fix merge conflicts

2021-10-11 16:54:20 +03:00 · 2021-10-11 16:54:20 +03:00 · 6c2e6ead2b
commit 6c2e6ead2b
parent f4a55d60a4 d275702080
46 changed files with 1092 additions and 8428 deletions
--- a/client/client.pro
+++ b/client/client.pro
@ -19,6 +19,7 @@ include ("3rd/SortFilterProxyModel/SortFilterProxyModel.pri")
 HEADERS  += \
    ../ipc/ipc.h \
   configurators/cloak_configurator.h \
+   configurators/ikev2_configurator.h \
   configurators/shadowsocks_configurator.h \
   configurators/ssh_configurator.h \
   configurators/vpn_configurator.h \
@ -34,6 +35,7 @@ HEADERS  += \
    debug.h \
    defines.h \
    managementserver.h \
+   protocols/ikev2_vpn_protocol.h \
   protocols/openvpnovercloakprotocol.h \
   protocols/protocols_defs.h \
    protocols/shadowsocksvpnprotocol.h \
@ -73,6 +75,7 @@ HEADERS  += \

 SOURCES  += \
   configurators/cloak_configurator.cpp \
+   configurators/ikev2_configurator.cpp \
   configurators/shadowsocks_configurator.cpp \
   configurators/ssh_configurator.cpp \
   configurators/vpn_configurator.cpp \
@ -87,6 +90,7 @@ SOURCES  += \
    debug.cpp \
    main.cpp \
    managementserver.cpp \
+   protocols/ikev2_vpn_protocol.cpp \
   protocols/openvpnovercloakprotocol.cpp \
   protocols/protocols_defs.cpp \
    protocols/shadowsocksvpnprotocol.cpp \
@ -122,9 +126,6 @@ SOURCES  += \
    protocols/vpnprotocol.cpp \
    protocols/openvpnprotocol.cpp \

-FORMS    += \
-   ui/server_widget.ui
-
 RESOURCES += \
    resources.qrc

--- a/client/configurators/ikev2_configurator.cpp
+++ b/client/configurators/ikev2_configurator.cpp
@ -0,0 +1,66 @@
+#include "ikev2_configurator.h"
+#include <QApplication>
+#include <QProcess>
+#include <QString>
+#include <QTemporaryDir>
+#include <QDebug>
+#include <QTemporaryFile>
+#include <QJsonDocument>
+
+#include "sftpdefs.h"
+
+#include "core/server_defs.h"
+#include "containers/containers_defs.h"
+#include "core/scripts_registry.h"
+#include "utils.h"
+
+Ikev2Configurator::ConnectionData Ikev2Configurator::prepareIkev2Config(const ServerCredentials &credentials,
+    DockerContainer container, ErrorCode *errorCode)
+{
+    Ikev2Configurator::ConnectionData connData;
+    connData.host = credentials.hostName;
+    connData.clientId = Utils::getRandomString(16);
+    connData.password = Utils::getRandomString(16);
+
+    QString certFileName = "/opt/amnezia/ikev2/clients/" + connData.clientId + ".p12";
+
+    QString scriptCreateCert = QString("certutil -z <(head -c 1024 /dev/urandom) "\
+                             "-S -c \"IKEv2 VPN CA\" -n \"%1\" "\
+                             "-s \"O=IKEv2 VPN,CN=%1\" "\
+                             "-k rsa -g 3072 -v 120 "\
+                             "-d sql:/etc/ipsec.d -t \",,\" "\
+                             "--keyUsage digitalSignature,keyEncipherment "\
+                             "--extKeyUsage serverAuth,clientAuth -8 \"%1\"")
+            .arg(connData.clientId);
+
+    ErrorCode e = ServerController::runContainerScript(credentials, container, scriptCreateCert);
+
+    QString scriptExportCert = QString("pk12util -W \"%1\" -d sql:/etc/ipsec.d -n \"%2\" -o \"%3\"")
+            .arg(connData.password)
+            .arg(connData.clientId)
+            .arg(certFileName);
+    e = ServerController::runContainerScript(credentials, container, scriptExportCert);
+
+    connData.cert = ServerController::getTextFileFromContainer(container, credentials, certFileName, &e);
+    qDebug() << "Ikev2Configurator::ConnectionData cert size:" << connData.cert.size();
+
+    return connData;
+}
+
+QString Ikev2Configurator::genIkev2Config(const ServerCredentials &credentials,
+    DockerContainer container, const QJsonObject &containerConfig, ErrorCode *errorCode)
+{
+    ConnectionData connData = prepareIkev2Config(credentials, container, errorCode);
+    if (errorCode && *errorCode) {
+        return "";
+    }
+
+    QJsonObject config;
+    config[config_key::hostName] = connData.host;
+    config[config_key::userName] = connData.clientId;
+    config[config_key::cert] = QString(connData.cert.toBase64());
+    config[config_key::password] = connData.password;
+
+    return QJsonDocument(config).toJson();
+}
+
--- a/client/configurators/ikev2_configurator.h
+++ b/client/configurators/ikev2_configurator.h
@ -0,0 +1,30 @@
+#ifndef IKEV2_CONFIGURATOR_H
+#define IKEV2_CONFIGURATOR_H
+
+#include <QObject>
+#include <QProcessEnvironment>
+
+#include "core/defs.h"
+#include "core/servercontroller.h"
+
+class Ikev2Configurator
+{
+public:
+
+    struct ConnectionData {
+        QByteArray cert; // p12 client cert
+        QString clientId;
+        QString password; // certificate password
+        QString host; // host ip
+    };
+
+    static QString genIkev2Config(const ServerCredentials &credentials, DockerContainer container,
+        const QJsonObject &containerConfig, ErrorCode *errorCode = nullptr);
+
+
+private:
+    static ConnectionData prepareIkev2Config(const ServerCredentials &credentials,
+        DockerContainer container, ErrorCode *errorCode = nullptr);
+};
+
+#endif // IKEV2_CONFIGURATOR_H
--- a/client/configurators/openvpn_configurator.cpp
+++ b/client/configurators/openvpn_configurator.cpp
@ -5,6 +5,7 @@
 #include <QTemporaryDir>
 #include <QDebug>
 #include <QTemporaryFile>
+#include <QJsonObject>

 #include "core/server_defs.h"
 #include "containers/containers_defs.h"
@ -242,16 +243,14 @@ QString OpenVpnConfigurator::genOpenVpnConfig(const ServerCredentials &credentia
    config.replace("block-outside-dns", "");
 #endif

-    //qDebug().noquote() << config;
-    return config;
+    QJsonObject jConfig;
+    jConfig[config_key::config] = config;
+
+    return QJsonDocument(jConfig).toJson();
 }

 QString OpenVpnConfigurator::processConfigWithLocalSettings(QString config)
 {
-    // TODO replace DNS if it already set
-    config.replace("$PRIMARY_DNS", m_settings().primaryDns());
-    config.replace("$SECONDARY_DNS", m_settings().secondaryDns());
-
    if (m_settings().routeMode() != Settings::VpnAllSites) {
        config.replace("redirect-gateway def1 bypass-dhcp", "");
    }
@ -277,9 +276,6 @@ QString OpenVpnConfigurator::processConfigWithLocalSettings(QString config)

 QString OpenVpnConfigurator::processConfigWithExportSettings(QString config)
 {
-    config.replace("$PRIMARY_DNS", m_settings().primaryDns());
-    config.replace("$SECONDARY_DNS", m_settings().secondaryDns());
-
    if(!config.contains("redirect-gateway def1 bypass-dhcp")) {
        config.append("redirect-gateway def1 bypass-dhcp\n");
    }
@ -308,5 +304,5 @@ ErrorCode OpenVpnConfigurator::signCert(DockerContainer container,
    QStringList scriptList {script_import, script_sign};
    QString script = ServerController::replaceVars(scriptList.join("\n"), ServerController::genVarsForScript(credentials, container));

-    return ServerController::runScript(ServerController::sshParams(credentials), script);
+    return ServerController::runScript(credentials, script);
 }
--- a/client/configurators/vpn_configurator.cpp
+++ b/client/configurators/vpn_configurator.cpp
@ -3,6 +3,7 @@
 #include "cloak_configurator.h"
 #include "shadowsocks_configurator.h"
 #include "wireguard_configurator.h"
+#include "ikev2_configurator.h"

 #include <QFile>
 #include <QJsonObject>
@ -10,6 +11,11 @@

 #include "containers/containers_defs.h"

+Settings &VpnConfigurator::m_settings()
+{
+    static Settings s;
+    return s;
+}

 QString VpnConfigurator::genVpnProtocolConfig(const ServerCredentials &credentials,
    DockerContainer container, const QJsonObject &containerConfig, Protocol proto, ErrorCode *errorCode)
@ -27,6 +33,9 @@ QString VpnConfigurator::genVpnProtocolConfig(const ServerCredentials &credentia
    case Protocol::WireGuard:
        return WireguardConfigurator::genWireguardConfig(credentials, container, containerConfig, errorCode);

+    case Protocol::Ikev2:
+        return Ikev2Configurator::genIkev2Config(credentials, container, containerConfig, errorCode);
+
    default:
        return "";
    }
@ -34,6 +43,9 @@ QString VpnConfigurator::genVpnProtocolConfig(const ServerCredentials &credentia

 QString VpnConfigurator::processConfigWithLocalSettings(DockerContainer container, Protocol proto, QString config)
 {
+    config.replace("$PRIMARY_DNS", m_settings().primaryDns());
+    config.replace("$SECONDARY_DNS", m_settings().secondaryDns());
+
    if (proto == Protocol::OpenVpn) {
        return OpenVpnConfigurator::processConfigWithLocalSettings(config);
    }
@ -42,6 +54,9 @@ QString VpnConfigurator::processConfigWithLocalSettings(DockerContainer containe

 QString VpnConfigurator::processConfigWithExportSettings(DockerContainer container, Protocol proto, QString config)
 {
+    config.replace("$PRIMARY_DNS", m_settings().primaryDns());
+    config.replace("$SECONDARY_DNS", m_settings().secondaryDns());
+
    if (proto == Protocol::OpenVpn) {
        return OpenVpnConfigurator::processConfigWithExportSettings(config);
    }
--- a/client/configurators/vpn_configurator.h
+++ b/client/configurators/vpn_configurator.h
@ -7,6 +7,7 @@
 #include "settings.h"
 #include "core/servercontroller.h"

+// Retrieve connection settings from server
 class VpnConfigurator
 {
 public:
@ -21,6 +22,7 @@ public:
    static void updateContainerConfigAfterInstallation(DockerContainer container,
        QJsonObject &containerConfig, const QString &stdOut);

+    static Settings &m_settings();
 };

 #endif // VPN_CONFIGURATOR_H
--- a/client/configurators/wireguard_configurator.cpp
+++ b/client/configurators/wireguard_configurator.cpp
@ -130,7 +130,7 @@ WireguardConfigurator::ConnectionData WireguardConfigurator::prepareWireguardCon
        return connData;
    }

-    e = ServerController::runScript(ServerController::sshParams(credentials),
+    e = ServerController::runScript(credentials,
        ServerController::replaceVars("sudo docker exec -i $CONTAINER_NAME bash -c 'wg syncconf wg0 <(wg-quick strip /opt/amnezia/wireguard/wg0.conf)'",
            ServerController::genVarsForScript(credentials, container)));

@ -158,8 +158,10 @@ QString WireguardConfigurator::genWireguardConfig(const ServerCredentials &crede
    config.replace("$WIREGUARD_SERVER_PUBLIC_KEY", connData.serverPubKey);
    config.replace("$WIREGUARD_PSK", connData.pskKey);

-    qDebug().noquote() << config;
-    return config;
+    QJsonObject jConfig;
+    jConfig[config_key::config] = config;
+
+    return QJsonDocument(jConfig).toJson();
 }

 QString WireguardConfigurator::processConfigWithLocalSettings(QString config)
@ -168,7 +170,10 @@ QString WireguardConfigurator::processConfigWithLocalSettings(QString config)
    config.replace("$PRIMARY_DNS", m_settings().primaryDns());
    config.replace("$SECONDARY_DNS", m_settings().secondaryDns());

-    return config;
+    QJsonObject jConfig;
+    jConfig[config_key::config] = config;
+
+    return QJsonDocument(jConfig).toJson();
 }

 QString WireguardConfigurator::processConfigWithExportSettings(QString config)
--- a/client/containers/containers_defs.cpp
+++ b/client/containers/containers_defs.cpp
@ -42,6 +42,9 @@ QVector<amnezia::Protocol> ContainerProps::protocolsForContainer(amnezia::Docker
    case DockerContainer::Cloak:
        return { Protocol::OpenVpn, Protocol::ShadowSocks, Protocol::Cloak };

+    case DockerContainer::Ipsec:
+        return { Protocol::Ikev2, Protocol::L2tp };
+
    case DockerContainer::Dns:
        return { };

