Script to set up FreeBSD 13 VPS as a Tailscale VPN Exit Node

freebsd-tailscale-vpn.sh

#!/bin/sh
# 
# freebsd-tailscale-vpn.sh
#
# MIT License
# 
# Copyright (c) 2023 Harshad Sharma
# 
# Permission is hereby granted, free of charge, to any person obtaining a copy
# of this software and associated documentation files (the "Software"), to deal
# in the Software without restriction, including without limitation the rights
# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
# copies of the Software, and to permit persons to whom the Software is
# furnished to do so, subject to the following conditions:
# 
# The above copyright notice and this permission notice shall be included in all
# copies or substantial portions of the Software.
# 
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
# SOFTWARE.

# Set -x to enable debugging
# set -x
set -e

# Configuration
# =============

app_name="freebsd-tailscale-vpn"


# Logging
# =======

log_enable_syslog() {
  use_syslog=true
}

log_info() {
  # Usage: log_info "some message"
  printf "\033[0;32m[INFO] %s\033[0m\n" "$*"
  if [ "$use_syslog" = "true" ]; then
    logger -t "${app_name}" "[INFO] $*"
  fi
}


# Tailscale
# =========

ensure_tailscaled_service() {
  if ! service tailscaled status | grep -q "tailscaled is running as"; then
    service tailscaled enable
    service tailscaled start
  else
    echo "Tailscaled is already running"
  fi
}

# Firewall
# ========

create_pf_conf_file() {
  echo 'ext_if="vtnet0"
vpn_if="tailscale0"

vpn_net="100.0.0.0/8"

icmp_types="{ echoreq }"

set block-policy return
scrub in on {$ext_if, $vpn_if} all fragment reassemble

set skip on $vpn_if

nat on $ext_if  from $vpn_net to any -> ($ext_if:0)

block in all
pass out quick keep state
pass in inet proto tcp from any to any port ssh flags S/SA keep state
pass inet proto icmp icmp-type $icmp_types
pass out all' > /etc/pf.conf
}

ensure_pf_service() {
  if ! service pf status | grep -q "Status: Enabled for"; then
    service pf enable
    service pf start
  else
    echo "pf is already running"
    service pf reload
  fi
}

ensure_nat_gateway() {
  if ! sysctl net.inet.ip.forwarding | grep -q "net.inet.ip.forwarding: 1"; then
    sysrc gateway_enable="YES"
    sysctl net.inet.ip.forwarding=1
    echo 'net.inet.ip.forwarding=1' >> /etc/sysctl.conf
  else
    echo "NAT is already enabled"
  fi
}

disable_hardware_checksum() {
  if ! sysctl hw.vtnet.csum_disable | grep -q "hw.vtnet.csum_disable: 1"; then
    echo 'hw.vtnet.csum_disable=1' >> /boot/loader.conf
  else
    echo "Hardware checksum is already disabled"
  fi
}

# Main
# ====

main() {
  log_enable_syslog
  log_info "Start."

  log_info "Installing tailscale..."
  pkg install -y tailscale

  log_info "Configuring tailscale to run on startup..."
  ensure_tailscaled_service

  log_info "Starting tailscale..."
  log_info "Click on the link below to authorize this node:"
  tailscale up

  log_info "Enabling NAT..."
  ensure_nat_gateway

  log_info "Disabling hardware checksum..."
  disable_hardware_checksum

  log_info "Configuring Tailscale to advertise exit node..."
  tailscale up --advertise-exit-node --accept-routes

  log_info "Setting up firewall..."
  log_info "Your SSH session may disconnect after this step."
  log_info "Please reconnect after 30 seconds."

  create_pf_conf_file
  ensure_pf_service

  log_info "Done."
}

main

Alapvető írási és formázási szintaxis
Hozzon létre kifinomult formázást prózai és kódjai számára a GitHubon egyszerű szintaxissal.