├── README.md ├── LICENSE └── openvpn-install.sh /README.md: -------------------------------------------------------------------------------- 1 | # OpenVPN-install 2 | 3 | The repo URL has changed : https://github.com/Angristan/openvpn-install 4 | 5 | 6 | ### License 7 | 8 | [MIT Licence](https://raw.githubusercontent.com/Angristan/OpenVPN-install-fork-old/master/LICENSE) 9 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | The MIT License (MIT) 2 | 3 | Copyright (c) 2016, Angristan 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy of 6 | this software and associated documentation files (the "Software"), to deal in 7 | the Software without restriction, including without limitation the rights to 8 | use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of 9 | the Software, and to permit persons to whom the Software is furnished to do so, 10 | subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS 17 | FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR 18 | COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER 19 | IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN 20 | CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. 21 | -------------------------------------------------------------------------------- /openvpn-install.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # OpenVPN road warrior installer for Debian, Ubuntu and CentOS 3 | 4 | # This script will work on Debian, Ubuntu, CentOS and probably other distros 5 | # of the same families, although no support is offered for them. It isn't 6 | # bulletproof but it will probably work if you simply want to setup a VPN on 7 | # your Debian/Ubuntu/CentOS box. It has been designed to be as unobtrusive and 8 | # universal as possible. 9 | 10 | 11 | if [[ "$EUID" -ne 0 ]]; then 12 | echo "Sorry, you need to run this as root" 13 | exit 1 14 | fi 15 | 16 | 17 | if [[ ! -e /dev/net/tun ]]; then 18 | echo "TUN is not available" 19 | exit 2 20 | fi 21 | 22 | 23 | if grep -qs "CentOS release 5" "/etc/redhat-release"; then 24 | echo "CentOS 5 is too old and not supported" 25 | exit 3 26 | fi 27 | 28 | if [[ -e /etc/debian_version ]]; then 29 | OS="debian" 30 | #We get the version number, to verify we can get a recent version of OpenVPN 31 | VERSION_ID=$(cat /etc/*-release | grep "VERSION_ID") 32 | RCLOCAL='/etc/rc.local' 33 | if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]]; then 34 | echo "Your version of Debian/Ubuntu is not supported. Please look at the documentation." 35 | exit 4 36 | fi 37 | elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then 38 | OS=centos 39 | RCLOCAL='/etc/rc.d/rc.local' 40 | # Needed for CentOS 7 41 | chmod +x /etc/rc.d/rc.local 42 | else 43 | echo "Looks like you aren't running this installer on a Debian, Ubuntu or CentOS system" 44 | exit 4 45 | fi 46 | 47 | newclient () { 48 | # Generates the custom client.ovpn 49 | cp /etc/openvpn/client-common.txt ~/$1.ovpn 50 | echo "" >> ~/$1.ovpn 51 | cat /etc/openvpn/easy-rsa/pki/ca.crt >> ~/$1.ovpn 52 | echo "" >> ~/$1.ovpn 53 | echo "" >> ~/$1.ovpn 54 | cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> ~/$1.ovpn 55 | echo "" >> ~/$1.ovpn 56 | echo "" >> ~/$1.ovpn 57 | cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ~/$1.ovpn 58 | echo "" >> ~/$1.ovpn 59 | echo "key-direction 1" >> ~/$1.ovpn 60 | echo "" >> ~/$1.ovpn 61 | cat /etc/openvpn/tls-auth.key >> ~/$1.ovpn 62 | echo "" >> ~/$1.ovpn 63 | } 64 | 65 | 66 | # Try to get our IP from the system and fallback to the Internet. 67 | # I do this to make the script compatible with NATed servers (LowEndSpirit/Scaleway) 68 | # and to avoid getting an IPv6. 