<commit_before>#!/bin/bash
# Establish an OpenVPN connection using $1 as config and
# create an iptables filter working like a VPN kill switch.
# VPN server IP is deduced after succesful connection, so it may be dynamic.
# If "allowlan" is given as $2, LAN traffic is allowed, otherwise it is not.

# For now we need to know beforehand how many IP routes the VPN
# connection is expected to create when initializing.
routes_to_create=5

if [ "$#" == 0 ]
then
    echo "You must give the OpenVPN config file as parameter."
    exit
fi

if test "X$(which openvpn)" == "X"
then
    echo "OpenVPN executable not found."
    exit
fi

for physical_device in $(ls -l /sys/class/net | grep devices\/pci | grep -o " [^ ]* ->" | cut -f 2 -d ' ')
do
    ip=$(ip addr show $physical_device | grep -o "inet [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}" | cut -f 2 -d ' ')
    if test "X$ip" != "X"
    then
        IF=$physical_device
        if test "X$2" == "Xallowlan"
        then
            subnet=$(echo $ip | cut -f 1 -d '.')
        fi
        break
    fi
done

echo "Using interface $IF and config file $1"

current_routes=$(ip route show | grep $IF | cut -f 1 -d ' ')
num_routes=$(expr $(ip route show | wc -l) + $routes_to_create)

modprobe tun

echo -n "Connecting VPN..."
openvpn $1 &>/dev/shm/openvpn.log &

# Wait till VPN routes are set up.
while [ $(ip route show | wc -l) -ne $num_routes ]
do
    sleep 0.5
    echo -n "."
done
echo -e "\nVPN connection is active."

new_routes=$(ip route show | grep $IF | cut -f 1 -d ' ')
vpn_ip=""
for route in $new_routes
do
    vpn_ip=$route
    for counterpart in $current_routes
    do
        if test "$route" == "$counterpart"
        then
            vpn_ip=""
        fi
    done
    if test "X$vpn_ip" != "X"
    then
        break
    fi
done
if test "X$vpn_ip" == "X"
then
    echo "ERROR: VPN IP not found from routes."
    exit
fi

iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
if test "X$subnet" != "X"
then
    echo "LAN connections are allowed."
    iptables -A INPUT -s $subnet.0.0.0/16 -d $subnet.0.0.0/16 -j ACCEPT
    iptables -A OUTPUT -s $subnet.0.0.0/16 -d $subnet.0.0.0/16 -j ACCEPT
fi
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A INPUT -p udp --sport 1194 -s $vpn_ip -j ACCEPT
iptables -A OUTPUT -p udp --dport 1194 -d $vpn_ip -j ACCEPT
echo "Created iptables rules. Firewall is now enabled."

function killvpn() {
    echo -e "\nKilling VPN connection..."
}

while [ 1 ]
do
    trap killvpn 2
    wait
    echo "VPN connection lost. Reconnecting in 5 seconds..."
    echo "To cancel, press c."
    read -s -N 1 -t 5 cancel
    trap 2

    if test "X$cancel" == "Xc"
    then
        break
    fi

    echo "DNS traffic allowed outside VPN."
    iptables -A INPUT -p udp --sport 53 -j ACCEPT
    iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

    num_routes=$(expr $(ip route show | wc -l) + $routes_to_create)
    echo -n "Reconnecting VPN..."
    openvpn $1 &>/dev/shm/openvpn.log &
    while [ $(ip route show | wc -l) -ne $num_routes ]
    do
        sleep 0.5
        echo -n "."
    done
    echo -e "\nVPN connection is active."

    iptables -D INPUT -p udp --sport 53 -j ACCEPT
    iptables -D OUTPUT -p udp --dport 53 -j ACCEPT
    echo "DNS traffic disabled outside VPN."
done

iptables -F
iptables -P INPUT ACCEPT<commit_msg>Add more verbose info.<commit_after>#!/bin/bash
# Establish an OpenVPN connection using $1 as config and
# create an iptables filter working like a VPN kill switch.
# VPN server IP is deduced after succesful connection, so it may be dynamic.
# If "allowlan" is given as $2, LAN traffic is allowed, otherwise it is not.

