From 3bfd4a1ff8d2159f71456b16c337556066fa46d8 Mon Sep 17 00:00:00 2001 From: Mohammad Parvin Date: Sun, 12 Sep 2021 15:55:21 +0430 Subject: [PATCH 1/4] add random password suggestion --- openvpn-install.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index a31713a..5260077 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -1089,7 +1089,10 @@ function newClient() { ./easyrsa build-client-full "$CLIENT" nopass ;; 2) - echo "⚠️ You will be asked for the client password below ⚠️" + echo -e "\n\n⚠️ You will be asked for the client password below ⚠️" + echo "this is a random password generated" + echo `openssl rand -base64 $(shuf -i13-17 -n1) || tr -dc A-Za-z0-9 Date: Thu, 20 Oct 2022 23:37:03 +0300 Subject: [PATCH 2/4] add an option to use two option for detect public IP --- openvpn-install.sh | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index c418d29..96cd8bc 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -227,8 +227,14 @@ function installQuestions() { echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." echo "Unless your server is behind NAT, it should be your public IPv4 address." - # Detect public IPv4 address and pre-fill for the user - IP=$(ip -4 addr | sed -ne 's|^.* inet \([^/]*\)/.* scope global.*$|\1|p' | head -1) + # If detect_from_net is not set detect the IP from the network + # Else use this command to detect ip: curl -s https://api.ipify.org + if [[ -z $DETECT_FROM_NET ]]; then + # Detect public IPv4 address and pre-fill for the user + IP=$(ip -4 addr | sed -ne 's|^.* inet \([^/]*\)/.* scope global.*$|\1|p' | head -1) + else + IP=$(curl -s https://api.ipify.org) + fi if [[ -z $IP ]]; then # Detect public IPv6 address From a879503af196277953c1b61c0ec28d01bc0c7f1d Mon Sep 17 00:00:00 2001 From: Mohammad Parvin Date: Mon, 25 Dec 2023 15:40:25 +0330 Subject: [PATCH 3/4] removed my changes --- openvpn-install.sh | 41 +++++++++++++++++------------------------ 1 file changed, 17 insertions(+), 24 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 96cd8bc..06ad608 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -57,7 +57,7 @@ function checkOS() { fi if [[ $ID == "centos" || $ID == "rocky" || $ID == "almalinux" ]]; then OS="centos" - if [[ ! $VERSION_ID =~ (7|8) ]]; then + if [[ ${VERSION_ID%.*} -lt 7 ]]; then echo "⚠️ Your version of CentOS is not supported." echo "" echo "The script only support CentOS 7 and CentOS 8." @@ -227,14 +227,8 @@ function installQuestions() { echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." echo "Unless your server is behind NAT, it should be your public IPv4 address." - # If detect_from_net is not set detect the IP from the network - # Else use this command to detect ip: curl -s https://api.ipify.org - if [[ -z $DETECT_FROM_NET ]]; then - # Detect public IPv4 address and pre-fill for the user - IP=$(ip -4 addr | sed -ne 's|^.* inet \([^/]*\)/.* scope global.*$|\1|p' | head -1) - else - IP=$(curl -s https://api.ipify.org) - fi + # Detect public IPv4 address and pre-fill for the user + IP=$(ip -4 addr | sed -ne 's|^.* inet \([^/]*\)/.* scope global.