1. wget --no-check-certificate https://raw.githubusercontent.com/teddysun/across/master/l2tp.sh
    1. #!/usr/bin/env bash
    2. PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:~/bin
    3. export PATH
    4. #=======================================================================#
    5. #   System Supported:  CentOS 6+ / Debian 7+ / Ubuntu 12+               #
    6. #   Description: L2TP VPN Auto Installer                                #
    7. #   Author: Teddysun <i@teddysun.com>                                   #
    8. #   Intro:  https://teddysun.com/448.html                               #
    9. #=======================================================================#
    10. cur_dir=`pwd`
    12. libreswan_filename="libreswan-3.27"
    13. download_root_url="https://dl.lamp.sh/files"
    15. rootness(){
    16.     if [[ $EUID -ne 0 ]]; then
    17.        echo "Error:This script must be run as root!" 1>&2
    18.        exit 1
    19.     fi
    20. }
    22. tunavailable(){
    23.     if [[ ! -e /dev/net/tun ]]; then
    24.         echo "Error:TUN/TAP is not available!" 1>&2
    25.         exit 1
    26.     fi
    27. }
    29. disable_selinux(){
    30. if [ -s /etc/selinux/config ] && grep 'SELINUX=enforcing' /etc/selinux/config; then
    31.     sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config
    32.     setenforce 0
    33. fi
    34. }
    36. get_opsy(){
    37.     [ -f /etc/redhat-release ] && awk '{print ($1,$3~/^[0-9]/?$3:$4)}' /etc/redhat-release && return
    38.     [ -f /etc/os-release ] && awk -F'[= "]' '/PRETTY_NAME/{print $3,$4,$5}' /etc/os-release && return
    39.     [ -f /etc/lsb-release ] && awk -F'[="]+' '/DESCRIPTION/{print $2}' /etc/lsb-release && return
    40. }
    42. get_os_info(){
    43.     IP=$( ip addr | egrep -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | egrep -v "^192\.168|^172\.1[6-9]\.|^172\.2[0-9]\.|^172\.3[0-2]\.|^10\.|^127\.|^255\.|^0\." | head -n 1 )
    44.     [ -z ${IP} ] && IP=$( wget -qO- -t1 -T2 ipv4.icanhazip.com )
    46.     local cname=$( awk -F: '/model name/ {name=$2} END {print name}' /proc/cpuinfo | sed 's/^[ \t]*//;s/[ \t]*$//' )
    47.     local cores=$( awk -F: '/model name/ {core++} END {print core}' /proc/cpuinfo )
    48.     local freq=$( awk -F: '/cpu MHz/ {freq=$2} END {print freq}' /proc/cpuinfo | sed 's/^[ \t]*//;s/[ \t]*$//' )
    49.     local tram=$( free -m | awk '/Mem/ {print $2}' )
    50.     local swap=$( free -m | awk '/Swap/ {print $2}' )
    51.     local up=$( awk '{a=$1/86400;b=($1%86400)/3600;c=($1%3600)/60;d=$1%60} {printf("%ddays, %d:%d:%d\n",a,b,c,d)}' /proc/uptime )
    52.     local load=$( w | head -1 | awk -F'load average:' '{print $2}' | sed 's/^[ \t]*//;s/[ \t]*$//' )
    53.     local opsy=$( get_opsy )
    54.     local arch=$( uname -m )
    55.     local lbit=$( getconf LONG_BIT )
    56.     local host=$( hostname )
    57.     local kern=$( uname -r )
    59.     echo "########## System Information ##########"
    60.     echo 
    61.     echo "CPU model            : ${cname}"
    62.     echo "Number of cores      : ${cores}"
    63.     echo "CPU frequency        : ${freq} MHz"
    64.     echo "Total amount of ram  : ${tram} MB"
    65.     echo "Total amount of swap : ${swap} MB"
    66.     echo "System uptime        : ${up}"
    67.     echo "Load average         : ${load}"
    68.     echo "OS                   : ${opsy}"
    69.     echo "Arch                 : ${arch} (${lbit} Bit)"
    70.     echo "Kernel               : ${kern}"
    71.     echo "Hostname             : ${host}"
    72.     echo "IPv4 address         : ${IP}"
    73.     echo 
    74.     echo "########################################"
    75. }
    77. check_sys(){
    78.     local checkType=$1
    79.     local value=$2
    81.     local release=''
    82.     local systemPackage=''
    84.     if [[ -f /etc/redhat-release ]]; then
    85.         release="centos"
    86.         systemPackage="yum"
    87.     elif cat /etc/issue | grep -Eqi "debian"; then
    88.         release="debian"
