mirror of
https://github.com/skurudo/mikrotik-chr-installer.git
synced 2026-10-19 07:23:53 +00:00
chr configuration updates
This commit is contained in:
Pavel Galkin
parent
170bde257a
commit
f6edc86c59
6 changed files with 244 additions and 64 deletions
|
|
@ -27,6 +27,15 @@ generate_wireguard_key() {
|
|||
head -c 32 /dev/urandom | base64
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# INPUT SANITIZATION
|
||||
# ============================================
|
||||
sanitize_input() {
|
||||
local input="$1"
|
||||
# Remove dangerous characters: ; " ' ` $ \ / and newlines
|
||||
echo "$input" | tr -d ';"'\''`$\\/\n\r' | head -c 64
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# CONFIGURATION
|
||||
# ============================================
|
||||
|
|
@ -37,8 +46,8 @@ CHR_IMG="chr-${CHR_VERSION}.img"
|
|||
WORK_DIR="/tmp/chr-install"
|
||||
MOUNT_POINT="/mnt/chr"
|
||||
|
||||
# CHR Settings
|
||||
ADMIN_PASSWORD="PASSWORD"
|
||||
# CHR Settings (password auto-generated if not specified)
|
||||
ADMIN_PASSWORD=""
|
||||
DNS_SERVERS="8.8.8.8,8.8.4.4"
|
||||
ROUTER_NAME="MikroTik-VPN"
|
||||
TIMEZONE="Europe/Moscow"
|
||||
|
|
@ -56,7 +65,7 @@ WG_SERVER_PRIVATE_KEY=""
|
|||
WG_NETWORK="10.10.20.0/24"
|
||||
OVPN_PORT="1194"
|
||||
OVPN_TCP_PORT="1195"
|
||||
SSTP_PORT="443"
|
||||
SSTP_PORT="8443"
|
||||
|
||||
# Flags
|
||||
FORCE_DOWNLOAD=false
|
||||
|
|
@ -72,7 +81,7 @@ usage() {
|
|||
echo "CHR installation script as VPN server with all protocols:"
|
||||
echo " - PPTP (port 1723)"
|
||||
echo " - L2TP/IPsec (port 1701, UDP 500/4500)"
|
||||
echo " - SSTP (port 443)"
|
||||
echo " - SSTP (port 8443)"
|
||||
echo " - OpenVPN (port 1194 UDP/TCP, 1195 TCP)"
|
||||
echo " - WireGuard (port 51820)"
|
||||
echo ""
|
||||
|
|
@ -81,7 +90,7 @@ usage() {
|
|||
echo " --yes, -y No confirmations (automatic mode)"
|
||||
echo " --reboot Automatic reboot (requires --yes)"
|
||||
echo " --version VER CHR version (default: $CHR_VERSION)"
|
||||
echo " --password PASS Admin password (default: $ADMIN_PASSWORD)"
|
||||
echo " --password PASS Admin password (auto-generated)"
|
||||
echo " --name NAME Router name (default: $ROUTER_NAME)"
|
||||
echo " --timezone TZ Timezone (default: $TIMEZONE)"
|
||||
echo " --dns SERVERS DNS servers (default: $DNS_SERVERS)"
|
||||
|
|
@ -121,35 +130,35 @@ while [[ $# -gt 0 ]]; do
|
|||
shift 2
|
||||
;;
|
||||
--password)
|
||||
ADMIN_PASSWORD="$2"
|
||||
ADMIN_PASSWORD=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--name)
|
||||
ROUTER_NAME="$2"
|
||||
ROUTER_NAME=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--timezone)
|
||||
TIMEZONE="$2"
|
||||
TIMEZONE=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--dns)
|
||||
DNS_SERVERS="$2"
|
||||
DNS_SERVERS=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--vpn-user)
|
||||
VPN_USER="$2"
|
||||
VPN_USER=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--vpn-pass)
|
||||
VPN_USER_PASSWORD="$2"
|
||||
VPN_USER_PASSWORD=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--vpn-pool)
|
||||
VPN_POOL="$2"
|
||||
VPN_POOL=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--ipsec-secret)
|
||||
IPSEC_SECRET="$2"
|
||||
IPSEC_SECRET=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--wg-port)
|
||||
|
|
@ -171,6 +180,11 @@ done
|
|||
# ============================================
|
||||
log_info "Generating keys and passwords..."
