt install -yq strongswan strongswan-pki libcharon-extra-plugins xl2tpd ppp curl; then
|
|
print_success "StrongSwan 和 xl2tpd 安装成功"
|
|
else
|
|
print_error "StrongSwan 和 xl2tpd 安装失败"
|
|
exit 1
|
|
fi
|
|
|
|
# 随机生成用户名、密码和预共享密钥
|
|
USERNAME="vpnuser_$(tr -dc A-Za-z0-9 </dev/urandom | head -c 6)"
|
|
PASSWORD="$(tr -dc A-Za-z0-9 </dev/urandom | head -c 16)"
|
|
PSK="$(tr -dc A-Za-z0-9 </dev/urandom | head -c 20)"
|
|
|
|
# 获取公网 IP
|
|
print_info "正在获取公网 IP..."
|
|
PUBLIC_IP=$(curl -s http://ipinfo.io/ip)
|
|
if [ -z "$PUBLIC_IP" ]; then
|
|
print_error "无法获取公网 IP"
|
|
exit 1
|
|
else
|
|
print_success "成功获取公网 IP: $PUBLIC_IP"
|
|
fi
|
|
|
|
# 配置 StrongSwan
|
|
print_info "正在配置 StrongSwan..."
|
|
cat <<EOF > /etc/ipsec.conf
|
|
config setup
|
|
charondebug="ike 1, knl 1, cfg 0"
|
|
uniqueids=no
|
|
|
|
conn L2TP-PSK
|
|
authby=secret
|
|
auto=add
|
|
keyingtries=3
|
|
rekey=no
|
|
ikelifetime=8h
|
|
keylife=1h
|
|
type=transport
|
|
left=%any
|
|
leftprotoport=17/1701
|
|
right=%any
|
|
rightprotoport=17/%any
|
|
dpdaction=clear
|
|
dpddelay=30s
|
|
dpdtimeout=120s
|
|
ike=aes256-sha256-modp2048!
|
|
esp=aes256-sha256!
|
|
EOF
|
|
print_success "StrongSwan 配置完成"
|
|
|
|
# 设置预共享密钥
|
|
print_info "正在设置预共享密钥..."
|
|
echo ": PSK \"$PSK\"" > /etc/ipsec.secrets
|
|
print_success "预共享密钥设置完成"
|
|
|
|
# 配置 xl2tpd
|
|
print_info "正在配置 xl2tpd..."
|
|
cat <<EOF > /etc/xl2tpd/xl2tpd.conf
|
|
[global]
|
|
port = 1701
|
|
|
|
[lns default]
|
|
ip range = 10.10.10.10-10.10.10.200
|
|
local ip = 10.10.10.1
|
|
require chap = yes
|
|
refuse pap = yes
|
|
require authentication = yes
|
|
name = L2TP-VPN-Server
|
|
ppp debug = yes
|
|
pppoptfile = /etc/ppp/options.xl2tpd
|
|
length bit = yes
|
|
EOF
|
|
print_success "xl2tpd 配置完成"
|
|
|
|
# 配置 PPP 选项
|
|
print_info "正在配置 PPP 选项..."
|
|
cat <<EOF > /etc/ppp/options.xl2tpd
|
|
ipcp-accept-local
|
|
ipcp-accept-remote
|
|
ms-dns 8.8.8.8
|
|
ms-dns 8.8.4.4
|
|
noccp
|
|
auth
|
|
mtu 1280
|
|
mru 1280
|
|
proxyarp
|
|
lcp-echo-failure 4
|
|
lcp-echo-interval 30
|
|
connect-delay 5000
|
|
EOF
|
|
print_success "PPP 选项配置完成"
|
|
|
|
# 添加 VPN 用户
|
|
print_info "正在添加 VPN 用户..."
|
|
echo "$USERNAME * $PASSWORD *" > /etc/ppp/chap-secrets
|
|
print_success "VPN 用户添加完成"
|
|
|
|
# 配置 IP 转发
|
|
print_info "正在配置 IP 转发..."
|
|
echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/60-vpn-forward.conf
|
|
sysctl -p /etc/sysctl.d/60-vpn-forward.conf
|
|
print_success "IP 转发配置完成"
|
|
|
|
# 配置 NAT
|
|
print_info "正在配置 NAT..."
|
|
DEFAULT_IFACE=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1)
|
|
iptables -t nat -A POSTROUTING -s 10.10.10.0/24 -o $DEFAULT_IFACE -j MASQUERADE
|
|
iptables-save > /etc/iptables.rules
|
|
print_success "NAT 配置完成"
|
|
|
|
# 创建一个服务来在启动时恢复 iptables 规则
|
|
print_info "正在创建 iptables 恢复服务..."
|
|
cat <<EOF > /etc/systemd/system/iptables-restore.service
|
|
[Unit]
|
|
Description=Restore iptables rules
|
|
Before=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/sbin/iptables-restore /etc/iptables.rules
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
systemctl enable iptables-restore
|
|
print_success "iptables 恢复服务创建完成"
|
|
|
|
# 重启并启用服务
|
|
print_info "正在重启并启用服务..."
|
|
if [[ "$OS" == *"Ubuntu"* ]]; then
|
|
systemctl restart strongswan
|
|
systemctl enable strongswan
|
|
elif [[ "$OS" == *"Debian"* ]]; then
|
|
systemctl restart strongswan-starter
|
|
systemctl enable strongswan-starter
|
|
else
|
|
print_info "未知的操作系统，尝试重启 strongswan 服务..."
|
|
systemctl restart strongswan || systemctl restart strongswan-starter
|
|
systemctl enable strongswan || systemctl enable strongswan-starter
|
|
fi
|
|
|
|
systemctl restart xl2tpd
|
|
systemctl enable xl2tpd
|
|
|
|
# 检查服务状态
|
|
if [[ "$OS" == *"Ubuntu"* ]]; then
|
|
check_service_status "strongswan"
|
|
elif [[ "$OS" == *"Debian"* ]]; then
|
|
check_service_status "strongswan-starter"
|
|
else
|
|
if systemctl is-active --quiet strongswan; then
|
|
check_service_status "strongswan"
|
|
elif systemctl is-active --quiet strongswan-starter; then
|
|
check_service_status "strongswan-starter"
|
|
else
|
|
print_error "strongSwan 服务未运行"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
check_service_status "xl2tpd"
|
|
|
|
# 输出连接信息
|
|
print_success "L2TP/IPSec VPN 安装和配置完成！"
|
|
echo -e "${GREEN}请使用以下信息进行连接：${NC}"
|
|
echo -e "${GREEN}服务器地址: $PUBLIC_IP${NC}"
|
|
echo -e "${GREEN}用户名: $USERNAME${NC}"
|
|
echo -e "${GREEN}密码: $PASSWORD${NC}"
|
|
echo -e "${GREEN}预共享密钥: $PSK${NC}"
|