    89.         systemPackage="apt"
    90.     elif cat /etc/issue | grep -Eqi "ubuntu"; then
    91.         release="ubuntu"
    92.         systemPackage="apt"
    93.     elif cat /etc/issue | grep -Eqi "centos|red hat|redhat"; then
    94.         release="centos"
    95.         systemPackage="yum"
    96.     elif cat /proc/version | grep -Eqi "debian"; then
    97.         release="debian"
    98.         systemPackage="apt"
    99.     elif cat /proc/version | grep -Eqi "ubuntu"; then
    100.         release="ubuntu"
    101.         systemPackage="apt"
    102.     elif cat /proc/version | grep -Eqi "centos|red hat|redhat"; then
    103.         release="centos"
    104.         systemPackage="yum"
    105.     fi
    107.     if [[ ${checkType} == "sysRelease" ]]; then
    108.         if [ "$value" == "$release" ];then
    109.             return 0
    110.         else
    111.             return 1
    112.         fi
    113.     elif [[ ${checkType} == "packageManager" ]]; then
    114.         if [ "$value" == "$systemPackage" ];then
    115.             return 0
    116.         else
    117.             return 1
    118.         fi
    119.     fi
    120. }
    122. rand(){
    123.     index=0
    124.     str=""
    125.     for i in {a..z}; do arr[index]=${i}; index=`expr ${index} + 1`; done
    126.     for i in {A..Z}; do arr[index]=${i}; index=`expr ${index} + 1`; done
    127.     for i in {0..9}; do arr[index]=${i}; index=`expr ${index} + 1`; done
    128.     for i in {1..10}; do str="$str${arr[$RANDOM%$index]}"; done
    129.     echo ${str}
    130. }
    132. is_64bit(){
    133.     if [ `getconf WORD_BIT` = '32' ] && [ `getconf LONG_BIT` = '64' ] ; then
    134.         return 0
    135.     else
    136.         return 1
    137.     fi
    138. }
    140. download_file(){
    141.     if [ -s ${1} ]; then
    142.         echo "$1 [found]"
    143.     else
    144.         echo "$1 not found!!!download now..."
    145.         if ! wget -c -t3 -T60 ${download_root_url}/${1}; then
    146.             echo "Failed to download $1, please download it to ${cur_dir} directory manually and try again."
    147.             exit 1
    148.         fi
    149.     fi
    150. }
    152. versionget(){
    153.     if [[ -s /etc/redhat-release ]];then
    154.         grep -oE  "[0-9.]+" /etc/redhat-release
    155.     else
    156.         grep -oE  "[0-9.]+" /etc/issue
    157.     fi
    158. }
    160. centosversion(){
    161.     if check_sys sysRelease centos;then
    162.         local code=${1}
    163.         local version="`versionget`"
    164.         local main_ver=${version%%.*}
    165.         if [ "${main_ver}" == "${code}" ];then
    166.             return 0
    167.         else
    168.             return 1
    169.         fi
    170.     else
    171.         return 1
    172.     fi
    173. }
    175. debianversion(){
    176.     if check_sys sysRelease debian;then
    177.         local version=$( get_opsy )
    178.         local code=${1}
    179.         local main_ver=$( echo ${version} | sed 's/[^0-9]//g')
    180.         if [ "${main_ver}" == "${code}" ];then
    181.             return 0
    182.         else
    183.             return 1
    184.         fi
    185.     else
    186.         return 1
    187.     fi
    188. }
    190. version_check(){
    191.     if check_sys packageManager yum; then
    192.         if centosversion 5; then
    193.             echo "Error: CentOS 5 is not supported, Please re-install OS and try again."
    194.             exit 1
    195.         fi
    196.     fi
    197. }
    199. get_char(){
    200.     SAVEDSTTY=`stty -g`
    201.     stty -echo
    202.     stty cbreak
    203.     dd if=/dev/tty bs=1 count=1 2> /dev/null
    204.     stty -raw
    205.     stty echo
    206.     stty $SAVEDSTTY
    207. }
    209. preinstall_l2tp(){
    211.     echo
    212.     if [ -d "/proc/vz" ]; then
    213.         echo -e "\033[41;37m WARNING: \033[0m Your VPS is based on OpenVZ, and IPSec might not be supported by the kernel."
