mirror of
https://github.com/Slava-Shchipunov/awg-openwrt.git
synced 2026-03-14 01:13:09 +00:00
Feat/add install script (#31)
* feat: add awg install script * fix: replace curl with wget * fix: add opkg update run * feat: add firewall settings * fix: fix allowed_ips set * fix: add timeout * fix: fix peer create * docs: update readme
This commit is contained in:
Slava-Shchipunov
GitHub
13
README.md
13
README.md
@@ -1,6 +1,12 @@
|
||||
# Автоматическая настройка AmneziaWG для OpenWRT версии 23.05.0 и более новых
|
||||
Для автоматической настройки рекомендую использовать [скрипт](https://github.com/itdoginfo/domain-routing-openwrt) от пользователя itdog. Этот скрипт позволяет автоматически скачать нужные пакеты из собранных здесь и настроить [точечный обход блокировок по доменам](https://habr.com/ru/articles/767464/).
|
||||
|
||||
Если же вам нужно только установить пакеты, я добавил скрипт amneziawg-install - он автоматически скачает пакеты из этого репозитория под ваше устройство (только для стабильной версии OpenWRT), а также предложит сразу настроить интерфейс с протоколом AmneziaWG. Если пользователь согласится, нужно будет ввести параметры конфига, которые запросит скрипт. При этом скрипт создаст интерфейс, настроит для него правила фаерволла, а также **включит перенаправление всего траффика через тунель AmneziaWG** (установит в настройках Peer галочку Route Allowed IPs).
|
||||
Для запуска скрипта подключитесь к роутеру по SSH, введите команду и следуйте инструкциям на экране:
|
||||
```
|
||||
sh <(wget -O - https://raw.githubusercontent.com/Slava-Shchipunov/awg-openwrt/refs/heads/feat/add-install-script/amneziawg-install.sh)
|
||||
```
|
||||
|
||||
# Сборка пакетов для всех устройств, поддерживающих OpenWRT
|
||||
В репозиторий добавлен скрипт, который парсит данные о поддерживаемых платформах со страницы OpenWRT и автоматически запускает сборку пакетов AmneziaWG для всех устройств.
|
||||
На данный момент я собрал пакеты для всех устройств для OpenWRT версий:
|
||||
@@ -9,6 +15,7 @@
|
||||
3) [23.05.2](https://github.com/Slava-Shchipunov/awg-openwrt/releases/tag/v23.05.2)
|
||||
4) [23.05.3](https://github.com/Slava-Shchipunov/awg-openwrt/releases/tag/v23.05.3)
|
||||
5) [23.05.4](https://github.com/Slava-Shchipunov/awg-openwrt/releases/tag/v23.05.4)
|
||||
6) [23.05.5](https://github.com/Slava-Shchipunov/awg-openwrt/releases/tag/v23.05.5)
|
||||
|
||||
И собрал пакеты для популярных устройств для OpenWRT [SNAPSHOT](https://github.com/Slava-Shchipunov/awg-openwrt/releases/tag/SNAPSHOT)
|
||||
|
||||
@@ -41,6 +48,12 @@
|
||||
# Automatic configuration of AmneziaWG for OpenWRT version 23.05.0 and newer
|
||||
For automatic configuration, I recommend using the [script](https://github.com/itdoginfo/domain-routing-openwrt) from the user itdog. This script allows you to automatically download the necessary packages from those collected here and configure [point-by-point bypass of blocking by domains](https://habr.com/ru/articles/767464/) (instructions in Russian).
|
||||
|
||||
If you only need to install packages, I added the amneziawg-install script - it will automatically download packages from this repository for your device (only for the stable version of OpenWRT), and also offer to immediately configure the interface with the AmneziaWG protocol. If the user agrees, you will need to enter the config parameters that the script will request. The script will create an interface, configure firewall rules for it, and also **enable redirection of all traffic through the AmneziaWG tunnel** (check the Route Allowed IPs box in the Peer settings).
|
||||
To run the script, connect to the router via SSH, enter the command and follow the instructions on the screen:
|
||||
```
|
||||
sh <(wget -O - https://raw.githubusercontent.com/Slava-Shchipunov/awg-openwrt/refs/heads/feat/add-install-script/amneziawg-install.sh)
|
||||
```
|
||||
|
||||
# Building packages for all devices that support OpenWRT
|
||||
A script has been added to the repository that parses data on supported platforms from the OpenWRT page and automatically starts building AmneziaWG packages for all devices.
