Gesamten Fritz!Box LAN-Traffic über OpenVPN Tunnel ins Internet routen

client
dev tun
proto udp
remote eu1.vpn.giganews.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
persist-remote-ip
ca ca.vyprvpn.com.crt
tls-remote eu1.vpn.giganews.com
auth-user-pass
comp-lzo
verb 3

# Prüfen ob Internet vorhanden
while !(ping -c 1 www.google.de); do
sleep 5
done

# Module laden
./loadmodules.sh

# iptables NAT-Regel für tun0
./iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

# tun-Device anlegen
mknod /var/tmp/tun c 10 200

# openVPN starten
/var/media/ftp/openVPN/openvpn --client --config eu1.vpn.giganews.com.conf --dev-node /var/tmp/tun --daemon

client
dev tun
proto udp
remote eu1.vpn.giganews.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
persist-remote-ip
ca ca.vyprvpn.com.crt
tls-remote eu1.vpn.giganews.com
auth-user-pass password.txt
comp-lzo
verb 3

user
pass

# ./openvpn --client --config eu1.vpn.giganews.com.conf --dev-node /var/tmp/tun         
Thu Mar 10 21:14:59 2011 OpenVPN 2.1.4 mips-linux [SSL] [LZO2] [EPOLL] [MH] [PF_INET6] built on Mar  7 2011
Thu Mar 10 21:14:59 2011 WARNING: file 'password.txt' is group or others accessible
Thu Mar 10 21:14:59 2011 WARNING: Make sure you understand the semantics of --tls-remote before using it (see the man page).
Thu Mar 10 21:14:59 2011 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Thu Mar 10 21:14:59 2011 LZO compression initialized
Thu Mar 10 21:14:59 2011 Control Channel MTU parms [ L:1542 D:138 EF:38 EB:0 ET:0 EL:0 ]
Thu Mar 10 21:14:59 2011 Socket Buffers: R=[132096->131072] S=[132096->131072]
Thu Mar 10 21:14:59 2011 Data Channel MTU parms [ L:1542 D:1450 EF:42 EB:135 ET:0 EL:0 AF:3/1 ]
Thu Mar 10 21:14:59 2011 UDPv4 link local: [undef]
Thu Mar 10 21:14:59 2011 UDPv4 link remote: [AF_INET]138.199.67.17:1194
Thu Mar 10 21:14:59 2011 TLS: Initial packet from [AF_INET]138.199.67.17:1194, sid=3dad9f4f b88c26da
Thu Mar 10 21:14:59 2011 WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
Thu Mar 10 21:14:59 2011 VERIFY OK: depth=1, /C=KY/ST=GrandCayman/L=GeorgeTown/O=GoldenFrog-Inc/CN=GoldenFrog-Inc_CA/[email protected]
Thu Mar 10 21:14:59 2011 VERIFY X509NAME OK: /C=KY/ST=GrandCayman/L=GeorgeTown/O=GoldenFrog-Inc/CN=eu1.vpn.giganews.com/[email protected]
Thu Mar 10 21:14:59 2011 VERIFY OK: depth=0, /C=KY/ST=GrandCayman/L=GeorgeTown/O=GoldenFrog-Inc/CN=eu1.vpn.giganews.com/[email protected]
Thu Mar 10 21:15:03 2011 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 10 21:15:03 2011 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 10 21:15:03 2011 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Thu Mar 10 21:15:03 2011 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Thu Mar 10 21:15:03 2011 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA, 2048 bit RSA
Thu Mar 10 21:15:03 2011 [eu1.vpn.giganews.com] Peer Connection Initiated with [AF_INET]138.199.67.17:1194
Thu Mar 10 21:15:05 2011 SENT CONTROL [eu1.vpn.giganews.com]: 'PUSH_REQUEST' (status=1)
Thu Mar 10 21:15:05 2011 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,explicit-exit-notify 5,rcvbuf 262144,route-gateway 10.9.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.9.0.121 255.255.0.0'
Thu Mar 10 21:15:05 2011 Options error: Unrecognized option or missing parameter(s) in [PUSH-OPTIONS]:4: explicit-exit-notify (2.1.4)
Thu Mar 10 21:15:05 2011 OPTIONS IMPORT: timers and/or timeouts modified
Thu Mar 10 21:15:05 2011 OPTIONS IMPORT: --sndbuf/--rcvbuf options modified
Thu Mar 10 21:15:05 2011 Socket Buffers: R=[131072->264192] S=[131072->131072]
Thu Mar 10 21:15:05 2011 OPTIONS IMPORT: --ifconfig/up options modified
Thu Mar 10 21:15:05 2011 OPTIONS IMPORT: route options modified
Thu Mar 10 21:15:05 2011 OPTIONS IMPORT: route-related options modified
Thu Mar 10 21:15:05 2011 OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
Thu Mar 10 21:15:05 2011 TUN/TAP device tun0 opened
Thu Mar 10 21:15:05 2011 TUN/TAP TX queue length set to 100
Thu Mar 10 21:15:05 2011 /sbin/ifconfig tun0 10.9.0.121 netmask 255.255.0.0 mtu 1500 broadcast 10.9.255.255
Thu Mar 10 21:15:05 2011 NOTE: unable to redirect default gateway -- Cannot read current default gateway from system
Thu Mar 10 21:15:05 2011 Initialization Sequence Completed

