HWS/OpenVPN-Installer
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge d88fe4d947 into 2236f9c048

Browse source
This commit is contained in:
lordnik22 2023-04-06 00:33:36 +02:00 • committed by GitHub
commit e24fba2c41
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 161 additions and 251 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

242
README.md Normal file → Executable file
View file

@ -1,232 +1,84 @@
# OpenVPN-installer by WMTech
# OpenVPN-installer
OpenVPN installer for CentOS and RedHat Linux.
OpenVPN installer for Raspberry Pi.
This script will let you setup your own secure VPN server in just a few minutes.
This script will let you setup your own secure VPN server.
Users with DS-Lite it's recommanded to first read the chapter [DS-Lite](/DS-Lite).
I am at a new ISP which uses DS-Lite. I therefore wanted to setup a
OpenVPN that is accessible over IPv6. I searched for similar projects
and found the script from WMtech-1 and adjusted it to my need until it
worked.
## Usage
**You have to enable the TUN module otherwise OpenVPN won't work.** Ask your host if you don't know how to do it. If the TUN module is not enabled, the script will warn you and exit.
You can get a cheap VPS to run this script for $5/month worldwide at [Linode](https://222.at/kQe6) or [UpCloud](https://222.at/P91t).
First, get the script and make it executable :
First, make sure IPv6 is enabled
```bash
wget https://raw.githubusercontent.com/wmtech-1/OpenVPN-Installer/master/openvpn-install.sh
modprobe ipv6
```
Secondly, get the script and make it executable :
```bash
wget https://raw.githubusercontent.com/lordnik22/OpenVPN-Installer/master/openvpn-install.sh
chmod +x openvpn-install.sh
```
Then run it :
Thirdly, run it :
`./openvpn-install.sh`
The first time you run it, you'll have to follow the assistant and answer a few questions to setup your VPN server.
When OpenVPN is installed, you can run the script again, and you will get the choice to :
An example how to answer is provided in [Example](example.txt).
When OpenVPN is installed, you can run the script again, and you will get the choice to :
- Add a client
- Remove a client
- Uninstall OpenVPN
## The fork of the fork
## DS-Lite
This script is based on the great work of [Nyr and its contributors](https://github.com/Nyr/openvpn-install) and [Angristan and its contributors](https://github.com/Angristan/OpenVPN-install).
### Universale Port Mapper
I use a Universale Port-Mapper at feste-ip.net. This makes it possible
to access my home-network while I am connected from a IPv4-Network (e.g.
most mobilphone-networks are in IPv4). feste-ip.net only supports TCP (never
tested with UDP).
I made it because I wanted to have a more secured OpenVPN out-of-the-box with IPv6 support and log files. It works like the original script by Angristan and Nyr, but has support for IPv6, some bug fixes and adds log files. Nyr's original script uses mainly default parameters regarding encryption, and some of them are insecure. Angristan focused at privacy and encryption. See [#encryption](#encryption).
Because I used such a port-mapper I needed to supply the DNS/IP of that
port-mapper to the script.
The only drawback is that you need to use a recent version of OpenVPN, because some parameters that requires TLS 1.2 are only availble since OpenVPN 2.3.3. Therefore I restrain the compatibility of this script to a few but widely used GNU/Linux distributions, to get a recent version of OpenVPN from trusted third-party repositories, if needed. That is not a complete drawback tough, because it means that you can have the latest version with all the new features and security fixes. See [compatibilty](#compatibility).
Additionally foreach client-file I generate I have to adjust the port
which they assigned to me.
On the client-side, it's less problematic, but if you want to use an OpenVPN server installed with this script with an old client (\<2.3.3), it won't work. However I don't see why you would use an outdated client.
For the IPv6 Target Port I used the default OpenVPN port: 1194.
**TL;DR**, this script is relatively secure, and you can just press enter in the setup.
For the hostname I used my DDNS from no-ip.
## Compatibility
### DDNS
The script is made to work on these OS and architectures :
I use a DDNS from no-ip.net. This makes it possible to access your
home-network even if your ISP changes the IPv6 (untested). In theory
the IPv6 should never change but I still use it because I already used
it with my old ISP which had IPv4.