    214.         echo "Continue installation? (y/n)"
    215.         read -p "(Default: n)" agree
    216.         [ -z ${agree} ] && agree="n"
    217.         if [ "${agree}" == "n" ]; then
    218.             echo
    219.             echo "L2TP installation cancelled."
    220.             echo
    221.             exit 0
    222.         fi
    223.     fi
    224.     echo
    225.     echo "Please enter IP-Range:"
    226.     read -p "(Default Range: 192.168.18):" iprange
    227.     [ -z ${iprange} ] && iprange="192.168.18"
    229.     echo "Please enter PSK:"
    230.     read -p "(Default PSK: teddysun.com):" mypsk
    231.     [ -z ${mypsk} ] && mypsk="teddysun.com"
    233.     echo "Please enter Username:"
    234.     read -p "(Default Username: teddysun):" username
    235.     [ -z ${username} ] && username="teddysun"
    237.     password=`rand`
    238.     echo "Please enter ${username}'s password:"
    239.     read -p "(Default Password: ${password}):" tmppassword
    240.     [ ! -z ${tmppassword} ] && password=${tmppassword}
    242.     echo
    243.     echo "ServerIP:${IP}"
    244.     echo "Server Local IP:${iprange}.1"
    245.     echo "Client Remote IP Range:${iprange}.2-${iprange}.254"
    246.     echo "PSK:${mypsk}"
    247.     echo
    248.     echo "Press any key to start... or press Ctrl + C to cancel."
    249.     char=`get_char`
    251. }
    253. install_l2tp(){
    255.     mknod /dev/random c 1 9
    257.     if check_sys packageManager apt; then
    258.         apt-get -y update
    260.         if debianversion 7; then
    261.             if is_64bit; then
    262.                 local libnspr4_filename1="libnspr4_4.10.7-1_amd64.deb"
    263.                 local libnspr4_filename2="libnspr4-0d_4.10.7-1_amd64.deb"
    264.                 local libnspr4_filename3="libnspr4-dev_4.10.7-1_amd64.deb"
    265.                 local libnspr4_filename4="libnspr4-dbg_4.10.7-1_amd64.deb"
    266.                 local libnss3_filename1="libnss3_3.17.2-1.1_amd64.deb"
    267.                 local libnss3_filename2="libnss3-1d_3.17.2-1.1_amd64.deb"
    268.                 local libnss3_filename3="libnss3-tools_3.17.2-1.1_amd64.deb"
    269.                 local libnss3_filename4="libnss3-dev_3.17.2-1.1_amd64.deb"
    270.                 local libnss3_filename5="libnss3-dbg_3.17.2-1.1_amd64.deb"
    271.             else
    272.                 local libnspr4_filename1="libnspr4_4.10.7-1_i386.deb"
    273.                 local libnspr4_filename2="libnspr4-0d_4.10.7-1_i386.deb"
    274.                 local libnspr4_filename3="libnspr4-dev_4.10.7-1_i386.deb"
    275.                 local libnspr4_filename4="libnspr4-dbg_4.10.7-1_i386.deb"
    276.                 local libnss3_filename1="libnss3_3.17.2-1.1_i386.deb"
    277.                 local libnss3_filename2="libnss3-1d_3.17.2-1.1_i386.deb"
    278.                 local libnss3_filename3="libnss3-tools_3.17.2-1.1_i386.deb"
    279.                 local libnss3_filename4="libnss3-dev_3.17.2-1.1_i386.deb"
    280.                 local libnss3_filename5="libnss3-dbg_3.17.2-1.1_i386.deb"
    281.             fi
    282.             rm -rf ${cur_dir}/l2tp
    283.             mkdir -p ${cur_dir}/l2tp
    284.             cd ${cur_dir}/l2tp
    285.             download_file "${libnspr4_filename1}"
    286.             download_file "${libnspr4_filename2}"
    287.             download_file "${libnspr4_filename3}"
    288.             download_file "${libnspr4_filename4}"
    289.             download_file "${libnss3_filename1}"
    290.             download_file "${libnss3_filename2}"
    291.             download_file "${libnss3_filename3}"
    292.             download_file "${libnss3_filename4}"
    293.             download_file "${libnss3_filename5}"
    294.             dpkg -i ${libnspr4_filename1} ${libnspr4_filename2} ${libnspr4_filename3} ${libnspr4_filename4}
    295.             dpkg -i ${libnss3_filename1} ${libnss3_filename2} ${libnss3_filename3} ${libnss3_filename4} ${libnss3_filename5}
    297.             apt-get -y install wget gcc ppp flex bison make pkg-config libpam0g-dev libcap-ng-dev iptables \
    298.                                libcap-ng-utils libunbound-dev libevent-dev libcurl4-nss-dev libsystemd-daemon-dev
    299.         else
    300.             apt-get -y install wget gcc ppp flex bison make python libnss3-dev libnss3-tools libselinux-dev iptables \
    301.                                libnspr4-dev pkg-config libpam0g-dev libcap-ng-dev libcap-ng-utils libunbound-dev \
    302.                                libevent-dev libcurl4-nss-dev libsystemd-dev
    303.         fi
    304.         apt-get -y --no-install-recommends install xmlto
    305.         apt-get -y install xl2tpd
    307.         compile_install
    308.     elif check_sys packageManager yum; then
    309.         echo "Adding the EPEL repository..."
