API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Aug 10th, 2023
92
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 21.97 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2.  
  3. # Secure OpenVPN server installer for Debian, Ubuntu, CentOS and Arch Linux
  4. # https://github.com/SwiftfireDev/OpenVPN-install
  5.  
  6.  
  7. if [[ "$EUID" -ne 0 ]]; then
  8.     echo "Sorry, you need to run this as root"
  9.     exit 1
  10. fi
  11.  
  12. if [[ ! -e /dev/net/tun ]]; then
  13.     echo "TUN is not available"
  14.     exit 2
  15. fi
  16.  
  17. if grep -qs "CentOS release 5" "/etc/redhat-release"; then
  18.     echo "CentOS 5 is too old and not supported"
  19.     exit 3
  20. fi
  21.  
  22. if [[ -e /etc/debian_version ]]; then
  23.     OS="debian"
  24.     # Getting the version number, to verify that a recent version of OpenVPN is available
  25.     VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID")
  26.     RCLOCAL='/etc/rc.local'
  27.     SYSCTL='/etc/sysctl.conf'
  28.     if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then
  29.         echo "Your version of Debian/Ubuntu is not supported."
  30.         echo "I can't install a recent version of OpenVPN on your system."
  31.         echo ""
  32.         echo "However, if you're using Debian unstable/testing, or Ubuntu beta,"
  33.         echo "then you can continue, a recent version of OpenVPN is available on these."
  34.         echo "Keep in mind they are not supported, though."
  35.         while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do
  36.             read -p "Continue ? [y/n]: " -e CONTINUE
  37.         done
  38.         if [[ "$CONTINUE" = "n" ]]; then
  39.             echo "Ok, bye !"
  40.             exit 4
  41.         fi
  42.     fi
  43. elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then
  44.     OS=centos
  45.     RCLOCAL='/etc/rc.d/rc.local'
  46.     SYSCTL='/etc/sysctl.conf'
  47.     # Needed for CentOS 7
  48.     chmod +x /etc/rc.d/rc.local
  49. elif [[ -e /etc/arch-release ]]; then
  50.     OS=arch
  51.     RCLOCAL='/etc/rc.local'
  52.     SYSCTL='/etc/sysctl.d/openvpn.conf'
  53. else
  54.     echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system"
  55.     exit 4
  56. fi
  57.  
  58. newclient () {
  59.     # Generates the custom client.ovpn
  60.     cp /etc/openvpn/client-template.txt ~/$1.ovpn
  61.     echo "<ca>" >> ~/$1.ovpn
  62.     cat /etc/openvpn/easy-rsa/pki/ca.crt >> ~/$1.ovpn
  63.     echo "</ca>" >> ~/$1.ovpn
  64.     echo "<cert>" >> ~/$1.ovpn
  65.     cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> ~/$1.ovpn
  66.     echo "</cert>" >> ~/$1.ovpn
  67.     echo "<key>" >> ~/$1.ovpn
  68.     cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ~/$1.ovpn
  69.     echo "</key>" >> ~/$1.ovpn
  70.     echo "key-direction 1" >> ~/$1.ovpn
  71.     echo "<tls-crypt>" >> ~/$1.ovpn
  72.     cat /etc/openvpn/tls-crypt.key >> ~/$1.ovpn
  73.     echo "</tls-crypt>" >> ~/$1.ovpn
  74. }
  75.  
  76. # Try to get our IP from the system and fallback to the Internet.
  77. # I do this to make the script compatible with NATed servers (LowEndSpirit/Scaleway)
  78. # and to avoid getting an IPv6.
  79. IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
  80. if [[ "$IP" = "" ]]; then
  81.     IP=$(wget -4qO- "http://whatismyip.akamai.com/")
  82. fi
  83.  
  84. if [[ -e /etc/openvpn/server.conf ]]; then
  85.     while :
  86.     do
  87.     clear
  88.         echo "OpenVPN-install (github.com/SwiftfireDev/OpenVPN-install)"
  89.         echo ""
  90.         echo "Looks like OpenVPN is already installed"
  91.         echo ""
  92.         echo "What do you want to do?"
