m724/vpsmusthave
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Update freebsd/freebsd-secure.sh

Browse source
This commit is contained in:
Minecon724 2025-08-06 18:10:41 +02:00
commit 8289292403
1 changed files with 14 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

25
freebsd/freebsd-secure.sh
View file

@ -18,19 +18,22 @@ pw useradd -n "$USERNAME" -m -s /usr/local/bin/bash -w no
# --- WireGuard setup --- # --- WireGuard setup ---
echo "Configuring WireGuard..." echo "Configuring WireGuard..."
if [ -z "$WG_CLIENT_IP" ] || [ -z "$WG_SERVER_IP" ]; then if [ -z "$CLIENT_IP" ] || [ -z "$SERVER_IP" ] || [ -z "$PREFIXLEN" ]; then
SUB_START="fc$(openssl rand -hex 1):$(openssl rand -hex 2):$(openssl rand -hex 2):$(openssl rand -hex 2)" SUB_START="fc$(openssl rand -hex 1):$(openssl rand -hex 2):$(openssl rand -hex 2):$(openssl rand -hex 2)"
WG_CLIENT_IP="$SUB_START::2" CLIENT_IP="$SUB_START::2"
WG_SERVER_IP="$SUB_START::1" SERVER_IP="$SUB_START::1"
SUBNET_MASK=64 PREFIXLEN=64
fi fi
if [ "$WG_CLIENT_IP" == *"."* ]; then if [ "$CLIENT_IP" == *"."* ]; then
HOST_MASK=32 HOST_MASK=32
else else
HOST_MASK=128 HOST_MASK=128
fi fi
CLIENT_IP=$(echo "$CLIENT_IP" | cut -d"/" -f1)
SERVER_IP=$(echo "$SERVER_IP" | cut -d"/" -f1)
WG_LISTEN_PORT=${WG_LISTEN_PORT:-$(jot -r 1 49152 65535)} WG_LISTEN_PORT=${WG_LISTEN_PORT:-$(jot -r 1 49152 65535)}
WG_PRESHARED_KEY=${WG_PRESHARED_KEY:-$(wg genpsk)} WG_PRESHARED_KEY=${WG_PRESHARED_KEY:-$(wg genpsk)}
@ -43,12 +46,12 @@ cat <<EOF > /usr/local/etc/wireguard/vmh-ssh-vpn.conf
[Interface] [Interface]
ListenPort = $WG_LISTEN_PORT ListenPort = $WG_LISTEN_PORT
PrivateKey = $WG_LOCAL_PRIVKEY PrivateKey = $WG_LOCAL_PRIVKEY
Address = $WG_SERVER_IP/$SUBNET_MASK Address = $SERVER_IP/$PREFIXLEN
[Peer] [Peer]
PublicKey = $WIREGUARD_PUBKEY PublicKey = $WIREGUARD_PUBKEY
PresharedKey = $WG_PRESHARED_KEY PresharedKey = $WG_PRESHARED_KEY
AllowedIPs = $WG_CLIENT_SUBNET/$HOST_MASK AllowedIPs = $CLIENT_IP/$HOST_MASK
EOF EOF
chmod 600 /usr/local/etc/wireguard/vmh-ssh-vpn.conf chmod 600 /usr/local/etc/wireguard/vmh-ssh-vpn.conf
@ -79,7 +82,7 @@ PasswordAuthentication no
PubkeyAuthentication yes PubkeyAuthentication yes
PermitRootLogin no PermitRootLogin no
ListenAddress $WG_SERVER_IP ListenAddress $SERVER_IP
EOF EOF
@ -106,16 +109,16 @@ echo "1. Install the WireGuard config (fill in the gaps)"
echo echo
echo "[Interface]" echo "[Interface]"
echo "PrivateKey = ..." echo "PrivateKey = ..."
echo "Address = $WG_CLIENT_IP/$SUBNET_MASK" echo "Address = $CLIENT_IP/$PREFIXLEN"
echo "[Peer]" echo "[Peer]"
echo "Endpoint = ...:$WG_LISTEN_PORT" echo "Endpoint = ...:$WG_LISTEN_PORT"
echo "PublicKey = $WG_LOCAL_PUBKEY" echo "PublicKey = $WG_LOCAL_PUBKEY"
echo "PresharedKey = $WG_PRESHARED_KEY" echo "PresharedKey = $WG_PRESHARED_KEY"
echo "AllowedIPs = $WG_SERVER_IP/$HOST_MASK" echo "AllowedIPs = $SERVER_IP/$HOST_MASK"
echo echo
echo "2. Use this command to connect" echo "2. Use this command to connect"
echo echo
echo "ssh $USERNAME@$WG_SERVER_IP" echo "ssh $USERNAME@$SERVER_IP"
echo echo
echo "NOTICE:" echo "NOTICE:"
echo "If you need to change the port or other VPN settings, do it NOW. /usr/local/etc/wireguard/vmh-ssh-vpn.conf" echo "If you need to change the port or other VPN settings, do it NOW. /usr/local/etc/wireguard/vmh-ssh-vpn.conf"