├── README.md ├── LICENSE └── openvpn-install.sh /README.md: -------------------------------------------------------------------------------- 1 | ### UPDATED SCRIPT HERE : https://github.com/Angristan/openvpn-install 2 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | The MIT License (MIT) 2 | 3 | Copyright (c) 2013 Nyr 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy of 6 | this software and associated documentation files (the "Software"), to deal in 7 | the Software without restriction, including without limitation the rights to 8 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of 9 | the Software, and to permit persons to whom the Software is furnished to do so, 10 | subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS 17 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 18 | COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 19 | IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 20 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 21 | -------------------------------------------------------------------------------- /openvpn-install.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # OpenVPN road warrior installer for Debian, Ubuntu and CentOS 3 | 4 | # This script will work on Debian, Ubuntu, CentOS and probably other distros 5 | # of the same families, although no support is offered for them. It isn't 6 | # bulletproof but it will probably work if you simply want to setup a VPN on 7 | # your Debian/Ubuntu/CentOS box. It has been designed to be as unobtrusive and 8 | # universal as possible. 9 | 10 | 11 | if [[ "$EUID" -ne 0 ]]; then 12 | echo "Sorry, you need to run this as root" 13 | exit 1 14 | fi 15 | 16 | 17 | if [[ ! -e /dev/net/tun ]]; then 18 | echo "TUN is not available" 19 | exit 2 20 | fi 21 | 22 | 23 | if grep -qs "CentOS release 5" "/etc/redhat-release"; then 24 | echo "CentOS 5 is too old and not supported" 25 | exit 3 26 | fi 27 | 28 | if [[ -e /etc/debian_version ]]; then 29 | OS="debian" 30 | #We get the version number, to verify we can get a recent version of OpenVPN 31 | VERSION_ID=$(cat /etc/*-release | grep "VERSION_ID") 32 | RCLOCAL='/etc/rc.local' 33 | if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="15.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]]; then 34 | echo "Your version of Debian/Ubuntu is not supported. Please look at the documentation." 35 | exit 4 36 | fi 37 | elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then 38 | OS=centos 39 | RCLOCAL='/etc/rc.d/rc.local' 40 | # Needed for CentOS 7 41 | chmod +x /etc/rc.d/rc.local 42 | else 43 | echo "Looks like you aren't running this installer on a Debian, Ubuntu or CentOS system" 44 | exit 4 45 | fi 46 | 47 | newclient () { 48 | # Generates the custom client.ovpn 49 | cp /etc/openvpn/client-common.txt ~/$1.ovpn 50 | echo "" >> ~/$1.ovpn 51 | cat /etc/openvpn/easy-rsa/pki/ca.crt >> ~/$1.ovpn 52 | echo "" >> ~/$1.ovpn 53 | echo "" >> ~/$1.ovpn 54 | cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> ~/$1.ovpn 55 | echo "" >> ~/$1.ovpn 56 | echo "" >> ~/$1.ovpn 57 | cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ~/$1.ovpn 58 | echo "" >> ~/$1.ovpn 59 | echo "key-direction 1" >> ~/$1.ovpn 60 | echo "" >> ~/$1.ovpn 61 | cat /etc/openvpn/tls-auth.key >> ~/$1.ovpn 62 | echo "" >> ~/$1.ovpn 63 | } 64 | 65 | 66 | # Try to get our IP from the system and fallback to the Internet. 67 | # I do this to make the script compatible with NATed servers (LowEndSpirit/Scaleway) 68 | # and to avoid getting an IPv6. 69 | IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) 70 | if [[ "$IP" = "" ]]; then 71 | IP=$(wget -qO- ipv4.icanhazip.com) 72 | fi 73 | 74 | 75 | if [[ -e /etc/openvpn/server.conf ]]; then 76 | while : 77 | do 78 | clear 79 | echo "Looks like OpenVPN is already installed" 80 | echo "" 81 | echo "What do you want to do?" 82 | echo " 1) Add a cert for a new user" 83 | echo " 2) Revoke existing user cert" 84 | echo " 3) Remove OpenVPN" 85 | echo " 4) Exit" 86 | read -p "Select an option [1-4]: " option 87 | case $option in 88 | 1) 89 | echo "" 90 | echo "Tell me a name for the client cert" 91 | echo "Please, use one word only, no special characters" 92 | read -p "Client name: " -e -i client CLIENT 93 | cd /etc/openvpn/easy-rsa/ 94 | ./easyrsa build-client-full $CLIENT nopass 95 | # Generates the custom client.ovpn 96 | newclient "$CLIENT" 97 | echo "" 98 | echo "Client $CLIENT added, certs available at ~/$CLIENT.ovpn" 99 | exit 100 | ;; 101 | 2) 102 | # This option could be documented a bit better and maybe even be simplimplified 103 | # ...but what can I say, I want some sleep too 104 | NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") 105 | if [[ "$NUMBEROFCLIENTS" = '0' ]]; then 106 | echo "" 107 | echo "You have no existing clients!" 