HWS/OpenVPN-Installer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Various Updates & Improvements

Browse source 
Updated the script with several improvements and code changes.
This commit is contained in:
wmtech-1 2018-08-23 16:35:43 +02:00 • committed by GitHub
parent 4d92c6f4fc
commit b09a18c38a
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 175 additions and 96 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

229
openvpn-install.sh
View file

@ -4,24 +4,28 @@
# https://github.com/wmtech-1/OpenVPN-install/ # https://github.com/wmtech-1/OpenVPN-install/
# Verify root
if [[ "$EUID" -ne 0 ]]; then if [[ "$EUID" -ne 0 ]]; then
echo "Sorry, you need to run this as root" echo "Sorry, you need to run this as root"
exit 1 exit
fi fi
# Verify tun
if [[ ! -e /dev/net/tun ]]; then if [[ ! -e /dev/net/tun ]]; then
echo "TUN is not available" echo "TUN is not available"
exit 2 exit
fi fi
# Check if CentOS 5
if grep -qs "CentOS release 5" "/etc/redhat-release"; then if grep -qs "CentOS release 5" "/etc/redhat-release"; then
echo "CentOS 5 is too old and not supported. Please upgrade to CentOS 7" echo "CentOS 5 is too old and not supported. Please upgrade to CentOS 7"
exit 3 exit
fi fi
# Check if CentOS 6
if grep -qs "CentOS release 6" "/etc/redhat-release"; then if grep -qs "CentOS release 6" "/etc/redhat-release"; then
echo "CentOS 6 is too old and no longer supported. Please upgrade to CentOS 7" echo "CentOS 6 is too old and no longer supported. Please upgrade to CentOS 7"
exit 4 exit
fi fi
if [[ -e /etc/centos-release || -e /etc/redhat-release || -e /etc/system-release ]]; then if [[ -e /etc/centos-release || -e /etc/redhat-release || -e /etc/system-release ]]; then
@ -33,36 +37,41 @@ if [[ -e /etc/centos-release || -e /etc/redhat-release || -e /etc/system-release
IPTABLES='/etc/iptables/iptables.rules' IPTABLES='/etc/iptables/iptables.rules'
IP6TABLES='/etc/ip6tables/ip6tables.rules' IP6TABLES='/etc/ip6tables/ip6tables.rules'
fi fi
SYSCTL='/etc/sysctl.conf' SYSCTL='/etc/sysctl.d/30-openvpn-forward.conf'
else else
echo "Looks like you aren't running this installer on a CentOS or RedHat system" echo "Looks like you aren't running this installer on a CentOS or RedHat system"
exit 5 exit
fi fi
newclient () { newclient () {
# Where to write the custom client.ovpn? # Where to write the custom client.ovpn?
if [ -e /home/$1 ]; then # if $1 is a user name if [ -e "/home/$1" ]; then # if $1 is a user name
homeDir="/home/$1" homeDir="/home/$1"
elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER elif [ "${SUDO_USER}" ]; then # if not, use SUDO_USER
homeDir="/home/${SUDO_USER}" homeDir="/home/${SUDO_USER}"
else # if not SUDO_USER, use /root else # if not SUDO_USER, use /root
homeDir="/root" homeDir="/root"
fi fi
# Generates the custom client.ovpn # Generates the custom client.ovpn
cp /etc/openvpn/client-template.txt $homeDir/$1.ovpn cp /etc/openvpn/client-template.txt "$homeDir/$1.ovpn"
