updates

3 files changed, 143 insertions, 6 deletions

diff --git a/vpn/Vagrantfile b/vpn/Vagrantfile
index 1c52fae..67d9551 100644
--- a/vpn/Vagrantfile
+++ b/vpn/Vagrantfile
@@ -38,12 +38,12 @@ Vagrant.configure('2') do |config|
 
   config.vm.provision 'update', type: 'shell', name: 'update', inline: <<-SHELL
     set -ex
-    sudo apk add openvpn nfs-utils
+    sudo apk add openvpn nfs-utils ufw
     mkdir -p /vagrant && \
       sudo mount -t nfs 192.168.121.1:/home/devi/share/nfs /vagrant
   SHELL
 
-  config.vm.provision 'update-root', type: 'shell', name: 'update-root', privileged: true, inline: <<-SHELL2
+  config.vm.provision 'update-root', type: 'shell', name: 'update-root', privileged: true, inline: <<-SHELL
     set -ex
     echo tun >> /etc/modules
     #rc-update add openvpn default
@@ -61,5 +61,37 @@ Vagrant.configure('2') do |config|
     sysctl -p /etc/sysctl.d/ipv4.conf
     rc-service openvpn start || true
     sleep 1
-  SHELL2
+  SHELL
+
+  config.vm.provision 'killswitch', type: 'shell', name: 'killswitch', privileged: true, inline: <<-SHELL
+    ufw --force reset
+    ufw default deny incoming
+    ufw default deny outgoing
+    ufw allow in on tun0
+    ufw allow out on tun0
+    # enable libvirt bridge
+    ufw allow in on eth0 from 192.168.121.1
+    ufw allow out on eth0 to 192.168.121.1
+    # server block
+    ufw allow out on eth0 to 185.204.1.174 port 443
+    ufw allow in on eth0 from 185.204.1.174 port 443
+    ufw allow out on eth0 to 185.204.1.176 port 443
+    ufw allow in on eth0 from 185.204.1.176 port 443
+    ufw allow out on eth0 to 185.204.1.172 port 443
+    ufw allow in on eth0 from 185.204.1.172 port 443
+    ufw allow out on eth0 to 185.204.1.171 port 443
+    ufw allow in on eth0 from 185.204.1.171 port 443
+    ufw allow out on eth0 to 185.212.149.201 port 443
+    ufw allow in on eth0 from 185.212.149.201 port 443
+    ufw allow out on eth0 to 185.204.1.173 port 443
+    ufw allow in on eth0 from 185.204.1.173 port 443
+    ufw allow out on eth0 to 193.138.7.237 port 443
+    ufw allow in on eth0 from 193.138.7.237 port 443
+    ufw allow out on eth0 to 193.138.7.217 port 443
+    ufw allow in on eth0 from 193.138.7.217 port 443
+    ufw allow out on eth0 to 185.204.1.175 port 443
+    ufw allow in on eth0 from 185.204.1.175 port 443
+
+    echo y | ufw enable
+  SHELL
 end
diff --git a/vpn2/Vagrantfile b/vpn2/Vagrantfile
new file mode 100644
index 0000000..46dfc0d
--- /dev/null
+++ b/vpn2/Vagrantfile
@@ -0,0 +1,83 @@
+# vi: set ft=ruby :
+# frozen_string_literal: true
+
+ENV['VAGRANT_DEFAULT_PROVIDER'] = 'libvirt'
+Vagrant.require_version '>= 2.2.6'
+Vagrant.configure('2') do |config|
+  config.vm.box = 'generic/alpine319'
+  config.vm.box_version = '4.3.12'
+  config.vm.box_check_update = false
+  config.vm.hostname = 'virt-vpn2'
+
+  # ssh
+  config.ssh.insert_key = true
+  config.ssh.keep_alive = true
+  config.ssh.keys_only = true
+
+  # timeouts
+  config.vm.boot_timeout = 300
+  config.vm.graceful_halt_timeout = 60
+  config.ssh.connect_timeout = 15
+
+  # shares
+  # config.vm.synced_folder './share', '/home/vagrant/nfs', type: 'nfs', nfs_version: 4, nfs_udp: false
+
+  config.vm.provider 'libvirt' do |libvirt|
+    libvirt.default_prefix = 'vpn2-'
+    libvirt.driver = 'kvm'
+    libvirt.memory = '128'
+    libvirt.cpus = 1
+    libvirt.sound_type = nil
+    libvirt.qemuargs value: '-nographic'
+    libvirt.qemuargs value: '-nodefaults'
+    libvirt.qemuargs value: '-no-user-config'
+    libvirt.qemuargs value: '-serial'
+    libvirt.qemuargs value: 'pty'
+    # libvirt.random model: 'random'
+  end
+
+  config.vm.provision 'update', type: 'shell', name: 'update', inline: <<-SHELL
+  set -ex
+  sudo apk add openvpn nfs-utils ufw
+  mkdir -p /vagrant && \
+    sudo mount -t nfs 192.168.121.1:/home/devi/share/nfs /vagrant
+  SHELL
+
+  config.vm.provision 'update-root', type: 'shell', name: 'update-root', privileged: true, inline: <<-SHELL
+  set -ex
+  echo tun >> /etc/modules
+  #rc-update add openvpn default
+  mkdir -p /tmp/mullvad/ && \
+    cp /vagrant/mullvad_openvpn_linux_us_phx.zip /tmp/mullvad/ && \
+    cd /tmp/mullvad && \
+    unzip mullvad_openvpn_linux_us_phx.zip && \
+    mv mullvad_config_linux_us_phx/mullvad_us_phx.conf /etc/openvpn/openvpn.conf && \
+    mv mullvad_config_linux_us_phx/mullvad_userpass.txt /etc/openvpn/ && \
+    mv mullvad_config_linux_us_phx/mullvad_ca.crt /etc/openvpn/ && \
+    mv mullvad_config_linux_us_phx/update-resolv-conf /etc/openvpn && \
+    chmod 755 /etc/openvpn/update-resolv-conf
+  modprobe tun
+  echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.d/ipv4.conf
+  sysctl -p /etc/sysctl.d/ipv4.conf
+  rc-service openvpn start || true
+  sleep 1
+  SHELL
+
+  config.vm.provision 'killswitch', type: 'shell', name: 'killswitch', privileged: true, inline: <<-SHELL
+    ufw --force reset
+    ufw default deny incoming
+    ufw default deny outgoing
+    ufw allow in on tun0
+    ufw allow out on tun0
+    # enable libvirt bridge
+    ufw allow in on eth0 from 192.168.121.1
+    ufw allow out on eth0 to 192.168.121.1
+    # server block
+    ufw allow out on eth0 to 198.54.133.34 port 1196
+    ufw allow in on eth0 from 198.54.133.34 port 1196
+    ufw allow out on eth0 to 198.54.133.66 port 1196
+    ufw allow in on eth0 from 198.54.133.66 port 1196
+
+    echo y | ufw enable
+  SHELL
+end
diff --git a/vpn3/Vagrantfile b/vpn3/Vagrantfile
index 2bd91c7..1b236ac 100644
--- a/vpn3/Vagrantfile
+++ b/vpn3/Vagrantfile
@@ -38,12 +38,12 @@ Vagrant.configure('2') do |config|
 
