使用 SSH 金鑰登入其他主機

1.讓 master 主機不用密碼,直接登入 slave主機

在 master 主機生成 ssh key:

mkdir ~/.ssh

cd ~/.ssh

ssh-keygen -t rsa

cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys

scp ~/.ssh/id_rsa.pub root@slave01:/root/

scp ~/.ssh/id_rsa.pub root@slave02:/root/

2.在 slave01、slave02 主機裡，將 ssh 公鑰保存到相對應的位置

cat ~/id_rsa.pub >> ~/.ssh/authorized_keys

3.回 master 主機測試,是否能直接登入

登入的 user 帳號相同,可以省略不輸入

ssh slave01 (ssh root@slave01)

ssh slave02 (ssh root@slave02)

上面動作完成,如還不能登入,請檢查 /etc/ssh/sshd_config 設定:

AuthorizedKeysFile      .ssh/authorized_keys

GoAccess 分析 Apache、Nginx Log,監控 Server 狀態

系統平台: CentOS 7

所需的 compile 套件(環境差異有所不同):

# yum install -y gcc GeoIP-devel php-pear php-pecl-geoip ncurses-devel

下載 GoAccess 套件:

# wget http://tar.goaccess.io/goaccess-1.2.tar.gz

# tar -xzvf goaccess-1.2.tar.gz

# cd goaccess-1.2/

編譯安裝:

# ./configure --enable-utf8 --enable-geoip=legacy

# make

# make install

修改 goaccess.conf 設定檔:

vi /usr/local/etc/goaccess.conf

調整時間格式:

# The following time format works with any of the

# Apache/NGINX's log formats below.

#

time-format %H:%M:%S

調整日期格式:

# The following date format works with any of the

# Apache/NGINX's log formats below.

#

date-format %d/%b/%Y

Log 檔內容格式:

# NCSA Combined Log Format

log-format %h %^[%d:%t %^] "%r" %s %b "%R" "%u"

更改 UI 配色(SSH 連線 Console UI):

# Choose among color schemes

# 1 : Monochrome

# 2 : Green

# 3 : Monokai (if 256-colors supported)

#

color-scheme 2

排除 IP 位址:

# Exclude an IPv4 or IPv6 from being counted.

# Ranges can be included as well using a dash in between

# the IPs (start-end).

#

#exclude-ip 127.0.0.1

#exclude-ip 192.168.0.1-192.168.0.100

#exclude-ip ::1

#exclude-ip 0:0:0:0:0:ffff:808:804-0:0:0:0:0:ffff:808:808

調整 靜態檔案(static-file) 類型:

.................................等等

即時查看(沒有特別修改 Apache、Nginx 的 Log 格式及沒有修改過 goaccess.conf 設定檔):

# /usr/local/bin/goaccess -f /var/log/nginx/access.log --log-format=COMBINED

沒修改 goaccess.conf、沒加 --log-format=COMBINED 啟動即時查看時,會先彈出要選擇 "Log Format Configuration"

Dashboard 欄位說明:

1.Unique visitors per day – Including spiders（分析每天多少不同的IP造訪）

2.Requested files (Pages-URL)（瀏覽的動態網頁）

3.Requested static files – (Static content: png,js,etc)（瀏覽的靜態檔案）

4.HTTP 404 Not Found response code (HTTP 404 錯誤的頁面)

5.Hosts (拜訪最多次數的IP，DDos常常看這裡)

6.Operating Systems (分析來客的系統，但這個參數可以偽裝)

7.Browsers (分析來客的瀏覽器，同樣可以偽裝)

8.Referrers URLs (最多請求的 URL)

9.Referring Sites (從哪裡URL來源鏈結過來的)

10.Top Keyphrases used on Google’s search engine (分析Google熱門關鍵字，似乎沒有辦法分析)

11.Geo Location (來源的地區)

12.HTTP Status Codes (HTTP狀態，可以拿來看網站的穩定度)

(Dashboard 欄位說明來源: Mr. 沙先生 https://shazi.info/)

動態更新 goaccess report.html 網頁(Console 下執行,執行後顯示持續執行中狀態):

# goaccess /var/log/nginx/access.log -o /var/www/html/report.html --real-time-html

WEB UI 重新整理(F5) 資訊即時更新。

crontab 排程產生網頁(每五分鐘更新一次):

*/5 * * * * /usr/local/bin/goaccess -f /var/log/nginx/access.log -a -o /var/www/html/web-report.html