108 | exit 5 109 | fi 110 | echo "" 111 | echo "Select the existing client certificate you want to revoke" 112 | tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' 113 | if [[ "$NUMBEROFCLIENTS" = '1' ]]; then 114 | read -p "Select one client [1]: " CLIENTNUMBER 115 | else 116 | read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER 117 | fi 118 | CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) 119 | cd /etc/openvpn/easy-rsa/ 120 | ./easyrsa --batch revoke $CLIENT 121 | ./easyrsa gen-crl 122 | rm -rf pki/reqs/$CLIENT.req 123 | rm -rf pki/private/$CLIENT.key 124 | rm -rf pki/issued/$CLIENT.crt 125 | rm -rf /etc/openvpn/crl.pem 126 | cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem 127 | echo "" 128 | echo "Certificate for client $CLIENT revoked" 129 | echo "Exiting..." 130 | exit 131 | ;; 132 | 3) 133 | echo "" 134 | read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE 135 | if [[ "$REMOVE" = 'y' ]]; then 136 | PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) 137 | if hash ufw 2>/dev/null && ufw status | grep -qw active; then 138 | ufw delete allow $PORT/udp 139 | sed -i '/^##OPENVPN_START/,/^##OPENVPN_END/d' /etc/ufw/before.rules 140 | sed -i '/^DEFAULT_FORWARD/{N;s/DEFAULT_FORWARD_POLICY="ACCEPT"\n#before openvpn: /DEFAULT_FORWARD_POLICY=/}' /etc/default/ufw 141 | elif pgrep firewalld; then 142 | # Using both permanent and not permanent rules to avoid a firewalld reload. 143 | firewall-cmd --zone=public --remove-port=$PORT/udp 144 | firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 145 | firewall-cmd --permanent --zone=public --remove-port=$PORT/udp 146 | firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 147 | firewall-cmd --zone=trusted --remove-masquerade 148 | firewall-cmd --permanent --zone=trusted --remove-masquerade 149 | fi 150 | if iptables -L | grep -qE 'REJECT|DROP'; then 151 | sed -i "/iptables -I INPUT -p udp --dport $PORT -j ACCEPT/d" $RCLOCAL 152 | sed -i "/iptables -I FORWARD -s 10.8.0.0\/24 -j ACCEPT/d" $RCLOCAL 153 | sed -i "/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT/d" $RCLOCAL 154 | fi 155 | sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 /d' $RCLOCAL 156 | if hash sestatus 2>/dev/null; then 157 | if sestatus | grep "Current mode" | grep -qs "enforcing"; then 158 | if [[ "$PORT" != '1194' ]]; then 159 | semanage port -d -t openvpn_port_t -p udp $PORT 160 | fi 161 | fi 162 | fi 163 | if [[ "$OS" = 'debian' ]]; then 164 | apt-get remove --purge -y openvpn openvpn-blacklist 165 | else 166 | yum remove openvpn -y 167 | fi 168 | rm -rf /etc/openvpn 169 | rm -rf /usr/share/doc/openvpn* 170 | echo "" 171 | echo "OpenVPN removed!" 172 | else 173 | echo "" 174 | echo "Removal aborted!" 175 | fi 176 | exit 177 | ;; 178 | 4) exit;; 179 | esac 180 | done 181 | else 182 | clear 183 | echo 'Welcome to this quick OpenVPN "road warrior" installer' 184 | echo "" 185 | # OpenVPN setup and first user creation 186 | echo "I need to ask you a few questions before starting the setup" 187 | echo "You can leave the default options and just press enter if you are ok with them" 188 | echo "" 189 | echo "First, choose which variant of the script you want to use." 190 | echo '"Fast" is secure, but "slow" is the best encryption you can get, at the cost of speed (not that slow though)' 191 | echo " 1) Fast (2048 bits RSA and DH, 128 bits AES)" 192 | echo " 2) Slow (4096 bits RSA and DH, 256 bits AES)" 193 | while [[ $VARIANT != "1" && $VARIANT != "2" ]]; do 194 | read -p "Variant [1-2]: " -e -i 1 VARIANT 195 | done 196 | 197 | echo "" 198 | echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." 