|
||||
At the moment I have collected packages for all devices for OpenWRT versions:
|
||||
|
||||
207
amneziawg-install.sh
Normal file
207
amneziawg-install.sh
Normal file
@@ -0,0 +1,207 @@
|
||||
#!/bin/sh
|
||||
|
||||
#set -x
|
||||
|
||||
#Репозиторий OpenWRT должен быть доступен для установки зависимостей пакета kmod-amneziawg
|
||||
check_repo() {
|
||||
printf "\033[32;1mChecking OpenWrt repo availability...\033[0m\n"
|
||||
opkg update | grep -q "Failed to download" && printf "\033[32;1mopkg failed. Check internet or date. Command for force ntp sync: ntpd -p ptbtime1.ptb.de\033[0m\n" && exit 1
|
||||
}
|
||||
|
||||
install_awg_packages() {
|
||||
# Получение pkgarch с наибольшим приоритетом
|
||||
PKGARCH=$(opkg print-architecture | awk 'BEGIN {max=0} {if ($3 > max) {max = $3; arch = $2}} END {print arch}')
|
||||
|
||||
TARGET=$(ubus call system board | jsonfilter -e '@.release.target' | cut -d '/' -f 1)
|
||||
SUBTARGET=$(ubus call system board | jsonfilter -e '@.release.target' | cut -d '/' -f 2)
|
||||
VERSION=$(ubus call system board | jsonfilter -e '@.release.version')
|
||||
PKGPOSTFIX="_v${VERSION}_${PKGARCH}_${TARGET}_${SUBTARGET}.ipk"
|
||||
BASE_URL="https://github.com/Slava-Shchipunov/awg-openwrt/releases/download/"
|
||||
|
||||
AWG_DIR="/tmp/amneziawg"
|
||||
mkdir -p "$AWG_DIR"
|
||||
|
||||
if opkg list-installed | grep -q kmod-amneziawg; then
|
||||
echo "kmod-amneziawg already installed"
|
||||
else
|
||||
KMOD_AMNEZIAWG_FILENAME="kmod-amneziawg${PKGPOSTFIX}"
|
||||
DOWNLOAD_URL="${BASE_URL}v${VERSION}/${KMOD_AMNEZIAWG_FILENAME}"
|
||||
wget -O "$AWG_DIR/$KMOD_AMNEZIAWG_FILENAME" "$DOWNLOAD_URL"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "kmod-amneziawg file downloaded successfully"
|
||||
else
|
||||
echo "Error downloading kmod-amneziawg. Please, install kmod-amneziawg manually and run the script again"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
opkg install "$AWG_DIR/$KMOD_AMNEZIAWG_FILENAME"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "kmod-amneziawg file downloaded successfully"
|
||||
else
|
||||
echo "Error installing kmod-amneziawg. Please, install kmod-amneziawg manually and run the script again"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if opkg list-installed | grep -q amneziawg-tools; then
|
||||
echo "amneziawg-tools already installed"
|
||||
else
|
||||
AMNEZIAWG_TOOLS_FILENAME="amneziawg-tools${PKGPOSTFIX}"
|
||||
DOWNLOAD_URL="${BASE_URL}v${VERSION}/${AMNEZIAWG_TOOLS_FILENAME}"
|
||||
wget -O "$AWG_DIR/$AMNEZIAWG_TOOLS_FILENAME" "$DOWNLOAD_URL"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "amneziawg-tools file downloaded successfully"
|
||||
else
|
||||
echo "Error downloading amneziawg-tools. Please, install amneziawg-tools manually and run the script again"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
opkg install "$AWG_DIR/$AMNEZIAWG_TOOLS_FILENAME"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "amneziawg-tools file downloaded successfully"
|
||||
else
|
||||