    310.         yum -y install epel-release yum-utils
    311.         [ ! -f /etc/yum.repos.d/epel.repo ] && echo "Install EPEL repository failed, please check it." && exit 1
    312.         yum-config-manager --enable epel
    313.         echo "Adding the EPEL repository complete..."
    315.         if centosversion 7; then
    316.             yum -y install ppp libreswan xl2tpd firewalld
    317.             yum_install
    318.         elif centosversion 6; then
    319.             yum -y remove libevent-devel
    320.             yum -y install libevent2-devel
    321.             yum -y install nss-devel nspr-devel pkgconfig pam-devel \
    322.                            libcap-ng-devel libselinux-devel lsof \
    323.                            curl-devel flex bison gcc ppp make iptables gmp-devel \
    324.                            fipscheck-devel unbound-devel xmlto libpcap-devel xl2tpd
    326.             compile_install
    327.         fi
    328.     fi
    330. }
    332. config_install(){
    334.     cat > /etc/ipsec.conf<<EOF
    335. version 2.0
    337. config setup
    338.     protostack=netkey
    339.     nhelpers=0
    340.     uniqueids=no
    341.     interfaces=%defaultroute
    342.     virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!${iprange}.0/24
    344. conn l2tp-psk
    345.     rightsubnet=vhost:%priv
    346.     also=l2tp-psk-nonat
    348. conn l2tp-psk-nonat
    349.     authby=secret
    350.     pfs=no
    351.     auto=add
    352.     keyingtries=3
    353.     rekey=no
    354.     ikelifetime=8h
    355.     keylife=1h
    356.     type=transport
    357.     left=%defaultroute
    358.     leftid=${IP}
    359.     leftprotoport=17/1701
    360.     right=%any
    361.     rightprotoport=17/%any
    362.     dpddelay=40
    363.     dpdtimeout=130
    364.     dpdaction=clear
    365.     sha2-truncbug=yes
    366. EOF
    368.     cat > /etc/ipsec.secrets<<EOF
    369. %any %any : PSK "${mypsk}"
    370. EOF
    372.     cat > /etc/xl2tpd/xl2tpd.conf<<EOF
    373. [global]
    374. port = 1701
    376. [lns default]
    377. ip range = ${iprange}.2-${iprange}.254
    378. local ip = ${iprange}.1
    379. require chap = yes
    380. refuse pap = yes
    381. require authentication = yes
    382. name = l2tpd
    383. ppp debug = yes
    384. pppoptfile = /etc/ppp/options.xl2tpd
    385. length bit = yes
    386. EOF
    388.     cat > /etc/ppp/options.xl2tpd<<EOF
    389. ipcp-accept-local
    390. ipcp-accept-remote
    391. require-mschap-v2
    392. ms-dns 8.8.8.8
    393. ms-dns 8.8.4.4
    394. noccp
    395. auth
    396. hide-password
    397. idle 1800
    398. mtu 1410
    399. mru 1410
    400. nodefaultroute
    401. debug
    402. proxyarp
    403. connect-delay 5000
    404. EOF
    406.     rm -f /etc/ppp/chap-secrets
    407.     cat > /etc/ppp/chap-secrets<<EOF
    408. # Secrets for authentication using CHAP
    409. # client    server    secret    IP addresses
    410. ${username}    l2tpd    ${password}       *
    411. EOF
    413. }
    415. compile_install(){
    417.     rm -rf ${cur_dir}/l2tp
    418.     mkdir -p ${cur_dir}/l2tp
    419.     cd ${cur_dir}/l2tp
    420.     download_file "${libreswan_filename}.tar.gz"
    421.     tar -zxf ${libreswan_filename}.tar.gz
    423.     cd ${cur_dir}/l2tp/${libreswan_filename}
    424.         cat > Makefile.inc.local <<'EOF'
    425. WERROR_CFLAGS =
    426. USE_DNSSEC = false
    427. USE_DH31 = false
    428. USE_GLIBC_KERN_FLIP_HEADERS = true
    429. EOF
    430.     make programs && make install
    432.     /usr/local/sbin/ipsec --version >/dev/null 2>&1
    433.     if [ $? -ne 0 ]; then
    434.         echo "${libreswan_filename} install failed."