|
||||
|
||||
if [[ -z "$ADMIN_PASSWORD" ]]; then
|
||||
ADMIN_PASSWORD=$(generate_password 16)
|
||||
log_info "Generated admin password: $ADMIN_PASSWORD"
|
||||
fi
|
||||
|
||||
if [[ -z "$VPN_USER_PASSWORD" ]]; then
|
||||
VPN_USER_PASSWORD=$(generate_password 16)
|
||||
log_info "Generated VPN password: $VPN_USER_PASSWORD"
|
||||
|
|
@ -400,6 +414,12 @@ cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
|
|||
# ============================================
|
||||
/ppp profile add name=vpn-profile local-address=${VPN_LOCAL_IP} remote-address=vpn-pool dns-server=${DNS_SERVERS} use-encryption=yes
|
||||
|
||||
# ============================================
|
||||
# VPN - OPENVPN PUSH ROUTES
|
||||
# ============================================
|
||||
# Default route through VPN (all traffic)
|
||||
/ppp profile set vpn-profile push-routes="0.0.0.0/0 ${VPN_LOCAL_IP}"
|
||||
|
||||
# ============================================
|
||||
# VPN - USER
|
||||
# ============================================
|
||||
|
|
@ -459,9 +479,15 @@ cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
|
|||
/ip firewall nat add chain=dstnat protocol=tcp dst-port=${OVPN_TCP_PORT} action=redirect to-ports=${OVPN_PORT} comment="Redirect OpenVPN TCP alt port to main"
|
||||
|
||||
# ============================================
|
||||
# FIREWALL - SSH BRUTE-FORCE PROTECTION
|
||||
# FIREWALL - BASIC RULES (first for performance)
|
||||
# ============================================
|
||||
/ip firewall filter
|
||||
add chain=input connection-state=established,related action=accept comment="Accept established connections"
|
||||
add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
|
||||
|
||||
# ============================================
|
||||
# FIREWALL - SSH BRUTE-FORCE PROTECTION
|
||||
# ============================================
|
||||
add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop comment="Drop SSH brute force"
|
||||
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w
|
||||
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m
|
||||
|
|
@ -486,10 +512,8 @@ add chain=input protocol=udp dst-port=53 action=drop comment="Drop external DNS
|
|||
add chain=input protocol=tcp dst-port=53 action=drop comment="Drop external DNS TCP queries"
|
||||
|
||||
# ============================================
|
||||
# FIREWALL - BASIC RULES
|
||||
# FIREWALL - ALLOWED SERVICES
|
||||
# ============================================
|
||||
add chain=input connection-state=established,related action=accept comment="Accept established connections"
|
||||
add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
|
||||
add chain=input protocol=icmp action=accept comment="Accept ICMP (ping)"
|
||||
add chain=input protocol=tcp dst-port=22 action=accept comment="Accept SSH"
|
||||
add chain=input protocol=tcp dst-port=8291 action=accept comment="Accept WinBox"
|
||||
|
|
@ -543,6 +567,11 @@ add chain=forward action=drop comment="Drop all other forward"
|
|||
# NAT - MASQUERADE FOR ALL OUTGOING TRAFFIC
|
||||
# ============================================
|
||||
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT for all outgoing traffic"
|
||||
|
||||
# ============================================
|
||||
# SECURITY - REMOVE AUTORUN AFTER EXECUTION
|
||||
# ============================================
|
||||
/file remove [find name~"autorun"]
|
||||
EOF
|
||||
|
||||
sync
|
||||
|
|
@ -651,6 +680,7 @@ echo -e "${GREEN} SAVE THIS INFORMATION!${NC}"
|
|||
echo -e "${GREEN}═══════════════════════════════════════════${NC}"
|
||||
echo ""
|
||||
echo "Server: ${SERVER_IP}"
|
||||
echo "Admin password: ${ADMIN_PASSWORD}"
|
||||
echo ""
|
||||
echo "PPTP/L2TP/SSTP/OpenVPN:"
|
||||
echo " Username: ${VPN_USER}"
|
||||
|
|
|
|||
|
|
@ -27,6 +27,15 @@ generate_wireguard_key() {
|
|||
head -c 32 /dev/urandom | base64
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# САНИТИЗАЦИЯ ВХОДНЫХ ДАННЫХ
|
||||
