WiTopia OpenVPN DD-WRT Startup Script

#!/bin/sh

# WiTopia OpenVPN DD-WRT Startup Script.
#
# Install instructions:
# ----------------------
# 1. Ensure you are running DD-WRT STD, BIG or MEGA.
# 2. Perform a DD-WRT hard reset 30/30/30).
# 3. Ensure your DD-WRT router's Internet connection is working correctly.
# 4. Set Date / Time to your local zone (Setup - Basic Setup - Time Settings).
# 5. Copy-paste this file to (Administration - Commands - Command Shell).
# 6. Edit USERNAME and PASSWORD fields below.
# 7. Copy-paste the contents of your WiTopia CNXXXXX.key and CNXXXXX.crt files below.
# 7. Optionally, update REMOTE_SERVERS below.
# 8. Now reboot your DD-WRT router
# 9. Wait while the OpenVPN connects (~30-60 seconds after successful reboot).
#

# Adapted for WiTopia from http://hmastuff.com/files/Startup_Script_TCP_Extended-V2.4.txt

USERNAME="WITOPIA_USER_NAME ('user@witopia' OR 'W\[email protected]')"
PASSWORD="WITOPIA_PASSWORD"

PROTOCOL="udp" # udp / tcp MUST BE lower case

# WiTopia OpenVPN udp gateways: https://www.witopia.net/?faq-item=openvpn-ssl-gateway-locations
# WiTopia OpenVPN tcp gateways: https://www.witopia.net/?faq-item=alternate-port-openvpn-ssl-gateways

# Add - delete - edit servers between ##BB## and ##EE##
# Full list at
REMOTE_SERVERS="
##BB##
remote vpn.ashburn.witopia.net 1194
remote vpn.atlanta.witopia.net 1194
remote vpn.austin.witopia.net 1194
remote vpn.chicago.witopia.net 1194
remote vpn.columbus.witopia.net 1194
remote vpn.dallas.witopia.net 1194
remote vpn.denver.witopia.net 1194
remote vpn.detroit.witopia.net 1194
remote vpn.kansascity.witopia.net 1194
remote vpn.lasvegas.witopia.net 1194
remote vpn.longbeach.witopia.net 1194
remote vpn.losangeles.witopia.net 1194
remote vpn.miami.witopia.net 1194
remote vpn.newyork.witopia.net 1194
remote vpn.newark.witopia.net 1194
remote vpn.phoenix.witopia.net 1194
remote vpn.sanfrancisco.witopia.net 1194
remote vpn.seattle.witopia.net 1194
remote vpn.washingtondc.witopia.net 1194
##EE##
"