69 | IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) 70 | if [[ "$IP" = "" ]]; then 71 | IP=$(wget -qO- ipv4.icanhazip.com) 72 | fi 73 | 74 | 75 | if [[ -e /etc/openvpn/server.conf ]]; then 76 | while : 77 | do 78 | clear 79 | echo "Looks like OpenVPN is already installed" 80 | echo "" 81 | echo "What do you want to do?" 82 | echo " 1) Add a cert for a new user" 83 | echo " 2) Revoke existing user cert" 84 | echo " 3) Remove OpenVPN" 85 | echo " 4) Exit" 86 | read -p "Select an option [1-4]: " option 87 | case $option in 88 | 1) 89 | echo "" 90 | echo "Tell me a name for the client cert" 91 | echo "Please, use one word only, no special characters" 92 | read -p "Client name: " -e -i client CLIENT 93 | cd /etc/openvpn/easy-rsa/ 94 | ./easyrsa build-client-full $CLIENT nopass 95 | # Generates the custom client.ovpn 96 | newclient "$CLIENT" 97 | echo "" 98 | echo "Client $CLIENT added, certs available at ~/$CLIENT.ovpn" 99 | exit 100 | ;; 101 | 2) 102 | # This option could be documented a bit better and maybe even be simplimplified 103 | # ...but what can I say, I want some sleep too 104 | NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") 105 | if [[ "$NUMBEROFCLIENTS" = '0' ]]; then 106 | echo "" 107 | echo "You have no existing clients!" 108 | exit 5 109 | fi 110 | echo "" 111 | echo "Select the existing client certificate you want to revoke" 112 | tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' 113 | if [[ "$NUMBEROFCLIENTS" = '1' ]]; then 114 | read -p "Select one client [1]: " CLIENTNUMBER 115 | else 116 | read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER 117 | fi 118 | CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) 119 | cd /etc/openvpn/easy-rsa/ 120 | ./easyrsa --batch revoke $CLIENT 121 | ./easyrsa gen-crl 122 | rm -rf pki/reqs/$CLIENT.req 123 | rm -rf pki/private/$CLIENT.key 124 | rm -rf pki/issued/$CLIENT.crt 125 | rm -rf /etc/openvpn/crl.pem 126 | cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem 127 | echo "" 128 | echo "Certificate for client $CLIENT revoked" 129 | echo "Exiting..." 130 | exit 131 | ;; 132 | 3) 133 | echo "" 134 | read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE 135 | if [[ "$REMOVE" = 'y' ]]; then 136 | PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) 137 | if hash ufw 2>/dev/null && ufw status | grep -qw active; then 138 | ufw delete allow $PORT/udp 139 | sed -i '/^##OPENVPN_START/,/^##OPENVPN_END/d' /etc/ufw/before.rules 140 | sed -i '/^DEFAULT_FORWARD/{N;s/DEFAULT_FORWARD_POLICY="ACCEPT"\n#before openvpn: /DEFAULT_FORWARD_POLICY=/}' /etc/default/ufw 141 | elif pgrep firewalld; then 142 | # Using both permanent and not permanent rules to avoid a firewalld reload. 143 | firewall-cmd --zone=public --remove-port=$PORT/udp 144 | firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 145 | firewall-cmd --permanent --zone=public --remove-port=$PORT/udp 146 | firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 147 | firewall-cmd --zone=trusted --remove-masquerade 148 | firewall-cmd --permanent --zone=trusted --remove-masquerade 149 | fi 150 | if iptables -L -n | grep -qE 'REJECT|DROP'; then 151 | sed -i "/iptables -I INPUT -p udp --dport $PORT -j ACCEPT/d" $RCLOCAL 152 | sed -i "/iptables -I FORWARD -s 10.8.0.0\/24 -j ACCEPT/d" $RCLOCAL 153 | sed -i "/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT/d" $RCLOCAL 154 | fi 155 | sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 /d' $RCLOCAL 156 | if hash sestatus 2>/dev/null; then 157 | if sestatus | grep "Current mode" | grep -qs "enforcing"; then 158 | if [[ "$PORT" != '1194' ]]; then 159 | semanage port -d -t openvpn_port_t -p udp $PORT 160 | fi 161 | fi 162 | fi 163 | if [[ "$OS" = 'debian' ]]; then 164 | apt-get remove --purge -y openvpn openvpn-blacklist 165 | else 166 | yum remove openvpn -y 167 | fi 168 | rm -rf /etc/openvpn 169 | rm -rf /usr/share/doc/openvpn* 170 | echo "" 171 | echo "OpenVPN removed!" 172 | else 173 | echo "" 174 | echo "Removal aborted!" 175 | fi 176 | exit 177 | ;; 178 | 4) exit;; 179 | esac 180 | done 181 | else 182 | clear 183 | echo 'Welcome to this quick OpenVPN "road warrior" installer' 184 | echo "" 185 | # OpenVPN setup and first user creation 186 | echo "I need to ask you a few questions before starting the setup" 187 | echo "You can leave the default options and just press enter if you are ok with them" 188 | echo "" 189 | echo "First, choose which variant of the script you want to use." 190 | echo '"Fast" is secure, but "slow" is the best encryption you can get, at the cost of speed (not that slow though)' 191 | echo " 1) Fast (2048 bits RSA and DH, 128 bits AES)" 192 | echo " 2) Slow (4096 bits RSA and DH, 256 bits AES)" 193 | while [[ $VARIANT != "1" && $VARIANT != "2" ]]; do 194 | read -p "Variant [1-2]: " -e -i 1 VARIANT 195 | done 196 | 197 | echo "" 198 | echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." 