API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Feb 20th, 2018
200
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 11.00 KB | None | 0 0
raw download clone embed print report
  1. ADMIN@RT-AC68U-85F8:/jffs/scripts#
  2. ADMIN@RT-AC68U-85F8:/jffs/scripts#
  3. ADMIN@RT-AC68U-85F8:/jffs/scripts#
  4. ADMIN@RT-AC68U-85F8:/jffs/scripts#
  5. ADMIN@RT-AC68U-85F8:/jffs/scripts#
  6. ADMIN@RT-AC68U-85F8:/jffs/scripts#
  7. ADMIN@RT-AC68U-85F8:/jffs/scripts# ls -l
  8. -rwxr-xr-x    1 ADMIN    root          7510 Feb 10 23:42 ChkVPNConfig.sh
  9. -rwxr-xr-x    1 ADMIN    root          2920 Feb 20 21:50 Debug_VPN.sh
  10. ADMIN@RT-AC68U-85F8:/jffs/scripts#
  11. ADMIN@RT-AC68U-85F8:/jffs/scripts# ./Debug_VPN.sh
  12. -sh: ./Debug_VPN.sh: not found
  13. ADMIN@RT-AC68U-85F8:/jffs/scripts# ./ChkVPNConfig.sh
  14. -sh: ./ChkVPNConfig.sh: not found
  15. ADMIN@RT-AC68U-85F8:/jffs/scripts#
  16. ADMIN@RT-AC68U-85F8:/jffs/scripts# cat Debug_VPN.sh
  17. #!/bin/sh
  18.  
  19. # Debugging Selective routing use cru/cron
  20.  
  21. Say(){
  22.    echo -e $$ $@ | logger -st "($(basename $0))"
  23. }
  24. SayT() {
  25.    echo -e $$ $@ | logger -t "($(basename $0))"
  26. }
  27. ANSIColours() {
  28.     cRESET="\e[0m";cBLA="\e[30m";cRED="\e[31m";cGRE="\e[32m";cYEL="\e[33m";cBLU="\e[34m";cMAG="\e[35m";cCYA="\e[36m";cGRA="\e[37m"
  29.     cBGRA="\e[90m";cBRED="\e[91m";cBGRE="\e[92m";cBYEL="\e[93m";cBBLU="\e[94m";cBMAG="\e[95m";cBCYA="\e[96m";cBWHT="\e[97m"
  30.     aBOLD="\e[1m";aDIM="\e[2m";aUNDER="\e[4m";aBLINK="\e[5m";aREVERSE="\e[7m"
  31.     cRED_="\e[41m";cGRE_="\e[42m"
  32. }
  33.  
  34. ANSIColours
  35.  
  36. VPN_ROUTES=
  37. WAN_IP=
  38.  
  39. for VPN_TAB in 254 $(ip route show table 254 | grep -oE "tun1[1|2|3|4|5]" | sort )
  40.     do
  41.         [ "$VPN_TAB" != "254" ] && VPN_TAB=$(echo $VPN_TAB | sed 's/tun1/11/')
  42.         echo -e $cBWHT
  43.         Say "VPN Client" ${VPN_TAB:2:1}  "route Table:" $VPN_TAB
  44.         echo -en $cBMAG
  45.  
  46.         AROUTE=$(ip route show table $VPN_TAB | awk ' /default/ {print $3}')
  47.         if [ -z "$(echo  "$VPN_ROUTES" | grep -oF $AROUTE )" ];then
  48.             VPN_ROUTES=$VPN_ROUTES" "$AROUTE
  49.         else
  50.             echo -e $cBRED"\a"
  51.             TXT="ALREADY used by a previous VPN Client"
  52.             if [ "$WAN_IP" == "$AROUTE" ];then
  53.                 TXT="is via the WAN!!!"
  54.             fi
  55.             Say "***ERROR*** VPN Client" ${VPN_TAB:2:1} "route" $AROUTE $TXT
  56.             echo -e $cRESET
  57.         fi
  58.  
  59.         # Obfuscate IP address <optional>
  60.         ip route show table $VPN_TAB |  grep -E "^0\.|^128.|^default|tun1"
  61.         ip route show table $VPN_TAB |  grep -E "^0\.|^128.|^default|tun1"  >>/tmp/syslog.log
  62.  
