├── README.md ├── LICENSE └── openvpn-install.sh /README.md: -------------------------------------------------------------------------------- 1 | # OpenVPN Install for Multiple Users [Image of insights](https://github.com/gayanvoice/insights/blob/master/readme/208378302/week.md) 2 | 3 | [![Image of insights](https://github.com/gayanvoice/insights/blob/master/svg/208378302/badge.svg)](https://github.com/gayanvoice/insights/blob/master/readme/208378302/week.md) 4 | 5 | | Set up 📈 [GitHub Insights](https://github.com/gayanvoice/github-insights-template) counter to track how many people have viewed your GitHub repositories | 6 | | ---- | 7 | 8 | Share the same client-certificate with everyone. This script pre-enabled the duplicate-cn. 9 | 10 | ## Watch video 11 | [![Install OpenVPN for multiple users on Ubuntu](https://img.youtube.com/vi/lBelfmMkQYU/0.jpg)](https://www.youtube.com/watch?v=lBelfmMkQYU) 12 | 13 | ## Installation 14 | Run this script 15 | ``` 16 | wget https://git.io/JeFPU -O openvpn-install.sh && bash openvpn-install.sh 17 | ``` 18 | ## OpenVPN Server 19 | * Start 20 | ``` 21 | service openvpn start 22 | ``` 23 | * Status 24 | ``` 25 | service openvpn status 26 | ``` 27 | * Stop 28 | ``` 29 | service openvpn stop 30 | ``` 31 | 32 | ## Remove 33 | * Uninstall OpenVPN 34 | ``` 35 | sudo apt remove openvpn 36 | ``` 37 | 38 | * Remove it's dependencies 39 | ``` 40 | sudo rm -rfv /etc/openvpn 41 | ``` 42 | 43 | ## Prerequisites 44 | * Ubuntu 16.04 is no longer supported, use a latest version of OS 45 | * Only works with Debian, Ubuntu or CentOS 46 | * Enable 'tun' device before running this script 47 | ``` 48 | cat /dev/net/tun 49 | # if you receive this message, your 'tun' device is running 50 | # cat: /dev/net/tun: File descriptor in bad state 51 | ``` 52 | * This script run on 'bash', not 'sh' for Debian users 53 | ``` 54 | echo {$BASH_VERSION} 55 | ``` 56 | * Run this as 'root' 57 | ``` 58 | sudo su 59 | ``` 60 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | Apache License 2 | Version 2.0, January 2004 3 | http://www.apache.org/licenses/ 4 | 5 | TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION 6 | 7 | 1. Definitions. 8 | 9 | "License" shall mean the terms and conditions for use, reproduction, 10 | and distribution as defined by Sections 1 through 9 of this document. 11 | 12 | "Licensor" shall mean the copyright owner or entity authorized by 13 | the copyright owner that is granting the License. 14 | 15 | "Legal Entity" shall mean the union of the acting entity and all 16 | other entities that control, are controlled by, or are under common 17 | control with that entity. For the purposes of this definition, 18 | "control" means (i) the power, direct or indirect, to cause the 19 | direction or management of such entity, whether by contract or 20 | otherwise, or (ii) ownership of fifty percent (50%) or more of the 21 | outstanding shares, or (iii) beneficial ownership of such entity. 22 | 23 | "You" (or "Your") shall mean an individual or Legal Entity 24 | exercising permissions granted by this License. 25 | 26 | "Source" form shall mean the preferred form for making modifications, 27 | including but not limited to software source code, documentation 28 | source, and configuration files. 29 | 30 | "Object" form shall mean any form resulting from mechanical 31 | transformation or translation of a Source form, including but 32 | not limited to compiled object code, generated documentation, 33 | and conversions to other media types. 34 | 35 | "Work" shall mean the work of authorship, whether in Source or 36 | Object form, made available under the License, as indicated by a 37 | copyright notice that is included in or attached to the work 38 | (an example is provided in the Appendix below). 39 | 40 | "Derivative Works" shall mean any work, whether in Source or Object 41 | form, that is based on (or derived from) the Work and for which the 42 | editorial revisions, annotations, elaborations, or other modifications 43 | represent, as a whole, an original work of authorship. For the purposes 44 | of this License, Derivative Works shall not include works that remain 45 | separable from, or merely link (or bind by name) to the interfaces of, 46 | the Work and Derivative Works thereof. 