network

network/ip_info.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+
+PUB_IP=$(wget -T 5 -qO- ifconfig.co)
+printf "User: %s\n" "$(whoami)"
+if [ "${PUB_IP}" != "" ]; then
+        LOC=$(wget -T 3 -qO- ifconfig.co/country)
+        CITY=$(wget -T 3 -qO- ifconfig.co/city)
+        printf "%s\t%s\t%s\n" "${PUB_IP}" "${LOC}" "${CITY}"
+else
+        printf "No Connection\n"
+fi
+if [ "$(grep deluge-user /etc/passwd)" != "" ]; then
+	printf "User: deluge-user\n" 
+	PUB_IP=$(sudo /home/lucas/scripts/deluge_user_cmd.sh wget -T 3 -qO- ifconfig.co)
+	if [ "${PUB_IP}" == "" ]; then 
+		PUB_IP=$(sudo /home/lucas/scripts/deluge_user_cmd.sh curl --connect-timeout 3 https://ipinfo.io/ip)
+	fi
+	if [ "${PUB_IP}" != "" ]; then	
+		LOC=$(sudo /home/lucas/scripts/deluge_user_cmd.sh wget -T 3 -qO- ifconfig.co/country)
+		if [ "${LOC}" == "" ]; then 
+			LOC=$(sudo /home/lucas/scripts/deluge_user_cmd.sh curl --connect-timeout 3 https://ipinfo.io/country 2>>/dev/null)
+		fi
+		CITY=$(sudo /home/lucas/scripts/deluge_user_cmd.sh wget -T 3 -qO- ifconfig.co/city)
+		if [ "${CITY}" == "" ]; then 
+			CITY=$(sudo /home/lucas/scripts/deluge_user_cmd.sh curl --connect-timeout 3 https://ipinfo.io/city 2>>/dev/null)
+		fi
+		printf "%s\t%s\t%s\n" "${PUB_IP}" "${LOC}" "${CITY}"
+	else
+		printf "No Connection\n"
+	fi
+fi

