Karugtong tungkol sa kung paano ko nagawang ayusin ang isang direktang VPN tunnel sa pagitan ng dalawang computer na matatagpuan sa likod ng mga provider ng NAT. Inilarawan ng nakaraang artikulo ang proseso ng pag-aayos ng isang koneksyon sa tulong ng isang third party - isang tagapamagitan (isang inuupahang VPS na kumikilos bilang isang bagay tulad ng isang STUN server at isang node data transmitter para sa koneksyon). Sa artikulong ito sasabihin ko sa iyo kung paano ako nakayanan nang walang VPS, ngunit nanatili ang mga tagapamagitan at sila ang STUN server at Yandex.Disk...
Pagpapakilala
Matapos basahin ang mga komento ng nakaraang post, napagtanto ko na ang pangunahing disbentaha ng pagpapatupad ay ang paggamit ng isang tagapamagitan - isang third party (VPS) na nagpapahiwatig ng kasalukuyang mga parameter ng node, kung saan at kung paano kumonekta. Isinasaalang-alang ang mga rekomendasyon para gamitin itong STUN () upang matukoy ang kasalukuyang mga parameter ng koneksyon. Una sa lahat, nagpasya akong gumamit ng TCPDump upang tingnan ang mga nilalaman ng mga packet kapag ang STUN server ay nagtatrabaho sa mga kliyente at nakatanggap ng ganap na hindi nababasang nilalaman. Nag-googling sa protocol na nadatnan ko . Napagtanto ko na hindi ko maaaring ipatupad ang isang kahilingan sa STUN server sa aking sarili at ilagay ang ideya sa isang "malayong kahon".
Π’Π΅ΠΎΡΠΈΡ
Kamakailan ay kinailangan kong mag-install ng STUN server sa Debian mula sa package
# apt install stun-serverat sa mga dependency nakita ko ang stun-client package, ngunit kahit papaano ay hindi ko ito pinansin. Ngunit kalaunan ay naalala ko ang tungkol sa stun-client package at nagpasyang malaman kung paano ito gumagana, pagkatapos mag-googling at maghanap sa Yandex nakuha ko:
# apt install stun-client
# stun stun.ekiga.net -p 21234 -v
Bilang tugon natanggap ko:
bersyon ng STUN client 0.97
Binuksan ang port 21234 na may fd 3
Binuksan ang port 21235 na may fd 4
Encoding stun message:
Encoding ChangeRequest: 0Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 4Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 2Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Nakatanggap ng stun message: 92 bytes
MappedAddress = <My IP>:2885
SourceAddress = 216.93.246.18:3478
ChangedAddress = 216.93.246.17:3479
Hindi kilalang katangian: 32800
ServerName = Vovida.org 0.98-CPC
Nakatanggap ng mensahe ng uri 257 id=1
Encoding stun message:
Encoding ChangeRequest: 0Magpapadala na ng msg ni len 28 sa 216.93.246.17:3478
Encoding stun message:
Encoding ChangeRequest: 4Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 2Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 0Malapit nang magpadala ng msg ni len 28 sa <My IP>:2885
Nakatanggap ng stun message: 28 bytes
ChangeRequest = 0
Nakatanggap ng mensahe ng uri 1 id=11
Encoding stun message:
Encoding ChangeRequest: 0Magpapadala na ng msg ni len 28 sa 216.93.246.17:3478
Encoding stun message:
Encoding ChangeRequest: 4Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 2Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Nakatanggap ng stun message: 92 bytes
MappedAddress = <My IP>:2885
SourceAddress = 216.93.246.17:3479
ChangedAddress = 216.93.246.18:3478
Hindi kilalang katangian: 32800
ServerName = Vovida.org 0.98-CPC
Nakatanggap ng mensahe ng uri 257 id=10
Encoding stun message:
Encoding ChangeRequest: 4Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 2Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 4Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 2Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 4Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 2Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 4Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 2Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 4Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
Encoding stun message:
Encoding ChangeRequest: 2Magpapadala na ng msg ni len 28 sa 216.93.246.18:3478
pagsubok I = 1
pagsubok II = 0
pagsubok III = 0
pagsubok I(2) = 1
ay nat = 1
nakamapang IP pareho = 1
hairpin = 1
preserve port = 0
Pangunahin: Independent Mapping, Port Dependent Filter, random port, will hairpin
Ang return value ay 0x000006
String na may halaga
MappedAddress = <My IP>:2885
basta ang kailangan mo! Ipinakita nito ang kasalukuyang katayuan para sa koneksyon sa lokal na UDP port 21234. Ngunit ito ay kalahati lamang ng labanan, ang tanong ay lumitaw kung paano ilipat ang data na ito sa malayong host at ayusin ang isang koneksyon sa VPN. Gamit ang mail protocol, o baka Telegram?! Maraming mga pagpipilian at nagpasya akong gamitin ang Yandex.disk, dahil napunta ako . Matapos isipin ang tungkol sa pagpapatupad, naisip ko ang sumusunod na pamamaraan:
- Ipahiwatig na ang mga node ay handa nang magtatag ng isang koneksyon sa pamamagitan ng pagkakaroon ng isang partikular na file na may timestamp sa Yandex.disk;
- Kung handa na ang mga node, pagkatapos ay tumanggap ng kasalukuyang mga parameter mula sa server ng STUN;
- Mag-upload ng mga kasalukuyang setting sa Yandex.disk;
- Suriin ang presensya at basahin ang mga parameter ng isang malayong node mula sa isang file sa Yandex.disk;
- Pagtatatag ng koneksyon sa isang malayuang host gamit ang OpenVPN.
