https://github.com/BoizZ/PPTP-L2TP-IPSec-VPN-auto-installation-script-for-CentOS-7
| ############################################################# |
| # This is a PPTP and L2TP VPN installation for CentOS 7 # |
| # Version: 1.1.1 20160507 # |
| # Website: http://www.ccwebsite.com # |
| ############################################################# |
| if [[ $(id -u) != “0“ ]]; then |
| printf “e[42me[31mError: You must be root to run this install script.e[0mn“ |
| if [[ $(grep “release 7.“ /etc/redhat-release 2>/dev/null | wc -l) -eq 0 ]]; then |
| printf “e[42me[31mError: Your OS is NOT CentOS 7 or RHEL 7.e[0mn“ |
| printf “e[42me[31mThis install script is ONLY for CentOS 7 and RHEL 7.e[0mn“ |
| ############################################################# |
| # This is a PPTP and L2TP VPN installation for CentOS 7 # |
| # Version: 1.1.1 20160507 # |
| # Website: http://www.ccwebsite.com # |
| ############################################################# |
| serverip=$(ifconfig -a |grep -w “inet“| grep -v “127.0.0.1“ |awk ‘{print $2;}‘) |
| printf “e[33m$serveripe[0m is the server IP?“ |
| printf “If e[33m$serveripe[0m is e[33mcorrecte[0m, press enter directly.“ |
| printf “If e[33m$serveripe[0m is e[33mincorrecte[0m, please input your server IP.“ |
| printf “(Default server IP: e[33m$serveripe[0m):“ |
| if [[ -n “$serveriptmp“ ]]; then |
| ethlist=$(ifconfig | grep “: flags“ | cut -d “:“ -f1) |
| eth=$(printf “$ethlistn“ | head -n 1) |
| if [[ $(printf “$ethlistn“ | wc -l) -gt 2 ]]; then |
| echo ====================================== |
| echo “Network Interface list:“ |
| printf “e[33m$ethliste[0mn“ |
| echo ====================================== |
| echo “Which network interface you want to listen for ocserv?“ |
| printf “Default network interface is e[33m$ethe[0m, let it blank to use default network interface: “ |
| if [ -n “$ethtmp“ ]; then |
| echo “Please input IP-Range:“ |
| printf “(Default IP-Range: e[33m$iprangee[0m): “ |
| if [[ -n “$iprangetmp“ ]]; then |
| printf “(Default PSK: e[33mueibo.cne[0m): “ |
| if [[ -n “$mypsktmp“ ]]; then |
| echo “Please input VPN username:“ |
| printf “(Default VPN username: e[33mueibo.come[0m): “ |
| if [[ -n “$usernametmp“ ]]; then |
| for i in {a..z}; do arr[index]=$i; index=$(expr ${index} + 1); done |
| for i in {A..Z}; do arr[index]=$i; index=$(expr ${index} + 1); done |
| for i in {0..9}; do arr[index]=$i; index=$(expr ${index} + 1); done |
| for i in {1..10}; do str=“$str${arr[$RANDOM%$index]}“; done |
| printf “Please input e[33m$usernamee[0m’s password:n“ |
| printf “Default password is e[33m$passworde[0m, let it blank to use default password: “ |
| if [[ -n “$passwordtmp“ ]]; then |
| echo “Client Remote IP Range:“ |
| echo “$iprange.10-$iprange.254“ |
| echo “Press any key to start…“ |
| dd if=/dev/tty bs=1 count=1 2> /dev/null |
| yum install epel-release -y |
| yum install -y openswan ppp pptpd xl2tpd wget |
| cat >>/etc/ipsec.conf<<EOF |
| # /etc/ipsec.conf – Libreswan IPsec configuration file |
| # This file: /etc/ipsec.conf |
| # Enable when using this configuration file with openswan instead of libreswan |
| # NAT-TRAVERSAL support, see README.NAT-Traversal |
| # exclude networks used on server side by adding %v4:!a.b.c.0/24 |
| virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12 |
| # OE is now off by default. Uncomment and change to on, to enable. |
| # which IPsec stack to use. auto will try netkey, then klips then mast |
| leftnexthop=%defaultroute |
| rightnexthop=%defaultroute |
| ike=3des-sha1,aes-sha1,aes256-sha1,aes256-sha2_256 |
| phase2alg=3des-sha1,aes-sha1,aes256-sha1,aes256-sha2_256 |
| # For example connections, see your distribution’s documentation directory, |
| # or the documentation which could be located at |
| # /usr/share/docs/libreswan-3.*/ or look at https://www.libreswan.org/ |
| # There is also a lot of information in the manual page, “man ipsec.conf” |
| # You may put your configuration (.conf) file in the “/etc/ipsec.d/” directory |
| # by uncommenting this line |
| #include /etc/ipsec.d/*.conf |
| cat >>/etc/ipsec.secrets<<EOF |
| #include /etc/ipsec.d/*.secrets |
| $serverip %any: PSK “$mypsk” |
| cat >>/etc/pptpd.conf<<EOF |
| option /etc/ppp/options.pptpd |
| remoteip $iprange.200-254 |
| rm -f /etc/xl2tpd/xl2tpd.conf |
| cat >>/etc/xl2tpd/xl2tpd.conf<<EOF |
| ; This is a minimal sample xl2tpd configuration file for use |
| ; The idea is to provide an L2TP daemon to which remote Windows L2TP/IPsec |
| ; clients connect. In this example, the internal (protected) network |