network/iptables_basic.sh

@@ -0,0 +1,168 @@
+#!/bin/bash
+
+echo Flush existing rules
+iptables -F
+iptables -F -t nat
+iptables -F -t mangle
+iptables -F -t filter
+echo Delete all
+iptables -X
+
+DELUGE_MODE=false
+
+if [ "$1" == "-d" ]; then
+	echo Input -d open all traffic
+	iptables -P INPUT ACCEPT
+	iptables -P FORWARD ACCEPT
+	exit 0
+elif [ "$1" == "-deluge-mode" ]; then
+	echo "Iptables Deluge Mode"
+	DELUGE_MODE=true
+else
+	echo "Set up Firewall"
+fi
+
+echo Set Variables
+HOST="$(hostname)"
+SSHPORT=$(cat /etc/ssh/sshd_config | grep Port | grep -v "#" | cut -f2 -d' ')
+
+echo Make Rules
+
+echo Drop incoming traffic and accept outgoing 
+iptables -P INPUT DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT ACCEPT 
+
+echo "Established Connections"
+iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+iptables -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+echo "DHCP"
+iptables -A OUTPUT -p udp --dport 67 --sport 68 -m state --state NEW,ESTABLISHED -j ACCEPT
+iptables -A INPUT -p udp --sport 67 --dport 68 -m state --state RELATED,ESTABLISHED -j ACCEPT
+if [ "${HOST}" == "quiethost" ]; then
+	SD_PORT=7860
+	echo Incoming SD Port ${SD_PORT}
+	iptables -A INPUT -p tcp --dport ${SD_PORT} -m state --state NEW,ESTABLISHED -j ACCEPT
+	iptables -A OUTPUT -p tcp --sport ${SD_PORT} -m state --state ESTABLISHED -j ACCEPT
+	echo Incoming SD Port 9170 
+	iptables -A INPUT -p tcp --dport 9170 -m state --state NEW,ESTABLISHED -j ACCEPT
+	iptables -A OUTPUT -p tcp --sport 9170 -m state --state ESTABLISHED -j ACCEPT
+elif [ "${HOST}" == "serverhost" ]; then
+	DELUGE_PORT=58846
+	echo Incoming https Port 8123 
+	iptables -A INPUT -p tcp --dport 8123 -m state --state NEW,ESTABLISHED -j ACCEPT
+	iptables -A OUTPUT -p tcp --sport 8123 -m state --state ESTABLISHED -j ACCEPT
+	echo Incoming https Port 80
+	iptables -A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
+	iptables -A OUTPUT -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
+	echo Incoming https Port 443
+	iptables -A INPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+	iptables -A OUTPUT -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
+	echo Incoming https Port 444
+	iptables -A INPUT -p tcp --dport 444 -m state --state NEW,ESTABLISHED -j ACCEPT
+	iptables -A OUTPUT -p tcp --sport 444 -m state --state ESTABLISHED -j ACCEPT
+	echo Deluge Daemon
+	iptables -A INPUT -p tcp --dport ${DELUGE_PORT} -m state --state NEW,ESTABLISHED -j ACCEPT
+	iptables -A OUTPUT -p tcp --sport ${DELUGE_PORT} -m state --state ESTABLISHED -j ACCEPT
+fi
+echo "Incoming SSH -P $SSHPORT"
+iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport $SSHPORT -j ACCEPT
+iptables -A OUTPUT -p tcp --sport $SSHPORT -m state --state ESTABLISHED -j ACCEPT
+echo "Incoming XRDP Port"
+iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 3389 -j ACCEPT
+iptables -A OUTPUT -p tcp --sport 3389 -m state --state ESTABLISHED -j ACCEPT
+echo "Ping Reply"
+iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
+iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
+echo "Send Mail"
+iptables -A INPUT -p 25 -j ACCEPT
+iptables -A OUTPUT -p 25 -j ACCEPT
+echo "loopback"
+iptables -A INPUT -i lo -j ACCEPT
+iptables -A OUTPUT -o lo -j ACCEPT
+if [[ "$(grep -E "no-internet:" /etc/group)" == "" ]]; then
+	echo "Add no-internet group"
+	sudo addgroup no-internet
+fi
+echo "Add No Internet Group Rule"
+sudo iptables -A OUTPUT -m owner --gid-owner no-internet -j DROP
+# On Fail:
+# sudo addgroup no-internet
+# sudo adduser lucas no-internet
+
+
+if [ "${HOST}" == "raspberry" ]; then
+	iptables -A FORWARD -i ${NETIF} -o wlan0 -j ACCEPT
+	iptables -A FORWARD -i wlan0 -o ${NETIF} -m state --state RELATED,ESTABLISHED -j ACCEPT
+	sysctl -w net.ipv4.ip_forward=1
+	iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE
+fi
+if [ "$(cat /etc/passwd | grep -E "deluge-user:x:[0-9]{4}:[0-9]{4}")" != "" ]; then
+	echo "deluge-user Settings"
+	if [ "${VPNUSER}" == "" ]; then 
+		VPNUSER="deluge-user"
+	fi
+	if [ "${LOCALIP}" == "" ]; then
+		NETIF="$(lshw -class network | grep -A6 "Ethernet interface" | grep name | awk -F': ' '{print $2}')"
+		LOCALIP=$(ip addr show ${NETIF} | grep -Po '(?<= inet )([0-9\.]+)')
+	fi
+	if [ "${MARK_ID}" == "" ]; then 
+		MARK_ID="0x32"
+	fi
+
+	if [[ $(ip rule list | grep -c $MARK_ID) == 0 ]]; then
+		ip rule add from all fwmark $MARK_ID lookup $VPNUSER
+	fi
+
+	echo Interface $NETIF 
+	echo IP: $LOCALIP
+	echo "mark packets from ${VPNUSER} to ${LOCALIP} with ${MARK_ID}"
+	iptables -t mangle -A OUTPUT -j CONNMARK --restore-mark
+	iptables -t mangle -A OUTPUT ! --dest ${LOCALIP} -m owner --uid-owner ${VPNUSER}  -j MARK --set-mark ${MARK_ID}
+	iptables -t mangle -A OUTPUT --dest ${LOCALIP} -p udp --dport 53 -m owner --uid-owner ${VPNUSER} -j MARK --set-mark ${MARK_ID}
+	iptables -t mangle -A OUTPUT --dest ${LOCALIP} -p tcp --dport 53 -m owner --uid-owner ${VPNUSER} -j MARK --set-mark ${MARK_ID}
+	iptables -t mangle -A OUTPUT ! --src ${LOCALIP} -j MARK --set-mark ${MARK_ID}
+	iptables -t mangle -A OUTPUT -j CONNMARK --save-mark
+
+	echo "Set DNS for ${VPNUSER}"
+	iptables -t nat -A OUTPUT --dest ${LOCALIP} -p udp --dport 53 -m owner --uid-owner ${VPNUSER} -j DNAT --to-destination 8.8.4.4
+	iptables -t nat -A OUTPUT --dest ${LOCALIP} -p tcp --dport 53 -m owner --uid-owner ${VPNUSER} -j DNAT --to-destination 8.8.8.8
+
+	echo "let ${VPNUSER} access lo"
+	iptables -A OUTPUT -o lo -m owner --uid-owner ${VPNUSER} -j ACCEPT
+
+	iptables -A INPUT -i ${NETIF} -s 192.168.0.0/24 -p udp --dport 137:138 -m state --state NEW,ESTABLISHED -j ACCEPT
+	iptables -A OUTPUT -o ${NETIF} -d 192.168.0.0/24 -p udp --sport 137:138 -m state --state ESTABLISHED -j ACCEPT
+	iptables -A INPUT -i ${NETIF} -s 192.168.0.0/24 -p tcp --dport 139 -m state --state NEW,ESTABLISHED -j ACCEPT
+	iptables -A OUTPUT -o ${NETIF} -d 192.168.0.0/24 -p tcp --sport 139 -m state --state ESTABLISHED -j ACCEPT
+	iptables -A INPUT -i ${NETIF} -s 192.168.0.0/24 -p tcp --dport 445 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+
+	if [ "${DELUGE_MODE}" == "true" ]; then
+		printf "Local IP: ${LOCALIP}\nInterface: $NETIF\nVPN IP: $VPNIP\nVPN Interface: $VPNIF\nP2P IP: $P2PIP\nVPN User: ${VPNUSER}\nMarkID: ${MARK_ID}\n"
+		echo "Deluge and VPN Settings"
+
+		echo Established VPN connections
+		iptables -A INPUT -i $VPNIF -m conntrack --ctstate ESTABLISHED -j ACCEPT
+
+		echo "block everything incoming on $VPNIF"
+		iptables -A INPUT -i $VPNIF -j REJECT
+
+		echo "let ${VPNUSER} access $VPNIF"
+		iptables -A OUTPUT -o $VPNIF -m owner --uid-owner ${VPNUSER} -j ACCEPT
+		
+		echo all packets on $VPNIF needs to be masqueraded
+		iptables -t nat -A POSTROUTING -o $VPNIF -j MASQUERADE
+
+		echo "reject connections from predator IP going over $NETIF"
+		iptables -A OUTPUT ! --src ${LOCALIP} -o $NETIF -j REJECT
+	fi
+fi
+LOG=false
+if $LOG; then
+	echo Logging
+	iptables -N LOGGING
+	iptables -A INPUT -j LOGGING
+	iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
+	iptables -A LOGGING -j DROP
+fi