  63.         if [ "$VPN_TAB" != "254" ];then
  64.             DEV=$(ip route show table $VPN_TAB | grep -v "default" | grep -oE "tun1[1|2|3|4|5]" )
  65.             if [ "tun1"${VPN_TAB:2:1} != "$DEV" ];then
  66.                 echo -e $cBRED"\a"
  67.                 Say "***ERROR*** RPDB rules will be misdirected for VPN Client" ${VPN_TAB:2:1}
  68.                 echo -e $cRESET
  69.             else
  70.                 if [ ! -z "$(ip route show table $VPN_TAB |  grep -E "^0\.|^128.]")" ];then
  71.                     echo -e $cBRED"\a"
  72.                     Say "***ERROR***Selective routing NOT enabled! - table 'main' is routing ALL traffic via VPN"
  73.                     echo -e $cRESET
  74.                 fi
  75.             fi
  76.         else
  77.             WAN_IP=$AROUTE
  78.         fi
  79.     done
  80.  
  81. echo -e $cBWHT
  82. Say "RPDB rules:"
  83. echo -en $cBMAG
  84. ip rule;ip rule >>/tmp/syslog.log
  85.  
  86. echo -e $cBWHT
  87. Say "Count of active RPDB rules:"
  88. echo -en $cBGRE
  89.  
  90. # How many entities Selectively routed
  91. ip rule | grep -v "fwmark" | grep -oE "lookup.*ovpnc[1-5]+" | sort -k 2 | uniq -c
  92. ip rule | grep -v "fwmark" | grep -oE "lookup.*ovpnc[1-5]+" | sort -k 2 | uniq -c >>/tmp/syslog.log
  93. SayT "Summary:$(ip rule | grep -v "fwmark" | grep -oE "lookup.*ovpnc[1-5]+" | sort -k 2 | uniq -c)"
  94.  
  95. echo -e $cRESET
  96.  
  97. ADMIN@RT-AC68U-85F8:/jffs/scripts# cat ChkVPNConfig.sh
  98. #!/bin/sh
  99. VER="v1.01b3"
  100. #============================================================================== © 2018 Martineau, v01.01b3
  101. # Check VPN Selective routing.
  102. #
  103. #       Schedule via cru/cron to have the VPN status tracked/dumped to Syslog.
  104. #
  105.  
  106. #*=====================================Functions=====================================================
  107. # Print between line beginning with'#==' to first blank line inclusive
  108. ShowHelp() {
  109.     echo -en $cBWHT >&2
  110.     awk '/^#==/{f=1} f{print; if (!NF) exit}' $0
  111.     echo -en $cRESET >&2
  112. }
  113. Say(){
  114.    echo -e $$ $@ | logger -st "($(basename $0))"
  115. }
  116. SayT(){
  117.    echo -e $$ $@ | logger -t "($(basename $0))"
  118. }
  119. ANSIColours() {
  120.     cRESET="\e[0m";cBLA="\e[30m";cRED="\e[31m";cGRE="\e[32m";cYEL="\e[33m";cBLU="\e[34m";cMAG="\e[35m";cCYA="\e[36m";cGRA="\e[37m"
  121.     cBGRA="\e[90m";cBRED="\e[91m";cBGRE="\e[92m";cBYEL="\e[93m";cBBLU="\e[94m";cBMAG="\e[95m";cBCYA="\e[96m";cBWHT="\e[97m"
  122.     aBOLD="\e[1m";aDIM="\e[2m";aUNDER="\e[4m";aBLINK="\e[5m";aREVERSE="\e[7m"
  123.     cRED_="\e[41m";cGRE_="\e[42m"
  124. }
  125. Check_DuplicateVPNPorts() {
  126.     local VPN_ID=
  127.     local VPN_ADDR=
  128.     local VPN_PORTS=
  129.     local VPN_ID_LIST="1 2 3 4 5"
  130.  
  131.     #local VPN_CLIENTPORTS=$(nvram show 2> /dev/null | grep -E "vpn_client.*port" | grep -v "client_port")
  132.     for VPN_ID in $VPN_ID_LIST
  133.         do
  134.             VPN_ADDR=$(nvram get vpn_client${VPN_ID}_addr)
  135.        
