#!/bin/bash ######系統配合 #下載ISO檔 #https://ftp.ubuntu-tw.org/ubuntu-releases/26.04.1/ 安裝 ######鄭亮星 jls@mail.jls.idv.tw , jls550225@gmail.com , jls@acfs.tw ####安裝 VPN xl2tp ETH0=$(ls /proc/net/dev_snmp6 |awk '{ print $1 }' |sed -n '1p') ETH1=$(ls /proc/net/dev_snmp6 |awk '{ print $1 }' |sed -n '2p') HOST=$(/bin/hostname -s) DOMAINNAME=$(/bin/hostname -d) IP=$(ifconfig $ETH0 |grep 'inet ' |awk '{print $2}') DATE=$(date "+%Y%m%d%H") . /root/setup.txt sync clear while [ "$Select" != "system" -a "$Select" != "custom" ] do read -p "若要自定帳號請輸入小寫的 custom 若用系統帳號請輸入小寫的 system :" Select clear done if [ "$Select" != "system" ]; then while [ "$yn" != "yes" -a "$yn" != "YES" ] do read -p "請輸入 VPN 播接帳號(例 vpn ):" VpnName read -p "請輸入 VPN 播接密碼(例如 password ):" VpnPassword read -p "請輸入 VPN PSK 共用金鑰(例如 168168 ):" VpnPsk clear echo "您輸入的 VPN 播接帳號是: $VpnName" echo "您輸入的 VPN 播接密碼是: $VpnPassword" echo "您輸入的 VPN PSK 共用金鑰是: $VpnPsk" read -p "以上輸入是否正確？ 正確請輸入 yes 或 YES，否則按任一鍵繼續輸入:" yn clear done else while [ "$yn" != "yes" -a "$yn" != "YES" ] do read -p "請輸入 VPN PSK 共用金鑰(例如 168168 ):" VpnPsk clear echo "您輸入的 VPN PSK 共用金鑰是: $VpnPsk" read -p "以上輸入是否正確？ 正確請輸入 yes 或 YES，否則按任一鍵繼續輸入:" yn clear done fi apt -y install strongswan xl2tpd cp -arf /etc/ipsec.conf /etc/ipsec.conf-$DATE cat > /etc/ipsec.conf < /etc/ipsec.secrets << EOF $IP %any : PSK "$VpnPsk" EOF cp -arf /etc/xl2tpd/xl2tpd.conf /etc/xl2tpd/xl2tpd.conf-$DATE cat > /etc/xl2tpd/xl2tpd.conf << EOF ; ; This is a minimal sample xl2tpd configuration file for use ; with L2TP over IPsec. ; ; The idea is to provide an L2TP daemon to which remote Windows L2TP/IPsec ; clients connect. In this example, the internal (protected) network ; is 192.168.1.0/24. A special IP range within this network is reserved ; for the remote clients: 192.168.1.128/25 ; (i.e. 192.168.1.128 ... 192.168.1.254) ; ; The listen-addr parameter can be used if you want to bind the L2TP daemon ; to a specific IP address instead of to all interfaces. For instance, ; you could bind it to the interface of the internal LAN (e.g. 192.168.1.98 ; in the example below). Yet another IP address (local ip, e.g. 192.168.1.99) ; will be used by xl2tpd as its address on pppX interfaces. [global] listen-addr = $IP ipsec saref = yes [lns default] ip range = 192.168.1.51-192.168.1.150 local ip = 192.168.1.1 refuse chap = yes refuse pap = yes require chap = yes require pap = yes require authentication = yes unix authentication = yes name = LinuxVPNserver ppp debug = yes pppoptfile = /etc/ppp/options.xl2tpd length bit = yes EOF cp -arf /etc/ppp/options.xl2tpd /etc/ppp/options.xl2tpd-$DATE cat > /etc/ppp/options.xl2tpd << EOF ipcp-accept-local ipcp-accept-remote noccp refuse-pap refuse-chap refuse-mschap require-mschap-v2 require-mppe-128 nodefaultroute ms-dns 1.1.1.1 ms-dns 