#### DO NOT CHANGE below this line ####

CA_CRT='-----BEGIN CERTIFICATE-----
MIIEZjCCA8+gAwIBAgIJAPUnaWtFWkqKMA0GCSqGSIb3DQEBBAUAMIHTMQswCQYD
VQQGEwJVUzERMA8GA1UECBMIVmlyZ2luaWExDzANBgNVBAcTBlJlc3RvbjEhMB8G
A1UEChMYRnVsbCBNZXNoIE5ldHdvcmtzLCBJbmMuMSUwIwYDVQQLFBxGTU4gRW5n
aW5lZXJpbmcgJiBPcGVyYXRpb25zMTEwLwYDVQQDEyhGdWxsIE1lc2ggTmV0d29y
a3MgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSMwIQYJKoZIhvcNAQkBFhRzdXBwb3J0
QGZ1bGxtZXNoLm5ldDAeFw0wNTAzMTcxODM3MTFaFw0xNTAzMTUxODM3MTFaMIHT
MQswCQYDVQQGEwJVUzERMA8GA1UECBMIVmlyZ2luaWExDzANBgNVBAcTBlJlc3Rv
bjEhMB8GA1UEChMYRnVsbCBNZXNoIE5ldHdvcmtzLCBJbmMuMSUwIwYDVQQLFBxG
TU4gRW5naW5lZXJpbmcgJiBPcGVyYXRpb25zMTEwLwYDVQQDEyhGdWxsIE1lc2gg
TmV0d29ya3MgQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSMwIQYJKoZIhvcNAQkBFhRz
dXBwb3J0QGZ1bGxtZXNoLm5ldDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEA
tSCLIQ3+rPzDQVDBuPWePX0QqzhoUWTYGNGAIrELxAKvmcVJRyLs7ufcchC6elVg
DFZ44lm0PFAj5IvdE2LlXbRun0Z2PpTp0n8iyKCEVy3FGiyjffIwwJIQapPKymWt
mN+cd/RaktSwWb67ofCW1n4n09j5tGeZWdBiuuzfW2kCAwEAAaOCAT4wggE6MB0G
A1UdDgQWBBT4KHw3WOt7X8O2Q/FKINt65OGRkzCCAQkGA1UdIwSCAQAwgf2AFPgo
fDdY63tfw7ZD8Uog23rk4ZGToYHZpIHWMIHTMQswCQYDVQQGEwJVUzERMA8GA1UE
CBMIVmlyZ2luaWExDzANBgNVBAcTBlJlc3RvbjEhMB8GA1UEChMYRnVsbCBNZXNo
IE5ldHdvcmtzLCBJbmMuMSUwIwYDVQQLFBxGTU4gRW5naW5lZXJpbmcgJiBPcGVy
YXRpb25zMTEwLwYDVQQDEyhGdWxsIE1lc2ggTmV0d29ya3MgQ2VydGlmaWNhdGUg
QXV0aG9yaXR5MSMwIQYJKoZIhvcNAQkBFhRzdXBwb3J0QGZ1bGxtZXNoLm5ldIIJ
APUnaWtFWkqKMAwGA1UdEwQFMAMBAf8wDQYJKoZIhvcNAQEEBQADgYEAVARIGyBa
kk8r8E8yJQblYJ/mLzt1C+Qezd3CGvMkLvjKIdNMbYt6bydAphIb+7idmUPbFSXd
8vUGnMOP2KNVJEi5kJ0GcFO8RENSPlYQzCWqc3vzaTOrD9kDCgjGMgrmjvaj9Yly
o2SCDH2Myw1rboUMo6TOY6G+A8f+dPF0/ZE=
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIGdTCCBF2gAwIBAgIJAIeW8F6c9bEcMA0GCSqGSIb3DQEBCwUAMIG5MQswCQYD
VQQGEwJVUzERMA8GA1UECAwIVmlyZ2luaWExEDAOBgNVBAoMB1dpVG9waWExNTAz
BgNVBAsMLFdpVG9waWEgQ2VydGlmaWNhdGUgQXV0aG9yaXR5IEFkbWluaXN0cmF0
aW9uMSowKAYDVQQDDCFXaVRvcGlhIFZQTiBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkx
IjAgBgkqhkiG9w0BCQEWE3N1cHBvcnRAd2l0b3BpYS5uZXQwHhcNMTQwMzExMjMw
NDEzWhcNMjkwMzExMDAwMDAwWjCBuTELMAkGA1UEBhMCVVMxETAPBgNVBAgMCFZp
cmdpbmlhMRAwDgYDVQQKDAdXaVRvcGlhMTUwMwYDVQQLDCxXaVRvcGlhIENlcnRp
ZmljYXRlIEF1dGhvcml0eSBBZG1pbmlzdHJhdGlvbjEqMCgGA1UEAwwhV2lUb3Bp
YSBWUE4gQ2VydGlmaWNhdGUgQXV0aG9yaXR5MSIwIAYJKoZIhvcNAQkBFhNzdXBw
b3J0QHdpdG9waWEubmV0MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
uYoeZufuYS5k27G+XnSdlT1FRgj5Q/DCPsznqorcBJoBCf84Sp2IAkb1ZBiN9n6v
P1u5zIGvGDAOliqwgTUhtv3qUQvrtyheonL4GvW3gqptIBi5dytkgRnRyjw7PHvY
4q/m73pOyyQH3/drBskBs2FIgGGkxzJX1vLSk1sjk+bhL3EztCm+H8FeTgyxzezT
3GOTgqENKNv3RzN+8N5c5+97ecu7EZ4D6gpaDJka7XwXzJXKcHYpvaeU0KE+4fs3
87qv9G39AJ5oGiczUpoEXYXU/q2+TTsIAlfCRjnu+lpZPpWvQO/HBV/SHpJyyhT/
uiCoEJNJjvGjw5BOw7BPx0kPSbJY5uzSPzQ50rnysphspO0DNsKlsZd/bpeKgCyT
pDQXNqZ2iRPJXK0ANzFUJ0EHDwJmweOSANEtGt98GJyzDWuPOnoP2zcbHEkc0ynA
NbXefmNKCP1LA3PrYmLWj8dZvBeT5ndgJ1NJcUjRVi9qJaGHZANDzKflaiBAb9/1
5CDT8P9/OJDY2aCuyAs2MO7iBACyTNTX8n/60a8z4i4XlfyxD5UNeh0Qo3vL0m3k
8vtg18ZmxKexuc3+MDrXgsl7hChDw+iREPVl+/qdMrcrezUSXhyypTwCsLPXttDa
o5Ofax5C6IWRkynL0PyI/PPUIfEXL0ZXdYLAr7/v768CAwEAAaN+MHwwDAYDVR0T
BAUwAwEB/zAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlm
aWNhdGUwHQYDVR0OBBYEFPiV/8N5c0YeWd+DN8gjqdYFJsNgMB8GA1UdIwQYMBaA
FPiV/8N5c0YeWd+DN8gjqdYFJsNgMA0GCSqGSIb3DQEBCwUAA4ICAQAJwnzyMOQh
g28vo7TvQfBtd1AMPLoXvlchA9h+6zazZVLP8uw/ldFoySsAcMXZqtDoN7F/RGpb
UtumFqEjGJI8SDjkacK+nZeASRW6r99v9E2/Rd50OrbCqUg5dZMHDE3krDP0Klbu
/OLKlpqEt80NgfJNCjYkdDzpDwbxepvrAsEMwa95kAsQl4is6349PNSIO+1Mkkq1
dOTYW8sfCvfHPwXXR/CqnHwDlpIzJhlW6TfKBNdFiZ5+JKf6mDAz39ctwv7DPjP7
29/i1DGnzHIxGJEGXK40xnuDemXutBMr2l4Myf3B7qDOXnW2y5ztc45Anx25Mo+d
fXWrqqIK446BW+3JGfkzdj2nq2ifp++JDXimOf1cbe6j2lp0Pju5pQMhP7wDcpt8
oZprPWLdjeLGsw7Ftp6K10J5M74DzWeXaONklvXtVOHbkmIxDgGEbEKkcDHtAg/5
Tgfo8WfXlgSl+edhZw9xsQYaHCjY+CBlbHL2LO9/WPv4a47/TbZW4bQVbl1wktKN
oD3eJ27x7BZ2iRrJaISP6WzulIxZmuUz8KwQ0LcFqKIg8QAuP+7N7EChXfK3wxXk
m36J3ZURggpVXc0W9DigceYQwpYgxLx9w5lSDPhOERUfbhMdKq5NSKkimbuXcrDY
8eRFapl26Zeh2DcTvOUgRAhqQWf9xVqcKw==
-----END CERTIFICATE-----
'