    435.         exit 1
    436.     fi
    438.     config_install
    440.     cp -pf /etc/sysctl.conf /etc/sysctl.conf.bak
    442.     sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf
    444.     for each in `ls /proc/sys/net/ipv4/conf/`; do
    445.         echo "net.ipv4.conf.${each}.accept_source_route=0" >> /etc/sysctl.conf
    446.         echo "net.ipv4.conf.${each}.accept_redirects=0" >> /etc/sysctl.conf
    447.         echo "net.ipv4.conf.${each}.send_redirects=0" >> /etc/sysctl.conf
    448.         echo "net.ipv4.conf.${each}.rp_filter=0" >> /etc/sysctl.conf
    449.     done
    450.     sysctl -p
    452.     if centosversion 6; then
    453.         [ -f /etc/sysconfig/iptables ] && cp -pf /etc/sysconfig/iptables /etc/sysconfig/iptables.old.`date +%Y%m%d`
    455.         if [ "`iptables -L -n | grep -c '\-\-'`" == "0" ]; then
    456.             cat > /etc/sysconfig/iptables <<EOF
    457. # Added by L2TP VPN script
    458. *filter
    459. :INPUT ACCEPT [0:0]
    460. :FORWARD ACCEPT [0:0]
    461. :OUTPUT ACCEPT [0:0]
    462. -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    463. -A INPUT -p icmp -j ACCEPT
    464. -A INPUT -i lo -j ACCEPT
    465. -A INPUT -p tcp --dport 22 -j ACCEPT
    466. -A INPUT -p udp -m multiport --dports 500,4500,1701 -j ACCEPT
    467. -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    468. -A FORWARD -s ${iprange}.0/24  -j ACCEPT
    469. COMMIT
    470. *nat
    471. :PREROUTING ACCEPT [0:0]
    472. :OUTPUT ACCEPT [0:0]
    473. :POSTROUTING ACCEPT [0:0]
    474. -A POSTROUTING -s ${iprange}.0/24 -j SNAT --to-source ${IP}
    475. COMMIT
    476. EOF
    477.         else
    478.             iptables -I INPUT -p udp -m multiport --dports 500,4500,1701 -j ACCEPT
    479.             iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    480.             iptables -I FORWARD -s ${iprange}.0/24  -j ACCEPT
    481.             iptables -t nat -A POSTROUTING -s ${iprange}.0/24 -j SNAT --to-source ${IP}
    482.             /etc/init.d/iptables save
    483.         fi
    485.         if [ ! -f /etc/ipsec.d/cert9.db ]; then
    486.            echo > /var/tmp/libreswan-nss-pwd
    487.            certutil -N -f /var/tmp/libreswan-nss-pwd -d /etc/ipsec.d
    488.            rm -f /var/tmp/libreswan-nss-pwd
    489.         fi
    491.         chkconfig --add iptables
    492.         chkconfig iptables on
    493.         chkconfig --add ipsec
    494.         chkconfig ipsec on
    495.         chkconfig --add xl2tpd
    496.         chkconfig xl2tpd on
    498.         /etc/init.d/iptables restart
    499.         /etc/init.d/ipsec start
    500.         /etc/init.d/xl2tpd start
    502.     else
    503.         [ -f /etc/iptables.rules ] && cp -pf /etc/iptables.rules /etc/iptables.rules.old.`date +%Y%m%d`
    505.         if [ "`iptables -L -n | grep -c '\-\-'`" == "0" ]; then
    506.             cat > /etc/iptables.rules <<EOF
    507. # Added by L2TP VPN script
    508. *filter
    509. :INPUT ACCEPT [0:0]
    510. :FORWARD ACCEPT [0:0]
    511. :OUTPUT ACCEPT [0:0]
    512. -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    513. -A INPUT -p icmp -j ACCEPT
    514. -A INPUT -i lo -j ACCEPT
    515. -A INPUT -p tcp --dport 22 -j ACCEPT
    516. -A INPUT -p udp -m multiport --dports 500,4500,1701 -j ACCEPT
    517. -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    518. -A FORWARD -s ${iprange}.0/24  -j ACCEPT
