├── scripts ├── FILES.d │ ├── quagga │ │ ├── bgpd.conf │ │ ├── ospfd.conf │ │ ├── ospfd.conf.SAMPLE │ │ ├── zebra.conf │ │ ├── reset_vti.sh │ │ └── quagga-config.SAMPLE │ │ │ ├── zebra.conf │ │ │ ├── ospfd.conf │ │ │ └── bgpd.conf │ ├── strongswan │ │ ├── vti.d │ │ │ ├── .DISABLED │ │ │ │ └── .keep │ │ │ ├── vtiN.secrets.sample │ │ │ ├── vtiN.init.sample │ │ │ └── vtiN.conf.sample │ │ ├── ipsec.secrets │ │ ├── strongswan.d │ │ │ ├── charon │ │ │ │ └── farp.conf │ │ │ └── charon.conf │ │ ├── ipsec.conf │ │ ├── restart_vti.sh │ │ └── ipsec-vti.sh │ ├── sysctl.d │ │ ├── 83-nopanic.conf │ │ ├── 81-disable-ipv6.conf │ │ ├── 84-disable-rpp.conf │ │ └── 82-router-ok.conf │ ├── monit.d │ │ ├── snmpd │ │ ├── strongswan │ │ └── quuagga │ ├── crontab │ └── sysconfig │ │ └── iptables ├── SYNC_AVAIL.sh ├── add_restarts.sh ├── refresh_scripts.sh ├── update_kernel.sh ├── VTI_RM.sh ├── README.txt ├── VTI_ADDAWS.sh ├── VTI_ADD.sh ├── VTI_OPS.sh ├── INITIAL_SETUP.sh └── RPM.list ├── License-And-Disclimer.txt ├── DOCS ├── 01-VTI_ROUTER_Implementation.pdf ├── 02-IPSEC-AZURE-CONFIGURATION.pdf └── 00-VTI_ROUTER_APPLIANCE_Introduction.pdf └── README.md /scripts/FILES.d/quagga/bgpd.conf: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /scripts/FILES.d/quagga/ospfd.conf: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /scripts/FILES.d/strongswan/vti.d/.DISABLED/.keep: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /scripts/FILES.d/sysctl.d/83-nopanic.conf: -------------------------------------------------------------------------------- 1 | kernel.panic=100 2 | -------------------------------------------------------------------------------- /scripts/FILES.d/sysctl.d/81-disable-ipv6.conf: -------------------------------------------------------------------------------- 1 | net.ipv6.conf.all.disable_ipv6=1 2 | -------------------------------------------------------------------------------- /scripts/FILES.d/strongswan/ipsec.secrets: -------------------------------------------------------------------------------- 1 | # VPC IPSEC 2 | include /etc/strongswan/vti.d/*.secrets 3 | -------------------------------------------------------------------------------- /scripts/FILES.d/strongswan/vti.d/vtiN.secrets.sample: -------------------------------------------------------------------------------- 1 | %VTI_OIP_LOCAL% %VTI_OIP_REMOTE% : PSK %VTI_SECRET% 2 | -------------------------------------------------------------------------------- /License-And-Disclimer.txt: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/eis-group-opensource/vti-router/HEAD/License-And-Disclimer.txt -------------------------------------------------------------------------------- /scripts/SYNC_AVAIL.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | mkdir -p ~/scripts/WORK 3 | rsync -av WORK/`hostname -s`.d ~/scripts/WORK/. 4 | -------------------------------------------------------------------------------- /DOCS/01-VTI_ROUTER_Implementation.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/eis-group-opensource/vti-router/HEAD/DOCS/01-VTI_ROUTER_Implementation.pdf -------------------------------------------------------------------------------- /DOCS/02-IPSEC-AZURE-CONFIGURATION.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/eis-group-opensource/vti-router/HEAD/DOCS/02-IPSEC-AZURE-CONFIGURATION.pdf -------------------------------------------------------------------------------- /scripts/FILES.d/sysctl.d/84-disable-rpp.conf: -------------------------------------------------------------------------------- 1 | net.ipv4.conf.default.rp_filter=0 2 | net.ipv4.conf.all.rp_filter=0 3 | net.ipv4.conf.eth0.rp_filter=0 4 | -------------------------------------------------------------------------------- /DOCS/00-VTI_ROUTER_APPLIANCE_Introduction.pdf: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/eis-group-opensource/vti-router/HEAD/DOCS/00-VTI_ROUTER_APPLIANCE_Introduction.pdf -------------------------------------------------------------------------------- /scripts/FILES.d/sysctl.d/82-router-ok.conf: -------------------------------------------------------------------------------- 1 | # Enable IPv4 forwarding 2 | net.ipv4.ip_forward=1 3 | net.ipv4.conf.eth0.disable_xfrm=1 4 | net.ipv4.conf.eth0.disable_policy=1 5 | -------------------------------------------------------------------------------- /scripts/FILES.d/strongswan/vti.d/vtiN.init.sample: -------------------------------------------------------------------------------- 1 | # 2 | VTI_INTERFACE=%VTI% 3 | VTI_LOCALADDR=%VTI_IIP_LOCAL% 4 | VTI_REMOTEADDR=%VTI_IIP_REMOTE% 5 | VTI_DESRITION=%VTI_NAME% 6 | VTI_MTU=%VTI_MTU% 7 | 8 | -------------------------------------------------------------------------------- /scripts/FILES.d/strongswan/strongswan.d/charon/farp.conf: -------------------------------------------------------------------------------- 1 | farp { 2 | 3 | # Whether to load the plugin. Can also be an integer to increase the 4 | # priority of this plugin. 5 | load = no 6 | 7 | } 8 | 9 | -------------------------------------------------------------------------------- /scripts/FILES.d/strongswan/vti.d/vtiN.conf.sample: -------------------------------------------------------------------------------- 1 | 2 | #BEGIN:%VTI% 3 | conn %VTI% 4 | left=%VTI_OIP_LOCAL% 5 | right=%VTI_OIP_REMOTE% 6 | auto=start 7 | mark=%VTI_MARK% 8 | forceencaps=yes 9 | #END:%VTI% 10 | -------------------------------------------------------------------------------- /scripts/FILES.d/monit.d/snmpd: -------------------------------------------------------------------------------- 1 | check process snmpd with pidfile /var/run/net-snmp/snmpd.pid 2 | start program = "/bin/systemctl start snmpd.service" with timeout 10 seconds 3 | stop program = "/bin/systemctl stop snmpd.service" 4 | if failed port 161 type udp then restart 5 | -------------------------------------------------------------------------------- /scripts/FILES.d/quagga/ospfd.conf.SAMPLE: -------------------------------------------------------------------------------- 1 | ! -*- ospf -*- 2 | ! 