# ============================================
|
||||
sanitize_input() {
|
||||
local input="$1"
|
||||
# Удаляем опасные символы: ; " ' ` $ \ / и переносы строк
|
||||
echo "$input" | tr -d ';"'\''`$\\/\n\r' | head -c 64
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# КОНФИГУРАЦИЯ
|
||||
# ============================================
|
||||
|
|
@ -37,8 +46,8 @@ CHR_IMG="chr-${CHR_VERSION}.img"
|
|||
WORK_DIR="/tmp/chr-install"
|
||||
MOUNT_POINT="/mnt/chr"
|
||||
|
||||
# Настройки CHR
|
||||
ADMIN_PASSWORD="PASSWORD"
|
||||
# Настройки CHR (пароль генерируется автоматически если не указан)
|
||||
ADMIN_PASSWORD=""
|
||||
DNS_SERVERS="8.8.8.8,8.8.4.4"
|
||||
ROUTER_NAME="MikroTik-VPN"
|
||||
TIMEZONE="Europe/Moscow"
|
||||
|
|
@ -56,7 +65,7 @@ WG_SERVER_PRIVATE_KEY=""
|
|||
WG_NETWORK="10.10.20.0/24"
|
||||
OVPN_PORT="1194"
|
||||
OVPN_TCP_PORT="1195"
|
||||
SSTP_PORT="443"
|
||||
SSTP_PORT="8443"
|
||||
|
||||
# Флаги
|
||||
FORCE_DOWNLOAD=false
|
||||
|
|
@ -72,7 +81,7 @@ usage() {
|
|||
echo "Скрипт установки CHR как VPN-сервера со всеми протоколами:"
|
||||
echo " - PPTP (порт 1723)"
|
||||
echo " - L2TP/IPsec (порт 1701, UDP 500/4500)"
|
||||
echo " - SSTP (порт 443)"
|
||||
echo " - SSTP (порт 8443)"
|
||||
echo " - OpenVPN (порт 1194 UDP/TCP, 1195 TCP)"
|
||||
echo " - WireGuard (порт 51820)"
|
||||
echo ""
|
||||
|
|
@ -81,7 +90,7 @@ usage() {
|
|||
echo " --yes, -y Без подтверждений (автоматический режим)"
|
||||
echo " --reboot Автоматическая перезагрузка (требует --yes)"
|
||||
echo " --version VER Версия CHR (по умолчанию: $CHR_VERSION)"
|
||||
echo " --password PASS Пароль admin (по умолчанию: $ADMIN_PASSWORD)"
|
||||
echo " --password PASS Пароль admin (генерируется автоматически)"
|
||||
echo " --name NAME Имя роутера (по умолчанию: $ROUTER_NAME)"
|
||||
echo " --timezone TZ Часовой пояс (по умолчанию: $TIMEZONE)"
|
||||
echo " --dns SERVERS DNS серверы (по умолчанию: $DNS_SERVERS)"
|
||||
|
|
@ -121,35 +130,35 @@ while [[ $# -gt 0 ]]; do
|
|||
shift 2
|
||||
;;
|
||||
--password)
|
||||
ADMIN_PASSWORD="$2"
|
||||
ADMIN_PASSWORD=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--name)
|
||||
ROUTER_NAME="$2"
|
||||
ROUTER_NAME=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--timezone)
|
||||
TIMEZONE="$2"
|
||||
TIMEZONE=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--dns)
|
||||
DNS_SERVERS="$2"
|
||||
DNS_SERVERS=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--vpn-user)
|
||||
VPN_USER="$2"
|
||||
VPN_USER=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--vpn-pass)
|
||||
VPN_USER_PASSWORD="$2"
|
||||
VPN_USER_PASSWORD=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--vpn-pool)
|
||||
VPN_POOL="$2"
|
||||
VPN_POOL=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--ipsec-secret)
|
||||
IPSEC_SECRET="$2"
|
||||
IPSEC_SECRET=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--wg-port)
|
||||
|
|
@ -171,6 +180,11 @@ done
|
|||
# ============================================
|
||||
log_info "Генерация ключей и паролей..."
|
||||
|
||||
if [[ -z "$ADMIN_PASSWORD" ]]; then
|
||||
ADMIN_PASSWORD=$(generate_password 16)
|
||||
log_info "Сгенерирован пароль admin: $ADMIN_PASSWORD"
|
||||
fi
|
||||
|
||||
if [[ -z "$VPN_USER_PASSWORD" ]]; then
|
||||
VPN_USER_PASSWORD=$(generate_password 16)
|
||||
log_info "Сгенерирован пароль VPN: $VPN_USER_PASSWORD"
|
||||
|
|
@ -400,6 +414,12 @@ cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
|
|||
# ============================================
|
||||
/ppp profile add name=vpn-profile local-address=${VPN_LOCAL_IP} remote-address=vpn-pool dns-server=${DNS_SERVERS} use-encryption=yes
|
||||
|
||||
# ============================================
|
||||
# VPN - OPENVPN PUSH ROUTES
|
||||
# ============================================
|
||||
# Маршрут по умолчанию через VPN (весь трафик)
|
||||
/ppp profile set vpn-profile push-routes="0.0.0.0/0 ${VPN_LOCAL_IP}"
|
||||
|
||||
# ============================================
|
||||