echo "<ca>" >> $homeDir/$1.ovpn {
cat /etc/openvpn/easy-rsa/pki/ca.crt >> $homeDir/$1.ovpn echo "<ca>"
echo "</ca>" >> $homeDir/$1.ovpn cat "/etc/openvpn/easy-rsa/pki/ca.crt"
echo "<cert>" >> $homeDir/$1.ovpn echo "</ca>"
cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> $homeDir/$1.ovpn
echo "</cert>" >> $homeDir/$1.ovpn echo "<cert>"
echo "<key>" >> $homeDir/$1.ovpn cat "/etc/openvpn/easy-rsa/pki/issued/$1.crt"
cat /etc/openvpn/easy-rsa/pki/private/$1.key >> $homeDir/$1.ovpn echo "</cert>"
echo "</key>" >> $homeDir/$1.ovpn
echo "key-direction 1" >> $homeDir/$1.ovpn echo "<key>"
echo "<tls-auth>" >> $homeDir/$1.ovpn cat "/etc/openvpn/easy-rsa/pki/private/$1.key"
cat /etc/openvpn/tls-auth.key >> $homeDir/$1.ovpn echo "</key>"
echo "</tls-auth>" >> $homeDir/$1.ovpn echo "key-direction 1"
echo "<tls-auth>"
cat "/etc/openvpn/tls-auth.key"
echo "</tls-auth>"
} >> "$homeDir/$1.ovpn"
} }
# Get Internet network interface with default route # Get Internet network interface with default route
@ -78,22 +87,45 @@ if [[ -e /etc/openvpn/server.conf ]]; then
echo "" echo ""
echo "Looks like OpenVPN is already installed" echo "Looks like OpenVPN is already installed"
echo "" echo ""
echo "What do you want to do?" echo "What do you want to do?"
echo " 1) Add a cert for a new user" echo " 1) Add a cert for a new user"
echo " 2) Revoke existing user cert" echo " 2) Revoke existing user cert"
echo " 3) Remove OpenVPN" echo " 3) Remove OpenVPN"
echo " 4) Exit" echo " 4) Exit"
read -p "Select an option [1-4]: " option read -rp "Select an option [1-4]: " option
case $option in case $option in
1) 1)
echo "" echo ""
echo "Do you want to protect the configuration file with a password?"
echo "(e.g. encrypt the private key with a password)"
echo " 1) Add a passwordless client"
echo " 2) Use a password for the client"
until [[ "$pass" =~ ^[1-2]$ ]]; do
read -rp "Select an option [1-2]: " -e -i 1 pass
done
echo ""
echo "Tell me a name for the client cert" echo "Tell me a name for the client cert"
echo "Please, use one word only, no special characters" echo "Use one word only, no special characters"
read -p "Client name: " -e -i newclient CLIENT until [[ "$CLIENT" =~ ^[a-zA-Z0-9_]+$ ]]; do
cd /etc/openvpn/easy-rsa/ read -rp "Client name: " -e CLIENT
done
cd /etc/openvpn/easy-rsa/ || return
case $pass in
1)
./easyrsa build-client-full $CLIENT nopass ./easyrsa build-client-full $CLIENT nopass
;;
2)
echo "⚠️ You will be asked for the client password below ⚠️"
./easyrsa build-client-full $CLIENT
;;
esac
# Generates the custom client.ovpn # Generates the custom client.ovpn
newclient "$CLIENT" newclient "$CLIENT"
echo "" echo ""
echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn"
exit exit
@ -103,18 +135,23 @@ if [[ -e /etc/openvpn/server.conf ]]; then
if [[ "$NUMBEROFCLIENTS" = '0' ]]; then if [[ "$NUMBEROFCLIENTS" = '0' ]]; then
echo "" echo ""
echo "You have no existing clients!" echo "You have no existing clients!"