3 | ! OSPFd sample configuration file 4 | ! 5 | ! 6 | !hostname ospfd 7 | !password zebra 8 | !enable password please-set-at-here 9 | ! 10 | router ospf 11 | network 10.25.23.0/24 area 0 12 | network 10.25.223.0/24 area 0 13 | ! 14 | log stdout 15 | 16 | -------------------------------------------------------------------------------- /scripts/FILES.d/quagga/zebra.conf: -------------------------------------------------------------------------------- 1 | ! 2 | ! Zebra configuration saved from vty 3 | ! 2016/06/20 18:52:50 4 | ! 5 | hostname %HOSTNAME% 6 | ! 7 | interface eth0 8 | ipv6 nd suppress-ra 9 | ! 10 | interface eth1 11 | ipv6 nd suppress-ra 12 | ! 13 | interface lo 14 | ! 15 | ip forwarding 16 | ! 17 | ! 18 | line vty 19 | ! 20 | -------------------------------------------------------------------------------- /scripts/FILES.d/monit.d/strongswan: -------------------------------------------------------------------------------- 1 | check process starter with pidfile /var/run/starter.charon.pid 2 | start program = "/bin/systemctl start strongswan.service" with timeout 10 seconds 3 | stop program = "/bin/systemctl stop strongswan.service" 4 | 5 | check process charon with pidfile /var/run/charon.pid 6 | start program = "/bin/systemctl start strongswan.service" with timeout 10 seconds 7 | stop program = "/bin/systemctl stop strongswan.service" 8 | if failed port 500 type udp then restart 9 | if failed port 4500 type udp then restart 10 | -------------------------------------------------------------------------------- /scripts/FILES.d/crontab: -------------------------------------------------------------------------------- 1 | SHELL=/bin/bash 2 | PATH=/sbin:/bin:/usr/sbin:/usr/bin 3 | MAILTO=root 4 | 5 | # For details see man 4 crontabs 6 | 7 | # Example of job definition: 8 | # .---------------- minute (0 - 59) 9 | # | .------------- hour (0 - 23) 10 | # | | .---------- day of month (1 - 31) 11 | # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... 12 | # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat 13 | # | | | | | 14 | # * * * * * user-name command to be executed 15 | */10 * * * * root /etc/strongswan/restart_vti.sh > /tmp/restart_vti.log 2>& 1 16 | -------------------------------------------------------------------------------- /scripts/FILES.d/quagga/reset_vti.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | ################################################### 3 | # (c) EIS Group LTD, 2016 # 4 | # (License) GPL # 5 | # Donated to OpenSource by EIS Group, 2016. # 6 | # Authors: Alexei Roudnev , Andrey Saveliev # 7 | # # 8 | # open-source@eisgroup.com # 9 | # or aprudnev@gmail.com # 10 | # URL; http://eisgroup.com # 11 | ################################################### 12 | 13 | # Argument - interface name 14 | # 15 | vtysh -c "conf t" -c "interface $1" -c "ip ospf network point-to-point" 16 | -------------------------------------------------------------------------------- /scripts/FILES.d/monit.d/quuagga: -------------------------------------------------------------------------------- 1 | check process zebra with pidfile /var/run/quagga/zebra.pid 2 | start program = "/bin/systemctl start zebra.service" with timeout 10 seconds 3 | stop program = "/bin/systemctl stop zebra.service" 4 | if failed port 2601 then restart 5 | 6 | check process ospfd with pidfile /var/run/quagga/ospfd.pid 7 | start program = "/bin/systemctl start ospfd.service" with timeout 10 seconds 8 | stop program = "/bin/systemctl stop ospfd.service" 9 | if failed port 2604 then restart 10 | 11 | check process bgpd with pidfile /var/run/quagga/bgpd.pid 12 | start program = "/bin/systemctl start bgpd.service" with timeout 10 seconds 13 | stop program = "/bin/systemctl stop bgpd.service" 14 | if failed port 179 then restart 15 | 16 | -------------------------------------------------------------------------------- /scripts/FILES.d/quagga/quagga-config.SAMPLE/zebra.conf: -------------------------------------------------------------------------------- 1 | ! 2 | ! Zebra configuration saved from vty 3 | ! 2016/06/30 16:48:57 4 | ! 5 | ! 6 | interface eth0 7 | ipv6 nd suppress-ra 8 | ! 9 | interface eth1 10 | ipv6 nd suppress-ra 11 | ! 12 | interface ip_vti0 13 | ipv6 nd suppress-ra 14 | ! 15 | interface lo 16 | ! 17 | interface vti1 18 | ipv6 nd suppress-ra 19 | ! 20 | interface vti2 21 | ipv6 nd suppress-ra 22 | ! 23 | interface vti3 24 | ipv6 nd suppress-ra 25 | ! 26 | ip route 50.112.38.111/32 209.44.73.1 27 | ip route 52.25.200.12/32 209.44.73.1 28 | ip route 65.49.55.38/32 209.44.73.1 29 | ! 30 | access-list from_aws remark Newtork we want to accept from AWS 31 | access-list from_aws permit 10.20.0.0/16 32 | ! 33 | route-map from_aws permit 10 34 | match ip address from_aws 35 | ! 36 | ip forwarding 37 | ! 38 | ! 39 | line vty 40 | ! 41 | -------------------------------------------------------------------------------- /scripts/FILES.d/quagga/quagga-config.SAMPLE/ospfd.conf: -------------------------------------------------------------------------------- 1 | ! 2 | ! Zebra configuration saved from vty 3 | ! 2016/06/30 16:48:57 4 | ! 5 | ! 6 | ! 7 | ! 8 | interface eth0 9 | ip ospf authentication message-digest 10 | ip ospf message-digest-key 1 md5 XXX/23 11 | ! 12 | interface eth1 13 | ! 14 | interface ip_vti0 15 | ! 16 | interface lo 17 | ! 18 | interface vti1 19 | ! 20 | interface vti2 21 | ip ospf network broadcast 22 | ! 23 | interface vti3 24 | ! 25 | router ospf 26 | redistribute bgp route-map from_aws 27 | network 10.23.23.0/24 area 0.0.0.0 28 | network 10.25.223.0/24 area 0.0.0.0 29 | area 0.0.0.0 authentication message-digest 30 | ! 31 | access-list from_aws remark Network we want to accept from AWS 32 | access-list from_aws permit 10.20.0.0/16 33 | ! 34 | route-map from_aws permit 10 35 | match ip address from_aws 36 | ! 37 | line vty 38 | ! 