#!/bin/sh # # Docker script to configure and start an IPsec VPN server # # DO NOT RUN THIS SCRIPT ON YOUR PC OR MAC! THIS IS ONLY MEANT TO BE RUN # IN A DOCKER CONTAINER! # # This file is part of IPsec VPN Docker image, available at: # https://github.com/hwdsl2/docker-ipsec-vpn-server # # Copyright (C) 2016-2017 Lin Song # Based on the work of Thomas Sarlandie (Copyright 2012) # # This work is licensed under the Creative Commons Attribution-ShareAlike 3.0 # Unported License: http://creativecommons.org/licenses/by-sa/3.0/ # # Attribution required: please include my name in any derivative and let me # know how you have improved it! export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" exiterr() { echo "Error: $1" >&2; exit 1; } nospaces() { printf '%s' "$1" | sed -e 's/^[[:space:]]*//' -e 's/[[:space:]]*$//'; } noquotes() { printf '%s' "$1" | sed -e 's/^"\(.*\)"$/\1/' -e "s/^'\(.*\)'$/\1/"; } check_ip() { IP_REGEX='^(([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])\.){3}([0-9]|[1-9][0-9]|1[0-9]{2}|2[0-4][0-9]|25[0-5])$' printf '%s' "$1" | tr -d '\n' | grep -Eq "$IP_REGEX" } if [ ! -f "/.dockerenv" ]; then exiterr "This script ONLY runs in a Docker container." fi if ip link add dummy0 type dummy 2>&1 | grep -q "not permitted"; then cat 1>&2 <<'EOF' Error: This Docker image must be run in privileged mode. For detailed instructions, please visit: https://github.com/hwdsl2/docker-ipsec-vpn-server EOF exit 1 fi ip link delete dummy0 >/dev/null 2>&1 mkdir -p /opt/src vpn_env="/opt/src/vpn-gen.env" if [ -z "$VPN_IPSEC_PSK" ] && [ -z "$VPN_USER" ] && [ -z "$VPN_PASSWORD" ]; then if [ -f "$vpn_env" ]; then echo echo "Retrieving previously generated VPN credentials..." . "$vpn_env" else echo echo "VPN credentials not set by user. Generating random PSK and password..." VPN_IPSEC_PSK="$(LC_CTYPE=C tr -dc 'A-HJ-NPR-Za-km-z2-9' < /dev/urandom | head -c 16)" VPN_USER=vpnuser VPN_PASSWORD="$(LC_CTYPE=C tr -dc 'A-HJ-NPR-Za-km-z2-9' < /dev/urandom | head -c 16)" echo "VPN_IPSEC_PSK=$VPN_IPSEC_PSK" > "$vpn_env" echo "VPN_USER=$VPN_USER" >> "$vpn_env" echo "VPN_PASSWORD=$VPN_PASSWORD" >> "$vpn_env" chmod 600 "$vpn_env" fi fi # Remove whitespace and quotes around VPN variables, if any VPN_IPSEC_PSK="$(nospaces "$VPN_IPSEC_PSK")" VPN_IPSEC_PSK="$(noquotes "$VPN_IPSEC_PSK")" VPN_USER="$(nospaces "$VPN_USER")" VPN_USER="$(noquotes "$VPN_USER")" VPN_PASSWORD="$(nospaces "$VPN_PASSWORD")" VPN_PASSWORD="$(noquotes "$VPN_PASSWORD")" if [ -z "$VPN_IPSEC_PSK" ] || [ -z "$VPN_USER" ] || [ -z "$VPN_PASSWORD" ]; then exiterr "All VPN credentials must be specified. Edit your 'env' file and re-enter them." fi if printf '%s' "$VPN_IPSEC_PSK $VPN_USER $VPN_PASSWORD" | LC_ALL=C grep -q '[^ -~]\+'; then exiterr "VPN credentials must not contain non-ASCII characters." fi case "$VPN_IPSEC_PSK $VPN_USER $VPN_PASSWORD" in *[\\\"\']*) exiterr "VPN credentials must not contain these special characters: \\ \" '" ;; esac echo echo 'Trying to auto discover IP of this server...' # In case auto IP discovery fails, manually define the public IP # of this server in your 'env' file, as variable 'VPN_PUBLIC_IP'. PUBLIC_IP=${VPN_PUBLIC_IP:-''} # Try to auto discover IP of this server [ -z "$PUBLIC_IP" ] && PUBLIC_IP=$(dig @resolver1.opendns.com -t A -4 myip.opendns.com +short) # Check IP for correct format check_ip "$PUBLIC_IP" || PUBLIC_IP=$(wget -t 3 -T 15 -qO- http://ipv4.icanhazip.com) check_ip "$PUBLIC_IP" || exiterr "Cannot detect this server's public IP. Define it in your 'env' file as 'VPN_PUBLIC_IP'." L2TP_NET=${VPN_L2TP_NET:-'192.168.42.0/24'} L2TP_LOCAL=${VPN_L2TP_LOCAL:-'192.168.42.1'} L2TP_POOL=${VPN_L2TP_POOL:-'192.168.42.10-192.168.42.250'} XAUTH_NET=${VPN_XAUTH_NET:-'192.168.43.0/24'} XAUTH_POOL=${VPN_XAUTH_POOL:-'192.168.43.10-192.168.43.250'} DNS_SRV1=${VPN_DNS_SRV1:-'8.8.8.8'} DNS_SRV2=${VPN_DNS_SRV2:-'8.8.4.4'} # Create IPsec (Libreswan) config cat > /etc/ipsec.conf < /etc/ipsec.secrets < /etc/xl2tpd/xl2tpd.conf < /etc/ppp/options.xl2tpd < /etc/ppp/chap-secrets < /etc/ipsec.d/passwd <