API tools faq
paste
Advertisement
MertcanGokgoz

OpenVPN install(fix)

MertcanGokgoz
Dec 30th, 2018
1,044
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 22.12 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2.  
  3.  
  4. if [[ "$EUID" -ne 0 ]]; then
  5.     echo "Sorry, you need to run this as root"
  6.     exit 1
  7. fi
  8.  
  9. if [[ ! -e /dev/net/tun ]]; then
  10.     echo "TUN is not available"
  11.     exit 2
  12. fi
  13.  
  14. if grep -qs "CentOS release 5" "/etc/redhat-release"; then
  15.     echo "CentOS 5 is too old and not supported"
  16.     exit 3
  17. fi
  18.  
  19. if [[ -e /etc/debian_version ]]; then
  20.     OS="debian"
  21.     # Getting the version number, to verify that a recent version of OpenVPN is available
  22.     VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID")
  23.     RCLOCAL='/etc/rc.local'
  24.     SYSCTL='/etc/sysctl.conf'
  25.     if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then
  26.         echo "Your version of Debian/Ubuntu is not supported."
  27.         echo "I can't install a recent version of OpenVPN on your system."
  28.         echo ""
  29.         echo "However, if you're using Debian unstable/testing, or Ubuntu beta,"
  30.         echo "then you can continue, a recent version of OpenVPN is available on these."
  31.         echo "Keep in mind they are not supported, though."
  32.         while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do
  33.             read -p "Continue ? [y/n]: " -e CONTINUE
  34.         done
  35.         if [[ "$CONTINUE" = "n" ]]; then
  36.             echo "Ok, bye !"
  37.             exit 4
  38.         fi
  39.     fi
  40. elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then
  41.     OS=centos
  42.     RCLOCAL='/etc/rc.d/rc.local'
  43.     SYSCTL='/etc/sysctl.conf'
  44.     # Needed for CentOS 7
  45.     chmod +x /etc/rc.d/rc.local
  46. elif [[ -e /etc/arch-release ]]; then
  47.     OS=arch
  48.     RCLOCAL='/etc/rc.local'
  49.     SYSCTL='/etc/sysctl.d/openvpn.conf'
  50. else
  51.     echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system"
  52.     exit 4
  53. fi
  54.  
  55. newclient () {
  56.     # Generates the custom client.ovpn
  57.     cp /etc/openvpn/client-template.txt ~/$1.ovpn
  58.     echo "<ca>" >> ~/$1.ovpn
  59.     cat /etc/openvpn/easy-rsa/pki/ca.crt >> ~/$1.ovpn
  60.     echo "</ca>" >> ~/$1.ovpn
  61.     echo "<cert>" >> ~/$1.ovpn
  62.     cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> ~/$1.ovpn
  63.     echo "</cert>" >> ~/$1.ovpn
  64.     echo "<key>" >> ~/$1.ovpn
  65.     cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ~/$1.ovpn
  66.     echo "</key>" >> ~/$1.ovpn
  67.     echo "key-direction 1" >> ~/$1.ovpn
  68.     echo "<tls-auth>" >> ~/$1.ovpn
  69.     cat /etc/openvpn/tls-auth.key >> ~/$1.ovpn
  70.     echo "</tls-auth>" >> ~/$1.ovpn
  71. }
  72.  
  73. # Try to get our IP from the system and fallback to the Internet.
  74. # I do this to make the script compatible with NATed servers (LowEndSpirit/Scaleway)
  75. # and to avoid getting an IPv6.
  76. IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
  77. if [[ "$IP" = "" ]]; then
  78.     IP=$(wget -qO- ipv4.icanhazip.com)
  79. fi
  80. # Get Internet network interface with default route
  81. NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)')
  82.  
  83. if [[ -e /etc/openvpn/server.conf ]]; then
  84.     while :
  85.     do
  86.     clear
  87.         echo "OpenVPN-install (github.com/Angristan/OpenVPN-install)"
  88.         echo ""
  89.         echo "Looks like OpenVPN is already installed"
  90.         echo ""
  91.         echo "What do you want to do?"