Pagsasanay
Matapos mag-isip ng kaunti, isinasaalang-alang ang karanasan ng huling artikulo, mabilis akong nagsulat ng isang script. Kakailanganin namin ang:
# apt install openvpn stun-client curl Ang script mismo:
orihinal na bersyon
# cat vpn8.sh#!/bin/bash
######################## ΠΠ°Π΄Π°Π΅ΠΌ ΡΠ²Π΅ΡΠ½ΠΎΠΉ ΡΠ΅ΠΊΡΡ ###
WARN='33[37;1;41m' #
END='33[0m' #
RED='33[0;31m' # ${RED} #
GREEN='33[0;32m' # ${GREEN} #
#################################################
####################### ΠΡΠΎΠ²Π΅ΡΡΠ΅ΠΌ Π½Π°Π»ΠΈΡΠΈΠ΅ Π½Π΅ΠΎΠ±Ρ
ΠΎΠ΄ΡΠΌΠΈΡ
ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΠΉ #########################################################
al="echo readlink dirname grep awk md5sum shuf nc curl sleep openvpn cat stun"
ch=0
for i in $al; do which $i > /dev/null || echo -e "${WARN}ΠΠ»Ρ ΡΠ°Π±ΠΎΡΡ Π½Π΅ΠΎΠ±Ρ
ΠΎΠ΄ΠΈΠΌ $i ${END}"; which $i > /dev/null || ch=1; done
if (( $ch > 0 )); then echo -e "${WARN}ΠΠΉ, ΠΎΡΡΡΡΡΡΠ²ΡΡΡ Π½Π΅ΠΎΠ±Ρ
ΠΎΠ΄ΠΈΠΌΡΠ΅ Π΄Π»Ρ ΠΊΠΎΡΡΠ΅ΠΊΡΠ½ΠΎΠΉ ΡΠ°Π±ΠΎΡΡ ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΡ${END}"; exit; fi
#######################################################################################################################
if [[ $1 == '' ]]; then echo -e "${WARN}ΠΠ²Π΅Π΄ΠΈΡΠ΅ ΠΈΠ΄Π΅Π½ΡΠΈΡΠΈΠΊΠ°ΡΠΎΡ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΡ (Π»ΡΠ±ΠΎΠ΅ ΡΠ½ΠΈΠΊΠ°Π»ΡΠ½ΠΎΠ΅ ΡΠ»ΠΎΠ²ΠΎ, Π΄ΠΎΠ»ΠΆΠ½ΠΎ Π±ΡΡΡ ΠΎΠ΄ΠΈΠ½Π°ΠΊΠΎΠ²ΠΎΠ΅ Ρ Π΄Π²ΡΡ
ΡΡΠΎΡΠΎΠ½!) ${END} t
${GREEN}ΠΠ»Ρ Π·Π°ΠΏΡΡΠΊΠ° Π² Π°Π²ΡΠΎΠΌΠ°ΡΠΈΡΠ΅ΡΠΊΠΎΠΌ ΡΠ΅ΠΆΠΈΠΌΠ΅ ΠΏΡΠΈ Π²ΠΊΠ»ΡΡΠ΅Π½ΠΈΠΈ ΠΊΠΎΠΌΠΏΡΡΡΠ΅ΡΠ° ΠΌΠΎΠΆΠ½ΠΎ ΠΏΡΠΎΠΏΠΈΡΠ°ΡΡ Π² /etc/rc.local ΡΡΡΠΎΠΊΡ nohup /<ΠΏΡΡΡ ΠΊ ΡΠ°ΠΉΠ»Ρ>/vpn8.sh > /var/log/vpn8.log 2>/dev/hull & ${END}"; exit; fi
ABSOLUTE_FILENAME=`readlink -f "$0"` # ΠΏΠΎΠ»Π½ΡΠΉ ΠΏΡΡΡ Π΄ΠΎ ΡΠΊΡΠΈΠΏΡΠ°
DIR=`dirname "$ABSOLUTE_FILENAME"` # ΠΊΠ°ΡΠ°Π»ΠΎΠ³ Π² ΠΊΠΎΡΠΎΡΠΎΠΌ Π»Π΅ΠΆΠΈΡ ΡΠΊΡΠΈΠΏΡ
############################### ΠΡΠΎΠ²Π΅ΡΠΊΠ° Π½Π°Π»ΠΈΡΠΈΡ ΡΠ΅ΠΊΡΠ΅ΡΠ½ΠΎΠ³ΠΎ ΠΊΠ»ΡΡΠ° ##################################
key="$DIR/secret.key"
if [ ! -f "$key" ]; then
echo -e "${WARN}Π‘Π΅ΠΊΡΠ΅ΡΠ½ΡΠΉ ΠΊΠ»ΡΡ VPN-ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΡ Π½Π΅ Π½Π°ΠΉΠ΄Π΅Π½, Π΄Π»Ρ Π³Π΅Π½Π΅ΡΠ°ΡΠΈΠΈ ΠΊΠ»ΡΡΠ° Π²ΡΠΏΠΎΠ»Π½ΠΈΡΠ΅:
