-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathinstall_ipsec.txt
More file actions
143 lines (112 loc) · 3.87 KB
/
install_ipsec.txt
File metadata and controls
143 lines (112 loc) · 3.87 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
#!/bin/bash
#
###############################
# SCRIPT INSTALACAO VPN IPSEC #
# #
# AUTHOR: LEONARDO ARAUJO #
# CRIACAO: 10 MAR 2015 #
###############################
clear
echo "
__ __ _____ _____ _____ ______ _____
| \/ | _ |_ _| __ \ / ____| ____/ ____|
| \ / | (_) | | | |__) | (___ | |__ | |
| |\/| | | | | ___/ \___ \| __|| |
| | | | _ _| |_| | ____) | |___| |____
|_| |_| (_) |_____|_| |_____/|______\_____|
"
# INSTALACAO DE PACOTES
wget https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm
rpm -Uvh epel-release-latest-6.noarch.rpm --force
yum update -y
yum install openswan.x86_64 openswan-doc.x86_64 NetworkManager-openswan.x86_64 pwgen.x86_64 -y
clear
# VARIAVEL
PATH="/etc/ipsec.d"
SENHA=`pwgen -Byns 10 1`
IPTABLES='$IPTABLES'
# INTERACOES
echo -n " Informe o IP VIP: "
read VIP
export VIP
echo -n " Informe o RANGE BACKEND: "
read BACKEND
export BACKEND
echo -n " Informe o NOME do Cliente: "
read NOME
export NOME
echo -n " Informe o IP de Internet do Cliente: "
read IPCLIENTE
export IPCLIENTE
echo -n " Informe o RANGE BACKEND do Cliente: "
read BACKENDCLIENTE
export BACKENDCLIENTE
# ARQUIVOS DE CONFIGURACAO
echo "# Please place your own config files in /etc/ipsec.d/ ending in .conf
version 2.0 # conforms to second version of ipsec.conf specification
# basic configuration
config setup
listen=$VIP
protostack=netkey
nat_traversal=yes
virtual_private=
oe=off
plutostderrlog=/var/log/pluto.log
#You may put your configuration (.conf) file in the "/etc/ipsec.d/" and uncomment this.
include /etc/ipsec.d/*.conf
" > /etc/ipsec.conf
echo "conn $NOME
type=tunnel
left=$VIP
leftsubnet=$BACKEND
# Funcao MultiLink
# right=%any
# DADOS REDE CLIENTE
right=$IPCLIENTE
rightsubnet=$BACKENDCLIENTE
# PHASE1 de AUTENTICACAO
ike=3des-sha1;modp1024
# PHASE2 de AUTENTICACAO
phase2alg=3des-sha1;modp1024
keyexchange=ike
ikelifetime=28800s
keylife=1800s
dpddelay=10
dpdtimeout=5
dpdaction=restart_by_peer
authby=secret
auto=start
pfs=no
" > $PATH/vpn-$NOME.conf
echo "$VIP $IPCLIENTE : PSK '$SENHA'" > $PATH/vpn-$NOME.secrets
# REGRAS DE FIREWALL
$(which iptables) -I INPUT -p esp -j ACCEPT
$(which iptables) -I INPUT -p udp --dport 500 -j ACCEPT
$(which iptables) -I INPUT -p tcp --dport 500 -j ACCEPT
$(which iptables) -I INPUT -p udp --dport 4500 -j ACCEPT
$(which iptables) -I INPUT -s $IPCLIENTE -j ACCEPT
$(which iptables) -I FORWARD -s $IPCLIENTE -j ACCEPT
$(which iptables) -I FORWARD -s $BACKENDCLIENTE -d $BACKEND -j ACCEPT
$(which iptables) -I FORWARD -s $BACKEND -d $BACKENDCLIENTE -j ACCEPT
$(which iptables) -t nat -I POSTROUTING -s $BACKEND -d $BACKENDCLIENTE -j ACCEPT
$(which iptables) -t nat -I POSTROUTING -s $BACKENDCLIENTE -d $BACKEND -j ACCEPT
echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/lo/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/eth0/rp_filter
echo 0 > /proc/sys/net/ipv4/conf/eth1/rp_filter
echo ""
echo "### ADICIONAR AS REGRAS ABAIXO NO SCRIPT DE FIREWALL ###
## REGRAS IPSEC
##################################################################
$IPTABLES -A INPUT -p esp -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 500 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 500 -j ACCEPT
$IPTABLES -A INPUT -p udp --dport 4500 -j ACCEPT
$IPTABLES -A INPUT -s $IPCLIENTE -j ACCEPT
$IPTABLES -A FORWARD -s $IPCLIENTE -j ACCEPT
$IPTABLES -A FORWARD -s $BACKENDCLIENTE -d $BACKEND -j ACCEPT
$IPTABLES -A FORWARD -s $BACKEND -d $BACKENDCLIENTE -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -s $BACKEND -d $BACKENDCLIENTE -j ACCEPT
$IPTABLES -t nat -A POSTROUTING -s $BACKENDCLIENTE -d $BACKEND -j ACCEPT
###################################################################
"