  92.         echo "   1) Add a cert for a new user"
  93.         echo "   2) Revoke existing user cert"
  94.         echo "   3) Remove OpenVPN"
  95.         echo "   4) Exit"
  96.         read -p "Select an option [1-4]: " option
  97.         case $option in
  98.             1)
  99.             echo ""
  100.             echo "Tell me a name for the client cert"
  101.             echo "Please, use one word only, no special characters"
  102.             read -p "Client name: " -e -i client CLIENT
  103.             cd /etc/openvpn/easy-rsa/
  104.             ./easyrsa build-client-full $CLIENT nopass
  105.             # Generates the custom client.ovpn
  106.             newclient "$CLIENT"
  107.             echo ""
  108.             echo "Client $CLIENT added, certs available at ~/$CLIENT.ovpn"
  109.             exit
  110.             ;;
  111.             2)
  112.             NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V")
  113.             if [[ "$NUMBEROFCLIENTS" = '0' ]]; then
  114.                 echo ""
  115.                 echo "You have no existing clients!"
  116.                 exit 5
  117.             fi
  118.             echo ""
  119.             echo "Select the existing client certificate you want to revoke"
  120.             tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
  121.             if [[ "$NUMBEROFCLIENTS" = '1' ]]; then
  122.                 read -p "Select one client [1]: " CLIENTNUMBER
  123.             else
  124.                 read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER
  125.             fi
  126.             CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p)
  127.             cd /etc/openvpn/easy-rsa/
  128.             ./easyrsa --batch revoke $CLIENT
  129.             ./easyrsa gen-crl
  130.             rm -rf pki/reqs/$CLIENT.req
  131.             rm -rf pki/private/$CLIENT.key
  132.             rm -rf pki/issued/$CLIENT.crt
  133.             rm -rf /etc/openvpn/crl.pem
  134.             cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem
  135.             chmod 644 /etc/openvpn/crl.pem
  136.             echo ""
  137.             echo "Certificate for client $CLIENT revoked"
  138.             echo "Exiting..."
  139.             exit
  140.             ;;
  141.             3)
  142.             echo ""
  143.             read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE
  144.             if [[ "$REMOVE" = 'y' ]]; then
  145.                 PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2)
  146.                 if pgrep firewalld; then
  147.                     # Using both permanent and not permanent rules to avoid a firewalld reload.
  148.                     firewall-cmd --zone=public --remove-port=$PORT/udp
  149.                     firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
  150.                     firewall-cmd --permanent --zone=public --remove-port=$PORT/udp
  151.                     firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
  152.                 fi
  153.                 if iptables -L -n | grep -qE 'REJECT|DROP'; then
  154.                     sed -i "/iptables -I INPUT -p udp --dport $PORT -j ACCEPT/d" $RCLOCAL
  155.                     sed -i "/iptables -I FORWARD -s 10.8.0.0\/24 -j ACCEPT/d" $RCLOCAL
  156.                     sed -i "/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT/d" $RCLOCAL
  157.                 fi
  158.                 sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -j SNAT --to /d' $RCLOCAL
  159.                 if hash sestatus 2>/dev/null; then
  160.                     if sestatus | grep "Current mode" | grep -qs "enforcing"; then
  161.                         if [[ "$PORT" != '1194' ]]; then
  162.                             semanage port -d -t openvpn_port_t -p udp $PORT
  163.                         fi
  164.                     fi
  165.                 fi
  166.                 if [[ "$OS" = 'debian' ]]; then
  167.                     apt-get autoremove --purge -y openvpn
  168.                 elif [[ "$OS" = 'arch' ]]; then
  169.                     pacman -R openvpn --noconfirm
  170.                 else
  171.                     yum remove openvpn -y
  172.                 fi
  173.                 rm -rf /etc/openvpn
  174.                 rm -rf /usr/share/doc/openvpn*
  175.                 echo ""
  176.                 echo "OpenVPN removed!"
