diff --git a/salt-pillar/bind/dyndns/anon1.sls b/salt-pillar/bind/dyndns/anon1.sls index b6e6a3f..35cf4ec 100644 --- a/salt-pillar/bind/dyndns/anon1.sls +++ b/salt-pillar/bind/dyndns/anon1.sls @@ -1,7 +1,7 @@ #!yaml|gpg dyndns: anon1: - interface: ipredator + interface: protonvpn secret: | -----BEGIN PGP MESSAGE----- diff --git a/salt-pillar/top.sls b/salt-pillar/top.sls index 93c967a..34c05dc 100644 --- a/salt-pillar/top.sls +++ b/salt-pillar/top.sls @@ -41,7 +41,7 @@ base: - bind.dyndns.upstream2 'anon*': - bird.ospf - - wireguard.anon1 + - vpn.anon1 - upstream.anon1 - collectd.upstream - bind.dyndns.anon1 diff --git a/salt-pillar/vpn/anon1.sls b/salt-pillar/vpn/anon1.sls index d5951dd..7c79522 100644 --- a/salt-pillar/vpn/anon1.sls +++ b/salt-pillar/vpn/anon1.sls @@ -1,84 +1,84 @@ #!yaml|gpg openvpn: - ipredator: - server: ipv6.openvpn.ipredator.se + protonvpn: + server: nl-free-01.protonvpn.com user: | -----BEGIN PGP MESSAGE----- - - hQEMA2PKcvDMvlKLAQf9H1XFAYkM7XFoStSeqeDk9b6cG3kqqN9wXEprDg5lkXc8 - yhL7tF79HzzY18MQ5Cn24LRkoZtwsJkJNOaDdySpiEh34SP0m64Tuwj8gPrFGpSK - phox6e4/vpWw0BnM1hJaaQxd86qng9Ptv3U1afz98kcU0kxAKcrQZN77sTMrTF8K - Kw/6rnPPKF72PqspLcL/Sxl49MaEg8aJMO+TT26IiML4cu7N+ZEykgsfmpaoVhIG - r2xO1FBAPGjyh71G7HJWcsrBTq+y4jRMapEbIrUOusULXcOffe+hqQcOGX09Uv1Q - 1B+ZkaNxwohhbrkpEqOhfL5U5JUNC9+vlSmOh5nWI9JEAcw4gMRgLjVFGgy5+txj - EkOPNYuXC/Z9HoMqKOOcGKRpgW2bvrwoJ4w+41S2RIVAKS9vbFTJ+Cbr7ID8ReJ4 - mt82t1Q= - =7JHg + + hQEMA2PKcvDMvlKLAQf7BCwzkTetWarslcjqPyMRqMmbigVnQmp2Fjr/jRy9VhFr + AljofSuYyWwWVk9aPGh5dNXShT4CzKs2eSrSno2H71bnuqxfc80dqhO3loM63NZL + EchUhT09keQ580WEp3CziDXDbe8T5clmour7Dy9kX/AI+WqeKtdAjgBaI50M3m6f + 4TWt5zIUyMSxHtyEbpTswAtjD4GmjfsVHCUIw+EyfMsBVqRxYWDjtRUUE35wMeWm + k0DpyU5MF5CmKM108h8v69ti223kjB5hc+b/lg7lcr+8bjr3f9ELeg0pvtlkx4ps + VS8TXOIhT3KF7Bu9qKhmQFd5rwE5ColTiTcKpeq3iNJbAX3IIx7mvJSlYAeSwj0Y + 2l4LUvpl1f+IQ/PhRMNO1TZEqbG7q762skrD/9DVbpRpFblqKhj9tuyv0OFiPPCa + QcVW+MHwyqKZ1g1/KVXAaEWTdIP3qyuvA4zOGQ== + =BLbr -----END PGP MESSAGE----- - password: | -----BEGIN PGP MESSAGE----- - - hQEMA2PKcvDMvlKLAQf+I2T0gFEzr26FxlYA8BefrAz0pNV4ReVMCU2TasW5NIaZ - GnOUPTDeP97M4fNfsWPIzZcyTNby83BZIY8fH7bqtC5pfhaTA0GHfJywuBVJF87b - ixiOICCd/e3r1mahqgcUWRd8NT1FbzmpVbI42AKphA8gpN6hOZds9JUx44ZE5YxJ - wg9u2koEAriaIVzUpg+BXTQr2So17H8fm/FzUgMVUWohDAmYmTxqShnrLANBqebE - 8glYJFOhV+Iasu2AoOT3FkZLDvW2STaOZisqMNx0tlQQG0px1zv63GTF7JZAac+l - toUzTvpdZpVTrW1y+VwNKntrouXBWvcFnvOtrY34m9JGAT78YEZ6QUSIKF1z5sf6 - rI2I1ngv8fZZgO6hJhQFemxqzbLtUp2r1+GOzBhuKb/ilB0j0l/vd1P5sbvx7Bp3 - c3bTeN+KJw== - =aZ9Y + + hQEMA2PKcvDMvlKLAQf9FW6GeyPCaJm9ftIW89GX61TCnzMPXzK8i9hwA9mmRJxb + DuZ9gbMD5WKzgVNoCEXmKZ1nnbSTwCn1YjhMWwmmextrAuAGQiGqFtzG+KiyUGr6 + PG3iHXtzcz2v+oElB7hswnfpRS4XVB9VP/LlPk2azY1jaF+EyfO4WkN4Dg0ldIal + ulrOknmFKAQjbuPeRsejOEnpNocLd0fh5Phza66g4YxmPAT9QznOXCumrKrEoC5q + SW/9DxJugCiYmU5ti8pdySBVeRqeoen35tXdyl/8tMX0R97c27HCzzPRcMaQxQVc + yyrTDEib5T0PiphbtHcXBovlna87gUQn2uM+Zm3IL9JbAeadBusliNidAaMaB/hN + 2jQcqRxJmTp+Xo7vLzziAlaGhYEivq2ROasgaXa97qbkFIIvy4HVJrRtx7s8xuli + s8uY4mS0ZjVgGvFYO2ZMD+TIKZxbd6XwAFDBlA== + =fZBz -----END PGP MESSAGE----- - ca: | -----BEGIN CERTIFICATE----- - MIIFJzCCBA+gAwIBAgIJAKee4ZMMpvhzMA0GCSqGSIb3DQEBBQUAMIG9MQswCQYD - VQQGEwJTRTESMBAGA1UECBMJQnJ5Z2dsYW5kMQ8wDQYDVQQHEwZPZWxkYWwxJDAi - BgNVBAoTG1JveWFsIFN3ZWRpc2ggQmVlciBTcXVhZHJvbjESMBAGA1UECxMJSW50 - ZXJuZXR6MScwJQYDVQQDEx5Sb3lhbCBTd2VkaXNoIEJlZXIgU3F1YWRyb24gQ0Ex - JjAkBgkqhkiG9w0BCQEWF2hvc3RtYXN0ZXJAaXByZWRhdG9yLnNlMB4XDTEyMDgw - NDIxMTAyNVoXDTIyMDgwMjIxMTAyNVowgb0xCzAJBgNVBAYTAlNFMRIwEAYDVQQI - EwlCcnlnZ2xhbmQxDzANBgNVBAcTBk9lbGRhbDEkMCIGA1UEChMbUm95YWwgU3dl - ZGlzaCBCZWVyIFNxdWFkcm9uMRIwEAYDVQQLEwlJbnRlcm5ldHoxJzAlBgNVBAMT - HlJveWFsIFN3ZWRpc2ggQmVlciBTcXVhZHJvbiBDQTEmMCQGCSqGSIb3DQEJARYX - aG9zdG1hc3RlckBpcHJlZGF0b3Iuc2UwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAw - ggEKAoIBAQCp5M22fZtwtIh6Mu9IwC3N2tEFqyNTEP1YyXasjf+7VNISqSpFy+tf - DsHAkiE9Wbv8KFM9bOoVK1JjdDsetxArm/RNsUWm/SNyVbmY+5ezX/n95S7gQdMi - bA74/ID2+KsCXUY+HNNUQqFpyK67S09A6r0ZwPNUDbLgGnmCZRMDBPCHCbiK6e68 - d75v6f/0nY4AyAAAyqwAELIAn6sy4rzoPbalxcO33eW0fUG/ir41qqo8BQrWKyEd - Q9gy8tGEqbLQ+B30bhIvBh10YtWq6fgFZJzWP6K8bBJGRvioFOyQHCaVH98UjwOm - /AqMTg7LwNrpRJGcKLHzUf3gNSHQGHfzAgMBAAGjggEmMIIBIjAdBgNVHQ4EFgQU - pRqJxaYdvv3XGEECUqj7DJJ8ptswgfIGA1UdIwSB6jCB54AUpRqJxaYdvv3XGEEC - Uqj7DJJ8ptuhgcOkgcAwgb0xCzAJBgNVBAYTAlNFMRIwEAYDVQQIEwlCcnlnZ2xh - bmQxDzANBgNVBAcTBk9lbGRhbDEkMCIGA1UEChMbUm95YWwgU3dlZGlzaCBCZWVy - IFNxdWFkcm9uMRIwEAYDVQQLEwlJbnRlcm5ldHoxJzAlBgNVBAMTHlJveWFsIFN3 - ZWRpc2ggQmVlciBTcXVhZHJvbiBDQTEmMCQGCSqGSIb3DQEJARYXaG9zdG1hc3Rl - ckBpcHJlZGF0b3Iuc2WCCQCnnuGTDKb4czAMBgNVHRMEBTADAQH/MA0GCSqGSIb3 - DQEBBQUAA4IBAQB8nxZJaTvMMoSG47jD2w31zt9o6nSx8XJKop/0rMMHKBe1QBUw - /n3clGwYxBW8mTnrXHhmJkwJzA0Vh525+dkF28E0I+DSigKUXEewIZtKjADYSxaG - M+4272enbJ86JeXUhN8oF9TT+LKgMBgtt9yX5o63Ek6QOKwovH5kemDOVJmwae9p - tXQEWfCPDFMc7VfSxS4BDBVinRWeMWZs+2AWeWu2CMsjcx7+B+kPbBCzfANanFDD - CZEQON4pEpfK2XErhOudKEJGCl7psH+9Ex//pqsUS43nVN/4sqydiwbi+wQuUI3P - BYtvqPnWdjIdf2ayAQQCWliAx9+P03vbef6y + MIIFozCCA4ugAwIBAgIBATANBgkqhkiG9w0BAQ0FADBAMQswCQYDVQQGEwJDSDEV + MBMGA1UEChMMUHJvdG9uVlBOIEFHMRowGAYDVQQDExFQcm90b25WUE4gUm9vdCBD + QTAeFw0xNzAyMTUxNDM4MDBaFw0yNzAyMTUxNDM4MDBaMEAxCzAJBgNVBAYTAkNI + MRUwEwYDVQQKEwxQcm90b25WUE4gQUcxGjAYBgNVBAMTEVByb3RvblZQTiBSb290 + IENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAt+BsSsZg7+AuqTq7 + vDbPzfygtl9f8fLJqO4amsyOXlI7pquL5IsEZhpWyJIIvYybqS4s1/T7BbvHPLVE + wlrq8A5DBIXcfuXrBbKoYkmpICGc2u1KYVGOZ9A+PH9z4Tr6OXFfXRnsbZToie8t + 2Xjv/dZDdUDAqeW89I/mXg3k5x08m2nfGCQDm4gCanN1r5MT7ge56z0MkY3FFGCO + qRwspIEUzu1ZqGSTkG1eQiOYIrdOF5cc7n2APyvBIcfvp/W3cpTOEmEBJ7/14RnX + nHo0fcx61Inx/6ZxzKkW8BMdGGQF3tF6u2M0FjVN0lLH9S0ul1TgoOS56yEJ34hr + JSRTqHuar3t/xdCbKFZjyXFZFNsXVvgJu34CNLrHHTGJj9jiUfFnxWQYMo9UNUd4 + a3PPG1HnbG7LAjlvj5JlJ5aqO5gshdnqb9uIQeR2CdzcCJgklwRGCyDT1pm7eoiv + WV19YBd81vKulLzgPavu3kRRe83yl29It2hwQ9FMs5w6ZV/X6ciTKo3etkX9nBD9 + ZzJPsGQsBUy7CzO1jK4W01+u3ItmQS+1s4xtcFxdFY8o/q1zoqBlxpe5MQIWN6Qa + lryiET74gMHE/S5WrPlsq/gehxsdgc6GDUXG4dk8vn6OUMa6wb5wRO3VXGEc67IY + m4mDFTYiPvLaFOxtndlUWuCruKcCAwEAAaOBpzCBpDAMBgNVHRMEBTADAQH/MB0G + A1UdDgQWBBSDkIaYhLVZTwyLNTetNB2qV0gkVDBoBgNVHSMEYTBfgBSDkIaYhLVZ + TwyLNTetNB2qV0gkVKFEpEIwQDELMAkGA1UEBhMCQ0gxFTATBgNVBAoTDFByb3Rv + blZQTiBBRzEaMBgGA1UEAxMRUHJvdG9uVlBOIFJvb3QgQ0GCAQEwCwYDVR0PBAQD + AgEGMA0GCSqGSIb3DQEBDQUAA4ICAQCYr7LpvnfZXBCxVIVc2ea1fjxQ6vkTj0zM + htFs3qfeXpMRf+g1NAh4vv1UIwLsczilMt87SjpJ25pZPyS3O+/VlI9ceZMvtGXd + MGfXhTDp//zRoL1cbzSHee9tQlmEm1tKFxB0wfWd/inGRjZxpJCTQh8oc7CTziHZ + ufS+Jkfpc4Rasr31fl7mHhJahF1j/ka/OOWmFbiHBNjzmNWPQInJm+0ygFqij5qs + 51OEvubR8yh5Mdq4TNuWhFuTxpqoJ87VKaSOx/Aefca44Etwcj4gHb7LThidw/ky + zysZiWjyrbfX/31RX7QanKiMk2RDtgZaWi/lMfsl5O+6E2lJ1vo4xv9pW8225B5X + eAeXHCfjV/vrrCFqeCprNF6a3Tn/LX6VNy3jbeC+167QagBOaoDA01XPOx7Odhsb + Gd7cJ5VkgyycZgLnT9zrChgwjx59JQosFEG1DsaAgHfpEl/N3YPJh68N7fwN41Cj + zsk39v6iZdfuet/sP7oiP5/gLmA/CIPNhdIYxaojbLjFPkftVjVPn49RqwqzJJPR + N8BOyb94yhQ7KO4F3IcLT/y/dsWitY0ZH4lCnAVV/v2YjWAWS3OWyC8BFx/Jmc3W + DK/yPwECUcPgHIeXiRjHnJt0Zcm23O2Q3RphpU+1SO3XixsXpOVOYP6rJIXW9bMZ + A1gTTlpi7A== -----END CERTIFICATE----- key: | - -----BEGIN PGP MESSAGE----- - - hQEMA2PKcvDMvlKLAQf/T4DHs16NJK69W91IS2CJWDZER8TJCeG56ArKucz+2A7I - hB6OFkf0bKINXRGSBuFYcPcTOUpQ1NrV9osCPTwChaHx7vk3S+q4tlT+CiHUygCk - nisAckkAQSSSZlSkm+zhw59afiAu3Rn0x3gffjE1W6GBnIFwkzEnmViWHO3beYqV - 2sOJ9BlFTo/aJS87MoEDk58xycPinFkLUciyozToUN/TDcU+OYVOXMLmIr41nG9+ - GT1OlYALROo1sHpFP2KkwdpmqE2etc2lk3kDlVBiHMcQzLXcm3MO9N63Cec0cJEj - zzj4G8DWVsl1vU2n2l6dEiBCVQ5VqCC519mCHN//UdLA7AFEksPep/gm7ro3mbBG - SM3vuumroynP7QmKWTZeLuU+R6GLc1rdjicI2AQ5cNrIPfayzGirE7nnTRUfRHSX - 