@ -69,6 +72,8 @@ QMap<DockerContainer, QString> ContainerProps::containerHumanNames()
        {DockerContainer::ShadowSocks, "OpenVpn over ShadowSocks"},
        {DockerContainer::Cloak, "OpenVpn over Cloak"},
        {DockerContainer::WireGuard, "WireGuard"},
+        {DockerContainer::Ipsec, QObject::tr("IPsec container")},
+
        {DockerContainer::TorWebSite, QObject::tr("Web site in TOR network")},
        {DockerContainer::Dns, QObject::tr("DNS Service")},
        {DockerContainer::FileShare, QObject::tr("SMB file sharing service")},
@ -84,6 +89,8 @@ QMap<DockerContainer, QString> ContainerProps::containerDescriptions()
        {DockerContainer::Cloak, QObject::tr("Container with OpenVpn and ShadowSocks protocols "
                                                        "configured with traffic masking by Cloak plugin")},
        {DockerContainer::WireGuard, QObject::tr("WireGuard container")},
+        {DockerContainer::Ipsec, QObject::tr("IPsec container")},
+
        {DockerContainer::TorWebSite, QObject::tr("Web site in TOR network")},
        {DockerContainer::Dns, QObject::tr("DNS Service")},
        {DockerContainer::FileShare, QObject::tr("SMB file sharing service - is Window file sharing protocol")},
@ -99,15 +106,29 @@ amnezia::ServiceType ContainerProps::containerService(DockerContainer c)
    case DockerContainer::Cloak :        return ServiceType::Vpn;
    case DockerContainer::ShadowSocks :  return ServiceType::Vpn;
    case DockerContainer::WireGuard :    return ServiceType::Vpn;
+    case DockerContainer::Ipsec :        return ServiceType::Vpn;
    case DockerContainer::TorWebSite :   return ServiceType::Other;
    case DockerContainer::Dns :          return ServiceType::Other;
    case DockerContainer::FileShare :    return ServiceType::Other;
+    case DockerContainer::Sftp :         return ServiceType::Other;
    default:                             return ServiceType::Other;
    }
 }

 Protocol ContainerProps::defaultProtocol(DockerContainer c)
 {
-    return static_cast<Protocol>(c);
+    switch (c) {
+    case DockerContainer::None :         return Protocol::Any;
+    case DockerContainer::OpenVpn :      return Protocol::OpenVpn;
+    case DockerContainer::Cloak :        return Protocol::Cloak;
+    case DockerContainer::ShadowSocks :  return Protocol::ShadowSocks;
+    case DockerContainer::WireGuard :    return Protocol::WireGuard;
+    case DockerContainer::Ipsec :        return Protocol::Ikev2;
+
+    case DockerContainer::TorWebSite :   return Protocol::TorWebSite;
+    case DockerContainer::Dns :          return Protocol::Dns;
+    case DockerContainer::FileShare :    return Protocol::FileShare;
+    case DockerContainer::Sftp :         return Protocol::Sftp;
+    }
 }

--- a/client/containers/containers_defs.h
+++ b/client/containers/containers_defs.h
@ -18,6 +18,7 @@ enum DockerContainer {
    ShadowSocks,
    Cloak,
    WireGuard,
+    Ipsec,

    //non-vpn
    TorWebSite,
--- a/client/core/defs.h
+++ b/client/core/defs.h
@ -66,17 +66,6 @@ enum ErrorCode
    CloakExecutableCrashed
 };

-
-namespace config {
-// config keys
-const char key_openvpn_config_data[] = "openvpn_config_data";
-const char key_openvpn_config_path[] = "openvpn_config_path";
-const char key_shadowsocks_config_data[] = "shadowsocks_config_data";
-const char key_cloak_config_data[] = "cloak_config_data";
-const char key_wireguard_config_data[] = "wireguard_config_data";
-
-}
-
 } // namespace amnezia

 Q_DECLARE_METATYPE(amnezia::ErrorCode)
--- a/client/core/scripts_registry.cpp
+++ b/client/core/scripts_registry.cpp
@ -11,6 +11,8 @@ QString amnezia::scriptFolder(amnezia::DockerContainer container)
    case DockerContainer::Cloak: return QLatin1String("openvpn_cloak");
    case DockerContainer::ShadowSocks: return QLatin1String("openvpn_shadowsocks");
    case DockerContainer::WireGuard: return QLatin1String("wireguard");
+    case DockerContainer::Ipsec: return QLatin1String("ipsec");
+
    case DockerContainer::TorWebSite: return QLatin1String("website_tor");
    case DockerContainer::Dns: return QLatin1String("dns");
    case DockerContainer::FileShare: return QLatin1String("file_share");
--- a/client/core/servercontroller.cpp
+++ b/client/core/servercontroller.cpp
@ -24,11 +24,11 @@

 using namespace QSsh;

-ErrorCode ServerController::runScript(const SshConnectionParameters &sshParams, QString script,
+ErrorCode ServerController::runScript(const ServerCredentials &credentials, QString script,
    const std::function<void(const QString &, QSharedPointer<SshRemoteProcess>)> &cbReadStdOut,
    const std::function<void(const QString &, QSharedPointer<SshRemoteProcess>)> &cbReadStdErr)
 {
-    SshConnection *client = connectToHost(sshParams);
+    SshConnection *client = connectToHost(sshParams(credentials));
    if (client->state() == SshConnection::State::Connecting) {
        qDebug() << "ServerController::runScript aborted, connectToHost in progress";
        return ErrorCode::SshTimeoutError;
@ -121,6 +121,26 @@ ErrorCode ServerController::runScript(const SshConnectionParameters &sshParams,
    return ErrorCode::NoError;
 }

+ErrorCode ServerController::runContainerScript(const ServerCredentials &credentials,
+    DockerContainer container, QString script,
+    const std::function<void (const QString &, QSharedPointer<QSsh::SshRemoteProcess>)> &cbReadStdOut,
+    const std::function<void (const QString &, QSharedPointer<QSsh::SshRemoteProcess>)> &cbReadStdErr)
+{
+    QString fileName = "/opt/amnezia/" + Utils::getRandomString(16) + ".sh";
+    ErrorCode e = uploadTextFileToContainer(container, credentials, script, fileName);
+    if (e) return e;
+
+    QString runner = QString("sudo docker exec -i $CONTAINER_NAME bash %1 ").arg(fileName);
+    e = runScript(credentials,
+        replaceVars(runner, genVarsForScript(credentials, container)), cbReadStdOut, cbReadStdErr);
+
+//    QString remover = QString("sudo docker exec -i $CONTAINER_NAME rm %1 ").arg(fileName);
+//    runScript(credentials,
+//            replaceVars(remover, genVarsForScript(credentials, container)));
+
+    return e;
+}
+
 ErrorCode ServerController::uploadTextFileToContainer(DockerContainer container,
    const ServerCredentials &credentials, const QString &file, const QString &path,
    QSsh::SftpOverwriteMode overwriteMode)
@ -136,20 +156,20 @@ ErrorCode ServerController::uploadTextFileToContainer(DockerContainer container,
    };

    if (overwriteMode == QSsh::SftpOverwriteMode::SftpOverwriteExisting) {
-        e = runScript(sshParams(credentials),
+        e = runScript(credentials,
            replaceVars(QString("sudo docker cp %1 $CONTAINER_NAME:/%2").arg(tmpFileName).arg(path),
                genVarsForScript(credentials, container)), cbReadStd, cbReadStd);

        if (e) return e;
    }
    else if (overwriteMode == QSsh::SftpOverwriteMode::SftpAppendToExisting) {
-        e = runScript(sshParams(credentials),
+        e = runScript(credentials,
            replaceVars(QString("sudo docker cp %1 $CONTAINER_NAME:/%2").arg(tmpFileName).arg(tmpFileName),
                genVarsForScript(credentials, container)), cbReadStd, cbReadStd);

        if (e) return e;

-        e = runScript(sshParams(credentials),
+        e = runScript(credentials,
            replaceVars(QString("sudo docker exec -i $CONTAINER_NAME sh -c \"cat %1 >> %2\"").arg(tmpFileName).arg(path),
                genVarsForScript(credentials, container)), cbReadStd, cbReadStd);

@ -162,23 +182,23 @@ ErrorCode ServerController::uploadTextFileToContainer(DockerContainer container,
        return ErrorCode::ServerContainerMissingError;
    }

-    runScript(sshParams(credentials),
+    runScript(credentials,
        replaceVars(QString("sudo shred %1").arg(tmpFileName),
              genVarsForScript(credentials, container)));

-    runScript(sshParams(credentials),
+    runScript(credentials,
            replaceVars(QString("sudo rm %1").arg(tmpFileName),
                genVarsForScript(credentials, container)));

    return e;
 }

-QString ServerController::getTextFileFromContainer(DockerContainer container,
+QByteArray ServerController::getTextFileFromContainer(DockerContainer container,
    const ServerCredentials &credentials, const QString &path, ErrorCode *errorCode)
 {
    if (errorCode) *errorCode = ErrorCode::NoError;

-    QString script = QString("sudo docker exec -i %1 sh -c \"cat \'%2\'\"").
+    QString script = QString("sudo docker exec -i %1 sh -c \"xxd -p \'%2\'\"").
            arg(ContainerProps::containerToString(container)).arg(path);

    qDebug().noquote() << "Copy file from container\n" << script;
@ -186,14 +206,14 @@ QString ServerController::getTextFileFromContainer(DockerContainer container,
    SshConnection *client = connectToHost(sshParams(credentials));
    if (client->state() != SshConnection::State::Connected) {
        if (errorCode) *errorCode = fromSshConnectionErrorCode(client->errorState());
-        return QString();
+        return {};
    }

    QSharedPointer<SshRemoteProcess> proc = client->createRemoteProcess(script.toUtf8());
    if (!proc) {
        qCritical() << "Failed to create SshRemoteProcess, breaking.";
        if (errorCode) *errorCode = ErrorCode::SshRemoteProcessCreationError;
-        return QString();
+        return {};
    }

    QEventLoop wait;
@ -221,7 +241,7 @@ QString ServerController::getTextFileFromContainer(DockerContainer container,
    }

    if (errorCode) *errorCode = ErrorCode::NoError;
-    return proc->readAllStandardOutput();
+    return QByteArray::fromHex(proc->readAllStandardOutput());
 }

 ErrorCode ServerController::checkOpenVpnServer(DockerContainer container, const ServerCredentials &credentials)
@ -352,13 +372,13 @@ SshConnectionParameters ServerController::sshParams(const ServerCredentials &cre

 ErrorCode ServerController::removeAllContainers(const ServerCredentials &credentials)
 {
-    return runScript(sshParams(credentials),
+    return runScript(credentials,
        amnezia::scriptData(SharedScriptType::remove_all_containers));
 }

 ErrorCode ServerController::removeContainer(const ServerCredentials &credentials, DockerContainer container)
 {
-    return runScript(sshParams(credentials),
+    return runScript(credentials,
        replaceVars(amnezia::scriptData(SharedScriptType::remove_container),
            genVarsForScript(credentials, container)));
 }
@ -482,7 +502,7 @@ ErrorCode ServerController::installDockerWorker(const ServerCredentials &credent
        stdOut += data + "\n";
    };

-    ErrorCode e = runScript(sshParams(credentials),
+    ErrorCode e = runScript(credentials,
        replaceVars(amnezia::scriptData(SharedScriptType::install_docker),
            genVarsForScript(credentials)),
                cbReadStdOut, cbReadStdErr);
@ -495,7 +515,7 @@ ErrorCode ServerController::installDockerWorker(const ServerCredentials &credent
 ErrorCode ServerController::prepareHostWorker(const ServerCredentials &credentials, DockerContainer container, const QJsonObject &config)
 {
    // create folder on host
-    return runScript(sshParams(credentials),
+    return runScript(credentials,
        replaceVars(amnezia::scriptData(SharedScriptType::prepare_host),
            genVarsForScript(credentials, container)));
 }
@ -515,7 +535,7 @@ ErrorCode ServerController::buildContainerWorker(const ServerCredentials &creden
 //        stdOut += data + "\n";
 //    };

-    return runScript(sshParams(credentials),
+    return runScript(credentials,
        replaceVars(amnezia::scriptData(SharedScriptType::build_container),
                    genVarsForScript(credentials, container, config)));
 }
@ -530,7 +550,7 @@ ErrorCode ServerController::runContainerWorker(const ServerCredentials &credenti
        stdOut += data + "\n";
    };

-    ErrorCode e = runScript(sshParams(credentials),
+    ErrorCode e = runScript(credentials,
        replaceVars(amnezia::scriptData(ProtocolScriptType::run_container, container),
            genVarsForScript(credentials, container, config)),
                cbReadStdOut, cbReadStdErr);
@ -553,11 +573,12 @@ ErrorCode ServerController::configureContainerWorker(const ServerCredentials &cr
    };


-    ErrorCode e = runScript(sshParams(credentials),
+    ErrorCode e = runContainerScript(credentials, container,
        replaceVars(amnezia::scriptData(ProtocolScriptType::configure_container, container),
            genVarsForScript(credentials, container, config)),
                cbReadStdOut, cbReadStdErr);

+
    VpnConfigurator::updateContainerConfigAfterInstallation(container, config, stdOut);

    return e;
@ -576,7 +597,7 @@ ErrorCode ServerController::startupContainerWorker(const ServerCredentials &cred
            "/opt/amnezia/start.sh");
    if (e) return e;