  93.         echo "   1) Add a cert for a new user"
  94.         echo "   2) Revoke existing user cert"
  95.         echo "   3) Remove OpenVPN"
  96.         echo "   4) Exit"
  97.         read -p "Select an option [1-4]: " option
  98.         case $option in
  99.             1)
  100.             echo ""
  101.             echo "Tell me a name for the client cert"
  102.             echo "Please, use one word only, no special characters"
  103.             read -p "Client name: " -e -i client CLIENT
  104.             cd /etc/openvpn/easy-rsa/
  105.             ./easyrsa build-client-full $CLIENT nopass
  106.             # Generates the custom client.ovpn
  107.             newclient "$CLIENT"
  108.             echo ""
  109.             echo "Client $CLIENT added, certs available at ~/$CLIENT.ovpn"
  110.             exit
  111.             ;;
  112.             2)
  113.             NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V")
  114.             if [[ "$NUMBEROFCLIENTS" = '0' ]]; then
  115.                 echo ""
  116.                 echo "You have no existing clients!"
  117.                 exit 5
  118.             fi
  119.             echo ""
  120.             echo "Select the existing client certificate you want to revoke"
  121.             tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
  122.             if [[ "$NUMBEROFCLIENTS" = '1' ]]; then
  123.                 read -p "Select one client [1]: " CLIENTNUMBER
  124.             else
  125.                 read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER
  126.             fi
  127.             CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p)
  128.             cd /etc/openvpn/easy-rsa/
  129.             ./easyrsa --batch revoke $CLIENT
  130.             ./easyrsa gen-crl
  131.             rm -rf pki/reqs/$CLIENT.req
  132.             rm -rf pki/private/$CLIENT.key
  133.             rm -rf pki/issued/$CLIENT.crt
  134.             rm -rf /etc/openvpn/crl.pem
  135.             cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem
  136.             echo ""
  137.             echo "Certificate for client $CLIENT revoked"
  138.             echo "Exiting..."
  139.             exit
  140.             ;;
  141.             3)
  142.             echo ""
  143.             read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE
  144.             if [[ "$REMOVE" = 'y' ]]; then
  145.                 PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2)
  146.                 if pgrep firewalld; then
  147.                     # Using both permanent and not permanent rules to avoid a firewalld reload.
  148.                     firewall-cmd --zone=public --remove-port=$PORT/udp
  149.                     firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
  150.                     firewall-cmd --permanent --zone=public --remove-port=$PORT/udp
  151.                     firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
  152.                 fi
  153.                 if iptables -L -n | grep -qE 'REJECT|DROP'; then
  154.                     sed -i "/iptables -I INPUT -p udp --dport $PORT -j ACCEPT/d" $RCLOCAL
  155.                     sed -i "/iptables -I FORWARD -s 10.8.0.0\/24 -j ACCEPT/d" $RCLOCAL
  156.                     sed -i "/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT/d" $RCLOCAL
  157.                 fi
  158.                 sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -j SNAT --to /d' $RCLOCAL
  159.                 if hash sestatus 2>/dev/null; then
  160.                     if sestatus | grep "Current mode" | grep -qs "enforcing"; then
  161.                         if [[ "$PORT" != '1194' ]]; then
  162.                             semanage port -d -t openvpn_port_t -p udp $PORT
  163.                         fi
  164.                     fi
  165.                 fi
  166.                 if [[ "$OS" = 'debian' ]]; then
  167.                     apt-get remove --purge -y openvpn openvpn-blacklist
  168.                 elif [[ "$OS" = 'arch' ]]; then
  169.                     pacman -R openvpn --noconfirm
  170.                 else
  171.                     yum remove openvpn -y
  172.                 fi
  173.                 rm -rf /etc/openvpn
  174.                 rm -rf /usr/share/doc/openvpn*
  175.                 echo ""
  176.                 echo "OpenVPN removed!"
  177.             else
  178.                 echo ""
  179.                 echo "Removal aborted!"