    519. COMMIT
    520. *nat
    521. :PREROUTING ACCEPT [0:0]
    522. :OUTPUT ACCEPT [0:0]
    523. :POSTROUTING ACCEPT [0:0]
    524. -A POSTROUTING -s ${iprange}.0/24 -j SNAT --to-source ${IP}
    525. COMMIT
    526. EOF
    527.         else
    528.             iptables -I INPUT -p udp -m multiport --dports 500,4500,1701 -j ACCEPT
    529.             iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    530.             iptables -I FORWARD -s ${iprange}.0/24  -j ACCEPT
    531.             iptables -t nat -A POSTROUTING -s ${iprange}.0/24 -j SNAT --to-source ${IP}
    532.             /sbin/iptables-save > /etc/iptables.rules
    533.         fi
    535.         cat > /etc/network/if-up.d/iptables <<EOF
    536. #!/bin/sh
    537. /sbin/iptables-restore < /etc/iptables.rules
    538. EOF
    539.         chmod +x /etc/network/if-up.d/iptables
    541.         if [ ! -f /etc/ipsec.d/cert9.db ]; then
    542.            echo > /var/tmp/libreswan-nss-pwd
    543.            certutil -N -f /var/tmp/libreswan-nss-pwd -d /etc/ipsec.d
    544.            rm -f /var/tmp/libreswan-nss-pwd
    545.         fi
    547.         update-rc.d -f xl2tpd defaults
    549.         cp -f /etc/rc.local /etc/rc.local.old.`date +%Y%m%d`
    550.         sed --follow-symlinks -i -e '/^exit 0/d' /etc/rc.local
    551.         cat >> /etc/rc.local <<EOF
    553. # Added by L2TP VPN script
    554. echo 1 > /proc/sys/net/ipv4/ip_forward
    555. /usr/sbin/service ipsec start
    556. exit 0
    557. EOF
    558.         chmod +x /etc/rc.local
    559.         echo 1 > /proc/sys/net/ipv4/ip_forward
    561.         /sbin/iptables-restore < /etc/iptables.rules
    562.         /usr/sbin/service ipsec start
    563.         /usr/sbin/service xl2tpd restart
    565.     fi
    567. }
    569. yum_install(){
    571.     config_install
    573.     cp -pf /etc/sysctl.conf /etc/sysctl.conf.bak
    575.     echo "# Added by L2TP VPN" >> /etc/sysctl.conf
    576.     echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
    577.     echo "net.ipv4.tcp_syncookies=1" >> /etc/sysctl.conf
    578.     echo "net.ipv4.icmp_echo_ignore_broadcasts=1" >> /etc/sysctl.conf
    579.     echo "net.ipv4.icmp_ignore_bogus_error_responses=1" >> /etc/sysctl.conf
    581.     for each in `ls /proc/sys/net/ipv4/conf/`; do
    582.         echo "net.ipv4.conf.${each}.accept_source_route=0" >> /etc/sysctl.conf
    583.         echo "net.ipv4.conf.${each}.accept_redirects=0" >> /etc/sysctl.conf
    584.         echo "net.ipv4.conf.${each}.send_redirects=0" >> /etc/sysctl.conf
    585.         echo "net.ipv4.conf.${each}.rp_filter=0" >> /etc/sysctl.conf
    586.     done
    587.     sysctl -p
    589.     cat > /etc/firewalld/services/xl2tpd.xml<<EOF
    590. <?xml version="1.0" encoding="utf-8"?>
    591. <service>
    592.   <short>xl2tpd</short>
    593.   <description>L2TP IPSec</description>
    594.   <port protocol="udp" port="4500"/>
    595.   <port protocol="udp" port="1701"/>
    596. </service>
    597. EOF
    598.     chmod 640 /etc/firewalld/services/xl2tpd.xml
    600.     systemctl enable ipsec
    601.     systemctl enable xl2tpd
    602.     systemctl enable firewalld
    604.     systemctl status firewalld > /dev/null 2>&1
    605.     if [ $? -eq 0 ]; then
    606.         firewall-cmd --reload
    607.         echo "Checking firewalld status..."