47 | 48 | "Contribution" shall mean any work of authorship, including 49 | the original version of the Work and any modifications or additions 50 | to that Work or Derivative Works thereof, that is intentionally 51 | submitted to Licensor for inclusion in the Work by the copyright owner 52 | or by an individual or Legal Entity authorized to submit on behalf of 53 | the copyright owner. For the purposes of this definition, "submitted" 54 | means any form of electronic, verbal, or written communication sent 55 | to the Licensor or its representatives, including but not limited to 56 | communication on electronic mailing lists, source code control systems, 57 | and issue tracking systems that are managed by, or on behalf of, the 58 | Licensor for the purpose of discussing and improving the Work, but 59 | excluding communication that is conspicuously marked or otherwise 60 | designated in writing by the copyright owner as "Not a Contribution." 61 | 62 | "Contributor" shall mean Licensor and any individual or Legal Entity 63 | on behalf of whom a Contribution has been received by Licensor and 64 | subsequently incorporated within the Work. 65 | 66 | 2. Grant of Copyright License. Subject to the terms and conditions of 67 | this License, each Contributor hereby grants to You a perpetual, 68 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 69 | copyright license to reproduce, prepare Derivative Works of, 70 | publicly display, publicly perform, sublicense, and distribute the 71 | Work and such Derivative Works in Source or Object form. 72 | 73 | 3. Grant of Patent License. Subject to the terms and conditions of 74 | this License, each Contributor hereby grants to You a perpetual, 75 | worldwide, non-exclusive, no-charge, royalty-free, irrevocable 76 | (except as stated in this section) patent license to make, have made, 77 | use, offer to sell, sell, import, and otherwise transfer the Work, 78 | where such license applies only to those patent claims licensable 79 | by such Contributor that are necessarily infringed by their 80 | Contribution(s) alone or by combination of their Contribution(s) 81 | with the Work to which such Contribution(s) was submitted. If You 82 | institute patent litigation against any entity (including a 83 | cross-claim or counterclaim in a lawsuit) alleging that the Work 84 | or a Contribution incorporated within the Work constitutes direct 85 | or contributory patent infringement, then any patent licenses 86 | granted to You under this License for that Work shall terminate 87 | as of the date such litigation is filed. 88 | 89 | 4. Redistribution. You may reproduce and distribute copies of the 90 | Work or Derivative Works thereof in any medium, with or without 91 | modifications, and in Source or Object form, provided that You 92 | meet the following conditions: 93 | 94 | (a) You must give any other recipients of the Work or 95 | Derivative Works a copy of this License; and 96 | 97 | (b) You must cause any modified files to carry prominent notices 98 | stating that You changed the files; and 99 | 100 | (c) You must retain, in the Source form of any Derivative Works 101 | that You distribute, all copyright, patent, trademark, and 102 | attribution notices from the Source form of the Work, 103 | excluding those notices that do not pertain to any part of 104 | the Derivative Works; and 105 | 106 | (d) If the Work includes a "NOTICE" text file as part of its 107 | distribution, then any Derivative Works that You distribute must 108 | include a readable copy of the attribution notices contained 109 | within such NOTICE file, excluding those notices that do not 110 | pertain to any part of the Derivative Works, in at least one 111 | of the following places: within a NOTICE text file distributed 112 | as part of the Derivative Works; within the Source form or 113 | documentation, if provided along with the Derivative Works; or, 114 | within a display generated by the Derivative Works, if and 115 | wherever such third-party notices normally appear. The contents 116 | of the NOTICE file are for informational purposes only and 117 | do not modify the License. You may add Your own attribution 118 | notices within Derivative Works that You distribute, alongside 119 | or as an addendum to the NOTICE text from the Work, provided 120 | that such additional attribution notices cannot be construed 121 | as modifying the License. 