rampageX rampageX

Introduction

This howto describes setting up a LT2P over IPsec VPN server on your router with TomatoUSB firmware. This should allow you to connect using the built-in client to your Mac, iPhone or Android device. (Not sure about Windows.)

At the end of this tutorial, you should have a L2TP/IPsec VPN server that starts automatically on boot. Mac/iPhone/Android devices can connect with their native client and will be assigned an IP address within your LAN subnet. They should be able to talk to other devices on your LAN and should be able to contact hosts on the Internet NAT'd behind your WAN IP address.

Requirements

Router running Shibby's fork of TomatoUSB
entware installed to a USB stick mounted at /opt (howto)

	#!/bin/sh
	alias wget=/opt/bin/wget
	alias base64=/opt/bin/base64

	WAN_DNS="`nvram get wan_get_dns`"
	[ -z "$WAN_DNS" ] && WAN_DNS="`nvram get wan_dns`"
	echo $WAN_DNS \| grep " " >/dev/null 2>&1
	if [ $? = 0 ];then
	FORWARDDNSISP=$(echo $WAN_DNS \| awk '{print $1}')
	else

	#define _GNU_SOURCE
	#define __USE_GNU
	#include <netinet/in.h>
	#include <arpa/nameser.h>
	#include <fcntl.h>
	#include <netdb.h>
	#include <resolv.h>
	#include <stdio.h>
	#include <stdlib.h>
	#include <string.h>

	# Add below line to merge a basic configuration file
	#!PROXY-OVERRIDE:main.conf

	# Surge will support updating conf sometime in the future
	#!UPDATE-URL:https://gist.githubusercontent.com/raw/2e27c124af2f7a4f0d5a/main.conf

	[General]
	skip-proxy = 192.168.0.0/16, 10.0.0.0/8, 172.0.0.0/8, localhost, *.local, e.crashlytics.com
	bypass-tun = 10.0.0.0/8, 172.0.0.0/8, 0.0.0.0/8, 1.0.0.0/9, 1.160.0.0/11, 1.192.0.0/11, 10.0.0.0/8, 14.0.0.0/11, 14.96.0.0/11, 14.128.0.0/11, 14.192.0.0/11, 27.0.0.0/10, 27.96.0.0/11, 27.128.0.0/9, 36.0.0.0/10, 36.96.0.0/11, 36.128.0.0/9, 39.0.0.0/11, 39.64.0.0/10, 39.128.0.0/10, 42.0.0.0/8, 43.224.0.0/11, 45.64.0.0/10, 47.64.0.0/10, 49.0.0.0/9, 49.128.0.0/11, 49.192.0.0/10, 54.192.0.0/11, 58.0.0.0/9, 58.128.0.0/11, 58.192.0.0/10, 59.32.0.0/11, 59.64.0.0/10, 59.128.0.0/9, 60.0.0.0/10, 60.160.0.0/11, 60.192.0.0/10, 61.0.0.0/10, 61.64.0.0/11, 61.128.0.0/10, 61.224.0.0/11, 100.64.0.0/10, 101.0.0.0/9, 101.128.0.0/11, 101.192.0.0/10, 103.0.0.0/10, 103.192.0.0/10, 106.0.0.0/9, 106.224.0.0/11, 110

	$ LD_PRELOAD=$PWD/sendmsg.so dig twitter.com @8.8.8.8
	;; Warning: Message parser reports malformed message packet. <-- malformed 因为把压缩指针当作域名一部分了
	;; Question section mismatch: got twitter.com/RESERVED0/CLASS256

	; <<>> DiG 9.9.5-3-Ubuntu <<>> twitter.com @8.8.8.8
	;; global options: +cmd
	;; Got answer:
	;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 44722
	;; flags: qr rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 0, ADDITIONAL: 1

	CONFIG = {
	'Arial Black' : 'ENG',
	'Arial' : 'ENG',
	'Calibri' : 'ENG',
	'Cambria' : 'ENG',
	'Candara' : 'ENG',
	'Comic Sans MS' : 'ENG',
	'Constantia' : 'ENG',
	'Corbel' : 'ENG',
	'Georgia' : 'ENG',

	#!/bin/sh

	#First you need to login to your dnspod.cn account to get your api key and key id, and your DDNS subdomain=ddns.mydomain.com
	#then
	LOGIN_TOKEN="key_id,key"
	#get domain_id
	curl -X POST https://dnsapi.cn/Domain.List -d "login_token=${LOGIN_TOKEN}&format=json"
	#Let's say we got domain_id=12345
	#get record_id
	curl -X POST https://dnsapi.cn/Record.List -d "login_token=${LOGIN_TOKEN}&format=json&domain_id=12345"

	#! /bin/sh

	gfwlist="/opt/etc/domain_gfwlist.txt"
	polluted_domain="/opt/etc/polluted_domain.txt"

	while read host; do
	dig +trace +tries=1 +time=1 $host
	if [ $(dig +trace +tries=1 +time=1 $host \| wc -l) -eq 21 ]; then
	echo $host >> $polluted_domain
	fi

	# to generate your dhparam.pem file, run in the terminal
	openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

	#!/bin/sh
	UPGRADE=0
	TRAVIS_BUILD_DIR="Portable"
	PCK_NAME="haproxy-static"
	USE_STATIC_PCRE=1
	TARGET=linux2628
	HAPROXY_MAJOR_VERSION="1.7"
	HAPROXY_MINOR_VERSION="1"
	PCRE_VERSION="8.39"
	OPENSSL_VERSION="1.0.2j"