network/iptables_interfaces.sh

@@ -0,0 +1,112 @@
+#!/bin/bash
+
+echo Flush existing rules
+iptables -F
+iptables -F -t nat
+iptables -F -t mangle
+iptables -F -t filter
+echo Delete all
+iptables -X
+
+
+if [ "$1" == "-d" ]; then
+	echo Input -d open all traffic
+	iptables -P INPUT ACCEPT
+	iptables -P FORWARD ACCEPT
+	exit 0
+else 
+	echo "Standard Firewall, -d to open all"
+fi
+ifx=( $(/sbin/ifconfig -s -a | tail -n +2 | cut -f1 -d' ' | grep -v lo) )
+for i in ${!ifx[@]}; do
+	ipx[$i]="$(/sbin/ifconfig ${ifx[$i]} | grep -m1 -o -P '(?<=inet ).*(?= netmask)')"
+	if [ "${ipx[$i]}" == "" ]; then 
+		ipx[$i]="----------"
+	fi
+	printf "%s:\t%s\n" "${ifx[$i]}" "${ipx[$i]}"
+done
+
+echo Set Variables
+HOST=$(hostname)
+SSHPORT=$(cat /etc/ssh/sshd_config | grep Port | grep -v "#" | cut -f2 -d' ')
+printf "Local IP: $LOCALIP\nInterface: $NETIF\n"
+
+echo Make Rules
+
+
+echo Allen verkehr blockieren 
+iptables -P INPUT DROP
+iptables -P FORWARD DROP
+iptables -P OUTPUT ACCEPT 
+
+for i in ${!ifx[@]}; do
+	LOCALIP="${ipx[$i]}"
+	NETIF="${ifx[$i]}"
+	echo "Established Connections for $NETIF"
+	iptables -A INPUT -i $NETIF -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+	iptables -A OUTPUT -o $NETIF -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+	echo "DHCP for $NETIF"
+	iptables -A OUTPUT -o $NETIF -p udp --dport 67 --sport 68 -m state --state NEW,ESTABLISHED -j ACCEPT
+	iptables -A INPUT -i $NETIF -p udp --sport 67 --dport 68 -m state --state RELATED,ESTABLISHED -j ACCEPT
+	echo "reject connections from predator IP going over $NETIF"
+	iptables -A OUTPUT ! --src $LOCALIP -o $NETIF -j REJECT
+	if [ "${HOST}" == "serverhost" ]; then
+		echo Incoming https
+		iptables -A INPUT -i $NETIF -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+		iptables -A OUTPUT -o $NETIF -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
+	fi
+	echo "Incoming SSH P3032 for $NETIF"
+	iptables -A INPUT -i $NETIF -p tcp -m state --state NEW -m tcp --dport $SSHPORT -j ACCEPT
+	iptables -A OUTPUT -o $NETIF -p tcp --sport $SSHPORT -m state --state ESTABLISHED -j ACCEPT
+	echo "Ping Reply for $NETIF"
+	iptables -A INPUT -i $NETIF -p icmp --icmp-type echo-request -j ACCEPT
+	iptables -A OUTPUT -o $NETIF -p icmp --icmp-type echo-reply -j ACCEPT
+done
+echo loopback
+iptables -A INPUT -i lo -j ACCEPT
+iptables -A OUTPUT -o lo -j ACCEPT
+
+echo Logging
+iptables -N LOGGING
+iptables -A INPUT -j LOGGING
+iptables -A LOGGING -m limit --limit 2/min -j LOG --log-prefix "IPTables Packet Dropped: " --log-level 7
+iptables -A LOGGING -j DROP
+
+#echo Outgoing https
+#iptables -A OUTPUT -o $NETIF -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
+#iptables -A INPUT -i $NETIF -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
+
+#echo torrents
+#iptables -A OUTPUT -o $NETIF -p udp -m state --state NEW,ESTABLISHED -j ACCEPT
+#iptables -A INPUT -i $NETIF -p tcp --sport 6890:6999 -m state --state NEW,ESTABLISHED -j ACCEPT
+#iptables -A INPUT -i $NETIF -p udp --sport 6890:6999 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+#echo Outgoing SSH p1160
+#iptables -A INPUT -i $NETIF -p tcp --sport 1160 -m state --state ESTABLISHED -j ACCEPT
+#iptables -A OUTPUT -o $NETIF -p tcp --dport 1160 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+#echo Ping Request
+#iptables -A OUTPUT -o $NETIF -p icmp --icmp-type echo-request -j ACCEPT
+#iptables -A INPUT -i $NETIF -p icmp --icmp-type echo-reply -j ACCEPT
+
+#echo Incoming SSH p22
+#iptables -A INPUT -i $NETIF -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
+#iptables -A OUTPUT -o $NETIF -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
+
+#echo Outgoing SSH p22
+#iptables -A INPUT -i $NETIF -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
+#iptables -A OUTPUT -o $NETIF -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
+
+#echo outgouing http
+#iptables -A OUTPUT -o $NETIF -p tcp --dport 80 -m state --state NEW -j ACCEPT
+#iptables -A INPUT -i $NETIF -p tcp --sport 80 -m state --state RELATED,ESTABLISHED -j ACCEPT
+
+#echo incoming http
+#iptables -A INPUT -i $NETIF -p tcp --dport 80 -m state --state RELATED,ESTABLISHED -j DROP
+#iptables -A OUTPUT -o $NETIF -p tcp --sport 80 -m state --state NEW -j DROP
+
+#echo DNS
+#iptables -A OUTPUT -o $NETIF -p tcp --dport 53 -m state --state NEW -j ACCEPT
+#iptables -A OUTPUT -o $NETIF -p udp --dport 53 -m state --state NEW -j ACCEPT
+#iptables -A INPUT -i $NETIF -p tcp --sport 53 -m state --state NEW -j ACCEPT
+#iptables -A INPUT -i $NETIF -p udp --sport 53 -m state --state NEW -j ACCEPT