Thu Mar 10 21:15:05 2011 PUSH: Received control message: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 208.67.222.222,dhcp-option DNS 208.67.220.220,explicit-exit-notify 5,rcvbuf 262144,route-gateway 10.9.0.1,topology subnet,ping 10,ping-restart 60,ifconfig 10.9.0.121 255.255.0.0'
.
.
.
Thu Mar 10 21:15:05 2011 /sbin/ifconfig tun0 10.9.0.121 netmask 255.255.0.0 mtu 1500 broadcast 10.9.255.255
Thu Mar 10 21:15:05 2011 NOTE: unable to redirect default gateway -- Cannot read current default gateway from system

#Löschen des default gateway
route del default dev dsl

#Host route zu OpenVPN server-IP
route add -host 138.199.XXX.XXX dev dsl

#default route auf tun0 setzen
route add -net 0.0.0.0/0 dev tun0

# Find OpenVPN server IP address
VPNS=$(ping -c1 eu1.vpn.giganews.com | sed -n '/PING/ s/^[^(]*(\([0-9\.]*\).*/\1/p')

# Set route to VPN server over device dsl
route add $VPNS dev dsl

# Set route to tun0 device
route add -net 0.0.0.0/1 dev tun0
route add -net 128.0.0.0/1 dev tun0

#!/bin/sh
#
# script to correct strange default route by dsld
#

#- important variables
#$1={online|offline]
#DNS1=
#DNS2=
#IPADDR=
#GATEWAY=

#- debug
#	exec 1> "/tmp/$(basename "$0").log"
#	exec 2>&1
#	echo "`date` -- $(basename "$0") $*"
#	env | sort
#	set -x

#- magic
case "$1" in
	online )
		DEFAULTROUTEIF="`route -n | awk '/^0.0.0.0[[:space:]]+0.0.0.0/ {print $8}'`"
		if [ "$DEFAULTROUTEIF" = "dsl" ]; then
			ifconfig $DEFAULTROUTEIF $IPADDR dstaddr $IPADDR
			ifconfig $DEFAULTROUTEIF:dsld 169.254.2.1 dstaddr 169.254.2.1
			DEFAULTROUTEIF_IPADDR="$IPADDR"
			route del default 2> /dev/null
			route add default gw $DEFAULTROUTEIF_IPADDR dev $DEFAULTROUTEIF
		fi
	;;
esac