exit 6 exit
fi fi
echo "" echo ""
echo "Select the existing client certificate you want to revoke" echo "Select the existing client certificate you want to revoke"
tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
if [[ "$NUMBEROFCLIENTS" = '1' ]]; then if [[ "$NUMBEROFCLIENTS" = '1' ]]; then
read -p "Select one client [1]: " CLIENTNUMBER read -rp "Select one client [1]: " CLIENTNUMBER
else else
read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER read -rp "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER
fi fi
CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p)
cd /etc/openvpn/easy-rsa/ echo
read -p "Do you really want to revoke access for client $CLIENT? [y/N]: " -e REVOKE
if [[ "$REVOKE" = 'y' || "$REVOKE" = 'Y' ]]; then
cd /etc/openvpn/easy-rsa/ || return
./easyrsa --batch revoke $CLIENT ./easyrsa --batch revoke $CLIENT
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
rm -f pki/reqs/$CLIENT.req rm -f pki/reqs/$CLIENT.req
@ -125,15 +162,21 @@ if [[ -e /etc/openvpn/server.conf ]]; then
chmod 644 /etc/openvpn/crl.pem chmod 644 /etc/openvpn/crl.pem
rm -f $(find /home -maxdepth 2 | grep $CLIENT.ovpn) 2>/dev/null rm -f $(find /home -maxdepth 2 | grep $CLIENT.ovpn) 2>/dev/null
rm -f /root/$CLIENT.ovpn 2>/dev/null rm -f /root/$CLIENT.ovpn 2>/dev/null
echo "" echo ""
echo "Certificate for client $CLIENT revoked" echo "Certificate for client $CLIENT revoked!"
echo "Exiting..." echo "Exiting..."
else
echo ""
echo "Certificate revocation for client $CLIENT aborted!"
echo "Exiting..."
fi
exit exit
;; ;;
3) 3)
echo "" echo ""
read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE read -rp "Do you really want to remove OpenVPN? [y/n]: " -e REMOVE
if [[ "$REMOVE" = 'y' ]]; then if [[ "$REMOVE" = 'y' || "$REMOVE" = 'Y' ]]; then
PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2)
PROTOCOL=$(grep '^proto ' /etc/openvpn/server.conf | cut -d " " -f 2 | tail -n 1) PROTOCOL=$(grep '^proto ' /etc/openvpn/server.conf | cut -d " " -f 2 | tail -n 1)
IPV6E = "0" IPV6E = "0"
@ -188,6 +231,7 @@ if [[ -e /etc/openvpn/server.conf ]]; then
rm /root/$i.ovpn 2>/dev/null rm /root/$i.ovpn 2>/dev/null
done done
rm -rf /etc/openvpn rm -rf /etc/openvpn
rm -f /etc/sysctl.d/30-openvpn-forward.conf
rm -rf /usr/share/doc/openvpn* rm -rf /usr/share/doc/openvpn*
rm -rf /var/log/openvpn rm -rf /var/log/openvpn
rm -rf /etc/logrotate.d/openvpn rm -rf /etc/logrotate.d/openvpn
@ -206,6 +250,7 @@ else
clear clear
echo "Welcome to the secure OpenVPN installer (github.com/wmtech-1/OpenVPN-Installer)" echo "Welcome to the secure OpenVPN installer (github.com/wmtech-1/OpenVPN-Installer)"
echo "" echo ""
# OpenVPN setup and first user creation # OpenVPN setup and first user creation
echo "I need to ask you a few questions before starting the setup" echo "I need to ask you a few questions before starting the setup"
echo "You can leave the default options and just press enter if you are ok with them" echo "You can leave the default options and just press enter if you are ok with them"
@ -213,23 +258,45 @@ else
echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to."
echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)" echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)"
echo "Otherwise, it should be your public IPv4 address." echo "Otherwise, it should be your public IPv4 address."
# Autodetect IP address and pre-fill for the user # Autodetect IP address and pre-fill for the user
IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
read -p "IP address: " -e -i $IP IP read -rp "IP address: " -e -i $IP IP
echo "" echo ""
echo "What port do you want for OpenVPN?" echo "What port do you want for OpenVPN?"
read -p "Port: " -e -i 1194 PORT echo " 1) Default: 1194"
echo " 2) Custom"
echo " 3) Random [49152-65535]"
until [[ "$PORT_CHOICE" =~ ^[1-3]$ ]]; do
read -rp "Port choice [1-3]: " -e -i 1 PORT_CHOICE
done
case $PORT_CHOICE in
1)
PORT="1194"
;;
2)
until [[ "$PORT" =~ ^[0-9]+$ ]] && [ "$PORT" -ge 1 -a "$PORT" -le 65535 ]; do
read -rp "Custom port [1-65535]: " -e -i 1194 PORT
done
;;
3)
# Generate random number within private ports range
PORT=$(shuf -i49152-65535 -n1)
echo "Random Port: $PORT"
;;
esac
# If $IP is a private IP address, the server must be behind NAT # If $IP is a private IP address, the server must be behind NAT
if echo "$IP" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then if echo "$IP" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
echo "" echo ""
echo "This server is behind NAT. What is the public IPv4 address or hostname?" echo "This server is behind NAT. What is the public IPv4 address or hostname?"
