fixing bug that prevented adding two dns servers separated by a comma

Dockerfile

@@ -2,16 +2,12 @@ FROM ubuntu:16.04
 
 RUN apt-get update \
     && DEBIAN_FRONTEND=noninteractive apt-get -y install strongswan iptables uuid-runtime ndppd openssl \
-
+    && rm /etc/ipsec.secrets
-RUN rm /etc/ipsec.secrets
-RUN mkdir /config
-RUN (cd /etc && ln -s /config/ipsec.secrets .)
 
 ADD ./etc/* /etc/
 ADD ./bin/* /usr/bin/
 
 VOLUME /etc
-VOLUME /config
 
 # http://blogs.technet.com/b/rrasblog/archive/2006/06/14/which-ports-to-unblock-for-vpn-traffic-to-pass-through.aspx
 EXPOSE 500/udp 4500/udp

LICENSE

@@ -1,5 +1,6 @@
 The MIT License (MIT)
 
+Copyright (c) 2019 Andrew Davidson
 Copyright (c) 2016 Mengdi Gao
 
 Permission is hereby granted, free of charge, to any person obtaining a copy

README.md

@@ -6,13 +6,25 @@ Recipe to build [`amdavidson/vpn-server`](https://registry.hub.docker.com/u/amda
 
 ### 1. Start the IKEv2 VPN Server
 
-    docker run --privileged -d --name vpn-server --restart=always -p 500:500/udp -p 4500:4500/udp amdavidson/vpn-server:latest
+    docker run -d \
+    --name vpn-server \
+    --restart=always \
+    --cap-add=NET_ADMIN \
+    -v vpn-server-etc:/etc \
+    -p 500:500/udp -p 4500:4500/udp \
+    -e "DNS=9.9.9.9" \
+    amdavidson/vpn-server:latest
 
 ### 2. Generate the .mobileconfig (for iOS / macOS)
 
-    docker run --privileged -i -t --rm --volumes-from vpn-server -e "HOST=vpn1.example.com" amdavidson/vpn-server:latest generate-mobileconfig > ikev2-vpn.mobileconfig
+    docker run -it --rm \
+    --volumes-from vpn-server \
+    -e "HOST=vpn1.example.com" \
+    -e "SAFE_SSID=my home ssid" \
+    amdavidson/vpn-server:latest \
+    generate-mobileconfig > ikev2-vpn.mobileconfig
 
-*Be sure to replace `vpn1.example.com` with your own domain name and resolve it to you server's IP address. 
+Be sure to replace `vpn1.example.com` with your own domain name and resolve it to you server's IP address. 
 
 Transfer the generated `ikev2-vpn.mobileconfig` file to your local computer via SSH tunnel (`scp`) or any other secure methods.
 

bin/generate-mobileconfig

@@ -22,18 +22,16 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 # THE SOFTWARE.
 
-# TODO: add regenerate shared secret option
-
 # In normal cases, you will only need to pass the HOST of your server.
 [ "no${HOST}" = "no" ] && echo "\$HOST environment variable required." && exit 1
 
-: ${PROFILE_NAME="My IKEv2 VPN Profile"}
+: ${PROFILE_NAME="IKEv2 VPN Profile"}
 : ${PROFILE_IDENTIFIER=$(echo -n "${HOST}." | tac -s. | sed 's/\.$//g')}
 : ${PROFILE_UUID=$(hostname)}
 
 # These variable, especially CONN_UUID, are bind to per username,
 # which currently, all users share the same secrets and configurations.
-: ${CONN_NAME="My IKEv2 VPN"}
+: ${CONN_NAME="IKEv2 VPN"}
 : ${CONN_IDENTIFIER="${PROFILE_IDENTIFIER}.shared-configuration"}
 : ${CONN_UUID=$(uuidgen)}
 : ${CONN_HOST=${HOST}}
@@ -105,6 +103,19 @@ cat <<EOF
                         <dict>
                             <key>Action</key>
                             <string>Connect</string>
+                            <key>InterfaceTypeMatch</key>
+                            <string>WiFi</string>
+                        </dict>
+                        <dict>
+                            <key>Action</key>
+                            <string>Disconnect</string>
+                            <key>InterfaceTypeMatch</key>
+                            <string>WiFi</string>
+                            <key>SSIDMatch</key>
+                            <array>
+                                <!-- List one or more WiFi networks -->
+                                <string>${SAFE_SSID}</string>
+                            </array>
                         </dict>
                     </array>
                     <!-- The server is authenticated using a certificate -->

bin/start-vpn

@@ -39,6 +39,11 @@ SHARED_SECRET="123$(openssl rand -base64 32 2>/dev/null)"
 # hotfix for https://github.com/gaomd/docker-ikev2-vpn-server/issues/7
 rm -f /var/run/starter.charon.pid
 
+# Allow DNS changes https://github.com/amdavidson/vpn-server/issues/5
+if [ -n $DNS ]; then
+    sed -i "s/dns = .*/dns = ${DNS}/" /etc/strongswan.conf
+fi
+
 service ndppd start
 # http://wiki.loopop.net/doku.php?id=server:vpn:strongswanonopenvz
 /usr/sbin/ipsec start --nofork