vpn_setup.sh (1598B)
1 #!/usr/bin/env sh 2 3 set -e 4 5 sysctl net.inet.ip.forwarding=1 6 sysctl net.inet.ipcomp.enable=1 7 sysctl net.inet.esp.enable=1 8 sysctl net.inet.esp.udpencap=1 9 10 cat >> /etc/sysctl.conf << "END" 11 12 net.inet.ip.forwarding=1 13 net.inet.ipcomp.enable=1 14 net.inet.esp.enable=1 15 net.inet.esp.udpencap=1 16 END 17 18 cat > /etc/hostname.enc0 << "END" 19 inet 10.0.1.1 255.255.255.0 10.0.1.255 20 up 21 END 22 23 sh /etc/netstart 24 25 echo "user name:" 26 read NAME 27 echo "user password:" 28 read PASSWORD 29 30 cat > /etc/iked.conf << "END" 31 server_ip = "185.92.220.211" 32 dns1 = "1.1.1.1" 33 dns2 = "8.8.8.8" 34 35 user "$NAME" "$PASSWORD" 36 37 ikev2 "responder_eap" passive esp \ 38 from 0.0.0.0/0 to 10.0.1.0/24 \ 39 from 10.0.0.0/24 to 10.0.1.0/24 \ 40 local egress peer any \ 41 ikesa enc aes-256 prf hmac-sha2-256 auth hmac-sha2-256 group modp2048 \ 42 childsa enc aes-256 auth hmac-sha2-256 group modp2048 \ 43 srcid konyahin.xyz \ 44 eap "mschap-v2" \ 45 config protected-subnet 0.0.0.0/0 \ 46 config address 10.0.1.0/24 \ 47 config name-server $dns1 \ 48 config name-server $dns2 \ 49 tag "ROADW" 50 END 51 52 cat >> /etc/pf.conf << "END" 53 54 wan = vio0 55 vpn = enc0 56 match out on $wan inet nat-to ($wan:0) 57 pass in quick on $wan inet proto udp from any to ($wan:0) port {500, 4500} keep state label ipsec 58 pass in quick on $vpn inet keep state (if-bound) 59 END 60 61 pfctl -f /etc/pf.conf 62 63 cp /etc/ssl/private/konyahin.xyz.key /etc/iked/private/local.key 64 65 csplit -s -fcerts /etc/ssl/konyahin.xyz.fullchain.pem /BEGIN/ {0} 66 mv certs00 /etc/iked/certs/konyahin.xyz.crt 67 mv certs01 /etc/iked/ca/ca.crt 68 69 echo 'iked_flags=""' >> /etc/rc.conf.local 70 rcctl enable iked 71 rcctl start iked