network/networksettings.sh

@@ -0,0 +1,435 @@
+#!/bin/bash
+green="\e[32m"
+red="\e[31m"
+blue="\e[34m"
+norm="\e[0m"
+#IFS='\n'
+hostname="$(hostname)"
+export LOG_DIR="/home/lucas/.LOG"
+export VPN_DIR="/home/lucas/Documents/Dokumente/Projekte/Server/VPN/"
+export SCRIPTS_DIR="/home/lucas/Documents/Dokumente/Projekte/Server/scripts"
+ls ${SCRIPTS_DIR} >>/dev/null 2>&1
+if [ $? -ne 0 ]; then
+	export VPN_DIR="/home/lucas/Documents/Dokumente/Projekte/Server/VPN/"
+	export SCRIPTS_DIR="/home/lucas/Documents/Dokumente/Projekte/Server/scripts"
+	ls ${SCRIPTS_DIR} >>/dev/null 2>&1
+	if [ $? -ne 0 ]; then
+		echo "Script Dir Not present"
+		exit
+	fi
+fi
+ 
+date=$(date +"%m%d%H%M%S")
+SINGLE=false
+EXPRESSVPN=false
+SHARKVPN=true
+LOG=false
+DELUGE_MODE=false
+GATEWAY_MODE=false
+NORMAL_MODE=false;
+QUIT=false;
+LIST=false
+usage(){
+	printf "Usage:
+	-n\t\tNormal Mode
+	-del\t\tDeluge Mode	
+	-list\t\tList ovpn Files
+	-all\t\tUse all Files(FreeVPN)
+	-std\t\tTry a default vpn first
+	-gw\t\tGateway Mode(Raspberry)
+	-q\t\tQuit VPN
+	-l\t\tLog Output
+	-s <param>\tSearch Mode
+	-tu\t\tConnect to TU Wien VPN
+	-tud\t\tDisconnect from TU Wien VPN
+	-h\t\tHelp\n"
+}
+
+display_ip() {
+	if [ "$1" == "duser" ]; then
+		OBJ_duser_cmd="sudo -u deluge-user -i -- "
+	else
+		OBJ_duser_cmd=""
+	fi
+	echo whoami
+	OBJ_USER=$(${OBJ_duser_cmd}whoami)
+	OBJ_PUB_COUNTRY="Austria"
+	count=0
+        while true; do
+	        sleep 1
+		OBJ_PUBIP=$(${OBJ_duser_cmd}wget -T 10 -qO- ifconfig.co)
+		OBJ_PUB_COUNTRY=$(${OBJ_duser_cmd}wget -T 10 -qO- ifconfig.co/country)
+	       	if [[ "${DELUGE_MODE}" == "true" ]] || [[ "${OBJ_PUB_COUNTRY}" != "Austria" ]] && [[ "${OBJ_PUB_COUNTRY}" != "" ]] || [[ "${OBJ_PUBIP}" != "${STDIP}" ]] && [[ "${OBJ_PUBIP}" != "" ]];  then
+			break
+		fi
+		printf ". "
+		if [ ${count} -gt 20 ]; then
+			echo "Timeout... VPN Failed"
+			break
+		fi
+		((count++))
+	done
+	printf "User: ${OBJ_USER}"
+	for ((i=${#OBJ_USER};i<20;i++)); do
+		printf " "
+	done
+	printf "IP: $OBJ_PUBIP\tCountry: $OBJ_PUB_COUNTRY\n"
+}
+connect_tuwien() {
+if [  "$(pgrep openvpn)" != "" ]; then
+		printf "VPN already existing --- Killed\n"
+		kill $(pgrep openvpn)
+		sleep 1
+		pgrep openvpn
+	fi
+	printf "VPN \t\t\t\t[${green}DOWN${norm}]\n"
+	if [ $(/opt/cisco/anyconnect/bin/vpn state | grep Disconnected | wc -l) -gt 0 ]; then
+		sudo -u lucas /opt/cisco/anyconnect/bin/vpn -s < /home/lucas/.vpn_creds connect vpn.tuwien.ac.at
+		echo "Disconnect with vpn -tud"
+	else
+		echo "TU VPN not disconnected"
+	fi
+}
+disconnect_tuwien() {
+	/opt/cisco/anyconnect/bin/vpn disconnect
+	/home/lucas/Documents/Dokumente/Projekte/Server/scripts/network/networksettings.sh -std
+}
+get_config() {
+while [[ ${1:0:1} == - ]]; do
+        echo "Param: $1"
+    	[[ $1 == -n ]] && {
+                                NORMAL_MODE=true;
+                                shift 1;
+                                continue;
+                        };    
+		[[ $1 == -del ]] && {
+                                DELUGE_MODE=true;
+                                shift 1;
+                                continue;
+                        };
+        [[ $1 == -std ]] && {
+                                SINGLE=true
+				SEARCH="austria"
+                                shift 1;
+                                continue;
+                        };
+        [[ $1 == -list ]] && {
+                                LIST=true;
+                                shift 1;
+                                continue;
+                        };
+        [[ $1 == -all ]] && {
+                                EXPRESSVPN=false;
+                                shift 1;
+                                continue;
+                        };
+        [[ $1 == -gw ]] && {
+                                GATEWAY_MODE=true;
+                                shift 1;
+                                continue;
+                        };
+        [[ $1 == -q ]] && {
+                                QUIT=true;
+                                shift 1;
+                                continue;
+                        };
+        [[ $1 == -l ]] && {
+                                LOG=true;
+                                shift 1;
+                                continue;
+                        };
+        [[ $1 == -h ]] && {
+                                usage;
+         			exit;
+	 		};
+		[[ $1 == -tu ]] && {
+                                connect_tuwien;
+         			exit;
+	 		};
+		[[ $1 == -tud ]] && {
+                                disconnect_tuwien;
+         			exit;
+	 		};
+	[[ $1 == -s ]] && {
+                                if [ "$2" == "" ]; then 
+					echo "Search Parameter Missing"
+					usage;