  180.             fi
  181.             exit
  182.             ;;
  183.             4) exit;;
  184.         esac
  185.     done
  186. else
  187.     clear
  188.     echo "Welcome to the secure OpenVPN installer (github.com/SwiftfireDev/OpenVPN-install)"
  189.     echo ""
  190.     # OpenVPN setup and first user creation
  191.     echo "I need to ask you a few questions before starting the setup"
  192.     echo "You can leave the default options and just press enter if you are ok with them"
  193.     echo ""
  194.     echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to."
  195.     echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)"
  196.     echo "Otherwise, it should be your public IPv4 address."
  197.     read -p "IP address: " -e -i $IP IP
  198.     echo ""
  199.     echo "What port do you want for OpenVPN?"
  200.     read -p "Port: " -e -i 1194 PORT
  201.     echo ""
  202.     echo "What protocol do you want for OpenVPN?"
  203.     echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)"
  204.     while [[ $PROTOCOL != "UDP" && $PROTOCOL != "TCP" ]]; do
  205.         read -p "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL
  206.     done
  207.     echo ""
  208.     echo "What DNS do you want to use with the VPN?"
  209.     echo "   1) Current system resolvers (/etc/resolv.conf)"
  210.     echo "   2) FDN (France)"
  211.     echo "   3) DNS.WATCH (Germany)"
  212.     echo "   4) OpenDNS (Anycast: worldwide)"
  213.     echo "   5) Google (Anycast: worldwide)"
  214.     while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" ]]; do
  215.         read -p "DNS [1-5]: " -e -i 2 DNS
  216.     done
  217.     echo ""
  218.     echo "See https://github.com/SwiftfireDev/OpenVPN-install#encryption to learn more about "
  219.     echo "the encryption in OpenVPN and the choices I made in this script."
  220.     echo "Please note that all the choices proposed are secure (to a different degree)"
  221.     echo "and are still viable to date, unlike some default OpenVPN options"
  222.     echo ''
  223.     echo "Choose which cipher you want to use for the data channel:"
  224.     echo "   1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)"
  225.     echo "   2) AES-192-CBC"
  226.     echo "   3) AES-256-CBC"
  227.     echo "Alternatives to AES, use them only if you know what you're doing."
  228.     echo "They are relatively slower but as secure as AES."
  229.     echo "   4) CAMELLIA-128-CBC"
  230.     echo "   5) CAMELLIA-192-CBC"
  231.     echo "   6) CAMELLIA-256-CBC"
  232.     echo "   7) SEED-CBC"
  233.     while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" && $CIPHER != "7" ]]; do
  234.         read -p "Cipher [1-7]: " -e -i 1 CIPHER
  235.     done
  236.     case $CIPHER in
  237.         1)
  238.         CIPHER="cipher AES-128-CBC"
  239.         ;;
  240.         2)
  241.         CIPHER="cipher AES-192-CBC"
  242.         ;;
  243.         3)
  244.         CIPHER="cipher AES-256-CBC"
  245.         ;;
  246.         4)
  247.         CIPHER="cipher CAMELLIA-128-CBC"
  248.         ;;
  249.         5)
  250.         CIPHER="cipher CAMELLIA-192-CBC"
  251.         ;;
  252.         6)
  253.         CIPHER="cipher CAMELLIA-256-CBC"
  254.         ;;
  255.         5)
  256.         CIPHER="cipher SEED-CBC"
  257.         ;;
  258.     esac
  259.     echo ""
  260.     echo "Choose what size of Diffie-Hellman key you want to use:"
  261.     echo "   1) 2048 bits (fastest)"
  262.     echo "   2) 3072 bits (recommended, best compromise)"
  263.     echo "   3) 4096 bits (most secure)"
  264.     while [[ $DH_KEY_SIZE != "1" && $DH_KEY_SIZE != "2" && $DH_KEY_SIZE != "3" ]]; do
  265.         read -p "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE
  266.     done
  267.     case $DH_KEY_SIZE in
  268.         1)
  269.         DH_KEY_SIZE="2048"
  270.         ;;
  271.         2)
  272.         DH_KEY_SIZE="3072"
  273.         ;;
  274.         3)
  275.         DH_KEY_SIZE="4096"
  276.         ;;
  277.     esac
  278.     echo ""
  279.     echo "Choose what size of RSA key you want to use:"