  177.             else
  178.                 echo ""
  179.                 echo "Removal aborted!"
  180.             fi
  181.             exit
  182.             ;;
  183.             4) exit;;
  184.         esac
  185.     done
  186. else
  187.     clear
  188.     echo "Welcome to the secure OpenVPN installer (github.com/Angristan/OpenVPN-install)"
  189.     echo ""
  190.     # OpenVPN setup and first user creation
  191.     echo "I need to ask you a few questions before starting the setup"
  192.     echo "You can leave the default options and just press enter if you are ok with them"
  193.     echo ""
  194.     echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to."
  195.     echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)"
  196.     echo "Otherwise, it should be your public IPv4 address."
  197.     read -p "IP address: " -e -i $IP IP
  198.     echo ""
  199.     echo "What port do you want for OpenVPN?"
  200.     read -p "Port: " -e -i 1194 PORT
  201.     echo ""
  202.     echo "What protocol do you want for OpenVPN?"
  203.     echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)"
  204.     while [[ $PROTOCOL != "UDP" && $PROTOCOL != "TCP" ]]; do
  205.         read -p "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL
  206.     done
  207.     echo ""
  208.     echo "What DNS do you want to use with the VPN?"
  209.     echo "   1) Current system resolvers (in /etc/resolv.conf)"
  210.     echo "   2) FDN (France)"
  211.     echo "   3) DNS.WATCH (Germany)"
  212.     echo "   4) OpenDNS (Anycast: worldwide)"
  213.     echo "   5) Google (Anycast: worldwide)"
  214.     echo "   6) Yandex Basic (Russia)"
  215.     while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" ]]; do
  216.         read -p "DNS [1-5]: " -e -i 1 DNS
  217.     done
  218.     echo ""
  219.     echo "See https://github.com/Angristan/OpenVPN-install#encryption to learn more about "
  220.     echo "the encryption in OpenVPN and the choices I made in this script."
  221.     echo "Please note that all the choices proposed are secure (to a different degree)"
  222.     echo "and are still viable to date, unlike some default OpenVPN options"
  223.     echo ''
  224.     echo "Choose which cipher you want to use for the data channel:"
  225.     echo "   1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)"
  226.     echo "   2) AES-192-CBC"
  227.     echo "   3) AES-256-CBC"
  228.     echo "Alternatives to AES, use them only if you know what you're doing."
  229.     echo "They are relatively slower but as secure as AES."
  230.     echo "   4) CAMELLIA-128-CBC"
  231.     echo "   5) CAMELLIA-192-CBC"
  232.     echo "   6) CAMELLIA-256-CBC"
  233.     echo "   7) SEED-CBC"
  234.     while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" && $CIPHER != "7" ]]; do
  235.         read -p "Cipher [1-7]: " -e -i 1 CIPHER
  236.     done
  237.     case $CIPHER in
  238.         1)
  239.         CIPHER="cipher AES-128-CBC"
  240.         ;;
  241.         2)
  242.         CIPHER="cipher AES-192-CBC"
  243.         ;;
  244.         3)
  245.         CIPHER="cipher AES-256-CBC"
  246.         ;;
  247.         4)
  248.         CIPHER="cipher CAMELLIA-128-CBC"
  249.         ;;
  250.         5)
  251.         CIPHER="cipher CAMELLIA-192-CBC"
  252.         ;;
  253.         6)
  254.         CIPHER="cipher CAMELLIA-256-CBC"
  255.         ;;
  256.         7)
  257.         CIPHER="cipher SEED-CBC"
  258.         ;;
  259.     esac
  260.     echo ""
  261.     echo "Choose what size of Diffie-Hellman key you want to use:"
  262.     echo "   1) 2048 bits (fastest)"
  263.     echo "   2) 3072 bits (recommended, best compromise)"
  264.     echo "   3) 4096 bits (most secure)"
  265.     while [[ $DH_KEY_SIZE != "1" && $DH_KEY_SIZE != "2" && $DH_KEY_SIZE != "3" ]]; do
  266.         read -p "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE
  267.     done
  268.     case $DH_KEY_SIZE in
  269.         1)
  270.         DH_KEY_SIZE="2048"
  271.         ;;
  272.         2)
  273.         DH_KEY_SIZE="3072"
  274.         ;;
