63 lines
2.4 KiB
Plaintext
63 lines
2.4 KiB
Plaintext
Source: vpn-router
|
|
Section: net
|
|
Priority: optional
|
|
Maintainer: Sławomir Koszewski <slawek@koszewscy.waw.pl>
|
|
Build-Depends: debhelper-compat (= 13)
|
|
Standards-Version: 4.6.2
|
|
Rules-Requires-Root: no
|
|
|
|
Package: vpn-router
|
|
Architecture: all
|
|
Depends: ${misc:Depends},
|
|
strongswan-swanctl (>= 5.0),
|
|
charon-systemd (>= 5.0),
|
|
libstrongswan-extra-plugins,
|
|
libcharon-extra-plugins,
|
|
wireguard-tools,
|
|
ufw,
|
|
debconf,
|
|
ucf,
|
|
python3,
|
|
python3-cryptography,
|
|
python3-jinja2,
|
|
python3-ldap,
|
|
python3-pyotp,
|
|
python3-psycopg,
|
|
python3-psutil,
|
|
python3-prometheus-client,
|
|
postgresql,
|
|
slapd,
|
|
openvpn,
|
|
openvpn-auth-ldap,
|
|
iproute2,
|
|
systemd-resolved,
|
|
zstd
|
|
Suggests: caddy,
|
|
rclone,
|
|
proxmox-backup-client-static
|
|
Description: Linux VPN router with IPSec, road-warrior, OpenVPN and WireGuard support
|
|
Configures a Linux host or virtual machine as a VPN router: site-to-site
|
|
IKEv2 IPSec (strongSwan swanctl) with pre-shared keys or certificates,
|
|
optional road-warrior access using EAP-TLS, optional OpenVPN with a
|
|
certificate and a password per user, kept in a local LDAP directory, optional
|
|
WireGuard, and the routing, NAT, MSS clamping and firewall rules a router
|
|
needs. Its two-level CA, whose root may be kept offline, has issuing CAs for
|
|
the VPN clients, for site-to-site and for general use, and publishes their
|
|
certificates and CRLs. Caddy, installed by the package from the Ubuntu
|
|
archive or from Caddy's repository, serves HTTPS. It keeps metrics of the
|
|
router in PostgreSQL and serves them for an OpenTelemetry Collector, and
|
|
makes scheduled backups to a local folder, copied to the cloud with rclone,
|
|
or to a Proxmox Backup Server. Nothing in the package is specific to a cloud
|
|
provider.
|
|
.
|
|
Settings live in /etc/vpn-router/vpn-router.json, which is created on first
|
|
install and owned by the administrator afterwards. Editing it and restarting
|
|
vpn-router-setup applies the change; the same service reconciles the system
|
|
at every boot. It is built on two inputs, the external and internal interface
|
|
names; the addresses on them are read from the system rather than configured
|
|
again, and nothing is auto-detected.
|
|
.
|
|
Platform-specific additions are provided by modules under
|
|
/usr/lib/vpn-router, selected explicitly by the platform setting. Modules for
|
|
Azure and GCP are included.
|