kevin
4b82340a9f
Root cause: UFW FORWARD policy DROP overrides lmvpn_nat accept rules. DNS (small UDP) worked but TCP packets were silently dropped. - Add firewall_linux.go: dynamic NAT/forward/UFW config from ApplySettings - Add firewall_darwin.go/firewall_other.go: stubs - Fix anti-spoof bug in switch.go: return dropPacket sentinel instead of nil, so spoofed packets are no longer written to TUN - Simplify install_linux.sh: remove hardcoded subnets and NAT config - Add UFW detection to diag panel
84 lines
2.2 KiB
Bash
Executable File
84 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -e
|
|
|
|
if [ "$(id -u)" -ne 0 ]; then
|
|
echo "请使用 root 用户执行此脚本: sudo bash install_linux.sh"
|
|
exit 1
|
|
fi
|
|
|
|
echo ">>> 拉取最新代码（强制覆盖本地修改）..."
|
|
git fetch origin
|
|
git reset --hard origin/main
|
|
|
|
echo ">>> 安装前端依赖并构建..."
|
|
cd frontend
|
|
npm install
|
|
npm run build
|
|
cd ..
|
|
|
|
echo ">>> 编译 Go 后端..."
|
|
VERSION=$(git describe --tags --always 2>/dev/null || echo "dev")
|
|
COMMIT=$(git rev-parse --short HEAD)
|
|
COMMIT_TIME=$(git log -1 --format=%cI)
|
|
BUILD_TIME=$(date -u +%Y-%m-%dT%H:%M:%SZ)
|
|
go build -ldflags "-X lmvpn/internal/version.Version=$VERSION -X lmvpn/internal/version.Commit=$COMMIT -X lmvpn/internal/version.CommitTime=$COMMIT_TIME -X lmvpn/internal/version.BuildTime=$BUILD_TIME" -o lmvpn .
|
|
|
|
echo ">>> 创建 lmvpn 系统用户..."
|
|
if ! id lmvpn &>/dev/null; then
|
|
useradd -r -s /bin/false lmvpn
|
|
echo "用户 lmvpn 已创建"
|
|
else
|
|
echo "用户 lmvpn 已存在，跳过创建"
|
|
fi
|
|
|
|
echo ">>> 部署到 /opt/lmvpn..."
|
|
systemctl stop lmvpn 2>/dev/null || true
|
|
mkdir -p /opt/lmvpn
|
|
cp lmvpn /opt/lmvpn/
|
|
cp -r dist /opt/lmvpn/
|
|
chown -R lmvpn:lmvpn /opt/lmvpn
|
|
|
|
echo ">>> 配置内核 IP 转发..."
|
|
# 临时生效
|
|
sysctl -w net.ipv4.ip_forward=1 >/dev/null
|
|
sysctl -w net.ipv6.conf.all.forwarding=1 >/dev/null
|
|
# 持久化
|
|
cat > /etc/sysctl.d/99-lmvpn.conf << EOF
|
|
net.ipv4.ip_forward = 1
|
|
net.ipv6.conf.all.forwarding = 1
|
|
EOF
|
|
sysctl -p /etc/sysctl.d/99-lmvpn.conf >/dev/null
|
|
|
|
echo ">>> 安装 systemd 服务..."
|
|
cat > /etc/systemd/system/lmvpn.service << 'EOF'
|
|
[Unit]
|
|
Description=LMVPN Server
|
|
After=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=lmvpn
|
|
WorkingDirectory=/opt/lmvpn
|
|
ExecStart=/opt/lmvpn/lmvpn
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# 授予 TUN 设备创建与网络管理能力，无需 root 运行
|
|
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_RAW
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_RAW
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
systemctl daemon-reload
|
|
systemctl enable lmvpn
|
|
systemctl restart lmvpn
|
|
|
|
echo ">>> 安装完成"
|
|
echo ""
|
|
echo "NAT/转发/UFW 规则由服务端程序在启动时根据后台子网配置自动管理，无需手动设置。"
|
|
echo "若修改了后台 VPN 子网，只需在后台保存即可，程序会自动更新防火墙规则。"
|
|
echo ""
|
|
systemctl status lmvpn --no-pager
|