From 1be7733c0b13bd3b5a257ca47a960c7b1ae8d727 Mon Sep 17 00:00:00 2001 From: DrXala Date: Sun, 16 Jul 2017 12:55:09 +0200 Subject: [PATCH 01/17] Install iptables systemd service for Debian, Ubuntu and Centos. Fix iptables install for ArchLinux. --- openvpn-install.sh | 67 +++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 66 insertions(+), 1 deletion(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 3bcd725..0211023 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -23,6 +23,7 @@ if [[ -e /etc/debian_version ]]; then OS="debian" # Getting the version number, to verify that a recent version of OpenVPN is available VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID") + IPTABLES='/etc/iptables/iptables.rules' RCLOCAL='/etc/rc.local' SYSCTL='/etc/sysctl.conf' if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then @@ -42,12 +43,14 @@ if [[ -e /etc/debian_version ]]; then fi elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then OS=centos + IPTABLES='/etc/iptables/iptables.rules' RCLOCAL='/etc/rc.d/rc.local' SYSCTL='/etc/sysctl.conf' # Needed for CentOS 7 chmod +x /etc/rc.d/rc.local elif [[ -e /etc/arch-release ]]; then OS=arch + IPTABLES='/etc/iptables/iptables.rules' RCLOCAL='/etc/rc.local' SYSCTL='/etc/sysctl.d/openvpn.conf' else @@ -338,9 +341,71 @@ else # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. # The we install OpenVPN apt-get install openvpn iptables openssl wget ca-certificates curl -y + # Install iptables service + if [[ ! -e /etc/systemd/system/iptables.service ]]; then + mkdir /etc/iptables + iptables-save > /etc/iptables/iptables.rules + echo "#!/bin/sh +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh + chmod +x /etc/iptables/flush-iptables.sh + echo "[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +After=systemd-sysctl.service +Before=sysinit.target +[Service] +Type=oneshot +ExecStart=/sbin/iptables-restore < /etc/iptables/iptables.rules +ExecReload=/sbin/iptables-restore < /etc/iptables/iptables.rules +ExecStop=/etc/iptables/flush-iptables.sh +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" > /etc/systemd/system/iptables.service + systemctl daemon-reload + systemctl enable iptables.service + fi elif [[ "$OS" = 'centos' ]]; then yum install epel-release -y yum install openvpn iptables openssl wget ca-certificates curl -y + # Install iptables service + if [[ ! -e /etc/systemd/system/iptables.service ]]; then + mkdir /etc/iptables + iptables-save > /etc/iptables/iptables.rules + echo "#!/bin/sh +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh + chmod +x /etc/iptables/flush-iptables.sh + echo "[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +After=systemd-sysctl.service +Before=sysinit.target +[Service] +Type=oneshot +ExecStart=/sbin/iptables-restore < /etc/iptables/iptables.rules +ExecReload=/sbin/iptables-restore < /etc/iptables/iptables.rules +ExecStop=/etc/iptables/flush-iptables.sh +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" > /etc/systemd/system/iptables.service + systemctl daemon-reload + systemctl enable iptables.service + fi else # Else, the distro is ArchLinux echo "" @@ -379,7 +444,7 @@ WantedBy=multi-user.target" > /etc/systemd/system/rc-local.service # Install dependencies pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm if [[ "$OS" = 'arch' ]]; then - touch /etc/iptables/iptables.rules # iptables won't start if this file does not exist + iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist systemctl enable iptables systemctl start iptables fi From d3d7d18ab157c21b001a23c13d8fc66318cf6c6d Mon Sep 17 00:00:00 2001 From: DrXala Date: Sun, 16 Jul 2017 14:11:29 +0200 Subject: [PATCH 02/17] Removing the use of rc.local file --- openvpn-install.sh | 55 ++++++++++++---------------------------------- 1 file changed, 14 insertions(+), 41 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 0211023..6e5f308 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -24,7 +24,6 @@ if [[ -e /etc/debian_version ]]; then # Getting the version number, to verify that a recent version of OpenVPN is available VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID") IPTABLES='/etc/iptables/iptables.rules' - RCLOCAL='/etc/rc.local' SYSCTL='/etc/sysctl.conf' if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then echo "Your version of Debian/Ubuntu is not supported." @@ -44,14 +43,10 @@ if [[ -e /etc/debian_version ]]; then elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then OS=centos IPTABLES='/etc/iptables/iptables.rules' - RCLOCAL='/etc/rc.d/rc.local' SYSCTL='/etc/sysctl.conf' - # Needed for CentOS 7 - chmod +x /etc/rc.d/rc.local elif [[ -e /etc/arch-release ]]; then OS=arch IPTABLES='/etc/iptables/iptables.rules' - RCLOCAL='/etc/rc.local' SYSCTL='/etc/sysctl.d/openvpn.conf' else echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system" @@ -157,11 +152,16 @@ if [[ -e /etc/openvpn/server.conf ]]; then firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 fi if iptables -L -n | grep -qE 'REJECT|DROP'; then - sed -i "/iptables -I INPUT -p udp --dport $PORT -j ACCEPT/d" $RCLOCAL - sed -i "/iptables -I FORWARD -s 10.8.0.0\/24 -j ACCEPT/d" $RCLOCAL - sed -i "/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT/d" $RCLOCAL + if [[ "$PROTOCOL" = 'udp' ]]; then + iptables -D INPUT -p udp --dport $PORT -j ACCEPT + else + iptables -D INPUT -p tcp --dport $PORT -j ACCEPT + fi + iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables-save > $IPTABLES fi - sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -j SNAT --to /d' $RCLOCAL + iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + iptables-save > $IPTABLES if hash sestatus 2>/dev/null; then if sestatus | grep "Current mode" | grep -qs "enforcing"; then if [[ "$PORT" != '1194' ]]; then @@ -423,28 +423,11 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service fi if [[ "$OS" = 'arch' ]]; then - # Install rc.local - echo "[Unit] -Description=/etc/rc.local compatibility - -[Service] -Type=oneshot -ExecStart=/etc/rc.local -RemainAfterExit=yes - -[Install] -WantedBy=multi-user.target" > /etc/systemd/system/rc-local.service - chmod +x /etc/rc.local - systemctl enable rc-local.service - if ! grep '#!' $RCLOCAL; then - echo "#!/bin/bash" > $RCLOCAL - fi - fi - # Install dependencies pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm if [[ "$OS" = 'arch' ]]; then iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist + systemctl daemon-reload systemctl enable iptables systemctl start iptables fi @@ -555,15 +538,10 @@ verb 3" >> /etc/openvpn/server.conf fi # Avoid an unneeded reboot echo 1 > /proc/sys/net/ipv4/ip_forward - # Needed to use rc.local with some systemd distros - if [[ "$OS" = 'debian' && ! -e $RCLOCAL ]]; then - echo '#!/bin/sh -e - exit 0' > $RCLOCAL - fi - chmod +x $RCLOCAL # Set NAT for the VPN subnet iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - sed -i "1 a\iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE" $RCLOCAL + # Save persitent iptables rules + iptables-save > $IPTABLES if pgrep firewalld; then # We don't use --add-service=openvpn because that would only work with # the default port. Using both permanent and not permanent rules to @@ -589,13 +567,8 @@ verb 3" >> /etc/openvpn/server.conf fi iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT - if [[ "$PROTOCOL" = 'UDP' ]]; then - sed -i "1 a\iptables -I INPUT -p udp --dport $PORT -j ACCEPT" $RCLOCAL - elif [[ "$PROTOCOL" = 'TCP' ]]; then - sed -i "1 a\iptables -I INPUT -p tcp --dport $PORT -j ACCEPT" $RCLOCAL - fi - sed -i "1 a\iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT" $RCLOCAL - sed -i "1 a\iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" $RCLOCAL + # save persitant OpenVPN rules + iptables-save > $IPTABLES fi # If SELinux is enabled and a custom port was selected, we need this if hash sestatus 2>/dev/null; then From 23222fd59faf75dfbe45ca75dc88c218e569fbac Mon Sep 17 00:00:00 2001 From: DrXala Date: Sun, 16 Jul 2017 15:39:14 +0200 Subject: [PATCH 03/17] Fix syntax error... --- openvpn-install.sh | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 6e5f308..99740d8 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -423,14 +423,13 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service fi if [[ "$OS" = 'arch' ]]; then - # Install dependencies - pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm - if [[ "$OS" = 'arch' ]]; then - iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist + # Install dependencies + pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm + iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist systemctl daemon-reload - systemctl enable iptables - systemctl start iptables - fi + systemctl enable iptables + systemctl start iptables + fi fi # Find out if the machine uses nogroup or nobody for the permissionless group if grep -qs "^nogroup:" /etc/group; then @@ -567,7 +566,7 @@ verb 3" >> /etc/openvpn/server.conf fi iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT - # save persitant OpenVPN rules + # Save persitent OpenVPN rules iptables-save > $IPTABLES fi # If SELinux is enabled and a custom port was selected, we need this From 8f28593112f03205392b6be4d6f208e0684d7db9 Mon Sep 17 00:00:00 2001 From: DrXala Date: Sun, 16 Jul 2017 16:01:05 +0200 Subject: [PATCH 04/17] Fix iptables.service --- openvpn-install.sh | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 99740d8..24a5c70 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -363,8 +363,8 @@ After=systemd-sysctl.service Before=sysinit.target [Service] Type=oneshot -ExecStart=/sbin/iptables-restore < /etc/iptables/iptables.rules -ExecReload=/sbin/iptables-restore < /etc/iptables/iptables.rules +ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules ExecStop=/etc/iptables/flush-iptables.sh RemainAfterExit=yes [Install] @@ -397,8 +397,8 @@ After=systemd-sysctl.service Before=sysinit.target [Service] Type=oneshot -ExecStart=/sbin/iptables-restore < /etc/iptables/iptables.rules -ExecReload=/sbin/iptables-restore < /etc/iptables/iptables.rules +ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules ExecStop=/etc/iptables/flush-iptables.sh RemainAfterExit=yes [Install] From b5c624eb76f50c1edeb0e230d8e7fec042f95f5b Mon Sep 17 00:00:00 2001 From: DrXala Date: Thu, 20 Jul 2017 17:12:40 +0200 Subject: [PATCH 05/17] Adjust indents + change iptables.service --- openvpn-install.sh | 106 ++++++++++++++++++++++----------------------- 1 file changed, 53 insertions(+), 53 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 24a5c70..3580e5d 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -23,7 +23,7 @@ if [[ -e /etc/debian_version ]]; then OS="debian" # Getting the version number, to verify that a recent version of OpenVPN is available VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID") - IPTABLES='/etc/iptables/iptables.rules' + IPTABLES='/etc/iptables/iptables.rules' SYSCTL='/etc/sysctl.conf' if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then echo "Your version of Debian/Ubuntu is not supported." @@ -42,11 +42,11 @@ if [[ -e /etc/debian_version ]]; then fi elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then OS=centos - IPTABLES='/etc/iptables/iptables.rules' + IPTABLES='/etc/iptables/iptables.rules' SYSCTL='/etc/sysctl.conf' elif [[ -e /etc/arch-release ]]; then OS=arch - IPTABLES='/etc/iptables/iptables.rules' + IPTABLES='/etc/iptables/iptables.rules' SYSCTL='/etc/sysctl.d/openvpn.conf' else echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system" @@ -152,16 +152,16 @@ if [[ -e /etc/openvpn/server.conf ]]; then firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 fi if iptables -L -n | grep -qE 'REJECT|DROP'; then - if [[ "$PROTOCOL" = 'udp' ]]; then - iptables -D INPUT -p udp --dport $PORT -j ACCEPT - else - iptables -D INPUT -p tcp --dport $PORT -j ACCEPT - fi - iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables-save > $IPTABLES + if [[ "$PROTOCOL" = 'udp' ]]; then + iptables -D INPUT -p udp --dport $PORT -j ACCEPT + else + iptables -D INPUT -p tcp --dport $PORT -j ACCEPT + fi + iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables-save > $IPTABLES fi - iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - iptables-save > $IPTABLES + iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + iptables-save > $IPTABLES if hash sestatus 2>/dev/null; then if sestatus | grep "Current mode" | grep -qs "enforcing"; then if [[ "$PORT" != '1194' ]]; then @@ -341,11 +341,11 @@ else # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. # The we install OpenVPN apt-get install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > /etc/iptables/iptables.rules - echo "#!