*$|\1|p' | head -1) if [[ -z $IP ]]; then # Detect public IPv6 address @@ -633,9 +627,13 @@ function installOpenVPN() { # Behind NAT, we'll default to the publicly reachable IPv4/IPv6. if [[ $IPV6_SUPPORT == "y" ]]; then - PUBLIC_IP=$(curl --retry 5 --retry-connrefused https://ifconfig.co) + if ! PUBLIC_IP=$(curl -f --retry 5 --retry-connrefused https://ip.seeip.org); then + PUBLIC_IP=$(dig -6 TXT +short o-o.myaddr.l.google.com @ns1.google.com | tr -d '"') + fi else - PUBLIC_IP=$(curl --retry 5 --retry-connrefused -4 https://ifconfig.co) + if ! PUBLIC_IP=$(curl -f --retry 5 --retry-connrefused -4 https://ip.seeip.org); then + PUBLIC_IP=$(dig -4 TXT +short o-o.myaddr.l.google.com @ns1.google.com | tr -d '"') + fi fi ENDPOINT=${ENDPOINT:-$PUBLIC_IP} fi @@ -708,10 +706,10 @@ function installOpenVPN() { # Install the latest version of easy-rsa from source, if not already installed. if [[ ! -d /etc/openvpn/easy-rsa/ ]]; then - local version="3.0.7" + local version="3.1.2" wget -O ~/easy-rsa.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v${version}/EasyRSA-${version}.tgz mkdir -p /etc/openvpn/easy-rsa - tar xzf ~/easy-rsa.tgz --strip-components=1 --directory /etc/openvpn/easy-rsa + tar xzf ~/easy-rsa.tgz --strip-components=1 --no-same-owner --directory /etc/openvpn/easy-rsa rm -f ~/easy-rsa.tgz cd /etc/openvpn/easy-rsa/ || return @@ -731,18 +729,16 @@ function installOpenVPN() { SERVER_NAME="server_$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)" echo "$SERVER_NAME" >SERVER_NAME_GENERATED - echo "set_var EASYRSA_REQ_CN $SERVER_CN" >>vars - # Create the PKI, set up the CA, the DH params and the server certificate ./easyrsa init-pki - ./easyrsa --batch build-ca nopass + ./easyrsa --batch --req-cn="$SERVER_CN" build-ca nopass if [[ $DH_TYPE == "2" ]]; then # ECDH keys are generated on-the-fly so we don't need to generate them beforehand openssl dhparam -out dh.pem $DH_KEY_SIZE fi - ./easyrsa build-server-full "$SERVER_NAME" nopass + ./easyrsa --batch build-server-full "$SERVER_NAME" nopass EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl case $TLS_SIG in @@ -1089,14 +1085,11 @@ function newClient() { cd /etc/openvpn/easy-rsa/ || return case $PASS in 1) - ./easyrsa build-client-full "$CLIENT" nopass + ./easyrsa --batch build-client-full "$CLIENT" nopass ;; 2) - echo -e "\n\n⚠️ You will be asked for the client password below ⚠️" - echo "this is a random password generated" - echo `openssl rand -base64 $(shuf -i13-17 -n1) || tr -dc A-Za-z0-9 " echo "" - awk '/BEGIN/,/END/' "/etc/openvpn/easy-rsa/pki/issued/$CLIENT.crt" + awk '/BEGIN/,/END CERTIFICATE/' "/etc/openvpn/easy-rsa/pki/issued/$CLIENT.crt" echo "" echo "" From 0b969ebc0e7f7ced5776367b682b9c20bc11273c Mon Sep 17 00:00:00 2001 From: Mohammad Parvin Date: Mon, 25 Dec 2023 15:46:30 +0330 Subject: [PATCH 4/4] sync with main project --- .github/ISSUE_TEMPLATE/bug.yml | 74 ----------------------- .github/ISSUE_TEMPLATE/feature-request.md | 21 ------- .github/issue_template.md | 10 +++ .github/pull_request_template.md | 7 +++ .github/workflows/lint.yml | 2 +- .github/workflows/test.yml | 23 ++++--- FAQ.md | 22 +++++++ README.md | 52 +++++++++------- 8 files changed, 84 insertions(+), 127 deletions(-) delete mode 100644 .github/ISSUE_TEMPLATE/bug.yml delete mode 100644 .github/ISSUE_TEMPLATE/feature-request.md create mode 100644 .github/issue_template.md create mode 100644 .github/pull_request_template.md diff --git a/.github/ISSUE_TEMPLATE/bug.yml b/.github/ISSUE_TEMPLATE/bug.yml deleted file mode 100644 index 0eacdc9..0000000 --- a/.github/ISSUE_TEMPLATE/bug.yml +++ /dev/null @@ -1,74 +0,0 @@ -name: Bug Report -description: File a bug report -title: "[Bug]: " -body: - - type: markdown - attributes: - value: | - Thanks for taking the time to fill out this bug report! - - **PLEASE** prioritise these communities before opening an issue. - - https://forums.openvpn.net - - https://stackoverflow.com/questions/tagged/openvpn - - https://github.com/angristan/openvpn-install/discussions - - ⚠️ **ANY ISSUE THAT IS NOT CLEARLY A BUG REPORT WILL BE CLOSED AND/OR CONVERTED TO A DISCUSSION.