read -p "Public IP address / hostname: " -e PUBLICIP read -rp "Public IP address / hostname: " -e PUBLICIP
fi fi
echo "" echo ""
echo "What protocol do you want for OpenVPN?" echo "What protocol do you want for OpenVPN?"
echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)" echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)"
while [[ $PROTOCOL != "UDP" && $PROTOCOL != "TCP" ]]; do until [[ "$PROTOCOL" == "UDP" || "$PROTOCOL" == "TCP" ]]; do
read -p "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL read -rp "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL
done done
echo "" echo ""
echo "What DNS do you want to use with the VPN?" echo "What DNS do you want to use with the VPN?"
@ -242,8 +309,8 @@ else
echo " 7) Google (Anycast: worldwide)" echo " 7) Google (Anycast: worldwide)"
echo " 8) Yandex Basic (Russia)" echo " 8) Yandex Basic (Russia)"
echo " 9) AdGuard DNS (Russia)" echo " 9) AdGuard DNS (Russia)"
while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" && $DNS != "6" && $DNS != "7" && $DNS != "8" && $DNS != "9" ]]; do until [[ "$DNS" =~ ^[0-9]+$ ]] && [ "$DNS" -ge 1 -a "$DNS" -le 9 ]; do
read -p "DNS [1-9]: " -e -i 1 DNS read -rp "DNS [1-9]: " -e -i 1 DNS
done done
echo "" echo ""
echo "See https://github.com/wmtech-1/OpenVPN-Installer#encryption to learn more about " echo "See https://github.com/wmtech-1/OpenVPN-Installer#encryption to learn more about "
@ -261,8 +328,8 @@ else
echo " 5) CAMELLIA-192-CBC" echo " 5) CAMELLIA-192-CBC"
echo " 6) CAMELLIA-256-CBC" echo " 6) CAMELLIA-256-CBC"
echo " 7) SEED-CBC" echo " 7) SEED-CBC"
while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" && $CIPHER != "7" ]]; do until [[ "$CIPHER" =~ ^[0-9]+$ ]] && [ "$CIPHER" -ge 1 -a "$CIPHER" -le 7 ]; do
read -p "Cipher [1-7]: " -e -i 1 CIPHER read -rp "Cipher [1-7]: " -e -i 1 CIPHER
done done
case $CIPHER in case $CIPHER in
1) 1)
@ -292,8 +359,8 @@ else
echo " 1) 2048 bits (fastest)" echo " 1) 2048 bits (fastest)"
echo " 2) 3072 bits (recommended, best compromise)" echo " 2) 3072 bits (recommended, best compromise)"
echo " 3) 4096 bits (most secure)" echo " 3) 4096 bits (most secure)"
while [[ $DH_KEY_SIZE != "1" && $DH_KEY_SIZE != "2" && $DH_KEY_SIZE != "3" ]]; do until [[ "$DH_KEY_SIZE" =~ ^[0-9]+$ ]] && [ "$DH_KEY_SIZE" -ge 1 -a "$DH_KEY_SIZE" -le 3 ]; do
read -p "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE read -rp "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE
done done
case $DH_KEY_SIZE in case $DH_KEY_SIZE in
1) 1)
@ -311,8 +378,8 @@ else
echo " 1) 2048 bits (fastest)" echo " 1) 2048 bits (fastest)"
echo " 2) 3072 bits (recommended, best compromise)" echo " 2) 3072 bits (recommended, best compromise)"
echo " 3) 4096 bits (most secure)" echo " 3) 4096 bits (most secure)"
while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do until [[ "$RSA_KEY_SIZE" =~ ^[0-9]+$ ]] && [ "$RSA_KEY_SIZE" -ge 1 -a "$RSA_KEY_SIZE" -le 3 ]; do
read -p "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE read -rp "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE
done done
case $RSA_KEY_SIZE in case $RSA_KEY_SIZE in
1) 1)
@ -329,8 +396,8 @@ else
echo "Enable IPv6? (ensure that your machine has IPv6 support):" echo "Enable IPv6? (ensure that your machine has IPv6 support):"