  280.     echo "   1) 2048 bits (fastest)"
  281.     echo "   2) 3072 bits (recommended, best compromise)"
  282.     echo "   3) 4096 bits (most secure)"
  283.     while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do
  284.         read -p "DH key size [1-3]: " -e -i 2 RSA_KEY_SIZE
  285.     done
  286.     case $RSA_KEY_SIZE in
  287.         1)
  288.         RSA_KEY_SIZE="2048"
  289.         ;;
  290.         2)
  291.         RSA_KEY_SIZE="3072"
  292.         ;;
  293.         3)
  294.         RSA_KEY_SIZE="4096"
  295.         ;;
  296.     esac
  297.     echo ""
  298.     echo "Finally, tell me a name for the client certificate and configuration"
  299.     while [[ $CLIENT = "" ]]; do
  300.         echo "Please, use one word only, no special characters"
  301.         read -p "Client name: " -e -i client CLIENT
  302.     done
  303.     echo ""
  304.     echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now"
  305.     read -n1 -r -p "Press any key to continue..."
  306.  
  307.     if [[ "$OS" = 'debian' ]]; then
  308.         apt-get install ca-certificates -y
  309.         # We add the OpenVPN repo to get the latest version.
  310.         # Debian 7
  311.         if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then
  312.             echo "deb http://swupdate.openvpn.net/apt wheezy main" > /etc/apt/sources.list.d/swupdate-openvpn.list
  313.             wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
  314.             apt-get update
  315.         fi
  316.         # Debian 8
  317.         if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then
  318.             echo "deb http://swupdate.openvpn.net/apt jessie main" > /etc/apt/sources.list.d/swupdate-openvpn.list
  319.             wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
  320.             apt update
  321.         fi
  322.         # Ubuntu 12.04
  323.         if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then
  324.             echo "deb http://swupdate.openvpn.net/apt precise main" > /etc/apt/sources.list.d/swupdate-openvpn.list
  325.             wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
  326.             apt-get update
  327.         fi
  328.         # Ubuntu 14.04
  329.         if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then
  330.             echo "deb http://swupdate.openvpn.net/apt trusty main" > /etc/apt/sources.list.d/swupdate-openvpn.list
  331.             wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
  332.             apt-get update
  333.         fi
  334.         # Ubuntu 16.04
  335.         if [[ "$VERSION_ID" = 'VERSION_ID="16.04"' ]]; then
  336.             echo "deb http://build.openvpn.net/debian/openvpn/release/2.4 xenial main" > /etc/apt/sources.list.d/openvpn-aptrepo.list
  337.             wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg|apt-key add -
  338.             apt-get update && apt-get install openvpn
  339.         fi
  340.         # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository.
  341.         # The we install OpenVPN
  342.         #Uncomment line below for older OpenVPN releases and comment out lines 335 - 339
  343.         # apt-get install openvpn iptables openssl wget ca-certificates curl -y
  344.     elif [[ "$OS" = 'centos' ]]; then
  345.         yum install epel-release -y
  346.         yum install openvpn iptables openssl wget ca-certificates curl -y
  347.     else
  348.         # Else, the distro is ArchLinux
  349.         echo ""
  350.         echo ""
  351.         echo "As you're using ArchLinux, I need to update the packages on your system to install those I need."
  352.         echo "Not doing that could cause problems between dependencies, or missing files in repositories."
  353.         echo ""
  354.         echo "Continuing will update your installed packages and install needed ones."
  355.         while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do
  356.             read -p "Continue ? [y/n]: " -e -i y CONTINUE
  357.         done
  358.         if [[ "$CONTINUE" = "n" ]]; then
  359.             echo "Ok, bye !"