+					exit;
+				fi
+				SINGLE=true;
+				SEARCH="$2"
+                                shift 2;
+                                continue;
+                        };
+	echo "Parameter $1 wrong"
+	usage
+	exit 1;
+done
+}
+
+connect_vpn() {
+	export STDIP=$(wget -T 10 -qO- ifconfig.co)
+	export NETIF="$(lshw -class network | grep -A6 "Ethernet interface" | grep name | awk -F': ' '{print $2}')"
+	if [ "${hostname}" == "raspberry" ]; then 
+		export NETIF="$(lshw -class network | grep -A6 "Wireless interface" | grep name | awk -F': ' '{print $2}')"
+	fi
+	find ${LOG_DIR}/log_* -mtime +1 -type f -delete
+	1>${LOG_DIR}/log_${hostname}_$date.log
+	IFS=$'\n'; set -f
+	if $EXPRESSVPN; then
+		SEARCH_EXPRESS="my_expressvpn_"
+	elif $SHARKVPN; then
+		SEARCH_EXPRESS="surfshark"
+	else 
+		SEARCH_EXPRESS=""
+	fi
+	if $SINGLE; then 
+		VPN_arr=($(find ${VPN_DIR} -name '*.ovpn' | grep "${SEARCH_EXPRESS}" | grep -i "${SEARCH}"))
+		filename="${VPN_arr[0]}"
+	else
+		VPN_arr=($(find ${VPN_DIR} -name '*.ovpn' | grep "${SEARCH_EXPRESS}"))
+		NUM=$(($RANDOM % ${#VPN_arr[@]}))
+		filename="${VPN_arr[${NUM}]}"
+	fi
+	unset IFS; set +f
+	export PUBIP=($(dig +short $(cat $filename | grep "remote " | cut -d' ' -f2)))
+	if [  "$(pgrep openvpn)" != "" ]; then
+		printf "VPN already existing --- Killed\n"
+		kill $(pgrep openvpn)
+		sleep 1
+		pgrep openvpn
+	fi
+	printf "VPN \t\t\t\t[${green}DOWN${norm}]\n"
+
+	while [ -z ${VPNIF} ] && [ ${#VPN_arr[@]} -ge 1 ] ; do
+		printf "OpenVPN: Connect to: $blue$( echo $filename | rev | cut -f1 -d'/' | rev)${norm}, ${NUM} of ${#VPN_arr[@]} VPNs\n"
+		if $DELUGE_MODE; then
+			filename_buffer="$(echo ${filename} | sed 's/\.ovpn/BUFF.ovpn/g')"
+			 if $EXPRESSVPN; then
+				cat ${filename} | grep -v 'pull' | sed 's/dev tun/client\ndev tun/g' | sed 's/<cert>/route-nopull\nscript-security 2\ndown '$(echo ${SCRIPTS_DIR} | sed 's/\//\\\//g')'\/network\/rev_routing.sh\n<cert>/g' > ${filename_buffer}
+			 elif $SHARKVPN; then
+				cat ${filename} | grep -v 'pull' | sed 's/<ca>/route-nopull\nscript-security 2\ndown '$(echo ${SCRIPTS_DIR} | sed 's/\//\\\//g')'\/network\/rev_routing.sh\n<ca>/g' > ${filename_buffer}
+			 fi
+			filename=${filename_buffer}
+		fi
+		if ${LOG}; then
+			exec  3>&1 4>&2 1>>${LOG_DIR}/log_${hostname}_$date.log  2>&1
+		fi
+		echo "${SCRIPTS_DIR}/network/openvpn.sh $filename"
+		bash ${SCRIPTS_DIR}/network/openvpn.sh $filename  
+#		if ${LOG}; then
+#			exec 1>&3 2>&4
+#		fi
+		
+		printf "Load tun interface " 
+		count=0
+		while [ -z ${VPNIF} ] && [ -z ${VPNIP} ] && [ -z ${P2PIP} ];  do
+			sleep 1
+			export VPNIF="$(ip -br link | cut -f1 -d' ' | grep -o tun[0-9])"
+			if [ ! -z ${VPNIF} ]; then
+			      export VPNIP=$(ip addr show ${VPNIF} | grep -Po '(?<=inet )([0-9\.]+)')
+			      export P2PIP=$(ip addr show ${VPNIF} | grep -Po '(?<=peer )([0-9\.]+)')
+			      export P2PIP=$VPNIP
+			fi
+			printf ". "
+			if [ ${count} -gt 20 ]; then 
+				echo "Timeout... VPN Failed"
+				break
+			fi
+			((count++))
+		done
+		echo ""	
+		echo "VPN IF: ${VPNIF}, VPN IP: ${VPNIP}, P2P IP: ${P2PIP}"
+		export MARK_ID="0x32"
+		export VPNIF="$(ip -br link | cut -f1 -d' ' | grep -o tun[0-9])"
+		export VPNUSER="deluge-user"
+		export LOCALIP=$(ip addr show ${NETIF} | grep -Po '(?<= inet )([0-9\.]+)')
+		if [ ! -z ${VPNIF} ]; then
+			export VPNIP=$(ip addr show ${VPNIF} | grep -Po '(?<=inet )([0-9\.]+)')
+			export P2PIP=$(ip addr show ${VPNIF} | grep -Po '(?<=peer )([0-9\.]+)')
+			export P2PIP=$VPNIP
+		fi
+		
+
+		if [ -z ${VPNIF} ] || [ -z ${VPNIP} ]; then
+			if ${LOG}; then
+				exec 1>&3 2>&4
+			fi
+			echo "VPN IF: ${VPNIF}, VPN IP: ${VPNIP}, P2P IP: ${P2PIP}"
+			printf "VPN\t\t\t\t[${red}FAIL${norm}]\n"
+			unset VPN_arr[${NUM}]
+			VPN_arr=("${VPN_arr[@]}")
+			if [ ${#VPN_arr[@]} -lt 1 ]; then break; fi
+			NUM=$(($RANDOM % ${#VPN_arr[@]}))
+			filename="${VPN_arr[$NUM]}"	
+			echo "VPN arr size: ${#VPN_arr[@]}, NUM: $NUM, filename: $filename"	
+			pkill openvpn
+		fi
+		if ${DELUGE_MODE}; then 
+			rm ${filename_buffer}
+			if [ "$(ls $(echo ${filename_buffer} | rev | cut -f2- -d'/' | rev) | grep "BUFF\.ovpn")" != "" ]; then 			
+				rm $(echo ${filename_buffer} | rev | cut -f2- -d'/' | rev)/*BUFF.ovpn
+			fi
+		fi
+	done
+
+	if [ -z ${VPNIF} ] || [ -z ${VPNIP} ] ; then
+		printf "VPN\t\t\t\t[${red}FAIL${norm}]\n"
+		printf "VPN Script failed: IF: ${VPNIF}\n" >>${LOG_DIR}/log_${hostname}_$date.log
+		pkill openvpn
+		exit 0
+	fi
+
+	printf "VPN\t\t\t\t[${green}OK${norm}]\n"
+
+	if ${DELUGE_MODE}; then 
+		printf "${LOCALIP} at ${NETIF}\n"  >>${LOG_DIR}/log_${hostname}_$date.log
+		printf "${VPNIP} at VPN IP: ${VPNIF} and P2P IP: ${P2PIP}, User: $VPNUSER, Mark ID: $MARK_ID\n" >>${LOG_DIR}/log_${hostname}_$date.log