openvpn --genkey --secret secret.key ΠΠ½ΠΈΠΌΠ°Π½ΠΈΠ΅: ΠΊΠ»ΡΡ ΠΈΡΠΏΠΎΠ»ΡΠ·ΡΠ΅ΡΡΡ Π΄Π»Ρ Π°Π²ΡΠΎΡΠΈΠ·Π°ΡΠΈΠΈ ΠΈ Π΄ΠΎΠ»ΠΆΠ΅Π½
Π±ΡΡΡ ΠΎΠ΄ΠΈΠ½Π°ΠΊΠΎΠ²ΡΠΌ Ρ Π΄Π²ΡΡ
ΡΡΠΎΡΠΎΠ½!!!${END}
# ls -l secret.key
-rw------- 1 root root 637 Π½ΠΎΡ 27 11:12 secret.key
# chmod 600 secret.key";
exit;
fi
########################################################################################################################
ABSOLUTE_FILENAME=`readlink -f "$0"` # ΠΏΠΎΠ»Π½ΡΠΉ ΠΏΡΡΡ Π΄ΠΎ ΡΠΊΡΠΈΠΏΡΠ°
DIR=`dirname "$ABSOLUTE_FILENAME"` # ΠΊΠ°ΡΠ°Π»ΠΎΠ³ Π² ΠΊΠΎΡΠΎΡΠΎΠΌ Π»Π΅ΠΆΠΈΡ ΡΠΊΡΠΈΠΏΡ
name=$(uname -n | md5sum | awk '{print $1}')
vpn=$(echo $1 | md5sum | awk '{print $1}')
stun="stun.ekiga.net" # STUN ΡΠ΅ΡΠ²Π΅Ρ
username="Yandex" # ΠΠΎΠ³ΠΈΠ½ ΠΎΡ Π―Π½Π΄Π΅ΠΊΡ.Π΄ΠΈΡΠΊΠ°
password="Password" # ΠΠ°ΡΠΎΠ»Ρ ΠΎΡ Π―Π½Π΄Π΅ΠΊΡ.Π΄ΠΈΡΠΊΠ°
localport=`shuf -i 20000-65000 -n 1` # Π³Π΅Π½Π΅ΡΠ°ΡΠΈΡ Π»ΠΎΠΊΠ°Π»ΡΠ½ΠΎΠ³ΠΎ ΠΏΠΎΡΡΠ°
echo "$(date) Π‘ΠΎΠ·Π΄Π°Ρ ΠΏΠ°ΠΏΠΊΡ Π½Π° Π―Π½Π΄Π΅ΠΊΡ.Π΄ΠΈΡΠΊΠ΅"
curl -X MKCOL --user "${username}:${password}" https://webdav.yandex.ru/vpn-$vpn
echo "$(date) ΠΡΠΈΡΠ°Ρ ΠΏΠ°ΠΏΠΊΡ ΠΎΡ Π²ΡΡΠΊΠΎΠ³ΠΎ ΠΌΡΡΠΎΡΠ°"
for i in `curl --silent --user "$username:$password" -X PROPFIND -H "Depth: 1" https://webdav.yandex.ru/vpn-$vpn/ | sed 's/></n/g' | grep "d:displayname" | sed 's/d:displayname//g' | sed 's/>//g' | sed 's/<//' | sed 's////g' | grep -v $(date +%Y-%m-%d-%H-%M)`; do
echo "$(date) Delete: $i"
curl -X DELETE --user "${username}:${password}" https://webdav.yandex.ru/vpn-$vpn/$i
done
until [ $c ];do
until [[ $b ]]; do
echo "$(date) ΠΡΠΎΠ²Π΅ΡΡΡ ΠΏΠ°ΠΏΠΊΡ"
date=`date +%Y-%m-%d-%H-%M`
mydata=`curl --silent --user "${username}:${password}" -X PROPFIND -H "Depth: 1" https://webdav.yandex.ru/vpn-$vpn/ | sed 's/></>n</g' | grep $name | grep $date | grep "d:displayname"`
if [[ -z $mydata ]]; then
echo "$(date) Π€Π°ΠΉΠ» Π³ΠΎΡΠΎΠ²Π½ΠΎΡΡΠΈ ΡΠΎΠ·Π΄Π°Π½"
echo "$date" > "/tmp/$date-$name-ready.txt"
curl -T "/tmp/$date-$name-ready.txt" --user "$username:$password" https://webdav.yandex.ru/vpn-$vpn/$date-$name-ready.txt
else
echo "$(date) Π€Π°ΠΉΠ» Π³ΠΎΡΠΎΠ²Π½ΠΎΡΡΠΈ ΡΠΆΠ΅ ΡΡΡΠ΅ΡΡΠ²ΡΠ΅Ρ - $date"
fi
remote=`curl --silent --user "${username}:${password}" -X PROPFIND -H "Depth: 1" https://webdav.yandex.ru/vpn-$vpn/ | sed 's/></>n</g' | grep -v $name | grep $date | grep "d:displayname"`