  275.         3)
  276.         DH_KEY_SIZE="4096"
  277.         ;;
  278.     esac
  279.     echo ""
  280.     echo "Choose what size of RSA key you want to use:"
  281.     echo "   1) 2048 bits (fastest)"
  282.     echo "   2) 3072 bits (recommended, best compromise)"
  283.     echo "   3) 4096 bits (most secure)"
  284.     while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do
  285.         read -p "DH key size [1-3]: " -e -i 2 RSA_KEY_SIZE
  286.     done
  287.     case $RSA_KEY_SIZE in
  288.         1)
  289.         RSA_KEY_SIZE="2048"
  290.         ;;
  291.         2)
  292.         RSA_KEY_SIZE="3072"
  293.         ;;
  294.         3)
  295.         RSA_KEY_SIZE="4096"
  296.         ;;
  297.     esac
  298.     echo ""
  299.     echo "Finally, tell me a name for the client certificate and configuration"
  300.     while [[ $CLIENT = "" ]]; do
  301.         echo "Please, use one word only, no special characters"
  302.         read -p "Client name: " -e -i client CLIENT
  303.     done
  304.     echo ""
  305.     echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now"
  306.     read -n1 -r -p "Press any key to continue..."
  307.  
  308.     if [[ "$OS" = 'debian' ]]; then
  309.         apt-get install ca-certificates -y
  310.         # We add the OpenVPN repo to get the latest version.
  311.         # Debian 7
  312.         if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then
  313.             echo "deb http://swupdate.openvpn.net/apt wheezy main" > /etc/apt/sources.list.d/swupdate-openvpn.list
  314.             wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
  315.             apt-get update
  316.         fi
  317.         # Debian 8
  318.         if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then
  319.             echo "deb http://swupdate.openvpn.net/apt jessie main" > /etc/apt/sources.list.d/swupdate-openvpn.list
  320.             wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
  321.             apt update
  322.         fi
  323.         # Ubuntu 12.04
  324.         if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then
  325.             echo "deb http://swupdate.openvpn.net/apt precise main" > /etc/apt/sources.list.d/swupdate-openvpn.list
  326.             wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
  327.             apt-get update
  328.         fi
  329.         # Ubuntu 14.04
  330.         if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then
  331.             echo "deb http://swupdate.openvpn.net/apt trusty main" > /etc/apt/sources.list.d/swupdate-openvpn.list
  332.             wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
  333.             apt-get update
  334.         fi
  335.         # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository.
  336.         # The we install OpenVPN
  337.         apt-get install openvpn iptables openssl wget ca-certificates curl -y
  338.     elif [[ "$OS" = 'centos' ]]; then
  339.         yum install epel-release -y
  340.         yum install openvpn iptables openssl wget ca-certificates curl -y
  341.     else
  342.         # Else, the distro is ArchLinux
  343.         echo ""
  344.         echo ""
  345.         echo "As you're using ArchLinux, I need to update the packages on your system to install those I need."
  346.         echo "Not doing that could cause problems between dependencies, or missing files in repositories."
  347.         echo ""
  348.         echo "Continuing will update your installed packages and install needed ones."
  349.         while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do
  350.             read -p "Continue ? [y/n]: " -e -i y CONTINUE
  351.         done
  352.         if [[ "$CONTINUE" = "n" ]]; then
  353.             echo "Ok, bye !"
  354.             exit 4
  355.         fi
  356.        
  357.         if [[ "$OS" = 'arch' ]]; then
  358.         # Install rc.local
  359.         echo "[Unit]
  360. Description=/etc/rc.local compatibility
  361.  
  362. [Service]
  363. Type=oneshot
  364. ExecStart=/etc/rc.local
  365. RemainAfterExit=yes
  366.  