  360.             exit 4
  361.         fi
  362.        
  363.         if [[ "$OS" = 'arch' ]]; then
  364.         # Install rc.local
  365.         echo "[Unit]
  366. Description=/etc/rc.local compatibility
  367.  
  368. [Service]
  369. Type=oneshot
  370. ExecStart=/etc/rc.local
  371. RemainAfterExit=yes
  372.  
  373. [Install]
  374. WantedBy=multi-user.target" > /etc/systemd/system/rc-local.service
  375.             chmod +x /etc/rc.local
  376.             systemctl enable rc-local.service
  377.             if ! grep '#!' $RCLOCAL; then
  378.                 echo "#!/bin/bash" > $RCLOCAL
  379.             fi
  380.         fi
  381.        
  382.         # Install dependencies
  383.         pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm
  384.         if [[ "$OS" = 'arch' ]]; then
  385.             touch /etc/iptables/iptables.rules # iptables won't start if this file does not exist
  386.             systemctl enable iptables
  387.             systemctl start iptables
  388.         fi
  389.     fi
  390.     # Find out if the machine uses nogroup or nobody for the permissionless group
  391.     if grep -qs "^nogroup:" /etc/group; then
  392.             NOGROUP=nogroup
  393.     else
  394.             NOGROUP=nobody
  395.     fi
  396.  
  397.     # An old version of easy-rsa was available by default in some openvpn packages
  398.     if [[ -d /etc/openvpn/easy-rsa/ ]]; then
  399.         rm -rf /etc/openvpn/easy-rsa/
  400.     fi
  401.     # Get easy-rsa
  402.     wget -O ~/EasyRSA-3.0.1.tgz https://github.com/OpenVPN/easy-rsa/releases/download/3.0.1/EasyRSA-3.0.1.tgz
  403.     tar xzf ~/EasyRSA-3.0.1.tgz -C ~/
  404.     mv ~/EasyRSA-3.0.1/ /etc/openvpn/
  405.     mv /etc/openvpn/EasyRSA-3.0.1/ /etc/openvpn/easy-rsa/
  406.     chown -R root:root /etc/openvpn/easy-rsa/
  407.     rm -rf ~/EasyRSA-3.0.1.tgz
  408.     cd /etc/openvpn/easy-rsa/
  409.     echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars
  410.     # Create the PKI, set up the CA, the DH params and the server + client certificates
  411.     ./easyrsa init-pki
  412.     ./easyrsa --batch build-ca nopass
  413.     openssl dhparam $DH_KEY_SIZE -out dh.pem
  414.     ./easyrsa build-server-full server nopass
  415.     ./easyrsa build-client-full $CLIENT nopass
  416.     ./easyrsa gen-crl
  417.     # generate tls-crypt key
  418.     openvpn --genkey --secret /etc/openvpn/tls-crypt.key
  419.     # Move all the generated files
  420.     cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn
  421.     # Make cert revocation list readable for non-root
  422.     chmod 644 /etc/openvpn/crl.pem
  423.    
  424.     # Generate server.conf
  425.     # Find out if the machine uses group nogroup or group nobody and edit /etc/openvpn/server.conf if needed
  426.     echo "port $PORT" > /etc/openvpn/server.conf
  427.     if [[ "$PROTOCOL" = 'UDP' ]]; then
  428.         echo "proto udp
  429.         fast-io" >> /etc/openvpn/server.conf
  430.     elif [[ "$PROTOCOL" = 'TCP' ]]; then
  431.         echo "proto tcp-server
  432.         tcp-nodelay" >> /etc/openvpn/server.conf
  433.     fi
  434.     echo "dev tun  
  435. tun-mtu 1500
  436. tun-mtu-extra 32
  437. mssfix 1450
  438. reneg-sec 60
  439. user nobody
  440. group nogroup
  441. persist-key
  442. persist-tun
  443. keepalive 10 120
  444. topology subnet
  445. server 10.8.0.0 255.255.255.0
  446. ifconfig-pool-persist /etc/openvpn/ipp.txt" >> /etc/openvpn/server.conf
  447.     # DNS resolvers
  448.     case $DNS in
  449.         1)
  450.         # Obtain the resolvers from resolv.conf and use them for OpenVPN
  451.         grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do
  452.             echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf
  453.         done
  454.         ;;
  455.         2) #FDN
  456.         echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf
  457.         echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf
  458.         ;;
  459.         3) #DNS.WATCH
  460.         echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf
  461.         echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf
  462.         ;;
  463.         4) #OpenDNS
  464.         echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf
  465.         echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf
  466.         ;;
  467.         5) #Google
  468.         echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf
  469.         echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf
  470.         ;;
  471.     esac
  472. echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf
  473.  