echo " 1) Yes" echo " 1) Yes"
echo " 2) No (default)" echo " 2) No (default)"
while [[ $IPV6E != "1" && $IPV6E != "2" ]]; do until [[ "$IPV6E" =~ ^[0-9]+$ ]] && [ "$IPV6E" -ge 1 -a "$IPV6E" -le 2 ]; do
read -p "Enable IPv6 [1-2]: " -e -i 2 IPV6E read -rp "Enable IPv6 [1-2]: " -e -i 2 IPV6E
done done
case $IPV6E in case $IPV6E in
1) 1)
@ -341,10 +408,18 @@ else
;; ;;
esac esac
echo "" echo ""
echo "Do you want to protect the configuration file with a password?"
echo "(e.g. encrypt the private key with a password)"
echo " 1) Add a passwordless client"
echo " 2) Use a password for the client"
until [[ "$pass" =~ ^[1-2]$ ]]; do
read -rp "Select an option [1-2]: " -e -i 1 pass
done
echo ""
echo "Finally, tell me a name for the client certificate and configuration" echo "Finally, tell me a name for the client certificate and configuration"
while [[ $CLIENT = "" ]]; do echo "Use one word only, no special characters"
echo "Please, use one word only, no special characters" until [[ "$CLIENT" =~ ^[a-zA-Z0-9_]+$ ]]; do
read -p "Client name: " -e -i client CLIENT read -rp "Client name: " -e -i firstclient CLIENT
done done
echo "" echo ""
echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now"
@ -452,10 +527,10 @@ WantedBy=multi-user.target" > /etc/systemd/system/ip6tables.service
mv /etc/openvpn/EasyRSA-3.0.4/ /etc/openvpn/easy-rsa/ mv /etc/openvpn/EasyRSA-3.0.4/ /etc/openvpn/easy-rsa/
chown -R root:root /etc/openvpn/easy-rsa/ chown -R root:root /etc/openvpn/easy-rsa/
rm -f ~/EasyRSA-3.0.4.tgz rm -f ~/EasyRSA-3.0.4.tgz
cd /etc/openvpn/easy-rsa/ cd /etc/openvpn/easy-rsa/ || return
# Generate a random, alphanumeric identifier of 16 characters for CN and one for server name # Generate a random, alphanumeric identifier of 16 characters for CN and one for server name
SERVER_CN="cn_$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)" SERVER_CN="cn_$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 16 | head -n 1)"
SERVER_NAME="server_$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)" SERVER_NAME="server_$(tr -dc 'a-zA-Z0-9' < /dev/urandom | fold -w 16 | head -n 1)"
echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars
echo "set_var EASYRSA_REQ_CN $SERVER_CN" >> vars echo "set_var EASYRSA_REQ_CN $SERVER_CN" >> vars
# Create the PKI, set up the CA, the DH params and the server + client certificates # Create the PKI, set up the CA, the DH params and the server + client certificates
@ -463,7 +538,15 @@ WantedBy=multi-user.target" > /etc/systemd/system/ip6tables.service
./easyrsa --batch build-ca nopass ./easyrsa --batch build-ca nopass
openssl dhparam -out dh.pem $DH_KEY_SIZE openssl dhparam -out dh.pem $DH_KEY_SIZE
./easyrsa build-server-full $SERVER_NAME nopass ./easyrsa build-server-full $SERVER_NAME nopass
case $pass in
1)
./easyrsa build-client-full $CLIENT nopass ./easyrsa build-client-full $CLIENT nopass
;;
2)
echo "⚠️ You will be asked for the client password below ⚠️"
./easyrsa build-client-full $CLIENT
;;
esac
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
# generate tls-auth key # generate tls-auth key
openvpn --genkey --secret /etc/openvpn/tls-auth.key openvpn --genkey --secret /etc/openvpn/tls-auth.key
