forked from kevin/lmvpn_server
dsh
e82fb7421d
问题: 更换网卡后(如 enp1s0f3 -> enp1s0), nft masquerade 规则仍绑定旧网卡名, 规则永不命中, 客户端连上 VPN 但无法出网; 且诊断面板只检查规则是否存在, 会误报正常。 修改: 1. systemd 单元增加 Wants/After=network-online.target, 开机等待默认路由 就绪后再启动, 避免启动竞态下检测不到出口网卡而跳过防火墙配置; 2. detectWANInterface 增加 10x1s 重试, 开机初期无默认路由时短暂等待; 3. 诊断面板校验 masquerade 规则绑定的网卡是否真实存在, 不存在时给出 明确提示(网卡已更换?), 不再误报正常。
85 lines
2.3 KiB
Bash
Executable File
85 lines
2.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -e
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "请使用 root 用户执行此脚本: sudo bash install_linux.sh"
|
|
exit 1
|
|
fi
|
|
|
|
echo ">>> 拉取最新代码（强制覆盖本地修改）..."
|
|
git fetch origin
|
|
git reset --hard origin/main
|
|
|
|
echo ">>> 安装前端依赖并构建..."
|
|
cd frontend
|
|
npm install
|
|
npm run build
|
|
cd ..
|
|
|
|
echo ">>> 编译 Go 后端..."
|
|
VERSION=$(git describe --tags --always 2>/dev/null || echo "dev")
|
|
COMMIT=$(git rev-parse --short HEAD)
|
|
COMMIT_TIME=$(git log -1 --format=%cI)
|
|
BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
|
go build -ldflags "-X lmvpn/internal/version.Version=$VERSION -X lmvpn/internal/version.Commit=$COMMIT -X lmvpn/internal/version.CommitTime=$COMMIT_TIME -X lmvpn/internal/version.BuildTime=$BUILD_TIME" -o lmvpn .
|
|
|
|
echo ">>> 创建 lmvpn 系统用户..."
|
|
if ! id lmvpn &>/dev/null; then
|
|
useradd -r -s /bin/false lmvpn
|
|
echo "用户 lmvpn 已创建"
|
|
else
|
|
echo "用户 lmvpn 已存在，跳过创建"
|
|
fi
|
|
|
|
echo ">>> 部署到 /opt/lmvpn..."
|
|
systemctl stop lmvpn 2>/dev/null || true
|
|
mkdir -p /opt/lmvpn
|
|
cp lmvpn /opt/lmvpn/
|
|
cp -r dist /opt/lmvpn/
|
|
chown -R lmvpn:lmvpn /opt/lmvpn
|
|
|
|
echo ">>> 配置内核 IP 转发..."
|
|
# 临时生效
|
|
sysctl -w net.ipv4.ip_forward=1 >/dev/null
|
|
sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null
|
|
# 持久化
|
|
cat > /etc/sysctl.d/99-lmvpn.conf << EOF
|
|
net.ipv4.ip_forward = 1
|
|
net.ipv6.conf.all.forwarding = 1
|
|
EOF
|
|
sysctl -p /etc/sysctl.d/99-lmvpn.conf >/dev/null
|
|
|
|
echo ">>> 安装 systemd 服务..."
|
|
cat > /etc/systemd/system/lmvpn.service << 'EOF'
|
|
[Unit]
|
|
Description=LMVPN Server
|
|
Wants=network-online.target
|
|
After=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=lmvpn
|
|
WorkingDirectory=/opt/lmvpn
|
|
ExecStart=/opt/lmvpn/lmvpn
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# 授予 TUN 设备创建与网络管理能力，无需 root 运行
|
|
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable lmvpn
|
|
systemctl restart lmvpn
|
|
|
|
echo ">>> 安装完成"
|
|
echo ""
|
|
echo "NAT/转发/UFW 规则由服务端程序在启动时根据后台子网配置自动管理，无需手动设置。"
|
|
echo "若修改了后台 VPN 子网，只需在后台保存即可，程序会自动更新防火墙规则。"
|
|
echo ""
|
|
systemctl status lmvpn --no-pager
|