# For now we need to know beforehand how many IP routes the VPN
# connection is expected to create when initializing.
routes_to_create=5
logfile=/dev/shm/openvpn.log

if [ "$#" == 0 ]
then
    echo "You must give the OpenVPN config file as parameter."
    exit
fi

if test "X$(which openvpn)" == "X"
then
    echo "OpenVPN executable not found."
    exit
fi

for physical_device in $(ls -l /sys/class/net | grep devices\/pci | grep -o " [^ ]* ->" | cut -f 2 -d ' ')
do
    ip=$(ip addr show $physical_device | grep -o "inet [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}" | cut -f 2 -d ' ')
    if test "X$ip" != "X"
    then
        IF=$physical_device
        if test "X$2" == "Xallowlan"
        then
            subnet=$(echo $ip | cut -f 1 -d '.')
        fi
        break
    fi
done

echo "Using interface $IF and config file $1"
echo "OpenVPN output is logged into $logfile"
echo "To kill the connection, press Ctrl-c and then c."

current_routes=$(ip route show | grep $IF | cut -f 1 -d ' ')
num_routes=$(expr $(ip route show | wc -l) + $routes_to_create)

modprobe tun

echo -n "Connecting VPN..."
openvpn $1 &>$logfile &

# Wait till VPN routes are set up.
while [ $(ip route show | wc -l) -ne $num_routes ]
do
    sleep 0.5
    echo -n "."
done
echo -e "\n\nVPN connection is active."

new_routes=$(ip route show | grep $IF | cut -f 1 -d ' ')
vpn_ip=""
for route in $new_routes
do
    vpn_ip=$route
    for counterpart in $current_routes
    do
        if test "$route" == "$counterpart"
        then
            vpn_ip=""
        fi
    done
    if test "X$vpn_ip" != "X"
    then
        break
    fi
done
if test "X$vpn_ip" == "X"
then
    echo "ERROR: VPN IP not found from routes."
    exit
fi

iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT DROP
if test "X$subnet" != "X"
then
    echo "LAN connections are allowed."
    iptables -A INPUT -s $subnet.0.0.0/16 -d $subnet.0.0.0/16 -j ACCEPT
    iptables -A OUTPUT -s $subnet.0.0.0/16 -d $subnet.0.0.0/16 -j ACCEPT
fi
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -i tun+ -j ACCEPT
iptables -A OUTPUT -o tun+ -j ACCEPT
iptables -A INPUT -p udp --sport 1194 -s $vpn_ip -j ACCEPT
iptables -A OUTPUT -p udp --dport 1194 -d $vpn_ip -j ACCEPT
echo "Created iptables rules. Firewall is now enabled."

function killvpn() {
    echo -e "\nKilling VPN connection..."
}

while [ 1 ]
do
    trap killvpn 2
    wait
    echo "VPN connection lost. Reconnecting in 5 seconds..."
    echo "To cancel, press c."
    read -s -N 1 -t 5 cancel
    trap 2

    if test "X$cancel" == "Xc"
    then
        break
    fi

    echo "DNS traffic allowed outside VPN."
    iptables -A INPUT -p udp --sport 53 -j ACCEPT
    iptables -A OUTPUT -p udp --dport 53 -j ACCEPT

    num_routes=$(expr $(ip route show | wc -l) + $routes_to_create)
    echo -n "Reconnecting VPN..."
    openvpn $1 &>$logfile &
    while [ $(ip route show | wc -l) -ne $num_routes ]
    do
        sleep 0.5
        echo -n "."
    done
    echo -e "\n\nVPN connection is active."

    iptables -D INPUT -p udp --sport 53 -j ACCEPT
    iptables -D OUTPUT -p udp --dport 53 -j ACCEPT
    echo "DNS traffic disabled outside VPN."
done

iptables -F
iptables -P INPUT ACCEPT
{'fraction_non_alphanumeric': 0.1266437964551172, 'fraction_numerical': 0.02144082332761578, 'mean_word_length': 2.3430482560917345, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4595478', 'n_tokens_mistral': 2689, 'n_tokens_neox': 2595, 'n_words': 990}