1069 lines
33 KiB
Bash
1069 lines
33 KiB
Bash
#!/bin/bash
|
||
|
||
# GRE/VXLAN 隧道生成器
|
||
# 生成 GRE 或 VXLAN 隧道的 systemd 服务文件
|
||
# 支持 IPv4 和 IPv6，IPv6 支持 PBR 防止 bird 路由冲突
|
||
|
||
set -e
|
||
|
||
# 检测是否通过管道运行
|
||
if [[ ! -t 0 ]]; then
|
||
echo "========================================"
|
||
echo " GRE/VXLAN 隧道服务生成器"
|
||
echo "========================================"
|
||
echo ""
|
||
echo "检测到您正在通过管道运行此脚本。"
|
||
echo "由于需要交互式输入，请使用以下方式运行："
|
||
echo ""
|
||
echo " # 下载脚本"
|
||
echo " curl -fsSL https://raw.githubusercontent.com/yanglc721/tunnelgen/main/tunnel-generator.sh -o tunnel-generator.sh"
|
||
echo ""
|
||
echo " # 添加执行权限"
|
||
echo " chmod +x tunnel-generator.sh"
|
||
echo ""
|
||
echo " # 运行脚本"
|
||
echo " sudo ./tunnel-generator.sh"
|
||
echo ""
|
||
exit 1
|
||
fi
|
||
|
||
# 输出颜色
|
||
RED='\033[0;31m'
|
||
GREEN='\033[0;32m'
|
||
YELLOW='\033[1;33m'
|
||
BLUE='\033[0;34m'
|
||
NC='\033[0m' # 无颜色
|
||
|
||
print_banner() {
|
||
echo -e "${BLUE}"
|
||
echo "========================================"
|
||
echo " GRE/VXLAN 隧道服务生成器"
|
||
echo "========================================"
|
||
echo -e "${NC}"
|
||
}
|
||
|
||
print_info() {
|
||
echo -e "${GREEN}[信息]${NC} $1"
|
||
}
|
||
|
||
print_warn() {
|
||
echo -e "${YELLOW}[警告]${NC} $1"
|
||
}
|
||
|
||
print_error() {
|
||
echo -e "${RED}[错误]${NC} $1"
|
||
}
|
||
|
||
# 检查是否以 root 运行
|
||
check_root() {
|
||
if [[ $EUID -ne 0 ]]; then
|
||
print_error "此脚本必须以 root 权限运行"
|
||
exit 1
|
||
fi
|
||
}
|
||
|
||
# 验证 IPv4 地址
|
||
validate_ipv4() {
|
||
local ip=$1
|
||
local regex='^([0-9]{1,3}\.){3}[0-9]{1,3}$'
|
||
|
||
if [[ ! $ip =~ $regex ]]; then
|
||
return 1
|
||
fi
|
||
|
||
# 验证每个八位组
|
||
IFS='.' read -ra octets <<< "$ip"
|
||
for octet in "${octets[@]}"; do
|
||
if [[ $octet -lt 0 ]] || [[ $octet -gt 255 ]]; then
|
||
return 1
|
||
fi
|
||
done
|
||
return 0
|
||
}
|
||
|
||
# 验证 IPv6 地址
|
||
validate_ipv6() {
|
||
local ip=$1
|
||
local regex='^([0-9a-fA-F]{0,4}:){2,7}[0-9a-fA-F]{0,4}$|^::$|^::1$|^([0-9a-fA-F]{0,4}:){1,7}:$|^:([0-9a-fA-F]{0,4}:){1,7}$'
|
||
|
||
if [[ $ip =~ $regex ]]; then
|
||
return 0
|
||
fi
|
||
return 1
|
||
}
|
||
|
||
validate_ip() {
|
||
local ip=$1
|
||
local type=$2
|
||
|
||
if [[ $type == "ipv4" ]]; then
|
||
validate_ipv4 "$ip"
|
||
else
|
||
validate_ipv6 "$ip"
|
||
fi
|
||
}
|
||
|
||
# 获取指定 IP 的网络接口
|
||
get_interface_for_ip() {
|
||
local ip=$1
|
||
local ip_type=$2
|
||
|
||
if [[ $ip_type == "ipv4" ]]; then
|
||
ip -4 route get "$ip" 2>/dev/null | sed -n 's/.*dev \([^ ]*\).*/\1/p' | head -1
|
||
else
|
||
ip -6 route get "$ip" 2>/dev/null | sed -n 's/.*dev \([^ ]*\).*/\1/p' | head -1
|
||
fi
|
||
}
|
||
|
||
# 列出可用的网络接口
|
||
list_interfaces() {
|
||
local ip_type=$1
|
||
|
||
echo ""
|
||
echo "可用的网络接口:"
|
||
echo "====================================="