   config.vm.provision 'update', type: 'shell', name: 'update', inline: <<-SHELL
   set -ex
-  sudo apk add openvpn nfs-utils
+  sudo apk add openvpn nfs-utils ufw
   mkdir -p /vagrant && \
     sudo mount -t nfs 192.168.121.1:/home/devi/share/nfs /vagrant
   SHELL
 
-  config.vm.provision 'update-root', type: 'shell', name: 'update-root', privileged: true, inline: <<-SHELL2
+  config.vm.provision 'update-root', type: 'shell', name: 'update-root', privileged: true, inline: <<-SHELL
   set -ex
   echo tun >> /etc/modules
   #rc-update add openvpn default
@@ -61,5 +61,27 @@ Vagrant.configure('2') do |config|
   sysctl -p /etc/sysctl.d/ipv4.conf
   rc-service openvpn start || true
   sleep 1
-  SHELL2
+  SHELL
+
+  config.vm.provision 'killswitch', type: 'shell', name: 'killswitch', privileged: true, inline: <<-SHELL
+    ufw --force reset
+    ufw default deny incoming
+    ufw default deny outgoing
+    ufw allow in on tun0
+    ufw allow out on tun0
+    # enable libvirt bridge
+    ufw allow in on eth0 from 192.168.121.1
+    ufw allow out on eth0 to 192.168.121.1
+    # server block
+    ufw allow out on eth0 to 185.213.154.131 port 1197
+    ufw allow in on eth0 from 185.213.154.131 port 1197
+    ufw allow out on eth0 to 185.213.154.133 port 1197
+    ufw allow in on eth0 from 185.213.154.133 port 1197
+    ufw allow out on eth0 to 185.213.154.134 port 1197
+    ufw allow in on eth0 from 185.213.154.134 port 1197
+    ufw allow out on eth0 to 185.213.154.132 port 1197
+    ufw allow in on eth0 from 185.213.154.132 port 1197
+
+    echo y | ufw enable
+  SHELL
 end