/bin/sh + # Install iptables service + if [[ ! -e /etc/systemd/system/iptables.service ]]; then + mkdir /etc/iptables + iptables-save > /etc/iptables/iptables.rules + echo "#!/bin/sh iptables -F iptables -X iptables -t nat -F @@ -355,12 +355,12 @@ iptables -t mangle -X iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] + chmod +x /etc/iptables/flush-iptables.sh + echo "[Unit] Description=Packet Filtering Framework DefaultDependencies=no -After=systemd-sysctl.service -Before=sysinit.target +Before=network-pre.target +Wants=network-pre.target [Service] Type=oneshot ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules @@ -369,17 +369,17 @@ ExecStop=/etc/iptables/flush-iptables.sh RemainAfterExit=yes [Install] WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - fi + systemctl daemon-reload + systemctl enable iptables.service + fi elif [[ "$OS" = 'centos' ]]; then yum install epel-release -y yum install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > /etc/iptables/iptables.rules - echo "#!/bin/sh + # Install iptables service + if [[ ! -e /etc/systemd/system/iptables.service ]]; then + mkdir /etc/iptables + iptables-save > /etc/iptables/iptables.rules + echo "#!/bin/sh iptables -F iptables -X iptables -t nat -F @@ -389,12 +389,12 @@ iptables -t mangle -X iptables -P INPUT ACCEPT iptables -P FORWARD ACCEPT iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] + chmod +x /etc/iptables/flush-iptables.sh + echo "[Unit] Description=Packet Filtering Framework DefaultDependencies=no -After=systemd-sysctl.service -Before=sysinit.target +Before=network-pre.target +Wants=network-pre.target [Service] Type=oneshot ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules @@ -403,9 +403,9 @@ ExecStop=/etc/iptables/flush-iptables.sh RemainAfterExit=yes [Install] WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - fi + systemctl daemon-reload + systemctl enable iptables.service + fi else # Else, the distro is ArchLinux echo "" @@ -423,19 +423,19 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service fi if [[ "$OS" = 'arch' ]]; then - # Install dependencies - pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm - iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist - systemctl daemon-reload - systemctl enable iptables - systemctl start iptables - fi + # Install dependencies + pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm + iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist + systemctl daemon-reload + systemctl enable iptables + systemctl start iptables + fi fi # Find out if the machine uses nogroup or nobody for the permissionless group if grep -qs "^nogroup:" /etc/group; then - NOGROUP=nogroup + NOGROUP=nogroup else - NOGROUP=nobody + NOGROUP=nobody fi # An old version of easy-rsa was available by default in some openvpn packages @@ -539,8 +539,8 @@ verb 3" >> /etc/openvpn/server.conf echo 1 > /proc/sys/net/ipv4/ip_forward # Set NAT for the VPN subnet iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - # Save persitent iptables rules - iptables-save > $IPTABLES + # Save persitent iptables rules + iptables-save > $IPTABLES if pgrep firewalld; then # We don't use --add-service=openvpn because that would only work with # the default port. Using both permanent and not permanent rules to @@ -566,8 +566,8 @@ verb 3" >> /etc/openvpn/server.conf fi iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT - # Save persitent OpenVPN rules - iptables-save > $IPTABLES + # Save persitent OpenVPN rules + iptables-save > $IPTABLES fi # If SELinux is enabled and a custom port was selected, we need this if hash sestatus 2>/dev/null; then @@ -627,10 +627,10 @@ verb 3" >> /etc/openvpn/server.conf echo "" echo "Looks like your server is behind a NAT!" echo "" - echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," - echo "then I need to know the address that can be used to access it from outside." - echo "If that's not the case, just ignore this and leave the next field blank" - read -p "External IP or domain name: " -e USEREXTERNALIP + echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," + echo "then I need to know the address that can be used to access it from outside." + echo "If that's not the case, just ignore this and leave the next field blank" + read -p "External IP or domain name: " -e USEREXTERNALIP if [[ "$USEREXTERNALIP" != "" ]]; then IP=$USEREXTERNALIP fi From 641510984bbbc4848c626fc8e451ad48af8622e7 Mon Sep 17 00:00:00 2001 From: Nathan Date: Sun, 27 Aug 2017 13:59:08 -0500 Subject: [PATCH 06/17] Adding auth-nocache Option to .ovpn Configuration --- openvpn-install.sh | 1 + 1 file changed, 1 insertion(+) diff --git a/openvpn-install.sh b/openvpn-install.sh index 3b49d31..eb1dcbd 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -622,6 +622,7 @@ persist-key persist-tun remote-cert-tls server auth SHA256 +auth-nocache $CIPHER tls-client tls-version-min 1.2 From 97fa24e884a6c882fbe41323a9f3486c30a5a40f Mon Sep 17 00:00:00 2001 From: Angristan Date: Tue, 3 Oct 2017 15:30:13 +0200 Subject: [PATCH 07/17] Fix title class --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 44d4f97..4e3b60b 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,4 @@ -## OpenVPN-install +# OpenVPN-install Secure OpenVPN installer for Debian, Ubuntu, CentOS and Arch Linux. This script will let you setup your own secure VPN server in just a few minutes. From dccbe2f71d9b2f96874730cfb07dc4c5924b42c7 Mon Sep 17 00:00:00 2001 From: Angristan Date: Mon, 9 Oct 2017 17:12:46 +0200 Subject: [PATCH 08/17] Add AdGuard DNS --- openvpn-install.sh | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index b0603db..9c92191 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -223,8 +223,9 @@ else echo " 4) OpenDNS (Anycast: worldwide)" echo " 5) Google (Anycast: worldwide)" echo " 6) Yandex Basic (Russia)" - while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" && $DNS != "6" ]]; do - read -p "DNS [1-6]: " -e -i 1 DNS + echo " 7) AdGuard DNS (Russia)" + while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" && $DNS != "6" && $DNS != "7" ]]; do + read -p "DNS [1-7]: " -e -i 1 DNS done echo "" echo "See https://github.com/Angristan/OpenVPN-install#encryption to learn more about " @@ -471,6 +472,10 @@ ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 77.88.8.8"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 77.88.8.1"' >> /etc/openvpn/server.conf ;; + 7) #AdGuard DNS + echo 'push "dhcp-option DNS 176.103.130.130"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf + ;; esac echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf echo "crl-verify crl.pem From db182bc741c1b6face4330794a0c69bc5a973989 Mon Sep 17 00:00:00 2001 From: Angristan Date: Mon, 9 Oct 2017 19:43:49 +0200 Subject: [PATCH 09/17] Add AdGuard DNS https://github.com/Angristan/OpenVPN-install/commit/dccbe2f71d9b2f96874730cfb07dc4c5924b42c7 --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 4e3b60b..fa08d8d 100644 --- a/README.md +++ b/README.md @@ -93,6 +93,7 @@ Here are the possibilities : - [OpenDNS](https://en.wikipedia.org/wiki/OpenDNS), not recommened but fast wordlwide (Anycast servers) - [Google Public DNS](https://en.wikipedia.org/wiki/Google_Public_DNS), not recommended, but fast worldwide (Anycast servers) - [Yandex Basic DNS](https://dns.yandex.com/), not recommended, but fast in Russia +- [AdGuard DNS](https://github.com/AdguardTeam/AdguardDNS), located in Russia, blocks ads and trackers - Soon : local resolver :D Any other fast, trustable and neutral servers proposition is welcome. From a0821ee5b4f4a4239006d7255b95c952ddf0442d Mon Sep 17 00:00:00 2001 From: Angristan Date: Tue, 17 Oct 2017 22:05:11 +0200 Subject: [PATCH 10/17] Fix typo --- openvpn-install.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 9c92191..be8f3fe 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -294,7 +294,7 @@ else echo " 2) 3072 bits (recommended, best compromise)" echo " 3) 4096 bits (most secure)" while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do - read -p "DH key size [1-3]: " -e -i 2 RSA_KEY_SIZE + read -p "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE done case $RSA_KEY_SIZE in 1) From 8a384191de579d623b96267b4fedc33398e663c0 Mon Sep 17 00:00:00 2001 From: Angristan Date: Mon, 30 Oct 2017 23:43:51 +0100 Subject: [PATCH 11/17] Add link to OpenVPN 2.4 PR I don't know when I'll finish the PR but the script is working so I think it's a good idea to give it a bit more visibility until I merge it into master --- README.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index fa08d8d..98c377e 100644 --- a/README.md +++ b/README.md @@ -46,7 +46,9 @@ The only drawback is that you need to use a recent version of OpenVPN, because s On the client-side, it's less problematic, but if you want to use an OpenVPN server installed with this script with an old client (\<2.3.3), it won't work. However I don't see why you would use an outdated client. -**TL;DR**, this script is relatively secure, and you can just press enter in the setup. +**TL;DR**, this script is relatively secure, and you can just press enter in the setup. + +**[A Pull Request](https://github.com/Angristan/OpenVPN-install/pull/96) is currently being worked on to implement the latest OpenVPN 2.4 features.** ## Compatibility From a7a277e2dc5e6d77a355a4cb60bb85032d724c65 Mon Sep 17 00:00:00 2001 From: Angristan Date: Sun, 12 Nov 2017 15:48:39 +0100 Subject: [PATCH 12/17] Remove "local" parameter Revert https://github.com/Angristan/OpenVPN-install/commit/ad3c223385a9aa323227633fcc5e456d1235e873 On some servers, this prevented OpenVPN to start on boot. (Socket bind failed on local address [AF_INET] IP:1194 Cannot assign requested address) --- openvpn-install.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index be8f3fe..c826160 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -428,8 +428,7 @@ WantedBy=multi-user.target" > /etc/systemd/system/rc-local.service chmod 644 /etc/openvpn/crl.pem # Generate server.conf - echo "local $IP" > /etc/openvpn/server.conf - echo "port $PORT" >> /etc/openvpn/server.conf + echo "port $PORT" > /etc/openvpn/server.conf if [[ "$PROTOCOL" = 'UDP' ]]; then echo "proto udp" >> /etc/openvpn/server.conf elif [[ "$PROTOCOL" = 'TCP' ]]; then From ed17fc074d9c6d2a0441593b416d96e734152def Mon Sep 17 00:00:00 2001 From: Angristan Date: Sun, 12 Nov 2017 18:07:07 +0100 Subject: [PATCH 13/17] Resolve conflicts Merge changes from master to resolve conflicts --- openvpn-install.sh | 86 +++++++++++++++++++++++++++------------------- 1 file changed, 50 insertions(+), 36 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 3580e5d..4b6f398 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -54,21 +54,29 @@ else fi newclient () { + # Where to write the custom client.ovpn? + if [ -e /home/$1 ]; then # if $1 is a user name + homeDir="/home/$1" + elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER + homeDir="/home/${SUDO_USER}" + else # if not SUDO_USER, use /root + homeDir="/root" + fi # Generates the custom client.ovpn - cp /etc/openvpn/client-template.txt ~/$1.ovpn - echo "" >> ~/$1.ovpn - cat /etc/openvpn/easy-rsa/pki/ca.crt >> ~/$1.ovpn - echo "" >> ~/$1.ovpn - echo "" >> ~/$1.ovpn - cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> ~/$1.ovpn - echo "" >> ~/$1.ovpn - echo "" >> ~/$1.ovpn - cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ~/$1.ovpn - echo "" >> ~/$1.ovpn - echo "key-direction 1" >> ~/$1.ovpn - echo "" >> ~/$1.ovpn - cat /etc/openvpn/tls-auth.key >> ~/$1.ovpn - echo "" >> ~/$1.ovpn + cp /etc/openvpn/client-template.txt $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + cat /etc/openvpn/easy-rsa/pki/ca.crt >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + cat /etc/openvpn/easy-rsa/pki/private/$1.key >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + echo "key-direction 1" >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + cat /etc/openvpn/tls-auth.key >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn } # Try to get our IP from the system and fallback to the Internet. @@ -106,7 +114,7 @@ if [[ -e /etc/openvpn/server.conf ]]; then # Generates the custom client.ovpn newclient "$CLIENT" echo "" - echo "Client $CLIENT added, certs available at ~/$CLIENT.ovpn" + echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" exit ;; 2) @@ -127,7 +135,7 @@ if [[ -e /etc/openvpn/server.conf ]]; then CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) cd /etc/openvpn/easy-rsa/ ./easyrsa --batch revoke $CLIENT - ./easyrsa gen-crl + EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl rm -rf pki/reqs/$CLIENT.req rm -rf pki/private/$CLIENT.key rm -rf pki/issued/$CLIENT.crt @@ -218,8 +226,9 @@ else echo " 4) OpenDNS (Anycast: worldwide)" echo " 5) Google (Anycast: worldwide)" echo " 6) Yandex Basic (Russia)" - while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" && $DNS != "6" ]]; do - read -p "DNS [1-6]: " -e -i 1 DNS + echo " 7) AdGuard DNS (Russia)" + while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" && $DNS != "6" && $DNS != "7" ]]; do + read -p "DNS [1-7]: " -e -i 1 DNS done echo "" echo "See https://github.com/Angristan/OpenVPN-install#encryption to learn more about " @@ -288,7 +297,7 @@ else echo " 2) 3072 bits (recommended, best compromise)" echo " 3) 4096 bits (most secure)" while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do - read -p "DH key size [1-3]: " -e -i 2 RSA_KEY_SIZE + read -p "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE done case $RSA_KEY_SIZE in 1) @@ -316,25 +325,25 @@ else # We add the OpenVPN repo to get the latest version. # Debian 7 if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then - echo "deb http://swupdate.openvpn.net/apt wheezy main" > /etc/apt/sources.list.d/swupdate-openvpn.list + echo "deb http://build.openvpn.net/debian/openvpn/stable wheezy main" > /etc/apt/sources.list.d/openvpn.list wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - apt-get update fi # Debian 8 if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then - echo "deb http://swupdate.openvpn.net/apt jessie main" > /etc/apt/sources.list.d/swupdate-openvpn.list + echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - apt update fi # Ubuntu 12.04 if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then - echo "deb http://swupdate.openvpn.net/apt precise main" > /etc/apt/sources.list.d/swupdate-openvpn.list + echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - apt-get update fi # Ubuntu 14.04 if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then - echo "deb http://swupdate.openvpn.net/apt trusty main" > /etc/apt/sources.list.d/swupdate-openvpn.list + echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - apt-get update fi @@ -443,12 +452,12 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service rm -rf /etc/openvpn/easy-rsa/ fi # Get easy-rsa - wget -O ~/EasyRSA-3.0.1.tgz https://github.com/OpenVPN/easy-rsa/releases/download/3.0.1/EasyRSA-3.0.1.tgz - tar xzf ~/EasyRSA-3.0.1.tgz -C ~/ - mv ~/EasyRSA-3.0.1/ /etc/openvpn/ - mv /etc/openvpn/EasyRSA-3.0.1/ /etc/openvpn/easy-rsa/ + wget -O ~/EasyRSA-3.0.3.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz + tar xzf ~/EasyRSA-3.0.3.tgz -C ~/ + mv ~/EasyRSA-3.0.3/ /etc/openvpn/ + mv /etc/openvpn/EasyRSA-3.0.3/ /etc/openvpn/easy-rsa/ chown -R root:root /etc/openvpn/easy-rsa/ - rm -rf ~/EasyRSA-3.0.1.tgz + rm -rf ~/EasyRSA-3.0.3.tgz cd /etc/openvpn/easy-rsa/ echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars # Create the PKI, set up the CA, the DH params and the server + client certificates @@ -457,14 +466,14 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service openssl dhparam -out dh.pem $DH_KEY_SIZE ./easyrsa build-server-full server nopass ./easyrsa build-client-full $CLIENT nopass - ./easyrsa gen-crl + EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl # generate tls-auth key openvpn --genkey --secret /etc/openvpn/tls-auth.key # Move all the generated files cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn # Make cert revocation list readable for non-root chmod 644 /etc/openvpn/crl.pem - + # Generate server.conf echo "port $PORT" > /etc/openvpn/server.conf if [[ "$PROTOCOL" = 'UDP' ]]; then @@ -509,6 +518,10 @@ ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 77.88.8.8"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 77.88.8.1"' >> /etc/openvpn/server.conf ;; + 7) #AdGuard DNS + echo 'push "dhcp-option DNS 176.103.130.130"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf + ;; esac echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf echo "crl-verify crl.pem @@ -567,7 +580,7 @@ verb 3" >> /etc/openvpn/server.conf iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT # Save persitent OpenVPN rules - iptables-save > $IPTABLES + iptables-save > $IPTABLES fi # If SELinux is enabled and a custom port was selected, we need this if hash sestatus 2>/dev/null; then @@ -627,10 +640,10 @@ verb 3" >> /etc/openvpn/server.conf echo "" echo "Looks like your server is behind a NAT!" echo "" - echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," - echo "then I need to know the address that can be used to access it from outside." - echo "If that's not the case, just ignore this and leave the next field blank" - read -p "External IP or domain name: " -e USEREXTERNALIP + echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," + echo "then I need to know the address that can be used to access it from outside." + echo "If that's not the case, just ignore this and leave the next field blank" + read -p "External IP or domain name: " -e USEREXTERNALIP if [[ "$USEREXTERNALIP" != "" ]]; then IP=$USEREXTERNALIP fi @@ -650,6 +663,7 @@ persist-key persist-tun remote-cert-tls server auth SHA256 +auth-nocache $CIPHER tls-client tls-version-min 1.2 @@ -662,7 +676,7 @@ verb 3" >> /etc/openvpn/client-template.txt echo "" echo "Finished!" echo "" - echo "Your client config is available at ~/$CLIENT.ovpn" + echo "Your client config is available at $homeDir/$CLIENT.ovpn" echo "If you want to add more clients, you simply need to run this script another time!" fi exit 0; From dcec3f12a469bb63668fcf1c051ca9811d9db94c Mon Sep 17 00:00:00 2001 From: Angristan Date: Sun, 12 Nov 2017 18:30:05 +0100 Subject: [PATCH 14/17] Disable firewalld to allow iptables to start upon reboot --- openvpn-install.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/openvpn-install.sh b/openvpn-install.sh index 4b6f398..e3b8f8e 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -414,6 +414,8 @@ RemainAfterExit=yes WantedBy=multi-user.target" > /etc/systemd/system/iptables.service systemctl daemon-reload systemctl enable iptables.service + # Disable firewalld to allow iptables to start upon reboot + systemctl disable firewalld fi else # Else, the distro is ArchLinux From aca3b4a019c3545331e2f8e39af65ac730501d6a Mon Sep 17 00:00:00 2001 From: Angristan Date: Sun, 12 Nov 2017 19:54:44 +0100 Subject: [PATCH 15/17] Fix the network interface variable Fix for https://github.com/Angristan/OpenVPN-install/pull/83#issuecomment-343758329 --- openvpn-install.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index e3b8f8e..2f0dfa4 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -87,7 +87,7 @@ if [[ "$IP" = "" ]]; then IP=$(wget -qO- ipv4.icanhazip.com) fi # Get Internet network interface with default route -NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)') +NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) if [[ -e /etc/openvpn/server.conf ]]; then while : From 80fd8678a6845744018af89bea565ebdb26f83d5 Mon Sep 17 00:00:00 2001 From: Angristan Date: Sun, 12 Nov 2017 22:51:54 +0100 Subject: [PATCH 16/17] Revert "Merge PR #83 : Remove rc.local and use an iptables systemd service" This reverts commit e874013112b5b288bc7cdf7b3e933acc69d3a747, reversing changes made to 998d1e8b13645ade038e4167dac641153edc58fe. --- openvpn-install.sh | 1846 ++++++++++++++------------------------------ 1 file changed, 562 insertions(+), 1284 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 62ee62c..bf2f4d5 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -5,78 +5,80 @@ if [[ "$EUID" -ne 0 ]]; then - echo "Sorry, you need to run this as root" - exit 1 + echo "Sorry, you need to run this as root" + exit 1 fi if [[ ! -e /dev/net/tun ]]; then - echo "TUN is not available" - exit 2 + echo "TUN is not available" + exit 2 fi if grep -qs "CentOS release 5" "/etc/redhat-release"; then - echo "CentOS 5 is too old and not supported" - exit 3 + echo "CentOS 5 is too old and not supported" + exit 3 fi if [[ -e /etc/debian_version ]]; then - OS="debian" - # Getting the version number, to verify that a recent version of OpenVPN is available - VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID") - IPTABLES='/etc/iptables/iptables.rules' - SYSCTL='/etc/sysctl.conf' - if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then - echo "Your version of Debian/Ubuntu is not supported." - echo "I can't install a recent version of OpenVPN on your system." - echo "" - echo "However, if you're using Debian unstable/testing, or Ubuntu beta," - echo "then you can continue, a recent version of OpenVPN is available on these." - echo "Keep in mind they are not supported, though." - while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do - read -p "Continue ? [y/n]: " -e CONTINUE - done - if [[ "$CONTINUE" = "n" ]]; then - echo "Ok, bye !" - exit 4 - fi - fi + OS="debian" + # Getting the version number, to verify that a recent version of OpenVPN is available + VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID") + RCLOCAL='/etc/rc.local' + SYSCTL='/etc/sysctl.conf' + if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then + echo "Your version of Debian/Ubuntu is not supported." + echo "I can't install a recent version of OpenVPN on your system." + echo "" + echo "However, if you're using Debian unstable/testing, or Ubuntu beta," + echo "then you can continue, a recent version of OpenVPN is available on these." + echo "Keep in mind they are not supported, though." + while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do + read -p "Continue ? [y/n]: " -e CONTINUE + done + if [[ "$CONTINUE" = "n" ]]; then + echo "Ok, bye !" + exit 4 + fi + fi elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then - OS=centos - IPTABLES='/etc/iptables/iptables.rules' - SYSCTL='/etc/sysctl.conf' + OS=centos + RCLOCAL='/etc/rc.d/rc.local' + SYSCTL='/etc/sysctl.conf' + # Needed for CentOS 7 + chmod +x /etc/rc.d/rc.local elif [[ -e /etc/arch-release ]]; then - OS=arch - IPTABLES='/etc/iptables/iptables.rules' - SYSCTL='/etc/sysctl.d/openvpn.conf' + OS=arch + RCLOCAL='/etc/rc.local' + SYSCTL='/etc/sysctl.d/openvpn.conf' else - echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system" - exit 4 + echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system" + exit 4 fi newclient () { - # Where to write the custom client.ovpn? - if [ -e /home/$1 ]; then # if $1 is a user name - homeDir="/home/$1" - elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER - homeDir="/home/${SUDO_USER}" - else # if not SUDO_USER, use /root - homeDir="/root" - fi - # Generates the custom client.ovpn - cp /etc/openvpn/client-template.txt $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - cat /etc/openvpn/easy-rsa/pki/ca.crt >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - cat /etc/openvpn/easy-rsa/pki/private/$1.key >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - echo "key-direction 1" >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - cat /etc/openvpn/tls-auth.key >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn + # Where to write the custom client.ovpn? + if [ -e /home/$1 ]; then # if $1 is a user name + homeDir="/home/$1" + elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER + homeDir="/home/${SUDO_USER}" + else # if not SUDO_USER, use /root + homeDir="/root" + fi + # Generates the custom client.ovpn + cp /etc/openvpn/client-template.txt $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + cat /etc/openvpn/easy-rsa/pki/ca.crt >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + cat /etc/openvpn/easy-rsa/pki/private/$1.key >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + echo "key-direction 1" >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + cat /etc/openvpn/tls-auth.key >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn } # Try to get our IP from the system and fallback to the Internet. @@ -84,406 +86,355 @@ newclient () { # and to avoid getting an IPv6. IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) if [[ "$IP" = "" ]]; then - IP=$(wget -qO- ipv4.icanhazip.com) + IP=$(wget -qO- ipv4.icanhazip.com) fi # Get Internet network interface with default route -NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) +NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)') if [[ -e /etc/openvpn/server.conf ]]; then - while : - do - clear - echo "OpenVPN-install (github.com/Angristan/OpenVPN-install)" - echo "" - echo "Looks like OpenVPN is already