199 | echo "If you server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP adress as it is. (local/private IP" 200 | echo "Otherwise, it sould be your public IPv4 address." 201 | read -p "IP address: " -e -i $IP IP 202 | echo "" 203 | echo "What port do you want for OpenVPN?" 204 | read -p "Port: " -e -i 1194 PORT 205 | echo "" 206 | echo "What DNS do you want to use with the VPN?" 207 | echo " 1) Current system resolvers" 208 | echo " 2) FDN (recommended)" 209 | echo " 3) OpenNIC" 210 | echo " 4) DNS.WATCH" 211 | echo " 5) OpenDNS" 212 | echo " 6) Google" 213 | read -p "DNS [1-6]: " -e -i 2 DNS 214 | echo "" 215 | echo "Some setups (e.g. Amazon Web Services), require use of MASQUERADE rather than SNAT" 216 | echo "Which forwarding method do you want to use [if unsure, leave as default]?" 217 | echo " 1) SNAT (default)" 218 | echo " 2) MASQUERADE" 219 | while [[ $FORWARD_TYPE != "1" && $FORWARD_TYPE != "2" ]]; do 220 | read -p "Forwarding type: " -e -i 1 FORWARD_TYPE 221 | done 222 | echo "" 223 | echo "Finally, tell me your name for the client cert" 224 | while [[ $CLIENT = "" ]]; do 225 | echo "Please, use one word only, no special characters" 226 | read -p "Client name: " -e -i client CLIENT 227 | done 228 | echo "" 229 | echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" 230 | read -n1 -r -p "Press any key to continue..." 231 | if [[ "$OS" = 'debian' ]]; then 232 | apt-get install ca-certificates -y 233 | # We add the OpenVPN repo to get the latest version. 234 | # Debian 7 235 | if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then 236 | echo "deb http://swupdate.openvpn.net/apt wheezy main" > /etc/apt/sources.list.d/swupdate-openvpn.list 237 | wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - 238 | apt-get update 239 | fi 240 | # Debian 8 241 | if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then 242 | echo "deb http://swupdate.openvpn.net/apt jessie main" > /etc/apt/sources.list.d/swupdate-openvpn.list 243 | wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - 244 | apt update 245 | fi 246 | # Ubuntu 12.04 247 | if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then 248 | echo "deb http://swupdate.openvpn.net/apt precise main" > /etc/apt/sources.list.d/swupdate-openvpn.list 249 | wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - 250 | apt-get update 251 | fi 252 | # Ubuntu 14.04 253 | if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then 254 | echo "deb http://swupdate.openvpn.net/apt trusty main" > /etc/apt/sources.list.d/swupdate-openvpn.list 255 | wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - 256 | apt-get update 257 | fi 258 | # The repo, is not available for Ubuntu 15.10 and 16.04, but it has OpenVPN > 2.3.3, so we do nothing. 259 | # The we install OpnVPN 260 | apt-get install openvpn iptables openssl wget ca-certificates curl -y 261 | else 262 | # Else, the distro is CentOS 263 | yum install epel-release -y 264 | yum install openvpn iptables openssl wget ca-certificates curl -y 265 | fi 266 | # find out if the machine uses nogroup or nobody for the permissionless group 267 | if grep -qs "^nogroup:" /etc/group; then 268 | NOGROUP=nogroup 269 | else 270 | NOGROUP=nobody 271 | fi 272 | 273 | # An old version of easy-rsa was available by default in some openvpn packages 274 | if [[ -d /etc/openvpn/easy-rsa/ ]]; then 275 | rm -rf /etc/openvpn/easy-rsa/ 276 | fi 277 | # Get easy-rsa 278 | wget -O ~/EasyRSA-3.0.1.tgz https://github.com/OpenVPN/easy-rsa/releases/download/3.0.1/EasyRSA-3.0.1.tgz 279 | tar xzf ~/EasyRSA-3.0.1.tgz -C ~/ 280 | mv ~/EasyRSA-3.0.1/ /etc/openvpn/ 281 | mv /etc/openvpn/EasyRSA-3.0.1/ /etc/openvpn/easy-rsa/ 282 | chown -R root:root /etc/openvpn/easy-rsa/ 283 | rm -rf ~/EasyRSA-3.0.1.tgz 284 | cd /etc/openvpn/easy-rsa/ 285 | # If the user selected the fast, less hardened version 286 | if [[ "$VARIANT" = '1' ]]; then 287 | echo "set_var EASYRSA_KEY_SIZE 2048 288 | set_var EASYRSA_KEY_SIZE 2048 289 | set_var EASYRSA_DIGEST "sha256"" > vars 290 | fi 291 | # If the user selected the relatively slow, ultra hardened version 292 | if [[ "$VARIANT" = '2' ]]; then 293 | echo "set_var EASYRSA_KEY_SIZE 4096 294 | set_var EASYRSA_KEY_SIZE 4096 