· 10 months ago · Feb 25, 2025, 03:50 AM
1#!/bin/sh
2#
3# Script for automatic setup of an IPsec VPN server on Ubuntu, Debian, CentOS/RHEL,
4# Rocky Linux, AlmaLinux, Oracle Linux, Amazon Linux 2 and Alpine Linux
5#
6# DO NOT RUN THIS SCRIPT ON YOUR PC OR MAC!
7#
8# The latest version of this script is available at:
9# https://github.com/hwdsl2/setup-ipsec-vpn
10#
11# Copyright (C) 2021-2024 Lin Song <linsongui@gmail.com>
12#
13# This work is licensed under the Creative Commons Attribution-ShareAlike 3.0
14# Unported License: http://creativecommons.org/licenses/by-sa/3.0/
15#
16# Attribution required: please include my name in any derivative and let me
17# know how you have improved it!
18
19# =====================================================
20
21# Define your own values for these variables
22# - IPsec pre-shared key, VPN username and password
23# - All values MUST be placed inside 'single quotes'
24# - DO NOT use these special characters within values: \ " '
25
26YOUR_IPSEC_PSK=''
27YOUR_USERNAME=''
28YOUR_PASSWORD=''
29
30# =====================================================
31
32export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
33
34exiterr() { echo "Error: $1" >&2; exit 1; }
35
36check_ip() {
37 IP_REGEX='^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$'
38 printf '%s' "$1" | tr -d '\n' | grep -Eq "$IP_REGEX"
39}
40
41check_dns_name() {
42 FQDN_REGEX='^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?\.)+[a-zA-Z]{2,}$'
43 printf '%s' "$1" | tr -d '\n' | grep -Eq "$FQDN_REGEX"
44}
45
46check_root() {
47 if [ "$(id -u)" != 0 ]; then
48 exiterr "Script must be run as root. Try 'sudo sh $0'"
49 fi
50}
51
52check_vz() {
53 if [ -f /proc/user_beancounters ]; then
54 exiterr "OpenVZ VPS is not supported."
55 fi
56}
57
58check_lxc() {
59 # shellcheck disable=SC2154
60 if [ "$container" = "lxc" ] && [ ! -e /dev/ppp ]; then
61cat 1>&2 <<'EOF'
62Error: /dev/ppp is missing. LXC containers require configuration.
63 See: https://github.com/hwdsl2/setup-ipsec-vpn/issues/1014
64EOF
65 exit 1
66 fi
67}
68
69check_os() {
70 rh_file="/etc/redhat-release"
71 if [ -f "$rh_file" ]; then
72 os_type=centos
73 if grep -q "Red Hat" "$rh_file"; then
74 os_type=rhel
75 fi
76 [ -f /etc/oracle-release ] && os_type=ol
77 grep -qi rocky "$rh_file" && os_type=rocky
78 grep -qi alma "$rh_file" && os_type=alma
79 if grep -q "release 7" "$rh_file"; then
80 os_ver=7
81 elif grep -q "release 8" "$rh_file"; then
82 os_ver=8
83 grep -qi stream "$rh_file" && os_ver=8s
84 elif grep -q "release 9" "$rh_file"; then
85 os_ver=9
86 grep -qi stream "$rh_file" && os_ver=9s
87 else
88 exiterr "This script only supports CentOS/RHEL 7-9."
89 fi
90 if [ "$os_type" = "centos" ] \
91 && { [ "$os_ver" = 7 ] || [ "$os_ver" = 8 ] || [ "$os_ver" = 8s ]; }; then
92 exiterr "CentOS Linux $os_ver is EOL and not supported."
93 fi
94 elif grep -qs "Amazon Linux release 2 " /etc/system-release; then
95 os_type=amzn
96 os_ver=2
97 elif grep -qs "Amazon Linux release 2023" /etc/system-release; then
98 exiterr "Amazon Linux 2023 is not supported."
99 else
100 os_type=$(lsb_release -si 2>/dev/null)
101 [ -z "$os_type" ] && [ -f /etc/os-release ] && os_type=$(. /etc/os-release && printf '%s' "$ID")
102 case $os_type in
103 [Uu]buntu)
104 os_type=ubuntu
105 ;;
106 [Dd]ebian|[Kk]ali)
107 os_type=debian
108 ;;
109 [Rr]aspbian)
110 os_type=raspbian
111 ;;
112 [Aa]lpine)
113 os_type=alpine
114 ;;
115 *)
116cat 1>&2 <<'EOF'
117Error: This script only supports one of the following OS:
118 Ubuntu, Debian, CentOS/RHEL, Rocky Linux, AlmaLinux,
119 Oracle Linux, Amazon Linux 2 or Alpine Linux
120EOF
121 exit 1
122 ;;
123 esac
124 if [ "$os_type" = "alpine" ]; then
125 os_ver=$(. /etc/os-release && printf '%s' "$VERSION_ID" | cut -d '.' -f 1,2)
126 if [ "$os_ver" != "3.19" ] && [ "$os_ver" != "3.20" ]; then
127 exiterr "This script only supports Alpine Linux 3.19/3.20."