39 | -------------------------------------------------------------------------------- /scripts/add_restarts.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | ################################################### 3 | # (c) EIS Group LTD, 2016 # 4 | # (License) GPL # 5 | # Donated to OpenSource by EIS Group, 2016. # 6 | # Authors: Alexei Roudnev , Andrey Saveliev # 7 | # # 8 | # open-source@eisgroup.com # 9 | # or aprudnev@gmail.com # 10 | # URL; http://eisgroup.com # 11 | ################################################### 12 | 13 | if ! grep -q restart_vti.sh /etc/crontab 14 | then 15 | echo "*/10 * * * * root /etc/strongswan/restart_vti.sh > /tmp/restart_vti.log 2>& 1" >> /etc/crontab 16 | echo "Restart check every 10 minutes added" 17 | else 18 | echo "Restarts are already in place" 19 | fi 20 | -------------------------------------------------------------------------------- /scripts/FILES.d/strongswan/ipsec.conf: -------------------------------------------------------------------------------- 1 | config setup 2 | 3 | conn %default 4 | leftauth=psk 5 | rightauth=psk 6 | ike=aes256-sha256-modp2048s256,aes128-sha1-modp1024! 7 | ikelifetime=28800s 8 | aggressive=no 9 | esp=aes128-sha256-modp2048s256,aes128-sha1-modp1024! 10 | lifetime=3600s 11 | type=tunnel 12 | dpddelay=10s 13 | dpdtimeout=30s 14 | keyexchange=ikev1 15 | rekey=yes 16 | reauth=no 17 | dpdaction=restart 18 | closeaction=restart 19 | left=%defaultroute 20 | leftsubnet=0.0.0.0/0,::/0 21 | rightsubnet=0.0.0.0/0,::/0 22 | leftupdown=/etc/strongswan/ipsec-vti.sh 23 | installpolicy=yes 24 | compress=no 25 | mobike=no 26 | keyingtries=%forever 27 | 28 | include /etc/strongswan/vti.d/*.conf 29 | 30 | -------------------------------------------------------------------------------- /scripts/FILES.d/quagga/quagga-config.SAMPLE/bgpd.conf: -------------------------------------------------------------------------------- 1 | ! 2 | ! Zebra configuration saved from vty 3 | ! 2016/06/30 16:48:57 4 | ! 5 | ! 6 | router bgp 65003 7 | network 10.0.0.0/8 8 | network 192.168.0.0/16 9 | neighbor 10.255.254.21 remote-as 64600 10 | neighbor 10.255.254.21 ebgp-multihop 255 11 | neighbor 10.255.254.21 update-source eth0 12 | neighbor 10.255.254.22 remote-as 64600 13 | neighbor 10.255.254.22 ebgp-multihop 255 14 | neighbor 10.255.254.22 update-source eth0 15 | neighbor 169.254.12.49 remote-as 7224 16 | neighbor 169.254.12.49 route-map from_aws in 17 | neighbor 169.254.12.213 remote-as 7224 18 | neighbor 169.254.12.213 route-map from_aws in 19 | ! 20 | access-list from_aws remark Newtork we want to accept from AWS 21 | access-list from_aws permit 10.20.0.0/16 22 | ! 23 | route-map from_aws permit 10 24 | match ip address from_aws 25 | ! 26 | line vty 27 | ! 28 | -------------------------------------------------------------------------------- /scripts/FILES.d/sysconfig/iptables: -------------------------------------------------------------------------------- 1 | # Generated by iptables-save v1.4.21 on Mon Jun 20 20:07:34 2016 2 | *filter 3 | :INPUT ACCEPT [0:0] 4 | :FORWARD ACCEPT [0:0] 5 | :OUTPUT ACCEPT [1738:245262] 6 | -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 7 | -A INPUT -p icmp -j ACCEPT 8 | -A INPUT -i lo -j ACCEPT 9 | -A INPUT -i eth0 -j ACCEPT 10 | -A INPUT -i tun+ -j ACCEPT 11 | -A INPUT -i vti+ -j ACCEPT 12 | -A INPUT -p ah -j ACCEPT 13 | -A INPUT -p esp -j ACCEPT 14 | -A INPUT -p udp -m state --state NEW -m udp --dport 500 -j ACCEPT 15 | -A INPUT -p udp -m state --state NEW -m udp --dport 4500 -j ACCEPT 16 | -A INPUT -j REJECT --reject-with icmp-host-prohibited 17 | -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 18 | -A FORWARD -p icmp -j ACCEPT 19 | -A FORWARD -i lo -j ACCEPT 20 | -A FORWARD -i eth0 -j ACCEPT 21 | -A FORWARD -i tun+ -j ACCEPT 22 | -A FORWARD -i vti+ -j ACCEPT 23 | -A FORWARD -j REJECT --reject-with icmp-host-prohibited 24 | COMMIT 25 | -------------------------------------------------------------------------------- /scripts/refresh_scripts.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | ################################################### 3 | # (c) EIS Group LTD, 2016 # 4 | # (License) GPL # 5 | # Donated to OpenSource by EIS Group, 2016. # 6 | # Authors: Alexei Roudnev , Andrey Saveliev # 7 | # # 8 | # open-source@eisgroup.com # 9 | # or aprudnev@gmail.com # 10 | # URL; http://eisgroup.com # 11 | ################################################### 12 | 13 | cp FILES.d/strongswan/*.sh /etc/strongswan/. 14 | cp FILES.d/quagga/*.sh /etc/quagga/. 15 | cp FILES.d/sysctl.d/* /etc/sysctl.d/. && sysctl -p 16 | if [ ! -d /usr/local/scripts ] 17 | then 18 | (cd ~ && mv scripts /usr/local/. && ln -s /usr/local/scripts .) 19 | fi 20 | cat > /usr/sbin/VTI <.properties 17 | # Options: 18 | # -d 19 | # -r 20 | # 21 | 22 | # Remove property files# 23 | LIST= 24 | ask() { 25 | var=$1 26 | LIST="$LIST $var" 27 | default=$2 28 | echo "Enter $3" 29 | echo -n "$1= [$2]_" 30 | eval read X 31 | if [ "$X" = "" ] 32 | then 33 | eval $var='"$default"' 34 | else 35 | eval $var='"$X"' 36 | fi 37 | } 38 | HOST=`hostname -s` 39 | opt=1 40 | DIR=WORK/$HOST.d 41 | while [[ "$opt" != "0" ]] 42 | do 43 | case $1 in 44 | -d) 45 | shift 46 | DIR=$1 47 | shift 48 | ;; 49 | -r) 50 | shift 51 | RDIR=$1 52 | shift 53 | ;; 54 | *) opt=0 55 | ;; 56 | esac 57 | done 58 | echo "WORK DIRECTORY is$DIR" 59 | if [[ "$RDIR" != "" ]] 60 | then 61 | echo "REVERSE WORK DIRECTORY is $RDIR" 62 | fi 63 | 64 | for v in $* 65 | do 66 | if [[ -f $DIR/$v.properties ]] 67 | then 68 | rm -f $DIR/$v.properties 69 | echo "Removed $DIR/$v.properties" 70 | fi 71 | if [[ "$RDIR" != "" && -f $RDIR/$v.properties ]] 72 | then 73 | rm -f $RDIR/$v.properties 74 | echo "Removed $RDIR/$v.properties" 75 | fi 76 | done 77 | 78 | 79 | 80 | 81 | 82 | 83 | 84 | 85 | 86 | 87 | -------------------------------------------------------------------------------- /scripts/FILES.d/strongswan/restart_vti.