295 | set_var EASYRSA_DIGEST "sha384"" > vars 296 | fi 297 | # Create the PKI, set up the CA, the DH params and the server + client certificates 298 | ./easyrsa init-pki 299 | ./easyrsa --batch build-ca nopass 300 | ./easyrsa gen-dh 301 | ./easyrsa build-server-full server nopass 302 | ./easyrsa build-client-full $CLIENT nopass 303 | ./easyrsa gen-crl 304 | # generate tls-auth key 305 | openvpn --genkey --secret /etc/openvpn/tls-auth.key 306 | # Move the stuff we need 307 | cp pki/ca.crt pki/private/ca.key pki/dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn 308 | # Make cert revocation list readable for non-root 309 | chmod 644 /etc/openvpn/crl.pem 310 | # Generate server.conf 311 | echo "port $PORT 312 | proto udp 313 | dev tun 314 | ca ca.crt 315 | cert server.crt 316 | key server.key 317 | dh dh.pem 318 | user nobody 319 | group $NOGROUP 320 | topology subnet 321 | server 10.8.0.0 255.255.255.0 322 | ifconfig-pool-persist ipp.txt 323 | cipher AES-256-CBC 324 | auth SHA512 325 | tls-version-min 1.2" > /etc/openvpn/server.conf 326 | if [[ "$VARIANT" = '1' ]]; then 327 | # If the user selected the fast, less hardened version 328 | echo "tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256" >> /etc/openvpn/server.conf 329 | elif [[ "$VARIANT" = '2' ]]; then 330 | # If the user selected the relatively slow, ultra hardened version 331 | echo "tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384" >> /etc/openvpn/server.conf 332 | fi 333 | echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server.conf 334 | # DNS 335 | case $DNS in 336 | 1) 337 | # Obtain the resolvers from resolv.conf and use them for OpenVPN 338 | grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do 339 | echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf 340 | done 341 | ;; 342 | 2) #FDN 343 | echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf 344 | echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf 345 | ;; 346 | 3) #OpenNIC 347 | #Getting the nearest OpenNIC servers using the geoip API 348 | read ns1 ns2 <<< $(curl -s https://api.opennicproject.org/geoip/ | head -2 | awk '{print $1}') 349 | echo "push \"dhcp-option DNS $ns1\"" >> /etc/openvpn/server.conf 350 | echo "push \"dhcp-option DNS $ns2\"" >> /etc/openvpn/server.conf 351 | ;; 352 | 4) #DNS.WATCH 353 | echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf 354 | echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf 355 | ;; 356 | 5) #OpenDNS 357 | echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf 358 | echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf 359 | ;; 360 | 6) #Google 361 | echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf 362 | echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf 363 | ;; 364 | esac 365 | echo "keepalive 10 120 366 | persist-key 367 | persist-tun 368 | crl-verify crl.pem 369 | tls-server 370 | tls-auth tls-auth.key 0" >> /etc/openvpn/server.conf 371 | # Enable net.ipv4.ip_forward for the system 372 | if [[ "$OS" = 'debian' ]]; then 373 | sed -i 's|#net.ipv4.ip_forward=1|net.ipv4.ip_forward=1|' /etc/sysctl.conf 374 | else 375 | # CentOS 5 and 6 376 | sed -i 's|net.ipv4.ip_forward = 0|net.ipv4.ip_forward = 1|' /etc/sysctl.conf 377 | # CentOS 7 378 | if ! grep -q "net.ipv4.ip_forward=1" "/etc/sysctl.conf"; then 379 | echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf 380 | fi 381 | fi 382 | # Avoid an unneeded reboot 383 | echo 1 > /proc/sys/net/ipv4/ip_forward 384 | # Set NAT for the VPN subnet 385 | if [[ "$FORWARD_TYPE" = '1' ]]; then 386 | iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to $IP 387 | sed -i "1 a\iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to $IP" $RCLOCAL 388 | else 389 | iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE 390 | sed -i "1 a\iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE" $RCLOCAL 391 | fi 392 | if pgrep firewalld; then 393 | # We don't use --add-service=openvpn because that would only work with 394 | # the default port. Using both permanent and not permanent rules to 395 | # avoid a firewalld reload. 