- **CentOS 6** (i386, amd64)
- **CentOS 7** (i386, amd64, arm64)
## The fork of the fork of the fork
## Features
This script is based on the great work of [Nyr and its
contributors](https://github.com/Nyr/openvpn-install), [Angristan and
its contributors](https://github.com/Angristan/OpenVPN-install) and
[WMtech-1 and its
contributors](https://github.com/wmtech-1/OpenVPN-Installer).
This fork includes the following features :
- Every feature of the [original script](https://github.com/Nyr/openvpn-install)
- Every feature of the [Angristan fork](https://github.com/Angristan/OpenVPN-install)
- IPv6 support
- Log file and rotation
- Bug fixes with script removal
- Randomized certificate name
- The ability to create passwordless clients and clients protected with a password
## Forward to VMtech-1 for more details
## DNS
The script will ask you which DNS resolvers you want to use when connected to the VPN.
Here are the possibilities :
- Current system resolvers, those that are in `/etc/resolv.conf`
- [Cloudflare](https://1.1.1.1/), recommended, fastest resolvers available (Anycast servers)
- [Quad9](https://www.quad9.net), recommended, security and privacy oriented, fast worldwide (Anycast servers)
- [FDN's DNS Servers](http://www.fdn.fr/actions/dns/), recommended if you're in western europe (France)
- [DNS.WATCH DNS Servers](https://dns.watch/index), recommended if you're in western europe (Germany)
- [OpenDNS](https://en.wikipedia.org/wiki/OpenDNS), not recommened but fast wordlwide (Anycast servers)
- [Google Public DNS](https://en.wikipedia.org/wiki/Google_Public_DNS), not recommended, but fast worldwide (Anycast servers)
- [Yandex Basic DNS](https://dns.yandex.com/), not recommended, but fast in Russia
- [AdGuard DNS](https://github.com/AdguardTeam/AdguardDNS), located in Russia, blocks ads and trackers
- Soon : local resolver :D
Any other fast, trustable and neutral servers proposition is welcome.
## Encryption
The main reason why Angristan made this fork was to improve the encryption. Indeed, OpenVPN's default parameters are weak (and that's what [Nyr's script](https://github.com/Nyr/openvpn-install) uses).
OpenVPN 2.4 will be a great update on the encryption part, because we'll be able to use elliptic curves, so ECDSA and ECDH (as well for the control channel), and AES GCM. They are faster and more secure.
**Note:** With OpenVPN's default parameters, you have a relatively weak encryption. Nonetheless, your trafic is still encrypted, so unless you're under surveillance, probably no one will try to decrypt it. Yet it's not a reason to use old and weak algorithm when there are much better ones available. 😉
### TLS version
OpenVPN uses TLS 1.0 by default, which is nearly [20 years old](https://en.wikipedia.org/wiki/Transport_Layer_Security#TLS_1.0).
With `tls-version-min 1.2` we use at least TLS 1.2, which the best protocol available currently. I could have used `tls-version-min highest` but this does not ensure we use TLS 1.2 which is the only secure protocol available.
[OpenVPN documentation for tls-version-min](https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAK)
TLS 1.2 is only supported since OpenVPN 2.3.3. This is one of the reasons of the script uses third-party repositories, because some distributions have an older version of OpenVPN.
### Certificate
#### Key
OpenVPN uses an RSA certificate with a 2048 bits key [by default](https://github.com/OpenVPN/easy-rsa/blob/master/easyrsa3/vars.example#L97).
2048 bits is OK, but both [NSA](https://cryptome.org/2016/01/CNSA-Suite-and-Quantum-Computing-FAQ.pdf) and [ANSSI](https://www.ssi.gouv.fr/uploads/2015/01/RGS_v-2-0_B1.pdf) recommend at least a 3072 bits for a future-proof key. As the size of the key will have an impact on speed, I leave the choice to use 2048, 3072 or 4096 bits RSA key. 4096 bits is what's most used and recommened today, but 3072 bits is still good.
In OpenVPN 2.4, we will be able to use an ECDSA certificate. This algorithm uses elliptic curves instead of prime numbers' factorization for a reduced key size and calculation time, thus it's faster and more secure.
#### Signature hash
OpenVPN uses SHA-256 [by default](https://github.com/OpenVPN/easy-rsa/blob/master/easyrsa3/vars.example#L192).