瀏覽器連線:

http://host/web-report.html

其他用法:

goaccess 也附加了 GeoIP，用來分析 IP 的位置 :

# geoiplookup www.hinet.net

GeoIP Country Edition: TW, Taiwan

備註,以下設定都可在 goaccess.conf 裡設定:

排除 IP:

# /usr/local/bin/goaccess -f /var/log/nginx/access.log -e 192.168.1.1

# /usr/local/bin/goaccess -f /var/log/nginx/access.log -e 192.168.1.1-192.168.1.20

-e 的參數可以排除指定的 IP，也可以用範圍，但不支援 netmask

更改配色(SSH 連線 Console UI):

# /usr/local/bin/goaccess -f /var/log/nginx/access.log --color-scheme=(預設 1 灰色, 2 綠色)

ESXI 重啟動,還原自訂修改過的設定檔(個人備忘記錄)

ESXI 重開機都會還原系統的某些設定值,所以最好的做法是備份修改後的設定檔,

並於重啟後還原這些備份的設定檔,才不用每次重啟後還要再調整一次系統設定。

相關會還原或被清除的檔案:

1.root 的 crontab 設定: /var/spool/cron/crontabs/root

2.firewall 設定: /etc/vmware/firewall/service.xml

3.localtime 檔: /etc/localtime

4.ghettoVCB.conf 被清除: /opt/ghettovcb/ghettoVCB.conf,vmlist(指定備份的 guest os 列表)

我用 ghettoVCB 備份 Guest OS,新增獨立的 conf 檔......也會被清除所以也要備份

5........有遇到再繼續補充

以上的檔案都已備份到 /vmfs/volumes/datastore1/(這裡的檔案一定不會被還原)

/etc/rc.local.d/local.sh,讓系統重啟後執行還原自訂的設定檔(local.sh 檔案重啟 ESXI 不會被還原):

/etc/rc.local.d/local.sh 新增要執行的動作:

#backup crond

/vmfs/volumes/datastore1/crondtab.sh

#Open firewall SMTP (ghettovcb 備份後寄送 e-mail,所以要開通 firewall,裡面還包含後續新增開通的 rules)

/vmfs/volumes/datastore1/firewall.sh

#localtime(從 Ubuntu 16.04 拿來替代的檔案)

/vmfs/volumes/datastore1/re-localtime.sh

#ghettoVCB

/vmfs/volumes/datastore1/re-ghettovcb.sh

四個 Srcitp 檔案內容(檔案需可執行權限 755 OR 555):

crondtab.sh 內容:

#!/bin/sh

#add backup crond shell

/bin/kill $(cat /var/run/crond.pid)

cp /vmfs/volumes/datastore1/crontabsroot /var/spool/cron/crontabs/root

/usr/lib/vmware/busybox/bin/busybox crond

firewall.sh 內容:

#!/bin/sh

#Firwall rules
rm -rf /etc/vmware/firewall/service.xml

cp /vmfs/volumes/datastore1/service.xml /etc/vmware/firewall/

esxcli network firewall refresh

re-localtime.sh 內容:

#!/bin/sh

#Restore localtime file

rm -rf /etc/localtime

cp /vmfs/volumes/datastore1/localtime /etc/

re-ghettovcb.sh 內容:

rm -rf /opt/ghettovcb/bin/ghettoVCB.sh /opt/ghettovcb/bin/ghettoVCB-restore.sh

cp /vmfs/volumesdatastore1/ghettoVCB.sh /opt/ghettovcb/bin/

cp /vmfs/volumesdatastore1/ghettoVCB-restore.sh /opt/ghettovcb/bin/

cp /vmfs/volumesdatastore1/ghettoVCB.conf /opt/ghettovcb/

cp /vmfs/volumesdatastore1/vmlist /opt/ghettovcb/

系統 /var/spool/cron/crontabs/root 檔案內容:

30 1 * * 2,4,6 /opt/ghettovcb/bin/ghettoVCB.sh -g /opt/ghettovcb/ghettoVCB.conf -f /opt/ghettovcb/vmlist -l /tmp/vmbackup_$(date +%F_%H-%M).log > /dev/null

40 3 * * * /etc/init.d/snmpd restart > /dev/null 2>&1    

##發現 snmp 有時候會停掉,所以加入每天 03:40 重啟服務

/etc/vmware/firewall/service.xml 新增的內容:

