HWS/OpenVPN-Installer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Better iptables handling

Browse source 
Minor bugfixes for iptables handling
Removed CentOS 6 support
This commit is contained in:
wmtech-1 2018-03-13 19:55:41 +01:00 • committed by GitHub
parent 5dbab9fdbb
commit a7b4bb5dbd
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

30
openvpn-install.sh
View file

@ -15,18 +15,28 @@ if [[ ! -e /dev/net/tun ]]; then
fi fi
if grep -qs "CentOS release 5" "/etc/redhat-release"; then if grep -qs "CentOS release 5" "/etc/redhat-release"; then
echo "CentOS 5 is too old and not supported" echo "CentOS 5 is too old and not supported. Please upgrade to CentOS 7"
exit 3 exit 3
fi fi
if grep -qs "CentOS release 6" "/etc/redhat-release"; then
echo "CentOS 6 is too old and no longer supported. Please upgrade to CentOS 7"
exit 4
fi
if [[ -e /etc/centos-release || -e /etc/redhat-release || -e /etc/system-release ]]; then if [[ -e /etc/centos-release || -e /etc/redhat-release || -e /etc/system-release ]]; then
OS=centos OS=centos
if [[ -e /usr/lib/systemd/system/iptables.service ]]; then
IPTABLES='/etc/sysconfig/iptables'
IP6TABLES='/etc/sysconfig/ip6tables'
else
IPTABLES='/etc/iptables/iptables.rules' IPTABLES='/etc/iptables/iptables.rules'
IP6TABLES='/etc/ip6tables/ip6tables.rules' IP6TABLES='/etc/ip6tables/ip6tables.rules'
fi
SYSCTL='/etc/sysctl.conf' SYSCTL='/etc/sysctl.conf'
else else
echo "Looks like you aren't running this installer on a CentOS or RedHat system" echo "Looks like you aren't running this installer on a CentOS or RedHat system"
exit 4 exit 5
fi fi
newclient () { newclient () {
@ -100,7 +110,7 @@ if [[ -e /etc/openvpn/server.conf ]]; then
if [[ "$NUMBEROFCLIENTS" = '0' ]]; then if [[ "$NUMBEROFCLIENTS" = '0' ]]; then
echo "" echo ""
echo "You have no existing clients!" echo "You have no existing clients!"
exit 5 exit 6
fi fi
echo "" echo ""
echo "Select the existing client certificate you want to revoke" echo "Select the existing client certificate you want to revoke"
@ -149,6 +159,7 @@ if [[ -e /etc/openvpn/server.conf ]]; then
iptables -D INPUT -p tcp --dport $PORT -j ACCEPT iptables -D INPUT -p tcp --dport $PORT -j ACCEPT
fi fi
iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -D INPUT -i tun+ -j ACCEPT
iptables-save > $IPTABLES iptables-save > $IPTABLES
fi fi
iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE
@ -161,6 +172,7 @@ if [[ -e /etc/openvpn/server.conf ]]; then
ip6tables -D INPUT -p tcp --dport $PORT -j ACCEPT ip6tables -D INPUT -p tcp --dport $PORT -j ACCEPT
fi fi
ip6tables -D FORWARD -s fd6c:62d9:eb8c::/112 -j ACCEPT ip6tables -D FORWARD -s fd6c:62d9:eb8c::/112 -j ACCEPT
ip6tables -D INPUT -i tun+ -j ACCEPT
ip6tables-save > $IP6TABLES ip6tables-save > $IP6TABLES
fi fi
ip6tables -t nat -D POSTROUTING -o $NIC6 -s fd6c:62d9:eb8c::/112 -j MASQUERADE ip6tables -t nat -D POSTROUTING -o $NIC6 -s fd6c:62d9:eb8c::/112 -j MASQUERADE
@ -332,9 +344,9 @@ else
yum install epel-release -y yum install epel-release -y
yum install openvpn iptables openssl wget ca-certificates curl -y yum install openvpn iptables openssl wget ca-certificates curl -y
# Install iptables service # Install iptables service
if [[ ! -e /etc/systemd/system/iptables.service ]]; then if [[ ! -e /usr/lib/systemd/system/iptables.service && ! -e /etc/systemd/system/iptables.service ]]; then
mkdir /etc/iptables mkdir /etc/iptables
iptables-save > /etc/iptables/iptables.rules iptables-save > $IPTABLES
echo "#!/bin/sh echo "#!/bin/sh
iptables -F iptables -F
iptables -X iptables -X
@ -367,9 +379,9 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service
fi fi
if [[ "$IPV6E" = '1' ]]; then if [[ "$IPV6E" = '1' ]]; then
# Install ip6tables service # Install ip6tables service
if [[ ! -e /etc/systemd/system/ip6tables.service ]]; then if [[ ! -e /usr/lib/systemd/system/ip6tables.service && ! -e /etc/systemd/system/ip6tables.service ]]; then
mkdir /etc/ip6tables mkdir /etc/ip6tables
ip6tables-save > /etc/ip6tables/ip6tables.rules ip6tables-save > $IP6TABLES
echo "#!/bin/sh echo "#!/bin/sh
ip6tables -F ip6tables -F
ip6tables -X ip6tables -X
@ -531,7 +543,7 @@ $CIPHER
tls-server tls-server
tls-version-min 1.2 tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
status openvpn.log status openvpn-status.log
log-append /var/log/openvpn/openvpn.log log-append /var/log/openvpn/openvpn.log
verb 3 verb 3
mute 3 mute 3
@ -592,6 +604,7 @@ rcvbuf 393216" >> /etc/openvpn/server.conf
fi fi
iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -I INPUT -i tun+ -j ACCEPT
# Save persitent OpenVPN rules # Save persitent OpenVPN rules
iptables-save > $IPTABLES iptables-save > $IPTABLES
fi fi
@ -613,6 +626,7 @@ rcvbuf 393216" >> /etc/openvpn/server.conf
fi fi
ip6tables -I FORWARD -s fd6c:62d9:eb8c::/112 -j ACCEPT ip6tables -I FORWARD -s fd6c:62d9:eb8c::/112 -j ACCEPT
ip6tables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT ip6tables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
ip6tables -I INPUT -i tun+ -j ACCEPT
# Save persitent OpenVPN rules # Save persitent OpenVPN rules
ip6tables-save > $IP6TABLES ip6tables-save > $IP6TABLES
fi fi