** - - - type: checkboxes - id: pre - attributes: - label: Make sure your check these beforehand! - description: Search before opening an issue. - options: - - label: Issues - https://github.com/angristan/openvpn-install/issues - required: true - - label: README and FAQ - https://github.com/angristan/openvpn-install - required: true - - label: Wiki - https://github.com/angristan/openvpn-install/wiki - required: true - - label: Discussions - https://github.com/angristan/openvpn-install/discussions - required: true - - - type: input - id: server - attributes: - label: Server OS - description: What OS is the OpenVPN server running on? - placeholder: Debian 10 - validations: - required: false - - - type: input - id: openvpn - attributes: - label: OpenVPN version - description: What OpenVPN version is running on your server? - placeholder: 2.5.0 - validations: - required: false - - - type: input - id: client - attributes: - label: Client - description: What OS and client are you using? Please specify the versions. - placeholder: Viscosity 1.10.1 on macOS 12.1 - validations: - required: false - - - type: textarea - id: issue - attributes: - label: What is the bug? - description: Also tell us, what did you expect to happen? - placeholder: Tell us what you see! - value: "A bug happened!" - validations: - required: true - - - type: textarea - id: logs - attributes: - label: Relevant log output - description: Please copy and paste any relevant log output. This will be automatically formatted into code, so no need for backticks. - render: shell diff --git a/.github/ISSUE_TEMPLATE/feature-request.md b/.github/ISSUE_TEMPLATE/feature-request.md deleted file mode 100644 index dcc367d..0000000 --- a/.github/ISSUE_TEMPLATE/feature-request.md +++ /dev/null @@ -1,21 +0,0 @@ ---- -name: Feature request -about: Suggest an idea for this project -title: "" -labels: "" -assignees: "" ---- - -**Checklist** - -- [ ] I read the [README](https://github.com/angristan/openvpn-install/blob/master/README.md) -- [ ] I read the [FAQ](https://github.com/angristan/openvpn-install/blob/master/FAQ.md) -- [ ] I searched the [issues](https://github.com/angristan/openvpn-install/issues?q=is%3Aissue+) -- [ ] My issue is about the script, and not OpenVPN itself - - diff --git a/.github/issue_template.md b/.github/issue_template.md new file mode 100644 index 0000000..2166d42 --- /dev/null +++ b/.github/issue_template.md @@ -0,0 +1,10 @@ + diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..43bed85 --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,7 @@ + diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index ea69759..7301cdf 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -7,7 +7,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout Code - uses: actions/checkout@v3.0.2 + uses: actions/checkout@v3.2.0 - name: Lint Code Base uses: github/super-linter@v4.1.0 env: diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index a0b796e..71ea00a 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -2,6 +2,7 @@ on: push: branches: - master + - ci name: Test jobs: @@ -11,16 +12,18 @@ jobs: strategy: matrix: os-image: - - debian-9-x64 - debian-10-x64 - debian-11-x64 - - ubuntu-18-04-x64 + - debian-12-x64 - ubuntu-20-04-x64 - - fedora-35-x64 + - ubuntu-22-04-x64 + - fedora-37-x64 + - fedora-38-x64 - centos-7-x64 - centos-stream-8-x64 + # - centos-stream-9-x64 # yum oomkill steps: - - uses: actions/checkout@v3.0.2 + - uses: actions/checkout@v3.2.0 - name: Setup doctl uses: digitalocean/action-doctl@v2 @@ -50,7 +53,7 @@ jobs: - name: Setup remote server (Debian/Ubuntu) if: steps.server_os.outputs.value == 'debian' || steps.server_os.outputs.value == 'ubuntu' - uses: appleboy/ssh-action@v0.1.4 + uses: appleboy/ssh-action@v0.1.6 with: host: ${{ steps.server_ip.outputs.value }} username: root @@ -59,7 +62,7 @@ jobs: - name: Setup remote server (Fedora) if: steps.server_os.outputs.value == 'fedora' - uses: appleboy/ssh-action@v0.1.4 + uses: appleboy/ssh-action@v0.1.6 with: host: ${{ steps.server_ip.outputs.value }} username: root @@ -68,7 +71,7 @@ jobs: - name: Setup remote server (CentOS) if: steps.server_os.outputs.value == 'centos' - uses: appleboy/ssh-action@v0.1.4 + uses: appleboy/ssh-action@v0.1.6 with: host: ${{ steps.server_ip.outputs.value }} username: root @@ -76,15 +79,15 @@ jobs: script: set -x && yum install -y git - name: Download repo and checkout current commit - uses: appleboy/ssh-action@v0.1.4 + uses: appleboy/ssh-action@v0.1.6 with: host: ${{ steps.server_ip.outputs.value }} username: root key: ${{ secrets.SSH_KEY }} - script: set -x && git clone https://github.com/angristan/openvpn-install.git && cd openvpn-install && git checkout ${{ github.event.pull_request.head.sha }} + script: set -x && git clone https://github.com/angristan/openvpn-install.git && cd openvpn-install && git checkout ${{ github.sha }} - name: Run openvpn-install.sh in headless mode - uses: appleboy/ssh-action@v0.1.4 + uses: appleboy/ssh-action@v0.1.6 with: host: ${{ steps.server_ip.outputs.value }} username: root diff --git a/FAQ.md b/FAQ.md index 825a9ba..5acd78b 100644 --- a/FAQ.md +++ b/FAQ.md @@ -151,3 +151,25 @@ route 10.0.0.0 255.0.0.0 ``` So for example - here it would route all traffic of `10.0.0.0/8` to the vpn. And the rest through the internet. + +--- + +**Q:** I have enabled IPv6 and my VPN client gets an IPv6 address. Why do I reach the websites or other dual-stacked destionations via IPv4 only? + +**A:** This is because inside the tunnel you don't get a publicly routable IPv6 address, instead you get an ULA (Unlique Local Lan) address. Operating systems don't prefer this all the time. You can fix this in your operating system policies as it's unrelated to the VPN itself: + +Windows (commands needs to run cmd.exe as Administrator): + +``` +netsh interface ipv6 add prefixpolicy fd00::/8 3 1 +``` + +Linux: + +edit `/etc/gai.conf` and uncomment the following line and also change its value to `1`: + +``` +label fc00::/7 1 +``` + +This will not work properly unless you add you your VPN server `server.conf` one or two lines to push at least 1 (one) IPv6 DNS server. Most providers have IPv6 servers as well, add two more lines of `push "dhcp-option DNS "` diff --git a/README.md b/README.md index 4e81f28..dd83d6a 100644 --- a/README.md +++ b/README.md @@ -2,7 +2,6 @@ ![Test](https://github.com/angristan/openvpn-install/workflows/Test/badge.svg) ![Lint](https://github.com/angristan/openvpn-install/workflows/Lint/badge.svg) -![visitors](https://visitor-badge.glitch.me/badge?page_id=angristan.openvpn-install) [![Say Thanks!](https://img.shields.io/badge/Say%20Thanks-!