  474. # Change "max-clients 1" to desired number or comment out to remove limit
  475. echo "max-clients 1
  476. crl-verify /etc/openvpn/crl.pem
  477. ca /etc/openvpn/ca.crt
  478. cert /etc/openvpn/server.crt
  479. key /etc/openvpn/server.key
  480. tls-crypt /etc/openvpn/tls-crypt.key 0
  481. dh /etc/openvpn/dh.pem
  482. auth SHA512
  483. $CIPHER
  484. tls-server
  485. tls-version-min 1.2
  486. tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
  487. status openvpn.log
  488. compress lz4
  489. verb 3" >> /etc/openvpn/server.conf
  490.  
  491.     # Create the sysctl configuration file if needed (mainly for Arch Linux)
  492.     if [[ ! -e $SYSCTL ]]; then
  493.         touch $SYSCTL
  494.     fi
  495.  
  496.     # Enable net.ipv4.ip_forward for the system
  497.     sed -i '/\<net.ipv4.ip_forward\>/c\net.ipv4.ip_forward=1' $SYSCTL
  498.     if ! grep -q "\<net.ipv4.ip_forward\>" $SYSCTL; then
  499.         echo 'net.ipv4.ip_forward=1' >> $SYSCTL
  500.     fi
  501.     # Avoid an unneeded reboot
  502.     echo 1 > /proc/sys/net/ipv4/ip_forward
  503.     # Set NAT for the VPN subnet
  504.     iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to $IP
  505.     sed -i "1 a\iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to $IP" $RCLOCAL
  506.     if pgrep firewalld; then
  507.         # We don't use --add-service=openvpn because that would only work with
  508.         # the default port. Using both permanent and not permanent rules to
  509.         # avoid a firewalld reload.
  510.         if [[ "$PROTOCOL" = 'UDP' ]]; then
  511.             firewall-cmd --zone=public --add-port=$PORT/udp
  512.             firewall-cmd --permanent --zone=public --add-port=$PORT/udp
  513.         elif [[ "$PROTOCOL" = 'TCP' ]]; then
  514.             firewall-cmd --zone=public --add-port=$PORT/tcp
  515.             firewall-cmd --permanent --zone=public --add-port=$PORT/tcp
  516.         fi
  517.         firewall-cmd --zone=trusted --add-source=10.8.0.0/24
  518.         firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
  519.     fi
  520.     if iptables -L -n | grep -qE 'REJECT|DROP'; then
  521.         # If iptables has at least one REJECT rule, we asume this is needed.
  522.         # Not the best approach but I can't think of other and this shouldn't
  523.         # cause problems.