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | ################################################### 3 | # (c) EIS Group LTD, 2016 # 4 | # (License) GPL # 5 | # Donated to OpenSource by EIS Group, 2016. # 6 | # Authors: Alexei Roudnev , Andrey Saveliev # 7 | # # 8 | # open-source@eisgroup.com # 9 | # or aprudnev@gmail.com # 10 | # URL; http://eisgroup.com # 11 | ################################################### 12 | # Options - - 13 | # 1. Protection against frozen script 14 | # 15 | list=`ps aux | grep swanctl | grep -v grep | awk '{print $2}'` 16 | if [[ "$list" != "" ]] 17 | then 18 | echo "Some swanctl processes running, we wait 20 seci then kill them" 19 | sleep 20 20 | kill -9 $list > /dev/null 2>& 1 21 | sleep 1 22 | fi 23 | 24 | # This script check connections which gave up 25 | # and restarts them 26 | # Additionally it restarts dead vti interfaces (it MAY happen sometimes) 27 | # 28 | for i in /etc/strongswan/vti.d/vti*.conf 29 | do 30 | # set -x 31 | conn=`grep '^conn ' $i | awk '{print $2}'` 32 | echo -n "$conn... " 33 | if ! swanctl -list-sas | grep -q $conn 34 | then 35 | swanctl -i -c $conn >> /tmp/restarts.log & 36 | echo "Restarting" 37 | else 38 | if swanctl -list-sas | grep -q $conn 39 | then 40 | vti=`echo $conn | sed 's/\..*$//'` 41 | ip=`ifconfig $vti | sed -n "s/^.*destination //p"` 42 | # 43 | # In case of AZURE, remote IP can be not pingable 44 | # So we compare RX stats in 10 seconds (or while ping try to send pings) 45 | # If RX is different == there is inbound traffic in interface == it is healthy 46 | # Else, if no RX traffic and no pings, restart 47 | before=`ifconfig $vti | grep RX` 48 | n=0 49 | if [[ "$ip" != "" ]] 50 | then 51 | n=`ping -r -n -c 5 -q $ip | grep received | awk '{print $4;}'` 52 | if [[ "$n" = "" ]] 53 | then 54 | sleep 10 55 | fi 56 | else 57 | sleep 10 58 | fi 59 | after=`ifconfig $vti | grep RX` 60 | if [[ "$before" != "$after" || $n != "0" && $n != "" ]] 61 | then 62 | echo OK 63 | else 64 | ( 65 | echo " OK but no vti, resetting... see /tmp/${vti}_up.log" 66 | echo `date` resetting $conn > /tmp/${vti}_up.log 67 | strongswan down $conn >> /tmp/${vti}_up.log 2>& 1 68 | sleep 2 69 | strongswan up $conn >> /tmp/${vti}_up.log 2>& 1 70 | echo DONE $conn 71 | ) & 72 | fi 73 | else 74 | echo IN PROGRESS 75 | fi 76 | fi 77 | done 78 | wait 79 | 80 | 81 | -------------------------------------------------------------------------------- /scripts/README.txt: -------------------------------------------------------------------------------- 1 | # 2 | # (c) EIS Group LTD, 2016 3 | # (License) GPL 4 | # Donated to OpenSource by EIS Group, 2016. 5 | # Authors: Alexei Roudnev , Sergey Saveliev 6 | # 7 | # open-source@eisgroup.com 8 | # or aprudnev@gmail.com 9 | # 10 | # This is quick description of VTI management scripts. 11 | # 12 | This is VTI VPN router, compatible with AWS. 13 | 14 | Layouts: 15 | 16 | WORK - work directory 17 | 18 | WORK/.d/vtiN.properties - properti files for Available VTI 19 | /etc/strongswan - main IPSEC system 20 | /etc/sysconfig/.properties - host properties 21 | 22 | SYSTEM USAGE: 23 | 24 | 1) SET UP system after cloning or initial setting by running 25 | 26 | ./INITIAL_SETUP.sh 27 | (You wil have an option to install packages and/or to reset configuration of IPSEC 28 | and router). 29 | 30 | You may want, then, to manually edit /etc/quagga files. 31 | 32 | 2) Prepare VTI. You have 2 ways 33 | 2.1. Parse AWS file. To do it 34 | - copy AWS file into WORK directory, better with some meaning name like aws-lab20-1.txt 35 | - parse it by running ./VTI_ADDAWS.sh [-d work-dir] [vti1 vti2] 36 | (By default it will make available vti1 and vti2 but if they are used, you can specify 37 | different names) 38 | 2.2. Manually, by running 39 | ./VTI_ADD.sh [-d [-r ] 40 | 41 | (Both commands have options allowing to change work directory 42 | 43 | 3) Review files (they wil be created in work directory as vtiN.properties) 44 | 45 | 4) Then you can use VTI_OPS.sh to add|delete disable|enable tunnels and to check status. 46 | ./VTI_OPS.sh [-e ] [-d ] [-reload] [-nobgp] {-add|-delete|-enable|-disable} vti1 ... 47 | ./VTI_OPS.sh [-e ] p-d ] -status|-list 48 | 49 | -e allows to specify differnt /etc 50 | -reload enable automatic strongswan reload 51 | -nobgp blocks changes in bgpd.conf even if bgp specified in properties 52 | 53 | 54 | You can enter VTI instedas of '(cd /usr/local/src; ./VTI_OPS.sh). 55 | 56 | Normal procedure is: 57 | 58 | - copy aws file into /usr/local/scripts/WORK, for example, lab20-aws-1.txt 59 | - Prepare vti 60 | cd /usr/local/scripts && ./VTI_ADDAWS.sh WORK/lab20-aws-1.txt 61 | - Check files 62 | cat WORK/`hostname -s`.d/vti*.properties 63 | - Add vti-s 64 | VTI -list 65 | VTI -add vti1 66 | VTI -add vti2 67 | VTI -list 68 | 69 | - Enable this tunnels 70 | VTI -enable vti1 vti2 71 | 72 | - check results 73 | VTI -status 74 | 75 | You can disable tunnel 76 | VTI -disable vti1 77 | 78 | and enable it later 79 | VTI -enable vti1 80 | 81 | Normally, you do not need to restart strongswan and quagga (system reload them smoothly). 82 | 83 | VTI is just alias for 84 | 85 | (cd /usr/local/scripts && ./VTI_OPS.sh) 86 | 87 | refresh_scripts.sh allows to refresh system scripts from this copy in different place. 88 | update_kernel.sh should update old standard kernel into the strongswan-compatible version. 89 | 90 | if you make parsing on teh different place (not /usr/local/scripts), then SYNC_AVAIL.sh script required to make parsed properties to be available for the VTI command. 91 | 92 | 93 | 94 | 95 | 96 | 97 | -------------------------------------------------------------------------------- /scripts/FILES.d/strongswan/ipsec-vti.sh: -------------------------------------------------------------------------------- 1 | # AWS VPC Hardware VPN Strongswan updown Script 2 | ################################################### 3 | # (c) EIS Group LTD, 2016 # 4 | # (License) GPL # 5 | # Donated to OpenSource by EIS Group, 2016. # 6 | # Authors: Alexei Roudnev , Andrey Saveliev # 7 | # # 8 | # open-source@eisgroup.com # 9 | # or aprudnev@gmail.com # 10 | # URL; http://eisgroup.com # 11 | ################################################### 12 | 13 | LOG=/tmp/vti-`echo ${PLUTO_CONNECTION} | sed 's/\..