153 lines
4.4 KiB
Bash
153 lines
4.4 KiB
Bash
#!/usr/bin/env bash
|
|
# Server-side core (entrypoint) for GS-Warp
|
|
# Created by Luxferre in 2026, released into the public domain
|
|
|
|
set -e
|
|
|
|
# Ensure TUN device node exists in container namespace
|
|
if [ ! -c /dev/net/tun ]; then
|
|
mkdir -p /dev/net
|
|
mknod /dev/net/tun c 10 200
|
|
chmod 600 /dev/net/tun
|
|
fi
|
|
|
|
# Force public DNS resolvers inside container for GSocket relay lookup
|
|
echo "nameserver 1.1.1.1" > /etc/resolv.conf
|
|
echo "nameserver 8.8.8.8" >> /etc/resolv.conf
|
|
|
|
# 1. Generate Certificates & OpenVPN Configs (OpenSSL 3.x compliant)
|
|
if [ ! -f /vpn/server.conf ]; then
|
|
echo "[+] Generating OpenSSL 3.x compliant SSL/TLS Certificates..."
|
|
|
|
# A. Generate CA
|
|
openssl req -x509 -newkey rsa:2048 -nodes \
|
|
-keyout /vpn/ca.key -out /vpn/ca.crt -days 3650 \
|
|
-subj "/CN=GSocket-CA" \
|
|
-addext "basicConstraints=critical,CA:TRUE" \
|
|
-addext "keyUsage=critical,keyCertSign,cRLSign" >/dev/null 2>&1
|
|
|
|
# B. Generate Server Cert
|
|
cat <<EOF > /vpn/server_ext.cnf
|
|
basicConstraints = CA:FALSE
|
|
keyUsage = digitalSignature, keyEncipherment
|
|
extendedKeyUsage = serverAuth
|
|
subjectAltName = DNS:gsocket, IP:127.0.0.1
|
|
EOF
|
|
|
|
openssl req -newkey rsa:2048 -nodes -keyout /vpn/server.key -out /vpn/server.csr -subj "/CN=GSocket-Server" >/dev/null 2>&1
|
|
openssl x509 -req -in /vpn/server.csr -CA /vpn/ca.crt -CAkey /vpn/ca.key -CAcreateserial \
|
|
-out /vpn/server.crt -days 3650 -extfile /vpn/server_ext.cnf >/dev/null 2>&1
|
|
|
|
# C. Generate Client Cert
|
|
cat <<EOF > /vpn/client_ext.cnf
|
|
basicConstraints = CA:FALSE
|
|
keyUsage = digitalSignature
|
|
extendedKeyUsage = clientAuth
|
|
EOF
|
|
|
|
openssl req -newkey rsa:2048 -nodes -keyout /vpn/client.key -out /vpn/client.csr -subj "/CN=GSocket-Client" >/dev/null 2>&1
|
|
openssl x509 -req -in /vpn/client.csr -CA /vpn/ca.crt -CAkey /vpn/ca.key -CAcreateserial \
|
|
-out /vpn/client.crt -days 3650 -extfile /vpn/client_ext.cnf >/dev/null 2>&1
|
|
|
|
# D. Generate TLS-Crypt Key
|
|
openvpn --genkey secret /vpn/tls-crypt.key
|
|
|
|
# E. OpenVPN Server Config (uses 'topology subnet' & 'redirect-gateway local')
|
|
cat <<EOF > /vpn/server.conf
|
|
dev tun
|
|
topology subnet
|
|
ca /vpn/ca.crt
|
|
cert /vpn/server.crt
|
|
key /vpn/server.key
|
|
dh none
|
|
ecdh-curve prime256v1
|
|
tls-crypt /vpn/tls-crypt.key
|
|
server 10.8.0.0 255.255.255.0
|
|
push "redirect-gateway def1 local bypass-dhcp"
|
|
push "dhcp-option DNS 1.1.1.1"
|
|
push "dhcp-option DNS 8.8.8.8"
|
|
keepalive 10 60
|
|
cipher AES-256-GCM
|
|
data-ciphers AES-256-GCM:AES-128-GCM
|
|
persist-key
|
|
persist-tun
|
|
tun-mtu 1300
|
|
mssfix 1200
|
|
EOF
|
|
|
|
# F. Unified Client Config (Embedded relay routes via net_gateway)
|
|
cat <<EOF > /vpn/client.ovpn
|
|
client
|
|
dev tun
|
|
proto tcp-client
|
|
remote 127.0.0.1 1194
|
|
resolv-retry infinite
|
|
nobind
|
|
persist-key
|
|
persist-tun
|
|
remote-cert-tls server
|
|
cipher AES-256-GCM
|
|
tun-mtu 1300
|
|
mssfix 1200
|
|
|
|
# Native OpenVPN routes to bypass GSocket relay nodes via physical default gateway
|
|
route j.gs.thc.org 255.255.255.255 net_gateway
|
|
route a.gs.thc.org 255.255.255.255 net_gateway
|
|
route b.gs.thc.org 255.255.255.255 net_gateway
|
|
route c.gs.thc.org 255.255.255.255 net_gateway
|
|
route g.gs.thc.org 255.255.255.255 net_gateway
|
|
|
|
<ca>
|
|
$(cat /vpn/ca.crt)
|
|
</ca>
|
|
<cert>
|
|
$(cat /vpn/client.crt)
|
|
</cert>
|
|
<key>
|
|
$(cat /vpn/client.key)
|
|
</key>
|
|
<tls-crypt>
|
|
$(cat /vpn/tls-crypt.key)
|
|
</tls-crypt>
|
|
EOF
|
|
|
|
echo "[+] Client config generated at /vpn/client.ovpn"
|
|
fi
|
|
|
|
# 2. Configure Networking & IPTables inside Container
|
|
WAN_IF=$(ip route show default | awk '/default/ {print $5}' | head -n1)
|
|
echo "[+] Container WAN Interface detected: $WAN_IF"
|
|
|
|
if [ "$(cat /proc/sys/net/ipv4/ip_forward 2>/dev/null)" = "1" ]; then
|
|
echo "[+] IPv4 forwarding is active."
|
|
else
|
|
echo "[!] WARNING: IPv4 forwarding is not active in this container!"
|
|
fi
|
|
|
|
echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter 2>/dev/null || true
|
|
echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter 2>/dev/null || true
|
|
|
|
iptables -F
|
|
iptables -t nat -F
|
|
|
|
iptables -A INPUT -i tun+ -j ACCEPT
|
|
iptables -A OUTPUT -o tun+ -j ACCEPT
|
|
iptables -A FORWARD -i tun+ -j ACCEPT
|
|
iptables -A FORWARD -o tun+ -j ACCEPT
|
|
|
|
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
|
|
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1200
|
|
|
|
# 3. Start OpenVPN daemon
|
|
echo "[+] Starting local OpenVPN daemon on 127.0.0.1:1194..."
|
|
openvpn --config /vpn/server.conf \
|
|
--proto tcp4-server \
|
|
--local 127.0.0.1 \
|
|
--lport 1194 &
|
|
|
|
sleep 2
|
|
|
|
# 4. Forward GSocket stream directly to 127.0.0.1:1194
|
|
echo "[+] Starting gs-netcat port forwarder..."
|
|
exec gs-netcat -l -d 127.0.0.1 -p 1194 -s $(md5sum /vpn/client.ovpn | cut -d ' ' -f 1)
|