installed" - echo "" - echo "What do you want to do?" - echo " 1) Add a cert for a new user" - echo " 2) Revoke existing user cert" - echo " 3) Remove OpenVPN" - echo " 4) Exit" - read -p "Select an option [1-4]: " option - case $option in - 1) - echo "" - echo "Tell me a name for the client cert" - echo "Please, use one word only, no special characters" - read -p "Client name: " -e -i client CLIENT - cd /etc/openvpn/easy-rsa/ - ./easyrsa build-client-full $CLIENT nopass - # Generates the custom client.ovpn - newclient "$CLIENT" - echo "" - echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" - exit - ;; - 2) - NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") - if [[ "$NUMBEROFCLIENTS" = '0' ]]; then - echo "" - echo "You have no existing clients!" - exit 5 - fi - echo "" - echo "Select the existing client certificate you want to revoke" - tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' - if [[ "$NUMBEROFCLIENTS" = '1' ]]; then - read -p "Select one client [1]: " CLIENTNUMBER - else - read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER - fi - CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) - cd /etc/openvpn/easy-rsa/ - ./easyrsa --batch revoke $CLIENT - EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl - rm -rf pki/reqs/$CLIENT.req - rm -rf pki/private/$CLIENT.key - rm -rf pki/issued/$CLIENT.crt - rm -rf /etc/openvpn/crl.pem - cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem - chmod 644 /etc/openvpn/crl.pem - echo "" - echo "Certificate for client $CLIENT revoked" - echo "Exiting..." - exit - ;; - 3) - echo "" - read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE - if [[ "$REMOVE" = 'y' ]]; then - PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) - if pgrep firewalld; then - # Using both permanent and not permanent rules to avoid a firewalld reload. - firewall-cmd --zone=public --remove-port=$PORT/udp - firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 - firewall-cmd --permanent --zone=public --remove-port=$PORT/udp - firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 - fi - if iptables -L -n | grep -qE 'REJECT|DROP'; then - if [[ "$PROTOCOL" = 'udp' ]]; then - iptables -D INPUT -p udp --dport $PORT -j ACCEPT - else - iptables -D INPUT -p tcp --dport $PORT -j ACCEPT - fi - iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables-save > $IPTABLES - fi - iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - iptables-save > $IPTABLES - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - semanage port -d -t openvpn_port_t -p udp $PORT - fi - fi - fi - if [[ "$OS" = 'debian' ]]; then - apt-get autoremove --purge -y openvpn - elif [[ "$OS" = 'arch' ]]; then - pacman -R openvpn --noconfirm - else - yum remove openvpn -y - fi - rm -rf /etc/openvpn - rm -rf /usr/share/doc/openvpn* - echo "" - echo "OpenVPN removed!" - else - echo "" - echo "Removal aborted!" - fi - exit - ;; - 4) exit;; - esac - done + while : + do + clear + echo "OpenVPN-install (github.com/Angristan/OpenVPN-install)" + echo "" + echo "Looks like OpenVPN is already installed" + echo "" + echo "What do you want to do?" + echo " 1) Add a cert for a new user" + echo " 2) Revoke existing user cert" + echo " 3) Remove OpenVPN" + echo " 4) Exit" + read -p "Select an option [1-4]: " option + case $option in + 1) + echo "" + echo "Tell me a name for the client cert" + echo "Please, use one word only, no special characters" + read -p "Client name: " -e -i client CLIENT + cd /etc/openvpn/easy-rsa/ + ./easyrsa build-client-full $CLIENT nopass + # Generates the custom client.ovpn + newclient "$CLIENT" + echo "" + echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" + exit + ;; + 2) + NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") + if [[ "$NUMBEROFCLIENTS" = '0' ]]; then + echo "" + echo "You have no existing clients!" + exit 5 + fi + echo "" + echo "Select the existing client certificate you want to revoke" + tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' + if [[ "$NUMBEROFCLIENTS" = '1' ]]; then + read -p "Select one client [1]: " CLIENTNUMBER + else + read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER + fi + CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) + cd /etc/openvpn/easy-rsa/ + ./easyrsa --batch revoke $CLIENT + EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl + rm -rf pki/reqs/$CLIENT.req + rm -rf pki/private/$CLIENT.key + rm -rf pki/issued/$CLIENT.crt + rm -rf /etc/openvpn/crl.pem + cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem + chmod 644 /etc/openvpn/crl.pem + echo "" + echo "Certificate for client $CLIENT revoked" + echo "Exiting..." + exit + ;; + 3) + echo "" + read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE + if [[ "$REMOVE" = 'y' ]]; then + PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) + if pgrep firewalld; then + # Using both permanent and not permanent rules to avoid a firewalld reload. + firewall-cmd --zone=public --remove-port=$PORT/udp + firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 + firewall-cmd --permanent --zone=public --remove-port=$PORT/udp + firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 + fi + if iptables -L -n | grep -qE 'REJECT|DROP'; then + sed -i "/iptables -I INPUT -p udp --dport $PORT -j ACCEPT/d" $RCLOCAL + sed -i "/iptables -I FORWARD -s 10.8.0.0\/24 -j ACCEPT/d" $RCLOCAL + sed -i "/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT/d" $RCLOCAL + fi + sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -j SNAT --to /d' $RCLOCAL + if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + semanage port -d -t openvpn_port_t -p udp $PORT + fi + fi + fi + if [[ "$OS" = 'debian' ]]; then + apt-get autoremove --purge -y openvpn + elif [[ "$OS" = 'arch' ]]; then + pacman -R openvpn --noconfirm + else + yum remove openvpn -y + fi + rm -rf /etc/openvpn + rm -rf /usr/share/doc/openvpn* + echo "" + echo "OpenVPN removed!" + else + echo "" + echo "Removal aborted!" + fi + exit + ;; + 4) exit;; + esac + done else - clear - echo "Welcome to the secure OpenVPN installer (github.com/Angristan/OpenVPN-install)" - echo "" - # OpenVPN setup and first user creation - echo "I need to ask you a few questions before starting the setup" - echo "You can leave the default options and just press enter if you are ok with them" - echo "" - echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." - echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)" - echo "Otherwise, it should be your public IPv4 address." - read -p "IP address: " -e -i $IP IP - echo "" - echo "What port do you want for OpenVPN?" - read -p "Port: " -e -i 1194 PORT - echo "" - echo "What protocol do you want for OpenVPN?" - echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)" - while [[ $PROTOCOL != "UDP" && $PROTOCOL != "TCP" ]]; do - read -p "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL - done - echo "" - echo "What DNS do you want to use with the VPN?" - echo " 1) Current system resolvers (in /etc/resolv.conf)" - echo " 2) FDN (France)" - echo " 3) DNS.WATCH (Germany)" - echo " 4) OpenDNS (Anycast: worldwide)" - echo " 5) Google (Anycast: worldwide)" - echo " 6) Yandex Basic (Russia)" - echo " 7) AdGuard DNS (Russia)" - while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" && $DNS != "6" && $DNS != "7" ]]; do - read -p "DNS [1-7]: " -e -i 1 DNS - done - echo "" - echo "See https://github.com/Angristan/OpenVPN-install#encryption to learn more about " - echo "the encryption in OpenVPN and the choices I made in this script." - echo "Please note that all the choices proposed are secure (to a different degree)" - echo "and are still viable to date, unlike some default OpenVPN options" - echo '' - echo "Choose which cipher you want to use for the data channel:" - echo " 1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)" - echo " 2) AES-192-CBC" - echo " 3) AES-256-CBC" - echo "Alternatives to AES, use them only if you know what you're doing." - echo "They are relatively slower but as secure as AES." - echo " 4) CAMELLIA-128-CBC" - echo " 5) CAMELLIA-192-CBC" - echo " 6) CAMELLIA-256-CBC" - echo " 7) SEED-CBC" - while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" && $CIPHER != "7" ]]; do - read -p "Cipher [1-7]: " -e -i 1 CIPHER - done - case $CIPHER in - 1) - CIPHER="cipher AES-128-CBC" - ;; - 2) - CIPHER="cipher AES-192-CBC" - ;; - 3) - CIPHER="cipher AES-256-CBC" - ;; - 4) - CIPHER="cipher CAMELLIA-128-CBC" - ;; - 5) - CIPHER="cipher CAMELLIA-192-CBC" - ;; - 6) - CIPHER="cipher CAMELLIA-256-CBC" - ;; - 7) - CIPHER="cipher SEED-CBC" - ;; - esac - echo "" - echo "Choose what size of Diffie-Hellman key you want to use:" - echo " 1) 2048 bits (fastest)" - echo " 2) 3072 bits (recommended, best compromise)" - echo " 3) 4096 bits (most secure)" - while [[ $DH_KEY_SIZE != "1" && $DH_KEY_SIZE != "2" && $DH_KEY_SIZE != "3" ]]; do - read -p "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE - done - case $DH_KEY_SIZE in - 1) - DH_KEY_SIZE="2048" - ;; - 2) - DH_KEY_SIZE="3072" - ;; - 3) - DH_KEY_SIZE="4096" - ;; - esac - echo "" - echo "Choose what size of RSA key you want to use:" - echo " 1) 2048 bits (fastest)" - echo " 2) 3072 bits (recommended, best compromise)" - echo " 3) 4096 bits (most secure)" - while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do - read -p "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE - done - case $RSA_KEY_SIZE in - 1) - RSA_KEY_SIZE="2048" - ;; - 2) - RSA_KEY_SIZE="3072" - ;; - 3) - RSA_KEY_SIZE="4096" - ;; - esac - echo "" - echo "Finally, tell me a name for the client certificate and configuration" - while [[ $CLIENT = "" ]]; do - echo "Please, use one word only, no special characters" - read -p "Client name: " -e -i client CLIENT - done - echo "" - echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" - read -n1 -r -p "Press any key to continue..." + clear + echo "Welcome to the secure OpenVPN installer (github.com/Angristan/OpenVPN-install)" + echo "" + # OpenVPN setup and first user creation + echo "I need to ask you a few questions before starting the setup" + echo "You can leave the default options and just press enter if you are ok with them" + echo "" + echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." + echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)" + echo "Otherwise, it should be your public IPv4 address." + read -p "IP address: " -e -i $IP IP + echo "" + echo "What port do you want for OpenVPN?" + read -p "Port: " -e -i 1194 PORT + echo "" + echo "What protocol do you want for OpenVPN?" + echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)" + while [[ $PROTOCOL != "UDP" && $PROTOCOL != "TCP" ]]; do + read -p "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL + done + echo "" + echo "What DNS do you want to use with the VPN?" + echo " 1) Current system resolvers (in /etc/resolv.conf)" + echo " 2) FDN (France)" + echo " 3) DNS.WATCH (Germany)" + echo " 4) OpenDNS (Anycast: worldwide)" + echo " 5) Google (Anycast: worldwide)" + echo " 6) Yandex Basic (Russia)" + echo " 7) AdGuard DNS (Russia)" + while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" && $DNS != "6" && $DNS != "7" ]]; do + read -p "DNS [1-7]: " -e -i 1 DNS + done + echo "" + echo "See https://github.com/Angristan/OpenVPN-install#encryption to learn more about " + echo "the encryption in OpenVPN and the choices I made in this script." + echo "Please note that all the choices proposed are secure (to a different degree)" + echo "and are still viable to date, unlike some default OpenVPN options" + echo '' + echo "Choose which cipher you want to use for the data channel:" + echo " 1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)" + echo " 2) AES-192-CBC" + echo " 3) AES-256-CBC" + echo "Alternatives to AES, use them only if you know what you're doing." + echo "They are relatively slower but as secure as AES." + echo " 4) CAMELLIA-128-CBC" + echo " 5) CAMELLIA-192-CBC" + echo " 6) CAMELLIA-256-CBC" + echo " 7) SEED-CBC" + while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" && $CIPHER != "7" ]]; do + read -p "Cipher [1-7]: " -e -i 1 CIPHER + done + case $CIPHER in + 1) + CIPHER="cipher AES-128-CBC" + ;; + 2) + CIPHER="cipher AES-192-CBC" + ;; + 3) + CIPHER="cipher AES-256-CBC" + ;; + 4) + CIPHER="cipher CAMELLIA-128-CBC" + ;; + 5) + CIPHER="cipher CAMELLIA-192-CBC" + ;; + 6) + CIPHER="cipher CAMELLIA-256-CBC" + ;; + 7) + CIPHER="cipher SEED-CBC" + ;; + esac + echo "" + echo "Choose what size of Diffie-Hellman key you want to use:" + echo " 1) 2048 bits (fastest)" + echo " 2) 3072 bits (recommended, best