396 | firewall-cmd --zone=public --add-port=$PORT/udp 397 | firewall-cmd --zone=trusted --add-source=10.8.0.0/24 398 | firewall-cmd --permanent --zone=public --add-port=$PORT/udp 399 | firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 400 | if [[ "$FORWARD_TYPE" = '1' ]]; then 401 | firewall-cmd --zone=trusted --add-masquerade 402 | firewall-cmd --permanent --zone=trusted --add-masquerade 403 | fi 404 | elif hash ufw 2>/dev/null && ufw status | grep -qw active; then 405 | ufw allow $PORT/udp 406 | if [[ "$FORWARD_TYPE" = '1' ]]; then 407 | sed -i '1s/^/##OPENVPN_START\n*nat\n:POSTROUTING ACCEPT [0:0]\n-A POSTROUTING -s 10.8.0.0\/24 -o eth0 -j MASQUERADE\nCOMMIT\n##OPENVPN_END\n\n/' /etc/ufw/before.rules 408 | sed -ie 's/^DEFAULT_FORWARD_POLICY\s*=\s*/DEFAULT_FORWARD_POLICY="ACCEPT"\n#before openvpn: /' /etc/default/ufw 409 | fi 410 | fi 411 | if iptables -L | grep -qE 'REJECT|DROP'; then 412 | # If iptables has at least one REJECT rule, we asume this is needed. 413 | # Not the best approach but I can't think of other and this shouldn't 414 | # cause problems. 415 | iptables -I INPUT -p udp --dport $PORT -j ACCEPT 416 | iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT 417 | iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 418 | sed -i "1 a\iptables -I INPUT -p udp --dport $PORT -j ACCEPT" $RCLOCAL 419 | sed -i "1 a\iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT" $RCLOCAL 420 | sed -i "1 a\iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" $RCLOCAL 421 | fi 422 | # If SELinux is enabled and a custom port was selected, we need this 423 | if hash sestatus 2>/dev/null; then 424 | if sestatus | grep "Current mode" | grep -qs "enforcing"; then 425 | if [[ "$PORT" != '1194' ]]; then 426 | # semanage isn't available in CentOS 6 by default 427 | if ! hash semanage 2>/dev/null; then 428 | yum install policycoreutils-python -y 429 | fi 430 | semanage port -a -t openvpn_port_t -p udp $PORT 431 | fi 432 | fi 433 | fi 434 | # And finally, restart OpenVPN 435 | if [[ "$OS" = 'debian' ]]; then 436 | # Little hack to check for systemd 437 | if pgrep systemd-journal; then 438 | systemctl restart openvpn@server.service 439 | else 440 | /etc/init.d/openvpn restart 441 | fi 442 | else 443 | if pgrep systemd-journal; then 444 | systemctl restart openvpn@server.service 445 | systemctl enable openvpn@server.service 446 | else 447 | service openvpn restart 448 | chkconfig openvpn on 449 | fi 450 | fi 451 | # Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users 452 | EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) 453 | if [[ "$IP" != "$EXTERNALIP" ]]; then 454 | echo "" 455 | echo "Looks like your server is behind a NAT!" 456 | echo "" 457 | echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," 458 | echo "then I need to know the address that can be used to access it from outside." 459 | echo "If that's not the case, just ignore this and leave the next field blank" 460 | read -p "External IP or domain name: " -e USEREXTERNALIP 461 | if [[ "$USEREXTERNALIP" != "" ]]; then 462 | IP=$USEREXTERNALIP 463 | fi 464 | fi 465 | # client-common.txt is created so we have a template to add further users later 466 | echo "client 467 | dev tun 468 | proto udp 469 | remote $IP $PORT 470 | resolv-retry infinite 471 | nobind 472 | persist-key 473 | persist-tun 474 | remote-cert-tls server 475 | cipher AES-256-CBC 476 | auth SHA512 477 | setenv opt block-outside-dns 478 | tls-version-min 1.2 479 | tls-client" > /etc/openvpn/client-common.txt 480 | if [[ "$VARIANT" = '1' ]]; then 481 | # If the user selected the fast, less hardened version 482 | echo "tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256" >> /etc/openvpn/client-common.txt 483 | elif [[ "$VARIANT" = '2' ]]; then 484 | # If the user selected the relatively slow, ultra hardened version 485 | echo "tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384" >> /etc/openvpn/client-common.txt 486 | fi 487 | # Generates the custom client.ovpn 488 | newclient "$CLIENT" 489 | echo "" 490 | echo "Finished!" 491 | echo "" 492 | echo "Your client config is available at ~/$CLIENT.ovpn" 493 | echo "If you want to add more clients, you simply need to run this script another time!" 494 | fi 495 | exit 0; 496 | --------------------------------------------------------------------------------