admin/gluetun
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Restarts on fail; DNS over TLS only when connected to VPN; readme update

Browse Source
This commit is contained in:
Quentin McGaw
2018-09-21 16:39:08 +02:00
parent 6929947611
commit 2b7c7cc62a
3 changed files with 71 additions and 59 deletions
Download Patch File Download Diff File Expand all files Collapse all files

81
entrypoint.sh
View File

@@ -2,16 +2,7 @@
printf "=== PIA CONTAINER ==="
############################################
# SETTING DNS OVER TLS TO 1.1.1.1 / 1.0.0.1
############################################
printf "\nChanging DNS to localhost..."
echo "nameserver 127.0.0.1" > /etc/resolv.conf
echo "options ndots:0" >> /etc/resolv.conf
printf "DONE"
printf "\nLaunching Unbound daemon to connect to Cloudflare DNS 1.1.1.1 at its TLS endpoint..."
unbound
printf "DONE"
cd /openvpn-$PROTOCOL-$ENCRYPTION
############################################
# ORIGINAL IP FOR HEALTHCHECK
@@ -35,13 +26,17 @@ printf "\n * Port: $PORT"
printf "\n * Domain: $PIADOMAIN"
printf "\n * Detecting IP addresses corresponding to $PIADOMAIN..."
VPNIPS=$(nslookup $PIADOMAIN localhost | tail -n +5 | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}')
VPNIPSLENGTH=0
for ip in $VPNIPS
do
printf "\n $ip"
VPNIPSLENGTH=$((VPNIPSLENGTH+1))
done
printf "\n * Deleting all iptables rules..."
iptables --flush
iptables --delete-chain
iptables -t nat --flush
iptables -t nat --delete-chain
ip6tables --flush
ip6tables --delete-chain
printf "DONE"
@@ -52,10 +47,8 @@ ip6tables -P OUTPUT DROP 2>/dev/null
printf "\n * Adding rules to accept local loopback traffic..."
iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT 2>/dev/null
ip6tables -A OUTPUT -o lo -j ACCEPT 2>/dev/null
ip6tables -A INPUT -i lo -j ACCEPT 2>/dev/null
printf "DONE"
printf "\n * Adding rules to accept traffic of subnet $SUBNET..."
iptables -A OUTPUT -d $SUBNET -j ACCEPT
@@ -65,41 +58,61 @@ for ip in $VPNIPS
do
printf "\n * Adding rules to accept traffic with $ip on port $PROTOCOL $PORT..."
iptables -A OUTPUT -j ACCEPT -d $ip -o eth0 -p $PROTOCOL -m $PROTOCOL --dport $PORT
iptables -A INPUT -j ACCEPT -s $ip -i eth0 -p $PROTOCOL -m $PROTOCOL --sport $PORT
ip6tables -A OUTPUT -j ACCEPT -d $ip -o eth0 -p $PROTOCOL -m $PROTOCOL --dport $PORT 2>/dev/null
ip6tables -A INPUT -j ACCEPT -s $ip -i eth0 -p $PROTOCOL -m $PROTOCOL --sport $PORT 2>/dev/null
printf "DONE"
done
printf "\n * Adding rules to accept traffic going through the tun device..."
iptables -A OUTPUT -o tun0 -j ACCEPT
iptables -A INPUT -i tun0 -j ACCEPT
ip6tables -A OUTPUT -o tun0 -j ACCEPT 2>/dev/null
ip6tables -A INPUT -i tun0 -j ACCEPT 2>/dev/null
printf "DONE"
printf "\n * Allowing outgoing DNS queries on port 53 UDP..."
iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
ip6tables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT 2>/dev/null
#printf "\n * Allowing outgoing DNS queries on port 53 UDP..."
#iptables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT
#ip6tables -A OUTPUT -p udp -m udp --dport 53 -j ACCEPT 2>/dev/null
#printf "DONE"
############################################
# SETTING DNS OVER TLS TO 1.1.1.1 / 1.0.0.1
############################################
printf "\nLaunching Unbound daemon to connect to Cloudflare DNS 1.1.1.1 at its TLS endpoint..."
unbound
printf "DONE"
printf "\nChanging DNS to localhost..."
echo "nameserver 127.0.0.1" > /etc/resolv.conf
echo "options ndots:0" >> /etc/resolv.conf
printf "DONE"
############################################
# SUMMARY
# USE NON-ROOT USER
############################################
printf "\nStarting OpenVPN using the following parameters:"
printf "\n * Domain: $PIADOMAIN"
printf "\n * Port: $PORT"
printf "\n * Protocol: $PROTOCOL"
printf "\n * Encryption: $ENCRYPTION"
############################################
# OPENVPN LAUNCH
############################################
cd /openvpn-$PROTOCOL-$ENCRYPTION
printf "\nSwitching from root to nonrootuser..."
su -l nonrootuser
printf "DONE\n"
openvpn --config "$REGION.ovpn" --auth-user-pass /auth.conf
printf "DONE"
############################################
# CLEANUP
# OPENVPN LAUNCH (retry with next VPN IP if fail)
############################################
printf "\nExiting...\n\n"
failed=1
i=1
PREVIOUSIP=$PIADOMAIN
while [ $failed != 0 ]
do
VPNIP=$(echo $VPNIPS | cut -d' ' -f$i)
sed -i "s/$PREVIOUSIP/$VPNIP/g" $REGION.ovpn
PREVIOUSIP=$VPNIP
printf "\nStarting OpenVPN using the following parameters:"
printf "\n * Region: $REGION"
printf "\n * Encryption: $ENCRYPTION"
printf "\n * Address: $PROTOCOL://$VPNIP:$PORT"
printf "\n\n"
openvpn --config "$REGION.ovpn" --auth-user-pass /auth.conf
failed=$?
if [[ $failed != 0 ]]; then
echo "==> Openvpn failed with error code: $failed"
i=$((i+1))
if [[ $i -gt $VPNIPSLENGTH ]]; then
i=0
fi
else
echo "==> Openvpn stopped cleanly"
fi
done