  136.             if [ -z "$VPN_ADDR" ];then
  137.                 continue                                # VPN Client instance not configured?
  138.             fi
  139.             # vpn_client1_port=553
  140.             # vpn_client1_proto=udp
  141.             if [ "$1" == "2" ];then
  142.                 local VPN_STATE=$(nvram get "vpn_client"$VPN_ID"_state")
  143.                 if [ "$VPN_STATE" != "2" ];then
  144.                     continue
  145.                 fi
  146.             fi
  147.             local THIS=$(echo $(nvram get vpn_client${VPN_ID}_port)":"$(nvram get vpn_client${VPN_ID}_proto | tr "a-z" "A-Z") )
  148.             if [ "$2" == "diag" ];then
  149.                 local VPN_PORTS=$( echo -e "$VPN_PORTS VPN client" $VPN_ID "ACTIVE using port" $THIS", ")
  150.             else
  151.                 local VPN_PORTS=$(echo -e "$VPN_PORTS ${THIS}\n")
  152.             fi
  153.         done
  154.     if [ "$2" != "diag" ];then
  155.         # Convert words to individual lines and report on duplicates
  156.         echo $VPN_PORTS | tr ' ' '\n' | sort -n | uniq -d
  157.     else
  158.         echo $VPN_PORTS
  159.     fi
  160. }
  161. #============================================Main==================================================
  162.  
  163. ANSIColours
  164.  
  165. # Provide assistance
  166. if [ "$1" = "-h" ] || [ "$1" = "help" ]; then
  167.    ShowHelp                                                     # Show help
  168.    exit 0
  169. fi
  170.  
  171. echo -e $cBWHT
  172. Say $VER "VPN Selective Routing configuration checker ....."
  173.  
  174. VPN_ROUTES=
  175. WAN_IP=
  176. MULTI_FOUND=
  177.  
  178. for VPN_TAB in 254 $(ip route show table 254 | grep -oE "tun1[1|2|3|4|5]" | sort | uniq )
  179.     do
  180.         [ "$VPN_TAB" != "254" ] && VPN_TAB=$(echo $VPN_TAB | sed 's/tun1/11/')
  181.         echo -e $cBWHT
  182.         if [ "$VPN_TAB" != "254" ];then
  183.             Say "VPN Client" ${VPN_TAB:2:1}  "route Table:" $VPN_TAB
  184.         else
  185.             Say "WAN (main) route Table:" $VPN_TAB
  186.         fi
  187.         echo -en $cBCYA
  188.    
  189.         # Obfuscate IP address
  190.         AROUTE=$(ip route show table $VPN_TAB | awk ' /default/ {print $3}')
  191.         ip route show table $VPN_TAB |  grep -E "^0\.|^128.|^default|tun1"
  192.         ip route show table $VPN_TAB |  grep -E "^0\.|^128.|^default|tun1"  >>/tmp/syslog.log
  193.         if [ -z "$(echo  "$VPN_ROUTES" | grep -oF "\-${AROUTE}" )" ];then
  194.             if [ "$VPN_TAB" != "254" ];then
  195.                 if [ ! -z "$AROUTE" ];then
  196.                     VPN_ROUTES=$VPN_ROUTES" "${VPN_TAB:2:1}-${AROUTE}
  197.                 fi
  198.             else
  199.                 VPN_ROUTES=$VPN_ROUTES" 0-"$AROUTE
  200.             fi
  201.         else
  202.             echo -e $cBRED"\a"
  203.             TXT="ALREADY used by VPN Client "$(echo  "$VPN_ROUTES" | grep -oE "${AROUTE}\-[1-5]+" | cut -d'-' -f2)
  204.             if [ "$WAN_IP" == "$AROUTE" ];then
  205.                 TXT="is via the WAN!!!"
  206.             fi
  207.             Say "***ERROR*** VPN Client" ${VPN_TAB:2:1} "route" $AROUTE $TXT
  208.             echo -en $cRESET
  209.         fi
  210.         # Check default route matches this VPN Client
  211.         #   default via xxx.xxx.xxx.xxx dev tunXX
  212.         if [ "$VPN_TAB" != "254" ];then
  213.             DEV=$(ip route show table $VPN_TAB | awk ' /default/ {print $5}')
  214.        
