361 lines
9.9 KiB
Bash
Executable File
361 lines
9.9 KiB
Bash
Executable File
#!/bin/bash
|
||
|
||
# WireGuard + udp2raw 服务端一键部署脚本
|
||
# 适用于 Ubuntu/Debian 服务器
|
||
|
||
set -e
|
||
|
||
RED='\033[0;31m'
|
||
GREEN='\033[0;32m'
|
||
YELLOW='\033[1;33m'
|
||
BLUE='\033[0;34m'
|
||
NC='\033[0m'
|
||
|
||
# 配置参数
|
||
UDRAW_PORT="4096"
|
||
WG_PORT="51820"
|
||
PASSWORD="wireguard_bypass_2025"
|
||
CLIENT_PUBKEY="BDeFmU7QKH9Vi8CQyYe9/3v0aTJygzw9fCb8XODdgWw="
|
||
VPN_NETWORK="10.7.0.0/24"
|
||
SERVER_IP="10.7.0.1"
|
||
CLIENT_IP="10.7.0.2"
|
||
|
||
echo "======================================"
|
||
echo "WireGuard + udp2raw 服务端部署"
|
||
echo "======================================"
|
||
echo ""
|
||
|
||
# 检查 root 权限
|
||
if [ "$EUID" -ne 0 ]; then
|
||
echo -e "${RED}错误：${NC}请使用 root 用户或 sudo 运行此脚本"
|
||
exit 1
|
||
fi
|
||
|
||
echo "配置参数："
|
||
echo " udp2raw 端口：$UDRAW_PORT (TCP)"
|
||
echo " WireGuard 端口：$WG_PORT (UDP, 本地)"
|
||
echo " VPN 网络：$VPN_NETWORK"
|
||
echo " 服务器 IP：$SERVER_IP"
|
||
echo " 客户端 IP：$CLIENT_IP"
|
||
echo ""
|
||
|
||
# ============================================
|
||
# 步骤 1：安装 udp2raw
|
||
# ============================================
|
||
echo "======================================"
|
||
echo "步骤 1：安装 udp2raw"
|
||
echo "======================================"
|
||
echo ""
|
||
|
||
if [ -f /usr/local/bin/udp2raw ]; then
|
||
echo -e "${GREEN}✓${NC} udp2raw 已安装"
|
||
else
|
||
echo "下载 udp2raw..."
|
||
cd /tmp
|
||
wget -q https://github.com/wangyu-/udp2raw/releases/download/20230206.0/udp2raw_binaries.tar.gz
|
||
tar -xzf udp2raw_binaries.tar.gz
|
||
|
||
# 检测架构
|
||
ARCH=$(uname -m)
|
||
if [ "$ARCH" = "x86_64" ]; then
|
||
mv udp2raw_amd64 /usr/local/bin/udp2raw
|
||
elif [ "$ARCH" = "aarch64" ] || [ "$ARCH" = "arm64" ]; then
|
||
mv udp2raw_arm /usr/local/bin/udp2raw
|
||
else
|
||
echo -e "${RED}✗${NC} 不支持的架构：$ARCH"
|
||
exit 1
|
||
fi
|
||
|
||
chmod +x /usr/local/bin/udp2raw
|
||
rm -f udp2raw_binaries.tar.gz udp2raw_*
|
||
echo -e "${GREEN}✓${NC} udp2raw 安装成功"
|
||
fi
|
||
|
||
# 验证安装
|
||
/usr/local/bin/udp2raw --help > /dev/null 2>&1
|
||
if [ $? -eq 0 ]; then
|
||
echo -e "${GREEN}✓${NC} udp2raw 可执行"
|
||
else
|
||
echo -e "${RED}✗${NC} udp2raw 安装失败"
|
||
exit 1
|
||
fi
|
||
|
||
# ============================================
|
||
# 步骤 2：配置 udp2raw
|
||
# ============================================
|
||
echo ""
|
||
echo "======================================"
|
||
echo "步骤 2：配置 udp2raw"
|
||
echo "======================================"
|
||
echo ""
|
||
|
||
# 创建配置文件
|
||
tee /etc/udp2raw_server.conf > /dev/null << EOF
|
||
# udp2raw 服务端配置
|
||
# 自动生成于: $(date)
|
||
|
||
# 服务端模式
|
||
-s
|
||
|
||
# 监听地址和端口
|
||
-l 0.0.0.0:$UDRAW_PORT
|
||
|
||
# 转发到本地 WireGuard
|
||
-r 127.0.0.1:$WG_PORT
|
||
|
||
# 加密密码（必须与客户端一致）
|
||
-k $PASSWORD
|
||
|
||
# 模式：faketcp（伪装成 TCP）
|
||
--raw-mode faketcp
|
||
|
||
# 日志级别
|
||
--log-level 4
|
||
|
||
# 自动添加 iptables 规则
|
||
-a
|
||
EOF
|
||
|
||
echo -e "${GREEN}✓${NC} 配置文件已创建：/etc/udp2raw_server.conf"
|
||
|
||
# ============================================
|
||
# 步骤 3：创建 systemd 服务
|
||
# ============================================
|
||
echo ""
|
||
echo "======================================"
|
||
echo "步骤 3：创建 systemd 服务"
|
||
echo "======================================"
|
||
echo ""
|
||
|
||
tee /etc/systemd/system/udp2raw.service > /dev/null << 'EOF'