if [[ -z $remote ]]; then
echo -e "$(date) ${RED} Π£Π΄Π°Π»Π΅Π½Π½ΡΠΉ ΡΠ·Π΅Π» Π½Π΅ Π³ΠΎΡΠΎΠ² ${END}"
echo "$(date) ΠΠ΄Ρ"
sleep 20
else
echo -e "$(date) ${GREEN} Π£Π΄Π°Π»Π΅Π½Π½ΡΠΉ ΡΠ·Π΅Π» Π³ΠΎΡΠΎΠ² ${END}"
b=1
a=''
fi
done
until [ $a ]; do
echo "$(date) ΠΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΠ΅ ΠΈ ΠΏΠΎΠ»ΡΡΠ΅Π½ΠΈΠ΅ Π΄Π°Π½Π½ΡΡ
ΠΎΡ STUN ΡΠ΅ΡΠ²Π΅ΡΠ°: $stun"
mydata=`stun $stun -p $localport -v 2>&1 | grep MappedAddress | sort | uniq`
echo -e "$(date) ${GREEN}ΠΠΎΠΈ Π΄Π°Π½Π½ΡΠ΅ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΡ: $mydata${END}"
echo "$mydata" > "$DIR/mydata"
echo "$(date) ΠΠ°Π³ΡΡΠ·ΠΊΠ° Π΄Π°Π½Π½ΡΡ
Π½Π° Π―Π½Π΄Π΅ΠΊΡ.Π΄ΠΈΡΠΊ"
curl -T "$DIR/mydata" --user "$username:$password" https://webdav.yandex.ru/vpn-$vpn/$name.txt
echo "$(date) ΠΠΎΠ»ΡΡΠ΅Π½ΠΈΠ΅ ΡΠ°ΠΉΠ»Π° Π΄Π°Π½Π½ΡΡ
ΡΠ΄Π°Π»Π΅Π½Π½ΠΎΠ³ΠΎ ΡΠ·Π»Π°"
filename=$(curl --silent --user "${username}:${password}" -X PROPFIND -H "Depth: 1" https://webdav.yandex.ru/vpn-$vpn/ | sed 's/></n/g' | grep "d:displayname>" | grep "txt" | grep -v "$name" | grep -v "ready" | sed 's|.*d:displayname>||' | sed 's/</ /g' | awk '{print $1}')
echo "$(date) Π§ΡΠ΅Π½ΠΈΠ΅ ΡΠ°ΠΉΠ»Π° Π΄Π°Π½Π½ΡΡ
ΡΠ΄Π°Π»Π΅Π½Π½ΠΎΠ³ΠΎ ΡΠ·Π»Π°: $filename"
address=$(curl --silent --user "$username:$password" https://webdav.yandex.ru/vpn-$vpn/$filename | sort | uniq | head -n1 | sed 's/:/ /g')
echo "$(date) ΠΠΏΡΠ΅Π΄Π΅Π»Π΅Π½ΠΈΠ΅ IP-Π°Π΄ΡΠ΅ΡΠ° ΠΈ ΠΏΠΎΡΡΠ°"
ip=$(echo "$address" | awk '{print $3}')
port=$(echo "$address" | awk '{print $4}')
if [[ -n "$ip" && -n "$port" ]]; then
echo -e "$(date) ${GREEN} Π‘ΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΠ΅ $ip $port ${END}"
openvpn --remote $ip --rport $port --lport $localport
--proto udp --dev tap --float --auth-nocache --verb 3 --mute 20
--ifconfig 10.45.54.2 255.255.255.252
--secret "$DIR/secret.key"
--auth SHA256 --cipher AES-256-CBC
--ncp-disable --ping 10 --ping-exit 30
--comp-lzo yes
echo -e "$(date) ${WARN} Π‘ΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΠ΅ ΡΠ°Π·ΠΎΡΠ²Π°Π½ΠΎ${END}"
a=1
b=''
else
a=1
b=''
fi
done
donePara gumana ang script kailangan mo:
- Kopyahin sa clipboard at i-paste sa editor, halimbawa:
# nano vpn8.sh - tukuyin ang username at password para sa Yandex.disk.
- sa field na "βifconfig 10.45.54.(1 o 2) 255.255.255.252" tukuyin ang panloob na IP address ng interface
- lumikha lihim.susi sa pamamagitan ng utos:
# openvpn --genkey --secret secret.key - gawing executable ang script:
# chmod +x vpn8.sh - patakbuhin ang script:
# ./vpn8.sh nZbVGBuX5dtturDkung saan ang nZbVGBuX5dtturD ay ang nabuong connection ID
Sa remote node, gawin ang lahat ng pareho maliban sa pagbuo ng secret.key at connection ID, dapat magkapareho ang mga ito.
Na-update na bersyon (dapat i-synchronize ang oras para sa tamang operasyon):
cat vpn10.sh#!/bin/bash
stuns="stun.sipnet.ru stun.ekiga.net" # Π‘ΠΏΠΈΡΠΎΠΊ STUN ΡΠ΅ΡΠ²Π΅ΡΠΎΠ² ΡΠ΅ΡΠ΅Π· ΠΏΡΠΎΠ±Π΅Π»
username=" Login " # ΠΠΎΠ³ΠΈΠ½ ΠΎΡ Π―Π½Π΄Π΅ΠΊΡ.Π΄ΠΈΡΠΊΠ°
password=" Password " # ΠΠ°ΡΠΎΠ»Ρ ΠΎΡ Π―Π½Π΄Π΅ΠΊΡ.Π΄ΠΈΡΠΊΠ°
intip="10.23.22.1" # IP-Π°Π΄ΡΠ΅Ρ Π²Π½ΡΡΡΠ΅Π½Π½Π΅Π³ΠΎ ΠΈΠ½ΡΠ΅ΡΡΠ΅ΠΉΡΠ°
WARN='33[37;1;41m'
END='33[0m'
RED='33[0;31m'
GREEN='33[0;32m'
al="ip echo readlink dirname grep awk md5sum openssl sha256sum shuf curl sleep openvpn cat stun"
ch=0
for i in $al; do which $i > /dev/null || echo -e "${WARN}ΠΠ»Ρ ΡΠ°Π±ΠΎΡΡ Π½Π΅ΠΎΠ±Ρ
ΠΎΠ΄ΠΈΠΌ $i ${END}"; which $i > /dev/null || ch=1; done
if (( $ch > 0 )); then echo -e "${WARN}ΠΠΉ, ΠΎΡΡΡΡΡΡΠ²ΡΡΡ Π½Π΅ΠΎΠ±Ρ
ΠΎΠ΄ΠΈΠΌΡΠ΅ Π΄Π»Ρ ΠΊΠΎΡΡΠ΅ΠΊΡΠ½ΠΎΠΉ ΡΠ°Π±ΠΎΡΡ ΠΏΡΠΈΠ»ΠΎΠΆΠ΅Π½ΠΈΡ${END}"; exit; fi
if [[ $1 == '' ]];
then
echo -e "${WARN}ΠΠ²Π΅Π΄ΠΈΡΠ΅ ΠΈΠ΄Π΅Π½ΡΠΈΡΠΈΠΊΠ°ΡΠΎΡ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΡ (Π»ΡΠ±ΠΎΠ΅ ΡΠ½ΠΈΠΊΠ°Π»ΡΠ½ΠΎΠ΅ ΡΠ»ΠΎΠ²ΠΎ, Π΄ΠΎΠ»ΠΆΠ½ΠΎ Π±ΡΡΡ ΠΎΠ΄ΠΈΠ½Π°ΠΊΠΎΠ²ΠΎΠ΅ Ρ Π΄Π²ΡΡ
ΡΡΠΎΡΠΎΠ½!) ${END} t
${GREEN}ΠΠ»Ρ Π·Π°ΠΏΡΡΠΊΠ° Π² Π°Π²ΡΠΎΠΌΠ°ΡΠΈΡΠ΅ΡΠΊΠΎΠΌ ΡΠ΅ΠΆΠΈΠΌΠ΅ ΠΏΡΠΈ Π²ΠΊΠ»ΡΡΠ΅Π½ΠΈΠΈ ΠΊΠΎΠΌΠΏΡΡΡΠ΅ΡΠ° ΠΌΠΎΠΆΠ½ΠΎ ΠΏΡΠΎΠΏΠΈΡΠ°ΡΡ Π² /etc/rc.local ΡΡΡΠΎΠΊΡ nohup /<ΠΏΡΡΡ ΠΊ ΡΠ°ΠΉΠ»Ρ>/vpn10.sh > /var/log/vpn10.log 2>/dev/hull & ${END}"
exit
fi
ABSOLUTE_FILENAME=`readlink -f "$0"` # ΠΏΠΎΠ»Π½ΡΠΉ ΠΏΡΡΡ Π΄ΠΎ ΡΠΊΡΠΈΠΏΡΠ°
DIR=`dirname "$ABSOLUTE_FILENAME"` # ΠΊΠ°ΡΠ°Π»ΠΎΠ³ Π² ΠΊΠΎΡΠΎΡΠΎΠΌ Π»Π΅ΠΆΠΈΡ ΡΠΊΡΠΈΠΏΡ
key="$DIR/secret.key"
until [[ -n "$iftosrv" ]]
do
echo "$(date) ΠΠΏΡΠ΅Π΄Π΅Π»ΡΡ ΡΠ΅ΡΠ΅Π²ΠΎΠΉ ΠΈΠ½ΡΠ΅ΡΡΠ΅ΠΉΡ"; iftosrv=`ip route get 8.8.8.8 | head -n 1 | sed 's|.*dev ||' | awk '{print $1}'`
sleep 5
done
timedatectl
name=$(uname -n | md5sum | awk '{print $1}')
vpn=$(echo $1 | md5sum | awk '{print $1}')
echo "$(date) Π‘ΠΎΠ·Π΄Π°Ρ ΠΏΠ°ΠΏΠΊΡ Π½Π° Π―Π½Π΄Π΅ΠΊΡ.Π΄ΠΈΡΠΊΠ΅"
