From 9093cdb8bbeeadbe1edcecba54cd7d5bfe8ad724 Mon Sep 17 00:00:00 2001 From: Mengdi Gao Date: Sun, 25 Jan 2015 22:44:57 +0800 Subject: [PATCH] Running and working, then across the Great Wall, we can reach every corner in the world. --- Dockerfile | 15 ++++++ bin/generate-mobileconfig | 100 ++++++++++++++++++++++++++++++++++++++ bin/start-vpn | 14 ++++++ etc/ipsec.conf | 24 +++++++++ etc/strongswan.conf | 21 ++++++++ 5 files changed, 174 insertions(+) create mode 100644 Dockerfile create mode 100755 bin/generate-mobileconfig create mode 100755 bin/start-vpn create mode 100644 etc/ipsec.conf create mode 100644 etc/strongswan.conf diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..a6eda25 --- /dev/null +++ b/Dockerfile @@ -0,0 +1,15 @@ +FROM ubuntu:14.04 + +RUN apt-get update +RUN apt-get -y install strongswan iptables uuid-runtime +RUN rm /etc/ipsec.secrets + +ADD ./etc/* /etc/ +ADD ./bin/* /usr/bin/ + +VOLUME /etc + +# http://blogs.technet.com/b/rrasblog/archive/2006/06/14/which-ports-to-unblock-for-vpn-traffic-to-pass-through.aspx +EXPOSE 500/udp 4500/udp + +CMD /usr/bin/start-vpn diff --git a/bin/generate-mobileconfig b/bin/generate-mobileconfig new file mode 100755 index 0000000..2b17731 --- /dev/null +++ b/bin/generate-mobileconfig @@ -0,0 +1,100 @@ +#!/bin/bash + +# TODO: add regenerate shared secret option + +# In normal cases, you will only need to pass the HOST of your server. +[ "no${HOST}" = "no" ] && echo "\$HOST environment variable required." && exit 1 + +: ${PROFILE_NAME="My IKEv2 VPN Profile"} +: ${PROFILE_IDENTIFIER=$(echo -n "${HOST}." | tac -s. | sed 's/\.$//g')} +: ${PROFILE_UUID=$(hostname)} + +# These variable, especially CONN_UUID, are bind to per username, +# which currently, all users share the same secrets and configurations. +: ${CONN_NAME="My IKEv2 VPN"} +: ${CONN_IDENTIFIER="${PROFILE_IDENTIFIER}.shared-configuration"} +: ${CONN_UUID=$(uuidgen)} +: ${CONN_HOST=${HOST}} +: ${CONN_REMOTE_IDENTIFIER=${HOST}} +CONN_SHARED_SECRET=$(cat /etc/ipsec.secrets | sed 's/.*"\(.*\)"/\1/g') + +cat < + + + + + PayloadDisplayName + ${PROFILE_NAME} + + PayloadIdentifier + ${PROFILE_IDENTIFIER} + + PayloadUUID + ${PROFILE_UUID} + PayloadType + Configuration + PayloadVersion + 1 + PayloadContent + + + + + PayloadIdentifier + ${CONN_IDENTIFIER} + + PayloadUUID + ${CONN_UUID} + PayloadType + com.apple.vpn.managed + PayloadVersion + 1 + + UserDefinedName + ${CONN_NAME} + VPNType + IKEv2 + IKEv2 + + + RemoteAddress + ${CONN_HOST} + + RemoteIdentifier + ${CONN_REMOTE_IDENTIFIER} + + LocalIdentifier + + + OnDemandEnabled + 1 + OnDemandRules + + + Action + Connect + + + + AuthenticationMethod + SharedSecret + SharedSecret + ${CONN_SHARED_SECRET} + + ExtendedAuthEnabled + 0 + + + + + +EOF diff --git a/bin/start-vpn b/bin/start-vpn new file mode 100755 index 0000000..0ed5fd6 --- /dev/null +++ b/bin/start-vpn @@ -0,0 +1,14 @@ +#!/bin/bash + +# https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling +# Continue reading: https://wiki.strongswan.org/projects/strongswan/wiki/VirtualIP +sysctl net.ipv4.ip_forward=1 +iptables -t nat -A POSTROUTING -s 10.8.0.0/16 -o eth0 -m policy --dir out --pol ipsec -j ACCEPT +iptables -t nat -A POSTROUTING -s 10.8.0.0/16 -o eth0 -j MASQUERADE + +# hotfix for openssl `unable to write 'random state'` stderr +SHARED_SECRET="123$(openssl rand -base64 32 2>/dev/null)" +[ -f /etc/ipsec.secrets ] || echo ": PSK \"${SHARED_SECRET}\"" > /etc/ipsec.secrets + +# http://wiki.loopop.net/doku.php?id=server:vpn:strongswanonopenvz +/usr/sbin/ipsec start --nofork diff --git a/etc/ipsec.conf b/etc/ipsec.conf new file mode 100644 index 0000000..042b913 --- /dev/null +++ b/etc/ipsec.conf @@ -0,0 +1,24 @@ +# /etc/ipsec.conf - strongSwan IPsec configuration file +# +# Based on http://www.strongswan.org/uml/testresults/ikev2/rw-psk-ipv4/ + +config setup + +conn %default + left=%defaultroute + ikelifetime=60m + keylife=20m + rekeymargin=3m + keyingtries=1 + keyexchange=ikev2 + authby=secret + +conn rw + # http://wiki.loopop.net/doku.php?id=server:vpn:strongswanonopenvz + # https://wiki.strongswan.org/projects/strongswan/wiki/ForwardingAndSplitTunneling + leftsubnet=0.0.0.0/0 + # end ref + leftfirewall=yes + right=%any + rightsourceip=10.8.0.0/16 + auto=add diff --git a/etc/strongswan.conf b/etc/strongswan.conf new file mode 100644 index 0000000..696103e --- /dev/null +++ b/etc/strongswan.conf @@ -0,0 +1,21 @@ +# /etc/strongswan.conf - strongSwan configuration file +# +# strongswan.conf - strongSwan configuration file +# +# Refer to the strongswan.conf(5) manpage for details +# +# Configuration changes should be made in the included files + +charon { + load_modular = yes + plugins { + include strongswan.d/charon/*.conf + + # https://wiki.strongswan.org/projects/strongswan/wiki/Attrplugin + attr { + dns = 8.8.8.8, 8.8.4.4 + } + } +} + +include strongswan.d/*.conf