199 | echo "If you server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP adress as it is. (local/private IP" 200 | echo "Otherwise, it sould be your public IPv4 address." 201 | read -p "IP address: " -e -i $IP IP 202 | echo "" 203 | echo "What port do you want for OpenVPN?" 204 | read -p "Port: " -e -i 1194 PORT 205 | echo "" 206 | echo "What DNS do you want to use with the VPN?" 207 | echo " 1) Current system resolvers" 208 | echo " 2) FDN (recommended)" 209 | echo " 3) OpenNIC" 210 | echo " 4) DNS.WATCH" 211 | echo " 5) OpenDNS" 212 | echo " 6) Google" 213 | read -p "DNS [1-6]: " -e -i 2 DNS 214 | echo "" 215 | echo "Some setups (e.g. Amazon Web Services), require use of MASQUERADE rather than SNAT" 216 | echo "Which forwarding method do you want to use [if unsure, leave as default]?" 217 | echo " 1) SNAT (default)" 218 | echo " 2) MASQUERADE" 219 | while [[ $FORWARD_TYPE != "1" && $FORWARD_TYPE != "2" ]]; do 220 | read -p "Forwarding type: " -e -i 1 FORWARD_TYPE 221 | done 222 | echo "" 223 | echo "Finally, tell me your name for the client cert" 224 | while [[ $CLIENT = "" ]]; do 225 | echo "Please, use one word only, no special characters" 226 | read -p "Client name: " -e -i client CLIENT 227 | done 228 | echo "" 229 | echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" 230 | read -n1 -r -p "Press any key to continue..." 231 | if [[ "$OS" = 'debian' ]]; then 232 | apt-get install ca-certificates -y 233 | # We add the OpenVPN repo to get the latest version. 234 | # Debian 7 235 | if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then 236 | echo "deb http://swupdate.openvpn.net/apt wheezy main" > /etc/apt/sources.list.d/swupdate-openvpn.list 237 | wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - 238 | apt-get update 239 | fi 240 | # Debian 8 241 | if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then 242 | echo "deb http://swupdate.openvpn.net/apt jessie main" > /etc/apt/sources.list.d/swupdate-openvpn.list 243 | wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - 244 | apt update 245 | fi 246 | # Ubuntu 12.04 247 | if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then 248 | echo "deb http://swupdate.openvpn.net/apt precise main" > /etc/apt/sources.list.d/swupdate-openvpn.list 249 | wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - 250 | apt-get update 251 | fi 252 | # Ubuntu 14.04 253 | if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then 254 | echo "deb http://swupdate.openvpn.net/apt trusty main" > /etc/apt/sources.list.d/swupdate-openvpn.list 255 | wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - 256 | apt-get update 257 | fi 258 | # The repo, is not available for Ubuntu 15.10 and 16.04, but it has OpenVPN > 2.3.3, so we do nothing. 259 | # The we install OpnVPN 260 | apt-get install openvpn iptables openssl wget ca-certificates curl -y 261 | else 262 | # Else, the distro is CentOS 263 | yum install epel-release -y 264 | yum install openvpn iptables openssl wget ca-certificates curl -y 265 | fi 266 | # find out if the machine uses nogroup or nobody for the permissionless group 267 | if grep -qs "^nogroup:" /etc/group; then 268 | NOGROUP=nogroup 269 | else 270 | NOGROUP=nobody 271 | fi 272 | 273 | # An old version of easy-rsa was available by default in some openvpn packages 274 | if [[ -d /etc/openvpn/easy-rsa/ ]]; then 275 | rm -rf /etc/openvpn/easy-rsa/ 276 | fi 277 | # Get easy-rsa 278 | wget -O ~/EasyRSA-3.0.1.tgz https://github.com/OpenVPN/easy-rsa/releases/download/3.0.1/EasyRSA-3.0.1.tgz 279 | tar xzf ~/EasyRSA-3.0.1.tgz -C ~/ 280 | mv ~/EasyRSA-3.0.1/ /etc/openvpn/ 281 | mv /etc/openvpn/EasyRSA-3.0.1/ /etc/openvpn/easy-rsa/ 282 | chown -R root:root /etc/openvpn/easy-rsa/ 283 | rm -rf ~/EasyRSA-3.0.1.tgz 284 | cd /etc/openvpn/easy-rsa/ 285 | # If the user selected the fast, less hardened version 286 | if [[ "$VARIANT" = '1' ]]; then 287 | echo "set_var EASYRSA_KEY_SIZE 2048 288 | set_var EASYRSA_DIGEST "sha256"" > vars 289 | fi 