|
||
|
||
local idx=0
|
||
|
||
while IFS= read -r line; do
|
||
# 提取接口名称 (格式: "2: eth0: <...")
|
||
local iface=$(echo "$line" | awk -F': ' '{print $2}')
|
||
if [[ -z "$iface" ]]; then
|
||
continue
|
||
fi
|
||
|
||
# 跳过回环接口
|
||
if [[ "$iface" == "lo" ]]; then
|
||
continue
|
||
fi
|
||
|
||
# 获取接口状态
|
||
local state=$(ip link show "$iface" 2>/dev/null | awk '{for(i=1;i<=NF;i++) if($i=="state") print $(i+1)}' | head -1)
|
||
|
||
# 跳过未启用的接口
|
||
if [[ "$state" != "UP" && "$state" != "UNKNOWN" ]]; then
|
||
continue
|
||
fi
|
||
|
||
# 获取 IP 地址
|
||
local ipv4_addr=$(ip -4 addr show "$iface" 2>/dev/null | awk '/inet /{print $2}' | cut -d'/' -f1 | head -1)
|
||
local ipv6_addr=$(ip -6 addr show "$iface" 2>/dev/null | awk '/inet6 / && !/fe80::/{print $2}' | cut -d'/' -f1 | head -1)
|
||
|
||
idx=$((idx + 1))
|
||
|
||
printf " [%d] %-12s 状态:%-8s" "$idx" "$iface" "$state"
|
||
|
||
if [[ $ip_type == "ipv4" ]]; then
|
||
if [[ -n "$ipv4_addr" ]]; then
|
||
printf " IPv4: %s" "$ipv4_addr"
|
||
fi
|
||
else
|
||
if [[ -n "$ipv6_addr" ]]; then
|
||
printf " IPv6: %s" "$ipv6_addr"
|
||
fi
|
||
fi
|
||
|
||
echo ""
|
||
done < <(ip link show 2>/dev/null | grep -E '^[0-9]+:')
|
||
|
||
echo "====================================="
|
||
echo ""
|
||
}
|
||
|
||
# 根据索引获取接口
|
||
get_interface_by_idx() {
|
||
local idx=$1
|
||
shift
|
||
local ifaces=("$@")
|
||
|
||
echo "${ifaces[$((idx-1))]}"
|
||
}
|
||
|
||
# 检查路由表是否存在
|
||
check_rt_table() {
|
||
local table_name=$1
|
||
grep -q "^.*${table_name}$" /etc/iproute2/rt_tables 2>/dev/null
|
||
}
|
||
|
||
# 添加路由表
|
||
add_rt_table() {
|
||
local table_id=$1
|
||
local table_name=$2
|
||
|
||
if ! check_rt_table "$table_name"; then
|
||
echo "${table_id} ${table_name}" >> /etc/iproute2/rt_tables
|
||
print_info "已创建路由表: ${table_name} (ID: ${table_id})"
|
||
else
|
||
print_info "路由表已存在: ${table_name}"
|
||
fi
|
||
}
|
||
|
||
# 获取接口的默认网关
|
||
get_default_gateway() {
|
||
local interface=$1
|
||
local ip_type=$2
|
||
|
||
if [[ $ip_type == "ipv4" ]]; then
|
||
local gw=$(ip -4 route show default dev "$interface" 2>/dev/null | awk '{print $3}')
|
||
if [[ -n "$gw" ]]; then
|
||
echo "$gw"
|
||
return
|
||
fi
|
||
else
|
||
local gw=$(ip -6 route show default dev "$interface" 2>/dev/null | awk '{print $3}')
|
||
if [[ -n "$gw" ]]; then
|
||
echo "$gw"
|
||
return
|
||
fi
|
||
fi
|
||
}
|
||
|
||
# 获取指定目标 IP 的网关（更准确）
|
||
get_gateway_for_ip() {
|
||
local dest_ip=$1
|
||
local ip_type=$2
|
||
|
||
if [[ $ip_type == "ipv4" ]]; then
|
||
ip -4 route get "$dest_ip" 2>/dev/null | sed -n 's/.*via \([^ ]*\).*/\1/p' | head -1
|
||
else
|
||
ip -6 route get "$dest_ip" 2>/dev/null | sed -n 's/.*via \([^ ]*\).*/\1/p' | head -1
|
||
fi
|
||
}
|
||
|
||
# 生成 GRE 隧道服务文件
|
||
generate_gre_service() {
|
||
local tunnel_name=$1
|
||
local remote_ip=$2
|
||
local local_ip=$3
|
||
local ip_type=$4
|
||
local interface=$5
|
||
local gateway=$6
|
||
local pbr_table="${tunnel_name}_underlay"
|
||
local pbr_table_id=100
|
||
|
||
local service_file="/etc/systemd/system/${tunnel_name}.service"
|
||
local description="GRE 隧道 ${tunnel_name}"
|
||
|
||
# 确定隧道模式
|
||
local tunnel_mode="gre"
|
||
if [[ $ip_type == "ipv6" ]]; then
|
||
tunnel_mode="ip6gre"
|
||
fi
|
||
|
||
print_info "正在生成 GRE 隧道服务: $service_file"
|
||
|
||
# IPv6 需要 PBR，先创建路由表
|
||
if [[ $ip_type == "ipv6" ]]; then
|
||
# 查找可用的表 ID
|
||
while grep -q "^${pbr_table_id} " /etc/iproute2/rt_tables 2>/dev/null; do
|
||
pbr_table_id=$((pbr_table_id + 1))
|
||
done
|
||
add_rt_table "$pbr_table_id" "$pbr_table"
|
||
|
||
# 创建 PBR 设置脚本
|
||
local prestart_script="/usr/local/sbin/${tunnel_name}-pbr-setup.sh"
|
||
cat > "$prestart_script" << 'PBREOF'
|
||
#!/bin/bash
|
||
# GRE 隧道 PBR 设置脚本
|
||
# 创建干净的路由表用于隧道底层流量
|
||
|
||
set -e
|
||
|
||
TUNNEL_NAME="__TUNNEL_NAME__"
|
||
REMOTE_IP="__REMOTE_IP__"
|
||
LOCAL_IP="__LOCAL_IP__"
|
||
INTERFACE="__INTERFACE__"
|
||
GATEWAY="__GATEWAY__"
|
||
TABLE_NAME="__TABLE_NAME__"
|
||
|
||
# 在干净的路由表中添加路由
|
||