*$//'`.log 14 | ( 15 | echo "*** `date` $0 $*" 16 | set -x 17 | # 18 | # We use only part before . in CONN name to find out init file 19 | # 20 | NAME=`echo ${PLUTO_CONNECTION} | sed 's/\..*$//'` 21 | if [[ -f /etc/strongswan/vti.d/${NAME}.init ]] 22 | then 23 | exist=1 24 | . /etc/strongswan/vti.d/${NAME}.init 25 | else 26 | exist=0 27 | VTI_INTERFACE=$NAME 28 | fi 29 | if [ "$VTI_INTERFACE" == "" ] 30 | then 31 | echo "No $VTI_INTERFACE defined" 32 | exit 1 33 | fi 34 | # VTI_INTERFACE 35 | # VTI_LOCALADDR 36 | # VTI_REMOTEADDR 37 | # VTI_MTU 38 | # VTI_UP= 39 | # VTI_DOWN= 40 | # AWS_ID= 41 | if [ "$VTI_MTU" = "" ] 42 | then 43 | VTI_MTU=1420 44 | fi 45 | 46 | if [ "$VTI_UP" = "" ] 47 | then 48 | VTI_UP="/etc/quagga/reset_vti.sh $NAME" 49 | fi 50 | 51 | if [ "$VTI_DOWN" = "" ] 52 | then 53 | VTI_DOWN="" 54 | fi 55 | 56 | # 57 | # Usage Instructions: 58 | # Add "install_routes = no" to /etc/strongswan/strongswan.d/charon.conf or /etc/strongswan.d/charon.conf 59 | # Add "install_virtual_ip = no" to /etc/strongswan/strongswan.d/charon.conf or /etc/strongswan.d/charon.conf 60 | # For Ubuntu: Add "leftupdown=/etc/strongswan.d/ipsec-vti.sh" to /etc/ipsec.conf 61 | # For RHEL/Centos: Add "leftupdown=/etc/strongswan/ipsec-vti.sh" to /etc/strongswan/ipsec.conf 62 | # For RHEL/Centos 6 and below: git clone git://git.kernel.org/pub/scm/linux/kernel/git/shemminger/iproute2.git && cd iproute2 && make && cp ./ip/ip /usr/local/sbin/ip 63 | IP=$(which ip) 64 | IPTABLES=$(which iptables) 65 | 66 | PLUTO_MARK_OUT_ARR=(${PLUTO_MARK_OUT//// }) 67 | PLUTO_MARK_IN_ARR=(${PLUTO_MARK_IN//// }) 68 | echo "`date` ${PLUTO_VERB} $VTI_INTERFACE" >> /tmp/vtitrace.log 69 | 70 | case "${PLUTO_VERB}" in 71 | up-client) 72 | $IP tunnel add ${VTI_INTERFACE} mode vti local ${PLUTO_ME} remote ${PLUTO_PEER} okey ${PLUTO_MARK_OUT_ARR[0]} ikey ${PLUTO_MARK_IN_ARR[0]} 73 | sysctl -w net.ipv4.conf.${VTI_INTERFACE}.disable_policy=1 74 | # We have many cases when we need this check to be disabled. SO we set up 0 not 2. 75 | #sysctl -w net.ipv4.conf.${VTI_INTERFACE}.rp_filter=2 || sysctl -w net.ipv4.conf.${VTI_INTERFACE}.rp_filter=0 76 | sysctl -w net.ipv4.conf.${VTI_INTERFACE}.rp_filter=0 77 | $IP addr add ${VTI_LOCALADDR} remote ${VTI_REMOTEADDR} dev ${VTI_INTERFACE} 78 | $IP link set ${VTI_INTERFACE} up mtu $VTI_MTU 79 | $IPTABLES -t mangle -I FORWARD -o ${VTI_INTERFACE} -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 80 | $IPTABLES -t mangle -I INPUT -p esp -s ${PLUTO_PEER} -d ${PLUTO_ME} -j MARK --set-xmark ${PLUTO_MARK_IN} 81 | $IP route flush table 220 82 | # 83 | eval $VTI_UP 84 | ;; 85 | down-client) 86 | if [[ $exist == 0 ]] 87 | then 88 | $IP tunnel del ${VTI_INTERFACE} 89 | else 90 | echo $IP link set ${VTI_INTERFACE} down mtu $VTI_MTU 91 | fi 92 | $IPTABLES -t mangle -D FORWARD -o ${VTI_INTERFACE} -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 93 | $IPTABLES -t mangle -D INPUT -p esp -s ${PLUTO_PEER} -d ${PLUTO_ME} -j MARK --set-xmark ${PLUTO_MARK_IN} 94 | #$IP route flush table 220 95 | eval $VTI_DOWN 96 | ;; 97 | esac 98 | 99 | # Enable IPv4 forwarding 100 | sysctl -w net.ipv4.ip_forward=1 101 | sysctl -w net.ipv4.conf.eth0.disable_xfrm=1 102 | sysctl -w net.ipv4.conf.eth0.disable_policy=1 103 | date 104 | ) > $LOG 2>& 1 105 | -------------------------------------------------------------------------------- /scripts/VTI_ADDAWS.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | ################################################### 3 | # (c) EIS Group LTD, 2016 # 4 | # (License) GPL # 5 | # Donated to OpenSource by EIS Group, 2016. # 6 | # Authors: Alexei Roudnev , Andrey Saveliev # 7 | # # 8 | # open-source@eisgroup.com # 9 | # or aprudnev@gmail.com # 10 | # URL; http://eisgroup.com # 11 | ################################################### 12 | 13 | # 14 | # Call this from current directory 15 | # 16 | # IT wil create property files in WORK/.properties or in $DIR/vti.properties 17 | # Default is WORK/.d (will be /etc/sysconfig later) 18 | # 19 | 20 | exec 2>&1 21 | 22 | error() { 23 | echo "$@" >&2 24 | exit 1 25 | } 26 | 27 | HOST=`hostname -s` 28 | opt=1 29 | enforce=0 30 | DIR=WORK/$HOST.d 31 | while [[ "$opt" != "0" ]] 32 | do 33 | case $1 in 34 | -d) 35 | shift 36 | DIR=$1 37 | shift 38 | ;; 39 | -f) 40 | enforce=1 41 | shift 42 | ;; 43 | *) opt=0 44 | ;; 45 | esac 46 | done 47 | 48 | echo "Using directory $DIR - you can change it by -d option" 49 | [ -z "$1" ] && error "Usage: $0 [-d directory] [-f] [vti1 [vti2]]" 50 | [ -r "$1" ] || error "Could not read VPN config file $1." 51 | 52 | # 53 | # Options after and including ID are optional (but must exist in aws file). 54 | # 55 | VTI1_LIST="VTI1 VTI1_MTU VTI1_OIP_LOCAL VTI1_OIP_REMOTE LOCAL_GW VTI1_IIP_LOCAL VTI1_IIP_REMOTE VTI1_PSK VTI1_MARK ID AWS_ID VTI1_BGP_LOCAL_AS VTI1_BGP_REMOTE_AS VTI1_BGP_LOCAL_IP VTI1_BGP_REMOTE_IP" 56 | 57 | VTI2_LIST="VTI2 VTI2_MTU VTI2_OIP_LOCAL VTI2_OIP_REMOTE LOCAL_GW VTI2_IIP_LOCAL VTI2_IIP_REMOTE VTI2_PSK VTI2_MARK ID AWS_ID VTI2_BGP_LOCAL_AS VTI2_BGP_REMOTE_AS VTI2_BGP_LOCAL_IP VTI2_BGP_REMOTE_IP" 58 | VAR_LIST="$VTI1_LIST $VTI2_LIST" 59 | 60 | 61 | # Local WAN interface 62 | LAN_INT="eth0" 63 | WAN_INT="eth1" 64 | 65 | # 66 | ID=`basename $1 .txt` 67 | 68 | VTI1="vti1" 69 | VTI2="vti2" 70 | 71 | # VTI2 can be empty, it means that we do not generate it at all. 72 | if [ "$2" != "" ] 73 | then 74 | VTI1=$2 75 | VTI2=$3 76 | fi 77 | 78 | # 79 | # PARSER of AWS config file 80 | # 81 | VTI1_OIP_LOCAL=$(cat $1 |grep -m 1 "\- Customer Gateway" | tail -1 | awk '{print $5}') 82 | VTI1_OIP_REMOTE=$(cat $1 |grep -m 1 "\- Virtual Private Gateway" | tail -1 | awk '{print $6}') 83 | VTI1_IIP_LOCAL=$(cat $1 |grep -m 2 "\- Customer Gateway" | tail -1 | awk '{print $5}') 84 | VTI1_IIP_REMOTE=$(cat $1 |grep -m 2 "\- Virtual Private Gateway" | tail -1 | awk '{print $6}') 85 | VTI2_OIP_LOCAL=$(cat $1 |grep -m 4 "\- Customer Gateway" | tail -1 | awk '{print $5}') 86 | VTI2_OIP_REMOTE=$(cat $1 |grep -m 3 "\- Virtual Private Gateway" | tail -1 | awk '{print $6}') 87 | VTI2_IIP_LOCAL=$(cat $1 |grep -m 5 "\- Customer Gateway" | tail -1 | awk '{print $5}') 88 | VTI2_IIP_REMOTE=$(cat $1 |grep -m 4 "\- Virtual Private Gateway" | tail -1 | awk '{print $6}') 89 | VTI1_PSK=$(cat $1 | grep -m 1 "\- Pre-Shared Key" | tail -1 | awk '{print $5}') 90 | VTI2_PSK=$(cat $1 | grep -m 2 "\- Pre-Shared Key" | tail -1 | awk '{print $5}') 91 | VTI1_BGP_LOCAL_AS=$(cat $1 | grep -m 1 'Customer Gateway ASN' | tail -1 | awk '{print $6}') 92 | VTI1_BGP_REMOTE_AS=$(cat $1 | grep -m 1 'Virtual Private Gateway ASN' | tail -1 | awk '{print $7}') 93 | VTI2_BGP_LOCAL_AS=$(cat $1 | grep -m 2 'Customer Gateway ASN' | tail -1 | awk '{print $6}') 94 | VTI2_BGP_REMOTE_AS=$(cat $1 | grep -m 2 'Virtual Private Gateway ASN' | tail -1 | awk '{print $7}') 95 | VTI1_BGP_REMOTE_IP=$(cat $1 | grep -m 1 "Neighbor IP Address" | tail -1 | awk '{print $6}') 96 | VTI2_BGP_REMOTE_IP=$(cat $1 | grep -m 2 "Neighbor IP Address" | tail -1 | awk '{print $6}') 97 | # For easier reverse BGP configuration just in case 98 | VTI1_BGP_LOCAL_IP=$VTI1_IIP_LOCAL 99 | VTI2_BGP_LOCAL_IP=$VTI2_IIP_LOCAL 100 | 101 | AWS_ID=$(cat $1 | grep 'Your VPN Connection ID' | awk '{print $6}') 102 | LOCAL_GW=`echo $VTI1_OIP_LOCAL | sed 's/[^.]*$/1/'` 103 | VTI1_MTU=1420 104 | VTI2_MTU=1420 105 | #VTI1_MARK=`echo $VTI1 | sed 's/^vti//;s/$/00/'` 106 | #VTI2_MARK=`echo $VTI2 | sed 's/^vti//;s/$/00/'` 107 | VTI1_MARK_DEC=`echo $VTI1 | sed 's/^vti//;s/$/0/'` 108 | VTI2_MARK_DEC=`echo $VTI2 | sed 's/^vti//;s/$/0/'` 109 | VTI1_MARK=`bc <<< "obase=8; $VTI1_MARK_DEC"` 110 | VTI2_MARK=`bc <<< "obase=8; $VTI2_MARK_DEC"` 111 | 112 | # Check weather we got all the values 113 | if [ "$VTI2" != "" ] 114 | then 115 | list="$VAR_LIST $VTI2_LIST" 116 | else 117 | list=$VTI1_LIST 118 | fi 119 | # 120 | for i in $list 121 | do 122 | eval "[ -z \"\$$i\" ] && error \"Could not extract $i from \$1.\"" 123 | done 124 | 125 | mkdir -p $DIR 126 | if [[ -f $DIR/$VTI1.properties && ! "$enforce" = "1" ]] 127 | then 128 | echo "$VTI1 already exists in $DIR, 129 | rm $DIR/$VTI1.properties , use -f option, or specify another vti" 130 | echo "Aborted" 131 | exit 1 132 | fi 133 | if grep '"'$VTI1_IIP_LOCAL'"' $DIR/*.properties 134 | then 135 | if [[ "$enforce" != "1" ]] 136 | then 137 | echo "Duplicated IP address $VTI1_IIP_LOCAL found, aborted. You can use -f to override it" 138 | exit 1 139 | else 140 | echo "Warning: $VTI1_IIP_LOCAL address duplicated.. we continue on your own risk..." 141 | sleep 2 142 | fi 143 | fi 144 | if grep '"'$VTI2_IIP_LOCAL'"' $DIR/*.properties 145 | then 146 | if [[ "$enforce" != "1" ]] 147 | then 148 | echo "Duplicated IP address $VTI2_IIP_LOCAL found, aborted. You can use -f to override it" 149 | exit 1 150 | else 151 | echo "Warning: $VTI2_IIP_LOCAL address duplicated.. we continue on your own risk..." 152 | sleep 2 153 | fi 154 | fi 155 | 156 | 157 | id=$ID 158 | # 159 | ID="${id}_GW1" 160 | echo "### Generated `date`" > $DIR/$VTI1.properties 161 | for i in $VTI1_LIST 162 | do 163 | if [ "$i" = "ID" ] 164 | then 165 | echo "#### OPTIONAL " >> $DIR/$VTI1.properties 166 | fi 167 | j=`echo $i | sed 's/VTI[12]/VTI/'` 168 | eval 'echo '$j'=\"$'$i'\"' >> $DIR/$VTI1.properties 169 | done 170 | echo "Created $DIR/$VTI1.properties" 171 | 172 | if [ "$VTI2" == "" ] 173 | then 174 | echo "no vti2 requested, skipping second VPN" 175 | exit 0 176 | fi 177 | if [[ -f $DIR/$VTI2.properties && ! "$enforce" = "1" ]] 178 | then 179 | echo "$VTI2 alredy exists in $DIR, 180 | rm $DIR/$VTI2.properties , add -f option, or specify another vti" 181 | echo "Aborted" 182 | exit 1 183 | fi 184 | 185 | ID="${id}_GW2" 186 | echo "### Generated `date`" > $DIR/$VTI2.properties 187 | 188 | for i in $VTI2_LIST 189 | do 190 | if [ "$i" = "ID" ] 191 | then 192 | echo "#### OPTIONAL " >> $DIR/$VTI2.properties 193 | fi 194 | j=`echo $i | sed 's/^VTI[12]/VTI/'` 195 | eval 'echo '$j'=\"$'$i'\"' >> $DIR/$VTI2.properties 196 | done 197 | echo "Created $DIR/$VTI2.properties" 198 | 199 | 200 | 201 | -------------------------------------------------------------------------------- /scripts/VTI_ADD.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | ################################################### 3 | # (c) EIS Group LTD, 2016 # 4 | # (License) GPL # 5 | # Donated to OpenSource by EIS Group, 2016. # 6 | # Authors: Alexei Roudnev , Andrey Saveliev # 7 | # # 8 | # open-source@eisgroup.com # 9 | # or aprudnev@gmail.com # 10 | # URL; http://eisgroup.com # 11 | ################################################### 12 | 13 | # 14 | # Call this from current directory 15 | # 16 | # IT wil create property files in WORK/.properties 17 | # Options: 18 | # -d 19 | # -r 20 | # 21 | 22 | # Manually enter parameters 23 | # 24 | LIST= 25 | ask() { 26 | var=$1 27 | LIST="$LIST $var" 28 | default=$2 29 | echo "Enter $3" 30 | echo -n "$1= [$2]_" 31 | eval read X 32 | if [ "$X" = "" ] 33 | then 34 | eval $var='"$default"' 35 | else if [ "$X" = "#" ] 36 | then 37 | eval $var='""' 38 | else 39 | eval $var='"$X"' 40 | fi 41 | fi 42 | } 43 | HOST=`hostname -s` 44 | opt=1 45 | DIR=WORK/$HOST.d 46 | while [[ "$opt" != "0" ]] 47 | do 48 | case $1 in 49 | -d) 50 | shift 51 | DIR=$1 52 | shift 53 | ;; 54 | -r) 55 | shift 56 | RDIR=$1 57 | shift 58 | ;; 59 | "") opt=0 60 | ;; 61 | *) 62 | echo "Usage: $0 [-d directory] [-r reverse-directory]" 63 | exit 1 64 | ;; 65 | esac 66 | done 67 | echo "Results will be in $DIR" 68 | if [[ "$RDIR" != "" ]] 69 | then 70 | echo "Results for other end in $RDIR" 71 | fi 72 | 73 | 74 | # Let's find free vti 75 | i=0 76 | 77 | while (( ++i )) 78 | do 79 | if [ ! -f $DIR/vti$i.properties ] 80 | then 81 | break 82 | fi 83 | done 84 | 85 | ask ID "" "Connection name, will be added to connection name in IPSEC 86 | Recommended format: local-gw_remote-gw" 87 | ask N $i "Interface number (1 - 99)" 88 | VTI="vti$N" 89 | # RESET var list as we do not need N here 90 | LIST="ID VTI" 91 | 92 | ask VTI_MTU 1420 "MTU of this VTI" 93 | # Find local IPADDR 94 | IP=`sed -n 's/^IPADDR=//p' /etc/sysconfig/network-scripts/ifcfg-eth1` 95 | ask VTI_OIP_LOCAL "$IP" "OUTSIDE IP of tunnel, local" 96 | 97 | # 98 | ask VTI_OIP_REMOTE "" "OUTSIDE IP of tunnel, remote (no default)" 99 | # 100 | GW=`echo $VTI_OIP_LOCAL | sed 's/[^.]