Stunnel Kharej

Stunnel Kharej

yum update -y
yum install nano lsof net-tools wget -y
nano /etc/selinux/config => disable selinux
wget --no-check-certificate https://github.com/teddysun/across/raw/master/bbr.sh && chmod +x bbr.sh && ./bbr.sh
reboot

yum install stunnel -y 


cat > /etc/stunnel/stunnel.pem <<EOF
-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEAu2TfW5tUaXv1nNzGK/6AK2IjDhF0D8MhNYtVNLW2zK8oLLFo
14jLh5qWiCh1ZgDy5Q8sX2N9OD93W8Fim4nVGqEZjK1ieu59LclrkhkbOZwHqp6o
JwWzy/wrRTFrDAxy587ZCfas4F8rdhGqh5WEEDg4jgQLYT6M4ldUTm7DNn8TjKlc
PYfus8h+nbhD+G2l7F9LPU6BdugUCuiK+dHh6nTJpFs8ngbKzvbrc//qsHZKMnri
AxWG1eIx5av6taKgHrukwGcXPmNlCkYpvzyJM7etbQXDe7stVTcApA1FzLIP5fI1
kl+7OYgodnjDt4Sa8wPbv3CmavQhVrRum15sYwIDAQABAoIBABN+wQXkuPloXfr9
tNgq1+arhP4Xrr1dDX1mi2y6YtQUfNd5dXDG2HW5DWQI4X3FJ3/Q/krGLObHI4G2
Mq3/vt3QWLob55zmZrt2suw2FHD/3IRRkSjOHRBhoZbHN12/hcy75jR1JzMIc5sK
53THhz+wuaF8pjptqXZ6o1itiT2H+QxFpPHNiM88Ord2alliv1oiinH82bAn9ngj
XG5NpS0gPPNC6jJ6RJbC+P3k31ktfeRryRD12SS2k+qzOtjb0MZ1mULeRIvMiQM0
6FMAmqtiuWY24M7rbrmYBLNw8eXjZBILOia3JbJOnijI/dKHanyBT0iO43CfAh0R
q9RDaUECgYEA8ylcg534ASlUtPmRWIXBC2bXeawAD4Imh/6tuwTqdq3d5ZeXQGsA
0dm1BhI73rNlOqoB9rXEP5+ppE4YkcHg1PGYOayOi9D/9zEZ64bDzRbhUMWt0UCx
W5LHxDBKHIxB3c7jLY20MpVKSrVDeMjuypoGfUyCjDr9T1Lu6U7gj9ECgYEAxUm9
5OJ0RRK2GUD70nLbvFtBgfJbJf81GGWstelC55DLFEelN2Wx+dIN3T0zEPFlM86y
1j9Qv6TFjviOUgt2VirfF43RgfZ4zQD58mCwF6d8cX604Dcf1e0ixyxvYSqcuo88
1QfZs7ESN+Q8B0oBPLaQ8HByC3yx2vK7pkSimfMCgYEA6QlCuIC0JajOnYJwYT4O
fDbbWqgUhshc1Qimxw03BvYqKtbVBc+GwZa7fk4LQqr64PX9W8tngPIrSmPt+AKu
zmWbVeqh0i1CokxUYvyMugirdxV8N4agcvqAqOz+mc1xcnnMDuQ3RiL9SAvf1en7
r/9dKMgidPIzwcnhXYdSf4ECgYAyilqYSR8KFuoJfClG11/NV/9nH8QT7tYWQu3E
yFX4ZpJvxo7fqzC11AbzN1teqsiHRhtwYVX5Ume94ZTsFb2iA2eVbCJQzehSdD6T
xgs2dBSgKpqBmf2Q2yf+qDZ8SONPs6Qc2t79do45PUHXiDDa8dYdkmDU6oPRmD9U
L98L2wKBgQCm0Zu2ypTMZKqjOO5w1NjEnOkNH/H8HPOVvTUkng01IXEdb/5n0r4J
aFkH3NYhEOwYIu3T2q5nzlZMmiqE/qt3wJvrGAAb5o/ri4lx0KAxCg4N6O9AhidR
g5WRXfRP/rNUt0sqQlND7dAABuRHVAvFCBaAi1LwpC3ZivkWLbLw3A==
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
MIIDlzCCAn+gAwIBAgIJALK8ctSzqLfwMA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNV
BAYTAjk4MQwwCgYDVQQIDANraHoxDDAKBgNVBAcMA2F3aDEMMAoGA1UECgwDNDlm
MQswCQYDVQQLDAJmajEKMAgGA1UEAwwBYTEQMA4GCSqGSIb3DQEJARYBczAeFw0y
MjExMTAwMDM4MjVaFw0yNTExMDkwMDM4MjVaMGIxCzAJBgNVBAYTAjk4MQwwCgYD
VQQIDANraHoxDDAKBgNVBAcMA2F3aDEMMAoGA1UECgwDNDlmMQswCQYDVQQLDAJm
ajEKMAgGA1UEAwwBYTEQMA4GCSqGSIb3DQEJARYBczCCASIwDQYJKoZIhvcNAQEB
BQADggEPADCCAQoCggEBALtk31ubVGl79Zzcxiv+gCtiIw4RdA/DITWLVTS1tsyv
KCyxaNeIy4ealogodWYA8uUPLF9jfTg/d1vBYpuJ1RqhGYytYnrufS3Ja5IZGzmc
B6qeqCcFs8v8K0UxawwMcufO2Qn2rOBfK3YRqoeVhBA4OI4EC2E+jOJXVE5uwzZ/
E4ypXD2H7rPIfp24Q/htpexfSz1OgXboFAroivnR4ep0yaRbPJ4Gys7263P/6rB2
SjJ64gMVhtXiMeWr+rWioB67pMBnFz5jZQpGKb88iTO3rW0Fw3u7LVU3AKQNRcyy
D+XyNZJfuzmIKHZ4w7eEmvMD279wpmr0IVa0bptebGMCAwEAAaNQME4wHQYDVR0O
BBYEFLEfb7IKpD1o46qGpZhfCAw/QWd2MB8GA1UdIwQYMBaAFLEfb7IKpD1o46qG
pZhfCAw/QWd2MAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAJTiqShs
ZLgTMgcn+WpYaXH2qrkHeqE9IbS0NjcpTp62WOqJsYDXtbBzNKrnavqsbT9vUjRX
dRoUTgRyMW7Y7+Xzc8a/aLWKYzxdREO2muCCp+xDhHsjzst2BRmaotuYuGgYIdJH
DlDYq/b6Exv/SwctxVq//fYccLtFnLM9ZcM3VScMr5gG0L2Rtcsyr/v4SfE9we71
5UKFrSO5J5Dx2pKzAmybe/anZibCeHxSIi57IxpqjKWCIdRd3cXY5iV7rPIt3Mm/
eRYbUcWWyncnJQ+hlAzlzlw6PQhUXOxb0pTPpli8w4pK7+puIzVUAh0pku1ITmwC
VVEgBfzD4bXxzCc=
-----END CERTIFICATE-----
EOF