It also supports SHA1 and MD5, which are unsafe, and all the SHA2 family. I didn't find any reason to use something other than SHA-256 in the SHA2 group, so the script still uses the default hash algorithm.
### Data channel's cipher
By default, OpenVPN uses `BF-CBC` as the data channel cipher. Blowfish is an old (1993) and weak alogorithm. What's *funny* is that even the official OpenVPN documentation admits it.
>The default is BF-CBC, an abbreviation for Blowfish in Cipher Block Chaining mode.
Using BF-CBC is no longer recommended, because of its 64-bit block size. This small block size allows attacks based on collisions, as demonstrated by SWEET32. See https://community.openvpn.net/openvpn/wiki/SWEET32 for details.
[Source](https://community.openvpn.net/openvpn/wiki/Openvpn23ManPage#lbAI)
>Security researchers at INRIA published an attack on 64-bit block ciphers, such as 3DES and Blowfish. They show that they are able to recover plaintext when the same data is sent often enough, and show how they can use cross-site scripting vulnerabilities to send data of interest often enough. This works over HTTPS, but also works for HTTP-over-OpenVPN. See ​https://sweet32.info/ for a much better and more elaborate explanation.
> OpenVPN's default cipher, BF-CBC, is affected by this attack.
[Source](https://community.openvpn.net/openvpn/wiki/SWEET32)
>Blowfish's use of a 64-bit block size (as opposed to e.g. AES's 128-bit block size) makes it vulnerable to birthday attacks, particularly in contexts like HTTPS. In 2016, the SWEET32 attack demonstrated how to leverage birthday attacks to perform plaintext recovery (i.e. decrypting ciphertext) against ciphers with a 64-bit block size such as Blowfish.[9]
>A reduced-round variant of Blowfish is known to be susceptible to known-plaintext attacks on reflectively weak keys. Blowfish implementations use 16 rounds of encryption, and are not susceptible to this attack. Blowfish users are encouraged by Bruce Schneier, Blowfish's creator, to use the more modern and computationally efficient alternative Twofish. He is quoted in 2007 as saying:
>"At this point, though, I'm amazed it's still being used. If people ask, I recommend Twofish instead."
[Source](https://en.wikipedia.org/wiki/Blowfish_(cipher)#Weakness_and_successors)
Convinced ?
The [SWEET32 vulnerability page](https://community.openvpn.net/openvpn/wiki/SWEET32) from OpenVPN's documentation says :
>The following ciphers are affected, and should no longer be used:
- BF-*
- DES* (including 3DES variants)
- RC2-*
>The following ciphers are *not* affected:
- AES-*
- CAMELLIA-*
- SEED-*
Indeed, AES is today's standard. It's the fastest and more secure cipher available today. [SEED](https://en.wikipedia.org/wiki/SEED) and [Camellia](https://en.wikipedia.org/wiki/Camellia_(cipher)) are not vulnerable to date but are slower than AES and relatively less trusted.
As they have not any proven vulnerabilities, I decided to give the user the choice to use them, though I don't see any particular reason to this day to use it. Maybe someday if AES happens to be broken. Here is an example about [why Camellia is good, but AES is better and should be used](http://crypto.stackexchange.com/questions/476/why-does-nobody-use-or-break-the-camellia-cipher/477#477).
Currently AES is only available in its CBC mode, which is weaker than GCM.
To quote the [OpenVPN documentation](https://community.openvpn.net/openvpn/wiki/SWEET32) :
>Of the currently supported ciphers, OpenVPN currently recommends using AES-256-CBC or AES-128-CBC. OpenVPN 2.4 and newer will also support GCM. For 2.4+, we recommend using AES-256-GCM or AES-128-GCM.
Of course I will update the script to add AES-GCM mode (as well as ECDH and ECDSA) as soon as OpenVPN 2.4 is released.
For now, these cipher are available in the setup :
- AES-128-CBC
- AES-192-CBC
- AES-256-CBC
- CAMELLIA-128-CBC
- CAMELLIA-192-CBC
- CAMELLIA-256-CBC
- SEED-CBC
AES-256 is 40% slower than AES-128, and there isn't any real reason to use a 256 bits key over a 128 bits key with AES. (Source : [[1]](http://security.stackexchange.com/questions/14068/why-most-people-use-256-bit-encryption-instead-of-128-bit),[[2]](http://security.stackexchange.com/questions/6141/amount-of-simple-operations-that-is-safely-out-of-reach-for-all-humanity/6149#6149)).