# 通过物理接口路由到远端隧道端点
|
||
if [[ -n "$GATEWAY" ]]; then
|
||
ip -6 route replace "$REMOTE_IP/128" via "$GATEWAY" dev "$INTERFACE" table "$TABLE_NAME" 2>/dev/null || true
|
||
else
|
||
# 如果没有网关，尝试直接使用接口（点对点链路）
|
||
ip -6 route replace "$REMOTE_IP/128" dev "$INTERFACE" table "$TABLE_NAME" 2>/dev/null || true
|
||
fi
|
||
|
||
# 添加本地地址路由
|
||
ip -6 route replace "$LOCAL_IP/128" dev "$INTERFACE" table "$TABLE_NAME" 2>/dev/null || true
|
||
|
||
# 添加 PBR 规则（优先级 50，在默认 main 表查询 32766 之前）
|
||
ip -6 rule replace to "$REMOTE_IP" table "$TABLE_NAME" priority 50 2>/dev/null || \
|
||
ip -6 rule add to "$REMOTE_IP" table "$TABLE_NAME" priority 50
|
||
|
||
ip -6 rule replace from "$LOCAL_IP" table "$TABLE_NAME" priority 51 2>/dev/null || \
|
||
ip -6 rule add from "$LOCAL_IP" table "$TABLE_NAME" priority 51
|
||
|
||
echo "已为 $TUNNEL_NAME 安装 PBR 规则"
|
||
PBREOF
|
||
|
||
# 替换占位符
|
||
sed -i "s/__TUNNEL_NAME__/$tunnel_name/g" "$prestart_script"
|
||
sed -i "s/__REMOTE_IP__/$remote_ip/g" "$prestart_script"
|
||
sed -i "s/__LOCAL_IP__/$local_ip/g" "$prestart_script"
|
||
sed -i "s/__INTERFACE__/$interface/g" "$prestart_script"
|
||
sed -i "s/__GATEWAY__/$gateway/g" "$prestart_script"
|
||
sed -i "s/__TABLE_NAME__/$pbr_table/g" "$prestart_script"
|
||
chmod +x "$prestart_script"
|
||
|
||
print_info "已创建 PBR 设置脚本: $prestart_script"
|
||
fi
|
||
|
||
cat > "$service_file" << EOF
|
||
[Unit]
|
||
Description=$description
|
||
After=network.target network-online.target
|
||
Wants=network-online.target
|
||
|
||
[Service]
|
||
Type=oneshot
|
||
RemainAfterExit=yes
|
||
EOF
|
||
|
||
# 构建 ExecStart 命令
|
||
local exec_start="ip tunnel add $tunnel_name mode $tunnel_mode remote $remote_ip local $local_ip ttl 255 && ip link set $tunnel_name up"
|
||
|
||
if [[ $ip_type == "ipv6" ]]; then
|
||
# 在创建隧道前添加 PBR 设置
|
||
cat >> "$service_file" << EOF
|
||
ExecStartPre=/usr/local/sbin/${tunnel_name}-pbr-setup.sh
|
||
EOF
|
||
fi
|
||
|
||
cat >> "$service_file" << EOF
|
||
ExecStart=/bin/sh -c "$exec_start"
|
||
EOF
|
||
|
||
# 构建 ExecStop 命令
|
||
local exec_stop="ip link set $tunnel_name down; ip tunnel del $tunnel_name"
|
||
|
||
if [[ $ip_type == "ipv6" ]]; then
|
||
# 停止时删除 PBR 规则
|
||
exec_stop="ip link set $tunnel_name down; ip tunnel del $tunnel_name; ip -6 rule del to $remote_ip table $pbr_table priority 50 || true; ip -6 rule del from $local_ip table $pbr_table priority 51 || true"
|
||
fi
|
||
|
||
cat >> "$service_file" << EOF
|
||
ExecStop=/bin/sh -c "$exec_stop"
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
EOF
|
||
|
||
print_info "服务文件已创建: $service_file"
|
||
}
|
||
|
||
# 生成 VXLAN 隧道服务文件
|
||
generate_vxlan_service() {
|
||
local tunnel_name=$1
|
||
local remote_ip=$2
|
||
local local_ip=$3
|
||
local dst_port=$4
|
||
local vni=$5
|
||
local ip_type=$6
|
||
local interface=$7
|
||
local gateway=$8
|
||
local pbr_table="${tunnel_name}_underlay"
|
||
local pbr_table_id=100
|
||
|
||
local service_file="/etc/systemd/system/${tunnel_name}.service"
|
||
local description="VXLAN 隧道 ${tunnel_name}"
|
||
|
||
print_info "正在生成 VXLAN 隧道服务: $service_file"
|
||
|
||
# IPv6 需要 PBR，先创建路由表
|
||
if [[ $ip_type == "ipv6" ]]; then
|
||
# 查找可用的表 ID
|
||
while grep -q "^${pbr_table_id} " /etc/iproute2/rt_tables 2>/dev/null; do
|
||
pbr_table_id=$((pbr_table_id + 1))
|
||
done
|
||
add_rt_table "$pbr_table_id" "$pbr_table"
|
||
|
||
# 创建 PBR 设置脚本
|
||
local prestart_script="/usr/local/sbin/${tunnel_name}-pbr-setup.sh"
|
||
cat > "$prestart_script" << 'PBREOF'
|
||
#!/bin/bash
|
||
# VXLAN 隧道 PBR 设置脚本
|
||
# 创建干净的路由表用于隧道底层流量
|
||
|
||
set -e
|
||
|
||
TUNNEL_NAME="__TUNNEL_NAME__"
|
||
REMOTE_IP="__REMOTE_IP__"
|
||
LOCAL_IP="__LOCAL_IP__"
|
||
INTERFACE="__INTERFACE__"
|
||
GATEWAY="__GATEWAY__"
|
||
TABLE_NAME="__TABLE_NAME__"
|
||
|
||
# 在干净的路由表中添加路由
|
||
# 通过物理接口路由到远端隧道端点
|
||
if [[ -n "$GATEWAY" ]]; then
|
||
ip -6 route replace "$REMOTE_IP/128" via "$GATEWAY" dev "$INTERFACE" table "$TABLE_NAME" 2>/dev/null || true
|
||
else
|
||