122 | 123 | You may add Your own copyright statement to Your modifications and 124 | may provide additional or different license terms and conditions 125 | for use, reproduction, or distribution of Your modifications, or 126 | for any such Derivative Works as a whole, provided Your use, 127 | reproduction, and distribution of the Work otherwise complies with 128 | the conditions stated in this License. 129 | 130 | 5. Submission of Contributions. Unless You explicitly state otherwise, 131 | any Contribution intentionally submitted for inclusion in the Work 132 | by You to the Licensor shall be under the terms and conditions of 133 | this License, without any additional terms or conditions. 134 | Notwithstanding the above, nothing herein shall supersede or modify 135 | the terms of any separate license agreement you may have executed 136 | with Licensor regarding such Contributions. 137 | 138 | 6. Trademarks. This License does not grant permission to use the trade 139 | names, trademarks, service marks, or product names of the Licensor, 140 | except as required for reasonable and customary use in describing the 141 | origin of the Work and reproducing the content of the NOTICE file. 142 | 143 | 7. Disclaimer of Warranty. Unless required by applicable law or 144 | agreed to in writing, Licensor provides the Work (and each 145 | Contributor provides its Contributions) on an "AS IS" BASIS, 146 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or 147 | implied, including, without limitation, any warranties or conditions 148 | of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A 149 | PARTICULAR PURPOSE. You are solely responsible for determining the 150 | appropriateness of using or redistributing the Work and assume any 151 | risks associated with Your exercise of permissions under this License. 152 | 153 | 8. Limitation of Liability. In no event and under no legal theory, 154 | whether in tort (including negligence), contract, or otherwise, 155 | unless required by applicable law (such as deliberate and grossly 156 | negligent acts) or agreed to in writing, shall any Contributor be 157 | liable to You for damages, including any direct, indirect, special, 158 | incidental, or consequential damages of any character arising as a 159 | result of this License or out of the use or inability to use the 160 | Work (including but not limited to damages for loss of goodwill, 161 | work stoppage, computer failure or malfunction, or any and all 162 | other commercial damages or losses), even if such Contributor 163 | has been advised of the possibility of such damages. 164 | 165 | 9. Accepting Warranty or Additional Liability. While redistributing 166 | the Work or Derivative Works thereof, You may choose to offer, 167 | and charge a fee for, acceptance of support, warranty, indemnity, 168 | or other liability obligations and/or rights consistent with this 169 | License. However, in accepting such obligations, You may act only 170 | on Your own behalf and on Your sole responsibility, not on behalf 171 | of any other Contributor, and only if You agree to indemnify, 172 | defend, and hold each Contributor harmless for any liability 173 | incurred by, or claims asserted against, such Contributor by reason 174 | of your accepting any such warranty or additional liability. 175 | 176 | END OF TERMS AND CONDITIONS 177 | 178 | APPENDIX: How to apply the Apache License to your work. 179 | 180 | To apply the Apache License to your work, attach the following 181 | boilerplate notice, with the fields enclosed by brackets "[]" 182 | replaced with your own identifying information. (Don't include 183 | the brackets!) The text should be enclosed in the appropriate 184 | comment syntax for the file format. We also recommend that a 185 | file or class name and description of purpose be included on the 186 | same "printed page" as the copyright notice for easier 187 | identification within third-party archives. 