# route -n | awk '/^0.0.0.0[[:space:]]+0.0.0.0/ {print $8}'
-sh: awk: not found

#!/bin/sh
#
# Project: Connect fritz!box 7390 to VyprVPN via OpenVPN
#
# Start up script to connect the 7390 to giganews.com/VyprVPN via openVPN.
# 

# get the config file
. ./config.cfg

# start telnetd
/usr/sbin/telnetd -l /sbin/ar7login

# Check for internet connection.
while !(ping -c 1 www.google.de); do
	sleep 5
done

# Loading modules
$INSTDIR/loadmodules.sh

# Create iptables NAT rule for tun0
$INSTDIR/iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

# Create tun device
mknod /var/tmp/tun c 10 200

# Correct default gateway. Delete default gateway and add a corrected one.
# Necessary because of AVMs strange 0.0.0.0 gateway not recognized by openVPN.
# Will break AVMs VPN !!!!! Alternative: use openVPn with --up and --down scripts
# to do the routing.
DEFAULTROUTEIF="`route -n | sed -n '/^0.0.0.0[[:space:]]\+0.0.0.0/ s/^.*[[:space:]]\([^[:space:]]\+\)$/\1/p'`"
		if [ "$DEFAULTROUTEIF" = "dsl" ]; then
			ifconfig $DEFAULTROUTEIF:dsld 169.254.2.1 dstaddr 169.254.2.1
			route del default 2> /dev/null
			route add default gw 169.254.2.1 dev $DEFAULTROUTEIF
		fi
	
# Set bypass routing. 
# Get entries from file bypass.cfg. Resolve name and set route to dsl.
BYPCFG=$INSTDIR/bypass.cfg
		cat $BYPCFG | while read a; do
			NEWSS=$(ping -c1 $a | sed -n '/PING/ s/^[^(]*(\([0-9\.]*\).*/\1/p')
			route add $NEWSS dev dsl
		done

# Check if there is a password.txt file. If the file exists delete it.
test -f $INSTDIR/password.txt && rm $INSTDIR/password.txt

# Create a new password file and write usernemae and password.txt
touch $INSTDIR/password.txt
echo $USERNAME >> $INSTDIR/password.txt
echo $PASSWORD >> $INSTDIR/password.txt

# Check if there is NOT a logfile. If not create it.
! test -f $INSTDIR/log.txt && touch $INSTDIR/log.txt

# Firing up OpenVPN in background. Write output to log.txt. 
$INSTDIR/openvpn --config $SERVERLOC.vpn.giganews.com.conf --auth-user-pass $INSTDIR/password.txt --dev-node /var/tmp/tun --script-security 2 1>/var/media/ftp/openVPN/log.txt 2>&1 &

mkdir -p /var/tmp/onlinechanged
cp /var/media/ftp/openVPN/start_openvpn /var/tmp/onlinechanged/

#!/bin/sh
#
# Project: Connect fritz!box 7390 to VyprVPN via OpenVPN
#
# Start up script to connect the 7390 to giganews.com/VyprVPN via openVPN.


case "$1" in
        online )
                #####################################################
				# LOAD CONFIG FILE config.cfg. 
				#####################################################

				# Load config file
				. /var/media/ftp/openVPN/config.cfg
				
				
				#####################################################
				# CHANGE TO INSTALL DIR
				#####################################################
				cd $INSTDIR

				#####################################################
				# BYPASS CONFIGURATION in bypass.cfg 
				#####################################################
				# Last line must be a blank line.


