• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1# params for ipsec.conf
2IPSEC_CONF = {
3    "config setup": {
4        "charondebug": "chd 2,ike 2,knl 2,net 2,esp 2,dmn 2,"
5                       "mgr 2,lib 1,cfg 2,enc 1".__repr__(),
6        "uniqueids": "never"
7    },
8    "conn %default": {
9        "ike": "aes128-sha-modp1024",
10        "esp": "aes128-sha1"
11    }
12}
13
14IPSEC_L2TP_PSK = {
15    "conn L2TP_PSK": {
16        "keyexchange": "ikev1",
17        "type": "transport",
18        "left": "192.168.1.1",
19        "leftprotoport": "17/1701",
20        "leftauth": "psk",
21        "right": "%any",
22        "rightprotoport": "17/%any",
23        "rightsubnet": "0.0.0.0/0",
24        "rightauth": "psk",
25        "auto": "add"
26    }
27}
28
29IPSEC_L2TP_RSA = {
30    "conn L2TP_RSA": {
31        "keyexchange": "ikev1",
32        "type": "transport",
33        "left": "192.168.1.1",
34        "leftprotoport": "17/1701",
35        "leftauth": "pubkey",
36        "leftcert": "serverCert.der",
37        "right": "%any",
38        "rightprotoport": "17/%any",
39        "rightsubnet": "0.0.0.0/0",
40        "rightauth": "pubkey",
41        "auto": "add"
42    }
43}
44
45# parmas for lx2tpd
46
47XL2TPD_CONF_GLOBAL = [
48    "[global]",
49    "ipsec saref = no",
50    "debug tunnel = no",
51    "debug avp = no",
52    "debug network = no",
53    "debug state = no",
54    "access control = no",
55    "rand source = dev",
56    "port = 1701",
57]
58
59XL2TPD_CONF_INS = [
60    "[lns default]",
61    "require authentication = yes",
62    "pass peer = yes",
63    "ppp debug = no",
64    "length bit = yes",
65    "refuse pap = yes",
66    "refuse chap = yes",
67]
68
69XL2TPD_OPTION = [
70    "require-mschap-v2",
71    "refuse-mschap",
72    "ms-dns 8.8.8.8",
73    "ms-dns 8.8.4.4",
74    "asyncmap 0",
75    "auth",
76    "crtscts",
77    "idle 1800",
78    "mtu 1410",
79    "mru 1410",
80    "connect-delay 5000",
81    "lock",
82    "hide-password",
83    "local",
84    "debug",
85    "modem",
86    "proxyarp",
87    "lcp-echo-interval 30",
88    "lcp-echo-failure 4",
89    "nomppe"
90]
91
92# iptable rules for vpn_pptp
93FIREWALL_RULES_FOR_PPTP = [
94    "iptables -A input_rule -i ppp+ -j ACCEPT",
95    "iptables -A output_rule -o ppp+ -j ACCEPT",
96    "iptables -A forwarding_rule -i ppp+ -j ACCEPT"
97]
98
99# iptable rules for vpn_l2tp
100FIREWALL_RULES_FOR_L2TP = [
101    "iptables -I INPUT  -m policy --dir in --pol ipsec --proto esp -j ACCEPT",
102    "iptables -I FORWARD  -m policy --dir in --pol ipsec --proto esp -j ACCEPT",
103    "iptables -I FORWARD  -m policy --dir out --pol ipsec --proto esp -j ACCEPT",
104    "iptables -I OUTPUT   -m policy --dir out --pol ipsec --proto esp -j ACCEPT",
105    "iptables -t nat -I POSTROUTING -m policy --pol ipsec --dir out -j ACCEPT",
106    "iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT",
107    "iptables -A INPUT -p esp -j ACCEPT",
108    "iptables -A INPUT -i eth0.2 -p udp --dport 500 -j ACCEPT",
109    "iptables -A INPUT -i eth0.2 -p tcp --dport 500 -j ACCEPT",
110    "iptables -A INPUT -i eth0.2 -p udp --dport 4500 -j ACCEPT",
111    "iptables -A INPUT -p udp --dport 500 -j ACCEPT",
112    "iptables -A INPUT -p udp --dport 4500 -j ACCEPT",
113    "iptables -A INPUT -p udp -m policy --dir in --pol ipsec -m udp --dport 1701 -j ACCEPT"
114]
115
116
117# Object for vpn profile
118class VpnL2tp(object):
119    """Profile for vpn l2tp type.
120
121    Attributes:
122        hostname: vpn server domain name
123        address: vpn server address
124        username: vpn user account
125        password: vpn user password
126        psk_secret: psk for ipsec
127        name: vpn server name for register in OpenWrt
128    """
129
130    def __init__(self,
131                 vpn_server_hostname,
132                 vpn_server_address,
133                 vpn_username,
134                 vpn_password,
135                 psk_secret,
136                 server_name):
137        self.name = server_name
138        self.hostname = vpn_server_hostname
139        self.address = vpn_server_address
140        self.username = vpn_username
141        self.password = vpn_password
142        self.psk_secret = psk_secret
143