# VPN - ПОЛЬЗОВАТЕЛЬ
|
||||
# ============================================
|
||||
|
|
@ -459,9 +479,15 @@ cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
|
|||
/ip firewall nat add chain=dstnat protocol=tcp dst-port=${OVPN_TCP_PORT} action=redirect to-ports=${OVPN_PORT} comment="Redirect OpenVPN TCP alt port to main"
|
||||
|
||||
# ============================================
|
||||
# ФАЙРВОЛ - ЗАЩИТА ОТ БРУТФОРСА SSH
|
||||
# ФАЙРВОЛ - БАЗОВЫЕ ПРАВИЛА (в начале для производительности)
|
||||
# ============================================
|
||||
/ip firewall filter
|
||||
add chain=input connection-state=established,related action=accept comment="Accept established connections"
|
||||
add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
|
||||
|
||||
# ============================================
|
||||
# ФАЙРВОЛ - ЗАЩИТА ОТ БРУТФОРСА SSH
|
||||
# ============================================
|
||||
add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop comment="Drop SSH brute force"
|
||||
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w
|
||||
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m
|
||||
|
|
@ -486,10 +512,8 @@ add chain=input protocol=udp dst-port=53 action=drop comment="Drop external DNS
|
|||
add chain=input protocol=tcp dst-port=53 action=drop comment="Drop external DNS TCP queries"
|
||||
|
||||
# ============================================
|
||||
# ФАЙРВОЛ - БАЗОВЫЕ ПРАВИЛА
|
||||
# ФАЙРВОЛ - РАЗРЕШЁННЫЕ СЕРВИСЫ
|
||||
# ============================================
|
||||
add chain=input connection-state=established,related action=accept comment="Accept established connections"
|
||||
add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
|
||||
add chain=input protocol=icmp action=accept comment="Accept ICMP (ping)"
|
||||
add chain=input protocol=tcp dst-port=22 action=accept comment="Accept SSH"
|
||||
add chain=input protocol=tcp dst-port=8291 action=accept comment="Accept WinBox"
|
||||
|
|
@ -543,6 +567,11 @@ add chain=forward action=drop comment="Drop all other forward"
|
|||
# NAT - MASQUERADE ДЛЯ ВСЕГО ИСХОДЯЩЕГО ТРАФИКА
|
||||
# ============================================
|
||||
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT for all outgoing traffic"
|
||||
|
||||
# ============================================
|
||||
# БЕЗОПАСНОСТЬ - УДАЛЕНИЕ AUTORUN ПОСЛЕ ВЫПОЛНЕНИЯ
|
||||
# ============================================
|
||||
/file remove [find name~"autorun"]
|
||||
EOF
|
||||
|
||||
sync
|
||||
|
|
@ -651,6 +680,7 @@ echo -e "${GREEN} СОХРАНИТЕ ЭТИ ДАННЫЕ!${NC}"
|
|||
echo -e "${GREEN}═══════════════════════════════════════════${NC}"
|
||||
echo ""
|
||||
echo "Сервер: ${SERVER_IP}"
|
||||
echo "Admin пароль: ${ADMIN_PASSWORD}"
|
||||
echo ""
|
||||
echo "PPTP/L2TP/SSTP/OpenVPN:"
|
||||
echo " Пользователь: ${VPN_USER}"
|
||||
|
|
|
|||
|
|
@ -13,6 +13,20 @@ log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
|
|||
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
|
||||
log_debug() { echo -e "${CYAN}[DEBUG]${NC} $1"; }
|
||||
|
||||
# ============================================
|
||||
# PASSWORD GENERATION AND SANITIZATION
|
||||
# ============================================
|
||||
generate_password() {
|
||||
local length=$1
|
||||
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$length"
|
||||
}
|
||||
|
||||
sanitize_input() {
|
||||
local input="$1"
|
||||
# Remove dangerous characters: ; " ' ` $ \ / and newlines
|
||||
echo "$input" | tr -d ';"'\''`$\\/\n\r' | head -c 64
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# CONFIGURATION
|
||||
# ============================================
|
||||
|
|
@ -23,8 +37,8 @@ CHR_IMG="chr-${CHR_VERSION}.img"
|
|||
WORK_DIR="/tmp/chr-install"
|
||||
MOUNT_POINT="/mnt/chr"
|
||||
|
||||
# CHR Settings
|
||||
ADMIN_PASSWORD="PASSWORD"
|
||||
# CHR Settings (password auto-generated if not specified)
|
||||
ADMIN_PASSWORD=""
|
||||
DNS_SERVERS="8.8.8.8,8.8.4.4"
|
||||
ROUTER_NAME="MikroTik-CHR"