@ -476,11 +559,7 @@ WantedBy=multi-user.target" > /etc/systemd/system/ip6tables.service
if [[ "$IPV6E" = '1' ]]; then if [[ "$IPV6E" = '1' ]]; then
echo -e "#IPv6 config start echo -e "#IPv6 config start
server-ipv6 fd6c:62d9:eb8c::/112" > /etc/openvpn/server.conf server-ipv6 fd6c:62d9:eb8c::/112" > /etc/openvpn/server.conf
if [[ "$PROTOCOL" = 'UDP' ]]; then echo "proto $(echo $PROTOCOL | tr '[:upper:]' '[:lower:]')6" >> /etc/openvpn/server.conf
echo "proto udp6" >> /etc/openvpn/server.conf
elif [[ "$PROTOCOL" = 'TCP' ]]; then
echo "proto tcp6" >> /etc/openvpn/server.conf
fi
echo -e 'tun-ipv6 echo -e 'tun-ipv6
push tun-ipv6 push tun-ipv6
push "route-ipv6 2000::/3" push "route-ipv6 2000::/3"
@ -491,11 +570,7 @@ push "redirect-gateway ipv6"
# Generate ipv4 server.conf # Generate ipv4 server.conf
echo "port $PORT" >> /etc/openvpn/server.conf echo "port $PORT" >> /etc/openvpn/server.conf
if [[ "$PROTOCOL" = 'UDP' ]]; then echo "proto $(echo $PROTOCOL | tr '[:upper:]' '[:lower:]')" >> /etc/openvpn/server.conf
echo "proto udp" >> /etc/openvpn/server.conf
elif [[ "$PROTOCOL" = 'TCP' ]]; then
echo "proto tcp" >> /etc/openvpn/server.conf
fi
echo "dev tun echo "dev tun
user nobody user nobody
group $NOGROUP group $NOGROUP
@ -516,7 +591,7 @@ ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf
RESOLVCONF='/etc/resolv.conf' RESOLVCONF='/etc/resolv.conf'
fi fi
# Obtain the resolvers from resolv.conf and use them for OpenVPN # Obtain the resolvers from resolv.conf and use them for OpenVPN
grep -v '#' $RESOLVCONF | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do grep -v '#' $RESOLVCONF | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read -r line; do
echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf
done done
;; ;;
@ -526,6 +601,7 @@ ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf
;; ;;
3) #Quad9 3) #Quad9
echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server.conf
echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server.conf
;; ;;
4) #FDN 4) #FDN
echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf
@ -552,7 +628,7 @@ ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf
echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf
;; ;;
esac esac
echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf echo 'push "redirect-gateway def1 bypass-dhcp" ' >> /etc/openvpn/server.conf
echo "crl-verify crl.pem echo "crl-verify crl.pem
ca ca.crt ca ca.crt
cert $SERVER_NAME.crt cert $SERVER_NAME.crt
@ -564,8 +640,8 @@ $CIPHER
tls-server tls-server
tls-version-min 1.2 tls-version-min 1.2
tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
status openvpn-status.log status /var/log/openvpn/status.log
log-append /var/log/openvpn/openvpn.log log-append /var/log/openvpn/server.log
verb 3 verb 3
mute 3 mute 3
sndbuf 393216 sndbuf 393216
@ -573,33 +649,32 @@ rcvbuf 393216" >> /etc/openvpn/server.conf
echo 'push "sndbuf 393216"' >> /etc/openvpn/server.conf echo 'push "sndbuf 393216"' >> /etc/openvpn/server.conf
echo 'push "rcvbuf 393216"' >> /etc/openvpn/server.conf echo 'push "rcvbuf 393216"' >> /etc/openvpn/server.conf
# Create the sysctl configuration file if needed (mainly for Arch Linux) # Create log dir
mkdir -p /var/log/openvpn