  367. [Install]
  368. WantedBy=multi-user.target" > /etc/systemd/system/rc-local.service
  369.             chmod +x /etc/rc.local
  370.             systemctl enable rc-local.service
  371.             if ! grep '#!' $RCLOCAL; then
  372.                 echo "#!/bin/bash" > $RCLOCAL
  373.             fi
  374.         fi
  375.        
  376.         # Install dependencies
  377.         pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm
  378.         if [[ "$OS" = 'arch' ]]; then
  379.             touch /etc/iptables/iptables.rules # iptables won't start if this file does not exist
  380.             systemctl enable iptables
  381.             systemctl start iptables
  382.         fi
  383.     fi
  384.     # Find out if the machine uses nogroup or nobody for the permissionless group
  385.     if grep -qs "^nogroup:" /etc/group; then
  386.             NOGROUP=nogroup
  387.     else
  388.             NOGROUP=nobody
  389.     fi
  390.  
  391.     # An old version of easy-rsa was available by default in some openvpn packages
  392.     if [[ -d /etc/openvpn/easy-rsa/ ]]; then
  393.         rm -rf /etc/openvpn/easy-rsa/
  394.     fi
  395.     # Get easy-rsa
  396.     wget -O ~/EasyRSA-3.0.1.tgz https://github.com/OpenVPN/easy-rsa/releases/download/3.0.1/EasyRSA-3.0.1.tgz
  397.     tar xzf ~/EasyRSA-3.0.1.tgz -C ~/
  398.     mv ~/EasyRSA-3.0.1/ /etc/openvpn/
  399.     mv /etc/openvpn/EasyRSA-3.0.1/ /etc/openvpn/easy-rsa/
  400.     chown -R root:root /etc/openvpn/easy-rsa/
  401.     rm -rf ~/EasyRSA-3.0.1.tgz
  402.     cd /etc/openvpn/easy-rsa/
  403.     echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars
  404.     # Create the PKI, set up the CA, the DH params and the server + client certificates
  405.     ./easyrsa init-pki
  406.     ./easyrsa --batch build-ca nopass
  407.     openssl dhparam -out dh.pem $DH_KEY_SIZE
  408.     ./easyrsa build-server-full server nopass
  409.     ./easyrsa build-client-full $CLIENT nopass
  410.     ./easyrsa gen-crl
  411.     # generate tls-auth key
  412.     openvpn --genkey --secret /etc/openvpn/tls-auth.key
  413.     # Move all the generated files
  414.     cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn
  415.     # Make cert revocation list readable for non-root
  416.     chmod 644 /etc/openvpn/crl.pem
  417.    
  418.     # Generate server.conf
  419.     echo "port $PORT" > /etc/openvpn/server.conf
  420.     if [[ "$PROTOCOL" = 'UDP' ]]; then
  421.         echo "proto udp" >> /etc/openvpn/server.conf
  422.     elif [[ "$PROTOCOL" = 'TCP' ]]; then
  423.         echo "proto tcp" >> /etc/openvpn/server.conf
  424.     fi
  425.     echo "dev tun
  426. user nobody
  427. group $NOGROUP
  428. persist-key
  429. persist-tun
  430. keepalive 10 120
  431. comp-lzo no
  432. topology subnet
  433. server 10.8.0.0 255.255.255.0
  434. ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf
  435.     # DNS resolvers
  436.     case $DNS in
  437.         1)
  438.         # Obtain the resolvers from resolv.conf and use them for OpenVPN
  439.         grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do
  440.             echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf
  441.         done
  442.         ;;
  443.         2) #FDN
  444.         echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf
  445.         echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf
  446.         ;;
  447.         3) #DNS.WATCH
  448.         echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf
  449.         echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf
  450.         ;;
  451.         4) #OpenDNS
  452.         echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf
  453.         echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf
  454.         ;;
  455.         5) #Google
  456.         echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf
  457.         echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf
  458.         ;;
  459.         6) #Yandex Basic
  460.         echo 'push "dhcp-option DNS 77.88.8.8"' >> /etc/openvpn/server.conf
  461.         echo 'push "dhcp-option DNS 77.88.8.1"' >> /etc/openvpn/server.conf
  462.         ;;
  463.     esac
  464. echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf
  465. echo "crl-verify crl.pem
  466. ca ca.crt
  467. cert server.crt
  468. key server.key
  469. tls-auth tls-auth.key 0
  470. dh dh.pem
  471. comp-lzo
  472. auth SHA512
  473. $CIPHER
  474. tls-server
  475. tls-version-min 1.2
  476. tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
  477. status openvpn.log
  478. verb 3" >> /etc/openvpn/server.conf
  479.  