188 | 189 | Copyright [yyyy] [name of copyright owner] 190 | 191 | Licensed under the Apache License, Version 2.0 (the "License"); 192 | you may not use this file except in compliance with the License. 193 | You may obtain a copy of the License at 194 | 195 | http://www.apache.org/licenses/LICENSE-2.0 196 | 197 | Unless required by applicable law or agreed to in writing, software 198 | distributed under the License is distributed on an "AS IS" BASIS, 199 | WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 200 | See the License for the specific language governing permissions and 201 | limitations under the License. 202 | -------------------------------------------------------------------------------- /openvpn-install.sh: -------------------------------------------------------------------------------- 1 | #!/bin/bash 2 | # 3 | # https://github.com/gayankuruppu/openvpn-install-for-multiple-users 4 | # This script enables duplicate-cn in server.conf. You can share the same client.ovpn file for multiple users. 5 | # Based on Nyr https://github.com/Nyr/openvpn-install 6 | # 7 | # checks if ubuntu is 1604 8 | if grep -qs "Ubuntu 16.04" "/etc/os-release"; then 9 | echo 'Ubuntu 16.04 is no longer supported' 10 | echo "Go to https://github.com/gayankuruppu/openvpn-install-for-multiple-users for FAQ" 11 | exit 12 | fi 13 | # cehcks if run in bash 14 | if readlink /proc/$$/exe | grep -q "dash"; then 15 | echo "This script needs to be run with bash, not sh" 16 | echo "Go to https://github.com/gayankuruppu/openvpn-install-for-multiple-users for FAQ" 17 | exit 18 | fi 19 | # checks if run in root 20 | if [[ "$EUID" -ne 0 ]]; then 21 | echo "Run this as root" 22 | echo "Go to https://github.com/gayankuruppu/openvpn-install-for-multiple-users for FAQ" 23 | exit 24 | fi 25 | # checks if tun device is enabled 26 | if [[ ! -e /dev/net/tun ]]; then 27 | echo "The TUN device is not enabled" 28 | echo "Go to https://github.com/gayankuruppu/openvpn-install-for-multiple-users for FAQ" 29 | exit 30 | fi 31 | 32 | # checks the operating system version 33 | if [[ -e /etc/debian_version ]]; then 34 | OS=debian 35 | GROUPNAME=nogroup 36 | elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then 37 | OS=centos 38 | GROUPNAME=nobody 39 | else 40 | echo "This script only works on Debian, Ubuntu or CentOS" 41 | echo "Go to https://github.com/gayankuruppu/openvpn-install-for-multiple-users for FAQ" 42 | exit 43 | fi 44 | 45 | newclient () { 46 | # Generates the custom client.ovpn 47 | cp /etc/openvpn/server/client-common.txt ~/$1.ovpn 48 | echo "" >> ~/$1.ovpn 49 | cat /etc/openvpn/server/easy-rsa/pki/ca.crt >> ~/$1.ovpn 50 | echo "" >> ~/$1.ovpn 51 | echo "" >> ~/$1.ovpn 52 | sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/$1.crt >> ~/$1.ovpn 53 | echo "" >> ~/$1.ovpn 54 | echo "" >> ~/$1.ovpn 55 | cat /etc/openvpn/server/easy-rsa/pki/private/$1.key >> ~/$1.ovpn 56 | echo "" >> ~/$1.ovpn 57 | echo "" >> ~/$1.ovpn 58 | sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/ta.key >> ~/$1.ovpn 59 | echo "" >> ~/$1.ovpn 60 | } 61 | 62 | if [[ -e /etc/openvpn/server/server.conf ]]; then 63 | echo "OpenVPN is already installed" 64 | echo 65 | echo "Still you can't connect multiple users to the OpenVPN server?" 66 | echo "Restart the server!" 67 | echo 68 | echo "Go to https://github.com/gayankuruppu/openvpn-install-for-multiple-users for FAQ" 69 | exit 70 | else 71 | clear 72 | echo 'Install OpenVPN for Multiple Users' 73 | echo "Go to https://github.com/gayankuruppu/openvpn-install-for-multiple-users for FAQ" 74 | echo 75 | # OpenVPN setup and first user creation 76 | echo "Listening to IPv4 Address." 