compromise)" + echo " 3) 4096 bits (most secure)" + while [[ $DH_KEY_SIZE != "1" && $DH_KEY_SIZE != "2" && $DH_KEY_SIZE != "3" ]]; do + read -p "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE + done + case $DH_KEY_SIZE in + 1) + DH_KEY_SIZE="2048" + ;; + 2) + DH_KEY_SIZE="3072" + ;; + 3) + DH_KEY_SIZE="4096" + ;; + esac + echo "" + echo "Choose what size of RSA key you want to use:" + echo " 1) 2048 bits (fastest)" + echo " 2) 3072 bits (recommended, best compromise)" + echo " 3) 4096 bits (most secure)" + while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do + read -p "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE + done + case $RSA_KEY_SIZE in + 1) + RSA_KEY_SIZE="2048" + ;; + 2) + RSA_KEY_SIZE="3072" + ;; + 3) + RSA_KEY_SIZE="4096" + ;; + esac + echo "" + echo "Finally, tell me a name for the client certificate and configuration" + while [[ $CLIENT = "" ]]; do + echo "Please, use one word only, no special characters" + read -p "Client name: " -e -i client CLIENT + done + echo "" + echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" + read -n1 -r -p "Press any key to continue..." + + if [[ "$OS" = 'debian' ]]; then + apt-get install ca-certificates -y + # We add the OpenVPN repo to get the latest version. + # Debian 7 + if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then + echo "deb http://build.openvpn.net/debian/openvpn/stable wheezy main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + fi + # Debian 8 + if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then + echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt update + fi + # Ubuntu 12.04 + if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then + echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + fi + # Ubuntu 14.04 + if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then + echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - + apt-get update + fi + # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. + # The we install OpenVPN + apt-get install openvpn iptables openssl wget ca-certificates curl -y + elif [[ "$OS" = 'centos' ]]; then + yum install epel-release -y + yum install openvpn iptables openssl wget ca-certificates curl -y + else + # Else, the distro is ArchLinux + echo "" + echo "" + echo "As you're using ArchLinux, I need to update the packages on your system to install those I need." + echo "Not doing that could cause problems between dependencies, or missing files in repositories." + echo "" + echo "Continuing will update your installed packages and install needed ones." + while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do + read -p "Continue ? [y/n]: " -e -i y CONTINUE + done + if [[ "$CONTINUE" = "n" ]]; then + echo "Ok, bye !" + exit 4 + fi + + if [[ "$OS" = 'arch' ]]; then + # Install rc.local + echo "[Unit] +Description=/etc/rc.local compatibility - if [[ "$OS" = 'debian' ]]; then - apt-get install ca-certificates -y - # We add the OpenVPN repo to get the latest version. - # Debian 7 - if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable wheezy main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi - # Debian 8 - if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt update - fi - # Ubuntu 12.04 - if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi - # Ubuntu 14.04 - if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi - # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. - # The we install OpenVPN - apt-get install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > /etc/iptables/iptables.rules - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target [Service] Type=oneshot -ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecStop=/etc/iptables/flush-iptables.sh +ExecStart=/etc/rc.local RemainAfterExit=yes + [Install] -WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - fi - elif [[ "$OS" = 'centos' ]]; then - yum install epel-release -y - yum install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > /etc/iptables/iptables.rules - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target -[Service] -Type=oneshot -ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecStop=/etc/iptables/flush-iptables.sh -RemainAfterExit=yes -[Install] -WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - # Disable firewalld to allow iptables to start upon reboot - systemctl disable firewalld - fi - else - # Else, the distro is ArchLinux - echo "" - echo "" - echo "As you're using ArchLinux, I need to update the packages on your system to install those I need." - echo "Not doing that could cause problems between dependencies, or missing files in repositories." - echo "" - echo "Continuing will update your installed packages and install needed ones." - while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do - read -p "Continue ? [y/n]: " -e -i y CONTINUE - done - if [[ "$CONTINUE" = "n" ]]; then - echo "Ok, bye !" - exit 4 - fi +WantedBy=multi-user.target" > /etc/systemd/system/rc-local.service + chmod +x /etc/rc.local + systemctl enable rc-local.service + if ! grep '#!' $RCLOCAL; then + echo "#!/bin/bash" > $RCLOCAL + fi + fi - if [[ "$OS" = 'arch' ]]; then - # Install dependencies - pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm - iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist - systemctl daemon-reload - systemctl enable iptables - systemctl start iptables - fi - fi - # Find out if the machine uses nogroup or nobody for the permissionless group - if grep -qs "^nogroup:" /etc/group; then - NOGROUP=nogroup - else - NOGROUP=nobody - fi + # Install dependencies + pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm + if [[ "$OS" = 'arch' ]]; then + touch /etc/iptables/iptables.rules # iptables won't start if this file does not exist + systemctl enable iptables + systemctl start iptables + fi + fi + # Find out if the machine uses nogroup or nobody for the permissionless group + if grep -qs "^nogroup:" /etc/group; then + NOGROUP=nogroup + else + NOGROUP=nobody + fi - # An old version of easy-rsa was available by default in some openvpn packages - if [[ -d /etc/openvpn/easy-rsa/ ]]; then - rm -rf /etc/openvpn/easy-rsa/ - fi - # Get easy-rsa - wget -O ~/EasyRSA-3.0.3.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz - tar xzf ~/EasyRSA-3.0.3.tgz -C ~/ - mv ~/EasyRSA-3.0.3/ /etc/openvpn/ - mv /etc/openvpn/EasyRSA-3.0.3/ /etc/openvpn/easy-rsa/ - chown -R root:root /etc/openvpn/easy-rsa/ - rm -rf ~/EasyRSA-3.0.3.tgz - cd /etc/openvpn/easy-rsa/ - echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars - # Create the PKI, set up the CA, the DH params and the server + client certificates - ./easyrsa init-pki - ./easyrsa --batch build-ca nopass - openssl dhparam -out dh.pem $DH_KEY_SIZE - ./easyrsa build-server-full server nopass - ./easyrsa build-client-full $CLIENT nopass - EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl - # generate tls-auth key - openvpn --genkey --secret /etc/openvpn/tls-auth.key - # Move all the generated files - cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn - # Make cert revocation list readable for non-root - chmod 644 /etc/openvpn/crl.pem + # An old version of easy-rsa was available by default in some openvpn packages + if [[ -d /etc/openvpn/easy-rsa/ ]]; then + rm -rf /etc/openvpn/easy-rsa/ + fi + # Get easy-rsa + wget -O ~/EasyRSA-3.0.3.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz + tar xzf ~/EasyRSA-3.0.3.tgz -C ~/ + mv ~/EasyRSA-3.0.3/ /etc/openvpn/ + mv /etc/openvpn/EasyRSA-3.0.3/ /etc/openvpn/easy-rsa/ + chown -R root:root /etc/openvpn/easy-rsa/ + rm -rf ~/EasyRSA-3.0.3.tgz + cd /etc/openvpn/easy-rsa/ + echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars + # Create the PKI, set up the CA, the DH params and the server + client certificates + ./easyrsa init-pki + ./easyrsa --batch build-ca nopass + openssl dhparam -out dh.pem $DH_KEY_SIZE + ./easyrsa build-server-full server nopass + ./easyrsa build-client-full $CLIENT nopass + EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl + # generate tls-auth key + openvpn --genkey --secret /etc/openvpn/tls-auth.key + # Move all the generated files + cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn + # Make cert revocation list readable for non-root + chmod 644 /etc/openvpn/crl.pem - # Generate server.conf - echo "port $PORT" > /etc/openvpn/server.conf - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "proto udp" >> /etc/openvpn/server.conf - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "proto tcp" >> /etc/openvpn/server.conf - fi - echo "dev tun + # Generate server.conf + echo "port $PORT" > /etc/openvpn/server.conf + if [[ "$PROTOCOL" = 'UDP' ]]; then + echo "proto udp" >> /etc/openvpn/server.conf + elif [[ "$PROTOCOL" = 'TCP' ]]; then + echo "proto tcp" >> /etc/openvpn/server.conf + fi + echo "dev tun user nobody group $NOGROUP persist-key @@ -492,39 +443,39 @@ keepalive 10 120 topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf - # DNS resolvers - case $DNS in - 1) - # Obtain the resolvers from resolv.conf and use them for OpenVPN - grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do - echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf - done - ;; - 2) #FDN - echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf - ;; - 3) #DNS.WATCH - echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf - ;; - 4) #OpenDNS - echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf - ;; - 5) #Google - echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf - ;; - 6) #Yandex Basic - echo 'push "dhcp-option DNS 77.88.8.8"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 77.88.8.1"' >> /etc/openvpn/server.conf - ;; - 7) #AdGuard DNS - echo 'push "dhcp-option DNS 176.103.130.130"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf - ;; - esac + # DNS resolvers + case $DNS in + 1) + # Obtain the resolvers from resolv.conf and use them for OpenVPN + grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do + echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf + done + ;; + 2) #FDN + echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf + ;; + 3) #DNS.WATCH + echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf + ;; + 4) #OpenDNS + echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf + ;; + 5) #Google + echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf + ;; + 6) #Yandex Basic + echo 'push "dhcp-option DNS 77.88.8.8"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 77.88.8.1"' >> /etc/openvpn/server.conf + ;; + 7) #AdGuard DNS + echo 'push "dhcp-option DNS 176.103.130.130"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf + ;; + esac echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf echo "crl-verify crl.pem ca ca.crt @@ -540,124 +491,134 @@ tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 status openvpn.log verb 3" >> /etc/openvpn/server.conf - # Create the sysctl configuration file if needed (mainly for Arch Linux) - if [[ ! -e $SYSCTL ]]; then - touch $SYSCTL - fi + # Create the sysctl configuration file if needed (mainly for Arch Linux) + if [[ ! -e $SYSCTL ]]; then + touch $SYSCTL + fi - # Enable net.ipv4.ip_forward for the system - sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL - if ! grep -q "\" $SYSCTL; then - echo 'net.ipv4.ip_forward=1' >> $SYSCTL - fi - # Avoid an unneeded reboot - echo 1 > /proc/sys/net/ipv4/ip_forward - # Set NAT for the VPN subnet - iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - # Save persitent iptables rules - iptables-save > $IPTABLES - if pgrep firewalld; then - # We don't use --add-service=openvpn because that would only work with - # the default port. Using both permanent and not permanent rules to - # avoid a firewalld reload. - if [[ "$PROTOCOL" = 'UDP' ]]; then - firewall-cmd --zone=public --add-port=$PORT/udp - firewall-cmd --permanent --zone=public --add-port=$PORT/udp - elif [[ "$PROTOCOL" = 'TCP' ]]; then - firewall-cmd --zone=public --add-port=$PORT/tcp - firewall-cmd --permanent --zone=public --add-port=$PORT/tcp - fi - firewall-cmd --zone=trusted --add-source=10.8.0.0/24 - firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 - fi - if iptables -L -n | grep -qE 'REJECT|DROP'; then - # If iptables has at least one REJECT rule, we asume this is needed. - # Not the best approach but I can't think of other and this shouldn't - # cause problems. - if [[ "$PROTOCOL" = 'UDP' ]]; then - iptables -I INPUT -p udp --dport $PORT -j ACCEPT - elif [[ "$PROTOCOL" = 'TCP' ]]; then - iptables -I INPUT -p tcp --dport $PORT -j ACCEPT - fi - iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT - # Save persitent OpenVPN rules - iptables-save > $IPTABLES - fi - # If SELinux is enabled and a custom port was selected, we need this - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - # semanage isn't available in CentOS 6 by default - if ! hash semanage 2>/dev/null; then - yum install policycoreutils-python -y - fi - if [[ "$PROTOCOL" = 'UDP' ]]; then - semanage port -a -t openvpn_port_t -p udp $PORT - elif [[ "$PROTOCOL" = 'TCP' ]]; then - semanage port -a -t openvpn_port_t -p tcp $PORT - fi - fi - fi - fi - # And finally, restart OpenVPN - if [[ "$OS" = 'debian' ]]; then - # Little hack to check for systemd - if pgrep systemd-journal; then - if [[ "$VERSION_ID" = 'VERSION_ID="9"' ]]; then - #Workaround to fix OpenVPN service on Debian 9 OpenVZ - sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn-server\@.service - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn-server\@.service - sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn-server\@.service - systemctl daemon-reload - systemctl restart openvpn-server@openvpn.service - systemctl enable openvpn-server@openvpn.service - else - systemctl restart openvpn@server.service - fi - else - /etc/init.d/openvpn restart - fi - else - if pgrep systemd-journal; then - if [[ "$OS" = 'arch' ]]; then - #Workaround to avoid rewriting the entire script for Arch - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service - sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service - systemctl daemon-reload - systemctl restart openvpn-server@openvpn.service - systemctl enable openvpn-server@openvpn.service - else - systemctl restart openvpn@server.service - systemctl enable openvpn@server.service - fi - else - service openvpn restart - chkconfig openvpn on - fi - fi - # Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users - EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) - if [[ "$IP" != "$EXTERNALIP" ]]; then - echo "" - echo "Looks like your server is behind a NAT!" - echo "" - echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," - echo "then I need to know the address that can be used to access it from outside." - echo "If that's not the case, just ignore this and leave the next field blank" - read -p "External IP or domain name: " -e USEREXTERNALIP - if [[ "$USEREXTERNALIP" != "" ]]; then - IP=$USEREXTERNALIP - fi - fi - # client-template.txt is created so we have a template to add further users later - echo "client" > /etc/openvpn/client-template.txt - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "proto udp" >> /etc/openvpn/client-template.txt - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "proto tcp-client" >> /etc/openvpn/client-template.txt - fi - echo "remote $IP $PORT + # Enable net.ipv4.ip_forward for the system + sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL + if ! grep -q "\" $SYSCTL; then + echo 'net.ipv4.ip_forward=1' >> $SYSCTL + fi + # Avoid an unneeded reboot + echo 1 > /proc/sys/net/ipv4/ip_forward + # Needed to use rc.local with some systemd distros + if [[ "$OS" = 'debian' && ! -e $RCLOCAL ]]; then + echo '#!/bin/sh -e + exit 0' > $RCLOCAL + fi + chmod +x $RCLOCAL + # Set NAT for the VPN subnet + iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + sed -i "1 a\iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE" $RCLOCAL + if pgrep firewalld; then + # We don't use --add-service=openvpn because that would only work with + # the default port. Using both permanent and not permanent rules to + # avoid a firewalld reload. + if [[ "$PROTOCOL" = 'UDP' ]]; then + firewall-cmd --zone=public --add-port=$PORT/udp + firewall-cmd --permanent --zone=public --add-port=$PORT/udp + elif [[ "$PROTOCOL" = 'TCP' ]]; then + firewall-cmd --zone=public --add-port=$PORT/tcp + firewall-cmd --permanent --zone=public --add-port=$PORT/tcp + fi + firewall-cmd --zone=trusted --add-source=10.8.0.0/24 + firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 + fi + if iptables -L -n | grep -qE 'REJECT|DROP'; then + # If iptables has at least one REJECT rule, we asume this is needed. + # Not the best approach but I can't think of other and this shouldn't + # cause problems. + if [[ "$PROTOCOL" = 'UDP' ]]; then + iptables -I INPUT -p udp --dport $PORT -j ACCEPT + elif [[ "$PROTOCOL" = 'TCP' ]]; then + iptables -I INPUT -p tcp --dport $PORT -j ACCEPT + fi + iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT + if [[ "$PROTOCOL" = 'UDP' ]]; then + sed -i "1 a\iptables -I INPUT -p udp --dport $PORT -j ACCEPT" $RCLOCAL + elif [[ "$PROTOCOL" = 'TCP' ]]; then + sed -i "1 a\iptables -I INPUT -p tcp --dport $PORT -j ACCEPT" $RCLOCAL + fi + sed -i "1 a\iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT" $RCLOCAL + sed -i "1 a\iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" $RCLOCAL + fi + # If SELinux is enabled and a custom port was selected, we need this + if hash sestatus 2>/dev/null; then + if sestatus | grep "Current mode" | grep -qs "enforcing"; then + if [[ "$PORT" != '1194' ]]; then + # semanage isn't available in CentOS 6 by default + if ! hash semanage 2>/dev/null; then + yum install policycoreutils-python -y + fi + if [[ "$PROTOCOL" = 'UDP' ]]; then + semanage port -a -t openvpn_port_t -p udp $PORT + elif [[ "$PROTOCOL" = 'TCP' ]]; then + semanage port -a -t openvpn_port_t -p tcp $PORT + fi + fi + fi + fi + # And finally, restart OpenVPN + if [[ "$OS" = 'debian' ]]; then + # Little hack to check for systemd + if pgrep systemd-journal; then + if [[ "$VERSION_ID" = 'VERSION_ID="9"' ]]; then + #Workaround to fix OpenVPN service on Debian 9 OpenVZ + sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn-server\@.service + sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn-server\@.service + sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn-server\@.service + systemctl daemon-reload + systemctl restart openvpn-server@openvpn.service + systemctl enable openvpn-server@openvpn.service + else + systemctl restart openvpn@server.service + fi + else + /etc/init.d/openvpn restart + fi + else + if pgrep systemd-journal; then + if [[ "$OS" = 'arch' ]]; then + #Workaround to avoid rewriting the entire script for Arch + sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service + sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service + systemctl daemon-reload + systemctl restart openvpn-server@openvpn.service + systemctl enable openvpn-server@openvpn.service + else + systemctl restart openvpn@server.service + systemctl enable openvpn@server.service + fi + else + service openvpn restart + chkconfig openvpn on + fi + fi + # Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users + EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) + if [[ "$IP" != "$EXTERNALIP" ]]; then + echo "" + echo "Looks like your server is behind a NAT!" + echo "" + echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," + echo "then I need to know the address that can be used to access it from outside." + echo "If that's not the case, just ignore this and leave the next field blank" + read -p "External IP or domain name: " -e USEREXTERNALIP + if [[ "$USEREXTERNALIP" != "" ]]; then + IP=$USEREXTERNALIP + fi + fi + # client-template.txt is created so we have a template to add further users later + echo "client" > /etc/openvpn/client-template.txt + if [[ "$PROTOCOL" = 'UDP' ]]; then + echo "proto udp" >> /etc/openvpn/client-template.txt + elif [[ "$PROTOCOL" = 'TCP' ]]; then + echo "proto tcp-client" >> /etc/openvpn/client-template.txt + fi + echo "remote $IP $PORT dev tun resolv-retry infinite nobind @@ -673,695 +634,12 @@ tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 setenv opt block-outside-dns verb 3" >> /etc/openvpn/client-template.txt - # Generate the custom client.ovpn - newclient "$CLIENT" - echo "" - echo "Finished!" - echo "" - echo "Your client config is available at $homeDir/$CLIENT.ovpn" - echo "If you want to add more clients, you simply need to run this script another time!" -fi -exit 0;#!/bin/bash - -# Secure OpenVPN server installer for Debian, Ubuntu, CentOS and Arch Linux -# https://github.com/Angristan/OpenVPN-install - - -if [[ "$EUID" -ne 0 ]]; then - echo "Sorry, you need to run this as root" - exit 1 -fi - -if [[ ! -e /dev/net/tun ]]; then - echo "TUN is not available" - exit 2 -fi - -if grep -qs "CentOS release 5" "/etc/redhat-release"; then - echo "CentOS 5 is too old and not supported" - exit 3 -fi - -if [[ -e /etc/debian_version ]]; then - OS="debian" - # Getting the version number, to verify that a recent version of OpenVPN is available - VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID") - IPTABLES='/etc/iptables/iptables.rules' - SYSCTL='/etc/sysctl.conf' - if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then - echo "Your version of Debian/Ubuntu is not supported." - echo "I can't install a recent version of OpenVPN on your system." - echo "" - echo "However, if you're using Debian unstable/testing, or Ubuntu beta," - echo "then you can continue, a recent version of OpenVPN is available on these." - echo "Keep in mind they are not supported, though." - while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do - read -p "Continue ? [y/n]: " -e CONTINUE - done - if [[ "$CONTINUE" = "n" ]]; then - echo "Ok, bye !" - exit 4 - fi - fi -elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then - OS=centos - IPTABLES='/etc/iptables/iptables.rules' - SYSCTL='/etc/sysctl.conf' -elif [[ -e /etc/arch-release ]]; then - OS=arch - IPTABLES='/etc/iptables/iptables.rules' - SYSCTL='/etc/sysctl.d/openvpn.conf' -else - echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system" - exit 4 -fi - -newclient () { - # Where to write the custom client.ovpn? - if [ -e /home/$1 ]; then # if $1 is a user name - homeDir="/home/$1" - elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER - homeDir="/home/${SUDO_USER}" - else # if not SUDO_USER, use /root - homeDir="/root" - fi - # Generates the custom client.ovpn - cp /etc/openvpn/client-template.txt $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - cat /etc/openvpn/easy-rsa/pki/ca.crt >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - cat /etc/openvpn/easy-rsa/pki/issued/$1.crt >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - cat /etc/openvpn/easy-rsa/pki/private/$1.key >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - echo "key-direction 1" >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - cat /etc/openvpn/tls-auth.key >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn -} - -# Try to get our IP from the system and fallback to the Internet. -# I do this to make the script compatible with NATed servers (LowEndSpirit/Scaleway) -# and to avoid getting an IPv6. -IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) -if [[ "$IP" = "" ]]; then - IP=$(wget -qO- ipv4.icanhazip.com) -fi -# Get Internet network interface with default route -NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) - -if [[ -e /etc/openvpn/server.conf ]]; then - while : - do - clear - echo "OpenVPN-install (github.com/Angristan/OpenVPN-install)" - echo "" - echo "Looks like OpenVPN is already installed" - echo "" - echo "What do you want to do?" - echo " 1) Add a cert for a new user" - echo " 2) Revoke existing user cert" - echo " 3) Remove OpenVPN" - echo " 4) Exit" - read -p "Select an option [1-4]: " option - case $option in - 1) - echo "" - echo "Tell me a name for the client cert" - echo "Please, use one word only, no special characters" - read -p "Client name: " -e -i client CLIENT - cd /etc/openvpn/easy-rsa/ - ./easyrsa build-client-full $CLIENT nopass - # Generates the custom client.ovpn - newclient "$CLIENT" - echo "" - echo "Client $CLIENT added, certs available at $homeDir/$CLIENT.ovpn" - exit - ;; - 2) - NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") - if [[ "$NUMBEROFCLIENTS" = '0' ]]; then - echo "" - echo "You have no existing clients!" - exit 5 - fi - echo "" - echo "Select the existing client certificate you want to revoke" - tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' - if [[ "$NUMBEROFCLIENTS" = '1' ]]; then - read -p "Select one client [1]: " CLIENTNUMBER - else - read -p "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER - fi - CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) - cd /etc/openvpn/easy-rsa/ - ./easyrsa --batch revoke $CLIENT - EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl - rm -rf pki/reqs/$CLIENT.req - rm -rf pki/private/$CLIENT.key - rm -rf pki/issued/$CLIENT.crt - rm -rf /etc/openvpn/crl.pem - cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem - chmod 644 /etc/openvpn/crl.pem - echo "" - echo "Certificate for client $CLIENT revoked" - echo "Exiting..." - exit - ;; - 3) - echo "" - read -p "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE - if [[ "$REMOVE" = 'y' ]]; then - PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) - if pgrep firewalld; then - # Using both permanent and not permanent rules to avoid a firewalld reload. - firewall-cmd --zone=public --remove-port=$PORT/udp - firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 - firewall-cmd --permanent --zone=public --remove-port=$PORT/udp - firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 - fi - if iptables -L -n | grep -qE 'REJECT|DROP'; then - if [[ "$PROTOCOL" = 'udp' ]]; then - iptables -D INPUT -p udp --dport $PORT -j ACCEPT - else - iptables -D INPUT -p tcp --dport $PORT -j ACCEPT - fi - iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables-save > $IPTABLES - fi - iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - iptables-save > $IPTABLES - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - semanage port -d -t openvpn_port_t -p udp $PORT - fi - fi - fi - if [[ "$OS" = 'debian' ]]; then - apt-get autoremove --purge -y openvpn - elif [[ "$OS" = 'arch' ]]; then - pacman -R openvpn --noconfirm - else - yum remove openvpn -y - fi - rm -rf /etc/openvpn - rm -rf /usr/share/doc/openvpn* - echo "" - echo "OpenVPN removed!" - else - echo "" - echo "Removal aborted!" - fi - exit - ;; - 4) exit;; - esac - done -else - clear - echo "Welcome to the secure OpenVPN installer (github.com/Angristan/OpenVPN-install)" - echo "" - # OpenVPN setup and first user creation - echo "I need to ask you a few questions before starting the setup" - echo "You can leave the default options and just press enter if you are ok with them" - echo "" - echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." - echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)" - echo "Otherwise, it should be your public IPv4 address." - read -p "IP address: " -e -i $IP IP - echo "" - echo "What port do you want for OpenVPN?" - read -p "Port: " -e -i 1194 PORT - echo "" - echo "What protocol do you want for OpenVPN?" - echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)" - while [[ $PROTOCOL != "UDP" && $PROTOCOL != "TCP" ]]; do - read -p "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL - done - echo "" - echo "What DNS do you want to use with the VPN?" - echo " 1) Current system resolvers (in /etc/resolv.conf)" - echo " 2) FDN (France)" - echo " 3) DNS.WATCH (Germany)" - echo " 4) OpenDNS (Anycast: worldwide)" - echo " 5) Google (Anycast: worldwide)" - echo " 6) Yandex Basic (Russia)" - echo " 7) AdGuard DNS (Russia)" - while [[ $DNS != "1" && $DNS != "2" && $DNS != "3" && $DNS != "4" && $DNS != "5" && $DNS != "6" && $DNS != "7" ]]; do - read -p "DNS [1-7]: " -e -i 1 DNS - done - echo "" - echo "See https://github.com/Angristan/OpenVPN-install#encryption to learn more about " - echo "the encryption in OpenVPN and the choices I made in this script." - echo "Please note that all the choices proposed are secure (to a different degree)" - echo "and are still viable to date, unlike some default OpenVPN options" - echo '' - echo "Choose which cipher you want to use for the data channel:" - echo " 1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)" - echo " 2) AES-192-CBC" - echo " 3) AES-256-CBC" - echo "Alternatives to AES, use them only if you know what you're doing." - echo "They are relatively slower but as secure as AES." - echo " 4) CAMELLIA-128-CBC" - echo " 5) CAMELLIA-192-CBC" - echo " 6) CAMELLIA-256-CBC" - echo " 7) SEED-CBC" - while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" && $CIPHER != "7" ]]; do - read -p "Cipher [1-7]: " -e -i 1 CIPHER - done - case $CIPHER in - 1) - CIPHER="cipher AES-128-CBC" - ;; - 2) - CIPHER="cipher AES-192-CBC" - ;; - 3) - CIPHER="cipher AES-256-CBC" - ;; - 4) - CIPHER="cipher CAMELLIA-128-CBC" - ;; - 5) - CIPHER="cipher CAMELLIA-192-CBC" - ;; - 6) - CIPHER="cipher CAMELLIA-256-CBC" - ;; - 7) - CIPHER="cipher SEED-CBC" - ;; - esac - echo "" - echo "Choose what size of Diffie-Hellman key you want to use:" - echo " 1) 2048 bits (fastest)" - echo " 2) 3072 bits (recommended, best compromise)" - echo " 3) 4096 bits (most secure)" - while [[ $DH_KEY_SIZE != "1" && $DH_KEY_SIZE != "2" && $DH_KEY_SIZE != "3" ]]; do - read -p "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE - done - case $DH_KEY_SIZE in - 1) - DH_KEY_SIZE="2048" - ;; - 2) - DH_KEY_SIZE="3072" - ;; - 3) - DH_KEY_SIZE="4096" - ;; - esac - echo "" - echo "Choose what size of RSA key you want to use:" - echo " 1) 2048 bits (fastest)" - echo " 2) 3072 bits (recommended, best compromise)" - echo " 3) 4096 bits (most secure)" - while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do - read -p "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE - done - case $RSA_KEY_SIZE in - 1) - RSA_KEY_SIZE="2048" - ;; - 2) - RSA_KEY_SIZE="3072" - ;; - 3) - RSA_KEY_SIZE="4096" - ;; - esac - echo "" - echo "Finally, tell me a name for the client certificate and configuration" - while [[ $CLIENT = "" ]]; do - echo "Please, use one word only, no special characters" - read -p "Client name: " -e -i client CLIENT - done - echo "" - echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" - read -n1 -r -p "Press any key to continue..." - - if [[ "$OS" = 'debian' ]]; then - apt-get install ca-certificates -y - # We add the OpenVPN repo to get the latest version. - # Debian 7 - if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable wheezy main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi - # Debian 8 - if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt update - fi - # Ubuntu 12.04 - if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi - # Ubuntu 14.04 - if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi - # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. - # The we install OpenVPN - apt-get install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > /etc/iptables/iptables.rules - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target -[Service] -Type=oneshot -ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecStop=/etc/iptables/flush-iptables.sh -RemainAfterExit=yes -[Install] -WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - fi - elif [[ "$OS" = 'centos' ]]; then - yum install epel-release -y - yum install openvpn iptables openssl wget ca-certificates curl -y - # Install iptables service - if [[ ! -e /etc/systemd/system/iptables.service ]]; then - mkdir /etc/iptables - iptables-save > /etc/iptables/iptables.rules - echo "#!/bin/sh -iptables -F -iptables -X -iptables -t nat -F -iptables -t nat -X -iptables -t mangle -F -iptables -t mangle -X -iptables -P INPUT ACCEPT -iptables -P FORWARD ACCEPT -iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh - chmod +x /etc/iptables/flush-iptables.sh - echo "[Unit] -Description=Packet Filtering Framework -DefaultDependencies=no -Before=network-pre.target -Wants=network-pre.target -[Service] -Type=oneshot -ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules -ExecStop=/etc/iptables/flush-iptables.sh -RemainAfterExit=yes -[Install] -WantedBy=multi-user.target" > /etc/systemd/system/iptables.service - systemctl daemon-reload - systemctl enable iptables.service - # Disable firewalld to allow iptables to start upon reboot - systemctl disable firewalld - fi - else - # Else, the distro is ArchLinux - echo "" - echo "" - echo "As you're using ArchLinux, I need to update the packages on your system to install those I need." - echo "Not doing that could cause problems between dependencies, or missing files in repositories." - echo "" - echo "Continuing will update your installed packages and install needed ones." - while [[ $CONTINUE != "y" && $CONTINUE != "n" ]]; do - read -p "Continue ? [y/n]: " -e -i y CONTINUE - done - if [[ "$CONTINUE" = "n" ]]; then - echo "Ok, bye !" - exit 4 - fi - - if [[ "$OS" = 'arch' ]]; then - # Install dependencies - pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm - iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist - systemctl daemon-reload - systemctl enable iptables - systemctl start iptables - fi - fi - # Find out if the machine uses nogroup or nobody for the permissionless group - if grep -qs "^nogroup:" /etc/group; then - NOGROUP=nogroup - else - NOGROUP=nobody - fi - - # An old version of easy-rsa was available by default in some openvpn packages - if [[ -d /etc/openvpn/easy-rsa/ ]]; then - rm -rf /etc/openvpn/easy-rsa/ - fi - # Get easy-rsa - wget -O ~/EasyRSA-3.0.3.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.3/EasyRSA-3.0.3.tgz - tar xzf ~/EasyRSA-3.0.3.tgz -C ~/ - mv ~/EasyRSA-3.0.3/ /etc/openvpn/ - mv /etc/openvpn/EasyRSA-3.0.3/ /etc/openvpn/easy-rsa/ - chown -R root:root /etc/openvpn/easy-rsa/ - rm -rf ~/EasyRSA-3.0.3.tgz - cd /etc/openvpn/easy-rsa/ - echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars - # Create the PKI, set up the CA, the DH params and the server + client certificates - ./easyrsa init-pki - ./easyrsa --batch build-ca nopass - openssl dhparam -out dh.pem $DH_KEY_SIZE - ./easyrsa build-server-full server nopass - ./easyrsa build-client-full $CLIENT nopass - EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl - # generate tls-auth key - openvpn --genkey --secret /etc/openvpn/tls-auth.key - # Move all the generated files - cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn - # Make cert revocation list readable for non-root - chmod 644 /etc/openvpn/crl.pem - - # Generate server.conf - echo "port $PORT" > /etc/openvpn/server.conf - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "proto udp" >> /etc/openvpn/server.conf - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "proto tcp" >> /etc/openvpn/server.conf - fi - echo "dev tun -user nobody -group $NOGROUP -persist-key -persist-tun -keepalive 10 120 -topology subnet -server 10.8.0.0 255.255.255.0 -ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf - # DNS resolvers - case $DNS in - 1) - # Obtain the resolvers from resolv.conf and use them for OpenVPN - grep -v '#' /etc/resolv.conf | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read line; do - echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf - done - ;; - 2) #FDN - echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf - ;; - 3) #DNS.WATCH - echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf - ;; - 4) #OpenDNS - echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf - ;; - 5) #Google - echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf - ;; - 6) #Yandex Basic - echo 'push "dhcp-option DNS 77.88.8.8"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 77.88.8.1"' >> /etc/openvpn/server.conf - ;; - 7) #AdGuard DNS - echo 'push "dhcp-option DNS 176.103.130.130"' >> /etc/openvpn/server.conf - echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf - ;; - esac -echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf -echo "crl-verify crl.pem -ca ca.crt -cert server.crt -key server.key -tls-auth tls-auth.key 0 -dh dh.pem -auth SHA256 -$CIPHER -tls-server -tls-version-min 1.2 -tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 -status openvpn.log -verb 3" >> /etc/openvpn/server.conf - - # Create the sysctl configuration file if needed (mainly for Arch Linux) - if [[ ! -e $SYSCTL ]]; then - touch $SYSCTL - fi - - # Enable net.ipv4.ip_forward for the system - sed -i '/\/c\net.ipv4.ip_forward=1' $SYSCTL - if ! grep -q "\" $SYSCTL; then - echo 'net.ipv4.ip_forward=1' >> $SYSCTL - fi - # Avoid an unneeded reboot - echo 1 > /proc/sys/net/ipv4/ip_forward - # Set NAT for the VPN subnet - iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - # Save persitent iptables rules - iptables-save > $IPTABLES - if pgrep firewalld; then - # We don't use --add-service=openvpn because that would only work with - # the default port. Using both permanent and not permanent rules to - # avoid a firewalld reload. - if [[ "$PROTOCOL" = 'UDP' ]]; then - firewall-cmd --zone=public --add-port=$PORT/udp - firewall-cmd --permanent --zone=public --add-port=$PORT/udp - elif [[ "$PROTOCOL" = 'TCP' ]]; then - firewall-cmd --zone=public --add-port=$PORT/tcp - firewall-cmd --permanent --zone=public --add-port=$PORT/tcp - fi - firewall-cmd --zone=trusted --add-source=10.8.0.0/24 - firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24 - fi - if iptables -L -n | grep -qE 'REJECT|DROP'; then - # If iptables has at least one