				#####################################################
				#####################################################
				# MAIN SCRIPT 
				#####################################################
				#####################################################

				#####################################################
				# Check for internet connection.
				#####################################################
				while !(ping -c 1 www.google.de) >/dev/null 2>&1; do
					sleep 5
				done

				#####################################################
				# Loading modules
				#####################################################
				for x in $(ls net/ipv4/netfilter/); do
					y=${x%.*} # strip file extension
						if ! lsmod | grep $y >/dev/null 2>&1; then # Test if module is NOT installed
							insmod net/ipv4/netfilter/$x;	# then install module.
						fi
				done

				for x in $(ls net/netfilter/); do
					y=${x%.*}
						if ! lsmod | grep $y >/dev/null 2>&1; then # Test if module is NOT installed
							insmod net/netfilter/$x; # then install module.
						fi
				done

				#####################################################
				# Create iptables NAT rule for tun0
				#####################################################
				# First flush iptables to prevent duplicates.
				$INSTDIR/bin/iptables -t nat -F
				$INSTDIR/bin/iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE

				#####################################################
				# Check if tun device NOT exists; then create it
				#####################################################
				[ ! -c /var/tmp/tun ] && mknod /var/tmp/tun c 10 200

				#####################################################
				# Correct default gateway.
				#####################################################
				# Delete default gateway and add a corrected one.
				# Necessary because of AVMs strange 0.0.0.0 gateway not recognized by openVPN.
				# Will break AVMs VPN !!!!! Alternative: use openVPn with --up and --down scripts
				# to do the routing.
				DEFAULTROUTEIF="`route -n | sed -n '/^0.0.0.0[[:space:]]\+0.0.0.0/ s/^.*[[:space:]]\([^[:space:]]\+\)$/\1/p'`"
						if [ "$DEFAULTROUTEIF" = "dsl" ]; then
							ifconfig $DEFAULTROUTEIF:dsld 169.254.2.1 dstaddr 169.254.2.1
							route del default 2> /dev/null
							route add default gw 169.254.2.1 dev $DEFAULTROUTEIF
						fi
	
				#####################################################
				# Set bypass routing. 
				#####################################################
				# Get entries from file bypass.cfg. Resolve name and set route to dsl.
				BYPCFG=$INSTDIR/bypass.cfg
						cat $BYPCFG | while read a; do
							NEWSS=$(ping -c1 $a | sed -n '/PING/ s/^[^(]*(\([0-9\.]*\).*/\1/p')
			
							if ! route -n | grep $NEWSS >/dev/null 2>&1; then 
								route add $NEWSS dev dsl	
			
							fi
			
						done
		
				#####################################################
				# Check if there is a password.txt file. If the file exists delete it.
				#####################################################
				test -f $INSTDIR/password.txt && rm $INSTDIR/password.txt

				#####################################################
				# Create a new password file and write usernemae and password.txt
				#####################################################
				touch $INSTDIR/password.txt
				echo $USERNAME >> $INSTDIR/password.txt
				echo $PASSWORD >> $INSTDIR/password.txt

				#####################################################
				# Check if there is NOT a logfile; then create it
				#####################################################
				! test -f $INSTDIR/log.txt && touch $INSTDIR/log.txt

				#####################################################
				# Start OpenVPN. Write output to log.txt. 
				#####################################################
				# Write output to log.txt 
				$INSTDIR/bin/openvpn --config $INSTDIR/$SERVERLOC.vpn.giganews.com.conf --auth-user-pass $INSTDIR/password.txt --dev-node /var/tmp/tun --script-security 2 1>$INSTDIR/log.txt 2>&1 &

        ;;
        offline )
        
                #####################################################
				# get the config file
				#####################################################
				. /var/media/ftp/openVPN/config.cfg
				
				#####################################################
				# Kill openVPN
				#####################################################
				killall openvpn

				#####################################################
				# Del bypass routing. 
				#####################################################
				# Get entries from file bypass.cfg. Resolve name and del route to dsl.
				BYPCFG=$INSTDIR/bypass.cfg
						cat $BYPCFG | while read a; do
							NEWSS=$(ping -c1 $a | sed -n '/PING/ s/^[^(]*(\([0-9\.]*\).*/\1/p')
							route del $NEWSS dev dsl
						done

        ;;
esac