*$/1/'` 101 | ask LOCAL_GW $GW "Default gateway for $VTI_OIP_REMOTE on local gateway" 102 | 103 | if [[ "$RDIR" != "" ]] 104 | then 105 | GW=`echo $VTI_OIP_REMOTE | sed 's/[^.]*$/1/'` 106 | ask REMOTE_GW $GW "Default gateway for $VTI_OIP_LOCAL on remote gateway" 107 | fi 108 | 109 | ask VTI_IIP_LOCAL "" "Inside IP of tunnel, local, without /" 110 | VTI_IIP_LOCAL="$VTI_IIP_LOCAL" 111 | 112 | ask VTI_IIP_REMOTE "" "Inside IP of tunnel, remote, without /" 113 | VTI_IIP_REMOTE="$VTI_IIP_REMOTE" 114 | 115 | ask VTI_IIP_PREFIX "/30" "Netmask prefix with / (/30 means 255.255.255.252, and so on)" 116 | # 117 | ask VTI_PSK "" "Shared Secret" 118 | # 119 | VTI_MARK=`echo $VTI | sed 's/^vti//;s/$/0/'` 120 | VTI_MARK=`bc <<< "obase=8; $VTI_MARK"` 121 | ask VTI_MARK "$VTI_MARK" "MARK for this VTI, must be different on different VTI" 122 | 123 | # 124 | ask VTI_PROVIDER "" "Enter provider - AZURE, AWS - for pre-configured settings. Enter to use defaults" 125 | case "$VTI_PROVIDER" in 126 | AZURE) 127 | VTI_O1="ike=aes256-sha1-modp1024" 128 | VTI_O2="esp=aes128-sha1,aes256-sha1!" 129 | VTI_O3="keyexchange=ike" 130 | VTI_O4="ikelifetime=10800s" 131 | VTI_O5="keylife=3600s" 132 | VTI_O6="keyingtries=%forever" 133 | 134 | 135 | VTI_BGP1="route-map from_azure in" 136 | VTI_BGP2="ebgp-multihop" 137 | echo " Added 138 | VTI_O1=$VTI_O1 139 | VTI_O2=$VTI_O2 140 | VTI_O3=$VTI_O3 141 | VTI_O4=$VTI_O4 142 | VTI_O5=$VTI_O5 143 | VTI_O6=$VTI_O6 144 | VTI_BGP1=$VTI_BGP1 145 | VTI_BGP2=$VTI_BGP2 146 | 147 | You can change them later or ADD extra options." 148 | ;; 149 | AWS) VTI_BGP1="route-map from_aws in" 150 | VTI_O1="keyingtries=%forever" 151 | echo " Added 152 | VTI_O1=$VTI_O1 153 | VTI_BGP1=$VTI_BGP1 154 | 155 | You can change them later" 156 | 157 | ;; 158 | "") VTI_O1="keyingtries=%forever" 159 | ;; 160 | *) echo "Unknown provider $VTI_PROVIDER, skipped" 161 | ;; 162 | esac 163 | # 164 | echo "You can add up to 5 connection options in format key=value . No syntax check here." 165 | # 166 | ask VTI_O1 "$VTI_O1" "Option 1. Enter # to skip" 167 | ask VTI_O2 "$VTI_O2" "Option 2. Enter # to skip" 168 | ask VTI_O3 "$VTI_O3" "Option 3. Enter # to skip" 169 | ask VTI_O4 "$VTI_O4" "Option 4. Enter # to skip" 170 | ask VTI_O5 "$VTI_O5" "Option 5. Enter # to skip" 171 | ask VTI_O6 "$VTI_O6" "Option 6. Enter # to skip" 172 | 173 | 174 | echo "Now enter BGP information if we use it" 175 | ask VTI_BGP_REMOTE_AS "" "Enter AS of remote neighbor (ENTER if no BGP)" 176 | if [ "$VTI_BGP_REMOTE_AS" != "" ] 177 | then 178 | ask VTI_BGP_LOCAL_AS "" "Enter AS of our system" 179 | ask VTI_BGP_REMOTE_IP "$VTI_IIP_REMOTE" "Enter IP of neighbor" 180 | ask VTI_BGP_LOCAL_IP "$VTI_IIP_LOCAL" "Enter local IP for BGP" 181 | # 182 | # 183 | # 184 | echo "You can add up to 5 bgp options here (they added with neighbor $VTI_BGP_REMOTE_IP). No syntax check here." 185 | # 186 | ask VTI_BGP1 "$VTI_BGP1" "neighbor $VTI_BGP_REMOTE_IP Option 1. Enter # to skip" 187 | ask VTI_BGP2 "$VTI_BGP2" "neighbor $VTI_BGP_REMOTE_IP Option 2. Enter # to skip" 188 | ask VTI_BGP3 "$VTI_BGP3" "neighbor $VTI_BGP_REMOTE_IP Option 3. Enter # to skip" 189 | ask VTI_BGP4 "$VTI_BGP4" "neighbor $VTI_BGP_REMOTE_IP Option 4. Enter # to skip" 190 | ask VTI_BGP5 "$VTI_BGP5" "neighbor $VTI_BGP_REMOTE_IP Option 5. Enter # to skip" 191 | fi 192 | 193 | # 194 | # Now add netmasks 195 | # 196 | VTI_IIP_LOCAL="$VTI_IIP_LOCAL$VTI_IIP_PREFIX" 197 | VTI_IIP_REMOTE="$VTI_IIP_REMOTE$VTI_IIP_PREFIX" 198 | echo "We adjusted addresses as VTI_IIP_LOCAL=$VTI_IIP_LOCAL and VTI_IIP_REMOTE=$VTI_IIP_REMOTE" 199 | # 200 | # 201 | # Create REVERSE properties if requested, first, so we can abort if number is used 202 | # 203 | if [[ "$RDIR" != "" ]] 204 | then 205 | mkdir -p $RDIR 206 | if [[ -f $RDIR/$VTI.properties ]] 207 | then 208 | echo "File $RDIR/$VTI.properties already exists, can not rewrite it. Aborting" 209 | exit 1 210 | fi 211 | echo "### MANUALLY CREATED `date`" > $RDIR/$VTI.properties 212 | for i in $LIST 213 | do 214 | j=`echo $i | sed 's/LOCAL/LCL/;s/REMOTE/LOCAL/;s/LCL/REMOTE/'` 215 | eval 'echo '$j'=\"$'$i'\"' >> $RDIR/$VTI.properties 216 | done 217 | echo "Created REVERSE properties $RDIR/$VTI.properties" 218 | cat $RDIR/$VTI.properties 219 | fi 220 | 221 | mkdir -p $DIR 222 | echo "### MANUALLY CREATED `date`" > $DIR/$VTI.properties 223 | for i in $LIST 224 | do 225 | eval 'echo '$i'=\"$'$i'\"' >> $DIR/$VTI.properties 226 | done 227 | echo "Created $DIR/$VTI.properties" 228 | cat $DIR/$VTI.properties 229 | 230 | 231 | 232 | 233 | 234 | 235 | 236 | -------------------------------------------------------------------------------- /scripts/VTI_OPS.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | ################################################### 3 | # (c) EIS Group LTD, 2016 # 4 | # (License) GPL # 5 | # Donated to OpenSource by EIS Group, 2016. # 6 | # Authors: Alexei Roudnev , Andrey Saveliev # 7 | # # 8 | # open-source@eisgroup.com # 9 | # or aprudnev@gmail.com # 10 | # URL; http://eisgroup.com # 11 | ################################################### 12 | 13 | # 14 | # Add / delete / enable / disablei VTI 15 | # 16 | # usage - $0 [-e etc] [-d directory] [-reload] {-status|-list|-add|-delete|-enable|-disable} LIST 17 | # 18 | # ENABLE | DISABLE - we move vtiN.conf from/to /etc/strongswan/vti.d/.DISABLED 19 | # ADD|DELETE - we create or update config files. 