  <service id='0044'>

    <id>VIC Outgoing</id>

    <rule id='0000'>

      <direction>outbound</direction>

      <protocol>tcp</protocol>

      <port type='dst'>2377</port>

    </rule>

    <enabled>true</enabled>

    <required>true</required>

  </service>

  <service id='0045'>

    <id>SMTP client</id>

      <rule id='0000'>

        <direction>outbound</direction>

        <protocol>tcp</protocol>

        <porttype>dst</porttype>

        <port>25</port>

      </rule>

    <enabled>true</enabled>

    <required>true</required>

  </service>

Docker Swarm Cluster 及 WEB Load Balance 應用

操作主機 (CentOS 7):

docker1    192.168.60.201    #master + node 及 swarm management

docker2    192.168.60.202

docker3    192.168.60.203

三台全裝

yum install -y docker

master 執行

docker run --rm swarm create

會出現一串 Cluster ID 記下來，因為每次執行都會再產生不同的 cluster id。

node 執行

docker run -d swarm join --addr=192.168.60.201:2375 token://07956fde8d6cd1363d5ca0e3a403b136

docker run -d swarm join --addr=192.168.60.202:2375 token://07956fde8d6cd1363d5ca0e3a403b136

docker run -d swarm join --addr=192.168.60.203:2375 token://07956fde8d6cd1363d5ca0e3a403b136

node 執行

vi /etc/sysconfig/docker

OPTIONS='-H 0.0.0.0:2375 -H unix:///var/run/docker.sock'

systemctl restart docker.service

master 執行

2375 port 己經被 docker 使用,所以必須使用其他的 port 來管理 docker:

docker run -t -p 2376:2375 -t swarm manage token://07956fde8d6cd1363d5ca0e3a403b136

正常應出現三台 join 主機的訊息,按 Ctrl + C 跳脫

確認 join 主機

docker run --rm swarm list token://07956fde8d6cd1363d5ca0e3a403b136

或

docker -H 192.168.60.201:2376 info

主機重開機時,如果沒有設定讓 Container 隨主機開機啟動,都要手動啟動它。

利用下列指令 update 讓 Container 隨主機啟動:

查看 Container ID:

docker ps -a

update container:

docker update --restart=always Container_ID

測試:

1.master 本機執行(不是在 master 的 docker container 裡)

安裝 Nginx 套件:

yum install -y epel-release

yum install -y nginx

將下列程式碼加入 /etc/nginx/nginx.conf 中：

upstream nodes {

    server 192.168.60.203:8080 weight=1; #權重 = 1

    server 192.168.60.202:8080 weight=2; #權重 = 2
    server 192.168.60.201:8080 weight=3; #權重 = 3

}

server {

    listen 80;

    location / {

        proxy_pass http://nodes;

    }

}

2.master 從 docker.io PULL 測試網頁 image 裝到 node 上(有幾台 node 就執行幾次。我也不確定要這麼做嗎!!!!! 但我執行兩次只有兩台有 PULL。發現後再執行一次,三台 node 就都有 PULL 測試網頁了)

docker -H :2375 run -d -p 8080:80 cijie/haproxy-web-example:1.0.0

3.打開瀏覽器,輸入 master IP,就可看到 Container 的 ID 切換

http://192.168.60.201

Windows 10 Hyper-v 與 VMWare 共存

整理一下網路上大家分享的方法,當作自己的備忘錄,避免之後又找一次。


1.打開具有 系統管理員 權限的 命令提示字元 視窗

2.新增一個開機選項,並會顯示一串機碼
bcdedit /copy {current} /d "Windows 10 關閉 Hyper-V"

出現:
已順利將項目複製到 {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}。

3.設定開機時關閉 Hyper-V
bcdedit /set {貼上剛才顯示的機碼} hypervisorlaunchtype OFF

重新開機後就多出一個 "Windows 10 關閉 Hyper-V" 的開機選項。



之後,測試完要怎麼刪除不要的開機選項咧???