-    return runScript(sshParams(credentials),
+    return runScript(credentials,
        replaceVars("sudo docker exec -d $CONTAINER_NAME sh -c \"chmod a+x /opt/amnezia/start.sh && /opt/amnezia/start.sh\"",
            genVarsForScript(credentials, container, config)));
 }
@ -634,6 +655,25 @@ ServerController::Vars ServerController::genVarsForScript(const ServerCredential

    vars.append({{"$WIREGUARD_SERVER_PORT", wireguarConfig.value(config_key::port).toString(protocols::wireguard::defaultPort) }});

+    // IPsec vars
+    vars.append({{"$IPSEC_VPN_L2TP_NET", "192.168.42.0/24"}});
+    vars.append({{"$IPSEC_VPN_L2TP_POOL", "192.168.42.10-192.168.42.250"}});
+    vars.append({{"$IPSEC_VPN_L2TP_LOCAL", "192.168.42.1"}});
+
+    vars.append({{"$IPSEC_VPN_XAUTH_NET", "192.168.43.0/24"}});
+    vars.append({{"$IPSEC_VPN_XAUTH_POOL", "192.168.43.10-192.168.43.250"}});
+
+    vars.append({{"$IPSEC_VPN_SHA2_TRUNCBUG", "yes"}});
+
+    vars.append({{"$IPSEC_VPN_VPN_ANDROID_MTU_FIX", "yes"}});
+    vars.append({{"$IPSEC_VPN_DISABLE_IKEV2", "no"}});
+    vars.append({{"$IPSEC_VPN_DISABLE_L2TP", "no"}});
+    vars.append({{"$IPSEC_VPN_DISABLE_XAUTH", "no"}});
+
+    vars.append({{"$IPSEC_VPN_C2C_TRAFFIC", "no"}});
+
+
+
    // Sftp vars
    vars.append({{"$SFTP_PORT", sftpConfig.value(config_key::port).toString(QString::number(ProtocolProps::defaultPort(Protocol::Sftp))) }});
    vars.append({{"$SFTP_USER", sftpConfig.value(config_key::userName).toString() }});
@ -661,7 +701,7 @@ QString ServerController::checkSshConnection(const ServerCredentials &credential
        stdOut += data + "\n";
    };

-    ErrorCode e = runScript(sshParams(credentials),
+    ErrorCode e = runScript(credentials,
        amnezia::scriptData(SharedScriptType::check_connection), cbReadStdOut, cbReadStdErr);

    if (errorCode) *errorCode = e;
@ -731,7 +771,7 @@ void ServerController::disconnectFromHost(const ServerCredentials &credentials)

 ErrorCode ServerController::setupServerFirewall(const ServerCredentials &credentials)
 {
-    return runScript(sshParams(credentials),
+    return runScript(credentials,
        replaceVars(amnezia::scriptData(SharedScriptType::setup_host_firewall),
            genVarsForScript(credentials)));
 }
--- a/client/core/servercontroller.h
+++ b/client/core/servercontroller.h
@ -46,14 +46,18 @@ public:
        const ServerCredentials &credentials, const QString &file, const QString &path,
        QSsh::SftpOverwriteMode overwriteMode = QSsh::SftpOverwriteMode::SftpOverwriteExisting);

-    static QString getTextFileFromContainer(DockerContainer container,
+    static QByteArray getTextFileFromContainer(DockerContainer container,
        const ServerCredentials &credentials, const QString &path, ErrorCode *errorCode = nullptr);

    static ErrorCode setupServerFirewall(const ServerCredentials &credentials);

    static QString replaceVars(const QString &script, const Vars &vars);

-    static ErrorCode runScript(const QSsh::SshConnectionParameters &sshParams, QString script,
+    static ErrorCode runScript(const ServerCredentials &credentials, QString script,
+        const std::function<void(const QString &, QSharedPointer<QSsh::SshRemoteProcess>)> &cbReadStdOut = nullptr,
+        const std::function<void(const QString &, QSharedPointer<QSsh::SshRemoteProcess>)> &cbReadStdErr = nullptr);
+
+    static ErrorCode runContainerScript(const ServerCredentials &credentials, DockerContainer container, QString script,
        const std::function<void(const QString &, QSharedPointer<QSsh::SshRemoteProcess>)> &cbReadStdOut = nullptr,
        const std::function<void(const QString &, QSharedPointer<QSsh::SshRemoteProcess>)> &cbReadStdErr = nullptr);

--- a/client/debug.cpp
+++ b/client/debug.cpp
@ -3,6 +3,7 @@
 #include <QDir>
 #include <QStandardPaths>
 #include <QUrl>
+#include <Utils.h>

 #include <iostream>

@ -31,6 +32,9 @@ void debugMessageHandler(QtMsgType type, const QMessageLogContext& context, cons

 bool Debug::init()
 {
+    qSetMessagePattern("%{time yyyy-MM-dd hh:mm:ss} %{type} %{message}");
+
+#ifndef QT_DEBUG
    QString path = userLogsDir();
    QDir appDir(path);
    if (!appDir.mkpath(path)) {
@ -39,7 +43,6 @@ bool Debug::init()

    m_logFileName = QString("%1.log").arg(APPLICATION_NAME);

-    qSetMessagePattern("%{time yyyy-MM-dd hh:mm:ss} %{type} %{message}");

    m_file.setFileName(appDir.filePath(m_logFileName));
    if (!m_file.open(QIODevice::WriteOnly | QIODevice::Truncate)) {
@ -49,6 +52,7 @@ bool Debug::init()
    m_file.setTextModeEnabled(true);
    m_textStream.setDevice(&m_file);
    qInstallMessageHandler(debugMessageHandler);
+#endif

    return true;
 }
@ -71,6 +75,14 @@ bool Debug::openLogsFolder()
    return true;
 }

+bool Debug::openServiceLogsFolder()
+{
+    QString path = Utils::systemLogPath();
+    path = "file:///" + path;
+    QDesktopServices::openUrl(QUrl::fromLocalFile(path));
+    return true;
+}
+
 QString Debug::appLogFileNamePath()
 {
    return m_file.fileName();
--- a/client/debug.h
+++ b/client/debug.h
@ -12,6 +12,7 @@ class Debug
 public:
    static bool init();
    static bool openLogsFolder();
+    static bool openServiceLogsFolder();
    static QString appLogFileNamePath();

 private:
--- a/client/protocols/ikev2_vpn_protocol.cpp
+++ b/client/protocols/ikev2_vpn_protocol.cpp
@ -0,0 +1,218 @@
+#include <QCoreApplication>
+#include <QFileInfo>
+#include <QProcess>
+#include <QRegularExpression>
+#include <QTcpSocket>
+#include <QThread>
+
+#include "debug.h"
+#include "ikev2_vpn_protocol.h"
+#include "utils.h"
+
+
+Ikev2Protocol::Ikev2Protocol(const QJsonObject &configuration, QObject* parent) :
+    VpnProtocol(configuration, parent)
+{
+    //m_configFile.setFileTemplate(QDir::tempPath() + QDir::separator() + serviceName() + ".conf");
+    readIkev2Configuration(configuration);
+}
+
+Ikev2Protocol::~Ikev2Protocol()
+{
+    qDebug() << "IpsecProtocol::~IpsecProtocol()";
+    Ikev2Protocol::stop();
+    QThread::msleep(200);
+}
+
+void Ikev2Protocol::stop()
+{
+#ifdef Q_OS_WINDOWS
+    {
+        setConnectionState(Disconnecting);
+
+        auto disconnectProcess = new QProcess;
+
+        disconnectProcess->setProgram("rasdial");
+        QString arguments = QString("\"%1\" /disconnect")
+                                .arg(tunnelName());
+        disconnectProcess->setNativeArguments(arguments);
+
+//        connect(connectProcess, &QProcess::readyRead, [connectProcess]() {
+//            qDebug().noquote() << "connectProcess readyRead" << connectProcess->readAll();
+//        });
+
+        disconnectProcess->start();
+        disconnectProcess->waitForFinished(5000);
+        setConnectionState(Disconnected);
+    }
+#endif
+}
+
+void Ikev2Protocol::readIkev2Configuration(const QJsonObject &configuration)
+{
+    m_config = configuration.value(ProtocolProps::key_proto_config_data(Protocol::Ikev2)).toObject();
+}
+
+ErrorCode Ikev2Protocol::start()
+{
+#ifdef Q_OS_WINDOWS
+    QByteArray cert = QByteArray::fromBase64(m_config[config_key::cert].toString().toUtf8());
+    setConnectionState(ConnectionState::Connecting);
+
+    QTemporaryFile certFile;
+    certFile.setAutoRemove(false);
+    certFile.open();
+    certFile.write(cert);
+    certFile.close();
+
+
+    {
+        auto certInstallProcess = IpcClient::CreatePrivilegedProcess();
+
+        if (!certInstallProcess) {
+            setLastError(ErrorCode::AmneziaServiceConnectionFailed);
+            return ErrorCode::AmneziaServiceConnectionFailed;
+        }
+
+        certInstallProcess->waitForSource(1000);
+        if (!certInstallProcess->isInitialized()) {
+            qWarning() << "IpcProcess replica is not connected!";
+            setLastError(ErrorCode::AmneziaServiceConnectionFailed);
+            return ErrorCode::AmneziaServiceConnectionFailed;
+        }
+        certInstallProcess->setProgram("certutil");
+        QStringList arguments({"-f" , "-importpfx",
+                               "-p", m_config[config_key::password].toString(),
+                               certFile.fileName(), "NoExport"
+                              });
+        certInstallProcess->setArguments(arguments);
+
+//        qDebug() << arguments.join(" ");
+//        connect(certInstallProcess.data(), &IpcProcessInterfaceReplica::errorOccurred, [certInstallProcess](QProcess::ProcessError error) {
+//            qDebug() << "IpcProcessInterfaceReplica errorOccurred" << error;
+//        });
+
+//        connect(certInstallProcess.data(), &IpcProcessInterfaceReplica::stateChanged, [certInstallProcess](QProcess::ProcessState newState) {
+//            qDebug() << "IpcProcessInterfaceReplica stateChanged" << newState;
+//        });
+
+//        connect(certInstallProcess.data(), &IpcProcessInterfaceReplica::readyRead, [certInstallProcess]() {
+//            auto req = certInstallProcess->readAll();
+//            req.waitForFinished();
+//            qDebug() << "IpcProcessInterfaceReplica readyRead" << req.returnValue();
+//        });
+
+
+        certInstallProcess->start();
+    }
+
+    {
+        auto adapterRemoveProcess = new QProcess;
+
+        adapterRemoveProcess->setProgram("powershell");
+        QString arguments = QString("-command \"Remove-VpnConnection -Name '%1' -Force\"").arg(tunnelName());
+        adapterRemoveProcess->setNativeArguments(arguments);
+
+        adapterRemoveProcess->start();
+        adapterRemoveProcess->waitForFinished(5000);
+    }
+
+    {
+        auto adapterInstallProcess = new QProcess;
+
+        adapterInstallProcess->setProgram("powershell");
+        QString arguments = QString("-command \"Add-VpnConnection "
+                                    "-ServerAddress '%1' "
+                                    "-Name '%2' "
+                                    "-TunnelType IKEv2 "
+                                    "-AuthenticationMethod MachineCertificate "
+                                    "-EncryptionLevel Required "
+                                    "-PassThru\"")
+                                .arg(m_config[config_key::hostName].toString())
+                                .arg(tunnelName());
+        adapterInstallProcess->setNativeArguments(arguments);
+//        connect(adapterInstallProcess, &QProcess::readyRead, [adapterInstallProcess]() {
+//            qDebug().noquote() << "adapterInstallProcess readyRead" << adapterInstallProcess->readAll();
+//        });
+
+        adapterInstallProcess->start();
+        adapterInstallProcess->waitForFinished(5000);
+    }
+
+    {
+        auto adapterConfigProcess = new QProcess;
+
+        adapterConfigProcess->setProgram("powershell");
+        QString arguments = QString("-command \"Set-VpnConnectionIPsecConfiguration\ "
+                                    "-ConnectionName '%1'\ "
+                                    "-AuthenticationTransformConstants GCMAES128 "
+                                    "-CipherTransformConstants GCMAES128 "
+                                    "-EncryptionMethod AES256 "
+                                    "-IntegrityCheckMethod SHA256 "
+                                    "-PfsGroup None "
+                                    "-DHGroup Group14 "
+                                    "-PassThru -Force\"")
+                                .arg(tunnelName());
+        adapterConfigProcess->setNativeArguments(arguments);
+
+//        connect(adapterConfigProcess, &QProcess::readyRead, [adapterConfigProcess]() {
+//            qDebug().noquote() << "adapterConfigProcess readyRead" << adapterConfigProcess->readAll();
+//        });
+
+        adapterConfigProcess->start();
+        adapterConfigProcess->waitForFinished(5000);
+    }
+
+    {
+//        char buf[RASBUFFER]= {0};
+//        DWORD err = 0;
+//        RASDIALPARAMSA *param = (RASDIALPARAMSA *)buf;
+//        param->dwSize = 1064;
+//        strcpy(param->szEntryName, tunnelName().toStdString().c_str());
+//        err = RasDialA(NULL, NULL, param, 0, (LPVOID)rasCallback, &g_h);
+//        qDebug() << "Ikev2Protocol::start() ret" << err;
+
+
+        auto connectProcess = new QProcess;
+
+        connectProcess->setProgram("rasdial");
+        QString arguments = QString("\"%1\"")
+                                .arg(tunnelName());
+        connectProcess->setNativeArguments(arguments);
+
+        connect(connectProcess, &QProcess::readyRead, [connectProcess]() {
+            qDebug().noquote() << "connectProcess readyRead" << connectProcess->readAll();
+        });
+
+        connectProcess->start();
+        connectProcess->waitForFinished(5000);
+    }
+
+    setConnectionState(Connected);
+    return ErrorCode::NoError;
+
+#endif
+
+    return ErrorCode::NoError;
+}
+
+#ifdef Q_OS_WINDOWS
+DWORD CALLBACK rasCallback(UINT msg, RASCONNSTATE rascs, DWORD err)
+{
+    if(err != 0) {
+        printf("Error: %d\n", err);
+        fflush(stdout);
+        //g_done = 1;
+        return 0;   // stop the connection.
+    } else {
+        //printf("%s\n", rasState(rascs));
+        fflush(stdout);
+        if(rascs == RASCS_Connected) {
+            printf("Success: Connected\n");
+            fflush(stdout);
+            //g_done = 1;
+        }
+        return 1;
+    }
+}
+#endif
--- a/client/protocols/ikev2_vpn_protocol.h
+++ b/client/protocols/ikev2_vpn_protocol.h
@ -0,0 +1,60 @@
+#ifndef IPSEC_PROTOCOL_H
+#define IPSEC_PROTOCOL_H
+
+#include <QObject>
+#include <QProcess>
+#include <QString>
+#include <QTemporaryFile>
+#include <QTimer>
+
+#include "vpnprotocol.h"
+#include "core/ipcclient.h"
+
+#ifdef Q_OS_WIN
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include <windows.h>
+#include <ras.h>
+#include <raserror.h>
+#include <shlwapi.h>
+
+#pragma comment(lib, "shlwapi.lib")
+#pragma comment(lib, "rasapi32.lib")
+
+#define RASBUFFER       0x1000
+#define RASMAXENUM      0x100
+#endif
+
+class Ikev2Protocol : public VpnProtocol
+{
+    Q_OBJECT
+
+public:
+    explicit Ikev2Protocol(const QJsonObject& configuration, QObject* parent = nullptr);
+    virtual ~Ikev2Protocol() override;
+
+    ErrorCode start() override;
+    void stop() override;
+
+    static QString tunnelName() { return "AmneziaVPN IKEv2"; }
+
+private:
+    void readIkev2Configuration(const QJsonObject &configuration);
+
+
+private:
+    QJsonObject m_config;
+
+#ifdef Q_OS_WIN
+    HRASCONN g_h;
+    int      g_done = 0;
+#endif
+};
+
+#ifdef Q_OS_WIN
+DWORD CALLBACK rasCallback(UINT msg, RASCONNSTATE rascs, DWORD err);
+#endif
+
+#endif // IPSEC_PROTOCOL_H
--- a/client/protocols/openvpnovercloakprotocol.cpp
+++ b/client/protocols/openvpnovercloakprotocol.cpp
@ -113,5 +113,5 @@ QString OpenVpnOverCloakProtocol::cloakExecPath()

