diff --git a/openvpn-install.sh b/openvpn-install.sh index efa92ed..a2fba2b 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -102,34 +102,12 @@ function installUnbound() { if [[ $OS =~ (debian|ubuntu) ]]; then apt-get install -y unbound - # Configuration - echo 'interface: 10.8.0.1 -access-control: 10.8.0.1/24 allow -hide-identity: yes -hide-version: yes -use-caps-for-id: yes -prefetch: yes' >>/etc/unbound/unbound.conf - elif [[ $OS =~ (centos|amzn) ]]; then yum install -y unbound - # Configuration - sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf - sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf - sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf - sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf - sed -i 's|use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf - elif [[ $OS == "fedora" ]]; then dnf install -y unbound - # Configuration - sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf - sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf - sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf - sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf - sed -i 's|# use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf - elif [[ $OS == "arch" ]]; then pacman -Syu --noconfirm unbound @@ -141,66 +119,42 @@ prefetch: yes' >>/etc/unbound/unbound.conf fi echo 'server: - use-syslog: yes - do-daemonize: no - username: "unbound" - directory: "/etc/unbound" trust-anchor-file: trusted-key.key root-hints: root.hints + num-threads: 2' >/etc/unbound/unbound.conf + fi + fi + + # Add Unbound 'server' for the OpenVPN subnet + mkdir -p /etc/unbound/unbound.conf.d + echo 'server: interface: 10.8.0.1 access-control: 10.8.0.1/24 allow - port: 53 - num-threads: 2 use-caps-for-id: yes harden-glue: yes hide-identity: yes hide-version: yes qname-minimisation: yes - prefetch: yes' >/etc/unbound/unbound.conf - fi + prefetch: yes + # DNS Rebinding fix + private-address: 10.0.0.0/8 + private-address: 172.16.0.0/12 + private-address: 192.168.0.0/16 + private-address: 169.254.0.0/16 + private-address: fd00::/8 + private-address: fe80::/10 + private-address: 127.0.0.0/8 + private-address: ::ffff:0:0/96' >/etc/unbound/unbound.conf.d/openvpn.conf - # IPv6 DNS for all OS - if [[ $IPV6_SUPPORT == 'y' ]]; then - echo 'interface: fd42:42:42:42::1 -access-control: fd42:42:42:42::/112 allow' >>/etc/unbound/unbound.conf - fi + # IPv6 DNS for all OS + if [[ $IPV6_SUPPORT == 'y' ]]; then + echo ' interface: fd42:42:42:42::1 + access-control: fd42:42:42:42::/112 allow' >>/etc/unbound/unbound.conf.d/openvpn.conf + fi - if [[ ! $OS =~ (fedora|centos|amzn) ]]; then - # DNS Rebinding fix - echo "private-address: 10.0.0.0/8 -private-address: fd42:42:42:42::/112 -private-address: 172.16.0.0/12 -private-address: 192.168.0.0/16 -private-address: 169.254.0.0/16 -private-address: fd00::/8 -private-address: fe80::/10 -private-address: 127.0.0.0/8 -private-address: ::ffff:0:0/96" >>/etc/unbound/unbound.conf - fi - else # Unbound is already installed - echo 'include: /etc/unbound/openvpn.conf' >>/etc/unbound/unbound.conf - - # Add Unbound 'server' for the OpenVPN subnet - echo 'server: -interface: 10.8.0.1 -access-control: 10.8.0.1/24 allow -hide-identity: yes -hide-version: yes -use-caps-for-id: yes -prefetch: yes -private-address: 10.0.0.0/8 -private-address: fd42:42:42:42::/112 -private-address: 172.16.0.0/12 -private-address: 192.168.0.0/16 -private-address: 169.254.0.0/16 -private-address: fd00::/8 -private-address: fe80::/10 -private-address: 127.0.0.0/8 -private-address: ::ffff:0:0/96' >/etc/unbound/openvpn.conf - if [[ $IPV6_SUPPORT == 'y' ]]; then - echo 'interface: fd42:42:42:42::1 -access-control: fd42:42:42:42::/112 allow' >>/etc/unbound/openvpn.conf - fi + # Add as include, if no wildcard include exist + if ! grep -q '/etc/unbound/unbound.conf.d/' /etc/unbound/unbound.conf; then + echo 'include: /etc/unbound/unbound.conf.d/openvpn.conf' >>/etc/unbound/unbound.conf fi systemctl enable unbound @@ -322,7 +276,7 @@ function installQuestions() { echo "" echo "Unbound is already installed." echo "You can allow the script to configure it in order to use it from your OpenVPN clients" - echo "We will simply add a second server to /etc/unbound/unbound.conf for the OpenVPN subnet." + echo "We will simply add a second server to /etc/unbound/unbound.conf.d/openvpn.conf for the OpenVPN subnet." echo "No changes are made to the current configuration." echo "" @@ -1180,8 +1134,8 @@ function revokeClient() { function removeUnbound() { # Remove OpenVPN-related config - sed -i '/include: \/etc\/unbound\/openvpn.conf/d' /etc/unbound/unbound.conf - rm /etc/unbound/openvpn.conf + sed -i '/include: \/etc\/unbound\/unbound\.conf\.d\/openvpn\.conf/d' /etc/unbound/unbound.conf + rm /etc/unbound/unbound.conf.d/openvpn.conf until [[ $REMOVE_UNBOUND =~ (y|n) ]]; do echo "" @@ -1279,7 +1233,7 @@ function removeOpenVPN() { rm -rf /var/log/openvpn # Unbound - if [[ -e /etc/unbound/openvpn.conf ]]; then + if [[ -e /etc/unbound/unbound.conf.d/openvpn.conf ]]; then removeUnbound fi echo ""