使用 bcdedit 指令:
1.先查詢開機項目的機碼,開啟有 系統管理員 權限的 命令提示字元 視窗,輸入:
bcdedit

找到要刪除開機選項,複製 identifier 後面的機碼:

2.刪除開機選項
bcdedit /delete {xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}

3.再查詢看是否刪掉了
bcdedit

Shell script 安裝、設定 PPTP VPN

另一篇 Shell script 安裝、設定 L2TP VPN

#!/bin/bash
# Author:  yeho <lj2007331 AT gmail.com>

# Check if user is root
[ $(id -u) != "0" ] && echo "Error: You must be root to run this script" && exit 1

export PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
clear

printf "
#######################################################################
#                                                 For CentOS/RadHat 6+                                                   #
#######################################################################
"

while :
do
echo
read -p "Please input private IP-Range(Default Range: 192.168.40): " iprange
[ -z "$iprange" ] && iprange="192.168.40"
if [ -z "`echo $iprange | grep -E "^10\.|^192\.168\.|^172\." | grep -o '^[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}$'`" ];then
echo -e "\033[31minput error! Input format: xxx.xxx.xxx\033[0m"
else
break
fi
done

while :
do
echo
        read -p "Please input username: " Username
        [ -n "$Username" ] && break
done

while :
do
echo
        read -p "Please input password: " Password
        [ -n "$Password" ] && break
done
clear

get_char()
{
SAVEDSTTY=`stty -g`
stty -echo
stty cbreak
dd if=/dev/tty bs=1 count=1 2> /dev/null
stty -raw
stty echo
stty $SAVEDSTTY
}

echo ""
echo "Server Local IP:$iprange.1"
echo ""
echo "Client Remote IP Range:$iprange.2-$iprange.254"
echo ""
echo "Press any key to start..."
char=`get_char`
clear

if [ -n "`grep 'CentOS Linux release 7' /etc/redhat-release`" ];then
        CentOS_REL=7
        for Package in wget net-tools ppp iptables iptables-services make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced
        do
                yum -y install $Package
        done
wget http://dl.fedoraproject.org/pub/epel/7/x86_64/p/pptpd-1.4.0-2.el7.x86_64.rpm
rpm -Uvh pptpd-1.4.0-2.el7.x86_64.rpm
        echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
elif [ -n "`grep 'CentOS release 6' /etc/redhat-release`" ];then
        CentOS_REL=6
        for Package in wget net-tools ppp iptables make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced
        do
                yum -y install $Package
        done
wget wget http://poptop.sourceforge.net/yum/stable/rhel6/x86_64/pptpd-1.4.0-1.el6.x86_64.rpm
rpm -Uvh pptpd-1.3.4-2.el6.x86_64.rpm
        sed -i 's@net.ipv4.ip_forward.*@net.ipv4.ip_forward = 1@g' /etc/sysctl.conf
else
        echo -e "\033[31mDoes not support this OS, Please contact the author! \033[0m"
        exit 1
fi

sysctl -p

cat >/etc/ppp/options.pptpd<<EOF
name pptpd
#refuse-pap
#refuse-chap
#refuse-mschap
require-mschap-v2
require-mppe-128
proxyarp
lock
nobsdcomp
novj
novjccomp
nologfd
ms-dns 8.8.8.8
ms-dns 8.8.4.4
EOF

cat >/etc/pptpd.conf<<EOF
connections 100
localip 192.168.40.1
remoteip 192.168.40.100-200
EOF

cat >> /etc/ppp/chap-secrets<<EOF
$Username pptpd $Password *
EOF

if [ -n "`grep 'CentOS Linux release 7' /etc/redhat-release`" ];then
        CentOS_REL=7
        NETWORK_INT=`ip route | grep default | awk '{print $5}'`
iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 1723 -j ACCEPT
iptables -A INPUT -p gre -j ACCEPT
iptables -A OUTPUT -p gre -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.40.0/24 -o $NETWORK_INT -j MASQUERADE
#Forwarding rules for VPN
iptables -A FORWARD -p all -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
elif [ -n "`grep 'CentOS release 6' /etc/redhat-release`" ];then
        CentOS_REL=6
NETWORK_INT=`route | grep default | awk '{print $NF}'`
iptables -A INPUT -p tcp --dport 1723 -j ACCEPT
        iptables -A OUTPUT -p tcp --sport 1723 -j ACCEPT
        iptables -A INPUT -p gre -j ACCEPT
        iptables -A OUTPUT -p gre -j ACCEPT
        iptables -t nat -A POSTROUTING -s 192.168.40.0/24 -o $NETWORK_INT -j MASQUERADE
#Forwarding rules for VPN
iptables -A FORWARD -p all -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
else
        echo -e "\033[31mDoes not support this OS, Please contact the author! \033[0m"
        exit 1
fi

service pptpd restart-kill
service pptpd start
chkconfig pptpd on
clear
printf "
Serverip:$public_IP
username:$Username
password:$Password
"