CLIENT_CRT='-----BEGIN CERTIFICATE-----
...copy your CNXXXXXX.crt here...
-----END CERTIFICATE-----
'

CLIENT_KEY='-----BEGIN PRIVATE KEY-----
...copy your CNXXXXXX.key here...
-----END PRIVATE KEY-----
'

OPVPNENABLE=`nvram get openvpncl_enable | awk '$1 == "0" {print $1}'`

if [ "$OPVPNENABLE" != 0 ]
then
   nvram set openvpncl_enable=0
   nvram commit
fi

sleep 10
mkdir /tmp/witopia; cd /tmp/witopia
echo -e "$USERNAME\n$PASSWORD" > userpass.conf
echo "$CA_CRT" > ca.crt; echo "$CLIENT_CRT" > client.crt; echo "$CLIENT_KEY" > client.key
echo "#!/bin/sh" > route-up.sh; echo -e "#!/bin/sh\nsleep 2" > route-down.sh
echo "#!/bin/sh
iptables -I FORWARD -i br0 -o tun0 -j ACCEPT
iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -i tun0 -j DROP # drop all unsolicited incoming connections from VPN peers
iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE" > /tmp/.rc_firewall
chmod 644 ca.crt client.crt; chmod 600 client.key userpass.conf; chmod 700 route-up.sh route-down.sh
chmod 700 /tmp/.rc_firewall
sleep 10
echo "client
dev tun
proto $PROTOCOL
script-security 2
resolv-retry infinite
nobind
persist-key
persist-tun
ns-cert-type server
cipher bf-cbc
comp-lzo
verb 3
mute 20
ca ca.crt
mssfix 1300
key client.key
cert client.crt
log witopia.log
daemon
auth sha1
auth-user-pass userpass.conf
remote-random
$REMOTE_SERVERS" > openvpn.conf
ln -s /tmp/witopia/witopia.log /tmp/witopia.log
/tmp/.rc_firewall
(killall openvpn; openvpn --config /tmp/witopia/openvpn.conf --route-up /tmp/witopia/route-up.sh --down-pre /tmp/witopia/route-down.sh) &
exit 0