freecssx/nordvpn repository overview

# 1. AJUSTES DEL SERVIDOR
logoutput: stderr

internal: 0.0.0.0 port = 1080

# Usar nordlynx para forzar que todo salga por la VPN
external: nordlynx
# Sin autenticación (equivalente a --no-auth de Merino)
socksmethod: none
clientmethod: none

user.privileged: root
user.notprivileged: nobody

# 2. REGLAS DE ACCESO DE CLIENTE
# Abierto a cualquier cliente (según tu preferencia)
client pass {
    from: 0.0.0.0/0 to: 0.0.0.0/0
    log: connect disconnect error
}

# 3. REGLAS SOCKS (P2P completo)
# CONNECT + UDP ASSOCIATE + BIND
socks pass {
    from: 0.0.0.0/0 to: 0.0.0.0/0
    command: connect udpassociate bind
    log: connect disconnect error
}

# Respuestas UDP y BIND (crítico para P2P)
socks pass {
    from: 0.0.0.0/0 to: 0.0.0.0/0
    command: udpreply bindreply
    log: error
}

# Imagen única: NordVPN + Dante + supervisord
FROM ubuntu:24.04

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && \
    apt-get install -y --no-install-recommends \
        wget \
        apt-transport-https \
        ca-certificates \
        iproute2 \
        iputils-ping \
        supervisor \
        dante-server && \
    wget -qO /etc/apt/trusted.gpg.d/nordvpn_public.asc \
        https://repo.nordvpn.com/gpg/nordvpn_public.asc && \
    echo "deb https://repo.nordvpn.com/deb/nordvpn/debian stable main" \
        > /etc/apt/sources.list.d/nordvpn.list && \
    apt-get update && \
    apt-get install -y --no-install-recommends nordvpn && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

# Configuración de Dante
COPY danted.conf /etc/danted.conf

# Scripts y supervisord
COPY supervisord.conf /etc/supervisor/supervisord.conf
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
COPY run-dante.sh /usr/local/bin/run-dante.sh

RUN chmod +x /usr/local/bin/entrypoint.sh /usr/local/bin/run-dante.sh

ENV SOCKS_PORT=1080

EXPOSE 1080/tcp 1080/udp

CMD ["/usr/bin/supervisord", "-c", "/etc/supervisor/supervisord.conf"]

#!/usr/bin/env bash
set -euo pipefail

echo "[nordvpn-init] Iniciando daemon de NordVPN..."
/etc/init.d/nordvpn start

echo "[nordvpn-init] Esperando que nordvpnd esté listo..."
for i in {1..30}; do
  if nordvpn status >/dev/null 2>&1; then
    echo "[nordvpn-init] nordvpnd listo."
    break
  fi
  if [[ $i -eq 30 ]]; then
    echo "[nordvpn-init] ERROR: nordvpnd no respondió después de 30 segundos."
    exit 1
  fi
  sleep 1
done

# Login con token (modo no interactivo)
if [[ -n "${NORDVPN_TOKEN:-}" ]]; then
  echo "[nordvpn-init] Haciendo login en NordVPN con token..."
  if ! printf 'n\n' | nordvpn login --token "$NORDVPN_TOKEN"; then
    echo "[nordvpn-init] Aviso: login falló o ya estabas logueado. Continúo..."
  fi
else
  echo "[nordvpn-init] NORDVPN_TOKEN no definido, saltando login."
fi

# Tecnología (NordLynx, OpenVPN, etc.)
if [[ -n "${NORDVPN_TECHNOLOGY:-}" ]]; then
  echo "[nordvpn-init] Configurando tecnología: $NORDVPN_TECHNOLOGY"
  nordvpn set technology "$NORDVPN_TECHNOLOGY" || true
fi

# Protocolo (udp/tcp) - solo aplica para OpenVPN
if [[ -n "${NORDVPN_PROTOCOL:-}" ]]; then
  echo "[nordvpn-init] Configurando protocolo: $NORDVPN_PROTOCOL"
  nordvpn set protocol "$NORDVPN_PROTOCOL" || true
fi

# Kill Switch
case "${NORDVPN_KILLSWITCH:-}" in
  on)
    echo "[nordvpn-init] Activando Kill Switch"
    nordvpn set killswitch on || true
    ;;
  off)
    echo "[nordvpn-init] Desactivando Kill Switch"
    nordvpn set killswitch off || true
    ;;
esac

# LAN Discovery
case "${NORDVPN_LAN_DISCOVERY:-}" in
  on)
    echo "[nordvpn-init] Activando LAN Discovery"
    nordvpn set lan-discovery on || true
    ;;
  off)
    echo "[nordvpn-init] Desactivando LAN Discovery"
    nordvpn set lan-discovery off || true
    ;;
esac

# DNS personalizado (opcional)
if [[ -n "${NORDVPN_DNS:-}" ]]; then
  echo "[nordvpn-init] Configurando DNS: $NORDVPN_DNS"
  nordvpn set dns "$NORDVPN_DNS" || true
fi