# Create the sysctl configuration file if needed
if [[ ! -e $SYSCTL ]]; then if [[ ! -e $SYSCTL ]]; then
touch $SYSCTL touch $SYSCTL
fi fi
# Enable net.ipv4.ip_forward for the system # Enable net.ipv4.ip_forward for the system
sed -i '/\<net.ipv4.ip_forward\>/c\net.ipv4.ip_forward=1' $SYSCTL
if ! grep -q "\<net.ipv4.ip_forward\>" $SYSCTL; then
echo 'net.ipv4.ip_forward=1' >> $SYSCTL echo 'net.ipv4.ip_forward=1' >> $SYSCTL
fi
# Avoid an unneeded reboot # Avoid an unneeded reboot
echo 1 > /proc/sys/net/ipv4/ip_forward echo 1 > /proc/sys/net/ipv4/ip_forward
# Enable net.ipv6.ip_forward for the system # Enable net.ipv6.ip_forward for the system
if [[ "$IPV6E" = '1' ]]; then if [[ "$IPV6E" = '1' ]]; then
sed -i '/\<net.ipv6.conf.all.forwarding\>/c\net.ipv6.conf.all.forwarding=1' $SYSCTL
if ! grep -q "\<net.ipv6.conf.all.forwarding\>" $SYSCTL; then
echo 'net.ipv6.conf.all.forwarding=1' >> $SYSCTL echo 'net.ipv6.conf.all.forwarding=1' >> $SYSCTL
fi
# Avoid an unneeded reboot # Avoid an unneeded reboot
echo 1 > /proc/sys/net/ipv6/conf/all/forwarding echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
fi fi
# Set NAT for the VPN subnet # Set NAT for the VPN subnet
iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE
# Save persitent iptables rules # Save persitent iptables rules
iptables-save > $IPTABLES iptables-save > $IPTABLES
if pgrep firewalld; then if pgrep firewalld; then
# We don't use --add-service=openvpn because that would only work with # We don't use --add-service=openvpn because that would only work with
# the default port. Using both permanent and not permanent rules to # the default port. Using both permanent and not permanent rules to
@ -614,6 +689,7 @@ rcvbuf 393216" >> /etc/openvpn/server.conf
firewall-cmd --zone=trusted --add-source=10.8.0.0/24 firewall-cmd --zone=trusted --add-source=10.8.0.0/24
firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
fi fi
if iptables -L -n | grep -qE 'REJECT|DROP'; then if iptables -L -n | grep -qE 'REJECT|DROP'; then
# If iptables has at least one REJECT rule, we asume this is needed. # If iptables has at least one REJECT rule, we asume this is needed.
# Not the best approach but I can't think of other and this shouldn't # Not the best approach but I can't think of other and this shouldn't
@ -669,6 +745,7 @@ rcvbuf 393216" >> /etc/openvpn/server.conf
fi fi
fi fi
fi fi
# And finally, restart OpenVPN # And finally, restart OpenVPN
if pgrep systemd-journal; then if pgrep systemd-journal; then
systemctl restart openvpn@server.service systemctl restart openvpn@server.service
@ -677,10 +754,12 @@ rcvbuf 393216" >> /etc/openvpn/server.conf
service openvpn restart service openvpn restart
chkconfig openvpn on chkconfig openvpn on
fi fi
# If the server is behind a NAT, use the correct IP address # If the server is behind a NAT, use the correct IP address
if [[ "$PUBLICIP" != "" ]]; then if [[ "$PUBLICIP" != "" ]]; then
IP=$PUBLICIP IP=$PUBLICIP
fi fi
# client-template.txt is created so we have a template to add further users later # client-template.txt is created so we have a template to add further users later
echo "client" > /etc/openvpn/client-template.txt echo "client" > /etc/openvpn/client-template.txt
if [[ "$PROTOCOL" = 'UDP' ]]; then if [[ "$PROTOCOL" = 'UDP' ]]; then