77 | # Autodetect IP address and pre-fill for the user 78 | IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) 79 | read -p "IP address: " -e -i $IP IP 80 | # If $IP is a private IP address, the server must be behind NAT 81 | if echo "$IP" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then 82 | echo 83 | echo "Enter Public IPv4 Address" 84 | read -p "Public IP Address: " -e PUBLICIP 85 | fi 86 | echo 87 | echo "Choose OpenVPN Protocol (default UDP):" 88 | echo " 1) UDP (recommended)" 89 | echo " 2) TCP" 90 | read -p "Protocol [1-2]: " -e -i 1 PROTOCOL 91 | case $PROTOCOL in 92 | 1) 93 | PROTOCOL=udp 94 | ;; 95 | 2) 96 | PROTOCOL=tcp 97 | ;; 98 | esac 99 | echo 100 | echo "Enter OpenVPN Port (default 1194)" 101 | read -p "Port: " -e -i 1194 PORT 102 | echo 103 | echo "Choose DNS for VPN (default System)" 104 | echo " 1) Current system resolvers" 105 | echo " 2) 1.1.1.1" 106 | echo " 3) Google" 107 | echo " 4) OpenDNS" 108 | echo " 5) Verisign" 109 | read -p "DNS [1-5]: " -e -i 1 DNS 110 | echo 111 | echo "Enter the name Client Certificate (One Word)" 112 | read -p "Client name: " -e -i client CLIENT 113 | echo 114 | echo "Please wait few minutes" 115 | read -n1 -r -p "Press any key to continue..." 116 | # If running inside a container, disable LimitNPROC to prevent conflicts 117 | if systemd-detect-virt -cq; then 118 | mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null 119 | echo '[Service] 120 | LimitNPROC=infinity' > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf 121 | fi 122 | if [[ "$OS" = 'debian' ]]; then 123 | apt-get update 124 | apt-get install openvpn iptables openssl ca-certificates -y 125 | else 126 | # Else, the distro is CentOS 127 | yum install epel-release -y 128 | yum install openvpn iptables openssl ca-certificates -y 129 | fi 130 | # Get easy-rsa 131 | EASYRSAURL='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.5/EasyRSA-nix-3.0.5.tgz' 132 | wget -O ~/easyrsa.tgz "$EASYRSAURL" 2>/dev/null || curl -Lo ~/easyrsa.tgz "$EASYRSAURL" 133 | tar xzf ~/easyrsa.tgz -C ~/ 134 | mv ~/EasyRSA-3.0.5/ /etc/openvpn/server/ 135 | mv /etc/openvpn/server/EasyRSA-3.0.5/ /etc/openvpn/server/easy-rsa/ 136 | chown -R root:root /etc/openvpn/server/easy-rsa/ 137 | rm -f ~/easyrsa.tgz 138 | cd /etc/openvpn/server/easy-rsa/ 139 | # Create the PKI, set up the CA and the server and client certificates 140 | ./easyrsa init-pki 141 | ./easyrsa --batch build-ca nopass 142 | EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass 143 | EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full $CLIENT nopass 144 | EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl 145 | # Move the stuff we need 146 | cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server 147 | # CRL is read with each client connection, when OpenVPN is dropped to nobody 148 | chown nobody:$GROUPNAME /etc/openvpn/server/crl.pem 149 | # Generate key for tls-auth 150 | openvpn --genkey --secret /etc/openvpn/server/ta.key 151 | # Create the DH parameters file using the predefined ffdhe2048 group 152 | echo '-----BEGIN DH PARAMETERS----- 153 | MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz 154 | +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a 155 | 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7 156 | YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi 157 | 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD 158 | ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg== 159 | -----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem 160 | # Generate server.conf 161 | echo "port $PORT 162 | proto $PROTOCOL 163 | dev tun 164 | sndbuf 0 165 | rcvbuf 0 166 | ca ca.crt 167 | cert server.crt 168 | key server.key 169 | dh dh.pem 170 | duplicate-cn 171 | auth SHA512 172 | tls-auth ta.key 0 173 | topology subnet 174 | server 10.8.0.0 255.255.255.0 175 | ifconfig-pool-persist ipp.txt" > /etc/openvpn/server/server.conf 176 | echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf 177 | # DNS 178 | case $DNS in 179 | 1) 180 | # Locate the proper resolv.conf 181 | # Needed for systems running systemd-resolved 182 | if grep -q "127.0.0.53" "/etc/resolv.conf"; then 183 | RESOLVCONF='/run/systemd/resolve/resolv.conf' 184 | else 185 | RESOLVCONF='/etc/resolv.conf' 186 | fi 187 | # Obtain the resolvers from resolv.conf and use them for OpenVPN 188 | grep -v '#' $RESOLVCONF | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do 189 | echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server/server.conf 190 | done 191 | ;; 192 | 2) 193 | echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf 194 | echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf 195 | ;; 196 | 3) 197 | echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf 198 | echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf 199 | ;; 200 | 4) 201 | echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf 202 | echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf 203 | ;; 204 | 5) 205 | echo 'push "dhcp-option DNS 64.6.64.6"' >> /etc/openvpn/server/server.conf 206 | echo 'push "dhcp-option DNS 64.6.65.6"' >> /etc/openvpn/server/server.conf 207 | ;; 208 | esac 209 | echo "keepalive 10 120 210 | cipher AES-256-CBC 211 | user nobody 212 | group $GROUPNAME 213 | persist-key 214 | persist-tun 215 | status openvpn-status.log 216 | verb 3 217 | crl-verify crl.pem" >> /etc/openvpn/server/server.conf 218 | # Enable net.ipv4.ip_forward for the system 219 | echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/30-openvpn-forward.conf 220 | # Enable without waiting for a reboot or service restart 221 | echo 1 > /proc/sys/net/ipv4/ip_forward 222 | if pgrep firewalld; then 223 | # Using both permanent and not permanent rules to avoid a firewalld 224 | # reload. 225 | # We don't use --add-service=openvpn because that would only work with 226 | # the default port and protocol. 227 | firewall-cmd --add-port=$PORT/$PROTOCOL 228 | firewall-cmd --zone=trusted --add-source=10.8.0.0/24 229 | firewall-cmd --permanent --add-port=$PORT/$PROTOCOL 230 | firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 231 | # Set NAT for the VPN subnet 232 | firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP 233 | firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP 234 | else 235 | # Create a service to set up persistent iptables rules 236 | echo "[Unit] 237 | Before=network.target 238 | [Service] 239 | Type=oneshot 240 | ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP 241 | ExecStart=/sbin/iptables -I INPUT -p $PROTOCOL --dport $PORT -j ACCEPT 242 | ExecStart=/sbin/iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT 243 | ExecStart=/sbin/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 244 | ExecStop=/sbin/iptables -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP 245 | ExecStop=/sbin/iptables -D INPUT -p $PROTOCOL --dport $PORT -j ACCEPT 246 | ExecStop=/sbin/iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT 247 | ExecStop=/sbin/iptables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 248 | RemainAfterExit=yes 249 | [Install] 250 | WantedBy=multi-user.target" > /etc/systemd/system/openvpn-iptables.service 251 | systemctl enable --now openvpn-iptables.service 252 | fi 253 | # If SELinux is enabled and a custom port was selected, we need this 254 | if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$PORT" != '1194' ]]; then 255 | # Install semanage if not already present 256 | if ! hash semanage 2>/dev/null; then 257 | if grep -qs "CentOS Linux release 7" "/etc/centos-release"; then 258 | yum install policycoreutils-python -y 259 | else 260 | yum install policycoreutils-python-utils -y 261 | fi 262 | fi 263 | semanage port -a -t openvpn_port_t -p $PROTOCOL $PORT 264 | fi 265 | # And finally, enable and start the OpenVPN service 266 | systemctl enable --now openvpn-server@server.service 267 | # If the server is behind a NAT, use the correct IP address 268 | if [[ "$PUBLICIP" != "" ]]; then 269 | IP=$PUBLICIP 270 | fi 271 | # client-common.txt is created so we have a template to add further users later 272 | echo "client 273 | dev tun 274 | proto $PROTOCOL 275 | sndbuf 0 276 | rcvbuf 0 277 | remote $IP $PORT 278 | resolv-retry infinite 279 | nobind 280 | persist-key 281 | persist-tun 282 | remote-cert-tls server 283 | auth SHA512 284 | cipher AES-256-CBC 285 | setenv opt block-outside-dns 286 | key-direction 1 287 | verb 3" > /etc/openvpn/server/client-common.txt 288 | # Generates the custom client.ovpn 289 | newclient "$CLIENT" 290 | echo 291 | echo "Completed!" 292 | echo "Go to https://github.com/gayankuruppu/openvpn-install-for-multiple-users for FAQ" 293 | echo 294 | echo "duplicate-cn is added to the server.conf" 295 | echo 296 | echo "Now you can share the client certificate with unlimited number of users" 297 | echo "Please restart the server" 298 | echo 299 | echo "The client configuration is available at:" ~/"$CLIENT.ovpn" 300 | fi 301 | --------------------------------------------------------------------------------