 void OpenVpnOverCloakProtocol::readCloakConfiguration(const QJsonObject &configuration)
 {
-    m_cloakConfig = configuration.value(config::key_cloak_config_data).toObject();
+    m_cloakConfig = configuration.value(ProtocolProps::key_proto_config_data(Protocol::Cloak)).toObject();
 }
--- a/client/protocols/openvpnprotocol.cpp
+++ b/client/protocols/openvpnprotocol.cpp
@ -57,7 +57,7 @@ void OpenVpnProtocol::stop()
    }
 }

-ErrorCode OpenVpnProtocol::checkAndSetupTapDriver()
+ErrorCode OpenVpnProtocol::prepare()
 {
    if (!IpcClient::Interface()) {
        return ErrorCode::AmneziaServiceConnectionFailed;
@ -86,24 +86,16 @@ void OpenVpnProtocol::killOpenVpnProcess()

 void OpenVpnProtocol::readOpenVpnConfiguration(const QJsonObject &configuration)
 {
-    if (configuration.contains(config::key_openvpn_config_data)) {
+    if (configuration.contains(ProtocolProps::key_proto_config_data(Protocol::OpenVpn))) {
+        QJsonObject jConfig = configuration.value(ProtocolProps::key_proto_config_data(Protocol::OpenVpn)).toObject();
+
        m_configFile.open();
-        m_configFile.write(configuration.value(config::key_openvpn_config_data).toString().toUtf8());
+        m_configFile.write(jConfig.value(config_key::config).toString().toUtf8());
        m_configFile.close();
        m_configFileName = m_configFile.fileName();

        qDebug().noquote() << QString("Set config data") << m_configFileName;
    }
-    else if (configuration.contains(config::key_openvpn_config_path)) {
-        m_configFileName = configuration.value(config::key_openvpn_config_path).toString();
-        QFileInfo file(m_configFileName);
-
-        if (file.fileName().isEmpty()) {
-            m_configFileName = defaultConfigFileName();
-        }
-
-        qDebug().noquote() << QString("Set config file: '%1'").arg(configPath());
-    }
 }

 bool OpenVpnProtocol::openVpnProcessIsRunning() const
--- a/client/protocols/openvpnprotocol.h
+++ b/client/protocols/openvpnprotocol.h
@ -21,7 +21,7 @@ public:
    ErrorCode start() override;
    void stop() override;

-    ErrorCode checkAndSetupTapDriver();
+    ErrorCode prepare() override;
    static QString defaultConfigFileName();
    static QString defaultConfigPath();

--- a/client/protocols/protocols_defs.cpp
+++ b/client/protocols/protocols_defs.cpp
@ -174,3 +174,13 @@ bool ProtocolProps::defaultTransportProtoChangeable(Protocol p)
    default:                      return false;
    }
 }
+
+QString ProtocolProps::key_proto_config_data(Protocol p)
+{
+    return protoToString(p) + "_config_data";
+}
+
+QString ProtocolProps::key_proto_config_path(Protocol p)
+{
+    return protoToString(p) + "_config_path";
+}
--- a/client/protocols/protocols_defs.h
+++ b/client/protocols/protocols_defs.h
@ -16,14 +16,16 @@ constexpr char port[] = "port";
 constexpr char local_port[] = "local_port";

 constexpr char description[] = "description";
+constexpr char cert[] = "cert";
+constexpr char config[] = "config";


 constexpr char containers[] = "containers";
 constexpr char container[] = "container";
 constexpr char defaultContainer[] = "defaultContainer";

+constexpr char protocol[] = "protocol";
 constexpr char protocols[] = "protocols";
-//constexpr char protocol[] = "protocol";

 constexpr char remote[] = "remote";
 constexpr char transport_proto[] = "transport_proto";
@ -164,6 +166,10 @@ public:
    Q_INVOKABLE static TransportProto defaultTransportProto(Protocol p);
    Q_INVOKABLE static bool defaultTransportProtoChangeable(Protocol p);

+
+    Q_INVOKABLE static QString key_proto_config_data(Protocol p);
+    Q_INVOKABLE static QString key_proto_config_path(Protocol p);
+
 };

 static void declareQmlProtocolEnum() {
--- a/client/protocols/shadowsocksvpnprotocol.cpp
+++ b/client/protocols/shadowsocksvpnprotocol.cpp
@ -112,5 +112,5 @@ QString ShadowSocksVpnProtocol::shadowSocksExecPath()

 void ShadowSocksVpnProtocol::readShadowSocksConfiguration(const QJsonObject &configuration)
 {
-    m_shadowSocksConfig = configuration.value(config::key_shadowsocks_config_data).toObject();
+    m_shadowSocksConfig = configuration.value(ProtocolProps::key_proto_config_data(Protocol::ShadowSocks)).toObject();
 }
--- a/client/protocols/vpnprotocol.cpp
+++ b/client/protocols/vpnprotocol.cpp
@ -4,6 +4,13 @@
 #include "vpnprotocol.h"
 #include "core/errorstrings.h"

+#include "openvpnprotocol.h"
+#include "shadowsocksvpnprotocol.h"
+#include "openvpnovercloakprotocol.h"
+#include "wireguardprotocol.h"
+#include "ikev2_vpn_protocol.h"
+
+
 VpnProtocol::VpnProtocol(const QJsonObject &configuration, QObject* parent)
    : QObject(parent),
      m_connectionState(ConnectionState::Unknown),
@ -88,6 +95,19 @@ QString VpnProtocol::vpnGateway() const
    return m_vpnGateway;
 }

+VpnProtocol *VpnProtocol::factory(DockerContainer container, const QJsonObject& configuration)
+{
+    switch (container) {
+    case DockerContainer::OpenVpn: return new OpenVpnProtocol(configuration);
+    case DockerContainer::Cloak: return new OpenVpnOverCloakProtocol(configuration);
+    case DockerContainer::ShadowSocks: return new ShadowSocksVpnProtocol(configuration);
+    case DockerContainer::WireGuard: return new WireguardProtocol(configuration);
+    case DockerContainer::Ipsec: return new Ikev2Protocol(configuration);
+
+    default: return nullptr;
+    }
+}
+
 QString VpnProtocol::routeGateway() const
 {
    return m_routeGateway;
--- a/client/protocols/vpnprotocol.h
+++ b/client/protocols/vpnprotocol.h
@ -6,6 +6,8 @@
 #include <QJsonObject>

 #include "core/defs.h"
+#include "containers/containers_defs.h"
+
 using namespace amnezia;

 class QTimer;
@ -23,6 +25,7 @@ public:

    static QString textConnectionState(ConnectionState connectionState);

+    virtual ErrorCode prepare() { return ErrorCode::NoError; }

    virtual bool isConnected() const;
    virtual bool isDisconnected() const;
@ -37,6 +40,8 @@ public:
    QString routeGateway() const;
    QString vpnGateway() const;

+    static VpnProtocol* factory(amnezia::DockerContainer container, const QJsonObject &configuration);
+
 signals:
    void bytesChanged(quint64 receivedBytes, quint64 sentBytes);
    void connectionStateChanged(VpnProtocol::ConnectionState state);
--- a/client/protocols/wireguardprotocol.cpp
+++ b/client/protocols/wireguardprotocol.cpp
@ -73,31 +73,22 @@ void WireguardProtocol::stop()

 void WireguardProtocol::readWireguardConfiguration(const QJsonObject &configuration)
 {
-    if (configuration.contains(config::key_wireguard_config_data)) {
-        if (!m_configFile.open(QIODevice::WriteOnly | QIODevice::Truncate)) {
-            qCritical() << "Failed to save wireguard config to" << m_configFile.fileName();
-            return;
-        }
+    QJsonObject jConfig = configuration.value(ProtocolProps::key_proto_config_data(Protocol::WireGuard)).toObject();

-        m_isConfigLoaded = true;
-
-        m_configFile.write(configuration.value(config::key_wireguard_config_data).toString().toUtf8());
-        m_configFile.close();
-        m_configFileName = m_configFile.fileName();
-
-        qDebug().noquote() << QString("Set config data") << m_configFileName;
-        qDebug().noquote() << QString("Set config data") << configuration.value(config::key_wireguard_config_data).toString().toUtf8();
+    if (!m_configFile.open(QIODevice::WriteOnly | QIODevice::Truncate)) {
+        qCritical() << "Failed to save wireguard config to" << m_configFile.fileName();
+        return;
    }
-//    else if (configuration.contains(config::key_wireguard_config_path)) {
-//        m_configFileName = configuration.value(config::key_wireguard_config_path).toString();
-//        QFileInfo file(m_configFileName);

-//        if (file.fileName().isEmpty()) {
-//            m_configFileName = defaultConfigFileName();
-//        }
+    m_isConfigLoaded = true;
+
+    m_configFile.write(jConfig.value(config_key::config).toString().toUtf8());
+    m_configFile.close();
+    m_configFileName = m_configFile.fileName();
+
+    qDebug().noquote() << QString("Set config data") << m_configFileName;
+    qDebug().noquote() << QString("Set config data") << configuration.value(ProtocolProps::key_proto_config_data(Protocol::WireGuard)).toString().toUtf8();

-//        qDebug().noquote() << QString("Set config file: '%1'").arg(configPath());
-//    }
 }