cat > /etc/stunnel/stunnel.conf <<EOF
cert = /etc/stunnel/stunnel.pem
pid = /var/run/stunnel.pid
setuid = root
setgid = root
#output = /var/log/stunnel.log
syslog   = no
debug = 7
failover = prio
socket = l:TCP_NODELAY=1
#socket = r:TCP_NODELAY=1
#TIMEOUTconnect = 5
#session = 86400



session         = 300
stack           = 65536
TIMEOUTbusy     = 300
TIMEOUTclose    = 60
TIMEOUTconnect  = 10
TIMEOUTidle     = 120



[cisco]
accept = 8081
connect = 127.0.0.1:443



[oopenvpn]
accept = 8082
connect = 127.0.0.1:80
EOF



cat > /etc/systemd/system/stunnel.service <<EOF
[Unit]
Description=SSL tunnel for network daemons
After=network.target
After=syslog.target

[Install]
WantedBy=multi-user.target
Alias=stunnel.target

[Service]
Type=forking
ExecStart=/usr/bin/stunnel /etc/stunnel/stunnel.conf
ExecStop=/usr/bin/killall -9 stunnel

# Give up if ping don't get an answer
TimeoutSec=600

Restart=always
PrivateTmp=false
EOF

systemctl enable stunnel
systemctl stop stunnel
systemctl start stunnel
systemctl status stunnel 

Ethernet=$(ip link | awk -F: '$0 !~ "lo|vir|wl|^[^0-9]"{print $2;getline}' | head -1 )



systemctl stop firewalld
systemctl disable firewalld
systemctl mask firewalld
systemctl start iptables
systemctl enable iptables
iptables -t nat -F
iptables -t mangle -F
iptables -F
iptables -X
iptables -I INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p udp --dport 443 -j ACCEPT
iptables -A INPUT -p udp --dport 8081 -j ACCEPT
iptables -A INPUT -p udp --dport 8082 -j ACCEPT
iptables -t nat -A POSTROUTING -o  $Ethernet -j MASQUERADE
echo "net.ipv4.ip_forward=1
#net.core.default_qdisc = fq
#net.ipv4.tcp_congestion_control = bbr" > /etc/sysctl.conf
sysctl -p
service iptables save
service iptables restart