curl -X MKCOL --user "${username}:${password}" https://webdav.yandex.ru/vpn-$vpn
echo "$(date) ID Π½Π° Π΄ΠΈΡΠΊΠ΅: $vpn"
until [ $c ];do
echo "$(date) ΠΡΠΈΡΠ°Ρ ΠΏΠ°ΠΏΠΊΡ ΠΎΡ Π²ΡΡΠΊΠΎΠ³ΠΎ ΠΌΡΡΠΎΡΠ°"
for i in `curl --silent --user "$username:$password" -X PROPFIND -H "Depth: 1" https://webdav.yandex.ru/vpn-$vpn/ | sed 's/></n/g' | grep "d:displayname" | sed 's/d:displayname//g' | sed 's/>//g' | sed 's/<//' | sed 's////g' | grep -v $(date +%Y-%m-%d-%H-%M)`
do
echo -e "$(date)${RED} Π£Π΄Π°Π»ΡΡ ΡΡΠ°ΡΡΠΉ ΡΠ°ΠΉΠ»: $i${END}"
curl -X DELETE --user "${username}:${password}" https://webdav.yandex.ru/vpn-$vpn/$i
done
echo "$(date) ID Π½Π° Π΄ΠΈΡΠΊΠ΅: $vpn"
openvpn --genkey --secret "$key"
passwd=`echo "$vpn-tt" | sha256sum | awk '{print $1}'`
openssl AES-256-CBC -e -in "$key" -out "$DIR/file.enc" -k "$passwd" -base64
curl -T "$DIR/file.enc" --user "$username:$password" https://webdav.yandex.ru/vpn-$vpn/key.enc
rm "$DIR"/file.enc
echo -e "$(date) ${GREEN}Π€Π°Π·Π° 1 - ΠΠΎΠ»ΡΡΠ΅Π½ΠΈΠ΅ Π³ΠΎΡΠΎΠ²Π½ΠΎΡΡΠΈ ΡΠ΄Π°Π»Π΅Π½Π½ΠΎΠ³ΠΎ ΡΠ·Π»Π°${END}"
go=3
localport=`shuf -i 20000-65000 -n 1` # Π³Π΅Π½Π΅ΡΠ°ΡΠΈΡ Π»ΠΎΠΊΠ°Π»ΡΠ½ΠΎΠ³ΠΎ ΠΏΠΎΡΡΠ°
start=''
remote=''
timeout1=''
nextcheck=''
timestart=''
until [[ $b ]]
do
echo "$(date) ΠΡΠΎΠ²Π΅ΡΡΡ ΠΏΠ°ΠΏΠΊΡ"
date=`date +%s`
timeout1=60
echo "$(date) Π‘ΠΎΠ·Π΄Π°Π½ΠΈΠ΅ ΡΠ°ΠΉΠ»Π° Π³ΠΎΡΠΎΠ²Π½ΠΎΡΡΠΈ $date"
echo "$date" > "/tmp/ready-$date-$name.txt"
curl -T "/tmp/ready-$date-$name.txt" --user "$username:$password" https://webdav.yandex.ru/vpn-$vpn/ready-$name.txt
readyfile=`curl --silent --user "${username}:${password}" -X PROPFIND -H "Depth: 1" https://webdav.yandex.ru/vpn-$vpn/ | sed 's/></>n</g' | grep -v $name | grep "ready" | grep "d:displayname" | sed 's/<d:displayname>//g' | sed 's/</d:displayname>//g'`
if [[ -z $readyfile ]]
then
echo -e "$(date) ${RED} Π£Π΄Π°Π»Π΅Π½Π½ΡΠΉ ΡΠ·Π΅Π» Π½Π΅ Π³ΠΎΡΠΎΠ² ${END}"
echo "$(date) ΠΠ΄Ρ 60 ΡΠ΅ΠΊΡΠ½Π΄"
sleep $timeout1
else
remote=$(curl --silent --user "$username:$password" https://webdav.yandex.ru/vpn-$vpn/$readyfile)
echo -e "$(date) ${GREEN} Π£Π΄Π°Π»Π΅Π½Π½ΡΠΉ ΡΠ·Π΅Π» Π³ΠΎΡΠΎΠ² ${END}"
start=`curl --silent --user "${username}:${password}" -X PROPFIND -H "Depth: 1" https://webdav.yandex.ru/vpn-$vpn/ | sed 's/></>n</g' | grep "start" | grep "d:displayname" | sed 's/-/ /g' | awk '{print $2}'`
if [[ -z $start ]]
then
let nextcheck=$timeout1-$date+$remote