Moreover, AES-256 is more vulnerable to [Timing attacks](https://en.wikipedia.org/wiki/Timing_attack).
Thus, the best data channel cipher currently available in OpenVPN is `AES-128-CBC`.
### Control channel's cipher
According to the [Hardening](https://community.openvpn.net/openvpn/wiki/Hardening#Useof--tls-cipher) page of the OpenVPN wiki, TLS 1.2 is not supported by OpenVPN <2.3.3, so it uses a TLS 1.0 cipher by default, which is insecure.
> The following are TLSv1.2 DHE + RSA choices, requiring a compatible peer running at least OpenVPN 2.3.3:
- TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
- TLS-DHE-RSA-WITH-AES-256-CBC-SHA256
- TLS-DHE-RSA-WITH-AES-128-GCM-SHA256
- TLS-DHE-RSA-WITH-AES-128-CBC-SHA256
AES GCM is more secure than AES CBC, and AES 128 is secure enough today. I didn't find any security difference between SHA-256 and SHA-384 so we're going to use SHA-256.
Thus, I have chosen `TLS-DHE-RSA-WITH-AES-128-GCM-SHA256` as the control channel cipher.
### Diffie-Hellman key
OpenVPN uses a 2048 bits DH key [by default](https://github.com/OpenVPN/easy-rsa/blob/master/easyrsa3/vars.example#L97).
2048 bits is OK, but both [NSA](https://cryptome.org/2016/01/CNSA-Suite-and-Quantum-Computing-FAQ.pdf) and [ANSSI](https://www.ssi.gouv.fr/uploads/2015/01/RGS_v-2-0_B1.pdf) recommend at least a 3072 bits for a future-proof key. Like RSA, the size of the key will have an impact on speed, I leave the choice to use a 2048, 3072 or 4096 bits key. 4096 bits is what's most used and recommended today, but 3072 bits is still good.
In OpenVPN 2.4, we will be able to use ECDH key. It uses elliptic curves instead of prime numbers' factorization for a reduced key size and calculation time, thus it's faster and more secure.
### HMAC authentication algorithm
To quote the OpenVPN wiki :
>Authenticate packets with HMAC using message digest algorithm alg. (The default is SHA1 ). HMAC is a commonly used message authentication algorithm (MAC) that uses a data string, a secure hash algorithm, and a key, to produce a digital signature.
OpenVPN's usage of HMAC is to first encrypt a packet, then HMAC the resulting ciphertext.
SHA-1 is not safe anymore, so I use SHA-256 which is safe and widely used.
### TLS-Auth
>The --tls-auth option uses a static pre-shared key (PSK) that must be generated in advance and shared among all peers. This features adds "extra protection" to the TLS channel by requiring that incoming packets have a valid signature generated using the PSK key. If this key is ever changed, it must be changed on all peers at the same time (there is no support for rollover.)
>The primary benefit is that an unauthenticated client cannot cause the same CPU/crypto load against a server as the junk traffic can be dropped much sooner. This can aid in mitigating denial-of-service attempts.
>This feature by itself does not improve the TLS auth in any way, although it offers a 2nd line of defense if a future flaw is discovered in a particular TLS cipher-suite or implementation (such as CVE-2014-0160, Heartbleed, where the tls-auth key provided protection against attackers who did not have a copy). However, it offers no protection at all in the event of a complete cryptographic break that can allow decryption of a cipher-suite's traffic.
[Source](https://openvpn.net/index.php/open-source/documentation/howto.html#security)
TLS-Auth is not enabled by default by OpenVPN, but it is in this script.
## Check for DNS leaks
Go to [dnsleaktest.com](https://dnsleaktest.com/) or [ipleak.net](https://ipleak.net/) with your browser. Only your server's IP should show up.
See [WMtech-1 and its contributors](https://github.com/wmtech-1/OpenVPN-Installer).
## Credits & Licence
Thanks to the [contributors](https://github.com/wmtech-1/OpenVPN-Installer/graphs/contributors), Angristan and of course Nyr's orginal work.