    608.         firewall-cmd --list-all
    609.         echo "add firewalld rules..."
    610.         firewall-cmd --permanent --add-service=ipsec
    611.         firewall-cmd --permanent --add-service=xl2tpd
    612.         firewall-cmd --permanent --add-masquerade
    613.         firewall-cmd --reload
    614.     else
    615.         echo "Firewalld looks like not running, trying to start..."
    616.         systemctl start firewalld
    617.         if [ $? -eq 0 ]; then
    618.             echo "Firewalld start successfully..."
    619.             firewall-cmd --reload
    620.             echo "Checking firewalld status..."
    621.             firewall-cmd --list-all
    622.             echo "adding firewalld rules..."
    623.             firewall-cmd --permanent --add-service=ipsec
    624.             firewall-cmd --permanent --add-service=xl2tpd
    625.             firewall-cmd --permanent --add-masquerade
    626.             firewall-cmd --reload
    627.         else
    628.             echo "Failed to start firewalld. please enable udp port 500 4500 1701 manually if necessary."
    629.         fi
    630.     fi
    632.     systemctl restart ipsec
    633.     systemctl restart xl2tpd
    634.     echo "Checking ipsec status..."
    635.     systemctl -a | grep ipsec
    636.     echo "Checking xl2tpd status..."
    637.     systemctl -a | grep xl2tpd
    638.     echo "Checking firewalld status..."
    639.     firewall-cmd --list-all
    641. }
    643. finally(){
    645.     cd ${cur_dir}
    646.     rm -fr ${cur_dir}/l2tp
    647.     # create l2tp command
    648.     cp -f ${cur_dir}/`basename $0` /usr/bin/l2tp
    650.     echo "Please wait a moment..."
    651.     sleep 5
    652.     ipsec verify
    653.     echo
    654.     echo "###############################################################"
    655.     echo "# L2TP VPN Auto Installer                                     #"
    656.     echo "# System Supported: CentOS 6+ / Debian 7+ / Ubuntu 12+        #"
    657.     echo "# Intro: https://teddysun.com/448.html                        #"
    658.     echo "# Author: Teddysun <i@teddysun.com>                           #"
    659.     echo "###############################################################"
    660.     echo "If there is no [FAILED] above, you can connect to your L2TP "
    661.     echo "VPN Server with the default Username/Password is below:"
    662.     echo
    663.     echo "Server IP: ${IP}"
    664.     echo "PSK      : ${mypsk}"
    665.     echo "Username : ${username}"
    666.     echo "Password : ${password}"
    667.     echo
    668.     echo "If you want to modify user settings, please use below command(s):"
    669.     echo "l2tp -a (Add a user)"
    670.     echo "l2tp -d (Delete a user)"
    671.     echo "l2tp -l (List all users)"
    672.     echo "l2tp -m (Modify a user password)"
    673.     echo
    674.     echo "Welcome to visit our website: https://teddysun.com/448.html"
    675.     echo "Enjoy it!"
    676.     echo
    677. }
    680. l2tp(){
    681.     clear
    682.     echo
    683.     echo "###############################################################"
    684.     echo "# L2TP VPN Auto Installer                                     #"
    685.     echo "# System Supported: CentOS 6+ / Debian 7+ / Ubuntu 12+        #"
    686.     echo "# Intro: https://teddysun.com/448.html                        #"
    687.     echo "# Author: Teddysun <i@teddysun.com>                           #"
    688.     echo "###############################################################"
    689.     echo
    690.     rootness
    691.     tunavailable
    692.     disable_selinux
    693.     version_check
    694.     get_os_info
    695.     preinstall_l2tp
    696.     install_l2tp
    697.     finally
    698. }
    700. list_users(){
    701.     if [ ! -f /etc/ppp/chap-secrets ];then
    702.         echo "Error: /etc/ppp/chap-secrets file not found."