let timestart=$date+$timeout1-$nextcheck
go=$nextcheck
echo "$timestart" > "/tmp/start-$date-$name.txt"
curl -T "/tmp/start-$date-$name.txt" --user "$username:$password" https://webdav.yandex.ru/vpn-$vpn/start-$date-$name.txt
else
echo "$(date) ΠΆΠ΄Ρ $go ΡΠ΅ΠΊΡΠ½Π΄"
sleep $go
b=1
a=''
fi
fi
done
echo -e "$(date) ${GREEN}Π€Π°Π·Π° 2 - ΠΠ±ΠΌΠ΅Π½ Π΄Π°Π½Π½ΡΠΌΠΈ ΠΈ ΡΡΡΠ°Π½ΠΎΠ²ΠΊΠ° ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΡ${END}"
mydata=''
filename=''
address=''
myip=''
ip=''
port=''
ex=0
until [ $a ]; do
until [[ -n "$mydata" ]]; do
k=`echo "$stuns" | wc -w`
x=1
z=`shuf -i 1-$k -n 1`
for st in $stuns; do
if [[ $x == $z ]]; then
stun=$st;
fi;
(( x++ ));
done
echo "$(date) ΠΠΎΠ΄ΠΊΠ»ΡΡΠ΅Π½ΠΈΠ΅ ΠΈ ΠΏΠΎΠ»ΡΡΠ΅Π½ΠΈΠ΅ Π΄Π°Π½Π½ΡΡ
ΠΎΡ STUN ΡΠ΅ΡΠ²Π΅ΡΠ°: $stun"
sleep 5 && for pid in $(ps xa | grep "stun "$stun" 1 -p "$localport" -v" | grep -v grep | awk '{print $1}'); do kill $pid; done &
mydata=`stun "$stun" 1 -p "$localport" -v 2>&1 | grep "MappedAddress" | sort | uniq`
done
echo -e "$(date) ${GREEN}ΠΠΎΠΈ Π΄Π°Π½Π½ΡΠ΅ ΡΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΡ: $mydata${END}"
echo "$(date) ΠΠ°Π³ΡΡΠ·ΠΊΠ° Π΄Π°Π½Π½ΡΡ
Π½Π° Π―Π½Π΄Π΅ΠΊΡ.Π΄ΠΈΡΠΊ"
echo "$mydata" > "$DIR/mydata"
echo "IntIP $intip" >> "$DIR/mydata"
curl -T "$DIR/mydata" --user "$username:$password" https://webdav.yandex.ru/vpn-$vpn/$name-ipport.txt
rm "$DIR/mydata"
sleep 5
echo "$(date) ΠΠΎΠ»ΡΡΠ΅Π½ΠΈΠ΅ ΡΠ°ΠΉΠ»Π° Π΄Π°Π½Π½ΡΡ
ΡΠ΄Π°Π»Π΅Π½Π½ΠΎΠ³ΠΎ ΡΠ·Π»Π°"
filename=$(curl --silent --user "${username}:${password}" -X PROPFIND -H "Depth: 1" https://webdav.yandex.ru/vpn-$vpn/ | sed 's/></n/g' | grep "d:displayname>" | grep "ipport" | grep -v "$name" | sed 's|.*d:displayname>||' | sed 's/</ /g' | awk '{print $1}')
if [[ -n "$filename" ]]
then
echo "$(date) Π§ΡΠ΅Π½ΠΈΠ΅ ΡΠ°ΠΉΠ»Π° Π΄Π°Π½Π½ΡΡ
ΡΠ΄Π°Π»Π΅Π½Π½ΠΎΠ³ΠΎ ΡΠ·Π»Π°: $filename"
address=$(curl --silent --user "$username:$password" https://webdav.yandex.ru/vpn-$vpn/$filename | grep "MappedAddress" | head -n1 | sed 's/:/ /g')
intip2=$(curl --silent --user "$username:$password" https://webdav.yandex.ru/vpn-$vpn/$filename | grep "IntIP" | head -n1 | awk '{print $2}')
echo "$(date) ΠΠΏΡΠ΅Π΄Π΅Π»Π΅Π½ΠΈΠ΅ IP-Π°Π΄ΡΠ΅ΡΠ° ΠΈ ΠΏΠΎΡΡΠ°: $address $sesid2 $tunid2"
ip=$(echo "$address" | awk '{print $3}')
port=$(echo "$address" | awk '{print $4}')
myip=`ip route get "$ip" | head -n 1 | sed 's|.*src ||' | awk '{print $1}'`