|
||||
TIMEZONE="Europe/Moscow"
|
||||
|
|
@ -52,7 +66,7 @@ usage() {
|
|||
echo " --yes, -y No confirmations (automatic mode)"
|
||||
echo " --reboot Automatic reboot (requires --yes)"
|
||||
echo " --version VER CHR version (default: $CHR_VERSION)"
|
||||
echo " --password PASS Admin password (default: $ADMIN_PASSWORD)"
|
||||
echo " --password PASS Admin password (auto-generated)"
|
||||
echo " --name NAME Router name (default: $ROUTER_NAME)"
|
||||
echo " --timezone TZ Timezone (default: $TIMEZONE)"
|
||||
echo " --dns SERVERS DNS servers (default: $DNS_SERVERS)"
|
||||
|
|
@ -87,19 +101,19 @@ while [[ $# -gt 0 ]]; do
|
|||
shift 2
|
||||
;;
|
||||
--password)
|
||||
ADMIN_PASSWORD="$2"
|
||||
ADMIN_PASSWORD=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--name)
|
||||
ROUTER_NAME="$2"
|
||||
ROUTER_NAME=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--timezone)
|
||||
TIMEZONE="$2"
|
||||
TIMEZONE=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--dns)
|
||||
DNS_SERVERS="$2"
|
||||
DNS_SERVERS=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
-h|--help)
|
||||
|
|
@ -112,6 +126,14 @@ while [[ $# -gt 0 ]]; do
|
|||
esac
|
||||
done
|
||||
|
||||
# ============================================
|
||||
# PASSWORD GENERATION (if not specified)
|
||||
# ============================================
|
||||
if [[ -z "$ADMIN_PASSWORD" ]]; then
|
||||
ADMIN_PASSWORD=$(generate_password 16)
|
||||
log_info "Generated admin password: $ADMIN_PASSWORD"
|
||||
fi
|
||||
|
||||
# ============================================
|
||||
# ROOT CHECK
|
||||
# ============================================
|
||||
|
|
@ -319,9 +341,15 @@ cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
|
|||
/ip service set winbox disabled=no
|
||||
|
||||
# ============================================
|
||||
# FIREWALL - SSH BRUTE-FORCE PROTECTION
|
||||
# FIREWALL - BASIC RULES (first for performance)
|
||||
# ============================================
|
||||
/ip firewall filter
|
||||
add chain=input connection-state=established,related action=accept comment="Accept established connections"
|
||||
add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
|
||||
|
||||
# ============================================
|
||||
# FIREWALL - SSH BRUTE-FORCE PROTECTION
|
||||
# ============================================
|
||||
add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop comment="Drop SSH brute force"
|
||||
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w
|
||||
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m
|
||||
|
|
@ -349,10 +377,8 @@ add chain=input protocol=udp dst-port=53 action=drop comment="Drop external DNS
|
|||
add chain=input protocol=tcp dst-port=53 action=drop comment="Drop external DNS TCP queries"
|
||||
|
||||
# ============================================
|
||||
# FIREWALL - BASIC RULES
|
||||
# FIREWALL - ALLOWED SERVICES
|
||||
# ============================================
|
||||
add chain=input connection-state=established,related action=accept comment="Accept established connections"
|
||||
add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
|
||||
add chain=input protocol=icmp action=accept comment="Accept ICMP (ping)"
|
||||
add chain=input protocol=tcp dst-port=22 action=accept comment="Accept SSH"
|
||||
add chain=input protocol=tcp dst-port=8291 action=accept comment="Accept WinBox"
|
||||
|
|
@ -375,6 +401,11 @@ add chain=input action=drop comment="Drop all other input"
|
|||
# NAT - MASQUERADE
|
||||
# ============================================
|
||||
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT for all outgoing traffic"
|
||||
|
||||
# ============================================
|
||||
# SECURITY - REMOVE AUTORUN AFTER EXECUTION
|
||||
# ============================================
|
||||
/file remove [find name~"autorun"]
|
||||
EOF
|
||||
|
||||
sync
|
||||
|
|
@ -467,6 +498,7 @@ log_info "CHR installation with basic config completed!"