|
||
[Unit]
|
||
Description=udp2raw tunnel for WireGuard
|
||
After=network.target
|
||
[email protected]
|
||
[email protected]
|
||
|
||
[Service]
|
||
Type=simple
|
||
ExecStart=/usr/local/bin/udp2raw --conf-file /etc/udp2raw_server.conf
|
||
Restart=always
|
||
RestartSec=5
|
||
User=root
|
||
LimitNOFILE=65535
|
||
|
||
StandardOutput=journal
|
||
StandardError=journal
|
||
|
||
[Install]
|
||
WantedBy=multi-user.target
|
||
EOF
|
||
|
||
echo -e "${GREEN}✓${NC} systemd 服务已创建"
|
||
|
||
# 重载 systemd
|
||
systemctl daemon-reload
|
||
|
||
# ============================================
|
||
# 步骤 4：检查并配置 WireGuard
|
||
# ============================================
|
||
echo ""
|
||
echo "======================================"
|
||
echo "步骤 4：检查 WireGuard 配置"
|
||
echo "======================================"
|
||
echo ""
|
||
|
||
# 检查 WireGuard 是否安装
|
||
if ! command -v wg &> /dev/null; then
|
||
echo -e "${YELLOW}!${NC} WireGuard 未安装"
|
||
read -p "是否安装 WireGuard? (y/n) " -n 1 -r
|
||
echo
|
||
if [[ $REPLY =~ ^[Yy]$ ]]; then
|
||
echo "安装 WireGuard..."
|
||
apt update
|
||
apt install -y wireguard
|
||
echo -e "${GREEN}✓${NC} WireGuard 已安装"
|
||
else
|
||
echo -e "${YELLOW}!${NC} 跳过 WireGuard 安装"
|
||
fi
|
||
fi
|
||
|
||
# 检查 WireGuard 配置
|
||
if [ -f /etc/wireguard/wg0.conf ]; then
|
||
echo -e "${GREEN}✓${NC} WireGuard 配置已存在"
|
||
echo ""
|
||
echo "当前配置："
|
||
wg show 2>/dev/null || echo "WireGuard 未运行"
|
||
|
||
echo ""
|
||
echo -e "${YELLOW}重要${NC}：确保 WireGuard 配置包含客户端 Peer："
|
||
echo ""
|
||
echo "[Peer]"
|
||
echo "PublicKey = $CLIENT_PUBKEY"
|
||
echo "AllowedIPs = $CLIENT_IP/32"
|
||
echo "PersistentKeepalive = 25"
|
||
echo ""
|
||
else
|
||
echo -e "${YELLOW}!${NC} WireGuard 配置不存在"
|
||
echo ""
|
||
echo "示例配置（保存到 /etc/wireguard/wg0.conf）："
|
||
echo ""
|
||
cat << EOF
|
||
[Interface]
|
||
Address = $SERVER_IP/24
|
||
ListenPort = $WG_PORT
|
||
PrivateKey = <服务端私钥>
|
||
|
||
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
|
||
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
|
||
|
||
[Peer]
|
||
PublicKey = $CLIENT_PUBKEY
|
||
AllowedIPs = $CLIENT_IP/32
|
||
PersistentKeepalive = 25
|
||
EOF
|
||
echo ""
|
||
echo "注意：需要替换 <服务端私钥> 和网络接口名称（eth0）"
|
||
fi
|
||
|
||
# ============================================
|
||
# 步骤 5：启动服务
|
||
# ============================================
|
||
echo ""
|
||
echo "======================================"
|
||
echo "步骤 5：启动 udp2raw 服务"
|
||
echo "======================================"
|
||
echo ""
|
||
|
||
# 启用并启动服务
|
||
systemctl enable udp2raw
|
||
systemctl restart udp2raw
|
||
|
||
sleep 3
|
||
|
||
# 检查状态
|
||
if systemctl is-active --quiet udp2raw; then
|
||
echo -e "${GREEN}✓${NC} udp2raw 服务运行中"
|
||
systemctl status udp2raw --no-pager | head -15
|
||
else
|
||
echo -e "${RED}✗${NC} udp2raw 服务启动失败"
|
||
echo ""
|
||
echo "查看日志："
|
||
journalctl -u udp2raw -n 30 --no-pager
|
||
exit 1
|
||
fi
|
||
|
||
# ============================================
|
||
# 步骤 6：配置防火墙
|
||
# ============================================
|
||
echo ""
|
||
echo "======================================"
|
||
echo "步骤 6：配置防火墙"
|
||
echo "======================================"
|
||
echo ""
|
||
|
||
# 检测防火墙类型
|
||
if command -v ufw &> /dev/null; then
|
||
echo "检测到 UFW 防火墙"
|
||
ufw allow $UDRAW_PORT/tcp comment 'udp2raw tunnel' 2>/dev/null || true