290 | # If the user selected the relatively slow, ultra hardened version 291 | if [[ "$VARIANT" = '2' ]]; then 292 | echo "set_var EASYRSA_KEY_SIZE 4096 293 | set_var EASYRSA_DIGEST "sha384"" > vars 294 | fi 295 | # Create the PKI, set up the CA, the DH params and the server + client certificates 296 | ./easyrsa init-pki 297 | ./easyrsa --batch build-ca nopass 298 | ./easyrsa gen-dh 299 | ./easyrsa build-server-full server nopass 300 | ./easyrsa build-client-full $CLIENT nopass 301 | ./easyrsa gen-crl 302 | # generate tls-auth key 303 | openvpn --genkey --secret /etc/openvpn/tls-auth.key 304 | # Move the stuff we need 305 | cp pki/ca.crt pki/private/ca.key pki/dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn 306 | # Make cert revocation list readable for non-root 307 | chmod 644 /etc/openvpn/crl.pem 308 | # Generate server.conf 309 | echo "port $PORT 310 | proto udp 311 | dev tun 312 | ca ca.crt 313 | cert server.crt 314 | key server.key 315 | dh dh.pem 316 | user nobody 317 | group $NOGROUP 318 | topology subnet 319 | server 10.8.0.0 255.255.255.0 320 | ifconfig-pool-persist ipp.txt 321 | cipher AES-256-CBC 322 | auth SHA512 323 | tls-version-min 1.2" > /etc/openvpn/server.conf 324 | if [[ "$VARIANT" = '1' ]]; then 325 | # If the user selected the fast, less hardened version 326 | echo "tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256" >> /etc/openvpn/server.conf 327 | elif [[ "$VARIANT" = '2' ]]; then 328 | # If the user selected the relatively slow, ultra hardened version 329 | echo "tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384" >> /etc/openvpn/server.conf 330 | fi 331 | echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server.conf 332 | # DNS 333 | case $DNS in 334 | 1) 335 | # Obtain the resolvers from resolv.conf and use them for OpenVPN 336 | grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do 337 | echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf 338 | done 339 | ;; 340 | 2) #FDN 341 | echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf 342 | echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf 343 | ;; 344 | 3) #OpenNIC 345 | #Getting the nearest OpenNIC servers using the geoip API 346 | read ns1 ns2 <<< $(curl -s https://api.opennicproject.org/geoip/ | head -2 | awk '{print $1}') 347 | echo "push \"dhcp-option DNS $ns1\"" >> /etc/openvpn/server.conf 348 | echo "push \"dhcp-option DNS $ns2\"" >> /etc/openvpn/server.conf 349 | ;; 350 | 4) #DNS.WATCH 351 | echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf 352 | echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf 353 | ;; 354 | 5) #OpenDNS 355 | echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf 356 | echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf 357 | ;; 358 | 6) #Google 359 | echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf 360 | echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf 361 | ;; 362 | esac 363 | echo "keepalive 10 120 364 | persist-key 365 | persist-tun 366 | crl-verify crl.pem 367 | tls-server 368 | tls-auth tls-auth.key 0" >> /etc/openvpn/server.conf 369 | # Enable net.ipv4.ip_forward for the system 370 | sed -i '/\/c\net.ipv4.ip_forward=1' /etc/sysctl.conf 371 | if ! grep -q "\" /etc/sysctl.conf; then 372 | echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.conf 373 | fi 374 | # Avoid an unneeded reboot 375 | echo 1 > /proc/sys/net/ipv4/ip_forward 376 | # Set NAT for the VPN subnet 377 | if [[ "$FORWARD_TYPE" = '1' ]]; then 378 | iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to $IP 379 | sed -i "1 a\iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to $IP" $RCLOCAL 380 | else 381 | iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE 382 | sed -i "1 a\iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE" $RCLOCAL 383 | fi 384 | if pgrep firewalld; then 385 | # We don't use --add-service=openvpn because that would only work with 386 | # the default port. Using both permanent and not permanent rules to 387 | # avoid a firewalld reload. 