Amazon EC2 user-data file for automatic configuration of IPsec/L2TP VPN server on a Ubuntu or Debian instance. Tested with Ubuntu 14.04 & 12.04 and Debian 8 (Jessie).
With minor modifications, this script can also be used on dedicated servers or any KVM- or XEN- based Virtual Private Server (VPS) from other providers.
Alternative VPN script for CentOS/RHEL
Original post by Thomas Sarlandie
| #!/bin/bash | |
| # for KVM and XEN, modification required for OpenVZ | |
| apt-get -y update | |
| apt-get -y upgrade | |
| apt-get -y install libpam0g-dev libssl-dev make gcc | |
| wget http://download.strongswan.org/strongswan-5.3.0.tar.gz | |
| tar zxvf strongswan-5.3.0.tar.gz | |
| cd strongswan-5.3.0 | |
| ./configure --enable-eap-identity --enable-eap-md5 --enable-eap-mschapv2 --enable-eap-tls --enable-eap-ttls --enable-eap-peap --enable-eap-tnc --enable-eap-dynamic --enable-eap-radius --enable-xauth-eap --enable-xauth-pam --enable-dhcp --enable-openssl --enable-addrblock --enable-unity --enable-certexpire --enable-radattr --enable-tools --enable-openssl --disable-gmp | |
| make |
| acl Safe_ports port 80 21 443 563 70 210 280 488 591 777 1025-65535 | |
| acl SSL_ports port 443 563 | |
| acl CONNECT method CONNECT | |
| http_access deny !Safe_ports | |
| http_access deny CONNECT !SSL_ports | |
| http_access allow all | |
| http_port 0.0.0.0:21 | |
| via off | |
| request_header_access Allow allow all | |
| request_header_access Authorization allow all |
| [peername] | |
| proto = nacltai | |
| proto_publickey = LOCAL_PUBKEY | |
| proto_privatekey = REMOTE_PRIKEY | |
| local = tuntap | |
| local_interface = tunnel | |
| local_tunmode = 1 | |
| peer = udp | |
| peer_localaddr = REMOTE_IP | |
| peer_localport = 8000 |
Linux installation notes (tested under Ubuntu 14.04LTS/12.04LTS), assuming VirtualBox is already installed on host.
| #!/sbin/runscript | |
| DAEMON=/usr/local/sbin/ocserv | |
| PIDFILE=/var/run/ocserv.pid | |
| LOGFILE=/var/log/ocserv.log | |
| DAEMON_ARGS="-f -d 1" | |
| extra_commands="debug" | |
| depend() { |
| #!/usr/bin/env python | |
| """ | |
| Code to read a squid log file | |
| Sample usage: | |
| f = SquidLog('access.log.1.gz') | |
| for l in f: | |
| print l.ts, l.remhost, l.url |
| echo "this file isn't supposed to run" | |
| exit 0 | |
| # <------------------------------ Enviroment Variables -------------------------------> | |
| FQDN = <Server DNS Name> # can also get from PTR record | |
| ORG_NAME = <Org name> | |
| RELEASE_NAME = $(lsb_release -sc) | |
| # <------------------------------ Network Stack Setups -------------------------------> | |
| # Please edit /etc/default/ufw first |
| #!/usr/bin/env python | |
| #encoding: utf-8 | |
| import urllib2 | |
| from base64 import b64decode | |
| LIST_URL = 'https://autoproxy-gfwlist.googlecode.com/svn/trunk/gfwlist.txt' | |
| BLACK_FILE = 'gfw.url_regex.lst' | |
| WHITE_FILE = 'cn.url_regex.lst' |
| auth_basic "Restricted"; | |
| auth_basic_user_file /etc/nginx/htpasswd; |