hma ip binding script

#!/bin/bash
#
# Hide My Ass VPN Script
# By: Onryo
#

# Make sure user has permission to run OpenVPN in sudo.
sudo -v

# Make sure DNS servers are not your ISP's to stop leaks.
dns1="nameserver 208.67.222.222"
dns2="nameserver 208.67.220.220"

#Flush all rules
IPT=/sbin/iptables
$IPT -F
$IPT -X
$IPT -t nat -F
$IPT -t nat -X
$IPT -t mangle -F
$IPT -t mangle -X
$IPT -P INPUT ACCEPT
$IPT -P FORWARD ACCEPT
$IPT -P OUTPUT ACCEPT

# restart openvpn for quick vnp change

/sbin/ifconfig tun0 down
killall -9 openvpn
rm -f ./.pid 2>/dev/null

echo $dns1 > /etc/resolv.conf
echo $dns2 >> /etc/resolv.conf

OIFS=$IFS
check_wait=5 # Time to wait between checks for VPN connection.

# Find existing tunnels for connection check
_tunnels=$(ifconfig -s tun 2>/dev/null); tunnels=0; IFS=$'\n'; for tunnel in $_tunnels; do IFS=$' '; tunnel=( $tunnel ); let tunnels=$tunnels+1; done; IFS=$OIFS

trim() { IFS=$' '; echo $1; IFS=$OIFS; }
getservers() { echo "Loading server list..."; IFS=$'\n'; for server in $(curl -s http://vpn.hidemyass.com/vpnconfig/countries.php); do servers[${#servers[@]}]=$(trim $server); done; unset server; IFS=$OIFS; echo "Server list loaded."; }
getserver() { IFS=$'\n'; echo "Getting server configuration..."; if [[ ! -d "./servers" ]]; then echo "Creating server configurations directory..."; mkdir -v ./servers; fi; wget -nv $(printf "http://vpn.hidemyass.com/vpnconfig/client_config.php?win=1&loc=%s" ${servers[(($1-1))]}) -O "./servers/${servers[(($1-1))]}.cfg"; echo "Got server configuration."; IFS=$OIFS; }
vpncheck() { if [[ -e ./.pid ]]; then if [[ ! -z $(ps -ef | grep $(cat ./.pid) | grep openvpn) ]]; then echo "HMA VPN already running. PID: $(cat ./.pid)"; exit; else rm -f ./.pid; fi; fi; }
checkconnection() { echo "Checking connection in $check_wait seconds..."; while [[ 1 ]]; do sleep $check_wait; echo "Checking connection..."; _tunnels=$(ifconfig -s tun 2>/dev/null); IFS=$'\n'; _tunnels=( $_tunnels ); if [[ ${#_tunnels[@]} -gt $tunnels ]]; then echo "VPN connected."; echo "Real IP: $OIP"; echo " VPN IP: $(getip)"; break; elif [[ ! -z $(tail -n 5 /var/log/syslog | grep "HMA VPN" | grep -i "auth: received auth_failed control message") ]]; then echo "VPN connection failed. Reason: Invalid password."; exit; elif [[ ! -z $(tail -n 5 /var/log/syslog | grep "HMA VPN" | grep -i "error: auth username is empty") ]]; then echo "VPN connection failed. Reason: Blank username."; exit; fi; IFS=$OIFS; echo "Unable to confirm connection. Trying again in $check_wait seconds..."; done; }
getip() { echo $(curl -s http://www.whatismyip.org); }

OIP=$(getip)