128 fi
129 else
130 os_ver=$(sed 's/\..*//' /etc/debian_version | tr -dc 'A-Za-z0-9')
131 if [ "$os_ver" = 8 ] || [ "$os_ver" = 9 ] || [ "$os_ver" = "stretchsid" ] \
132 || [ "$os_ver" = "bustersid" ]; then
133cat 1>&2 <<EOF
134Error: This script requires Debian >= 10 or Ubuntu >= 20.04.
135 This version of Ubuntu/Debian is too old and not supported.
136EOF
137 exit 1
138 fi
139 if [ "$os_ver" = "trixiesid" ] && [ -f /etc/os-release ] \
140 && [ "$(. /etc/os-release && printf '%s' "$VERSION_ID")" = "24.10" ]; then
141cat 1>&2 <<EOF
142Error: This script does not support Ubuntu 24.10.
143 You may use e.g. Ubuntu 24.04 LTS instead.
144EOF
145 exit 1
146 fi
147 fi
148 fi
149}
150
151check_iface() {
152 def_iface=$(route 2>/dev/null | grep -m 1 '^default' | grep -o '[^ ]*$')
153 if [ "$os_type" != "alpine" ]; then
154 [ -z "$def_iface" ] && def_iface=$(ip -4 route list 0/0 2>/dev/null | grep -m 1 -Po '(?<=dev )(\S+)')
155 fi
156 def_state=$(cat "/sys/class/net/$def_iface/operstate" 2>/dev/null)
157 check_wl=0
158 if [ -n "$def_state" ] && [ "$def_state" != "down" ]; then
159 if [ "$os_type" = "ubuntu" ] || [ "$os_type" = "debian" ] || [ "$os_type" = "raspbian" ]; then
160 if ! uname -m | grep -qi -e '^arm' -e '^aarch64'; then
161 check_wl=1
162 fi
163 else
164 check_wl=1
165 fi
166 fi
167 if [ "$check_wl" = 1 ]; then
168 case $def_iface in
169 wl*)
170 exiterr "Wireless interface '$def_iface' detected. DO NOT run this script on your PC or Mac!"
171 ;;
172 esac
173 fi
174}
175
176check_creds() {
177 [ -n "$YOUR_IPSEC_PSK" ] && VPN_IPSEC_PSK="$YOUR_IPSEC_PSK"
178 [ -n "$YOUR_USERNAME" ] && VPN_USER="$YOUR_USERNAME"
179 [ -n "$YOUR_PASSWORD" ] && VPN_PASSWORD="$YOUR_PASSWORD"
180 if [ -z "$VPN_IPSEC_PSK" ] && [ -z "$VPN_USER" ] && [ -z "$VPN_PASSWORD" ]; then
181 return 0
182 fi
183 if [ -z "$VPN_IPSEC_PSK" ] || [ -z "$VPN_USER" ] || [ -z "$VPN_PASSWORD" ]; then
184 exiterr "All VPN credentials must be specified. Edit the script and re-enter them."
185 fi
186 if printf '%s' "$VPN_IPSEC_PSK $VPN_USER $VPN_PASSWORD" | LC_ALL=C grep -q '[^ -~]\+'; then
187 exiterr "VPN credentials must not contain non-ASCII characters."
188 fi
189 case "$VPN_IPSEC_PSK $VPN_USER $VPN_PASSWORD" in
190 *[\\\"\']*)
191 exiterr "VPN credentials must not contain these special characters: \\ \" '"
192 ;;
193 esac
194}
195
196check_dns() {
197 if { [ -n "$VPN_DNS_SRV1" ] && ! check_ip "$VPN_DNS_SRV1"; } \
198 || { [ -n "$VPN_DNS_SRV2" ] && ! check_ip "$VPN_DNS_SRV2"; }; then
199 exiterr "The DNS server specified is invalid."
200 fi
201}
202
203check_server_dns() {
204 if [ -n "$VPN_DNS_NAME" ] && ! check_dns_name "$VPN_DNS_NAME"; then
205 exiterr "Invalid DNS name. 'VPN_DNS_NAME' must be a fully qualified domain name (FQDN)."
206 fi
207}
208
209check_client_name() {
210 if [ -n "$VPN_CLIENT_NAME" ]; then
211 name_len="$(printf '%s' "$VPN_CLIENT_NAME" | wc -m)"
212 if [ "$name_len" -gt "64" ] || printf '%s' "$VPN_CLIENT_NAME" | LC_ALL=C grep -q '[^A-Za-z0-9_-]\+' \
213 || case $VPN_CLIENT_NAME in -*) true ;; *) false ;; esac; then
214 exiterr "Invalid client name. Use one word only, no special characters except '-' and '_'."