  480.     # Create the sysctl configuration file if needed (mainly for Arch Linux)
  481.     if [[ ! -e $SYSCTL ]]; then
  482.         touch $SYSCTL
  483.     fi
  484.  
  485.     # Enable net.ipv4.ip_forward for the system
  486.     sed -i '/\<net.ipv4.ip_forward\>/c\net.ipv4.ip_forward=1' $SYSCTL
  487.     if ! grep -q "\<net.ipv4.ip_forward\>" $SYSCTL; then
  488.         echo 'net.ipv4.ip_forward=1' >> $SYSCTL
  489.     fi
  490.     # Avoid an unneeded reboot
  491.     echo 1 > /proc/sys/net/ipv4/ip_forward
  492.     # Needed to use rc.local with some systemd distros
  493.     if [[ "$OS" = 'debian' && ! -e $RCLOCAL ]]; then
  494.         echo '#!/bin/sh -e
  495. exit 0' > $RCLOCAL
  496.     fi
  497.     chmod +x $RCLOCAL
  498.     # Set NAT for the VPN subnet
  499.     iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE
  500.     sed -i "1 a\iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE" $RCLOCAL
  501.     if pgrep firewalld; then
  502.         # We don't use --add-service=openvpn because that would only work with
  503.         # the default port. Using both permanent and not permanent rules to
  504.         # avoid a firewalld reload.
  505.         if [[ "$PROTOCOL" = 'UDP' ]]; then
  506.             firewall-cmd --zone=public --add-port=$PORT/udp
  507.             firewall-cmd --permanent --zone=public --add-port=$PORT/udp
  508.         elif [[ "$PROTOCOL" = 'TCP' ]]; then
  509.             firewall-cmd --zone=public --add-port=$PORT/tcp
  510.             firewall-cmd --permanent --zone=public --add-port=$PORT/tcp
  511.         fi
  512.         firewall-cmd --zone=trusted --add-source=10.8.0.0/24
  513.         firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
  514.     fi
  515.     if iptables -L -n | grep -qE 'REJECT|DROP'; then
  516.         # If iptables has at least one REJECT rule, we asume this is needed.
  517.         # Not the best approach but I can't think of other and this shouldn't
  518.         # cause problems.