-1EAEDB.svg)](https://saythanks.io/to/angristan) OpenVPN installer for Debian, Ubuntu, Fedora, CentOS, Arch Linux, Oracle Linux, Rocky Linux and AlmaLinux. @@ -114,27 +113,28 @@ export PASS="1" ## Compatibility -The script supports these OS and architectures: +The script supports these Linux distributions: -| | i386 | amd64 | armhf | arm64 | -| --------------- | ---- | ----- | ----- | ----- | -| Amazon Linux 2 | ❔ | ✅ | ❔ | ❔ | -| Arch Linux | ❔ | ✅ | ❔ | ✅ | -| CentOS 7 | ✅ | ✅ | ✅ | ✅ | -| CentOS 8 | ❌ | ✅ | ❌ | ✅ | -| Debian >= 9 | ✅ | ✅ | ✅ | ✅ | -| Fedora >= 27 | ❔ | ✅ | ❔ | ❔ | -| Ubuntu 16.04 | ✅ | ✅ | ❌ | ❌ | -| Ubuntu >= 18.04 | ✅ | ✅ | ✅ | ✅ | -| Oracle Linux 8 | ❌ | ✅ | ❌ | ❔ | -| Rocky Linux 8 | ❔ | ✅ | ❔ | ❔ | -| AlmaLinux 8 | ❌ | ✅ | ❌ | ❔ | +| | Support | +| ------------------ | ------- | +| AlmaLinux 8 | ✅ | +| Amazon Linux 2 | ✅ | +| Arch Linux | ✅ | +| CentOS 7 | ✅ 🤖 | +| CentOS Stream >= 8 | ✅ 🤖 | +| Debian >= 10 | ✅ 🤖 | +| Fedora >= 35 | ✅ 🤖 | +| Oracle Linux 8 | ✅ | +| Rocky Linux 8 | ✅ | +| Ubuntu >= 18.04 | ✅ 🤖 | To be noted: -- It should work on Debian 8+ and Ubuntu 16.04+. But versions not in the table above are not officially supported. +- The script is regularly tested against the distributions marked with a 🤖 only. + - It's only tested on `amd64` architecture. +- It should work on older versions such as Debian 8+, Ubuntu 16.04+ and previous Fedora releases. But versions not in the table above are not officially supported. + - It should also support versions between the LTS versions, but these are not tested. - The script requires `systemd`. -- The script is regularly tested against `amd64` only. ## Fork @@ -150,10 +150,9 @@ More Q&A in [FAQ.md](FAQ.md). **A:** I recommend these: -- [Vultr](https://www.vultr.com/?ref=8537055-6G): Worldwide locations, IPv6 support, starting at \$3.50/month -- [Hetzner](https://hetzner.cloud/?ref=ywtlvZsjgeDq): Germany, IPv6, 20 TB of traffic, starting at €3/month -- [Digital Ocean](https://goo.gl/qXrNLK): Worldwide locations, IPv6 support, starting at \$5/month -- [PulseHeberg](https://goo.gl/76yqW5): France, unlimited bandwidth, starting at €3/month +- [Vultr](https://www.vultr.com/?ref=8948982-8H): Worldwide locations, IPv6 support, starting at \$5/month +- [Hetzner](https://hetzner.cloud/?ref=ywtlvZsjgeDq): Germany, Finland and USA. IPv6, 20 TB of traffic, starting at 4.5€/month +- [Digital Ocean](https://m.do.co/c/ed0ba143fe53): Worldwide locations, IPv6 support, starting at \$4/month --- @@ -192,12 +191,19 @@ Solutions that provision a ready to use OpenVPN server based on this script in o ## Contributing +## Discuss changes + +Please open an issue before submitting a PR if you want to discuss a change, especially if it's a big one. + ### Code formatting We use [shellcheck](https://github.com/koalaman/shellcheck) and [shfmt](https://github.com/mvdan/sh) to enforce bash styling guidelines and good practices. They are executed for each commit / PR with GitHub Actions, so you can check the configuration [here](https://github.com/angristan/openvpn-install/blob/master/.github/workflows/push.yml). ## Security and Encryption +> **Warning** +> This has not been updated for OpenVPN 2.5 and later. + OpenVPN's default settings are pretty weak regarding encryption. This script aims to improve that. OpenVPN 2.4 was a great update regarding encryption. It added support for ECDSA, ECDH, AES GCM, NCP and tls-crypt. @@ -346,3 +352,7 @@ You can [say thanks](https://saythanks.io/to/angristan) if you want! Many thanks to the [contributors](https://github.com/Angristan/OpenVPN-install/graphs/contributors) and Nyr's original work. This project is under the [MIT Licence](https://raw.githubusercontent.com/Angristan/openvpn-install/master/LICENSE) + +## Star History + +[![Star History Chart](https://api.star-history.com/svg?repos=angristan/openvpn-install&type=Date)](https://star-history.com/#angristan/openvpn-install&Date)