if [[ -n "$ip" && -n "$port" && -n "$myip" && -n "$localport" ]];
then
echo -e "$(date) ${GREEN} Π‘ΠΎΠ΅Π΄ΠΈΠ½Π΅Π½ΠΈΠ΅ $ip $port ${END}"
echo -e "`date` ${GREEN} $myip:$localport -> $ip:$port ${END}"
curl --silent --user "$username:$password" https://webdav.yandex.ru/vpn-$vpn/key.enc > "$DIR/secret.enc"
openssl AES-256-CBC -d -in "$DIR/secret.enc" -out "$key" -k "$passwd" -base64
chmod 600 "$key"
rm "$DIR/secret.enc"
openvpn --remote $ip --rport $port --lport $localport
--proto udp --dev tun --float --auth-nocache --verb 3 --mute 20
--ifconfig "$intip" "$intip2"
--secret "$key"
--auth SHA256 --cipher AES-256-CBC
--ncp-disable --ping 10 --ping-exit 20
--comp-lzo yes
a=1
b=''
fi
else
if (( $ex >= 5 ))
then
echo "$(date) Π‘Π±ΡΠΎΡ"
a=1
b=''
fi
(( ex++ ))
sleep 5
fi
done
done
Para gumana ang script kailangan mo:
- Kopyahin sa clipboard at i-paste sa editor, halimbawa:
# nano vpn10.sh - ipahiwatig ang login (2nd line) at password para sa Yandex.disk (3rd line).
- tukuyin ang panloob na IP address ng tunnel (ika-4 na linya).
- gawing executable ang script:
# chmod +x vpn10.sh - patakbuhin ang script:
# ./vpn10.sh nZbVGBuX5dtturDkung saan ang nZbVGBuX5dtturD ay ang nabuong connection ID
Sa remote node, gawin ang parehong, tukuyin ang kaukulang panloob na IP address ng tunnel at connection ID.
Para i-autorun ang script kapag naka-on, ginagamit ko ang command na βnohup /<path to the script>/vpn10.sh nZbVGBuX5dtturD > /var/log/vpn10.log 2>/dev/null &β na nasa file /etc/ rc.lokal
Konklusyon
Gumagana ang script, nasubok sa Ubuntu (18.04, 19.10, 20.04) at Debian 9. Maaari mong gamitin ang anumang iba pang serbisyo bilang transmitter, ngunit para sa karanasan ginamit ko ang Yandex.disk.
Sa panahon ng mga eksperimento, natuklasan na ang ilang mga uri ng NAT provider ay hindi pinapayagan ang pagtatatag ng isang koneksyon. Pangunahin mula sa mga mobile operator kung saan naka-block ang mga torrents.
Plano kong pagbutihin sa mga tuntunin ng:
- Awtomatikong pagbuo ng secret.key sa tuwing magsisimula ka, i-encrypt at kopyahin sa Yandex.disk para ilipat sa isang malayuang node (Isinasaalang-alang sa na-update na bersyon)
- Awtomatikong pagtatalaga ng mga IP address ng mga interface
- Pag-encrypt ng data bago i-upload sa Yandex.disk
- Pag-optimize ng code
Hayaang magkaroon ng IPv6 sa bawat tahanan!
Nai-update! Pinakabagong mga file at DEB package dito -
Pinagmulan: www.habr.com