Thanks to VMtech-1, the respective [contributors](https://github.com/wmtech-1/OpenVPN-Installer/graphs/contributors), Angristan and of course Nyr's orginal work.
[MIT Licence](https://raw.githubusercontent.com/wmtech-1/OpenVPN-Installer/master/LICENSE)

75
example.txt Executable file
View file

@ -0,0 +1,75 @@
Welcome to the secure OpenVPN installer (github.com/wmtech-1/OpenVPN-Installer)
I need to ask you a few questions before starting the setup
You can leave the default options and just press enter if you are ok with them
I need to know the IPv4 address of the network interface you want OpenVPN listening to.
If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)
Otherwise, it should be your public IPv4 address.
IP address: your-domain.feste-ip.net
What port do you want for OpenVPN?
1) Default: 1194
2) Custom
3) Random [49152-65535]
Port choice [1-3]: 1
Enable IPv6? (ensure that your machine has IPv6 support):
1) Yes (default)
2) No
Enable IPv6 [1-2]: 1
What protocol do you want for OpenVPN?
Unless UDP is blocked, you should not use TCP (unnecessarily slower)
Protocol [UDP/TCP]: TCP
What DNS do you want to use with the VPN?
1) Current system resolvers (from /etc/resolv.conf)
2) Cloudflare (Anycast: worldwide)
3) Quad9 (Anycast: worldwide)
4) FDN (France)
5) DNS.WATCH (Germany)
6) OpenDNS (Anycast: worldwide)
7) Google (Anycast: worldwide)
8) Yandex Basic (Russia)
9) AdGuard DNS (Russia)
DNS [1-9]: 1
See https://github.com/wmtech-1/OpenVPN-Installer#encryption to learn more about
the encryption in OpenVPN and the choices I made in this script.
Please note that all the choices proposed are secure (to a different degree)
and are still viable to date, unlike some default OpenVPN options
Choose which cipher you want to use for the data channel:
1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)
2) AES-192-CBC
3) AES-256-CBC
Alternatives to AES, use them only if you know what you're doing.
They are relatively slower but as secure as AES.
4) CAMELLIA-128-CBC
5) CAMELLIA-192-CBC
6) CAMELLIA-256-CBC
7) SEED-CBC
Cipher [1-7]: 1
Choose what size of Diffie-Hellman key you want to use:
1) 2048 bits (fastest)
2) 3072 bits (recommended, best compromise)
3) 4096 bits (most secure)
DH key size [1-3]: 1
Choose what size of RSA key you want to use:
1) 2048 bits (fastest)
2) 3072 bits (recommended, best compromise)
3) 4096 bits (most secure)
RSA key size [1-3]: 1
Do you want to protect the configuration file with a password?
(e.g. encrypt the private key with a password)
1) Add a passwordless client
2) Use a password for the client
Select an option [1-2]: 1
Finally, tell me a name for the client certificate and configuration
Use one word only, no special characters
Client name: clientTCP

79
openvpn-install.sh
View file

@ -16,31 +16,14 @@ if [[ ! -e /dev/net/tun ]]; then
exit
fi
# Check if CentOS 5
if grep -qs "CentOS release 5" "/etc/redhat-release"; then
echo "CentOS 5 is too old and not supported. Please upgrade to CentOS 7"
exit
fi
# Check if CentOS 6
if grep -qs "CentOS release 6" "/etc/redhat-release"; then
echo "CentOS 6 is too old and no longer supported. Please upgrade to CentOS 7"
exit
fi
if [[ -e /etc/centos-release || -e /etc/redhat-release || -e /etc/system-release ]]; then
OS=centos
if [[ -e /usr/lib/systemd/system/iptables.service ]]; then
IPTABLES='/etc/sysconfig/iptables'
IP6TABLES='/etc/sysconfig/ip6tables'
else
IPTABLES='/etc/iptables/iptables.rules'
IP6TABLES='/etc/ip6tables/ip6tables.rules'
fi