| ; is 192.168.1.0/24. A special IP range within this network is reserved |
| ; for the remote clients: 192.168.1.128/25 |
| ; (i.e. 192.168.1.128 … 192.168.1.254) |
| ; The listen-addr parameter can be used if you want to bind the L2TP daemon |
| ; to a specific IP address instead of to all interfaces. For instance, |
| ; you could bind it to the interface of the internal LAN (e.g. 192.168.1.98 |
| ; in the example below). Yet another IP address (local ip, e.g. 192.168.1.99) |
| ; will be used by xl2tpd as its address on pppX interfaces. |
| auth file = /etc/ppp/chap-secrets |
| ip range = $iprange.10-$iprange.199 |
| require authentication = yes |
| pppoptfile = /etc/ppp/options.xl2tpd |
| rm -f /etc/ppp/options.pptpd |
| cat >>/etc/ppp/options.pptpd<<EOF |
| # BSD licensed ppp-2.4.2 upstream with MPPE only, kernel module ppp_mppe.o |
| # Require the peer to authenticate itself using MS-CHAPv2 [Microsoft |
| # Challenge Handshake Authentication Protocol, Version 2] authentication. |
| # Require MPPE 128-bit encryption |
| # (note that MPPE requires the use of MSCHAP-V2 during authentication) |
| # OpenSSL licensed ppp-2.4.1 fork with MPPE only, kernel module mppe.o |
| # Require the peer to authenticate itself using MS-CHAPv2 [Microsoft |
| # Challenge Handshake Authentication Protocol, Version 2] authentication. |
| # Require MPPE encryption |
| # (note that MPPE requires the use of MSCHAP-V2 during authentication) |
| #mppe-40 # enable either 40-bit or 128-bit, not both |
| rm -f /etc/ppp/options.xl2tpd |
| cat >>/etc/ppp/options.xl2tpd<<EOF |
| # To allow authentication against a Windows domain EXAMPLE, and require the |
| # user to be in a group “VPN Users”. Requires the samba-winbind package |
| # ntlm_auth-helper ‘/usr/bin/ntlm_auth –helper-protocol=ntlm-server-1 –require-membership-of=”EXAMPLEVPN Users”‘ |
| # You need to join the domain on the server, for example using samba: |
| # http://rootmanager.com/ubuntu-ipsec-l2tp-windows-domain-auth/setting-up-openswan-xl2tpd-with-native-windows-clients-lucid.html |
| #创建chap-secrets配置文件，即用户列表及密码 |
| rm -f /etc/ppp/chap-secrets |
| cat >>/etc/ppp/chap-secrets<<EOF |
| # Secrets for authentication using CHAP |
| # client server secret IP addresses |
| $username pptpd $password * |
| $username l2tpd $password * |
| sysctl -w net.ipv4.ip_forward=1 |
| sysctl -w net.ipv4.conf.all.rp_filter=0 |
| sysctl -w net.ipv4.conf.default.rp_filter=0 |
| sysctl -w net.ipv4.conf.$eth.rp_filter=0 |
| sysctl -w net.ipv4.conf.all.send_redirects=0 |
| sysctl -w net.ipv4.conf.default.send_redirects=0 |
| sysctl -w net.ipv4.conf.all.accept_redirects=0 |
| sysctl -w net.ipv4.conf.default.accept_redirects=0 |
| cat >>/etc/sysctl.conf<<EOF |
| net.ipv4.conf.all.rp_filter = 0 |
| net.ipv4.conf.default.rp_filter = 0 |
| net.ipv4.conf.$eth.rp_filter = 0 |
| net.ipv4.conf.all.send_redirects = 0 |
| net.ipv4.conf.default.send_redirects = 0 |
| net.ipv4.conf.all.accept_redirects = 0 |
| net.ipv4.conf.default.accept_redirects = 0 |
| cat >>/usr/lib/firewalld/services/pptpd.xml<<EOF |
| <?xml version=”1.0″ encoding=”utf-8″?> |
| <description>PPTP and Fuck the GFW</description> |
| <port protocol=”tcp” port=”1723″/> |
| cat >>/usr/lib/firewalld/services/l2tpd.xml<<EOF |
| <?xml version=”1.0″ encoding=”utf-8″?> |
| <description>L2TP IPSec</description> |
| <port protocol=”udp” port=”500″/> |
| <port protocol=”udp” port=”4500″/> |
| <port protocol=”udp” port=”1701″/> |
| firewall-cmd –permanent –add-service=pptpd |
| firewall-cmd –permanent –add-service=l2tpd |
| firewall-cmd –permanent –add-service=ipsec |
| firewall-cmd –permanent –add-masquerade |
| firewall-cmd –permanent –direct –add-rule ipv4 filter FORWARD 0 -p tcp -i ppp+ -j TCPMSS –syn –set-mss 1356 |
| #iptables –table nat –append POSTROUTING –jump MASQUERADE |
| #iptables -t nat -A POSTROUTING -s $iprange.0/24 -o $eth -j MASQUERADE |
| #iptables -t nat -A POSTROUTING -s $iprange.0/24 -j SNAT –to-source $serverip |
| #iptables -I FORWARD -p tcp –syn -i ppp+ -j TCPMSS –set-mss 1356 |
| systemctl enable pptpd ipsec xl2tpd |
| systemctl restart pptpd ipsec xl2tpd |
| ############################################################# |
| # This is a PPTP and L2TP VPN installation for CentOS 7 # |
| # Version: 1.1.1 20160507 # |
| # Website: http://www.ccwebsite.com # |
| ############################################################# |
| if there are no [FAILED] above, then you can |
| connect to your L2TP VPN Server with the default |
PSK: $mypsk