|
||
ufw allow $WG_PORT/udp comment 'WireGuard VPN' 2>/dev/null || true
|
||
echo -e "${GREEN}✓${NC} UFW 规则已添加"
|
||
elif command -v firewall-cmd &> /dev/null; then
|
||
echo "检测到 firewalld"
|
||
firewall-cmd --permanent --add-port=$UDRAW_PORT/tcp
|
||
firewall-cmd --permanent --add-port=$WG_PORT/udp
|
||
firewall-cmd --reload
|
||
echo -e "${GREEN}✓${NC} firewalld 规则已添加"
|
||
else
|
||
echo "使用 iptables"
|
||
iptables -C INPUT -p tcp --dport $UDRAW_PORT -j ACCEPT 2>/dev/null || \
|
||
iptables -A INPUT -p tcp --dport $UDRAW_PORT -j ACCEPT
|
||
iptables -C INPUT -p udp --dport $WG_PORT -j ACCEPT 2>/dev/null || \
|
||
iptables -A INPUT -p udp --dport $WG_PORT -j ACCEPT
|
||
echo -e "${GREEN}✓${NC} iptables 规则已添加"
|
||
fi
|
||
|
||
# ============================================
|
||
# 步骤 7：启用 IP 转发
|
||
# ============================================
|
||
echo ""
|
||
echo "======================================"
|
||
echo "步骤 7：启用 IP 转发"
|
||
echo "======================================"
|
||
echo ""
|
||
|
||
if grep -q "^net.ipv4.ip_forward=1" /etc/sysctl.conf; then
|
||
echo -e "${GREEN}✓${NC} IP 转发已启用"
|
||
else
|
||
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
|
||
sysctl -p > /dev/null
|
||
echo -e "${GREEN}✓${NC} IP 转发已启用"
|
||
fi
|
||
|
||
# ============================================
|
||
# 步骤 8：验证部署
|
||
# ============================================
|
||
echo ""
|
||
echo "======================================"
|
||
echo "步骤 8：验证部署"
|
||
echo "======================================"
|
||
echo ""
|
||
|
||
# 检查端口监听
|
||
echo "检查端口监听..."
|
||
if netstat -tulnp 2>/dev/null | grep -q ":$UDRAW_PORT"; then
|
||
echo -e "${GREEN}✓${NC} udp2raw 端口 $UDRAW_PORT 监听中"
|
||
netstat -tulnp | grep ":$UDRAW_PORT"
|
||
else
|
||
echo -e "${YELLOW}!${NC} 端口 $UDRAW_PORT 未监听（可能正常，取决于实现）"
|
||
fi
|
||
|
||
echo ""
|
||
if netstat -tulnp 2>/dev/null | grep -q ":$WG_PORT"; then
|
||
echo -e "${GREEN}✓${NC} WireGuard 端口 $WG_PORT 监听中"
|
||
netstat -tulnp | grep ":$WG_PORT"
|
||
else
|
||
echo -e "${YELLOW}!${NC} WireGuard 端口 $WG_PORT 未监听"
|
||
echo " 如果还没配置 WireGuard，请参考上述配置示例"
|
||
fi
|
||
|
||
# ============================================
|
||
# 完成
|
||
# ============================================
|
||
echo ""
|
||
echo "======================================"
|
||
echo -e "${GREEN}部署完成！${NC}"
|
||
echo "======================================"
|
||
echo ""
|
||
|
||
echo "服务状态："
|
||
echo " udp2raw: $(systemctl is-active udp2raw)"
|
||
echo " WireGuard: $(systemctl is-active wg-quick@wg0 2>/dev/null || echo 'not configured')"
|
||
echo ""
|
||
|
||
echo "端口配置："
|
||
echo " udp2raw 监听：0.0.0.0:$UDRAW_PORT (TCP)"
|
||
echo " WireGuard 监听：127.0.0.1:$WG_PORT (UDP)"
|
||
echo ""
|
||
|
||
echo "日志查看："
|
||
echo " udp2raw: journalctl -u udp2raw -f"
|
||
echo " WireGuard: journalctl -u wg-quick@wg0 -f"
|
||
echo ""
|
||
|
||
echo "管理命令："
|
||
echo " systemctl restart udp2raw # 重启 udp2raw"
|
||
echo " systemctl status udp2raw # 查看状态"
|
||
echo " wg show # 查看 WireGuard 状态"
|
||
echo ""
|
||
|
||
echo -e "${BLUE}下一步${NC}："
|
||
echo "1. 如果 WireGuard 还没配置，请参考上述示例配置"
|
||
echo "2. 确保客户端公钥已添加到 WireGuard 配置"
|
||
echo "3. 在客户端连接测试"
|
||
echo ""
|
||
|
||
echo -e "${YELLOW}客户端配置提示${NC}："
|
||
echo " WireGuard Endpoint: 127.0.0.1:51821"
|
||
echo " udp2raw 远程: 85.239.233.16:$UDRAW_PORT"
|
||
echo " 密码: $PASSWORD"
|
||
echo ""
|