SYSCTL='/etc/sysctl.d/30-openvpn-forward.conf'
if [[ -e /etc/os-release && $(cat /etc/os-release | grep "^NAME") == *"Raspbian"* ]]; then
OS=raspberrypios
PTABLES='/etc/iptables/rules.v4'
IP6TABLES='/etc/ip6tables/rules.v6'
SYSCTL='/etc/sysctl.d/30-openvpn-forward.conf'
else
echo "Looks like you aren't running this installer on a CentOS or RedHat system"
exit
echo "Looks like you aren't running this installer on a Raspberry Pi"
exit
fi
newclient () {
@ -223,7 +206,7 @@ if [[ -e /etc/openvpn/server.conf ]]; then
fi
fi
fi
yum remove openvpn -y
apt remove openvpn -y
OVPNS=$(ls /etc/openvpn/easy-rsa/pki/issued | awk -F "." {'print $1'})
for i in $OVPNS
do
@ -285,7 +268,21 @@ else
echo "Random Port: $PORT"
;;
esac
echo ""
echo "Enable IPv6? (ensure that your machine has IPv6 support):"
echo " 1) Yes (default)"
echo " 2) No"
until [[ "$IPV6E" =~ ^[0-9]+$ ]] && [ "$IPV6E" -ge 1 -a "$IPV6E" -le 2 ]; do
read -rp "Enable IPv6 [1-2]: " -e -i 1 IPV6E
done
case $IPV6E in
1)
IPV6E="1"
;;
2)
IPV6E="0"
;;
esac
# If $IP is a private IP address, the server must be behind NAT
if echo "$IP" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
echo ""
@ -296,7 +293,7 @@ else
echo "What protocol do you want for OpenVPN?"
echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)"
until [[ "$PROTOCOL" == "UDP" || "$PROTOCOL" == "TCP" ]]; do
read -rp "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL
read -rp "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL
done
echo ""
echo "What DNS do you want to use with the VPN?"
@ -393,21 +390,6 @@ else
;;
esac
echo ""
echo "Enable IPv6? (ensure that your machine has IPv6 support):"
echo " 1) Yes"
echo " 2) No (default)"
until [[ "$IPV6E" =~ ^[0-9]+$ ]] && [ "$IPV6E" -ge 1 -a "$IPV6E" -le 2 ]; do
read -rp "Enable IPv6 [1-2]: " -e -i 2 IPV6E
done
case $IPV6E in
1)
IPV6E="1"
;;
2)
IPV6E="0"
;;
esac
echo ""
echo "Do you want to protect the configuration file with a password?"
echo "(e.g. encrypt the private key with a password)"
echo " 1) Add a passwordless client"
@ -425,9 +407,9 @@ else
echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now"
read -n1 -r -p "Press any key to continue..."
if [[ "$OS" = 'centos' ]]; then
yum install epel-release -y
yum install openvpn iptables openssl wget ca-certificates curl -y
if [[ "$OS" = 'raspberrypios' ]]; then
apt install epel-release -y
apt install openvpn iptables openssl wget ca-certificates curl -y
# Install iptables service
if [[ ! -e /usr/lib/systemd/system/iptables.service && ! -e /etc/systemd/system/iptables.service ]]; then
mkdir /etc/iptables
@ -570,7 +552,7 @@ push "redirect-gateway ipv6"
# Generate ipv4 server.conf
echo "port $PORT" >> /etc/openvpn/server.conf
echo "proto $(echo $PROTOCOL | tr '[:upper:]' '[:lower:]')" >> /etc/openvpn/server.conf
echo "proto $(echo $PROTOCOL | tr '[:upper:]' '[:lower:]')6" >> /etc/openvpn/server.conf
echo "dev tun
user nobody
group $NOGROUP
@ -735,7 +717,7 @@ rcvbuf 393216" >> /etc/openvpn/server.conf
if [[ "$PORT" != '1194' ]]; then
# semanage isn't available in CentOS 6 by default
if ! hash semanage 2>/dev/null; then
yum install policycoreutils-python -y
apt install policycoreutils-python-utils -y
fi
if [[ "$PROTOCOL" = 'UDP' ]]; then
semanage port -a -t openvpn_port_t -p udp $PORT
@ -767,7 +749,8 @@ rcvbuf 393216" >> /etc/openvpn/server.conf
elif [[ "$PROTOCOL" = 'TCP' ]]; then
echo "proto tcp-client" >> /etc/openvpn/client-template.txt
fi
echo "remote $IP $PORT
echo "remote $IP
port $PORT
dev tun
resolv-retry infinite
nobind