# Change to the script directory to prevent an OpenVPN error with the
# server configs.
cd "$HOME/.hma"

if [[ -z $1 || $1 == '-l' ]]; then
    getservers
    echo "Servers:"
    for (( i=1;i<=${#servers[@]};i++ )); do
        echo "  $i: ${servers[(($i-1))]}"
    done
    echo "End of list."
elif [[ $1 == '-r' ]]; then
    vpncheck
    getservers
    while [[ -z $rserv ]]; do
        rserv=$RANDOM
        let "rserv %= ${#servers[@]}"
        shopt -s nocasematch
        while [[ 1 ]]; do
            echo -n "Continue using server \"${servers[(($rserv-1))]}\"? (yes) "
            read YN
            if [[ -z $YN || $YN =~ ^y(es)*$ ]]; then break;
            elif [[ $YN =~ ^no*$ ]]; then unset rserv;  break;
            else echo "Invalid response."; continue;
            fi
        done
    done
    shopt -u nocasematch
    getserver $1
    echo "Connecting to VPN..."
    sudo openvpn --config "./servers/${servers[(($1-1))]}.cfg" --auth-user-pass client.cred --writepid ./.pid --daemon "HMA VPN"
    checkconnection
elif [[ $1 =~ ^[0-9]+$ && $1 -gt 0 ]]; then
    vpncheck
    getservers
    if [[ ! -z ${servers[(($1-1))]} ]]; then
        echo "Server selected: ${servers[(($1-1))]}"
        getserver $1
        echo
        echo "Connecting to VPN..."
        sudo openvpn --config "./servers/${servers[(($1-1))]}.cfg" --auth-user-pass client.cred --writepid ./.pid --daemon "HMA VPN"
        checkconnection
    else echo "No server found."
    fi
elif [[ $1 == 0 ]]; then echo "Server must be greater than 0."
elif [[ $1 == '-c' ]]; then
    echo "Cleaning..."
    if [[ -d ./servers ]]; then rm -rvf ./servers/*; fi
    echo "Done cleaning."
elif [[ $1 == '-s' ]]; then
    if [[ -e ./.pid ]]; then
        echo "Stopping the VPN..."
        if [[ $(ps -p $(cat ./.pid)) =~ openvpn ]]; then
            sudo kill -9 $(cat ./.pid)
            echo "Killed process: $(cat ./.pid)"
        fi
        rm -f ./.pid 2>/dev/null
        echo "VPN stopped."
    else echo "No PID lock detected. VPN is not running, or the PID file was deleted prematurely."
    fi
elif [[ $1 == '-h' || $1 == '--help' ]]; then cat <<EOF
Hide My Ass VPN Help

$0 -h,--help        - Display this help screen
$0 -c           - Clean configuration files
$0 -r           - Random server
$0 #            - Select a server.
$0 -l           - List servers.
$0 -s           - Stop the VPN that is currently running (if any).
EOF
else echo "Unknown command: $1"
fi
############ binding the vpn with iptables ###############
if [[ $1 =~ ^[0-9]+$ && $1 -gt 0 ]] || [[ $1 == '-r' ]] ; then

#Set variables
# IPT=/sbin/iptables
VPN=$(/sbin/ifconfig tun0 | awk '/inet addr/ {print substr($2, 6)}')
LAN1=192.168.0.0/16
## LAN2=10.0.0.0/8
## LAN3=172.16.0.0/12

echo "Your IP is locked to VPN" $VPN
cat /etc/resolv.conf

#Default policies and define chains
$IPT -P OUTPUT DROP
$IPT -P INPUT DROP
$IPT -P FORWARD DROP

#Allow input from LAN and tun0 ONLY
$IPT -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$IPT -A INPUT -i lo -j ACCEPT
$IPT -A INPUT -i tun0 -m conntrack --ctstate NEW -j ACCEPT
$IPT -A INPUT -s $LAN1 -m conntrack --ctstate NEW -j ACCEPT
## $IPT -A INPUT -s $LAN2 -m conntrack --ctstate NEW -j ACCEPT
## $IPT -A INPUT -s $LAN3 -m conntrack --ctstate NEW -j ACCEPT
$IPT -A INPUT -j DROP

#Allow output from lo and tun0 ONLY
$IPT -A OUTPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
$IPT -A OUTPUT -o lo -j ACCEPT
$IPT -A OUTPUT -o tun0 -m conntrack --ctstate NEW -j ACCEPT
$IPT -A OUTPUT -d $VPN -m conntrack --ctstate NEW -j ACCEPT
$IPT -A OUTPUT -j DROP
fi
exit 0