+		for PUB_IP_ADDR in ${PUBIP[@]}; do
+			echo "Public VPN IP: ${PUB_IP_ADDR}" >>${LOG_DIR}/log_${hostname}_$date.log
+		done
+		printf "${VPNIF}: ${VPNIP}\n";
+		if ${LOG}; then
+			exec  3>&1 4>&2 1>>${LOG_DIR}/log_${hostname}_$date.log  2>&1
+		fi
+		printf "Execute IPTables.sh\n"
+		bash ${SCRIPTS_DIR}/network/iptables_basic.sh -deluge-mode #>>${LOG_DIR}/log_${hostname}_$date.log
+		printf "Execute routing.sh\n"
+		bash ${SCRIPTS_DIR}/network/routing.sh #>>${LOG_DIR}/log_${hostname}_$date.log
+		printf "Modified IP Route List\n"
+		ip route list
+		printf "Modified ip route list table deluge-user\n"
+		ip route list table deluge-user
+
+		printf "Set reverse path source validation to lose mode\n"
+		sysctl_var=("net.ipv4.conf.all.rp_filter" "net.ipv4.conf.default.rp_filter" "net.ipv4.conf.${VPNIF}.rp_filter" "net.ipv4.conf.lo.rp_filter" "net.ipv4.conf.${NETIF}.rp_filter")
+		for ((i=0;i<${#sysctl_var[@]};i++)); do
+			echo $1: ${sysctl_var[$i]}, $(sysctl -n ${sysctl_var[$i]})
+			if [ $(sysctl -n ${sysctl_var[$i]}) -ne 2 ]; then
+				echo $i
+				sysctl -w ${sysctl_var[$i]}=2
+			fi
+		done
+		if ${LOG}; then
+			exec 1>&3 2>&4
+		fi
+		printf "IPtables:\t\t\t[${green}OK${norm}]\n"
+		printf "IProute:\t\t\t[${green}OK${norm}]\n"
+		printf "RPFilter:\t\t\t[${green}OK${norm}]\n"
+
+		if [ "$userIP" != "$duserIP" ] && [ "$duserIP" != "" ] ; then
+		printf "VPN Settings:\t\t\t[${green}OK${norm}]\n$(whoami)IP: $userIP\nduserIP: $duserIP \n"
+		fi
+
+		printf "deluged service:\t\t"
+		if [ "$(ps -elf | grep deluged | grep 'deluge-+')" == "" ]; then
+			sudo -u deluge-user -i -- deluged
+			sleep 0.3
+			if [ $(ip addr | grep "127.0.0.2" | wc -l) -eq 0 ]; then
+				ip addr add 127.0.0.2 dev lo 
+			fi
+		fi
+		if [ "$(pgrep deluged)" != "" ]; then 
+			printf "[${blue}UP${norm}]\n"
+		else
+			printf "[${red}FAIL${norm}]\n"
+		fi
+	elif ${GATEWAY_MODE}; then
+		SUBNETIF="eth0"
+		sysctl -w net.ipv4.ip_forward=1
+		iptables -t nat -A POSTROUTING -o ${VPNIF} -j MASQUERADE
+		iptables -A FORWARD -i ${SUBNETIF} -o ${VPNIF} -j ACCEPT
+		iptables -A FORWARD -i ${VPNIF} -o ${SUBNETIF} -m state --state RELATED,ESTABLISHED -j ACCEPT
+		iptables -D FORWARD -i eth0 -o wlan0 -j ACCEPT
+		iptables -D FORWARD -i wlan0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
+		printf "${VPNIP} at VPN IP: ${VPNIF} \nP2P IP: ${P2PIP}\nUser: $VPNUSER\n"
+		for PUB_IP_ADDR in ${PUBIP[@]}; do
+			echo "Public VPN IP: ${PUB_IP_ADDR}"
+		done
+		printf "${VPNIF}: ${VPNIP}\n";
+	else 
+		printf "${VPNIP} at VPN IP: ${VPNIF}\nP2P IP: ${P2PIP}\nUser: $VPNUSER\n"
+		for PUB_IP_ADDR in ${PUBIP[@]}; do
+                        echo "Public VPN IP: ${PUB_IP_ADDR}"
+                done
+		printf "${VPNIF}: ${VPNIP}\n";
+		printf "IF: ${NETIF}\n"
+	fi
+}
+
+printf "Timestamp: $date\n" 
+get_config "$@"
+if { [ "${NORMAL_MODE}" == "false" ] && [ "${DELUGE_MODE}" == "false" ] && [ "${GATEWAY_MODE}" == "false" ]; } || [ $# -eq 0 ]; then 
+	echo "No Mode Argument passed, choose by host"
+	if [ "$(hostname)" == "quiethost" ]; then
+		NORMAL_MODE=true
+	fi 
+	if [ "$(hostname)" == "serverhost" ]; then
+		DELUGE_MODE=true
+	fi 
+	if [ "$(hostname)" == "raspberry" ]; then
+		GATEWAY_MODE=true
+	fi 
+fi
+if ${QUIT}; then 
+	if [  "$(pgrep openvpn)" == "" ]; then
+		printf "VPN not active\n"
+	else
+		echo "Disable VPN"
+		pkill openvpn
+		su - lucas -c "bash ${SCRIPTS_DIR}/profile_motd2.sh"
+	fi
+	display_ip
+	exit 0
+fi
+if ${LIST}; then 
+	find ${VPN_DIR} -name '*.ovpn'
+	exit
+fi
+if ${DELUGE_MODE} && [ "$(hostname)" != "serverhost" ]; then 
+	echo "Deluge Mode"
+	printf "Hostname is %s, continue?(y/*)" "$(hostname)" 
+	read -t 10 -n 1 choice
+	if [ "$choice" != "y" ]; then
+		printf "\nAbort\n"
+		exit
+	fi
+elif ${DELUGE_MODE}; then
+	printf "${blue}Deluge Mode${norm}\n"
+fi	
+if ${GATEWAY_MODE} && [ "$(hostname)" != "raspberry" ]; then 
+	echo "Gateway Mode"
+	printf "Hostname is %s, continue?(y/*)" "$(hostname)" 
+	read -t 10 -n 1 choice
+	if [ "$choice" != "y" ]; then
+		printf "\nAbort\n"
+		exit
+	fi
+elif ${GATEWAY_MODE}; then
+	printf "${blue}Gateway Mode${norm}\n"
+fi
+if ${NORMAL_MODE}; then
+	printf "${blue}Normal Mode${norm}\n"
+fi
+connect_vpn
+sleep 2
+display_ip
+
+if ${DELUGE_MODE}; then
+	display_ip "duser"
+	if [[ "$(ps -elf | grep -v grep | grep noip)" == "" ]] ; then
+		if [[ "$(service noip-duc status | grep 'active (running)')" == "" ]]; then
+			#/usr/local/bin/noip2 &
+			# Install noip service
+			#
+			echo "Install noip service"
+		fi
+	fi
+elif ${GATEWAY_MODE}; then
+	if [ "$(hostname)" == "quiethost" ]; then
+		bash "${SCRIPTS_DIR}/profile_motd2.sh"
+	fi 
+fi
+if [ "$(hostname)" == "quiethost" ]; then
+	su - lucas -c "bash ${SCRIPTS_DIR}/quiethost/servertunnel.sh"
+fi

network/openvpn.sh

@@ -0,0 +1,42 @@
+#!/bin/bash
+
+if [ $1 == "" ]; then 
+	filename="${VPN_DIR}/my_expressvpn_usa_-_new_york_udp.ovpn"
+else 
+	filename=$1
+fi
+#echo $filename
+if [[ "$filname" == *"vpnbook"* ]]; then
+	username="vpnbook"
+	password="$(${SCRIPTS_DIR}/network/vpnpassword.sh vpnbook)"
+elif [[ $filename == *"FreeVPN"* ]]; then 
+	username="freevpn.$(echo $filename | cut -f2- -d'.' | cut -f1 -d'-')"
+	password="$(${SCRIPTS_DIR}/network/vpnpassword.sh $username)"
+elif [[ "$filename" == *"expressvpn"* ]]; then
+        username="x5yn6ytav3opb4ubjqvy13g5"
+        password="joao7n67han31uwq8it6s3jb"
+elif [[ "$filename" == *"surfshark"* ]]; then
+        username="RjzbvqjFFa9AzDrxvUTwrfPA"
+        password="DtTnSbzS2tcWjScfGP6WZBXb"
+else
+	echo "Wrong Input File"
+	exit 0
+fi
+
+if [ $password == "" ]; then 
+	exec 1>&3 2>&4
+	echo "Get Password Failed: Password: $password"
+fi
+
+echo "User: $username"
+echo "Password: $password"
+echo "Config File: $filename"
+expect <<EOD
+spawn sudo openvpn --config $filename 
+expect "Username: "
+send "$username\r"
+expect "Password: "
+send "$password\r"
+expect EOF
+EOD
+exit 0