20 | # -e - where /etc is (default /etc) 21 | # -d - where directory with properties is (default WORK/.d 22 | # -reload - reload strongswan after operation 23 | # -nobgp - do not generate record in bgpd.conf 24 | # 25 | error() { 26 | echo "$*" 27 | echo "Usage: $0 [-e ] [-d ] [-noreload] [-nobgp] {-add|-delete|-enable|-disable} vti1 ... 28 | $0 [-e ] p-d ] -status|-list [vtiN]" 29 | exit 1 30 | } 31 | 32 | ETC=/etc 33 | HOST=`hostname -s` 34 | DIR=WORK/$HOST.d 35 | OP= 36 | QUIET= 37 | # 38 | nosrv=0 39 | nobgp=0 40 | 41 | while [[ "$OP" == "" ]] 42 | do 43 | case $1 in 44 | -e) 45 | shift 46 | ETC=$1 47 | shift 48 | ;; 49 | -d) 50 | shift 51 | DIR=$1 52 | shift 53 | ;; 54 | -noreload) 55 | nosrv=1 56 | shift 57 | ;; 58 | -nobgp) 59 | nobgp=1 60 | shift 61 | ;; 62 | -add|-delete|-enable|-disable|-list|-status) 63 | OP=$1 64 | shift 65 | ;; 66 | *) 67 | error "Unknown option $1" 68 | ;; 69 | esac 70 | done 71 | VDIR=$ETC/strongswan/vti.d 72 | 73 | # 74 | # Verify directories 75 | # 76 | test -d $ETC/quagga || error "Error: No $ETC/quagga directory" 77 | test -d $ETC/strongswan/vti.d || error "No $ETC/strongswan/vti.d directory" 78 | test -d $DIR || mkdir -p $DIR 79 | # 80 | if [[ -f $ETC/sysconfig/$HOST.properties ]] 81 | then 82 | . $ETC/sysconfig/$HOST.properties 83 | else 84 | echo "Warning: no $ETC/sysconfig/$HOST.properties file" 85 | echo "It is created when you run INITIAL_SETUP.sh script" 86 | echo "Not a problem but we can not verify some information" 87 | fi 88 | # 89 | cnt=0 90 | case $OP in 91 | -list) 92 | echo "Active: `cd $VDIR && echo *.conf | sed 's/.conf//g'`" 93 | echo "Disabled: `cd $VDIR/.DISABLED && echo *.conf | sed 's/.conf//g'`" 94 | echo "Available: `cd $DIR && echo *.properties | sed 's/.properties//g'`" 95 | exit 0 96 | ;; 97 | -status) 98 | if [ "$1" != "" ] 99 | then 100 | for v in $* 101 | do 102 | ( 103 | swanctl -list-sas; 104 | ifconfig | grep vti 105 | netstat -rn | grep vti 106 | ) | grep $v 107 | done 108 | else 109 | swanctl -list-sas; 110 | ifconfig | grep vti 111 | netstat -rn | grep vti 112 | fi 113 | exit 0 114 | ;; 115 | -disable) 116 | for i in $* 117 | do 118 | if [[ -f $VDIR/$i.conf ]] 119 | then 120 | conn=`grep '^conn' $VDIR/$i.conf | awk '{print $2}'` 121 | mkdir -p $VDIR/.DISABLED 122 | mv -f $VDIR/$i.conf $VDIR/.DISABLED 123 | strongswan update 124 | sleep 5 125 | strongswan down $conn 126 | ifconfig $i down 127 | echo $i disabled 128 | (( cnt++ )) 129 | else 130 | echo "$i not active so can not disable" 131 | fi 132 | done 133 | ;; 134 | -enable) 135 | for i in $* 136 | do 137 | if [[ -f $VDIR/.DISABLED/$i.conf ]] 138 | then 139 | mv -f $VDIR/.DISABLED/$i.conf $VDIR/ 140 | echo $i enabled 141 | strongswan update 142 | sleep 5 143 | conn=`grep '^conn' $VDIR/$i.conf | awk '{print $2}'` 144 | strongswan down $conn 145 | sleep 2 146 | strongswan up $conn 147 | (( cnt++ )) 148 | else 149 | echo "$i not disabled so can not enable" 150 | fi 151 | done 152 | ;; 153 | -add) 154 | # 155 | # Check all interfaces. We do not want to run partial operations 156 | # 157 | for v in $* 158 | do 159 | test -r $DIR/$v.properties || error "Error: no $DIR/$v.properties; use VTI_ADD.sh or VTI_ADDAWS.sh to create it" 160 | test -f $VDIR/$v.conf && error "$VDIR/$v.conf exists, delete $v first" 161 | test -f $VDIR/.DISABLED/$v.conf && error "$VDIR/.DISABLED/$v.conf exists, delete $v first" 162 | done 163 | for v in $* 164 | do 165 | ( 166 | . $DIR/$v.properties || error "Can not read properties $DIR/$v.properties" 167 | rsync -a $DIR/$v.properties ~/scripts/WORK/`hostname -s`.d/. 168 | if [[ "$LOCAL_GW" == "" && "$EXT_GW" != "" ]] 169 | then 170 | LOCAL_GW=$EXT_GW 171 | echo "Used $EXT_GW as LOCAL_GW" 172 | fi 173 | for i in VTI_OIP_LOCAL VTI_OIP_REMOTE VTI_PSK VTI_IIP_LOCAL VTI_IIP_REMOTE LOCAL_GW 174 | do 175 | eval "[ -z \"\$$i\" ] && error \"Could not extract $i from \$DIR/$v.properties.\"" 176 | done 177 | conn=$v 178 | if [[ "$ID" != "" ]] 179 | then 180 | conn=$v.$ID 181 | fi 182 | echo "1. Creating $VDIR/$v.init, $v.secret, $v.conf" 183 | cat > $VDIR/$v.init < $VDIR/$v.secrets 195 | cat > $VDIR/.DISABLED/$v.conf < /etc/hostname 125 | grep NOZEROCONF -q /etc/sysconfig/network || echo NOZEROCONF=yes >> /etc/sysconfig/network 126 | 127 | # 128 | cat > /etc/resolv.conf <> /etc/resolv.conf 136 | done 137 | 138 | cat > /etc/sysconfig/network-scripts/ifcfg-eth0 < /etc/sysconfig/network-scripts/ifcfg-eth1 < /etc/sysconfig/$host.properties <> /etc/sysconfig/$host.properties 195 | done 196 | fi 197 | 198 | if [[ "$REINSTALL" != "n" ]] 199 | then 200 | yum -y remove libreswan 201 | yum -y remove firewalld 202 | yum -y remove monit 203 | yum -y install net-snmp 204 | yum -y install --enablerepo=epel strongswan quagga system-config-firewall monit 205 | 206 | rm -rf /etc/ipsec.d 207 | rm -f /etc/ipsec.conf 208 | rm -f /etc/ipsec.secrets 209 | if [[ `pwd -P` != `cd ~/scripts && pwd -P` ]] 210 | then 211 | rsync -a README* *.sh VTI* FILES.d ~/scripts/ 212 | mkdir -p ~/scripts/WORK 213 | rsync -a WORK/`hostname -s`.d ~/scripts/WORK/. 214 | cat > /usr/sbin/VTI <> /etc/motd 220 | fi 221 | # 222 | fi 223 | 224 | if [[ "$RESET" = "y" ]] 225 | then 226 | # 227 | echo " " 228 | echo "Resetting configuration..." 229 | # 230 | echo "3.Removing /etc/strongswan/vti.d/*.{conf,init,secrets} /etc/quagga/*.conf" 231 | rm -rf /etc/strongswan/vti.d /etc/quagga 232 | echo "4. Copyying files from FILES.d to /etc" 233 | service zebra stop 234 | (cd FILES.d && tar cf - * ) | (cd /etc && tar xf -) 235 | chown -R quagga:quagga /etc/quagga 236 | for i in zebra ospfd bgpd 237 | do 238 | systemctl enable $i 239 | systemctl start $i 240 | systemctl status $i 241 | done 242 | chmod 600 /etc/strongswan/ipsec.secrets 243 | chmod +x /etc/strongswan/ipsec-vti.sh 244 | echo "5. Recreating /etc/sysconfig/network-scripts/route-eth1" 245 | cat > /etc/sysconfig/network-scripts/route-eth1 < /etc/sysconfig/iptables < /tmp/conf.$$ <> /tmp/conf.$$ 294 | done 295 | cat >> /tmp/conf.$$ < /tmp/conf.$$ <> /etc/sysconfig/snmpd 329 | cat > /etc/snmp/snmpd.conf <