|
|||
log_info "=========================================="
|
||||
echo ""
|
||||
echo "CHR will be available at: ${ADDRESS%/*}"
|
||||
echo "Admin password: ${ADMIN_PASSWORD}"
|
||||
echo ""
|
||||
echo -e "${GREEN}Configured:${NC}"
|
||||
echo " • Router name: $ROUTER_NAME"
|
||||
|
|
|
|||
|
|
@ -13,6 +13,20 @@ log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
|
|||
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
|
||||
log_debug() { echo -e "${CYAN}[DEBUG]${NC} $1"; }
|
||||
|
||||
# ============================================
|
||||
# ГЕНЕРАЦИЯ ПАРОЛЕЙ И САНИТИЗАЦИЯ
|
||||
# ============================================
|
||||
generate_password() {
|
||||
local length=$1
|
||||
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$length"
|
||||
}
|
||||
|
||||
sanitize_input() {
|
||||
local input="$1"
|
||||
# Удаляем опасные символы: ; " ' ` $ \ / и переносы строк
|
||||
echo "$input" | tr -d ';"'\''`$\\/\n\r' | head -c 64
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# КОНФИГУРАЦИЯ
|
||||
# ============================================
|
||||
|
|
@ -23,8 +37,8 @@ CHR_IMG="chr-${CHR_VERSION}.img"
|
|||
WORK_DIR="/tmp/chr-install"
|
||||
MOUNT_POINT="/mnt/chr"
|
||||
|
||||
# Настройки CHR
|
||||
ADMIN_PASSWORD="PASSWORD"
|
||||
# Настройки CHR (пароль генерируется автоматически если не указан)
|
||||
ADMIN_PASSWORD=""
|
||||
DNS_SERVERS="8.8.8.8,8.8.4.4"
|
||||
ROUTER_NAME="MikroTik-CHR"
|
||||
TIMEZONE="Europe/Moscow"
|
||||
|
|
@ -52,7 +66,7 @@ usage() {
|
|||
echo " --yes, -y Без подтверждений (автоматический режим)"
|
||||
echo " --reboot Автоматическая перезагрузка (требует --yes)"
|
||||
echo " --version VER Версия CHR (по умолчанию: $CHR_VERSION)"
|
||||
echo " --password PASS Пароль admin (по умолчанию: $ADMIN_PASSWORD)"
|
||||
echo " --password PASS Пароль admin (генерируется автоматически)"
|
||||
echo " --name NAME Имя роутера (по умолчанию: $ROUTER_NAME)"
|
||||
echo " --timezone TZ Часовой пояс (по умолчанию: $TIMEZONE)"
|
||||
echo " --dns SERVERS DNS серверы (по умолчанию: $DNS_SERVERS)"
|
||||
|
|
@ -87,19 +101,19 @@ while [[ $# -gt 0 ]]; do
|
|||
shift 2
|
||||
;;
|
||||
--password)
|
||||
ADMIN_PASSWORD="$2"
|
||||
ADMIN_PASSWORD=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--name)
|
||||
ROUTER_NAME="$2"
|
||||
ROUTER_NAME=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--timezone)
|
||||
TIMEZONE="$2"
|
||||
TIMEZONE=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
--dns)
|
||||
DNS_SERVERS="$2"
|
||||
DNS_SERVERS=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
-h|--help)
|
||||
|
|
@ -112,6 +126,14 @@ while [[ $# -gt 0 ]]; do
|
|||
esac
|
||||
done
|
||||
|
||||
# ============================================
|
||||
# ГЕНЕРАЦИЯ ПАРОЛЯ (если не задан)
|
||||
# ============================================
|
||||
if [[ -z "$ADMIN_PASSWORD" ]]; then
|
||||
ADMIN_PASSWORD=$(generate_password 16)
|
||||
log_info "Сгенерирован пароль admin: $ADMIN_PASSWORD"
|
||||
fi
|
||||
|
||||
# ============================================
|
||||
# ПРОВЕРКА ROOT
|
||||
# ============================================
|
||||
|
|
@ -319,9 +341,15 @@ cat > "$MOUNT_POINT/rw/autorun.scr" <<EOF
|
|||
/ip service set winbox disabled=no
|
||||
|
||||
# ============================================
|
||||
# ФАЙРВОЛ - ЗАЩИТА ОТ БРУТФОРСА SSH
|
||||
# ФАЙРВОЛ - БАЗОВЫЕ ПРАВИЛА (в начале для производительности)
|
||||
# ============================================
|
||||
/ip firewall filter
|
||||
add chain=input connection-state=established,related action=accept comment="Accept established connections"
|
||||
add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
|
||||
|
||||
# ============================================
|
||||
# ФАЙРВОЛ - ЗАЩИТА ОТ БРУТФОРСА SSH
|
||||
# ============================================
|
||||
add chain=input protocol=tcp dst-port=22 src-address-list=ssh_blacklist action=drop comment="Drop SSH brute force"
|
||||
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage3 action=add-src-to-address-list address-list=ssh_blacklist address-list-timeout=1w
|
||||