ip -6 route replace "$REMOTE_IP/128" dev "$INTERFACE" table "$TABLE_NAME" 2>/dev/null || true
|
||
fi
|
||
|
||
# 添加本地地址路由
|
||
ip -6 route replace "$LOCAL_IP/128" dev "$INTERFACE" table "$TABLE_NAME" 2>/dev/null || true
|
||
|
||
# 添加 PBR 规则（优先级 50，在默认 main 表查询 32766 之前）
|
||
ip -6 rule replace to "$REMOTE_IP" table "$TABLE_NAME" priority 50 2>/dev/null || \
|
||
ip -6 rule add to "$REMOTE_IP" table "$TABLE_NAME" priority 50
|
||
|
||
ip -6 rule replace from "$LOCAL_IP" table "$TABLE_NAME" priority 51 2>/dev/null || \
|
||
ip -6 rule add from "$LOCAL_IP" table "$TABLE_NAME" priority 51
|
||
|
||
echo "已为 $TUNNEL_NAME 安装 PBR 规则"
|
||
PBREOF
|
||
|
||
# 替换占位符
|
||
sed -i "s/__TUNNEL_NAME__/$tunnel_name/g" "$prestart_script"
|
||
sed -i "s/__REMOTE_IP__/$remote_ip/g" "$prestart_script"
|
||
sed -i "s/__LOCAL_IP__/$local_ip/g" "$prestart_script"
|
||
sed -i "s/__INTERFACE__/$interface/g" "$prestart_script"
|
||
sed -i "s/__GATEWAY__/$gateway/g" "$prestart_script"
|
||
sed -i "s/__TABLE_NAME__/$pbr_table/g" "$prestart_script"
|
||
chmod +x "$prestart_script"
|
||
|
||
print_info "已创建 PBR 设置脚本: $prestart_script"
|
||
fi
|
||
|
||
cat > "$service_file" << EOF
|
||
[Unit]
|
||
Description=$description
|
||
After=network.target network-online.target
|
||
Wants=network-online.target
|
||
|
||
[Service]
|
||
Type=oneshot
|
||
RemainAfterExit=yes
|
||
EOF
|
||
|
||
# 构建 ExecStart 命令
|
||
local exec_start="ip link add $tunnel_name type vxlan id $vni dev $interface remote $remote_ip dstport $dst_port learning && ip link set $tunnel_name up"
|
||
|
||
if [[ $ip_type == "ipv6" ]]; then
|
||
# 在创建隧道前添加 PBR 设置
|
||
cat >> "$service_file" << EOF
|
||
ExecStartPre=/usr/local/sbin/${tunnel_name}-pbr-setup.sh
|
||
EOF
|
||
fi
|
||
|
||
cat >> "$service_file" << EOF
|
||
ExecStart=/bin/sh -c "$exec_start"
|
||
EOF
|
||
|
||
# 构建 ExecStop 命令
|
||
local exec_stop="ip link set $tunnel_name down; ip link del $tunnel_name"
|
||
|
||
if [[ $ip_type == "ipv6" ]]; then
|
||
# 停止时删除 PBR 规则
|
||
exec_stop="ip link set $tunnel_name down; ip link del $tunnel_name; ip -6 rule del to $remote_ip table $pbr_table priority 50 || true; ip -6 rule del from $local_ip table $pbr_table priority 51 || true"
|
||
fi
|
||
|
||
cat >> "$service_file" << EOF
|
||
ExecStop=/bin/sh -c "$exec_stop"
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
EOF
|
||
|
||
print_info "服务文件已创建: $service_file"
|
||
}
|
||
|
||
# 生成 SSH TUN 隧道服务文件
|
||
generate_sshtun_service() {
|
||
local tunnel_name=$1
|
||
local remote_ip=$2
|
||
local local_ip=$3
|
||
local tunnel_ip_local=$4
|
||
local tunnel_ip_remote=$5
|
||
local ssh_port=$6
|
||
local ssh_user=$7
|
||
local role=$8 # "server" or "client"
|
||
local ip_type=$9 # "ipv4" or "ipv6"
|
||
|
||
local service_file="/etc/systemd/system/${tunnel_name}.service"
|
||
local description="SSH TUN 隧道 ${tunnel_name}"
|
||
|
||
# 确定掩码
|
||
local prefix="24"
|
||
if [[ "$ip_type" == "ipv6" ]]; then
|
||
prefix="64"
|
||
fi
|
||
|
||
print_info "正在生成 SSH TUN 隧道服务: $service_file"
|
||
|
||
if [[ "$role" == "server" ]]; then
|
||
# 服务端配置
|
||
# 检查并配置 SSH PermitTunnel
|
||
local sshd_config="/etc/ssh/sshd_config"
|
||
if ! grep -q "^PermitTunnel[[:space:]]*yes" "$sshd_config" 2>/dev/null; then
|
||
print_info "正在配置 SSH PermitTunnel..."
|
||
if grep -q "^#*PermitTunnel" "$sshd_config" 2>/dev/null; then
|
||
sed -i 's/^#*PermitTunnel.*/PermitTunnel yes/' "$sshd_config"
|
||
else
|
||
echo "PermitTunnel yes" >> "$sshd_config"
|
||
fi
|
||
# 重启 SSH 服务
|
||
systemctl restart sshd || systemctl restart ssh
|
||
print_info "已启用 SSH PermitTunnel 并重启 SSH 服务"
|
||
fi
|
||
|
||
# 服务端服务文件 - 等待客户端连接
|
||
cat > "$service_file" << EOF
|
||
[Unit]
|
||
Description=$description (服务端)
|
||
After=network.target network-online.target sshd.service
|
||
Wants=network-online.target
|
||
|
||
[Service]
|
||
Type=simple
|
||
# 服务端通过 SSH 连接的自动触发，不需要额外服务
|
||
# 当客户端连接时会自动创建 tun 设备
|
||
# 此服务主要用于记录状态
|
||
|
||
ExecStartPre=/bin/sh -c 'echo "SSH TUN 服务端已就绪，等待客户端连接..."'
|
||
ExecStart=/bin/sleep infinity
|
||
ExecStop=/bin/true
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
EOF
|
||
|
||
# 创建 IP 配置脚本（连接建立后手动或自动执行）
|
||
local ip_config_script="/usr/local/sbin/${tunnel_name}-ip-config.sh"
|
||
cat > "$ip_config_script" << EOF
|
||
#!/bin/bash
|
||
# SSH TUN 隧道 IP 配置脚本
|
||
# 当 SSH 连接建立后，tun 设备会自动创建
|
||
# 运行此脚本配置 IP 地址
|
||
|
||
# 查找 tun 设备（通常为 tun0）
|
||
TUN_DEV=""
|
||
for i in {0..9}; do
|
||
if ip link show tun\$i &>/dev/null; then
|
||
TUN_DEV="tun\$i"
|
||
break
|
||
fi
|
||
done
|
||
|
||
if [[ -z "\$TUN_DEV" ]]; then
|
||
echo "未找到 tun 设备，请确保 SSH 客户端已连接"
|
||
exit 1
|
||
fi
|
||
|
||
echo "配置 \$TUN_DEV IP 地址..."
|
||
ip addr add ${tunnel_ip_local}/${prefix} dev \$TUN_DEV
|
||
ip link set \$TUN_DEV up
|
||
|
||
echo "SSH TUN 隧道 IP 配置完成"
|
||
echo "本地隧道 IP: ${tunnel_ip_local}"
|
||
echo "对端隧道 IP: ${tunnel_ip_remote}"
|
||
EOF
|
||
chmod +x "$ip_config_script"
|
||
print_info "已创建 IP 配置脚本: $ip_config_script"
|
||
|
||
else
|
||
# 客户端配置
|
||
# 检查 SSH 密钥
|
||
local ssh_key=""
|
||
if [[ -f "/root/.ssh/id_rsa" ]]; then
|
||
ssh_key="/root/.ssh/id_rsa"
|
||
elif [[ -f "/root/.ssh/id_ed25519" ]]; then
|
||
ssh_key="/root/.ssh/id_ed25519"
|
||
elif [[ -f "/root/.ssh/id_ecdsa" ]]; then
|
||
ssh_key="/root/.ssh/id_ecdsa"
|
||
fi
|
||
|
||
if [[ -z "$ssh_key" ]]; then
|
||
print_warn "未找到 SSH 密钥，将生成新的密钥..."
|
||
ssh-keygen -t ed25519 -f /root/.ssh/id_ed25519 -N ""
|
||
ssh_key="/root/.ssh/id_ed25519"
|
||
print_info "已生成 SSH 密钥: $ssh_key"
|
||
print_warn "请将公钥添加到服务端:"
|
||
echo ""
|
||
cat "${ssh_key}.pub"
|
||
echo ""
|
||
read -p "已将公钥添加到服务端? [y/N]: " key_added
|
||
if [[ ! "$key_added" =~ ^[Yy]$ ]]; then
|
||
print_info "请先添加公钥后再运行此脚本"
|
||
exit 0
|
||
fi
|
||
fi
|
||
|
||
# 客户端服务文件
|
||
cat > "$service_file" << EOF
|
||
[Unit]
|
||
Description=$description (客户端)
|
||
After=network.target network-online.target
|
||
Wants=network-online.target
|
||
|
||
[Service]
|
||
Type=simple
|
||
User=root
|
||
# SSH TUN 连接命令
|
||
# -w 0:0 创建 tun 设备
|
||
# -o Tunnel=point-to-point 点对点模式
|
||
# -o ServerAliveInterval 保持连接
|
||
# -o ExitOnForwardFailure 连接失败时退出
|
||
ExecStart=/usr/bin/ssh -i ${ssh_key} \\
|
||
-w 0:0 \\
|
||
-o Tunnel=point-to-point \\
|
||
-o ServerAliveInterval=30 \\
|
||
-o ServerAliveCountMax=3 \\
|
||
-o ExitOnForwardFailure=yes \\
|
||
-o StrictHostKeyChecking=accept-new \\
|
||
-p ${ssh_port} \\
|
||
${ssh_user}@${remote_ip} \\
|
||
-N
|
||
|
||
# 连接建立后配置 IP
|
||
ExecStartPost=/bin/sh -c 'sleep 2 && ip addr add ${tunnel_ip_local}/${prefix} dev tun0 && ip link set tun0 up'
|
||
|
||
# 重启策略
|
||
Restart=always
|
||
RestartSec=10
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
EOF
|
||
fi
|
||
|
||
print_info "服务文件已创建: $service_file"
|
||
}
|
||
|
||
# 主脚本
|
||
main() {
|
||
print_banner
|
||
|
||
# 检查 root
|
||
check_root
|
||
|
||
# 选择 IP 版本
|
||
echo ""
|
||
echo "选择 IP 版本:"
|
||
echo " 1) IPv4"
|
||
echo " 2) IPv6"
|
||
echo ""
|
||
read -p "请输入选项 [1-2]: " ip_choice
|
||
|
||
case $ip_choice in
|
||
1) ip_type="ipv4" ;;
|
||
2) ip_type="ipv6" ;;
|
||
*) print_error "无效的选项"; exit 1 ;;
|
||
esac
|
||
|
||
print_info "已选择: $ip_type"
|
||
|
||
# SSH TUN 使用 IPv4 隧道 IP，跳过 IPv6 特有配置
|
||
# 但仍需要 ip_type 变量
|
||
|
||
# 选择隧道类型
|
||
echo ""
|
||
echo "选择隧道类型:"
|
||
echo " 1) GRE"
|
||
echo " 2) VXLAN"
|
||
echo " 3) SSH TUN (TCP 隧道，适用于 UDP 受限环境)"
|
||
echo ""
|
||
read -p "请输入选项 [1-3]: " tunnel_choice
|
||
|
||
case $tunnel_choice in
|
||
1) tunnel_type="gre" ;;
|
||
2) tunnel_type="vxlan" ;;
|
||
3) tunnel_type="sshtun" ;;
|
||
*) print_error "无效的选项"; exit 1 ;;
|
||
esac
|
||
|
||
print_info "已选择: $tunnel_type"
|
||
|
||
# 获取隧道名称
|
||
echo ""
|
||
read -p "请输入隧道名称 (例如: gre-hk1, vxlan-hk4, ssh-ca): " tunnel_name
|
||
|
||
if [[ -z "$tunnel_name" ]]; then
|
||
print_error "隧道名称不能为空"
|
||
exit 1
|
||
fi
|
||
|
||
# 检查服务是否已存在
|
||
if [[ -f "/etc/systemd/system/${tunnel_name}.service" ]]; then
|
||
print_warn "服务文件已存在: /etc/systemd/system/${tunnel_name}.service"
|
||
read -p "是否覆盖? [y/N]: " overwrite
|
||
if [[ ! "$overwrite" =~ ^[Yy]$ ]]; then
|
||
print_info "已取消"
|
||
exit 0
|
||
fi
|
||
fi
|
||
|
||
# 获取本地 IP
|
||
echo ""
|
||
if [[ $tunnel_type == "sshtun" ]]; then
|
||
# SSH TUN 需要知道角色
|
||
echo "选择本机角色:"
|
||
echo " 1) 服务端 (有公网 IP，等待客户端连接)"
|
||
echo " 2) 客户端 (在 NAT 内，主动连接服务端)"
|
||
echo ""
|
||
read -p "请输入选项 [1-2]: " role_choice
|
||
|
||
case $role_choice in
|
||
1) ssh_role="server" ;;
|
||
2) ssh_role="client" ;;
|
||
*) print_error "无效的选项"; exit 1 ;;
|
||
esac
|
||
print_info "已选择角色: $ssh_role"
|
||
|
||
# 获取对端 IP
|
||
echo ""
|
||
if [[ $ssh_role == "client" ]]; then
|
||
read -p "请输入服务端 IP 地址: " remote_ip
|
||
else
|
||
read -p "请输入客户端公网 IP 地址 (可选，用于防火墙规则): " remote_ip
|
||
fi
|
||
|
||
# SSH 参数
|
||
echo ""
|
||
read -p "请输入 SSH 端口 [默认: 22]: " ssh_port
|
||
ssh_port=${ssh_port:-22}
|
||
|
||
read -p "请输入 SSH 用户 [默认: root]: " ssh_user
|
||
ssh_user=${ssh_user:-root}
|
||
|
||
# 隧道 IP 类型
|
||
echo ""
|
||
echo "选择隧道内部 IP 类型:"
|
||
echo " 1) IPv4 (10.0.0.x)"
|
||
echo " 2) IPv6 (fd00::x)"
|
||
echo ""
|
||
read -p "请输入选项 [1-2，默认 2]: " tunnel_ip_choice
|
||
tunnel_ip_choice=${tunnel_ip_choice:-2}
|
||
|
||
case $tunnel_ip_choice in
|
||
1)
|
||
tunnel_ip_type="ipv4"
|
||
default_local="10.0.0.1"
|
||
default_remote="10.0.0.2"
|
||
;;
|
||
2)
|
||
tunnel_ip_type="ipv6"
|
||
default_local="fd00::1"
|
||
default_remote="fd00::2"
|
||
;;
|
||
*) print_error "无效的选项"; exit 1 ;;
|
||
esac
|
||
print_info "已选择隧道 IP 类型: $tunnel_ip_type"
|
||
|
||
# 隧道 IP
|
||
echo ""
|
||
print_info "配置隧道内部 IP 地址:"
|
||
read -p "请输入本地隧道 IP [默认: $default_local]: " tunnel_ip_local
|
||
tunnel_ip_local=${tunnel_ip_local:-$default_local}
|
||
|
||
read -p "请输入对端隧道 IP [默认: $default_remote]: " tunnel_ip_remote
|
||
tunnel_ip_remote=${tunnel_ip_remote:-$default_remote}
|
||
|
||
# 验证 IP
|
||
if [[ $tunnel_ip_type == "ipv4" ]]; then
|
||
if ! validate_ipv4 "$tunnel_ip_local" || ! validate_ipv4 "$tunnel_ip_remote"; then
|
||
print_error "无效的 IPv4 地址"
|
||
exit 1
|
||
fi
|
||
else
|
||
if ! validate_ipv6 "$tunnel_ip_local" || ! validate_ipv6 "$tunnel_ip_remote"; then
|
||
print_error "无效的 IPv6 地址"
|
||
exit 1
|
||
fi
|
||
fi
|
||
|
||
# 如果是客户端，交换 IP
|
||
if [[ $ssh_role == "client" ]]; then
|
||
local temp=$tunnel_ip_local
|
||
tunnel_ip_local=$tunnel_ip_remote
|
||
tunnel_ip_remote=$temp
|
||
fi
|
||
|
||
else
|
||
# GRE/VXLAN 原有逻辑
|
||
if [[ $ip_type == "ipv4" ]]; then
|
||
read -p "请输入本地 IPv4 地址: " local_ip
|
||
if ! validate_ipv4 "$local_ip"; then
|
||
print_error "无效的 IPv4 地址"
|
||
exit 1
|
||
fi
|
||
else
|
||
read -p "请输入本地 IPv6 地址: " local_ip
|
||
if ! validate_ipv6 "$local_ip"; then
|
||
print_error "无效的 IPv6 地址"
|
||
exit 1
|
||
fi
|
||
fi
|
||
|
||
# 获取远端 IP
|
||
echo ""
|
||
if [[ $ip_type == "ipv4" ]]; then
|
||
read -p "请输入远端 IPv4 地址: " remote_ip
|
||
if ! validate_ipv4 "$remote_ip"; then
|
||
print_error "无效的 IPv4 地址"
|
||
exit 1
|
||
fi
|
||
else
|
||
read -p "请输入远端 IPv6 地址: " remote_ip
|
||
if ! validate_ipv6 "$remote_ip"; then
|
||
print_error "无效的 IPv6 地址"
|
||
exit 1
|
||
fi
|
||
fi
|
||
fi
|
||
|
||
# 获取接口 - GRE/VXLAN 需要
|
||
local interface=""
|
||
local gateway=""
|
||
|
||
if [[ $tunnel_type != "sshtun" ]]; then
|
||
echo ""
|
||
print_info "选择隧道底层网络接口:"
|
||
|
||
# 列出可用接口
|
||
list_interfaces "$ip_type"
|
||
|
||
# 根据远端 IP 尝试自动检测接口
|
||
auto_interface=$(get_interface_for_ip "$remote_ip" "$ip_type")
|
||
|
||
if [[ -n "$auto_interface" ]]; then
|
||
print_info "自动检测到 $remote_ip 的接口: $auto_interface"
|
||
echo ""
|
||
read -p "按回车使用 [$auto_interface]，或输入其他接口名: " manual_iface
|
||
if [[ -n "$manual_iface" ]]; then
|
||
interface="$manual_iface"
|
||
else
|
||
interface="$auto_interface"
|
||
fi
|
||
else
|
||
read -p "请输入接口名称 (例如: ens18, eth0): " interface
|
||
fi
|
||
|
||
if [[ -z "$interface" ]]; then
|
||
print_error "接口不能为空"
|
||
exit 1
|
||
fi
|
||
|
||
# 验证接口存在
|
||
if ! ip link show "$interface" &>/dev/null; then
|
||
print_error "接口 '$interface' 不存在"
|
||
exit 1
|
||
fi
|
||
|
||
print_info "已选择接口: $interface"
|
||
|
||
# IPv6 需要网关用于 PBR
|
||
if [[ $ip_type == "ipv6" ]]; then
|
||
echo ""
|
||
# 方法1: 获取特定远端 IP 的网关（最准确）
|
||
gateway=$(get_gateway_for_ip "$remote_ip" "$ip_type")
|
||
|
||
# 方法2: 回退到默认网关
|
||
if [[ -z "$gateway" ]]; then
|
||
gateway=$(get_default_gateway "$interface" "$ip_type")
|
||
fi
|
||
|
||
if [[ -n "$gateway" ]]; then
|
||
print_info "自动检测到网关: $gateway"
|
||
read -p "按回车使用此网关，或输入其他网关: " custom_gw
|
||
if [[ -n "$custom_gw" ]]; then
|
||
gateway="$custom_gw"
|
||
fi
|
||
else
|
||
print_warn "无法自动检测网关"
|
||
read -p "请输入网关 IPv6 地址 (点对点链路可留空): " gateway
|
||
fi
|
||
print_info "PBR 网关: ${gateway:-<无，直接使用接口>}"
|
||
fi
|
||
fi
|
||
|
||
if [[ $tunnel_type == "vxlan" ]]; then
|
||
# 获取 VXLAN 端口
|
||
echo ""
|
||
read -p "请输入 VXLAN 目标端口 [默认: 4789]: " dst_port
|
||
dst_port=${dst_port:-4789}
|
||
|
||
# 获取 VNI
|
||
echo ""
|
||
read -p "请输入 VXLAN 网络标识符 (VNI) [默认: 100]: " vni
|
||
vni=${vni:-100}
|
||
fi
|
||
|
||
# 确认设置
|
||
echo ""
|
||
echo "========================================"
|
||
echo "配置摘要:"
|
||
echo "========================================"
|
||
echo "隧道名称: $tunnel_name"
|
||
echo "隧道类型: $tunnel_type"
|
||
if [[ $tunnel_type == "sshtun" ]]; then
|
||
echo "角色: $ssh_role"
|
||
echo "对端 IP: ${remote_ip:-<可选>}"
|
||
echo "SSH 端口: $ssh_port"
|
||
echo "SSH 用户: $ssh_user"
|
||
echo "隧道 IP 类型: $tunnel_ip_type"
|
||
echo "本地隧道 IP: $tunnel_ip_local"
|
||
echo "对端隧道 IP: $tunnel_ip_remote"
|
||
else
|
||
echo "IP 版本: $ip_type"
|
||
echo "本地 IP: $local_ip"
|
||
echo "远端 IP: $remote_ip"
|
||
echo "接口: $interface"
|
||
if [[ $tunnel_type == "vxlan" ]]; then
|
||
echo "目标端口: $dst_port"
|
||
echo "VNI: $vni"
|
||
fi
|
||
if [[ $ip_type == "ipv6" ]]; then
|
||
echo "网关: ${gateway:-<无>}"
|
||
echo "PBR: 已启用 (使用专用路由表)"
|
||
fi
|
||
fi
|
||
echo "========================================"
|
||
echo ""
|
||
read -p "生成服务文件? [Y/n]: " confirm
|
||
|
||
if [[ "$confirm" =~ ^[Nn]$ ]]; then
|
||
print_info "已取消"
|
||
exit 0
|
||
fi
|
||
|
||
# 生成服务文件
|
||
if [[ $tunnel_type == "gre" ]]; then
|
||
generate_gre_service "$tunnel_name" "$remote_ip" "$local_ip" "$ip_type" "$interface" "$gateway"
|
||
elif [[ $tunnel_type == "vxlan" ]]; then
|
||
generate_vxlan_service "$tunnel_name" "$remote_ip" "$local_ip" "$dst_port" "$vni" "$ip_type" "$interface" "$gateway"
|
||
elif [[ $tunnel_type == "sshtun" ]]; then
|
||
local local_ip=""
|
||
[[ -z "$remote_ip" ]] && remote_ip="none"
|
||
generate_sshtun_service "$tunnel_name" "$remote_ip" "$local_ip" "$tunnel_ip_local" "$tunnel_ip_remote" "$ssh_port" "$ssh_user" "$ssh_role" "$tunnel_ip_type"
|
||
fi
|
||
|
||
# 显示生成的文件
|
||
echo ""
|
||
echo "========================================"
|
||
echo "生成的服务文件:"
|
||
echo "========================================"
|
||
cat "/etc/systemd/system/${tunnel_name}.service"
|
||
echo "========================================"
|
||
echo ""
|
||
|
||
# 询问是否启用并启动
|
||
read -p "立即启用并启动服务? [Y/n]: " enable_now
|
||
|
||
if [[ ! "$enable_now" =~ ^[Nn]$ ]]; then
|
||
systemctl daemon-reload
|
||
systemctl enable "${tunnel_name}.service"
|
||
systemctl start "${tunnel_name}.service"
|
||
|
||
echo ""
|
||
systemctl status "${tunnel_name}.service" --no-pager
|
||
|
||
# 显示隧道接口
|
||
echo ""
|
||
if [[ $tunnel_type == "sshtun" ]]; then
|
||
if [[ $ssh_role == "server" ]]; then
|
||
print_info "SSH TUN 服务端已就绪"
|
||
echo ""
|
||
echo "下一步操作:"
|
||
echo " 1. 确保客户端的 SSH 公钥已添加到本机"
|
||
echo " 客户端运行: cat ~/.ssh/id_ed25519.pub"
|
||
echo " 本机执行: echo '<公钥>' >> /root/.ssh/authorized_keys"
|
||
echo ""
|
||
echo " 2. 客户端连接后，运行以下命令配置 IP:"
|
||
echo " /usr/local/sbin/${tunnel_name}-ip-config.sh"
|
||
echo ""
|
||
echo " 3. 验证隧道:"
|
||
echo " ping $tunnel_ip_remote"
|
||
else
|
||
print_info "SSH TUN 客户端服务已启动"
|
||
echo ""
|
||
# 检查 tun0 是否存在
|
||
sleep 3
|
||
if ip link show tun0 &>/dev/null; then
|
||
print_info "隧道接口 tun0 已创建"
|
||
ip addr show tun0
|
||
echo ""
|
||
echo "验证隧道:"
|
||
echo " ping $tunnel_ip_remote"
|
||
else
|
||
print_warn "隧道接口尚未创建，请检查 SSH 连接"
|
||
fi
|
||
fi
|
||
else
|
||
print_info "隧道接口状态:"
|
||
ip link show "$tunnel_name" 2>/dev/null || print_warn "接口未找到 (可能需要手动配置)"
|
||
|
||
if [[ $ip_type == "ipv6" ]]; then
|
||
echo ""
|
||
print_info "IPv6 PBR 规则 (专用表: ${tunnel_name}_underlay):"
|
||
ip -6 rule list priority 50 2>/dev/null || print_warn "优先级 50 没有 PBR 规则"
|
||
ip -6 rule list priority 51 2>/dev/null || print_warn "优先级 51 没有 PBR 规则"
|
||
echo ""
|
||
print_info "${tunnel_name}_underlay 表中的路由:"
|
||
ip -6 route show table "${tunnel_name}_underlay" 2>/dev/null || print_warn "表中没有路由"
|
||
fi
|
||
fi
|
||
else
|
||
print_info "手动启用和启动命令:"
|
||
echo " systemctl daemon-reload"
|
||
echo " systemctl enable ${tunnel_name}.service"
|
||
echo " systemctl start ${tunnel_name}.service"
|
||
fi
|
||
|
||
# IPv6 与 bird 的额外说明 (仅 GRE/VXLAN)
|
||
if [[ $tunnel_type != "sshtun" ]] && [[ $ip_type == "ipv6" ]]; then
|
||
echo ""
|
||
print_info "IPv6 PBR 说明 (bird 兼容性):"
|
||
echo ""
|
||
echo " 已创建专用路由表 '${tunnel_name}_underlay'"
|
||
echo " 用于防止 bird 覆盖隧道端点路由。"
|
||
echo ""
|
||
echo " 工作原理:"
|
||
echo " 1. 到/从隧道端点的流量使用干净的路由表"
|
||
echo " 2. 此表不受 bird 路由通告的影响"
|
||
echo " 3. PBR 规则优先级 50-51 (在 main 表 32766 之前)"
|
||
echo ""
|
||
echo " 验证 PBR 是否工作:"
|
||
echo " ip -6 route get $remote_ip"
|
||
echo " # 应显示: dev $interface (物理接口)，而不是 dev $tunnel_name"
|
||
echo ""
|
||
echo " 检查 PBR 规则:"
|
||
echo " ip -6 rule show | grep priority"
|
||
echo ""
|
||
echo " 检查干净表中的路由:"
|
||
echo " ip -6 route show table ${tunnel_name}_underlay"
|
||
echo ""
|
||
echo " 重要: 如果物理网关变更，请更新:"
|
||
echo " /usr/local/sbin/${tunnel_name}-pbr-setup.sh"
|
||
echo " 然后重启服务: systemctl restart $tunnel_name"
|
||
fi
|
||
|
||
# SSH TUN 额外说明
|
||
if [[ $tunnel_type == "sshtun" ]]; then
|
||
echo ""
|
||
print_info "SSH TUN 隧道说明:"
|
||
echo ""
|
||
echo " 特点:"
|
||
echo " - 基于 SSH 协议，使用 TCP"
|
||
echo " - 适用于 UDP 受限的环境"
|
||
echo " - 客户端主动连接服务端"
|
||
echo ""
|
||
echo " 性能:"
|
||
echo " - 由于 SSH 加密，性能低于 GRE/VXLAN"
|
||
echo " - 典型速度: 100-500 Mbps"
|
||
echo ""
|
||
echo " 注意事项:"
|
||
echo " - 客户端服务会自动重连"
|
||
echo " - 服务端需要手动配置 IP (运行 IP 配置脚本)"
|
||
echo " - 确保 SSH 密钥认证已配置"
|
||
fi
|
||
|
||
print_info "完成!"
|
||
}
|
||
|
||
# 运行主函数
|
||
main "$@"
|