totp

VM_VPN_GATEWAY.sh

@@ -1,46 +1,27 @@
 #!/bin/bash
 
-# Temos que configurar a VPN gateway (duh)
-# O gateway client é o VM_ROAD_WARRIOR :) 
-#
-# O gateway client é a pont entre a rede externa 193.136.212.0/24
-# E a rede interna 10.60.0.0/24
-
 # NOTE(vasco): 
 # Ao configurar a maquina virtual em si deixei a rede externa primeiro (enp0s8)
 # E a rede interna como a segunda interface (enp0s9).
 
+# --- configuração --- #
 source VM_CONFIG.sh
+yum install -y google-authenticator
 
-# --- variaveis aqui pf joao fr fr fr aaaaa --- #
-helloworld="print"
-
+# --- forwarding --- #
 if_fora="enp0s8"
 ip_fora="193.136.212.1"
-
 if_dentro="enp0s9"
 ip_dentro="10.60.0.3"
-
 mega_tunel="tun0"
 ip_mega_tunel="10.8.0.0/24"
 
-# --- interfaces --- #
 ifconfig $if_fora $ip_fora netmask 255.255.255.0
 ifconfig $if_dentro $ip_dentro netmask 255.255.255.0
 
-# --- ip forwarding --- #
 echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
 sysctl -p /etc/sysctl.conf
 
-# --- nat forwardin de vpn para clientes --- #
-
-# ?????????????????????????????????????????????????????????????????????
-# iptables -I INPUT -i tun0 -j ACCEPT
-# iptables -I OUTPUT -o tun0 -j ACCEPT
-# echo 0 > /proc/sys/net/ipv4/conf/all/rp_filter
-# echo 0 > /proc/sys/net/ipv4/conf/tun0/rp_filter
-# echo 0 > /proc/sys/net/ipv4/conf/default/rp_filter
-
 iptables -A INPUT  -p udp --dport 1194 -j ACCEPT # :O
 iptables -A FORWARD -i $mega_tunel -o $if_dentro -j ACCEPT # :P
 iptables -A FORWARD -i $if_dentro -o $mega_tunel -j ACCEPT # ;)
@@ -49,13 +30,13 @@ iptables -A FORWARD -i $if_fora -m state --state ESTABLISHED,RELATED -j ACCEPT #
 iptables -t nat -A POSTROUTING -s $ip_mega_tunel -o $if_fora -j MASQUERADE # :D
 iptables-save > /etc/sysconfig/iptables # :3
 
-# servidor
+# --- vpn server --- #
 vpn_dir="/etc/openvpn/server"
 cp ca/ta.key $vpn_dir 
 cp ca/ca.crt $vpn_dir 
 cp ca/vpn.key $vpn_dir 
 cp ca/vpn.crt $vpn_dir 
-cp vpn.conf $vpn_dir 
-
-# correr serviço
+cp ca/dh2048.pem $vpn_dir 
+cp conf/vpn.conf $vpn_dir 
+cp conf/totp /etc/pam.d/
 systemctl enable --now openvpn-server@vpn.service