echo "Error installing amneziawg-tools. Please, install amneziawg-tools manually and run the script again"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
if opkg list-installed | grep -q luci-app-amneziawg; then
|
||||
echo "luci-app-amneziawg already installed"
|
||||
else
|
||||
LUCI_APP_AMNEZIAWG_FILENAME="luci-app-amneziawg${PKGPOSTFIX}"
|
||||
DOWNLOAD_URL="${BASE_URL}v${VERSION}/${LUCI_APP_AMNEZIAWG_FILENAME}"
|
||||
wget -O "$AWG_DIR/$LUCI_APP_AMNEZIAWG_FILENAME" "$DOWNLOAD_URL"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "luci-app-amneziawg file downloaded successfully"
|
||||
else
|
||||
echo "Error downloading luci-app-amneziawg. Please, install luci-app-amneziawg manually and run the script again"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
opkg install "$AWG_DIR/$LUCI_APP_AMNEZIAWG_FILENAME"
|
||||
|
||||
if [ $? -eq 0 ]; then
|
||||
echo "luci-app-amneziawg file downloaded successfully"
|
||||
else
|
||||
echo "Error installing luci-app-amneziawg. Please, install luci-app-amneziawg manually and run the script again"
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
rm -rf "$AWG_DIR"
|
||||
}
|
||||
|
||||
configure_amneziawg_interface() {
|
||||
INTERFACE_NAME="awg1"
|
||||
CONFIG_NAME="amneziawg_awg1"
|
||||
PROTO="amneziawg"
|
||||
ZONE_NAME="awg1"
|
||||
|
||||
read -r -p "Enter the private key (from [Interface]):"$'\n' AWG_PRIVATE_KEY_INT
|
||||
|
||||
while true; do
|
||||
read -r -p "Enter internal IP address with subnet, example 192.168.100.5/24 (from [Interface]):"$'\n' AWG_IP
|
||||
if echo "$AWG_IP" | egrep -oq '^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]+$'; then
|
||||
break
|
||||
else
|
||||
echo "This IP is not valid. Please repeat"
|
||||
fi
|
||||
done
|
||||
|
||||
read -r -p "Enter the public key (from [Peer]):"$'\n' AWG_PUBLIC_KEY_INT
|
||||
read -r -p "If use PresharedKey, Enter this (from [Peer]). If your don't use leave blank:"$'\n' AWG_PRESHARED_KEY_INT
|
||||
read -r -p "Enter Endpoint host without port (Domain or IP) (from [Peer]):"$'\n' AWG_ENDPOINT_INT
|
||||
|
||||
read -r -p "Enter Endpoint host port (from [Peer]) [51820]:"$'\n' AWG_ENDPOINT_PORT_INT
|
||||
AWG_ENDPOINT_PORT_INT=${AWG_ENDPOINT_PORT_INT:-51820}
|
||||
if [ "$AWG_ENDPOINT_PORT_INT" = '51820' ]; then
|
||||
echo $AWG_ENDPOINT_PORT_INT
|
||||
fi
|
||||
|
||||
read -r -p "Enter Jc value (from [Interface]):"$'\n' AWG_JC
|
||||
read -r -p "Enter Jmin value (from [Interface]):"$'\n' AWG_JMIN
|
||||
read -r -p "Enter Jmax value (from [Interface]):"$'\n' AWG_JMAX
|
||||
read -r -p "Enter S1 value (from [Interface]):"$'\n' AWG_S1
|
||||
read -r -p "Enter S2 value (from [Interface]):"$'\n' AWG_S2
|
||||
read -r -p "Enter H1 value (from [Interface]):"$'\n' AWG_H1
|
||||
read -r -p "Enter H2 value (from [Interface]):"$'\n' AWG_H2
|
||||
read -r -p "Enter H3 value (from [Interface]):"$'\n' AWG_H3
|
||||
read -r -p "Enter H4 value (from [Interface]):"$'\n' AWG_H4
|
||||
|
||||
uci set network.${INTERFACE_NAME}=interface
|
||||
uci set network.${INTERFACE_NAME}.proto=$PROTO
|
||||
uci set network.${INTERFACE_NAME}.private_key=$AWG_PRIVATE_KEY_INT
|
||||
