slawek
7cb2f1b8dd
Add platform = none as the shipped default so installing the package changes nothing on the machine until a platform is chosen. Add a mode setting (manual/interfaces/auto) controlling how much of the network configuration is supplied versus detected from the system. Manage /etc/vpn-router/vpn-router.conf with ucf instead of writing it once, so dpkg-reconfigure can safely reapply debconf answers without clobbering local edits. Extend NAT/forward rules to all local subnets, not just the first.
160 lines
5.2 KiB
Plaintext
160 lines
5.2 KiB
Plaintext
Template: vpn-router/platform
|
|
Type: select
|
|
Choices: none, generic, azure, gcp
|
|
Default: none
|
|
Description: Platform:
|
|
Which platform this router runs on. The choice loads platform-specific
|
|
additions, such as the provider DNS resolver for road-warrior clients.
|
|
.
|
|
none defers configuration entirely: the package installs its files and
|
|
changes nothing on the machine. Choose it when the router will be configured
|
|
later by hand or by a configuration-management tool, then set the platform in
|
|
/etc/vpn-router/vpn-router.conf when you are ready.
|
|
.
|
|
generic configures the router with no platform-specific additions.
|
|
|
|
Template: vpn-router/mode
|
|
Type: select
|
|
Choices: manual, interfaces, auto
|
|
Default: manual
|
|
Description: Network configuration source:
|
|
How much of the network configuration you are supplying, and therefore how
|
|
much the package works out for itself:
|
|
.
|
|
manual - you give the interface names, the internal address and the internal
|
|
gateway. Nothing is detected.
|
|
.
|
|
interfaces - you give the two interface names. The internal address and
|
|
gateway are read from them.
|
|
.
|
|
auto - you give nothing. The interfaces are identified from the routing
|
|
table and their addresses read from the system. Convenient, but it can pick
|
|
the wrong interface and configure the machine incorrectly.
|
|
|
|
Template: vpn-router/external_interface
|
|
Type: string
|
|
Default:
|
|
Description: External network interface:
|
|
Name of the interface facing the untrusted network, for example eth0 or
|
|
ens4. The addresses strongSwan binds on are read from it, so they are never
|
|
configured separately.
|
|
|
|
Template: vpn-router/internal_interface
|
|
Type: string
|
|
Default:
|
|
Description: Internal network interface:
|
|
Name of the interface facing the protected network, for example eth1 or
|
|
ens5. Routes for the local subnets are applied to it.
|
|
|
|
Template: vpn-router/int_addr
|
|
Type: string
|
|
Default:
|
|
Description: Internal interface address:
|
|
This host's own address on the internal network. Asked only in manual mode;
|
|
in the other modes it is read from the internal interface.
|
|
|
|
Template: vpn-router/local_fqdn
|
|
Type: string
|
|
Default:
|
|
Description: Local router FQDN:
|
|
Fully-qualified domain name of this router (for example
|
|
router.example.com). Used as the road-warrior server identity and
|
|
certificate common name.
|
|
|
|
Template: vpn-router/local_id_mode
|
|
Type: select
|
|
Choices: fqdn, public_ip, internal_ip
|
|
Default: fqdn
|
|
Description: IKE local identity mode:
|
|
How to derive the IKE identity advertised to the remote site:
|
|
.
|
|
fqdn - use the FQDN, which must match what the peer expects.
|
|
.
|
|
public_ip - resolve the FQDN and use the address it returns.
|
|
.
|
|
internal_ip - use the internal NIC address.
|
|
|
|
Template: vpn-router/local_cidrs
|
|
Type: string
|
|
Default:
|
|
Description: Local subnet CIDR(s):
|
|
Comma-separated list of local subnet CIDRs to advertise into the
|
|
site-to-site tunnel (for example 10.0.0.0/24 or 10.0.0.0/24,10.0.1.0/24).
|
|
|
|
Template: vpn-router/int_gateway_ip
|
|
Type: string
|
|
Default:
|
|
Description: Internal network gateway address:
|
|
Address of the next-hop gateway on the internal side, used to route the
|
|
local subnets listed above. Asked only in manual mode; in the other modes it
|
|
is derived from the internal interface.
|
|
|
|
Template: vpn-router/remote_addrs
|
|
Type: string
|
|
Default:
|
|
Description: Remote site WAN IP address(es):
|
|
Comma-separated list of remote gateway addresses or FQDNs for the
|
|
site-to-site IPSec tunnel.
|
|
|
|
Template: vpn-router/remote_id
|
|
Type: string
|
|
Default:
|
|
Description: Remote site IKE identity:
|
|
IKE identity of the remote peer, without a leading @.
|
|
|
|
Template: vpn-router/remote_cidrs
|
|
Type: string
|
|
Default:
|
|
Description: Remote subnet CIDR(s):
|
|
Comma-separated list of remote subnet CIDRs reachable through the
|
|
site-to-site tunnel (for example 192.168.0.0/24).
|
|
|
|
Template: vpn-router/psk
|
|
Type: password
|
|
Description: Pre-shared key (PSK):
|
|
Pre-shared key for the site-to-site IKEv2 tunnel. Must match the value
|
|
configured on the remote peer. Stored base64-encoded in the configuration
|
|
file and cleared from the debconf database after installation.
|
|
|
|
Template: vpn-router/p2s_enabled
|
|
Type: boolean
|
|
Default: false
|
|
Description: Enable road-warrior (P2S) access?
|
|
If enabled, this router accepts IKEv2 EAP-TLS connections from individual
|
|
clients. Certificates are taken from /etc/vpn-router/pki, and a local
|
|
certificate authority is created there if that directory is empty.
|
|
|
|
Template: vpn-router/p2s_address_pool
|
|
Type: string
|
|
Default:
|
|
Description: Road-warrior address pool:
|
|
CIDR block assigned to road-warrior clients (for example 172.16.0.0/24).
|
|
|
|
Template: vpn-router/p2s_ca_name
|
|
Type: string
|
|
Default: VPN Router CA
|
|
Description: Road-warrior CA name:
|
|
Common name for the certificate authority created in /etc/vpn-router/pki
|
|
when that directory is empty. Ignored when certificates are supplied.
|
|
|
|
Template: vpn-router/wg_enabled
|
|
Type: boolean
|
|
Default: false
|
|
Description: Enable WireGuard?
|
|
If enabled, WireGuard is configured on wg0, a key pair is generated, and
|
|
the matching firewall rule is installed. Peers are added by editing
|
|
/etc/wireguard/wg0.conf.
|
|
|
|
Template: vpn-router/wg_address
|
|
Type: string
|
|
Default:
|
|
Description: WireGuard interface address:
|
|
Address and prefix length for the wg0 interface (for example
|
|
192.168.200.1/24).
|
|
|
|
Template: vpn-router/wg_listen_port
|
|
Type: string
|
|
Default: 51820
|
|
Description: WireGuard listen port:
|
|
UDP port that WireGuard listens on.
|