215 fi
216 fi
217}
218
219wait_for_apt() {
220 count=0
221 apt_lk=/var/lib/apt/lists/lock
222 pkg_lk=/var/lib/dpkg/lock
223 while fuser "$apt_lk" "$pkg_lk" >/dev/null 2>&1 \
224 || lsof "$apt_lk" >/dev/null 2>&1 || lsof "$pkg_lk" >/dev/null 2>&1; do
225 [ "$count" = 0 ] && echo "## Waiting for apt to be available..."
226 [ "$count" -ge 100 ] && exiterr "Could not get apt/dpkg lock."
227 count=$((count+1))
228 printf '%s' '.'
229 sleep 3
230 done
231}
232
233install_pkgs() {
234 if ! command -v wget >/dev/null 2>&1; then
235 if [ "$os_type" = "ubuntu" ] || [ "$os_type" = "debian" ] || [ "$os_type" = "raspbian" ]; then
236 wait_for_apt
237 export DEBIAN_FRONTEND=noninteractive
238 (
239 set -x
240 apt-get -yqq update || apt-get -yqq update
241 ) || exiterr "'apt-get update' failed."
242 (
243 set -x
244 apt-get -yqq install wget >/dev/null || apt-get -yqq install wget >/dev/null
245 ) || exiterr "'apt-get install wget' failed."
246 elif [ "$os_type" != "alpine" ]; then
247 (
248 set -x
249 yum -y -q install wget >/dev/null || yum -y -q install wget >/dev/null
250 ) || exiterr "'yum install wget' failed."
251 fi
252 fi
253 if [ "$os_type" = "alpine" ]; then
254 (
255 set -x
256 apk add -U -q bash coreutils grep net-tools sed wget
257 ) || exiterr "'apk add' failed."
258 fi
259}
260
261get_setup_url() {
262 base_url1="https://raw.githubusercontent.com/hwdsl2/setup-ipsec-vpn/master"
263 base_url2="https://gitlab.com/hwdsl2/setup-ipsec-vpn/-/raw/master"
264 sh_file="vpnsetup_ubuntu.sh"
265 if [ "$os_type" = "centos" ] || [ "$os_type" = "rhel" ] || [ "$os_type" = "rocky" ] \
266 || [ "$os_type" = "alma" ] || [ "$os_type" = "ol" ]; then
267 sh_file="vpnsetup_centos.sh"
268 elif [ "$os_type" = "amzn" ]; then
269 sh_file="vpnsetup_amzn.sh"
270 elif [ "$os_type" = "alpine" ]; then
271 sh_file="vpnsetup_alpine.sh"
272 fi
273 setup_url1="$base_url1/$sh_file"
274 setup_url2="$base_url2/$sh_file"
275}
276
277run_setup() {
278 status=0
279 if tmpdir=$(mktemp --tmpdir -d vpn.XXXXX 2>/dev/null); then
280 if ( set -x; wget -t 3 -T 30 -q -O "$tmpdir/vpn.sh" "$setup_url1" \
281 || wget -t 3 -T 30 -q -O "$tmpdir/vpn.sh" "$setup_url2" \
282 || curl -m 30 -fsL "$setup_url1" -o "$tmpdir/vpn.sh" 2>/dev/null ); then
283 VPN_IPSEC_PSK="$VPN_IPSEC_PSK" VPN_USER="$VPN_USER" \
284 VPN_PASSWORD="$VPN_PASSWORD" \
285 VPN_PUBLIC_IP="$VPN_PUBLIC_IP" VPN_L2TP_NET="$VPN_L2TP_NET" \
286 VPN_L2TP_LOCAL="$VPN_L2TP_LOCAL" VPN_L2TP_POOL="$VPN_L2TP_POOL" \
287 VPN_XAUTH_NET="$VPN_XAUTH_NET" VPN_XAUTH_POOL="$VPN_XAUTH_POOL" \
288 VPN_DNS_SRV1="$VPN_DNS_SRV1" VPN_DNS_SRV2="$VPN_DNS_SRV2" \
289 VPN_DNS_NAME="$VPN_DNS_NAME" VPN_CLIENT_NAME="$VPN_CLIENT_NAME" \
290 VPN_PROTECT_CONFIG="$VPN_PROTECT_CONFIG" \
291 VPN_CLIENT_VALIDITY="$VPN_CLIENT_VALIDITY" \
292 VPN_SKIP_IKEV2="$VPN_SKIP_IKEV2" VPN_SWAN_VER="$VPN_SWAN_VER" \
293 /bin/bash "$tmpdir/vpn.sh" || status=1
294 else
295 status=1
296 echo "Error: Could not download VPN setup script." >&2
297 fi
298 /bin/rm -f "$tmpdir/vpn.sh"
299 /bin/rmdir "$tmpdir"
300 else
301 exiterr "Could not create temporary directory."
302 fi
303}
304
305vpnsetup() {
306 check_root
307 check_vz
308 check_lxc
309 check_os
310 check_iface
311 check_creds
312 check_dns
313 check_server_dns
314 check_client_name
315 install_pkgs
316 get_setup_url
317 run_setup
318}
319
320## Defer setup until we have the complete script
321vpnsetup "$@"
322
323exit "$status"