    703.         exit 1
    704.     fi
    705.     local line="+-------------------------------------------+\n"
    706.     local string=%20s
    707.     printf "${line}|${string} |${string} |\n${line}" Username Password
    708.     grep -v "^#" /etc/ppp/chap-secrets | awk '{printf "|'${string}' |'${string}' |\n", $1,$3}'
    709.     printf ${line}
    710. }
    712. add_user(){
    713.     while :
    714.     do
    715.         read -p "Please input your Username:" user
    716.         if [ -z ${user} ]; then
    717.             echo "Username can not be empty"
    718.         else
    719.             grep -w "${user}" /etc/ppp/chap-secrets > /dev/null 2>&1
    720.             if [ $? -eq 0 ];then
    721.                 echo "Username (${user}) already exists. Please re-enter your username."
    722.             else
    723.                 break
    724.             fi
    725.         fi
    726.     done
    727.     pass=`rand`
    728.     echo "Please input ${user}'s password:"
    729.     read -p "(Default Password: ${pass}):" tmppass
    730.     [ ! -z ${tmppass} ] && pass=${tmppass}
    731.     echo "${user}    l2tpd    ${pass}       *" >> /etc/ppp/chap-secrets
    732.     echo "Username (${user}) add completed."
    733. }
    735. del_user(){
    736.     while :
    737.     do
    738.         read -p "Please input Username you want to delete it:" user
    739.         if [ -z ${user} ]; then
    740.             echo "Username can not be empty"
    741.         else
    742.             grep -w "${user}" /etc/ppp/chap-secrets >/dev/null 2>&1
    743.             if [ $? -eq 0 ];then
    744.                 break
    745.             else
    746.                 echo "Username (${user}) is not exists. Please re-enter your username."
    747.             fi
    748.         fi
    749.     done
    750.     sed -i "/^\<${user}\>/d" /etc/ppp/chap-secrets
    751.     echo "Username (${user}) delete completed."
    752. }
    754. mod_user(){
    755.     while :
    756.     do
    757.         read -p "Please input Username you want to change password:" user
    758.         if [ -z ${user} ]; then
    759.             echo "Username can not be empty"
    760.         else
    761.             grep -w "${user}" /etc/ppp/chap-secrets >/dev/null 2>&1
    762.             if [ $? -eq 0 ];then
    763.                 break
    764.             else
    765.                 echo "Username (${user}) is not exists. Please re-enter your username."
    766.             fi
    767.         fi
    768.     done
    769.     pass=`rand`
    770.     echo "Please input ${user}'s new password:"
    771.     read -p "(Default Password: ${pass}):" tmppass
    772.     [ ! -z ${tmppass} ] && pass=${tmppass}
    773.     sed -i "/^\<${user}\>/d" /etc/ppp/chap-secrets
    774.     echo "${user}    l2tpd    ${pass}       *" >> /etc/ppp/chap-secrets
    775.     echo "Username ${user}'s password has been changed."
    776. }
    778. # Main process
    779. action=$1
    780. if [ -z ${action} ] && [ "`basename $0`" != "l2tp" ]; then
    781.     action=install
    782. fi
    784. case ${action} in
    785.     install)
    786.         l2tp 2>&1 | tee ${cur_dir}/l2tp.log
    787.         ;;
    788.     -l|--list)
    789.         list_users
    790.         ;;
    791.     -a|--add)
    792.         add_user
    793.         ;;
    794.     -d|--del)
    795.         del_user
    796.         ;;
    797.     -m|--mod)
    798.         mod_user
    799.         ;;
    800.     -h|--help)
    801.         echo "Usage: `basename $0` -l,--list   List all users"
    802.         echo "       `basename $0` -a,--add    Add a user"
    803.         echo "       `basename $0` -d,--del    Delete a user"
    804.         echo "       `basename $0` -m,--mod    Modify a user password"
    805.         echo "       `basename $0` -h,--help   Print this help information"
    806.         ;;
    807.     *)
    808.         echo "Usage: `basename $0` [-l,--list|-a,--add|-d,--del|-m,--mod|-h,--help]" && exit
    809.         ;;
    810. esac