luxferre/gs-warp
1
0
Fork 0
Code Actions Activity
Files
c47eb40f9c59f8970dce8efe44d405d17ca96681
gs-warp/server/entrypoint.sh
T
Luxferre c47eb40f9c enabled multiconnectoin
2026-07-26 10:27:04 +03:00

177 lines
5.4 KiB
Bash
Raw Blame History

#!/usr/bin/env bash
# Server-side core (entrypoint) for GS-Warp
# Created by Luxferre in 2026, released into the public domain
set -e
# Ensure TUN device node exists in container namespace
if [ ! -c /dev/net/tun ]; then
mkdir -p /dev/net
mknod /dev/net/tun c 10 200
chmod 600 /dev/net/tun
fi
# Force public DNS resolvers inside container for GSocket relay lookup
echo "nameserver 1.1.1.1" > /etc/resolv.conf
echo "nameserver 8.8.8.8" >> /etc/resolv.conf
# 1. Generate Certificates & OpenVPN Configs (OpenSSL 3.x compliant)
if [ ! -f /vpn/server.conf ]; then
echo "[+] Generating OpenSSL 3.x compliant SSL/TLS Certificates..."
# A. Generate CA
openssl req -x509 -newkey rsa:2048 -nodes \
-keyout /vpn/ca.key -out /vpn/ca.crt -days 3650 \
-subj "/CN=GSocket-CA" \
-addext "basicConstraints=critical,CA:TRUE" \
-addext "keyUsage=critical,keyCertSign,cRLSign" >/dev/null 2>&1
# B. Generate Server Cert
cat <<EOF > /vpn/server_ext.cnf
basicConstraints = CA:FALSE
keyUsage = digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth
subjectAltName = DNS:gsocket, IP:127.0.0.1
EOF
openssl req -newkey rsa:2048 -nodes -keyout /vpn/server.key -out /vpn/server.csr -subj "/CN=GSocket-Server" >/dev/null 2>&1
openssl x509 -req -in /vpn/server.csr -CA /vpn/ca.crt -CAkey /vpn/ca.key -CAcreateserial \
-out /vpn/server.crt -days 3650 -extfile /vpn/server_ext.cnf >/dev/null 2>&1
# C. Generate Client Cert
cat <<EOF > /vpn/client_ext.cnf
basicConstraints = CA:FALSE
keyUsage = digitalSignature
extendedKeyUsage = clientAuth
EOF
openssl req -newkey rsa:2048 -nodes -keyout /vpn/client.key -out /vpn/client.csr -subj "/CN=GSocket-Client" >/dev/null 2>&1
openssl x509 -req -in /vpn/client.csr -CA /vpn/ca.crt -CAkey /vpn/ca.key -CAcreateserial \
-out /vpn/client.crt -days 3650 -extfile /vpn/client_ext.cnf >/dev/null 2>&1
# D. Generate TLS-Crypt Key
openvpn --genkey secret /vpn/tls-crypt.key
# E. OpenVPN Server Config (uses 'topology subnet' & 'redirect-gateway local')
cat <<EOF > /vpn/server.conf
dev tun
topology subnet
proto tcp-server
ca /vpn/ca.crt
cert /vpn/server.crt
key /vpn/server.key
dh none
ecdh-curve prime256v1
tls-crypt /vpn/tls-crypt.key
server 10.8.0.0 255.255.255.0
duplicate-cn
push "redirect-gateway def1 local bypass-dhcp"
push "dhcp-option DNS 1.1.1.1"
push "dhcp-option DNS 8.8.8.8"
keepalive 10 60
cipher AES-256-GCM
data-ciphers AES-256-GCM:AES-128-GCM
persist-key
persist-tun
tun-mtu 1300
mssfix 1200
EOF
# F. Unified Client Config (Embedded relay routes via net_gateway)
cat <<EOF > /vpn/client.ovpn
client
dev tun
proto tcp-client
remote 127.0.0.1 1194
resolv-retry infinite
nobind
persist-key
persist-tun
remote-cert-tls server
cipher AES-256-GCM
tun-mtu 1300
mssfix 1200
# Native OpenVPN routes to bypass GSocket relay nodes via physical default gateway
route gs.thc.org 255.255.255.255 net_gateway
route a.gs.thc.org 255.255.255.255 net_gateway
route b.gs.thc.org 255.255.255.255 net_gateway
route c.gs.thc.org 255.255.255.255 net_gateway
route d.gs.thc.org 255.255.255.255 net_gateway
route e.gs.thc.org 255.255.255.255 net_gateway
route f.gs.thc.org 255.255.255.255 net_gateway
route g.gs.thc.org 255.255.255.255 net_gateway
route h.gs.thc.org 255.255.255.255 net_gateway
route i.gs.thc.org 255.255.255.255 net_gateway
route j.gs.thc.org 255.255.255.255 net_gateway
route k.gs.thc.org 255.255.255.255 net_gateway
route l.gs.thc.org 255.255.255.255 net_gateway
route m.gs.thc.org 255.255.255.255 net_gateway
route n.gs.thc.org 255.255.255.255 net_gateway
route o.gs.thc.org 255.255.255.255 net_gateway
route p.gs.thc.org 255.255.255.255 net_gateway
route q.gs.thc.org 255.255.255.255 net_gateway
route r.gs.thc.org 255.255.255.255 net_gateway
route s.gs.thc.org 255.255.255.255 net_gateway
route t.gs.thc.org 255.255.255.255 net_gateway
route u.gs.thc.org 255.255.255.255 net_gateway
route v.gs.thc.org 255.255.255.255 net_gateway
route w.gs.thc.org 255.255.255.255 net_gateway
route x.gs.thc.org 255.255.255.255 net_gateway
route y.gs.thc.org 255.255.255.255 net_gateway
route z.gs.thc.org 255.255.255.255 net_gateway
<ca>
$(cat /vpn/ca.crt)
</ca>
<cert>
$(cat /vpn/client.crt)
</cert>
<key>
$(cat /vpn/client.key)
</key>
<tls-crypt>
$(cat /vpn/tls-crypt.key)
</tls-crypt>
EOF
echo "[+] Client config generated at /vpn/client.ovpn"
fi
# 2. Configure Networking & IPTables inside Container
WAN_IF=$(ip route show default | awk '/default/ {print $5}' | head -n1)
echo "[+] Container WAN Interface detected: $WAN_IF"
if [ "$(cat /proc/sys/net/ipv4/ip_forward 2>/dev/null)" = "1" ]; then
echo "[+] IPv4 forwarding is active."
else
echo "[!] WARNING: IPv4 forwarding is not active in this container!"
fi
echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter 2>/dev/null || true
echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter 2>/dev/null || true
iptables -F
iptables -t nat -F
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A FORWARD -i tun+ -j ACCEPT
iptables -A FORWARD -o tun+ -j ACCEPT
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j MASQUERADE
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1200
# 3. Start OpenVPN daemon
echo "[+] Starting local OpenVPN daemon on 127.0.0.1:1194..."
openvpn --config /vpn/server.conf \
--proto tcp4-server \
--local 127.0.0.1 \
--lport 1194 &
sleep 2
# 4. Forward GSocket stream directly to 127.0.0.1:1194
echo "[+] Starting gs-netcat port forwarder..."
exec gs-netcat -l -d 127.0.0.1 -p 1194 -s $(md5sum /vpn/client.ovpn | cut -d ' ' -f 1)
View Git Blame Copy Permalink