 //bool WireguardProtocol::openVpnProcessIsRunning() const
--- a/client/resources.qrc
+++ b/client/resources.qrc
@ -122,5 +122,9 @@
        <file>server_scripts/sftp/run_container.sh</file>
        <file>ui/qml/Pages/Protocols/PageProtoSftp.qml</file>
        <file>ui/qml/Pages/Protocols/PageProtoTorWebSite.qml</file>
+        <file>server_scripts/ipsec/configure_container.sh</file>
+        <file>server_scripts/ipsec/Dockerfile</file>
+        <file>server_scripts/ipsec/run_container.sh</file>
+        <file>server_scripts/ipsec/start.sh</file>
    </qresource>
 </RCC>
--- a/client/server_scripts/ipsec/Dockerfile
+++ b/client/server_scripts/ipsec/Dockerfile
@ -0,0 +1,4 @@
+FROM amneziavpn/ipsec-server:latest
+
+RUN mkdir -p /opt/amnezia
+LABEL maintainer="AmneziaVPN"
--- a/client/server_scripts/ipsec/configure_container.sh
+++ b/client/server_scripts/ipsec/configure_container.sh
@ -0,0 +1,257 @@
+#!/bin/bash
+
+export PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+
+if [ ! -e /dev/ppp ]; then
+cat <<'EOF'
+
+Warning: /dev/ppp is missing, and IPsec/L2TP mode may not work. Please use
+         IKEv2 (https://git.io/ikev2docker) or IPsec/XAuth mode to connect.
+EOF
+fi
+
+NET_IFACE=$(route 2>/dev/null | grep -m 1 '^default' | grep -o '[^ ]*$')
+[ -z "$NET_IFACE" ] && NET_IFACE=$(ip -4 route list 0/0 2>/dev/null | grep -m 1 -Po '(?<=dev )(\S+)')
+[ -z "$NET_IFACE" ] && NET_IFACE=eth0
+
+
+mkdir -p /opt/src
+mkdir -p /opt/amnezia/ikev2/clients
+
+
+# Create IPsec config
+cat > /etc/ipsec.conf <<EOF
+version 2.0
+
+config setup
+  virtual-private=%v4:10.0.0.0/8,%v4:192.168.0.0/16,%v4:172.16.0.0/12,%v4:!$IPSEC_VPN_L2TP_NET,%v4:!$IPSEC_VPN_XAUTH_NET
+  uniqueids=no
+
+conn shared
+  left=%defaultroute
+  leftid=$SERVER_IP_ADDRESS
+  right=%any
+  encapsulation=yes
+  authby=secret
+  pfs=no
+  rekey=no
+  keyingtries=5
+  dpddelay=30
+  dpdtimeout=120
+  dpdaction=clear
+  ikev2=never
+  ike=aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1,aes256-sha2;modp1024,aes128-sha1;modp1024
+  phase2alg=aes_gcm-null,aes128-sha1,aes256-sha1,aes256-sha2_512,aes128-sha2,aes256-sha2
+  ikelifetime=24h
+  salifetime=24h
+  sha2-truncbug=$IPSEC_VPN_SHA2_TRUNCBUG
+
+EOF
+
+if [ "$IPSEC_VPN_DISABLE_L2TP" != "yes" ]; then
+cat >> /etc/ipsec.conf <<'EOF'
+conn l2tp-psk
+  auto=add
+  leftprotoport=17/1701
+  rightprotoport=17/%any
+  type=transport
+  also=shared
+
+EOF
+fi
+
+if [ "$IPSEC_VPN_DISABLE_XAUTH" != "yes" ]; then
+cat >> /etc/ipsec.conf <<EOF
+conn xauth-psk
+  auto=add
+  leftsubnet=0.0.0.0/0
+  rightaddresspool=$IPSEC_VPN_XAUTH_POOL
+  modecfgdns=$PRIMARY_DNS,$SECONDARY_DNS
+  leftxauthserver=yes
+  rightxauthclient=yes
+  leftmodecfgserver=yes
+  rightmodecfgclient=yes
+  modecfgpull=yes
+  cisco-unity=yes
+  also=shared
+
+EOF
+fi
+
+cat >> /etc/ipsec.conf <<'EOF'
+include /etc/ipsec.d/*.conf
+EOF
+
+if uname -r | grep -qi 'coreos'; then
+  sed -i '/phase2alg/s/,aes256-sha2_512//' /etc/ipsec.conf
+fi
+
+if grep -qs ike-frag /etc/ipsec.d/ikev2.conf; then
+  sed -i 's/^[[:space:]]\+ike-frag=/  fragmentation=/' /etc/ipsec.d/ikev2.conf
+fi
+
+
+# Create xl2tpd config
+cat > /etc/xl2tpd/xl2tpd.conf <<EOF
+[global]
+port = 1701
+
+[lns default]
+ip range = $IPSEC_VPN_L2TP_POOL
+local ip = $IPSEC_VPN_L2TP_LOCAL
+require chap = yes
+refuse pap = yes
+require authentication = yes
+name = l2tpd
+pppoptfile = /etc/ppp/options.xl2tpd
+length bit = yes
+EOF
+
+# Set xl2tpd options
+cat > /etc/ppp/options.xl2tpd <<EOF
+mschap-v2
+ipcp-accept-local
+ipcp-accept-remote
+noccp
+auth
+mtu 1280
+mru 1280
+proxyarp
+lcp-echo-failure 4
+lcp-echo-interval 30
+connect-delay 5000
+ms-dns $PRIMARY_DNS
+ms-dns $SECONDARY_DNS
+EOF
+
+
+# Update sysctl settings
+syt='/sbin/sysctl -e -q -w'
+$syt kernel.msgmnb=65536 2>/dev/null
+$syt kernel.msgmax=65536 2>/dev/null
+$syt net.ipv4.ip_forward=1 2>/dev/null
+$syt net.ipv4.conf.all.accept_redirects=0 2>/dev/null
+$syt net.ipv4.conf.all.send_redirects=0 2>/dev/null
+$syt net.ipv4.conf.all.rp_filter=0 2>/dev/null
+$syt net.ipv4.conf.default.accept_redirects=0 2>/dev/null
+$syt net.ipv4.conf.default.send_redirects=0 2>/dev/null
+$syt net.ipv4.conf.default.rp_filter=0 2>/dev/null
+$syt "net.ipv4.conf.$NET_IFACE.send_redirects=0" 2>/dev/null
+$syt "net.ipv4.conf.$NET_IFACE.rp_filter=0" 2>/dev/null
+
+# Create IPTables rules
+ipi='iptables -I INPUT'
+ipf='iptables -I FORWARD'
+ipp='iptables -t nat -I POSTROUTING'
+res='RELATED,ESTABLISHED'
+if ! iptables -t nat -C POSTROUTING -s "$IPSEC_VPN_L2TP_NET" -o "$NET_IFACE" -j MASQUERADE 2>/dev/null; then
+  $ipi 1 -p udp --dport 1701 -m policy --dir in --pol none -j DROP
+  $ipi 2 -m conntrack --ctstate INVALID -j DROP
+  $ipi 3 -m conntrack --ctstate "$res" -j ACCEPT
+  $ipi 4 -p udp -m multiport --dports 500,4500 -j ACCEPT
+  $ipi 5 -p udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT
+  $ipi 6 -p udp --dport 1701 -j DROP
+  $ipf 1 -m conntrack --ctstate INVALID -j DROP
+  $ipf 2 -i "$NET_IFACE" -o ppp+ -m conntrack --ctstate "$res" -j ACCEPT
+  $ipf 3 -i ppp+ -o "$NET_IFACE" -j ACCEPT
+  $ipf 4 -i ppp+ -o ppp+ -j ACCEPT
+  $ipf 5 -i "$NET_IFACE" -d "$IPSEC_VPN_XAUTH_NET" -m conntrack --ctstate "$res" -j ACCEPT
+  $ipf 6 -s "$IPSEC_VPN_XAUTH_NET" -o "$NET_IFACE" -j ACCEPT
+  $ipf 7 -s "$IPSEC_VPN_XAUTH_NET" -o ppp+ -j ACCEPT
+
+  if [ "$IPSEC_VPN_VPN_ANDROID_MTU_FIX" = "yes" ]; then
+  # Client-to-client traffic is allowed by default. To *disallow* such traffic,
+  # uncomment below and restart the Docker container.
+   $ipf 2 -i ppp+ -o ppp+ -s "$IPSEC_VPN_L2TP_NET" -d "$IPSEC_VPN_L2TP_NET" -j DROP
+   $ipf 3 -s "$IPSEC_VPN_XAUTH_NET" -d "$IPSEC_VPN_XAUTH_NET" -j DROP
+   $ipf 4 -i ppp+ -d "$IPSEC_VPN_XAUTH_NET" -j DROP
+   $ipf 5 -s "$IPSEC_VPN_XAUTH_NET" -o ppp+ -j DROP
+  fi
+
+  iptables -A FORWARD -j DROP
+  $ipp -s "$IPSEC_VPN_XAUTH_NET" -o "$NET_IFACE" -m policy --dir out --pol none -j MASQUERADE
+  $ipp -s "$IPSEC_VPN_L2TP_NET" -o "$NET_IFACE" -j MASQUERADE
+fi
+
+
+if [ "$IPSEC_VPN_VPN_ANDROID_MTU_FIX" = "yes" ]; then
+    echo "Applying fix for Android MTU/MSS issues..."
+    iptables -t mangle -A FORWARD -m policy --pol ipsec --dir in \
+      -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 \
+      -j TCPMSS --set-mss 1360
+    iptables -t mangle -A FORWARD -m policy --pol ipsec --dir out \
+      -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1361:1536 \
+      -j TCPMSS --set-mss 1360
+
+fi
+
+# Update file attributes
+touch /etc/ipsec.secrets /etc/ppp/chap-secrets /etc/ipsec.d/passwd
+chmod 600 /etc/ipsec.secrets /etc/ppp/chap-secrets /etc/ipsec.d/passwd
+
+
+echo
+echo "Starting IPsec service..."
+mkdir -p /run/pluto /var/run/pluto
+rm -f /run/pluto/pluto.pid /var/run/pluto/pluto.pid
+
+ipsec initnss >/dev/null
+ipsec pluto --config /etc/ipsec.conf
+
+
+# Start xl2tpd
+mkdir -p /var/run/xl2tpd
+rm -f /var/run/xl2tpd.pid
+/usr/sbin/xl2tpd -c /etc/xl2tpd/xl2tpd.conf
+
+
+################# IKEV2 ##################
+if [ "$IPSEC_VPN_DISABLE_IKEV2" != "yes" ]; then
+printf "y\n\nN\n" | certutil -z <(head -c 1024 /dev/urandom) \
+  -S -x -n "IKEv2 VPN CA" \
+  -s "O=IKEv2 VPN,CN=IKEv2 VPN CA" \
+  -k rsa -g 3072 -v 120 \
+  -d sql:/etc/ipsec.d -t "CT,," -2
+
+certutil -z <(head -c 1024 /dev/urandom) \
+   -S -c "IKEv2 VPN CA" -n "$SERVER_IP_ADDRESS" \
+   -s "O=IKEv2 VPN,CN=$SERVER_IP_ADDRESS" \
+   -k rsa -g 3072 -v 120 \
+   -d sql:/etc/ipsec.d -t ",," \
+   --keyUsage digitalSignature,keyEncipherment \
+   --extKeyUsage serverAuth \
+   --extSAN "ip:$SERVER_IP_ADDRESS,dns:$SERVER_IP_ADDRESS"
+
+cat > /etc/ipsec.d/ikev2.conf <<EOF
+conn ikev2-cp
+  left=%defaultroute
+  leftcert=$SERVER_IP_ADDRESS
+  leftid=$SERVER_IP_ADDRESS
+  leftsendcert=always
+  leftsubnet=0.0.0.0/0
+  leftrsasigkey=%cert
+  right=%any
+  rightid=%fromcert
+  rightaddresspool=192.168.43.10-192.168.43.250
+  rightca=%same
+  rightrsasigkey=%cert
+  narrowing=yes
+  dpddelay=30
+  dpdtimeout=120
+  dpdaction=clear
+  auto=add
+  ikev2=insist
+  rekey=no
+  pfs=no
+  ike=aes256-sha2,aes128-sha2,aes256-sha1,aes128-sha1
+  phase2alg=aes_gcm-null,aes128-sha1,aes256-sha1,aes128-sha2,aes256-sha2
+  ikelifetime=24h
+  salifetime=24h
+  encapsulation=yes
+  modecfgdns=$PRIMARY_DNS,$SECONDARY_DNS
+EOF
+
+ ipsec auto --add ikev2-cp
+else
+ ipsec auto --delete ikev2-cp
+fi # if [ "$IPSEC_VPN_DISABLE_IKEV2" != "yes" ]
--- a/client/server_scripts/ipsec/run_container.sh
+++ b/client/server_scripts/ipsec/run_container.sh
@ -0,0 +1,7 @@
+sudo docker run \
+    --restart=always \
+    -p 500:500/udp \
+    -p 4500:4500/udp \
+    -d --privileged \
+    --name $CONTAINER_NAME $CONTAINER_NAME
+
--- a/client/server_scripts/ipsec/start.sh
+++ b/client/server_scripts/ipsec/start.sh
--- a/client/server_scripts/openvpn/configure_container.sh
+++ b/client/server_scripts/openvpn/configure_container.sh
@ -1,27 +1,26 @@
-sudo docker exec -i $CONTAINER_NAME bash -c '\
-echo -e "\
-port $OPENVPN_PORT \\n\
-proto $OPENVPN_TRANSPORT_PROTO \\n\
-dev tun \\n\
-ca /opt/amnezia/openvpn/ca.crt \\n\
-cert /opt/amnezia/openvpn/AmneziaReq.crt \\n\
-key /opt/amnezia/openvpn/AmneziaReq.key \\n\
-dh /opt/amnezia/openvpn/dh.pem \\n\
-server $OPENVPN_SUBNET_IP $OPENVPN_SUBNET_MASK \\n\
-ifconfig-pool-persist ipp.txt \\n\
-duplicate-cn \\n\
-keepalive 10 120 \\n\
-$OPENVPN_NCP_DISABLE \\n\
-cipher $OPENVPN_CIPHER \\n\
-data-ciphers $OPENVPN_CIPHER \\n\
-auth $OPENVPN_HASH \\n\
-user nobody \\n\
-group nobody \\n\
-persist-key \\n\
-persist-tun \\n\
-status openvpn-status.log \\n\
-verb 1 \\n\
-tls-server \\n\
-tls-version-min 1.2 \\n\
-$OPENVPN_TLS_AUTH" >/opt/amnezia/openvpn/server.conf'
-
+cat > /opt/amnezia/openvpn/server.conf <<EOF
+port $OPENVPN_PORT
+proto $OPENVPN_TRANSPORT_PROTO
+dev tun
+ca /opt/amnezia/openvpn/ca.crt
+cert /opt/amnezia/openvpn/AmneziaReq.crt
+key /opt/amnezia/openvpn/AmneziaReq.key
+dh /opt/amnezia/openvpn/dh.pem
+server $OPENVPN_SUBNET_IP $OPENVPN_SUBNET_MASK
+ifconfig-pool-persist ipp.txt
+duplicate-cn
+keepalive 10 120
+$OPENVPN_NCP_DISABLE
+cipher $OPENVPN_CIPHER
+data-ciphers $OPENVPN_CIPHER
+auth $OPENVPN_HASH
+user nobody
+group nobody
+persist-key
+persist-tun
+status openvpn-status.log
+verb 1
+tls-server
+tls-version-min 1.2
+$OPENVPN_TLS_AUTH
+EOF
--- a/client/server_scripts/openvpn_cloak/configure_container.sh
+++ b/client/server_scripts/openvpn_cloak/configure_container.sh
@ -1,71 +1,75 @@
-sudo docker exec -i $CONTAINER_NAME bash -c '\
-echo -e "\
-port $OPENVPN_PORT \\n\
-proto $OPENVPN_TRANSPORT_PROTO \\n\
-dev tun \\n\
-ca /opt/amnezia/openvpn/ca.crt \\n\
-cert /opt/amnezia/openvpn/AmneziaReq.crt \\n\
-key /opt/amnezia/openvpn/AmneziaReq.key \\n\
-dh /opt/amnezia/openvpn/dh.pem \\n\
-server $OPENVPN_SUBNET_IP $OPENVPN_SUBNET_MASK \\n\
-ifconfig-pool-persist ipp.txt \\n\
-duplicate-cn \\n\
-keepalive 10 120 \\n\
-$OPENVPN_NCP_DISABLE \\n\
-cipher $OPENVPN_CIPHER \\n\
-data-ciphers $OPENVPN_CIPHER \\n\
-auth $OPENVPN_HASH \\n\
-user nobody \\n\
-group nobody \\n\
-persist-key \\n\
-persist-tun \\n\
-status openvpn-status.log \\n\
-verb 1 \\n\
-tls-server \\n\
-tls-version-min 1.2 \\n\
-$OPENVPN_TLS_AUTH" >/opt/amnezia/openvpn/server.conf'
+cat > /opt/amnezia/openvpn/server.conf <<EOF
+port $OPENVPN_PORT
+proto $OPENVPN_TRANSPORT_PROTO
+dev tun
+ca /opt/amnezia/openvpn/ca.crt
+cert /opt/amnezia/openvpn/AmneziaReq.crt
+key /opt/amnezia/openvpn/AmneziaReq.key
+dh /opt/amnezia/openvpn/dh.pem
+server $OPENVPN_SUBNET_IP $OPENVPN_SUBNET_MASK
+ifconfig-pool-persist ipp.txt
+duplicate-cn
+keepalive 10 120
+$OPENVPN_NCP_DISABLE
+cipher $OPENVPN_CIPHER
+data-ciphers $OPENVPN_CIPHER
+auth $OPENVPN_HASH
+user nobody
+group nobody
+persist-key
+persist-tun
+status openvpn-status.log
+verb 1
+tls-server
+tls-version-min 1.2
+$OPENVPN_TLS_AUTH
+EOF

