#!/bin/sh
USERNAME="YourNordVPNusername"
PASSWORD="YourNordVPNpassword"

PROTO="udp"
TUN="tun1"
REMOTE="remote 23.226.132.244 1194"

CA_CRT='-----BEGIN CERTIFICATE-----
MIIEzTCCA7WgAwIBAgIJAKqH+BGGHKRXMA0GCSqGSIb3DQEBCwUAMIGfMQswCQYD
VQQGEwJQQTELMAkGA1UECBMCUEExDzANBgNVBAcTBlBhbmFtYTEQMA4GA1UEChMH
Tm9yZFZQTjEQMA4GA1UECxMHTm9yZFZQTjEbMBkGA1UEAxMSdXMxMTc5Lm5vcmR2
cG4uY29tMRAwDgYDVQQpEwdOb3JkVlBOMR8wHQYJKoZIhvcNAQkBFhBjZXJ0QG5v
cmR2cG4uY29tMB4XDTE3MTExMzE2NDMzM1oXDTI3MTExMTE2NDMzM1owgZ8xCzAJ
BgNVBAYTAlBBMQswCQYDVQQIEwJQQTEPMA0GA1UEBxMGUGFuYW1hMRAwDgYDVQQK
EwdOb3JkVlBOMRAwDgYDVQQLEwdOb3JkVlBOMRswGQYDVQQDExJ1czExNzkubm9y
ZHZwbi5jb20xEDAOBgNVBCkTB05vcmRWUE4xHzAdBgkqhkiG9w0BCQEWEGNlcnRA
bm9yZHZwbi5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDW7+t6
ORXcrW2Vi2qZAhG4LCE3Z1HS8QX4AVmfT/oqCHcNHJK5kBvwIu9XQDYSYfizcetm
KHbvjynt9nAyw1oBdDDuhpKqGJlPwt9bQbqu8pS3lZG1zhYsDrcnlNzOJ6RXyCnv
Wd3Z+v1PUacEQOKR1mUJkzup2DvVEZPVt7Xj8uTyw6GXIwELLpJL0lq+MR9ldEWS
skfDOHKc2PFDScCoxyFJS5+DKXY0vDSQbq5Izho3HHX2mKh01TqL2S55dBpEtR/h
vOLhbbbeDD/28y3/VO/9Bwnf7dA+WsbdUm/OECf6Mgw6ntPny6ywr7rts3R6mlkr
q5UZFIQNFZPYpFF/AgMBAAGjggEIMIIBBDAdBgNVHQ4EFgQU7Z3sB2enO2it7Dn/
7+S2lXDxvtQwgdQGA1UdIwSBzDCByYAU7Z3sB2enO2it7Dn/7+S2lXDxvtShgaWk
gaIwgZ8xCzAJBgNVBAYTAlBBMQswCQYDVQQIEwJQQTEPMA0GA1UEBxMGUGFuYW1h
MRAwDgYDVQQKEwdOb3JkVlBOMRAwDgYDVQQLEwdOb3JkVlBOMRswGQYDVQQDExJ1
czExNzkubm9yZHZwbi5jb20xEDAOBgNVBCkTB05vcmRWUE4xHzAdBgkqhkiG9w0B
CQEWEGNlcnRAbm9yZHZwbi5jb22CCQCqh/gRhhykVzAMBgNVHRMEBTADAQH/MA0G
CSqGSIb3DQEBCwUAA4IBAQBr1x0CYtTwMGwGdY/QglOkPyWLSoq0RYR8sobhaV6/
0M9zWMYhl/ADinemgaVGuEkesGQX4yeqjPg5t+Qp/3NyKj/FdoW4AkMmI81TQ0/w
RhmtWXA43MugsBrg/9i5z6tcx0wOpNZP1usQhRSpnamw4YuwV06i/xY0Zczv4OJG
elZVfa7Z+SP62VMMd3BdC6T2HP/QkXki/PyNDKz9Bkf/eDpPgufcFROOZwRkGvvB
3h1wVTqFm9H99BVd0ney/4deXoG8RXlNrEll7DW2eAi4lVu/At12UB9aWRzyAeVG
UB9/Al4kXkA78IwtC4AqIS5AT1VIn2HRhbme63FMXGig
-----END CERTIFICATE-----'

TLS_AUTH='-----BEGIN OpenVPN Static key V1-----
4f60b3f150077840625a054ad3b32b0e
ecfb2baaafaba53d46bfabe3b7a726af
243eb804c741bfda794a99bbe55e3ae0
082b4f8cbd40861b390feb4f509b5e18
f5b097300da158991a2ef840929ef153
b8de6b9191a405af113b562ba166c204
616cf3690475920b4aed253c64a49ec0
a9ee092255841f2f4b2821a7835a5343
2f2e4d7574699be751d78d87076b3320
5de84bdad78c34531df99430c12b6943
0dbc935ca5cc32bbfd6baae2cb770cb3
ce6b740b4dfcbb0855bde5309a9442ab
ed67abade14929baa23261246145505f
17b436c75ddf989ad2f1906422bacf7e
dcf1fb2913905c47f494d64a5863a9c8
d5705126eefa6a04028985634bc45ddf
-----END OpenVPN Static key V1-----'

#### Don't modify below here, except the "auth sha512" line ####

#### Ensure gui client disabled ####
if [ `nvram get openvpncl_enable` != 0 ]; then
nvram set openvpncl_enable=0
nvram commit
sleep 10
fi

mkdir /tmp/vpncl; cd /tmp/vpncl

echo -e "$USERNAME\n$PASSWORD" > userpass.txt

echo "#!/bin/sh
iptables -t nat -I POSTROUTING -o $TUN -j MASQUERADE" > route-up.sh

echo "#!/bin/sh
iptables -t nat -D POSTROUTING -o $TUN -j MASQUERADE" > route-down.sh

echo "$CA_CRT" > ca.crt
echo "$TLS_AUTH" > tls-auth.key
sleep 10

echo "client
dev $TUN
proto $PROTO

$REMOTE
resolv-retry infinite
nobind

tun-mtu 1500
tun-mtu-extra 32
mssfix 1450

persist-key
persist-tun
keepalive 5 30

comp-lzo
mute 20
verb 3
log-append vpn.log
fast-io

auth-user-pass userpass.txt
script-security 2
remote-cert-tls server
cipher AES-256-CBC
# if the server is relatively new and uses sha512, uncomment the line below
auth sha512

ca ca.crt
tls-auth tls-auth.key 1

daemon" > openvpn.conf

chmod 777 ca.crt tls-auth.key userpass.txt openvpn.conf; chmod 700 route-up.sh route-down.sh

(killall openvpn ; openvpn --config openvpn.conf --route-up /tmp/vpncl/route-up.sh --down-pre /tmp/vpncl/route-down.sh) &

exit 0