uci set network.${INTERFACE_NAME}.listen_port='51821'
|
||||
uci set network.${INTERFACE_NAME}.addresses=$AWG_IP
|
||||
|
||||
uci set network.${INTERFACE_NAME}.awg_jc=$AWG_JC
|
||||
uci set network.${INTERFACE_NAME}.awg_jmin=$AWG_JMIN
|
||||
uci set network.${INTERFACE_NAME}.awg_jmax=$AWG_JMAX
|
||||
uci set network.${INTERFACE_NAME}.awg_s1=$AWG_S1
|
||||
uci set network.${INTERFACE_NAME}.awg_s2=$AWG_S2
|
||||
uci set network.${INTERFACE_NAME}.awg_h1=$AWG_H1
|
||||
uci set network.${INTERFACE_NAME}.awg_h2=$AWG_H2
|
||||
uci set network.${INTERFACE_NAME}.awg_h3=$AWG_H3
|
||||
uci set network.${INTERFACE_NAME}.awg_h4=$AWG_H4
|
||||
|
||||
if ! uci show network | grep -q ${CONFIG_NAME}; then
|
||||
uci add network ${CONFIG_NAME}
|
||||
fi
|
||||
|
||||
uci set network.@${CONFIG_NAME}[0]=$CONFIG_NAME
|
||||
uci set network.@${CONFIG_NAME}[0].name="${INTERFACE_NAME}_client"
|
||||
uci set network.@${CONFIG_NAME}[0].public_key=$AWG_PUBLIC_KEY_INT
|
||||
uci set network.@${CONFIG_NAME}[0].preshared_key=$AWG_PRESHARED_KEY_INT
|
||||
uci set network.@${CONFIG_NAME}[0].route_allowed_ips='1'
|
||||
uci set network.@${CONFIG_NAME}[0].persistent_keepalive='25'
|
||||
uci set network.@${CONFIG_NAME}[0].endpoint_host=$AWG_ENDPOINT_INT
|
||||
uci set network.@${CONFIG_NAME}[0].allowed_ips='0.0.0.0/0'
|
||||
uci add_list network.@${CONFIG_NAME}[0].allowed_ips='::/0'
|
||||
uci set network.@${CONFIG_NAME}[0].endpoint_port=$AWG_ENDPOINT_PORT_INT
|
||||
uci commit network
|
||||
|
||||
if ! uci show firewall | grep -q "@zone.*name='${ZONE_NAME}'"; then
|
||||
printf "\033[32;1mZone Create\033[0m\n"
|
||||
uci add firewall zone
|
||||
uci set firewall.@zone[-1].name=$ZONE_NAME
|
||||
uci set firewall.@zone[-1].network=$INTERFACE_NAME
|
||||
uci set firewall.@zone[-1].forward='REJECT'
|
||||
uci set firewall.@zone[-1].output='ACCEPT'
|
||||
uci set firewall.@zone[-1].input='REJECT'
|
||||
uci set firewall.@zone[-1].masq='1'
|
||||
uci set firewall.@zone[-1].mtu_fix='1'
|
||||
uci set firewall.@zone[-1].family='ipv4'
|
||||
uci commit firewall
|
||||
fi
|
||||
|
||||
if ! uci show firewall | grep -q "@forwarding.*name='${ZONE_NAME}'"; then
|
||||
printf "\033[32;1mConfigured forwarding\033[0m\n"
|
||||
uci add firewall forwarding
|
||||
uci set firewall.@forwarding[-1]=forwarding
|
||||
uci set firewall.@forwarding[-1].name="${ZONE_NAME}-lan"
|
||||
uci set firewall.@forwarding[-1].dest=${ZONE_NAME}
|
||||
uci set firewall.@forwarding[-1].src='lan'
|
||||
uci set firewall.@forwarding[-1].family='ipv4'
|
||||
uci commit firewall
|
||||
fi
|
||||
}
|
||||
|
||||
check_repo
|
||||
|
||||
install_awg_packages
|
||||
|
||||
printf "\033[32;1mDo you want to configure the amneziawg interface? (y/n): \033[0m\n"
|
||||
read IS_SHOULD_CONFIGURE_AWG_INTERFACE
|
||||
|
||||
if [ "$IS_SHOULD_CONFIGURE_AWG_INTERFACE" = "y" ] || [ "$IS_SHOULD_CONFIGURE_AWG_INTERFACE" = "Y" ]; then
|
||||
configure_amneziawg_interface
|
||||
else
|
||||
printf "\033[32;1mSkipping amneziawg interface configuration.\033[0m\n"
|
||||
fi
|
||||
|
||||
service network restart
|
||||
Reference in New Issue
Block a user