家庭网关斐讯 k3 面向公网篇

#!/bin/shCF_API_KEY=替换为你的 API_KEYCF_ZONE_ID=替换为你的 ZONE_IDCF_DNS_ID=替换为你的 DNS_IDEMAIL=替换为你的邮箱形式的帐号名ROUTER_NETWORK_DEVICE=替换为你的 wan 口接口，易雾君的是pppoe-wanTEMP_FILE_PATH=/tmp/cloudflare-ddns/DNS_RECORD=替换为你的网关域名，易雾君的是 vnet.evling.me
if [ ! -d "$TEMP_FILE_PATH" ]; then    mkdir -p ${TEMP_FILE_PATH}fi
ifconfig $ROUTER_NETWORK_DEVICE | awk -F'[ ]+|:' '/inet /{print $4}'>${TEMP_FILE_PATH}/current_ip.txt
if [ -f ${TEMP_FILE_PATH}/current_ip.txt ] && [ -f ${TEMP_FILE_PATH}/current_resolving.txt ]; then    if [ "$(cat ${TEMP_FILE_PATH}/current_ip.txt)" == "$(cat ${TEMP_FILE_PATH}/current_resolving.txt)" ]; then        exit 1    fifi
CURRENT_IP="$(cat ${TEMP_FILE_PATH}/current_ip.txt)"curl -k -X PUT "https://api.cloudflare.com/client/v4/zones/${CF_ZONE_ID}/dns_records/${CF_DNS_ID}" \-H "X-Auth-Email:${EMAIL}" \-H "X-Auth-Key:${CF_API_KEY}" \-H "Content-Type: application/json" \--data '{"type":"A","name":"'$DNS_RECORD'","content":"'$CURRENT_IP'","ttl":1,"proxied":false}' && echo ${CURRENT_IP} > ${TEMP_FILE_PATH}/current_resolving.txt

* * * * *       /etc/k3/ddns.sh

sed -i 's/downloads.lede-project.org/mirrors.ustc.edu.cn\/openwrt/g' /etc/opkg/distfeeds.confopkg update && opkg install curlchmod +x /etc/k3/ddns.sh

# Base installkitsopkg update && opkg install openvpn-easy-rsa luci-app-openvpn openvpn-openssl
# Base varsOVPN_DIR="/etc/openvpn"OVPN_PKI="/etc/easy-rsa/pki"OVPN_PORT="1194"OVPN_PROTO="udp"OVPN_POOL="192.168.8.0 255.255.255.0"OVPN_DNS="${OVPN_POOL%.* *}.1"OVPN_DOMAIN="$(uci get dhcp.@dnsmasq[0].domain)"OVPN_SERV="vnet.evling.me" # Please change to yours
# Configuration parametersexport EASYRSA_KEY_SIZE="2048"export EASYRSA_PKI="${OVPN_PKI}"export EASYRSA_REQ_CN="ovpnca"export EASYRSA_BATCH="1"
# Remove and re-initialize the PKI directoryecho yes | easyrsa init-pki
# Generate DH parameterseasyrsa gen-dh# Create a new CAecho -e "\n" | easyrsa build-ca nopass
# Generate a key pair and sign locally for a servereasyrsa build-server-full server nopass# Generate a key pair and sign locally for a clienteasyrsa build-client-full client nopass# Generate TLS PSKopenvpn --genkey --secret /etc/easy-rsa/pki/tc.pem
# Configure firewalluci rename firewall.@zone[0]="lan"uci rename firewall.@zone[1]="wan"uci del_list firewall.lan.device="tun+"uci add_list firewall.lan.device="tun+"uci -q delete firewall.ovpnuci set firewall.ovpn="rule"uci set firewall.ovpn.name="Allow-OpenVPN"uci set firewall.ovpn.src="wan"uci set firewall.ovpn.dest_port="${OVPN_PORT}"uci set firewall.ovpn.proto="${OVPN_PROTO}"uci set firewall.ovpn.target="ACCEPT"uci commit firewall/etc/init.d/firewall restart
# Configuration parametersOVPN_DH="$(cat ${OVPN_PKI}/dh.pem)"OVPN_TC="$(sed -e "/^#/d;/^\w/N;s/\n//" ${OVPN_PKI}/tc.pem)"OVPN_CA="$(openssl x509 -in ${OVPN_PKI}/ca.crt)"NL=$'\n' # Configure VPN service and generate client profilesumask go=ls ${OVPN_PKI}/issued \| sed -e "s/\.\w*$//" \| while read -r OVPN_IDdoOVPN_KEY="$(cat ${OVPN_PKI}/private/${OVPN_ID}.key)"OVPN_CERT="$(openssl x509 -in ${OVPN_PKI}/issued/${OVPN_ID}.crt)"OVPN_CERT_EXT="$(openssl x509 -in ${OVPN_PKI}/issued/${OVPN_ID}.crt -purpose)"OVPN_CONF_SERVER="\user nobodygroup nogroupdev tunport ${OVPN_PORT}proto ${OVPN_PROTO}server ${OVPN_POOL}topology subnetclient-to-clientkeepalive 10 60persist-tunpersist-keypush \"dhcp-option DNS ${OVPN_DNS}\"push \"dhcp-option DOMAIN ${OVPN_DOMAIN}\"push \"redirect-gateway def1\"push \"persist-tun\"push \"persist-key\"<dh>${NL}${OVPN_DH}${NL}</dh>"OVPN_CONF_CLIENT="\dev tunnobindclientremote ${OVPN_SERV} ${OVPN_PORT} ${OVPN_PROTO}auth-nocacheremote-cert-tls server"OVPN_CONF_COMMON="\<tls-crypt>${NL}${OVPN_TC}${NL}</tls-crypt><key>${NL}${OVPN_KEY}${NL}</key><cert>${NL}${OVPN_CERT}${NL}</cert><ca>${NL}${OVPN_CA}${NL}</ca>"case ${OVPN_CERT_EXT} in(*"SSL server : Yes"*) cat << EOF > ${OVPN_DIR}/${OVPN_ID}.conf ;;${OVPN_CONF_SERVER}${OVPN_CONF_COMMON}EOF(*"SSL client : Yes"*) cat << EOF > ${OVPN_DIR}/${OVPN_ID}.ovpn ;;${OVPN_CONF_CLIENT}${OVPN_CONF_COMMON}EOFesacdone/etc/init.d/openvpn restart/etc/init.d/openvpn enablels ${OVPN_DIR}/*.ovpn