  524.         if [[ "$PROTOCOL" = 'UDP' ]]; then
  525.             iptables -I INPUT -p udp --dport $PORT -j ACCEPT
  526.         elif [[ "$PROTOCOL" = 'TCP' ]]; then
  527.             iptables -I INPUT -p tcp --dport $PORT -j ACCEPT
  528.         fi
  529.         iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
  530.         iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
  531.         if [[ "$PROTOCOL" = 'UDP' ]]; then
  532.             sed -i "1 a\iptables -I INPUT -p udp --dport $PORT -j ACCEPT" $RCLOCAL
  533.         elif [[ "$PROTOCOL" = 'TCP' ]]; then
  534.             sed -i "1 a\iptables -I INPUT -p tcp --dport $PORT -j ACCEPT" $RCLOCAL
  535.         fi
  536.         sed -i "1 a\iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT" $RCLOCAL
  537.         sed -i "1 a\iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" $RCLOCAL
  538.     fi
  539.     # If SELinux is enabled and a custom port was selected, we need this
  540.     if hash sestatus 2>/dev/null; then
  541.         if sestatus | grep "Current mode" | grep -qs "enforcing"; then
  542.             if [[ "$PORT" != '1194' ]]; then
  543.                 # semanage isn't available in CentOS 6 by default
  544.                 if ! hash semanage 2>/dev/null; then
  545.                     yum install policycoreutils-python -y
  546.                 fi
  547.                 if [[ "$PROTOCOL" = 'UDP' ]]; then
  548.                     semanage port -a -t openvpn_port_t -p udp $PORT
  549.                 elif [[ "$PROTOCOL" = 'TCP' ]]; then
  550.                     semanage port -a -t openvpn_port_t -p tcp $PORT
  551.                 fi
  552.             fi
  553.         fi
  554.     fi
  555.     # And finally, restart OpenVPN
  556.     if [[ "$OS" = 'debian' ]]; then
  557.         # Little hack to check for systemd
  558.         if pgrep systemd-journal; then
  559.             systemctl restart openvpn@server.service
  560.         else
  561.             /etc/init.d/openvpn restart
  562.         fi
  563.     else
  564.         if pgrep systemd-journal; then
  565.             systemctl restart openvpn@server.service
  566.             systemctl enable openvpn@server.service
  567.         else
  568.             service openvpn restart
  569.             chkconfig openvpn on
  570.         fi
  571.     fi
  572.     # Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users
  573.     EXTERNALIP=$(wget -4qO- "http://whatismyip.akamai.com/")
  574.     if [[ "$IP" != "$EXTERNALIP" ]]; then
  575.         echo ""
  576.         echo "Looks like your server is behind a NAT!"
  577.         echo ""
  578.                 echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router),"
  579.                 echo "then I need to know the address that can be used to access it from outside."
  580.                 echo "If that's not the case, just ignore this and leave the next field blank"
  581.                 read -p "External IP or domain name: " -e USEREXTERNALIP
  582.         if [[ "$USEREXTERNALIP" != "" ]]; then
  583.             IP=$USEREXTERNALIP
  584.         fi
  585.     fi
  586.     # client-template.txt is created so we have a template to add further users later
  587.     # check whether
  588.     echo "client" > /etc/openvpn/client-template.txt
  589.     if [[ "$PROTOCOL" = 'UDP' ]]; then
  590.         echo "proto udp
  591.         fast-io" >> /etc/openvpn/client-template.txt
  592.     elif [[ "$PROTOCOL" = 'TCP' ]]; then
  593.         echo "proto tcp-client" >> /etc/openvpn/client-template.txt
  594.     fi
  595.     echo "remote $IP $PORT
  596. dev tun
  597. user nobody
  598. group nobody
  599. resolv-retry infinite
  600. tun-mtu 1500
  601. tun-mtu-extra 32
  602. mssfix 1450
  603. reneg-sec 0
  604. nobind
  605. persist-key
  606. persist-tun
  607. remote-cert-tls server
  608. auth SHA512
  609. $CIPHER
  610. tls-client
  611. tls-version-min 1.2
  612. tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
  613. verb 3
  614. compress lz4
  615. key-direction 1" >> /etc/openvpn/client-template.txt
  616.  
  617.     # Find out if the machine uses group nogroup or group nobody and edit client.ovpn if needed
  618.     # Generate the custom client.ovpn
  619.     newclient "$CLIENT"
  620.     echo ""
  621.     echo "Finished!"
  622.     echo ""
  623.     echo "Your client config is available at ~/$CLIENT.ovpn"
  624.     echo "If you want to add more clients, you simply need to run this script another time!"
  625. fi
  626. exit 0;
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!