Shell script 安裝、設定 L2TP VPN

另一篇 Shell script 安裝、設定 PPTP VPN

很久以前在網路上有看到一篇使用 Shell script 安裝及設定一次搞定 L2TP VPN，

稍微修改一下符合自己的需求。

#!/bin/bash

# Author:  yeho <lj2007331 AT gmail.com>

# Check if user is root

[ $(id -u) != "0" ] && echo "Error: You must be root to run this script" && exit 1

export PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

clear

printf "

#######################################################################

#                        For CentOS/RadHat 6+                                                                            #

#######################################################################

"

while :

do

echo

read -p "Please input private IP-Range(Default Range: 192.168.50): " iprange

[ -z "$iprange" ] && iprange="192.168.50"

if [ -z "`echo $iprange | grep -E "^10\.|^192\.168\.|^172\." | grep -o '^[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}$'`" ];then

echo -e "\033[31minput error! Input format: xxx.xxx.xxx\033[0m"

else

break

fi

done

echo

read -p "Please input PSK(Default PSK: psk): " MYPSK

[ -z "$MYPSK" ] && MYPSK="psk"

while :

do

echo

        read -p "Please input username: " Username 

        [ -n "$Username" ] && break 

done

while :

do

echo

        read -p "Please input password: " Password 

        [ -n "$Password" ] && break 

done

while :

do

echo

        read -p "Please input public ip: " public_IP 

        [ -n "$public_IP" ] && break 

done

clear

get_char()

{

SAVEDSTTY=`stty -g`

stty -echo

stty cbreak

dd if=/dev/tty bs=1 count=1 2> /dev/null

stty -raw

stty echo

stty $SAVEDSTTY

}

echo ""

echo "ServerIP:$public_IP"

echo ""

echo "Server Local IP:$iprange.1"

echo ""

echo "Client Remote IP Range:$iprange.2-$iprange.254"

echo ""

echo "PSK:$MYPSK"

echo ""

echo "Press any key to start..."

char=`get_char`

clear

if [ -n "`grep 'CentOS Linux release 7' /etc/redhat-release`" ];then

        CentOS_REL=7

        for Package in wget net-tools ppp iptables iptables-services make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced

        do

                yum -y install $Package

        done

        echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf

elif [ -n "`grep 'CentOS release 6' /etc/redhat-release`" ];then

        CentOS_REL=6

        for Package in wget net-tools ppp iptables make gcc gmp-devel xmlto bison flex xmlto libpcap-devel lsof vim-enhanced

        do

                yum -y install $Package

        done

        sed -i 's@net.ipv4.ip_forward.*@net.ipv4.ip_forward = 1@g' /etc/sysctl.conf

else

        echo -e "\033[31mDoes not support this OS, Please contact the author! \033[0m"

        exit 1

fi

sysctl -p

mknod /dev/random c 1 9

wget http://pkgs.fedoraproject.org/repo/pkgs/openswan/openswan-2.6.38.tar.gz/13073eb5314b83a31be88e4117e8bbcd/openswan-2.6.38.tar.gz

tar -xzf openswan-2.6.38.tar.gz

cd openswan-2.6.38

make programs install

cd ..

cat >/etc/ipsec.conf<<EOF

config setup

    nat_traversal=yes

    virtual_private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12

    oe=off

    protostack=netkey

    plutostderrlog=/var/log/ipsec.log

conn L2TP-PSK-NAT

    rightsubnet=vhost:%priv

    also=L2TP-PSK-noNAT

conn L2TP-PSK-noNAT

    authby=secret

    type=tunnel

    pfs=no

    auto=add

    keyingtries=3

    rekey=no

    ikelifetime=8h

    keylife=1h

    left=$public_IP

    leftprotoport=17/1701

    right=%any

    rightprotoport=17/%any

    rightsubnetwithin=0.0.0.0/0

    dpddelay=30

    dpdtimeout=120

    dpdaction=clear

EOF

cat >/etc/ipsec.secrets<<EOF

$public_IP %any: PSK "$MYPSK"