 # Cloak config
-sudo docker exec -i $CONTAINER_NAME bash -c '\
-mkdir -p /opt/amnezia/cloak; \
-cd /opt/amnezia/cloak || exit 1; \
-CLOAK_ADMIN_UID=$(ck-server -u) && echo $CLOAK_ADMIN_UID > /opt/amnezia/cloak/cloak_admin_uid.key; \
-CLOAK_BYPASS_UID=$(ck-server -u) && echo $CLOAK_BYPASS_UID > /opt/amnezia/cloak/cloak_bypass_uid.key; \
-IFS=, read CLOAK_PUBLIC_KEY CLOAK_PRIVATE_KEY <<<$(ck-server -k); \
-echo $CLOAK_PUBLIC_KEY > /opt/amnezia/cloak/cloak_public.key; \
-echo $CLOAK_PRIVATE_KEY > /opt/amnezia/cloak/cloak_private.key; \
-echo -e "{\\n\
-  \"ProxyBook\": {\\n\
-     \"openvpn\": [\\n\
-     \"$OPENVPN_TRANSPORT_PROTO\",\\n\
-     \"localhost:$OPENVPN_PORT\"\\n\
-    ],\\n\
-     \"shadowsocks\": [\\n\
-     \"tcp\",\\n\
-     \"localhost:$SHADOWSOCKS_SERVER_PORT\"\\n\
-   ]\\n\
-  },\\n\
-  \"BypassUID\": [\\n\
-    \"$CLOAK_BYPASS_UID\"\\n\
-  ],\\n\
-  \"BindAddr\":[\":443\"],\\n\
-  \"RedirAddr\": \"$FAKE_WEB_SITE_ADDRESS\",\\n\
-  \"PrivateKey\": \"$CLOAK_PRIVATE_KEY\",\\n\
-  \"AdminUID\": \"$CLOAK_ADMIN_UID\",\\n\
-  \"DatabasePath\": \"userinfo.db\",\\n\
-  \"StreamTimeout\": 300\\n\
-}" >/opt/amnezia/cloak/ck-config.json'
+mkdir -p /opt/amnezia/cloak
+cd /opt/amnezia/cloak || exit 1
+CLOAK_ADMIN_UID=$(ck-server -u) && echo $CLOAK_ADMIN_UID > /opt/amnezia/cloak/cloak_admin_uid.key
+CLOAK_BYPASS_UID=$(ck-server -u) && echo $CLOAK_BYPASS_UID > /opt/amnezia/cloak/cloak_bypass_uid.key
+IFS=, read CLOAK_PUBLIC_KEY CLOAK_PRIVATE_KEY <<<$(ck-server -k)
+echo $CLOAK_PUBLIC_KEY > /opt/amnezia/cloak/cloak_public.key
+echo $CLOAK_PRIVATE_KEY > /opt/amnezia/cloak/cloak_private.key
+
+cat > /opt/amnezia/cloak/ck-config.json <<EOF
+{
+  "ProxyBook": {
+     "openvpn": [
+     "$OPENVPN_TRANSPORT_PROTO",
+     "localhost:$OPENVPN_PORT"
+    ],
+     "shadowsocks": [
+     "tcp",
+     "localhost:$SHADOWSOCKS_SERVER_PORT"
+   ]
+  },
+  "BypassUID": [
+    "$CLOAK_BYPASS_UID"
+  ],
+  "BindAddr":[":443"],
+  "RedirAddr": "$FAKE_WEB_SITE_ADDRESS",
+  "PrivateKey": "$CLOAK_PRIVATE_KEY",
+  "AdminUID": "$CLOAK_ADMIN_UID",
+  "DatabasePath": "userinfo.db",
+  "StreamTimeout": 300
+}
+EOF

 # ShadowSocks config
-sudo docker exec -i $CONTAINER_NAME bash -c '\
 mkdir -p /opt/amnezia/shadowsocks; \
 cd /opt/amnezia/shadowsocks || exit 1; \
-SHADOWSOCKS_PASSWORD=$(openssl rand -base64 32 | tr "=" "A" | tr "+" "A" | tr "/" "A") && echo $SHADOWSOCKS_PASSWORD > /opt/amnezia/shadowsocks/shadowsocks.key; \
-echo -e "{\\n\
-    \"local_port\": 8585,\\n\
-    \"method\": \"$SHADOWSOCKS_CIPHER\",\\n\
-    \"password\": \"$SHADOWSOCKS_PASSWORD\",\\n\
-    \"server\": \"0.0.0.0\",\\n\
-    \"server_port\": $SHADOWSOCKS_SERVER_PORT,\\n\
-    \"timeout\": 60\\n\
-}" >/opt/amnezia/shadowsocks/ss-config.json'
+SHADOWSOCKS_PASSWORD=$(openssl rand -base64 32 | tr "=" "A" | tr "+" "A" | tr "/" "A")
+echo $SHADOWSOCKS_PASSWORD > /opt/amnezia/shadowsocks/shadowsocks.key
+cat > /opt/amnezia/shadowsocks/ss-config.json <<EOF
+{
+    "local_port": 8585,
+    "method": "$SHADOWSOCKS_CIPHER",
+    "password": "$SHADOWSOCKS_PASSWORD",
+    "server": "0.0.0.0",
+    "server_port": $SHADOWSOCKS_SERVER_PORT,
+    "timeout": 60
+}
+EOF
--- a/client/server_scripts/openvpn_shadowsocks/configure_container.sh
+++ b/client/server_scripts/openvpn_shadowsocks/configure_container.sh
@ -1,40 +1,43 @@
-sudo docker exec -i $CONTAINER_NAME bash -c '\
-echo -e "\
-port $OPENVPN_PORT \\n\
-proto tcp \\n\
-dev tun \\n\
-ca /opt/amnezia/openvpn/ca.crt \\n\
-cert /opt/amnezia/openvpn/AmneziaReq.crt \\n\
-key /opt/amnezia/openvpn/AmneziaReq.key \\n\
-dh /opt/amnezia/openvpn/dh.pem \\n\
-server $OPENVPN_SUBNET_IP $OPENVPN_SUBNET_MASK \\n\
-ifconfig-pool-persist ipp.txt \\n\
-duplicate-cn \\n\
-keepalive 10 120 \\n\
-$OPENVPN_NCP_DISABLE \\n\
-cipher $OPENVPN_CIPHER \\n\
-data-ciphers $OPENVPN_CIPHER \\n\
-auth $OPENVPN_HASH \\n\
-user nobody \\n\
-group nobody \\n\
-persist-key \\n\
-persist-tun \\n\
-status openvpn-status.log \\n\
-verb 1 \\n\
-tls-server \\n\
-tls-version-min 1.2 \\n\
-$OPENVPN_TLS_AUTH" >/opt/amnezia/openvpn/server.conf'
+cat > /opt/amnezia/openvpn/server.conf <<EOF
+port $OPENVPN_PORT
+proto tcp
+dev tun
+ca /opt/amnezia/openvpn/ca.crt
+cert /opt/amnezia/openvpn/AmneziaReq.crt
+key /opt/amnezia/openvpn/AmneziaReq.key
+dh /opt/amnezia/openvpn/dh.pem
+server $OPENVPN_SUBNET_IP $OPENVPN_SUBNET_MASK
+ifconfig-pool-persist ipp.txt
+duplicate-cn
+keepalive 10 120
+$OPENVPN_NCP_DISABLE
+cipher $OPENVPN_CIPHER
+data-ciphers $OPENVPN_CIPHER
+auth $OPENVPN_HASH
+user nobody
+group nobody
+persist-key
+persist-tun
+status openvpn-status.log
+verb 1
+tls-server
+tls-version-min 1.2
+$OPENVPN_TLS_AUTH
+EOF

