diff --git a/conf/hook_post-iptable-rules b/conf/hook_post-iptable-rules new file mode 100644 index 0000000..fec36ed --- /dev/null +++ b/conf/hook_post-iptable-rules @@ -0,0 +1,58 @@ +#!/bin/bash + +host6=$(dig AAAA +short | tail -n1) +host4=$(dig A +short | tail -n1) + +# IPv6 + +sudo ip6tables -N vpnclient_in +sudo ip6tables -N vpnclient_out +sudo ip6tables -N vpnclient_fwd + +sudo ip6tables -A vpnclient_in -p icmpv6 -j ACCEPT +sudo ip6tables -A vpnclient_in -s fd00::/8,fe80::/10 -j ACCEPT +sudo ip6tables -A vpnclient_in -p tcp --dport 22 -j ACCEPT +sudo ip6tables -A vpnclient_in -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +sudo ip6tables -A vpnclient_in -j DROP + +if [ ! -z "${host6}" ]; then + sudo ip6tables -A vpnclient_out -d ${host6} -p --dport -j ACCEPT +fi + +sudo ip6tables -A vpnclient_out -d fd00::/8,fe80::/10 -j ACCEPT +sudo ip6tables -A vpnclient_out -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +sudo ip6tables -A vpnclient_out -j DROP + +sudo ip6tables -A vpnclient_fwd -j DROP + +sudo ip6tables -I INPUT 1 -i -j vpnclient_in +sudo ip6tables -I OUTPUT 1 -o -j vpnclient_out +sudo ip6tables -I FORWARD 1 -o -j vpnclient_fwd + +# IPv4 + +sudo iptables -N vpnclient_in +sudo iptables -N vpnclient_out +sudo iptables -N vpnclient_fwd + +sudo iptables -A vpnclient_in -p icmp -j ACCEPT +sudo iptables -A vpnclient_in -s 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16 -j ACCEPT +sudo iptables -A vpnclient_in -p tcp --dport 22 -j ACCEPT +sudo iptables -A vpnclient_in -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +sudo iptables -A vpnclient_in -j DROP + +if [ ! -z "${host4}" ]; then + sudo iptables -A vpnclient_out -d ${host4} -p --dport -j ACCEPT +fi + +sudo iptables -A vpnclient_out -d 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16 -j ACCEPT +sudo iptables -A vpnclient_out -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +sudo iptables -A vpnclient_out -j DROP + +sudo iptables -A vpnclient_fwd -j DROP + +sudo iptables -I INPUT 1 -i -j vpnclient_in +sudo iptables -I OUTPUT 1 -o -j vpnclient_out +sudo iptables -I FORWARD 1 -o -j vpnclient_fwd + +exit 0 diff --git a/conf/ynh-vpnclient b/conf/ynh-vpnclient index f7debf7..af9ed3f 100644 --- a/conf/ynh-vpnclient +++ b/conf/ynh-vpnclient @@ -38,6 +38,13 @@ is_hotspot_knowme() { [ "${hotspot_vpnclient}" == yes ] } +is_firewall_set() { + wired_device=${1} + + ip6tables -nvL OUTPUT | grep vpnclient_out | grep -q "${wired_device}"\ + && iptables -nvL OUTPUT | grep vpnclient_out | grep -q "${wired_device}" +} + is_ip6addr_set() { ip address show dev tun0 2> /dev/null | grep -q "${ynh_ip6_addr}/128" } @@ -59,7 +66,7 @@ is_openvpn_running() { is_running() { ((has_nativeip6 && is_serverip6route_set "${new_server_ip6}") || ! has_nativeip6)\ && ((! has_hotspot_app && has_ip6delegatedprefix && is_ip6addr_set) || has_hotspot_app || ! has_ip6delegatedprefix)\ - && is_openvpn_running + && is_firewall_set && is_openvpn_running } ## Setters @@ -68,6 +75,19 @@ set_ip6addr() { ip address add "${ynh_ip6_addr}/128" dev tun0 } +set_firewall() { + wired_device=${1} + + cp /etc/yunohost/hooks.d/{90-vpnclient.tpl,post_iptable_rules/90-vpnclient} + + sed "s||${ynh_server_name}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient + sed "s||${ynh_server_port}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient + sed "s||${ynh_server_proto}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient + sed "s||${wired_device}|g" -i /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient + + yunohost firewall reload +} + set_serverip6route() { server_ip6=${1} ip6_gw=${2} @@ -121,6 +141,11 @@ unset_ip6addr() { ip address delete "${ynh_ip6_addr}/128" dev tun0 } +unset_firewall() { + rm -f /etc/yunohost/hooks.d/post_iptable_rules/90-vpnclient + yunohost firewall reload +} + unset_serverip6route() { server_ip6=${1} ip6_gw=${2} @@ -255,6 +280,12 @@ case "${1}" in set_ip6addr fi + # Set ipv6/ipv4 firewall + if ! is_firewall_set "${new_wired_device}"; then + echo "Set IPv6/IPv4 firewall" + set_firewall "${new_wired_device}" + fi + # Update dynamic settings ynh_setting_set vpnclient server_ip6 "${new_server_ip6}" ynh_setting_set vpnclient ip6_gw "${new_ip6_gw}" @@ -280,6 +311,11 @@ case "${1}" in unset_serverip6route "${old_server_ip6}" "${old_ip6_gw}" "${old_wired_device}" fi + if is_firewall_set "${old_wired_device}"; then + echo "Unset IPv6/IPv4 firewall" + unset_firewall + fi + if is_openvpn_running; then echo "Stop openvpn" stop_openvpn @@ -347,6 +383,12 @@ case "${1}" in echo "[INFO] No IPv6 server route to set" fi + if is_firewall_set "${new_wired_device}"; then + echo "[OK] IPv6/IPv4 firewall set" + else + echo "[ERR] No IPv6/IPv4 firewall set" + fi + if is_openvpn_running; then echo "[OK] Openvpn is running" else @@ -357,7 +399,7 @@ case "${1}" in exit ${exitcode} ;; *) - echo "Usage: $0 {start|stop|litestop|restart|status}" + echo "Usage: $0 {start|stop|restart|status}" exit 1 ;; esac diff --git a/scripts/install b/scripts/install index 971a852..5e2b395 100644 --- a/scripts/install +++ b/scripts/install @@ -26,6 +26,8 @@ url_path=${2} server_name=${3} if ! $upgrade; then + + source ./prerequisites # Check arguments if [ -z "${server_name}" ]; then @@ -42,7 +44,7 @@ if ! $upgrade; then fi # Install packages -packages='php5-fpm sipcalc openvpn' +packages='php5-fpm sipcalc dnsutils openvpn' export DEBIAN_FRONTEND=noninteractive sudo apt-get --assume-yes --force-yes install ${packages} @@ -78,11 +80,13 @@ sudo install -o root -g root -m 0755 ../conf/ipv6_compressed /usr/local/bin/ sudo mkdir -pm 0755 /var/log/nginx/ sudo chown root:admins /etc/openvpn/ sudo chmod 775 /etc/openvpn/ +sudo mkdir -pm 0755 /etc/yunohost/hooks.d/post_iptable_rules/ sudo install -b -o root -g admins -m 0664 ../conf/openvpn_client.conf.tpl /etc/openvpn/client.conf.tpl sudo install -o root -g root -m 0644 ../conf/openvpn_client.conf.tpl /etc/openvpn/client.conf.tpl.restore sudo install -b -o root -g root -m 0644 ../conf/nginx_vpnadmin.conf "/etc/nginx/conf.d/${domain}.d/vpnadmin.conf" sudo install -b -o root -g root -m 0644 ../conf/phpfpm_vpnadmin.conf /etc/php5/fpm/pool.d/vpnadmin.conf +sudo install -b -o root -g root -m 0755 ../conf/hook_post-iptable-rules /etc/yunohost/hooks.d/90-vpnclient.tpl # Copy web sources sudo mkdir -pm 0755 /var/www/vpnadmin/ diff --git a/scripts/prerequisites b/scripts/prerequisites new file mode 100644 index 0000000..3239391 --- /dev/null +++ b/scripts/prerequisites @@ -0,0 +1,9 @@ +# Source me + +# Check Moulinette version (firewall hook) +ynh_moulinette_version=$(sudo dpkg -l moulinette-yunohost | grep ii | awk '{ print $3 }' | sed 's/\.//g') + +if [ "${ynh_moulinette_version}" -lt 240 ]; then + echo "ERROR: You need a YunoHost-Moulinette version equals or greater than 2.4.0" >&2 + exit 1 +fi diff --git a/scripts/remove b/scripts/remove index a912384..3dbb9a2 100644 --- a/scripts/remove +++ b/scripts/remove @@ -31,6 +31,7 @@ sudo rm -f /tmp/.ynh-vpnclient-* sudo rm -f /etc/openvpn/client.conf{.tpl,.tpl.restore,} sudo rm -f /etc/nginx/conf.d/${domain}.d/vpnadmin.conf sudo rm -f /etc/php5/fpm/pool.d/vpnadmin.conf +sudo rm -f /etc/yunohost/hooks.d/90-vpnclient.tpl # Remove certificates sudo rm -rf /etc/openvpn/keys/ diff --git a/scripts/upgrade b/scripts/upgrade index 5b19d8c..09903fa 100644 --- a/scripts/upgrade +++ b/scripts/upgrade @@ -7,6 +7,8 @@ ynh_setting() { sudo grep "^${setting}:" "/etc/yunohost/apps/${app}/settings.yml" | sed s/^[^:]\\+:\\s*[\"\']\\?// | sed s/\\s*[\"\']\$// } +source ./prerequisites + domain=$(ynh_setting vpnclient domain) path=$(ynh_setting vpnclient path) server_name=$(ynh_setting vpnclient server_name)