EOF

cat > /usr/bin/zl2tpset << EOF

#!/bin/bash

for each in /proc/sys/net/ipv4/conf/*

do

echo 0 > \$each/accept_redirects

echo 0 > \$each/send_redirects

echo 0 > \$each/rp_filter

done

EOF

chmod +x /usr/bin/zl2tpset

/usr/bin/zl2tpset

[ -z "`grep zl2tpset /etc/rc.local`" ] &&  echo '/usr/bin/zl2tpset' >> /etc/rc.local

service ipsec restart

#wget http://pkgs.fedoraproject.org/repo/pkgs/xl2tpd/xl2tpd-1.3.8.tar.gz/d244fdcd88f64601b64b7302870afca8/xl2tpd-1.3.8.tar.gz

#tar xzf xl2tpd-1.3.8.tar.gz

#cd xl2tpd-1.3.8

#make install

if [ -n "`grep 'CentOS Linux release 7' /etc/redhat-release`" ];then

        CentOS_REL=7

wget http://dl.fedoraproject.org/pub/epel/7/x86_64/x/xl2tpd-1.3.8-2.el7.x86_64.rpm

rpm -Uvh xl2tpd-1.3.8-2.el7.x86_64.rpm

elif [ -n "`grep 'CentOS release 6' /etc/redhat-release`" ];then

        CentOS_REL=6

wget http://dl.fedoraproject.org/pub/epel/6/x86_64/xl2tpd-1.3.8-1.el6.x86_64.rpm

        rpm -Uvh xl2tpd-1.3.8-1.el6.x86_64.rpm

else

        echo -e "\033[31mDoes not support this OS, Please contact the author! \033[0m"

        exit 1

fi

[ ! -e "/var/run/xl2tpd" ] && mkdir /var/run/xl2tpd

[ ! -e "/etc/xl2tpd" ] && mkdir /etc/xl2tpd

#cd ..

cat >/etc/xl2tpd/xl2tpd.conf<<EOF

[global]

listen-addr = $public_IP

ipsec saref = yes

auth file = /etc/ppp/chap-secrets

port = 1701

[lns default]

ip range = $iprange.2-$iprange.254

local ip = $iprange.1

assign ip = yes

refuse chap = yes

refuse pap = yes

require authentication = yes

name = L2TPVPN

ppp debug = yes

pppoptfile = /etc/ppp/options.xl2tpd

length bit = yes

EOF

cat >/etc/ppp/options.xl2tpd<<EOF

ipcp-accept-local

ipcp-accept-remote

require-mschap-v2

ms-dns 8.8.8.8

ms-dns 8.8.4.4

noccp

asyncmap 0

auth

crtscts

lock

hide-password

modem

debug

name l2tpd

proxyarp

lcp-echo-interval 30

lcp-echo-failure 4

idle 1800

mtu 1410

mru 1410

nodefaultroute

connect-delay 5000

logfd 2

logfile /var/log/l2tpd.log

EOF

cat > /etc/ppp/chap-secrets<<EOF

$Username l2tpd $Password *

EOF

if [ -n "`grep 'CentOS Linux release 7' /etc/redhat-release`" ];then

        CentOS_REL=7

        NETWORK_INT=`ip route | grep default | awk '{print $5}'`

iptables -I INPUT -p udp --dport 1701 -j ACCEPT

iptables -I INPUT -p udp --dport 500 -j ACCEPT

iptables -I INPUT -p udp --dport 4500 -j ACCEPT

iptables -t nat -A POSTROUTING -s 192.168.50.0/24 -o $NETWORK_INT -j MASQUERADE

#Forwarding rules for VPN

iptables -A FORWARD -p all -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

elif [ -n "`grep 'CentOS release 6' /etc/redhat-release`" ];then

        CentOS_REL=6

NETWORK_INT=`route | grep default | awk '{print $NF}'`

iptables -I INPUT -p udp --dport 1701 -j ACCEPT

iptables -I INPUT -p udp --dport 500 -j ACCEPT

iptables -I INPUT -p udp --dport 4500 -j ACCEPT

iptables -t nat -A POSTROUTING -s 192.168.50.0/24 -o $NETWORK_INT -j MASQUERADE

#Forwarding rules for VPN

iptables -A FORWARD -p all -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

iptables -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

else

        echo -e "\033[31mDoes not support this OS, Please contact the author! \033[0m"

        exit 1

fi

service ipsec restart

service xl2tpd restart

chkconfig ipsec on

chkconfig xl2tpd on

clear

ipsec verify

printf "

Serverip:$public_IP

PSK:$MYPSK

username:$Username

password:$Password

"