  519.         if [[ "$PROTOCOL" = 'UDP' ]]; then
  520.             iptables -I INPUT -p udp --dport $PORT -j ACCEPT
  521.         elif [[ "$PROTOCOL" = 'TCP' ]]; then
  522.             iptables -I INPUT -p tcp --dport $PORT -j ACCEPT
  523.         fi
  524.         iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
  525.         iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
  526.         if [[ "$PROTOCOL" = 'UDP' ]]; then
  527.             sed -i "1 a\iptables -I INPUT -p udp --dport $PORT -j ACCEPT" $RCLOCAL
  528.         elif [[ "$PROTOCOL" = 'TCP' ]]; then
  529.             sed -i "1 a\iptables -I INPUT -p tcp --dport $PORT -j ACCEPT" $RCLOCAL
  530.         fi
  531.         sed -i "1 a\iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT" $RCLOCAL
  532.         sed -i "1 a\iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" $RCLOCAL
  533.     fi
  534.     # If SELinux is enabled and a custom port was selected, we need this
  535.     if hash sestatus 2>/dev/null; then
  536.         if sestatus | grep "Current mode" | grep -qs "enforcing"; then
  537.             if [[ "$PORT" != '1194' ]]; then
  538.                 # semanage isn't available in CentOS 6 by default
  539.                 if ! hash semanage 2>/dev/null; then
  540.                     yum install policycoreutils-python -y
  541.                 fi
  542.                 if [[ "$PROTOCOL" = 'UDP' ]]; then
  543.                     semanage port -a -t openvpn_port_t -p udp $PORT
  544.                 elif [[ "$PROTOCOL" = 'TCP' ]]; then
  545.                     semanage port -a -t openvpn_port_t -p tcp $PORT
  546.                 fi
  547.             fi
  548.         fi
  549.     fi
  550.     # And finally, restart OpenVPN
  551.     if [[ "$OS" = 'debian' ]]; then
  552.         # Little hack to check for systemd
  553.         if pgrep systemd-journal; then
  554.             systemctl restart openvpn@server.service
  555.         else
  556.             /etc/init.d/openvpn restart
  557.         fi
  558.     else
  559.         if pgrep systemd-journal; then
  560.             if [[ "$OS" = 'arch' ]]; then
  561.                 #Workaround to avoid rewriting the entire script for Arch
  562.                 sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service
  563.                 sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service
  564.                 systemctl daemon-reload
  565.                 systemctl restart openvpn-server@openvpn.service
  566.                 systemctl enable openvpn-server@openvpn.service
  567.             else
  568.                 systemctl restart openvpn@server.service
  569.                 systemctl enable openvpn@server.service
  570.             fi
  571.         else
  572.             service openvpn restart
  573.             chkconfig openvpn on
  574.         fi
  575.     fi
  576.     # Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users
  577.     EXTERNALIP=$(wget -qO- ipv4.icanhazip.com)
  578.     if [[ "$IP" != "$EXTERNALIP" ]]; then
  579.         echo ""
  580.         echo "Looks like your server is behind a NAT!"
  581.         echo ""
  582.                 echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router),"
  583.                 echo "then I need to know the address that can be used to access it from outside."
  584.                 echo "If that's not the case, just ignore this and leave the next field blank"
  585.                 read -p "External IP or domain name: " -e USEREXTERNALIP
  586.         if [[ "$USEREXTERNALIP" != "" ]]; then
  587.             IP=$USEREXTERNALIP
  588.         fi
  589.     fi
  590.     # client-template.txt is created so we have a template to add further users later
  591.     echo "client" > /etc/openvpn/client-template.txt
  592.     if [[ "$PROTOCOL" = 'UDP' ]]; then
  593.         echo "proto udp" >> /etc/openvpn/client-template.txt
  594.     elif [[ "$PROTOCOL" = 'TCP' ]]; then
  595.         echo "proto tcp-client" >> /etc/openvpn/client-template.txt
  596.     fi
  597.     echo "remote $IP $PORT
  598. dev tun
  599. resolv-retry infinite
  600. nobind
  601. persist-key
  602. persist-tun
  603. comp-lzo no
  604. remote-cert-tls server
  605. auth SHA512
  606. $CIPHER
  607. tls-client
  608. tls-version-min 1.2
  609. tls-cipher TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384
  610. setenv opt block-outside-dns
  611. #--INFO-- Use update-resolv-conf to FIX DNSLEAK! See https://wiki.archlinux.org/index.php/OpenVPN#DNS for Details! Works with ALL LINUX!!
  612. #script-security 2
  613. #up /etc/openvpn/update-resolv-conf
  614. #down /etc/openvpn/update-resolv-conf
  615. #### Linux Special / Experimental Options
  616. #fast-io
  617. #nice -10
  618. verb 3" >> /etc/openvpn/client-template.txt
  619.  
  620.     # Generate the custom client.ovpn
  621.     newclient "$CLIENT"
  622.     echo ""
  623.     echo "Finished!"
  624.     echo ""
  625.     echo "Your client config is available at ~/$CLIENT.ovpn"
  626.     echo "If you want to add more clients, you simply need to run this script another time!"
  627. fi
  628. exit 0;
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!