 # ShadowSocks config
-sudo docker exec -i $CONTAINER_NAME bash -c '\
-mkdir -p /opt/amnezia/shadowsocks; \
-cd /opt/amnezia/shadowsocks || exit 1; \
-SHADOWSOCKS_PASSWORD=$(openssl rand -base64 32 | tr "=" "A" | tr "+" "A" | tr "/" "A") && echo $SHADOWSOCKS_PASSWORD > /opt/amnezia/shadowsocks/shadowsocks.key; \
-echo -e "{\\n\
-    \"local_port\": 8585,\\n\
-    \"method\": \"$SHADOWSOCKS_CIPHER\",\\n\
-    \"password\": \"$SHADOWSOCKS_PASSWORD\",\\n\
-    \"server\": \"0.0.0.0\",\\n\
-    \"server_port\": $SHADOWSOCKS_SERVER_PORT,\\n\
-    \"timeout\": 60\\n\
-}" >/opt/amnezia/shadowsocks/ss-config.json'
+mkdir -p /opt/amnezia/shadowsocks
+cd /opt/amnezia/shadowsocks
+SHADOWSOCKS_PASSWORD=$(openssl rand -base64 32 | tr "=" "A" | tr "+" "A" | tr "/" "A")
+echo $SHADOWSOCKS_PASSWORD > /opt/amnezia/shadowsocks/shadowsocks.key
+
+cat > /opt/amnezia/shadowsocks/ss-config.json <<EOF
+{
+    "local_port": 8585,
+    "method": "$SHADOWSOCKS_CIPHER",
+    "password": "$SHADOWSOCKS_PASSWORD",
+    "server": "0.0.0.0",
+    "server_port": $SHADOWSOCKS_SERVER_PORT,
+    "timeout": 60
+}
+EOF
--- a/client/server_scripts/website_tor/configure_container.sh
+++ b/client/server_scripts/website_tor/configure_container.sh
@ -1,2 +1,3 @@
 sleep 5
-sudo docker exec -i amnezia-tor onions
+# get onions list
+onions
--- a/client/server_scripts/wireguard/configure_container.sh
+++ b/client/server_scripts/wireguard/configure_container.sh
@ -1,13 +1,17 @@
-# Wireguard config
-sudo docker exec -i $CONTAINER_NAME bash -c '\
-mkdir -p /opt/amnezia/wireguard; \
-cd /opt/amnezia/wireguard || exit 1; \
-WIREGUARD_SERVER_PRIVATE_KEY=$(wg genkey) && echo $WIREGUARD_SERVER_PRIVATE_KEY > /opt/amnezia/wireguard/wireguard_server_private_key.key; \
-WIREGUARD_SERVER_PUBLIC_KEY=$(echo $WIREGUARD_SERVER_PRIVATE_KEY | wg pubkey) && echo $WIREGUARD_SERVER_PUBLIC_KEY > /opt/amnezia/wireguard/wireguard_server_public_key.key; \
-WIREGUARD_PSK=$(wg genpsk) && echo $WIREGUARD_PSK > /opt/amnezia/wireguard/wireguard_psk.key; \
-echo -e "\
-[Interface]\\n\
-PrivateKey = $WIREGUARD_SERVER_PRIVATE_KEY \\n\
-Address = $WIREGUARD_SUBNET_IP/$WIREGUARD_SUBNET_CIDR \\n\
-ListenPort = $WIREGUARD_SERVER_PORT \\n\
-" >/opt/amnezia/wireguard/wg0.conf'
+mkdir -p /opt/amnezia/wireguard
+cd /opt/amnezia/wireguard
+WIREGUARD_SERVER_PRIVATE_KEY=$(wg genkey)
+echo $WIREGUARD_SERVER_PRIVATE_KEY > /opt/amnezia/wireguard/wireguard_server_private_key.key
+
+WIREGUARD_SERVER_PUBLIC_KEY=$(echo $WIREGUARD_SERVER_PRIVATE_KEY | wg pubkey)
+echo $WIREGUARD_SERVER_PUBLIC_KEY > /opt/amnezia/wireguard/wireguard_server_public_key.key
+
+WIREGUARD_PSK=$(wg genpsk)
+echo $WIREGUARD_PSK > /opt/amnezia/wireguard/wireguard_psk.key
+
+cat > /opt/amnezia/wireguard/wg0.conf <<EOF
+[Interface]
+PrivateKey = $WIREGUARD_SERVER_PRIVATE_KEY
+Address = $WIREGUARD_SUBNET_IP/$WIREGUARD_SUBNET_CIDR
+ListenPort = $WIREGUARD_SERVER_PORT
+EOF
--- a/client/server_scripts/wireguard/template.conf
+++ b/client/server_scripts/wireguard/template.conf
@ -1,6 +1,6 @@
 [Interface]
 Address = 10.8.1.2/32
-DNS = 1.1.1.1, 1.0.0.1
+DNS = $PRIMARY_DNS, $SECONDARY_DNS
 PrivateKey = $WIREGUARD_CLIENT_PRIVATE_KEY

 [Peer]
--- a/client/settings.cpp
+++ b/client/settings.cpp
@ -167,8 +167,9 @@ void Settings::setProtocolConfig(int serverIndex, DockerContainer container, Pro

 void Settings::clearLastConnectionConfig(int serverIndex, DockerContainer container, Protocol proto)
 {
+    // recursively remove
    if (proto == Protocol::Any) {
-        for (Protocol p: { Protocol::OpenVpn, Protocol::ShadowSocks, Protocol::Cloak, Protocol::WireGuard}) {
+        for (Protocol p: ContainerProps::protocolsForContainer(container)) {
            clearLastConnectionConfig(serverIndex, container, p);
        }
        return;
--- a/client/ui/mainwindow.ui
+++ b/client/ui/mainwindow.ui
--- a/client/ui/pages_logic/VpnLogic.cpp
+++ b/client/ui/pages_logic/VpnLogic.cpp
@ -1,37 +1,3 @@
-//#include <QApplication>
-//#include <QClipboard>
-//#include <QDebug>
-//#include <QDesktopServices>
-//#include <QFileDialog>
-//#include <QHBoxLayout>
-//#include <QHostInfo>
-//#include <QItemSelectionModel>
-//#include <QJsonDocument>
-//#include <QJsonObject>
-//#include <QKeyEvent>
-//#include <QMenu>
-//#include <QMessageBox>
-//#include <QMetaEnum>
-//#include <QSysInfo>
-//#include <QThread>
-//#include <QTimer>
-//#include <QRegularExpression>
-//#include <QSaveFile>
-
-//#include "configurators/cloak_configurator.h"
-//#include "configurators/vpn_configurator.h"
-//#include "configurators/openvpn_configurator.h"
-//#include "configurators/shadowsocks_configurator.h"
-//#include "configurators/ssh_configurator.h"
-
-//#include "core/servercontroller.h"
-//#include "core/server_defs.h"
-//#include "core/errorstrings.h"
-
-//#include "containers/containers_defs.h"
-//#include "protocols/shadowsocksvpnprotocol.h"
-
-
 #include "VpnLogic.h"

 #include "core/errorstrings.h"
@ -52,7 +18,6 @@ VpnLogic::VpnLogic(UiLogic *logic, QObject *parent):
    m_labelSpeedReceivedText{tr("0 Mbps")},
    m_labelSpeedSentText{tr("0 Mbps")},
    m_labelStateText{},
-    m_pushButtonConnectEnabled{false},
    m_widgetVpnModeEnabled{false}
 {
    connect(uiLogic()->m_vpnConnection, &VpnConnection::bytesChanged, this, &VpnLogic::onBytesChanged);
@ -107,10 +72,10 @@ void VpnLogic::onBytesChanged(quint64 receivedData, quint64 sentData)

 void VpnLogic::onConnectionStateChanged(VpnProtocol::ConnectionState state)
 {
-    qDebug() << "UiLogic::onConnectionStateChanged" << VpnProtocol::textConnectionState(state);
+    qDebug() << "VpnLogic::onConnectionStateChanged" << VpnProtocol::textConnectionState(state);

-    bool pushButtonConnectEnabled = false;
-    bool radioButtonsModeEnabled = false;
+    bool pbConnectEnabled = false;
+    bool rbModeEnabled = false;
    set_labelStateText(VpnProtocol::textConnectionState(state));

    uiLogic()->setTrayState(state);
@ -119,41 +84,41 @@ void VpnLogic::onConnectionStateChanged(VpnProtocol::ConnectionState state)
    case VpnProtocol::Disconnected:
        onBytesChanged(0,0);
        set_pushButtonConnectChecked(false);
-        pushButtonConnectEnabled = true;
-        radioButtonsModeEnabled = true;
+        pbConnectEnabled = true;
+        rbModeEnabled = true;
        break;
    case VpnProtocol::Preparing:
-        pushButtonConnectEnabled = false;
-        radioButtonsModeEnabled = false;
+        pbConnectEnabled = false;
+        rbModeEnabled = false;
        break;
    case VpnProtocol::Connecting:
-        pushButtonConnectEnabled = false;
-        radioButtonsModeEnabled = false;
+        pbConnectEnabled = false;
+        rbModeEnabled = false;
        break;
    case VpnProtocol::Connected:
-        pushButtonConnectEnabled = true;
-        radioButtonsModeEnabled = false;
+        pbConnectEnabled = true;
+        rbModeEnabled = false;
        break;
    case VpnProtocol::Disconnecting:
-        pushButtonConnectEnabled = false;
-        radioButtonsModeEnabled = false;
+        pbConnectEnabled = false;
+        rbModeEnabled = false;
        break;
    case VpnProtocol::Reconnecting:
-        pushButtonConnectEnabled = true;
-        radioButtonsModeEnabled = false;
+        pbConnectEnabled = true;
+        rbModeEnabled = false;
        break;
    case VpnProtocol::Error:
        set_pushButtonConnectEnabled(false);
-        pushButtonConnectEnabled = true;
-        radioButtonsModeEnabled = true;
+        pbConnectEnabled = true;
+        rbModeEnabled = true;
        break;
    case VpnProtocol::Unknown:
-        pushButtonConnectEnabled = true;
-        radioButtonsModeEnabled = true;
+        pbConnectEnabled = true;
+        rbModeEnabled = true;
    }

-    set_pushButtonConnectEnabled(pushButtonConnectEnabled);
-    set_widgetVpnModeEnabled(radioButtonsModeEnabled);
+    set_pushButtonConnectEnabled(pbConnectEnabled);
+    set_widgetVpnModeEnabled(rbModeEnabled);
 }

 void VpnLogic::onVpnProtocolError(ErrorCode errorCode)
@ -197,11 +162,12 @@ void VpnLogic::onConnectWorker(int serverIndex, const ServerCredentials &credent
 {
    set_labelErrorText("");
    set_pushButtonConnectChecked(true);
+    set_pushButtonConnectEnabled(false);
+
    qApp->processEvents();

    ErrorCode errorCode = uiLogic()->m_vpnConnection->connectToVpn(
-                serverIndex, credentials, container, containerConfig
-                );
+                serverIndex, credentials, container, containerConfig);

    if (errorCode) {
        //ui->pushButton_connect->setChecked(false);
@ -210,7 +176,6 @@ void VpnLogic::onConnectWorker(int serverIndex, const ServerCredentials &credent
        return;
    }

-    set_pushButtonConnectEnabled(false);
 }

 void VpnLogic::onDisconnect()
--- a/client/ui/qml/Pages/PageServerContainers.qml
+++ b/client/ui/qml/Pages/PageServerContainers.qml
@ -332,6 +332,7 @@ PageBase {

                                checked: default_role
                                onClicked: {
+                                    tb_c.currentIndex = -1
                                    ServerContainersLogic.onPushButtonRemoveClicked(proxyContainersModel.mapToSource(index))
                                }

--- a/client/ui/server_widget.ui
+++ b/client/ui/server_widget.ui
@ -1,167 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<ui version="4.0">
- <class>ServerWidget</class>
- <widget class="QWidget" name="ServerWidget">
-  <property name="geometry">
-   <rect>
-    <x>0</x>
-    <y>0</y>
-    <width>325</width>
-    <height>70</height>
-   </rect>
-  </property>
-  <property name="windowTitle">
-   <string>Form</string>
-  </property>
-  <property name="styleSheet">
-   <string notr="true"/>
-  </property>
-  <widget class="QLabel" name="label_description">
-   <property name="geometry">
-    <rect>
-     <x>10</x>
-     <y>10</y>
-     <width>181</width>
-     <height>21</height>
-    </rect>
-   </property>
-   <property name="styleSheet">
-    <string notr="true">QLabel {
-	font-size: 16px;
-
-	font-style: normal;
-	font-weight: bold;
-    color: #181922;
-}</string>
-   </property>
-   <property name="text">
-    <string>Description</string>
-   </property>
-  </widget>
-  <widget class="QLabel" name="label_address">
-   <property name="geometry">
-    <rect>
-     <x>20</x>
-     <y>40</y>
-     <width>141</width>
-     <height>16</height>
-    </rect>
-   </property>
-   <property name="text">
-    <string>Address</string>
-   </property>
-  </widget>
-  <widget class="QPushButton" name="pushButton_default">
-   <property name="geometry">
-    <rect>
-     <x>300</x>
-     <y>25</y>
-     <width>24</width>
-     <height>24</height>
-    </rect>
-   </property>
-   <property name="cursor">
-    <cursorShape>PointingHandCursor</cursorShape>
-   </property>
-   <property name="toolTip">
-    <string>Set as default</string>
-   </property>
-   <property name="styleSheet">
-    <string notr="true">QPushButton:checked {
-	image: url(:/images/check.png);
-}
-QPushButton:!checked {
-	image: url(:/images/uncheck.png);
-}</string>
-   </property>
-   <property name="text">
-    <string/>
-   </property>
-   <property name="checkable">
-    <bool>true</bool>
-   </property>
-  </widget>
-  <widget class="QPushButton" name="pushButton_share">
-   <property name="geometry">
-    <rect>
-     <x>170</x>
-     <y>25</y>
-     <width>24</width>
-     <height>24</height>
-    </rect>
-   </property>
-   <property name="cursor">
-    <cursorShape>PointingHandCursor</cursorShape>
-   </property>
-   <property name="toolTip">
-    <string>Share connection</string>
-   </property>
-   <property name="styleSheet">
-    <string notr="true">image: url(:/images/share.png);</string>
-   </property>
-   <property name="text">
-    <string/>
-   </property>
-   <property name="checkable">
-    <bool>true</bool>
-   </property>
-  </widget>
-  <widget class="QPushButton" name="pushButton_connect">
-   <property name="geometry">
-    <rect>
-     <x>212</x>
-     <y>25</y>
-     <width>32</width>
-     <height>24</height>
-    </rect>
-   </property>
-   <property name="cursor">
-    <cursorShape>PointingHandCursor</cursorShape>
-   </property>
-   <property name="toolTip">
-    <string>Connection</string>
-   </property>
-   <property name="styleSheet">
-    <string notr="true">QPushButton:checked {
-	image: url(:/images/connect_button_connected.png);
-}
-QPushButton:!checked {
-	image: url(:/images/connect_button_disconnected.png);
-}</string>
-   </property>
-   <property name="text">
-    <string/>
-   </property>
-   <property name="checkable">
-    <bool>true</bool>
-   </property>
-  </widget>
-  <widget class="QPushButton" name="pushButton_settings">
-   <property name="geometry">
-    <rect>
-     <x>260</x>
-     <y>25</y>
-     <width>24</width>
-     <height>24</height>
-    </rect>
-   </property>
-   <property name="cursor">
-    <cursorShape>PointingHandCursor</cursorShape>
-   </property>
-   <property name="toolTip">
-    <string>Server settings</string>
-   </property>
-   <property name="styleSheet">
-    <string notr="true">image: url(:/images/settings.png);</string>
-   </property>
-   <property name="text">
-    <string/>
-   </property>
-   <property name="checkable">
-    <bool>true</bool>
-   </property>
-  </widget>
- </widget>
- <resources/>
- <connections/>
-</ui>
--- a/client/ui/uilogic.cpp
+++ b/client/ui/uilogic.cpp
@ -294,10 +294,9 @@ void UiLogic::showOnStartup()
 void UiLogic::keyPressEvent(Qt::Key key)
 {
    switch (key) {
-    case Qt::Key_L:
-        if (!Debug::openLogsFolder()) {
-            //QMessageBox::warning(this, APPLICATION_NAME, tr("Cannot open logs folder!"));
-        }
+    case Qt::Key_L: Debug::openLogsFolder();
+        break;
+    case Qt::Key_K: Debug::openServiceLogsFolder();
        break;
 #ifdef QT_DEBUG
    case Qt::Key_Q:
--- a/client/vpnconnection.cpp
+++ b/client/vpnconnection.cpp
@ -133,10 +133,7 @@ ErrorCode VpnConnection::lastError() const
 QMap<Protocol, QString> VpnConnection::getLastVpnConfig(const QJsonObject &containerConfig)
 {
    QMap<Protocol, QString> configs;
-    for (Protocol proto: { Protocol::OpenVpn,
-         Protocol::ShadowSocks,
-         Protocol::Cloak,
-         Protocol::WireGuard}) {
+    for (Protocol proto: ProtocolProps::allProtocols()) {