8.8.8.8 ms-dns 168.95.192.1 ms-dns 168.95.1.1 idle 1800 debug asyncmap 0 auth noipx mru 1400 mtu 1400 crtscts hide-password modem connect-delay 5000 proxyarp lcp-echo-interval 30 lcp-echo-failure 4 lock login EOF if [ "$Select" = "system" ]; then cp -arf /etc/ppp/chap-secrets /etc/ppp/chap-secrets-$DATE cat > /etc/ppp/chap-secrets << EOF # Secrets for authentication using CHAP # client server secret IP addresse #* * "" * EOF cp -arf /etc/ppp/pap-secrets /etc/ppp/pap-secrets-$DATE cat >> /etc/ppp/pap-secrets << EOF # Secrets for authentication using CHAP # client server secret IP addresse * * "" * EOF else cat > /etc/ppp/chap-secrets << EOF # Secrets for authentication using CHAP # client server secret IP addresse $VpnName * "$VpnPassword" * EOF fi cp -arf /etc/sysctl.conf /etc/sysctl.conf-$DATE cat >> /etc/sysctl.conf << EOF vm.swappiness = 0 net.ipv4.neigh.default.gc_stale_time=120 net.ipv4.conf.all.rp_filter=0 net.ipv4.conf.default.rp_filter=0 net.ipv4.conf.default.arp_announce = 2 net.ipv4.conf.all.arp_announce=2 net.ipv4.tcp_max_tw_buckets = 5000 net.ipv4.tcp_syncookies = 1 net.ipv4.tcp_max_syn_backlog = 1024 net.ipv4.tcp_synack_retries = 2 net.ipv4.conf.lo.arp_announce=2 net.ipv4.ip_forward = 1 net.ipv4.conf.default.accept_redirects = 0 net.ipv4.conf.default.send_redirects = 0 net.ipv4.conf.default.accept_source_route = 0 ### 開啟 IPv6 net.ipv6.conf.all.accept_redirects = 1 net.ipv6.conf.all.accept_source_route = 1 net.ipv6.conf.default.forwarding = 1 net.ipv6.conf.all.forwarding = 1 net.ipv6.conf.all.accept_source_route = 0 net.ipv6.conf.default.accept_source_route = 0 net.ipv6.conf.all.accept_redirects = 0 net.ipv6.conf.default.accept_redirects = 0 net.ipv6.conf.all.autoconf = 1 net.ipv6.conf.default.accept_ra = 2 net.ipv6.conf.all.accept_ra = 2 net.ipv6.conf.all.use_tempaddr = 0 net.ipv6.conf.default.use_tempaddr = 0 net.ipv6.conf.$ETH0.use_tempaddr = 2 ##關閉 IPV6 #net.ipv6.conf.all.disable_ipv6 = 1 EOF sysctl -p cp -arf /etc/pam.d/ppp /etc/pam.d/ppp-$DATE cat > /etc/pam.d/ppp << EOF #%PAM-1.0 auth required pam_nologin.so auth required pam_unix.so account required pam_unix.so session required pam_unix.so EOF ##12.開啟防火牆連接埠 #UDP:500 (isakmp) #UDP:4500 (nat-t) #UDP:1701 (l2tp)PROT UDF ####在/etc/rc.local檔加入防火牆給VPN對外連線 #cat >> /etc/rc.local << EOF #iptables -A INPUT -p esp -j ACCEPT #iptables -A INPUT -p ah -j ACCEPT #iptables -A INPUT -p udp --dport 500 -j ACCEPT #iptables -A INPUT -p udp --dport 4500 -j ACCEPT #iptables -A INPUT -p udp -m policy --dir in --pol ipsec -m udp --dport 1701 -j ACCEPT #iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o $ETH0 -j MASQUERADE #EOF #systemctl enable strongswan-starter.service #systemctl enable xl2tpd.service systemctl restart strongswan-starter.service systemctl restart xl2tpd.service