  215.             if [ "tun1"${VPN_TAB:2:1} != "$DEV" ];then
  216.                 if [ ! -z "$DEV" ];then
  217.                     echo -e $cBRED"\a"
  218.                     Say "***ERROR*** RPDB rules will be misdirected for VPN Client" ${VPN_TAB:2:1} "via" $DEV
  219.                     echo -en $cRESET
  220.                 fi
  221.             fi
  222.             # Check for either of these in this VPN Client but its OK if ONLY 1 VPN Client ACTIVE!
  223.             #   0.0.0.0/1 via xxx.xxx.xxx.xxx dev tunXX
  224.             #   128.0.0.0/1 via xxx.xxx.xxx.xxx dev tunXX
  225.             MULTI_DEFAULT=$(ip route show table $VPN_TAB | grep -E -m 1 "^0\.|^128.")
  226.             if [ ! -z "$MULTI_DEFAULT" ];then
  227.                 MULTI_FOUND=$MULTI_FOUND" "${VPN_TAB:2:1}
  228.                 if [ $(ip route show table 254 | grep -oE "tun1[1|2|3|4|5]" | wc -w) -gt 1 ];then
  229.                     echo -e $cBRED"\a"
  230.                     Say "**Warning '"$MULTI_DEFAULT"' found in VPN Client" ${VPN_TAB:2:1}
  231.                     echo -en $cRESET
  232.                 fi
  233.             fi
  234.        
  235.             # Can 'prohibit default' exist if VPN is UP..?? - YES if 'Redirect Internet traffic=ALL' ???
  236.             if [ ! -z "$(ip route show table $VPN_TAB | grep "prohibit default")" ];then
  237.                 echo -e $cRED"\a"
  238.                 Say "**Warning RPDB routing traffic is BLOCKED - ('prohibit default') for VPN Client" ${VPN_TAB:2:1}
  239.                 echo -en $cRESET
  240.             fi
  241.         else
  242.             WAN_IP=$AROUTE
  243.             # Check if pushed VPN override routes are still present in table main
  244.             MULTI_DEFAULT=$(ip route show table $VPN_TAB | grep -E -m 1 "^0\.|^128.")
  245.             if [ ! -z "$MULTI_DEFAULT" ];then
  246.                 echo -e $cBRED"\a"
  247.                 Say "***ERROR***Selective Routing NOT enabled! - table 'main' is FORCE routing ALL traffic via VPN Client" $(echo $MULTI_DEFAULT | awk '{print $5}' | sed 's/tun1//')
  248.                 echo -en $cRESET
  249.             fi
  250.         fi
  251.     done
  252.  
  253. echo -e $cBWHT
  254. Say "RPDB rules:"
  255. echo -en $cBCYA
  256. ip rule;ip rule >>/tmp/syslog.log
  257.  
  258. echo -e $cBWHT
  259. Say "Count of active RPDB rules:"
  260. echo -en $cBGRE
  261. # How many entities Selectively routed
  262. ip rule | grep -v "fwmark" | grep -v "all lookup main" | grep -oE "lookup.*main|lookup.*ovpnc[1-5]+" | sort -k 2 | uniq -c
  263. ip rule | grep -v "fwmark" | grep -v "all lookup main" | grep -oE "lookup.*main|lookup.*ovpnc[1-5]+" | sort -k 2 | uniq -c >>/tmp/syslog.log
  264.  
  265. SayT "Summary:$(ip rule | grep -v "fwmark" | grep -v "all lookup main" | grep -oE "lookup.*|lookup.*ovpnc[1-5]+" | sort -k 2 | uniq -c)"
  266.  
  267. SayT "VPNRoutes:"$VPN_ROUTES
  268.  
  269. PORTS="$(Check_DuplicateVPNPorts "2")"          # Only interested in ACTIVE VPN Clients (state="2") rather than any configured
  270. if [ ! -z $PORTS ];then
  271.     echo -e "\n"$cYEL
  272.     Say "**Warning for multiple ACTIVE concurrent VPN Clients UNIQUE ports are advised - Port" $PORTS "is configured for use by several VPN Clients"
  273. fi
  274. echo -e $cRESET
  275.  
  276. exit 0ADMIN@RT-AC68U-85F8:/jffs/scripts#
  277. ADMIN@RT-AC68U-85F8:/jffs/scripts#
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!