add chain=input protocol=tcp dst-port=22 connection-state=new src-address-list=ssh_stage2 action=add-src-to-address-list address-list=ssh_stage3 address-list-timeout=1m
|
||||
|
|
@ -349,10 +377,8 @@ add chain=input protocol=udp dst-port=53 action=drop comment="Drop external DNS
|
|||
add chain=input protocol=tcp dst-port=53 action=drop comment="Drop external DNS TCP queries"
|
||||
|
||||
# ============================================
|
||||
# ФАЙРВОЛ - БАЗОВЫЕ ПРАВИЛА
|
||||
# ФАЙРВОЛ - РАЗРЕШЁННЫЕ СЕРВИСЫ
|
||||
# ============================================
|
||||
add chain=input connection-state=established,related action=accept comment="Accept established connections"
|
||||
add chain=input connection-state=invalid action=drop comment="Drop invalid connections"
|
||||
add chain=input protocol=icmp action=accept comment="Accept ICMP (ping)"
|
||||
add chain=input protocol=tcp dst-port=22 action=accept comment="Accept SSH"
|
||||
add chain=input protocol=tcp dst-port=8291 action=accept comment="Accept WinBox"
|
||||
|
|
@ -375,6 +401,11 @@ add chain=input action=drop comment="Drop all other input"
|
|||
# NAT - MASQUERADE
|
||||
# ============================================
|
||||
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT for all outgoing traffic"
|
||||
|
||||
# ============================================
|
||||
# БЕЗОПАСНОСТЬ - УДАЛЕНИЕ AUTORUN ПОСЛЕ ВЫПОЛНЕНИЯ
|
||||
# ============================================
|
||||
/file remove [find name~"autorun"]
|
||||
EOF
|
||||
|
||||
sync
|
||||
|
|
@ -467,6 +498,7 @@ log_info "Установка CHR с базовой настройкой заве
|
|||
log_info "=========================================="
|
||||
echo ""
|
||||
echo "CHR будет доступен: ${ADDRESS%/*}"
|
||||
echo "Admin пароль: ${ADMIN_PASSWORD}"
|
||||
echo ""
|
||||
echo -e "${GREEN}Настроено:${NC}"
|
||||
echo " • Имя роутера: $ROUTER_NAME"
|
||||
|
|
|
|||
|
|
@ -13,6 +13,20 @@ log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
|
|||
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
|
||||
log_debug() { echo -e "${CYAN}[DEBUG]${NC} $1"; }
|
||||
|
||||
# ============================================
|
||||
# PASSWORD GENERATION AND SANITIZATION
|
||||
# ============================================
|
||||
generate_password() {
|
||||
local length=$1
|
||||
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$length"
|
||||
}
|
||||
|
||||
sanitize_input() {
|
||||
local input="$1"
|
||||
# Remove dangerous characters: ; " ' ` $ \ / and newlines
|
||||
echo "$input" | tr -d ';"'\''`$\\/\n\r' | head -c 64
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# CONFIGURATION
|
||||
# ============================================
|
||||
|
|
@ -23,8 +37,8 @@ CHR_IMG="chr-${CHR_VERSION}.img"
|
|||
WORK_DIR="/tmp/chr-install"
|
||||
MOUNT_POINT="/mnt/chr"
|
||||
|
||||
# CHR Settings
|
||||
ADMIN_PASSWORD="PASSWORD"
|
||||
# CHR Settings (password auto-generated if not specified)
|
||||
ADMIN_PASSWORD=""
|
||||
DNS_SERVERS="8.8.8.8,8.8.4.4"
|
||||
|
||||
# Flags
|
||||
|
|
@ -47,7 +61,7 @@ usage() {
|
|||
echo " --yes, -y No confirmations (automatic mode)"
|
||||
echo " --reboot Automatic reboot (requires --yes)"
|
||||
echo " --version VER CHR version (default: $CHR_VERSION)"
|
||||
echo " --password PASS Admin password (default: $ADMIN_PASSWORD)"
|
||||
echo " --password PASS Admin password (auto-generated)"
|
||||
echo " -h, --help Show help"
|
||||
echo ""
|
||||
echo "Examples:"
|
||||
|
|
@ -87,7 +101,7 @@ while [[ $# -gt 0 ]]; do
|
|||
shift 2
|
||||
;;
|
||||
--password)
|
||||
ADMIN_PASSWORD="$2"
|
||||
ADMIN_PASSWORD=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
-h|--help)
|
||||
|
|
@ -100,6 +114,14 @@ while [[ $# -gt 0 ]]; do
|
|||
esac
|
||||
done
|
||||
|
||||
# ============================================
|
||||
# PASSWORD GENERATION (if not specified)
|
||||
# ============================================
|
||||
if [[ -z "$ADMIN_PASSWORD" ]]; then
|
||||
ADMIN_PASSWORD=$(generate_password 16)
|
||||
log_info "Generated admin password: $ADMIN_PASSWORD"
|
||||
fi
|
||||
|
||||