5nKsxJnM7M75ZOZVGWI986dQJ1pHNDqHkOIGL8QbRcrQmguZxAPgYaYbbqd9L8Yl - oHSVm2j5SKYW5Sgj6q7mlM5asZ0bbwAEL/NghwDNIV0fXQlS9ZZRzXsRxKP/PS/g - HPX41MsIPPHBoHB7Uwmpk7efjubcmvk26n/sW6UdhT4EjNNmk5lBtanqs6NpqZDb - fOSEnkIkgt9i3bwyHv1aTNf5ir4AWz/cQ7FuqJjUE6viNxap9DbY60dJgAoTtJ9v - p2nmzfGJiqi4PKYf9qrk2SlCkudb00a6b7aNZr+J7WbZyFD1Slo/tGOvFKbf2VzS - 2KXoXTDykRDVoq5BAAcm9tWTf11ZuDDxaOb24RP10CcD6BXdgdQ50bB91VnjitDC - YNwQWtFEvn3XuYB+Lq074zFW+gaCCEhviCMfP5u4BO5/NVJsVTCBFyOXIX0l+xwy - Rtyed/RP7AhmyFL9Ia2zdWbBjUR9eSkC7lyQXQG7 - =vxru - -----END PGP MESSAGE----- + -----BEGIN OpenVPN Static key V1----- + 6acef03f62675b4b1bbd03e53b187727 + 423cea742242106cb2916a8a4c829756 + 3d22c7e5cef430b1103c6f66eb1fc5b3 + 75a672f158e2e2e936c3faa48b035a6d + e17beaac23b5f03b10b868d53d03521d + 8ba115059da777a60cbfd7b2c9c57472 + 78a15b8f6e68a3ef7fd583ec9f398c8b + d4735dab40cbd1e3c62a822e97489186 + c30a0b48c7c38ea32ceb056d3fa5a710 + e10ccc7a0ddb363b08c3d2777a3395e1 + 0c0b6080f56309192ab5aacd4b45f55d + a61fc77af39bd81a19218a79762c3386 + 2df55785075f37d8c71dc8a42097ee43 + 344739a0dd48d03025b0450cf1fb5e8c + aeb893d9a96d1f15519bb3c4dcb40ee3 + 16672ea16c012664f8a9f11255518deb + -----END OpenVPN Static key V1----- diff --git a/salt/top.sls b/salt/top.sls index 644a509..fa4fe89 100644 --- a/salt/top.sls +++ b/salt/top.sls @@ -52,7 +52,7 @@ base: - no-ssh - forwarding - bird - - wireguard + - vpn.openvpn - upstream.masquerade - upstream.shaping - upstream.nat66 diff --git a/salt/vpn/openvpn.conf b/salt/vpn/openvpn.conf index 405544e..15288fe 100644 --- a/salt/vpn/openvpn.conf +++ b/salt/vpn/openvpn.conf @@ -29,10 +29,23 @@ ca [inline] tls-client tls-auth [inline] ns-cert-type server +setenv CLIENT_CERT 0 +tun-mtu 1500 +tun-mtu-extra 32 +mssfix 1450 +persist-key +persist-tun + +reneg-sec 0 + +remote-cert-tls server +auth-user-pass keepalive 10 30 cipher AES-256-CBC -comp-lzo +auth SHA512 +comp-lzo no +fast-io passtos