REJECT rule, we asume this is needed. - # Not the best approach but I can't think of other and this shouldn't - # cause problems. - if [[ "$PROTOCOL" = 'UDP' ]]; then - iptables -I INPUT -p udp --dport $PORT -j ACCEPT - elif [[ "$PROTOCOL" = 'TCP' ]]; then - iptables -I INPUT -p tcp --dport $PORT -j ACCEPT - fi - iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT - iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT - # Save persitent OpenVPN rules - iptables-save > $IPTABLES - fi - # If SELinux is enabled and a custom port was selected, we need this - if hash sestatus 2>/dev/null; then - if sestatus | grep "Current mode" | grep -qs "enforcing"; then - if [[ "$PORT" != '1194' ]]; then - # semanage isn't available in CentOS 6 by default - if ! hash semanage 2>/dev/null; then - yum install policycoreutils-python -y - fi - if [[ "$PROTOCOL" = 'UDP' ]]; then - semanage port -a -t openvpn_port_t -p udp $PORT - elif [[ "$PROTOCOL" = 'TCP' ]]; then - semanage port -a -t openvpn_port_t -p tcp $PORT - fi - fi - fi - fi - # And finally, restart OpenVPN - if [[ "$OS" = 'debian' ]]; then - # Little hack to check for systemd - if pgrep systemd-journal; then - if [[ "$VERSION_ID" = 'VERSION_ID="9"' ]]; then - #Workaround to fix OpenVPN service on Debian 9 OpenVZ - sed -i 's|LimitNPROC|#LimitNPROC|' /lib/systemd/system/openvpn-server\@.service - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /lib/systemd/system/openvpn-server\@.service - sed -i 's|%i.conf|server.conf|' /lib/systemd/system/openvpn-server\@.service - systemctl daemon-reload - systemctl restart openvpn-server@openvpn.service - systemctl enable openvpn-server@openvpn.service - else - systemctl restart openvpn@server.service - fi - else - /etc/init.d/openvpn restart - fi - else - if pgrep systemd-journal; then - if [[ "$OS" = 'arch' ]]; then - #Workaround to avoid rewriting the entire script for Arch - sed -i 's|/etc/openvpn/server|/etc/openvpn|' /usr/lib/systemd/system/openvpn-server@.service - sed -i 's|%i.conf|server.conf|' /usr/lib/systemd/system/openvpn-server@.service - systemctl daemon-reload - systemctl restart openvpn-server@openvpn.service - systemctl enable openvpn-server@openvpn.service - else - systemctl restart openvpn@server.service - systemctl enable openvpn@server.service - fi - else - service openvpn restart - chkconfig openvpn on - fi - fi - # Try to detect a NATed connection and ask about it to potential LowEndSpirit/Scaleway users - EXTERNALIP=$(wget -qO- ipv4.icanhazip.com) - if [[ "$IP" != "$EXTERNALIP" ]]; then - echo "" - echo "Looks like your server is behind a NAT!" - echo "" - echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," - echo "then I need to know the address that can be used to access it from outside." - echo "If that's not the case, just ignore this and leave the next field blank" - read -p "External IP or domain name: " -e USEREXTERNALIP - if [[ "$USEREXTERNALIP" != "" ]]; then - IP=$USEREXTERNALIP - fi - fi - # client-template.txt is created so we have a template to add further users later - echo "client" > /etc/openvpn/client-template.txt - if [[ "$PROTOCOL" = 'UDP' ]]; then - echo "proto udp" >> /etc/openvpn/client-template.txt - elif [[ "$PROTOCOL" = 'TCP' ]]; then - echo "proto tcp-client" >> /etc/openvpn/client-template.txt - fi - echo "remote $IP $PORT -dev tun -resolv-retry infinite -nobind -persist-key -persist-tun -remote-cert-tls server -auth SHA256 -auth-nocache -$CIPHER -tls-client -tls-version-min 1.2 -tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 -setenv opt block-outside-dns -verb 3" >> /etc/openvpn/client-template.txt - - # Generate the custom client.ovpn - newclient "$CLIENT" - echo "" - echo "Finished!" - echo "" - echo "Your client config is available at $homeDir/$CLIENT.ovpn" - echo "If you want to add more clients, you simply need to run this script another time!" + # Generate the custom client.ovpn + newclient "$CLIENT" + echo "" + echo "Finished!" + echo "" + echo "Your client config is available at $homeDir/$CLIENT.ovpn" + echo "If you want to add more clients, you simply need to run this script another time!" fi exit 0; From f47fc795d5e2d53f74431aadc58ef9de5784103a Mon Sep 17 00:00:00 2001 From: Angristan Date: Sun, 12 Nov 2017 22:56:02 +0100 Subject: [PATCH 17/17] Merge PR #83 : Remove rc.local and use an iptables systemd service - Install iptables systemd service for Debian, Ubuntu and CentOS - Fix iptables install for ArcLinux - Remove the use rc.local file - Remove all iptables rules when removing openvpn (cf. #60 ) --- openvpn-install.sh | 147 ++++++++++++++++++++++++++++----------------- 1 file changed, 93 insertions(+), 54 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index bf2f4d5..ba86428 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -23,7 +23,7 @@ if [[ -e /etc/debian_version ]]; then OS="debian" # Getting the version number, to verify that a recent version of OpenVPN is available VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID") - RCLOCAL='/etc/rc.local' + IPTABLES='/etc/iptables/iptables.rules' SYSCTL='/etc/sysctl.conf' if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then echo "Your version of Debian/Ubuntu is not supported." @@ -42,13 +42,11 @@ if [[ -e /etc/debian_version ]]; then fi elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then OS=centos - RCLOCAL='/etc/rc.d/rc.local' + IPTABLES='/etc/iptables/iptables.rules' SYSCTL='/etc/sysctl.conf' - # Needed for CentOS 7 - chmod +x /etc/rc.d/rc.local elif [[ -e /etc/arch-release ]]; then OS=arch - RCLOCAL='/etc/rc.local' + IPTABLES='/etc/iptables/iptables.rules' SYSCTL='/etc/sysctl.d/openvpn.conf' else echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system" @@ -89,7 +87,7 @@ if [[ "$IP" = "" ]]; then IP=$(wget -qO- ipv4.icanhazip.com) fi # Get Internet network interface with default route -NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)') +NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) if [[ -e /etc/openvpn/server.conf ]]; then while : @@ -162,11 +160,16 @@ if [[ -e /etc/openvpn/server.conf ]]; then firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 fi if iptables -L -n | grep -qE 'REJECT|DROP'; then - sed -i "/iptables -I INPUT -p udp --dport $PORT -j ACCEPT/d" $RCLOCAL - sed -i "/iptables -I FORWARD -s 10.8.0.0\/24 -j ACCEPT/d" $RCLOCAL - sed -i "/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT/d" $RCLOCAL + if [[ "$PROTOCOL" = 'udp' ]]; then + iptables -D INPUT -p udp --dport $PORT -j ACCEPT + else + iptables -D INPUT -p tcp --dport $PORT -j ACCEPT + fi + iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT + iptables-save > $IPTABLES fi - sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -j SNAT --to /d' $RCLOCAL + iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE + iptables-save > $IPTABLES if hash sestatus 2>/dev/null; then if sestatus | grep "Current mode" | grep -qs "enforcing"; then if [[ "$PORT" != '1194' ]]; then @@ -347,9 +350,73 @@ else # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. # The we install OpenVPN apt-get install openvpn iptables openssl wget ca-certificates curl -y + # Install iptables service + if [[ ! -e /etc/systemd/system/iptables.service ]]; then + mkdir /etc/iptables + iptables-save > /etc/iptables/iptables.rules + echo "#!/bin/sh +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh + chmod +x /etc/iptables/flush-iptables.sh + echo "[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +Before=network-pre.target +Wants=network-pre.target +[Service] +Type=oneshot +ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecStop=/etc/iptables/flush-iptables.sh +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" > /etc/systemd/system/iptables.service + systemctl daemon-reload + systemctl enable iptables.service + fi elif [[ "$OS" = 'centos' ]]; then yum install epel-release -y yum install openvpn iptables openssl wget ca-certificates curl -y + # Install iptables service + if [[ ! -e /etc/systemd/system/iptables.service ]]; then + mkdir /etc/iptables + iptables-save > /etc/iptables/iptables.rules + echo "#!/bin/sh +iptables -F +iptables -X +iptables -t nat -F +iptables -t nat -X +iptables -t mangle -F +iptables -t mangle -X +iptables -P INPUT ACCEPT +iptables -P FORWARD ACCEPT +iptables -P OUTPUT ACCEPT" > /etc/iptables/flush-iptables.sh + chmod +x /etc/iptables/flush-iptables.sh + echo "[Unit] +Description=Packet Filtering Framework +DefaultDependencies=no +Before=network-pre.target +Wants=network-pre.target +[Service] +Type=oneshot +ExecStart=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecReload=/sbin/iptables-restore /etc/iptables/iptables.rules +ExecStop=/etc/iptables/flush-iptables.sh +RemainAfterExit=yes +[Install] +WantedBy=multi-user.target" > /etc/systemd/system/iptables.service + systemctl daemon-reload + systemctl enable iptables.service + # Disable firewalld to allow iptables to start upon reboot + systemctl disable firewalld + fi else # Else, the distro is ArchLinux echo "" @@ -365,39 +432,21 @@ else echo "Ok, bye !" exit 4 fi - + if [[ "$OS" = 'arch' ]]; then - # Install rc.local - echo "[Unit] -Description=/etc/rc.local compatibility - -[Service] -Type=oneshot -ExecStart=/etc/rc.local -RemainAfterExit=yes - -[Install] -WantedBy=multi-user.target" > /etc/systemd/system/rc-local.service - chmod +x /etc/rc.local - systemctl enable rc-local.service - if ! grep '#!' $RCLOCAL; then - echo "#!/bin/bash" > $RCLOCAL - fi - fi - - # Install dependencies - pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm - if [[ "$OS" = 'arch' ]]; then - touch /etc/iptables/iptables.rules # iptables won't start if this file does not exist + # Install dependencies + pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm + iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist + systemctl daemon-reload systemctl enable iptables systemctl start iptables fi fi # Find out if the machine uses nogroup or nobody for the permissionless group if grep -qs "^nogroup:" /etc/group; then - NOGROUP=nogroup + NOGROUP=nogroup else - NOGROUP=nobody + NOGROUP=nobody fi # An old version of easy-rsa was available by default in some openvpn packages @@ -503,15 +552,10 @@ verb 3" >> /etc/openvpn/server.conf fi # Avoid an unneeded reboot echo 1 > /proc/sys/net/ipv4/ip_forward - # Needed to use rc.local with some systemd distros - if [[ "$OS" = 'debian' && ! -e $RCLOCAL ]]; then - echo '#!/bin/sh -e - exit 0' > $RCLOCAL - fi - chmod +x $RCLOCAL # Set NAT for the VPN subnet iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE - sed -i "1 a\iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE" $RCLOCAL + # Save persitent iptables rules + iptables-save > $IPTABLES if pgrep firewalld; then # We don't use --add-service=openvpn because that would only work with # the default port. Using both permanent and not permanent rules to @@ -537,13 +581,8 @@ verb 3" >> /etc/openvpn/server.conf fi iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT - if [[ "$PROTOCOL" = 'UDP' ]]; then - sed -i "1 a\iptables -I INPUT -p udp --dport $PORT -j ACCEPT" $RCLOCAL - elif [[ "$PROTOCOL" = 'TCP' ]]; then - sed -i "1 a\iptables -I INPUT -p tcp --dport $PORT -j ACCEPT" $RCLOCAL - fi - sed -i "1 a\iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT" $RCLOCAL - sed -i "1 a\iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" $RCLOCAL + # Save persitent OpenVPN rules + iptables-save > $IPTABLES fi # If SELinux is enabled and a custom port was selected, we need this if hash sestatus 2>/dev/null; then @@ -603,10 +642,10 @@ verb 3" >> /etc/openvpn/server.conf echo "" echo "Looks like your server is behind a NAT!" echo "" - echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," - echo "then I need to know the address that can be used to access it from outside." - echo "If that's not the case, just ignore this and leave the next field blank" - read -p "External IP or domain name: " -e USEREXTERNALIP + echo "If your server is NATed (e.g. LowEndSpirit, Scaleway, or behind a router)," + echo "then I need to know the address that can be used to access it from outside." + echo "If that's not the case, just ignore this and leave the next field blank" + read -p "External IP or domain name: " -e USEREXTERNALIP if [[ "$USEREXTERNALIP" != "" ]]; then IP=$USEREXTERNALIP fi @@ -642,4 +681,4 @@ verb 3" >> /etc/openvpn/client-template.txt echo "Your client config is available at $homeDir/$CLIENT.ovpn" echo "If you want to add more clients, you simply need to run this script another time!" fi -exit 0; +exit 0; \ No newline at end of file