# ============================================
|
||||
# ROOT CHECK
|
||||
# ============================================
|
||||
|
|
@ -308,6 +330,11 @@ else
|
|||
/ip route add gateway=${GATEWAY}
|
||||
/user set 0 name=admin password=${ADMIN_PASSWORD}
|
||||
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT for all outgoing traffic"
|
||||
|
||||
# ============================================
|
||||
# SECURITY - REMOVE AUTORUN AFTER EXECUTION
|
||||
# ============================================
|
||||
/file remove [find name~"autorun"]
|
||||
EOF
|
||||
|
||||
# Sync filesystem before unmounting
|
||||
|
|
@ -419,6 +446,7 @@ if [[ "$SKIP_AUTORUN" == true ]]; then
|
|||
fi
|
||||
|
||||
echo "CHR will be available at: ${ADDRESS%/*}"
|
||||
echo "Admin password: ${ADMIN_PASSWORD}"
|
||||
echo ""
|
||||
|
||||
if [[ "$AUTO_YES" == true && "$AUTO_REBOOT" == true ]]; then
|
||||
|
|
|
|||
|
|
@ -13,6 +13,20 @@ log_warn() { echo -e "${YELLOW}[WARN]${NC} $1"; }
|
|||
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }
|
||||
log_debug() { echo -e "${CYAN}[DEBUG]${NC} $1"; }
|
||||
|
||||
# ============================================
|
||||
# ГЕНЕРАЦИЯ ПАРОЛЕЙ И САНИТИЗАЦИЯ
|
||||
# ============================================
|
||||
generate_password() {
|
||||
local length=$1
|
||||
tr -dc 'A-Za-z0-9' < /dev/urandom | head -c "$length"
|
||||
}
|
||||
|
||||
sanitize_input() {
|
||||
local input="$1"
|
||||
# Удаляем опасные символы: ; " ' ` $ \ / и переносы строк
|
||||
echo "$input" | tr -d ';"'\''`$\\/\n\r' | head -c 64
|
||||
}
|
||||
|
||||
# ============================================
|
||||
# КОНФИГУРАЦИЯ
|
||||
# ============================================
|
||||
|
|
@ -23,8 +37,8 @@ CHR_IMG="chr-${CHR_VERSION}.img"
|
|||
WORK_DIR="/tmp/chr-install"
|
||||
MOUNT_POINT="/mnt/chr"
|
||||
|
||||
# Настройки CHR
|
||||
ADMIN_PASSWORD="PASSWORD"
|
||||
# Настройки CHR (пароль генерируется автоматически если не указан)
|
||||
ADMIN_PASSWORD=""
|
||||
DNS_SERVERS="8.8.8.8,8.8.4.4"
|
||||
|
||||
# Флаги
|
||||
|
|
@ -47,7 +61,7 @@ usage() {
|
|||
echo " --yes, -y Без подтверждений (автоматический режим)"
|
||||
echo " --reboot Автоматическая перезагрузка (требует --yes)"
|
||||
echo " --version VER Версия CHR (по умолчанию: $CHR_VERSION)"
|
||||
echo " --password PASS Пароль admin (по умолчанию: $ADMIN_PASSWORD)"
|
||||
echo " --password PASS Пароль admin (генерируется автоматически)"
|
||||
echo " -h, --help Показать справку"
|
||||
echo ""
|
||||
echo "Примеры:"
|
||||
|
|
@ -87,7 +101,7 @@ while [[ $# -gt 0 ]]; do
|
|||
shift 2
|
||||
;;
|
||||
--password)
|
||||
ADMIN_PASSWORD="$2"
|
||||
ADMIN_PASSWORD=$(sanitize_input "$2")
|
||||
shift 2
|
||||
;;
|
||||
-h|--help)
|
||||
|
|
@ -100,6 +114,14 @@ while [[ $# -gt 0 ]]; do
|
|||
esac
|
||||
done
|
||||
|
||||
# ============================================
|
||||
# ГЕНЕРАЦИЯ ПАРОЛЯ (если не задан)
|
||||
# ============================================
|
||||
if [[ -z "$ADMIN_PASSWORD" ]]; then
|
||||
ADMIN_PASSWORD=$(generate_password 16)
|
||||
log_info "Сгенерирован пароль admin: $ADMIN_PASSWORD"
|
||||
fi
|
||||
|
||||
# ============================================
|
||||
# ПРОВЕРКА ROOT
|
||||
# ============================================
|
||||
|
|
@ -308,6 +330,11 @@ else
|
|||
/ip route add gateway=${GATEWAY}
|
||||
/user set 0 name=admin password=${ADMIN_PASSWORD}
|
||||
/ip firewall nat add chain=srcnat out-interface=ether1 action=masquerade comment="NAT for all outgoing traffic"
|
||||
|
||||
# ============================================
|
||||
# БЕЗОПАСНОСТЬ - УДАЛЕНИЕ AUTORUN ПОСЛЕ ВЫПОЛНЕНИЯ
|
||||
# ============================================
|
||||
/file remove [find name~"autorun"]
|
||||
EOF
|
||||
|
||||
# Синхронизация ФС перед размонтированием
|
||||
|
|
@ -419,6 +446,7 @@ if [[ "$SKIP_AUTORUN" == true ]]; then
|
|||
fi
|
||||
|
||||
echo "CHR будет доступен: ${ADDRESS%/*}"
|
||||
echo "Admin пароль: ${ADMIN_PASSWORD}"
|
||||
echo ""
|
||||
|
||||
if [[ "$AUTO_YES" == true && "$AUTO_REBOOT" == true ]]; then
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue