#!/bin/bash

set -e

if [ "$EUID" -ne 0 ]; then
    echo "Запустите от root"
    exit 1
fi


usage() {
    echo ""
    echo "Использование:"
    echo ""
    echo "./$0 --server IP --name-con ИМЯ --ipsec-pass PSK --user USER --password PASS"
    echo ""
    echo "Пример:"
    echo "./$0 --server 195.2.76.129 --name-con c129 --ipsec-pass secret --user user --password password"
    echo ""
    exit 1
}


SERVER=""
CON_NAME=""
IPSEC_PASS=""
PPP_USER=""
PPP_PASS=""


while [[ $# -gt 0 ]]; do
    case $1 in
        --server)
            SERVER="$2"
            shift 2
            ;;
        --name-con)
            CON_NAME="$2"
            shift 2
            ;;
        --ipsec-pass)
            IPSEC_PASS="$2"
            shift 2
            ;;
        --user)
            PPP_USER="$2"
            shift 2
            ;;
        --password)
            PPP_PASS="$2"
            shift 2
            ;;
        *)
            usage
            ;;
    esac
done


if [[ -z "$SERVER" || -z "$CON_NAME" || -z "$IPSEC_PASS" || -z "$PPP_USER" || -z "$PPP_PASS" ]]; then
    usage
fi


echo "[+] Установка пакетов"

apt update
apt install -y strongswan xl2tpd iptables


echo "[+] Определение интерфейса"

WAN_IF=$(ip route | awk '/default/ {print $5; exit}')

if [ -z "$WAN_IF" ]; then
    echo "Не найден интерфейс"
    exit 1
fi

echo "[+] Интерфейс: $WAN_IF"



echo "[+] Включение forwarding"

#grep -q "net.ipv4.ip_forward=1" /etc/sysctl.conf || \
#echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

grep -q "^net.ipv4.ip_forward=1$" /etc/sysctl.conf || \
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf

sysctl -w net.ipv4.ip_forward=1
sysctl -p



echo "[+] Создание /etc/ipsec.conf"

if [ ! -f /etc/ipsec.conf ]; then
    cat > /etc/ipsec.conf <<EOF
config setup
  uniqueids=yes

EOF
fi

cat >> /etc/ipsec.conf <<EOF
conn $CON_NAME
  keyexchange=ikev1
  left=%defaultroute
  leftauth=psk
  right=$SERVER
  rightauth=psk
  type=transport
  authby=secret
  auto=start
  ike=aes256-sha1-modp1024,3des-sha1-modp1024!
  esp=aes256-sha1,3des-sha1!

EOF



echo "[+] Создание /etc/ipsec.secrets"

if [ ! -f /etc/ipsec.secrets ]; then
    touch /etc/ipsec.secrets
fi

echo "%any $SERVER : PSK \"$IPSEC_PASS\"" >> /etc/ipsec.secrets



echo "[+] Настройка xl2tpd"

if [ ! -f /etc/xl2tpd/xl2tpd.conf ]; then
    cat > /etc/xl2tpd/xl2tpd.conf <<EOF
[lac $CON_NAME]
lns = $SERVER
autodial = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd.client.$CON_NAME
length bit = yes
redial = yes
redial timeout = 5
max redials = 99999999
EOF
else
    cat >> /etc/xl2tpd/xl2tpd.conf <<EOF

[lac $CON_NAME]
lns = $SERVER
autodial = yes
ppp debug = yes
pppoptfile = /etc/ppp/options.xl2tpd.client.$CON_NAME
length bit = yes
redial = yes
redial timeout = 5
max redials = 99999999
EOF
fi



echo "[+] Настройка PPP"

cat > /etc/ppp/options.xl2tpd.client.$CON_NAME <<EOF
ipcp-accept-local
ipcp-accept-remote
refuse-eap
refuse-pap
refuse-chap
refuse-mschap
require-mschap-v2
noccp
noauth
idle 1800
mtu 1410
mru 1410
defaultroute
usepeerdns
debug
connect-delay 5000
name "$PPP_USER"
password "$PPP_PASS"
EOF



echo "[+] Настройка NAT"

if [ ! -f /etc/ppp/ip-down.d/iptables-masquerade ]; then
    cat > /etc/ppp/ip-down.d/iptables-masquerade <<EOF
#!/bin/sh
iptables -t nat -D POSTROUTING -s \$5 -o $WAN_IF -j MASQUERADE
EOF
    chmod +x /etc/ppp/ip-down.d/iptables-masquerade
fi

if [ ! -f /etc/ppp/ip-up.d/iptables-masquerade ]; then
    cat > /etc/ppp/ip-up.d/iptables-masquerade <<EOF
#!/bin/sh
iptables -t nat -A POSTROUTING -s \$5 -o $WAN_IF -j MASQUERADE
EOF
    chmod +x /etc/ppp/ip-up.d/iptables-masquerade
fi



echo "[+] strongswan.conf"

cat > /etc/strongswan.conf <<EOF
charon {
  load_modular = yes
  plugins {
      include strongswan.d/charon/*.conf
  }
}

include strongswan.d/*.conf
EOF



echo "[+] Перезапуск сервисов"

systemctl restart strongswan-starter
systemctl restart xl2tpd


echo ""
echo "================================"
echo "Установка завершена"
echo ""
echo "Соединение : $CON_NAME"
echo "CHR        : $SERVER"
echo "Интерфейс  : $WAN_IF"
echo ""
echo "Проверка:"
echo "ipsec status"
echo "journalctl -u xl2tpd -f"
echo "================================"