        QString cfg = containerConfig.value(ProtocolProps::protoToString(proto)).toObject().value(config_key::last_config).toString();

@ -162,7 +159,7 @@ QString VpnConnection::createVpnConfigurationForProto(int serverIndex,
    else {
        qDebug() << "VpnConnection::createVpnConfiguration: gen new config for" << ProtocolProps::protoToString(proto);
        configData = VpnConfigurator::genVpnProtocolConfig(credentials,
-                                          container, containerConfig, proto, &e);
+            container, containerConfig, proto, &e);

        QString configDataBeforeLocalProcessing = configData;

@ -187,63 +184,37 @@ QString VpnConnection::createVpnConfigurationForProto(int serverIndex,
    return configData;
 }

-ErrorCode VpnConnection::createVpnConfiguration(int serverIndex,
-    const ServerCredentials &credentials, DockerContainer container, const QJsonObject &containerConfig)
+QJsonObject VpnConnection::createVpnConfiguration(int serverIndex,
+    const ServerCredentials &credentials, DockerContainer container,
+    const QJsonObject &containerConfig, ErrorCode *errorCode)
 {
-    ErrorCode errorCode = ErrorCode::NoError;
+    ErrorCode e = ErrorCode::NoError;
+    QJsonObject vpnConfiguration;

-    if (container == DockerContainer::OpenVpn ||
-            container == DockerContainer::ShadowSocks ||
-            container == DockerContainer::Cloak) {

-        QString openVpnConfigData =
+    for (ProtocolEnumNS::Protocol proto : ContainerProps::protocolsForContainer(container)) {
+//        QString vpnConfigData =
+//            createVpnConfigurationForProto(
+//                serverIndex, credentials, container, containerConfig, proto, &e);
+
+        QJsonObject vpnConfigData = QJsonDocument::fromJson(
            createVpnConfigurationForProto(
-                serverIndex, credentials, container, containerConfig, Protocol::OpenVpn, &errorCode);
+                serverIndex, credentials, container, containerConfig, proto, &e).toUtf8()).
+                    object();

-
-        m_vpnConfiguration.insert(config::key_openvpn_config_data, openVpnConfigData);
-        if (errorCode) {
-            return errorCode;
+        if (e) {
+            if (errorCode) *errorCode = e;
+            return {};
        }

-        QFile file(OpenVpnProtocol::defaultConfigFileName());
-        if (file.open(QIODevice::WriteOnly | QIODevice::Truncate)){
-            QTextStream stream(&file);
-            stream << openVpnConfigData << endl;
-            file.close();
-        }
-        else {
-            return ErrorCode::FailedToSaveConfigData;
-        }
+        vpnConfiguration.insert(ProtocolProps::key_proto_config_data(proto), vpnConfigData);
+
    }

-    if (container == DockerContainer::ShadowSocks) {
-        QJsonObject ssConfigData = QJsonDocument::fromJson(
-            createVpnConfigurationForProto(
-                serverIndex, credentials, container, containerConfig, Protocol::ShadowSocks, &errorCode).toUtf8()).
-            object();
+    Protocol proto = ContainerProps::defaultProtocol(container);
+    vpnConfiguration[config_key::protocol] = ProtocolProps::protoToString(proto);

-        m_vpnConfiguration.insert(config::key_shadowsocks_config_data, ssConfigData);
-    }
-
-    if (container == DockerContainer::Cloak) {
-        QJsonObject cloakConfigData = QJsonDocument::fromJson(
-            createVpnConfigurationForProto(
-                serverIndex, credentials, container, containerConfig, Protocol::Cloak, &errorCode).toUtf8()).
-            object();
-
-        m_vpnConfiguration.insert(config::key_cloak_config_data, cloakConfigData);
-    }
-
-    if (container == DockerContainer::WireGuard) {
-        QString wgConfigData = createVpnConfigurationForProto(
-                    serverIndex, credentials, container, containerConfig, Protocol::WireGuard, &errorCode);
-
-        m_vpnConfiguration.insert(config::key_wireguard_config_data, wgConfigData);
-    }
-
-    //qDebug().noquote() << "VPN config" << QJsonDocument(m_vpnConfiguration).toJson();
-    return ErrorCode::NoError;
+    return vpnConfiguration;
 }

 ErrorCode VpnConnection::connectToVpn(int serverIndex,
@ -261,69 +232,30 @@ ErrorCode VpnConnection::connectToVpn(int serverIndex,
        m_vpnProtocol.reset();
    }

-//    if (container == DockerContainer::None || container == DockerContainer::OpenVpn) {
-//        ErrorCode e = createVpnConfiguration(serverIndex, credentials, DockerContainer::OpenVpn, containerConfig);
-//        if (e) {
-//            emit connectionStateChanged(VpnProtocol::Error);
-//            return e;
-//        }

-//        m_vpnProtocol.reset(new OpenVpnProtocol(m_vpnConfiguration));
-//        e = static_cast<OpenVpnProtocol *>(m_vpnProtocol.data())->checkAndSetupTapDriver();
-//        if (e) {
-//            emit connectionStateChanged(VpnProtocol::Error);
-//            return e;
-//        }
-//    }
-//    else if (container == DockerContainer::ShadowSocks) {
-//        ErrorCode e = createVpnConfiguration(serverIndex, credentials, DockerContainer::ShadowSocks, containerConfig);
-//        if (e) {
-//            emit connectionStateChanged(VpnProtocol::Error);
-//            return e;
-//        }
-
-//        m_vpnProtocol.reset(new ShadowSocksVpnProtocol(m_vpnConfiguration));
-//        e = static_cast<OpenVpnProtocol *>(m_vpnProtocol.data())->checkAndSetupTapDriver();
-//        if (e) {
-//            emit connectionStateChanged(VpnProtocol::Error);
-//            return e;
-//        }
-//    }
-//    else if (container == DockerContainer::Cloak) {
-//        ErrorCode e = createVpnConfiguration(serverIndex, credentials, DockerContainer::Cloak, containerConfig);
-//        if (e) {
-//            emit connectionStateChanged(VpnProtocol::Error);
-//            return e;
-//        }
-
-//        m_vpnProtocol.reset(new OpenVpnOverCloakProtocol(m_vpnConfiguration));
-//        e = static_cast<OpenVpnProtocol *>(m_vpnProtocol.data())->checkAndSetupTapDriver();
-//        if (e) {
-//            emit connectionStateChanged(VpnProtocol::Error);
-//            return e;
-//        }
-//    }
-//    else if (container == DockerContainer::WireGuard) {
-//        ErrorCode e = createVpnConfiguration(serverIndex, credentials, DockerContainer::WireGuard, containerConfig);
-//        if (e) {
-//            emit connectionStateChanged(VpnProtocol::Error);
-//            return e;
-//        }
-
-//#ifdef Q_OS_ANDROID
-//        AndroidVpnProtocol *androidVpnProtocol = new AndroidVpnProtocol(Protocol::WireGuard, m_vpnConfiguration);
-//        androidVpnProtocol->initialize();
-//        m_vpnProtocol.reset(androidVpnProtocol);
-//#else
-//        m_vpnProtocol.reset(new WireguardProtocol(m_vpnConfiguration));
-//#endif
-//    }
+    ErrorCode e = ErrorCode::NoError;
+    m_vpnConfiguration = createVpnConfiguration(serverIndex, credentials, container, containerConfig);
+    if (e) {
+        emit connectionStateChanged(VpnProtocol::Error);
+        return e;
+    }


+#ifndef Q_OS_ANDROID

-            AndroidVpnProtocol *androidVpnProtocol = new AndroidVpnProtocol(Protocol::OpenVpn, m_vpnConfiguration);
-            androidVpnProtocol->initialize();
-            m_vpnProtocol.reset(androidVpnProtocol);
+    m_vpnProtocol.reset(VpnProtocol::factory(container, m_vpnConfiguration));
+    if (!m_vpnProtocol) {
+        return ErrorCode::InternalError;
+    }
+
+    m_vpnProtocol->prepare();
+
+
+#else
+    AndroidVpnProtocol *androidVpnProtocol = new AndroidVpnProtocol(Protocol::OpenVpn, m_vpnConfiguration);
+    androidVpnProtocol->initialize();
+    m_vpnProtocol.reset(androidVpnProtocol);
+#endif

    connect(m_vpnProtocol.data(), &VpnProtocol::protocolError, this, &VpnConnection::vpnProtocolError);
    connect(m_vpnProtocol.data(), SIGNAL(connectionStateChanged(VpnProtocol::ConnectionState)), this, SLOT(onConnectionStateChanged(VpnProtocol::ConnectionState)));
--- a/client/vpnconnection.h
+++ b/client/vpnconnection.h
@ -30,8 +30,9 @@ public:
        const ServerCredentials &credentials, DockerContainer container, const QJsonObject &containerConfig, Protocol proto,
        ErrorCode *errorCode = nullptr);

-    ErrorCode createVpnConfiguration(int serverIndex,
-        const ServerCredentials &credentials, DockerContainer container, const QJsonObject &containerConfig);
+    QJsonObject createVpnConfiguration(int serverIndex,
+        const ServerCredentials &credentials, DockerContainer container,
+        const QJsonObject &containerConfig, ErrorCode *errorCode = nullptr);

    ErrorCode connectToVpn(int serverIndex,
        const ServerCredentials &credentials, DockerContainer container, const QJsonObject &containerConfig);
--- a/ipc/ipcserverprocess.cpp
+++ b/ipc/ipcserverprocess.cpp
@ -19,17 +19,17 @@ IpcServerProcess::IpcServerProcess(QObject *parent) :
        qDebug() << "IpcServerProcess errorOccurred " << error;
    });

-    connect(m_process.data(), &QProcess::readyReadStandardError, this, [this](){
-        qDebug() << "IpcServerProcess StandardError " << m_process->readAllStandardError();
+//    connect(m_process.data(), &QProcess::readyReadStandardError, this, [this](){
+//        qDebug() << "IpcServerProcess StandardError " << m_process->readAllStandardError();

-    });
-    connect(m_process.data(), &QProcess::readyReadStandardOutput, this, [this](){
-        qDebug() << "IpcServerProcess StandardOutput " << m_process->readAllStandardOutput();
-    });
+//    });
+//    connect(m_process.data(), &QProcess::readyReadStandardOutput, this, [this](){
+//        qDebug() << "IpcServerProcess StandardOutput " << m_process->readAllStandardOutput();
+//    });

-    connect(m_process.data(), &QProcess::readyRead, this, [this](){
-        qDebug() << "IpcServerProcess StandardOutput " << m_process->readAll();
-    });
+//    connect(m_process.data(), &QProcess::readyRead, this, [this](){
+//        qDebug() << "IpcServerProcess StandardOutput " << m_process->readAll();
+//    });

 }