network/rev_routing.sh

@@ -0,0 +1,22 @@
+#! /bin/bash
+LOGFILE="/home/lucas/Documents/Dokumente/Dokumente/Projekte/Server/VPN/LOG/log_down.log"
+> ${LOGFILE}
+echo $(id) >> ${LOGFILE}
+date  >> ${LOGFILE}
+
+if [ "$(cat /etc/iproute2/rt_tables | grep "deluge-user")" != "" ]; then
+	if [ "$1" == "inet" ]; then
+		printf "routing table for deluge-user for noral internet\n"
+		ip route flush table deluge-user
+		ip route add default via 10.0.0.138 dev eth0  proto static  metric 100 table deluge-user
+		ip route add 10.0.0.0/24 dev eth0  proto kernel  scope link  src 10.0.0.2  metric 100 table deluge-user
+	else
+		printf "routing table for deluge-user blocking all traffic\n" >> ${LOGFILE}
+		ip route flush table deluge-user
+		ip route replace default via 127.0.0.1 table deluge-user
+		ip route flush cache
+	fi
+elif [ "$(hostname)" == "raspberry" ]; then
+	bash /home/lucas/Documents/Dokumente/Dokumente/Projekte/Server/scripts/iptables_basic.sh
+fi
+exit 0

network/routing.sh

@@ -0,0 +1,50 @@
+#! /bin/bash
+# Niftiest Software – www.niftiestsoftware.com
+# Modified version by HTPC Guides – www.htpcguides.com
+echo VPNUSER: $VPNUSER
+if [[ "$(grep $VPNUSER /etc/iproute2/rt_tables)" == "" ]]; then
+	sudo sh -c 'echo "1   deluge-user" >> /etc/iproute2/rt_tables'
+fi
+if [ "$1" == "reverse" ]; then
+	VPNUSER="$2"
+	printf "reverse table for ${VPNUSER}\n"
+	ip route flush table ${VPNUSER}
+	ip route replace default via 127.0.0.1 table ${VPNUSER}
+	ip route flush cache
+	exit 0
+fi
+#${VPNIF}="tun+"
+#VPNUSER="deluge-user"
+#VPNIP="10.15.0.*"
+printf "${LOCALIP}\n${NETIF}\n${VPNIP}\n${VPNIF}\n${P2PIP}\n${VPNUSER}\n"
+printf "Flush old ${VPNUSER} table\n"
+ip route flush table ${VPNUSER}
+
+#printf "Flush Main Table(Revert VPN Changes) and restore default\n"
+#ip route flush table main
+#ip route add 10.0.0.0/24 dev eth0  proto kernel  scope link  src 10.0.0.2  metric 100 
+#ip route add 37.48.66.67 via 10.0.0.138 dev eth0  proto static  metric 100 
+#ip route add 169.254.0.0/16 dev eth0  proto static  scope link  metric 1000 
+#ip route add default via 10.0.0.138 dev eth0  proto static  metric 100 
+
+printf "Add rule for marked packets\n"
+if [[ $(ip rule list | grep -c ${MARK_ID}) == 0 ]]; then
+ip rule add from all fwmark ${MARK_ID} lookup ${VPNUSER}
+fi
+printf "Replace Default, Append Default, Flush cache\n"
+ip route replace default via ${P2PIP} table ${VPNUSER}
+#ip route append default via 127.0.0.1 dev lo table ${VPNUSER}
+for PUB_IP_ADDR in ${PUBIP[@]}; do
+	echo "ip route add ${PUB_IP_ADDR}/32 via ${P2PIP} dev ${VPNIF} table ${VPNUSER}"
+	ip route add ${PUB_IP_ADDR}/32 via ${P2PIP} dev ${VPNIF} table ${VPNUSER}
+done
+#ip route add 0.0.0.0/1 via ${VPNIP} dev ${VPNIF} table ${VPNUSER}
+#ip route add 128.0.0.0/1 via 10.15.0.125 table ${VPNUSER}
+#ip route add 10.15.0.1/32 via ${VPNIP} dev ${VPNIF} table ${VPNUSER}
+#ip route add ${P2PIP} dev ${VPNIF}  proto kernel  scope link  src ${VPNIP} table ${VPNUSER}
+ip route flush cache
+
+printf "run update-resolv-conf script to set VPN DNS\n"
+/etc/openvpn/update-resolv-conf
+
+exit 0

network/state.sh

@@ -0,0 +1,9 @@
+#!bin/bash
+printf "IP Rules:\n"
+ip rule
+printf "IP Routes:\n"
+ip route list
+printf "IP Routes for duser:\n"
+ip route list table deluge-user
+printf "IP Table:\n"
+sudo iptables -L 

network/vpnpassword.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+#VPNBook
+#username vpnbook
+#password GE3epep
+#FreeVPN
+#username freevpnme
+#password 1tBm0P2DN4gG
+if [ "$1" = "vpnbook" ]; then
+	password=$(wget http://www.vpnbook.com/freevpn -q -O - | tr -d ' ' | grep -m1 -o -P '(?<=<li>Password:<strong>).*(?=</strong></li>)')
+else
+	password=$(wget https://$1/accounts/ -q -O - | tr -d ' ' | sed 's/Password:<\/b>/PWD;/g' | tr '<>' '\n' | grep -m1 "PWD;" | sed 's/PWD;//g')
+	#password="ykDJYnCIirN"
+fi
+echo "${password}"