388 | firewall-cmd --zone=public --add-port=$PORT/udp 389 | firewall-cmd --zone=trusted --add-source=10.8.0.0/24 390 | firewall-cmd --permanent --zone=public --add-port=$PORT/udp 391 | firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 392 | if [[ "$FORWARD_TYPE" = '1' ]]; then 393 | firewall-cmd --zone=trusted --add-masquerade 394 | firewall-cmd --permanent --zone=trusted --add-masquerade 395 | fi 396 | elif hash ufw 2>/dev/null && ufw status | grep -qw active; then 397 | ufw allow $PORT/udp 398 | if [[ "$FORWARD_TYPE" = '1' ]]; then 399 | sed -i '1s/^/##OPENVPN_START\n*nat\n:POSTROUTING ACCEPT [0:0]\n-A POSTROUTING -s 10.8.0.0\/24 -o eth0 -j MASQUERADE\nCOMMIT\n##OPENVPN_END\n\n/' /etc/ufw/before.rules 400 | sed -ie 's/^DEFAULT_FORWARD_POLICY\s*=\s*/DEFAULT_FORWARD_POLICY="ACCEPT"\n#before openvpn: /' /etc/default/ufw 401 | fi 402 | fi 403 | if iptables -L -n | grep -qE 'REJECT|DROP'; then 404 | # If iptables has at least one REJECT rule, we asume this is needed. 405 | # Not the best approach but I can't think of other and this shouldn't 406 | # cause problems. 407 | iptables -I INPUT -p udp --dport $PORT -j ACCEPT 408 | iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT 409 | iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 410 | sed -i "1 a\iptables -I INPUT -p udp --dport $PORT -j ACCEPT" $RCLOCAL 411 | sed -i "1 a\iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT" $RCLOCAL 412 | sed -i "1 a\iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" $RCLOCAL 413 | fi 414 | # If SELinux is enabled and a custom port was selected, we need this 415 | if hash sestatus 2>/dev/null; then 416 | if sestatus | grep "Current mode" | grep -qs "enforcing"; then 417 | if [[ "$PORT" != '1194' ]]; then 418 | # semanage isn't available in CentOS 6 by default 419 | if ! hash semanage 2>/dev/null; then 420 | yum install policycoreutils-python -y 421 | fi 422 | semanage port -a -t openvpn_port_t -p udp $PORT 423 | fi 424 | fi 425 | fi 426 | # And finally, restart OpenVPN 427 | if [[ "$OS" = 'debian' ]]; then 428 | # Little hack to check for systemd 429 | if pgrep systemd-journal; then 430 | systemctl restart openvpn@server.service 431 | else 432 | /etc/init.d/openvpn restart 433 | fi 434 | else 435 | if pgrep systemd-journal; then 436 | systemctl restart openvpn@server.service 437 | systemctl enable openvpn@server.service 438 | else 439 | service openvpn restart 440 | chkconfig openvpn on 441 | fi 442 | fi 443 | # Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users 444 | EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) 445 | if [[ "$IP" != "$EXTERNALIP" ]]; then 446 | echo "" 447 | echo "Looks like your server is behind a NAT!" 448 | echo "" 449 | echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," 450 | echo "then I need to know the address that can be used to access it from outside." 451 | echo "If that's not the case, just ignore this and leave the next field blank" 452 | read -p "External IP or domain name: " -e USEREXTERNALIP 453 | if [[ "$USEREXTERNALIP" != "" ]]; then 454 | IP=$USEREXTERNALIP 455 | fi 456 | fi 457 | # client-common.txt is created so we have a template to add further users later 458 | echo "client 459 | dev tun 460 | proto udp 461 | remote $IP $PORT 462 | resolv-retry infinite 463 | nobind 464 | persist-key 465 | persist-tun 466 | remote-cert-tls server 467 | cipher AES-256-CBC 468 | auth SHA512 469 | setenv opt block-outside-dns 470 | tls-version-min 1.2 471 | tls-client" > /etc/openvpn/client-common.txt 472 | if [[ "$VARIANT" = '1' ]]; then 473 | # If the user selected the fast, less hardened version 474 | echo "tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256" >> /etc/openvpn/client-common.txt 475 | elif [[ "$VARIANT" = '2' ]]; then 476 | # If the user selected the relatively slow, ultra hardened version 477 | echo "tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384" >> /etc/openvpn/client-common.txt 478 | fi 479 | # Generates the custom client.ovpn 480 | newclient "$CLIENT" 481 | echo "" 482 | echo "Finished!" 483 | echo "" 484 | echo "Your client config is available at ~/$CLIENT.ovpn" 485 | echo "If you want to add more clients, you simply need to run this script another time!" 486 | fi 487 | exit 0; 488 | --------------------------------------------------------------------------------