# Construir argumentos de conexión
CONNECT_ARGS=()

if [[ -n "${NORDVPN_GROUP:-}" ]]; then
  CONNECT_ARGS+=(--group "$NORDVPN_GROUP")
fi

if [[ -n "${NORDVPN_CONNECT:-}" ]]; then
  CONNECT_ARGS+=("$NORDVPN_CONNECT")
fi

echo "[nordvpn-init] Conectando a NordVPN..."
if [[ "${#CONNECT_ARGS[@]}" -gt 0 ]]; then
  echo "[nordvpn-init] Argumentos: ${CONNECT_ARGS[*]}"
  nordvpn connect "${CONNECT_ARGS[@]}" || nordvpn connect
else
  nordvpn connect
fi

# Esperar conexión
for i in {1..20}; do
  if nordvpn status | grep -q "Status: Connected"; then
    echo "[nordvpn-init] ✓ NordVPN conectado correctamente."
    nordvpn status

    # Whitelist de subnets (separadas por coma)
    # Ejemplo: NORDVPN_WHITELIST_SUBNETS="192.168.1.0/24,10.0.0.0/8"
    if [[ -n "${NORDVPN_WHITELIST_SUBNETS:-}" ]]; then
      echo "[nordvpn-init] Aplicando whitelist de subnets..."
      IFS=',' read -ra SUBNETS <<< "$NORDVPN_WHITELIST_SUBNETS"
      for subnet in "${SUBNETS[@]}"; do
        subnet_trimmed="$(echo "$subnet" | xargs)"
        if [[ -n "$subnet_trimmed" ]]; then
          echo "[nordvpn-init]   + Subnet: $subnet_trimmed"
          nordvpn whitelist add subnet "$subnet_trimmed" || true
        fi
      done
    fi

    # Whitelist de puertos (separados por coma)
    # Ejemplo: NORDVPN_WHITELIST_PORTS="22,80,443"
    if [[ -n "${NORDVPN_WHITELIST_PORTS:-}" ]]; then
      echo "[nordvpn-init] Aplicando whitelist de puertos..."
      IFS=',' read -ra PORTS <<< "$NORDVPN_WHITELIST_PORTS"
      for port in "${PORTS[@]}"; do
        port_trimmed="$(echo "$port" | xargs)"
        if [[ -n "$port_trimmed" ]]; then
          echo "[nordvpn-init]   + Puerto: $port_trimmed"
          nordvpn whitelist add port "$port_trimmed" || true
        fi
      done
    fi

    exit 0
  fi
  echo "[nordvpn-init] Esperando conexión VPN... ($i/20)"
  sleep 2
done

echo "[nordvpn-init] ERROR: No se pudo conectar a NordVPN después de 40 segundos."
pkill -9 supervisord
exit 1

#!/usr/bin/env bash
set -euo pipefail

echo "[dante] Esperando que NordVPN esté conectado..."

vpn_ok=0
for i in {1..30}; do
  if nordvpn status 2>/dev/null | grep -q "Status: Connected"; then
    echo "[dante] NordVPN está conectado."
    vpn_ok=1
    break
  fi
  echo "[dante] Aún no conectado a NordVPN... ($i/30)"
  sleep 2
done

if [[ "$vpn_ok" != "1" ]]; then
  echo "[dante] ERROR: NordVPN no se conectó, NO iniciaré Dante para evitar fuga de IP."
  exit 1
fi

echo "[dante] Esperando que la interfaz nordlynx exista..."
for i in {1..30}; do
  if ip link show nordlynx >/dev/null 2>&1; then
    echo "[dante] nordlynx detectada."
    break
  fi
  echo "[dante] Aún no aparece nordlynx... ($i/30)"
  sleep 1
done

if ! ip link show nordlynx >/dev/null 2>&1; then
  echo "[dante] ERROR: La interfaz nordlynx no existe, abortando para evitar fuga de IP."
  exit 1
fi

echo "[dante] Iniciando Dante SOCKS5 en 0.0.0.0:${SOCKS_PORT:-1080}..."

exec danted -f /etc/danted.conf

[supervisord]
nodaemon=true
logfile=/dev/null
logfile_maxbytes=0
pidfile=/var/run/supervisord.pid
user=root

[program:nordvpn-init]
command=/usr/local/bin/entrypoint.sh
autostart=true
autorestart=false
startsecs=0
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
priority=10

[program:dante]
command=/usr/local/bin/run-dante.sh
autostart=true
autorestart=true
startretries=3
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
priority=20

version: "3.8"
services:
  vpn:
    image: freecssx/nordvpn:v6   
    container_name: nordvpn-dante
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/nordlynx:/dev/net/nordlynx
    sysctls:
      net.ipv6.conf.all.disable_ipv6: "1"
    environment:
      - NORDVPN_TOKEN=xxxxxxxxxxxxxxxxxxxxxxx
      - NORDVPN_TECHNOLOGY=NordLynx
      - NORDVPN_PROTOCOL=udp
      - NORDVPN_KILLSWITCH=on
      - NORDVPN_LAN_DISCOVERY=off
      - NORDVPN_GROUP=p2p
      - NORDVPN_CONNECT=cl
      - SOCKS_PORT=1080
      - NORDVPN_WHITELIST_SUBNETS=166.166.166.0/24
    ports:
      - "1080:1080/tcp"
      - "1080:1080/udp"
    restart: unless-stopped


# nordvpn status
# ip a
# wget -qO- https://ipinfo.io/ip; echo

# curl --socks5 127.0.0.1:1080 https://ipinfo.io/ip
# curl --socks5 166.166.166.166:1080 https://ipinfo.io/ip