Fabio/openvpn-install
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Refactoring, cleanup, comments, etc

Browse source
This commit is contained in:
angristan 2018-09-19 23:04:48 +02:00
parent 66a6a702c2
commit 91eef0ebb8
1 changed files with 126 additions and 177 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

303
openvpn-install.sh
View file

@ -33,7 +33,7 @@ function checkOS () {
done done
if [[ "$CONTINUE" = "n" ]]; then if [[ "$CONTINUE" = "n" ]]; then
echo "Ok, bye!" echo "Ok, bye!"
exit 4 exit 1
fi fi
fi fi
elif [[ -e /etc/fedora-release ]]; then elif [[ -e /etc/fedora-release ]]; then
@ -49,13 +49,13 @@ function checkOS () {
done done
if [[ "$CONTINUE" = "n" ]]; then if [[ "$CONTINUE" = "n" ]]; then
echo "Ok, bye!" echo "Ok, bye!"
exit 5 exit 1
fi fi
fi fi
OS=centos OS=centos
else else
echo "Looks like you aren't running this installer on a Debian, Ubuntu, Fedora or CentOS system" echo "Looks like you aren't running this installer on a Debian, Ubuntu, Fedora or CentOS system"
exit 4 exit 1
fi fi
} }
@ -66,7 +66,7 @@ function initialCheck () {
fi fi
if ! tunAvailable; then if ! tunAvailable; then
echo "TUN is not available" echo "TUN is not available"
exit 2 exit 1
fi fi
checkOS checkOS
} }
@ -77,6 +77,7 @@ function installLocalDNS () {
if [[ "$OS" = "debian" ]]; then if [[ "$OS" = "debian" ]]; then
apt-get install -y unbound apt-get install -y unbound
# Configuration
echo 'interface: 10.8.0.1 echo 'interface: 10.8.0.1
access-control: 10.8.0.1/24 allow access-control: 10.8.0.1/24 allow
hide-identity: yes hide-identity: yes
@ -116,11 +117,10 @@ prefetch: yes' >> /etc/unbound/unbound.conf
private-address: 127.0.0.0/8 private-address: 127.0.0.0/8
private-address: ::ffff:0:0/96" >> /etc/unbound/unbound.conf private-address: ::ffff:0:0/96" >> /etc/unbound/unbound.conf
fi fi
else else # Unbound is already installed
# Unbound is already installed
echo 'include: /etc/unbound/openvpn.conf' >> /etc/unbound/unbound.conf echo 'include: /etc/unbound/openvpn.conf' >> /etc/unbound/unbound.conf
# Add OpenVPN integration # Add Unbound 'server' for the OpenVPN subnet
echo 'server: echo 'server:
interface: 10.8.0.1 interface: 10.8.0.1
access-control: 10.8.0.1/24 allow access-control: 10.8.0.1/24 allow
@ -138,19 +138,15 @@ private-address: 127.0.0.0/8
private-address: ::ffff:0:0/96' > /etc/unbound/openvpn.conf private-address: ::ffff:0:0/96' > /etc/unbound/openvpn.conf
fi fi
if pgrep systemd-journal; then
systemctl enable unbound systemctl enable unbound
systemctl start unbound systemctl start unbound
else
service unbound restart
fi
} }
function installOpenVPN () { function installOpenVPN () {
echo "Welcome to the secure OpenVPN installer (github.com/Angristan/OpenVPN-install)" echo "Welcome to the OpenVPN installer!"
echo "The git repository is available at: https://github.com/angristan/openvpn-install"
echo "" echo ""
# OpenVPN setup and first user creation
echo "I need to ask you a few questions before starting the setup" echo "I need to ask you a few questions before starting the setup"
echo "You can leave the default options and just press enter if you are ok with them" echo "You can leave the default options and just press enter if you are ok with them"
echo "" echo ""
@ -158,7 +154,7 @@ function installOpenVPN () {
echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)" echo "If your server is running behind a NAT, (e.g. LowEndSpirit, Scaleway) leave the IP address as it is. (local/private IP)"
echo "Otherwise, it should be your public IPv4 address." echo "Otherwise, it should be your public IPv4 address."
# Autodetect IP address and pre-fill for the user # Detect public IPv4 address and pre-fill for the user
IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
read -rp "IP address: " -e -i $IP IP read -rp "IP address: " -e -i $IP IP
# If $IP is a private IP address, the server must be behind NAT # If $IP is a private IP address, the server must be behind NAT
@ -167,21 +163,25 @@ function installOpenVPN () {
echo "This server is behind NAT. What is the public IPv4 address or hostname?" echo "This server is behind NAT. What is the public IPv4 address or hostname?"
read -rp "Public IP address / hostname: " -e PUBLICIP read -rp "Public IP address / hostname: " -e PUBLICIP
fi fi
echo "" echo ""
echo "Checking for IPv6 connectivity..." echo "Checking for IPv6 connectivity..."
ping6 -c4 ipv6.google.com > /dev/null 2>&1; ping6 -c4 ipv6.google.com > /dev/null 2>&1;
echo "" echo ""
if [[ $? == 0 ]]; then if [[ $? == 0 ]]; then
echo "Your host appears to have IPv6 connectivity." echo "Your host appears to have IPv6 connectivity."
SUGGESTION="y"
else else
echo "Your host does not appear to have IPv6 connectivity." echo "Your host does not appear to have IPv6 connectivity."
SUGGESTION="n"
fi fi
echo "" echo ""
while [[ $IPV6 != "y" && $IPV6 != "n" ]]; do # Ask the user if they want to enable IPv6 regardless its availability.
read -rp "Do you want to enable IPv6 support? [y/n]: " -e IPV6 while [[ $IPV6_SUPPORT != "y" && $IPV6_SUPPORT != "n" ]]; do
read -rp "Do you want to enable IPv6 support? [y/n]: " -e -i $SUGGESTION IPV6_SUPPORT
done done
echo "" echo ""
echo "What port do you want for OpenVPN?" echo "What port do you want OpenVPN to listen to?"
echo " 1) Default: 1194" echo " 1) Default: 1194"
echo " 2) Custom" echo " 2) Custom"
echo " 3) Random [49152-65535]" echo " 3) Random [49152-65535]"
@ -204,13 +204,23 @@ function installOpenVPN () {
;; ;;
esac esac
echo "" echo ""
echo "What protocol do you want for OpenVPN?" echo "What protocol do you want OpenVPN to use?"
echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)" echo "UDP is faster. Unless it is not available, you shoudn't use TCP."
until [[ "$PROTOCOL" == "UDP" || "$PROTOCOL" == "TCP" ]]; do echo " 1) UDP"
read -rp "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL echo " 2) TCP"
until [[ "$PROTOCOL_CHOICE" =~ ^[1-2] ]]; do
read -rp "Protocol [1-2]: " -e -i 1 PROTOCOL_CHOICE
done done
case $PROTOCOL_CHOICE in
1)
PROTOCOL="udp"
;;
2)
PROTOCOL="tcp"
;;
esac
echo "" echo ""
echo "What DNS do you want to use with the VPN?" echo "What DNS resolvers do you want to use with the VPN?"
echo " 1) Current system resolvers (from /etc/resolv.conf)" echo " 1) Current system resolvers (from /etc/resolv.conf)"
echo " 2) Self-hosted DNS Resolver (Unbound)" echo " 2) Self-hosted DNS Resolver (Unbound)"
echo " 3) Cloudflare (Anycast: worldwide)" echo " 3) Cloudflare (Anycast: worldwide)"
@ -222,7 +232,7 @@ function installOpenVPN () {
echo " 9) Yandex Basic (Russia)" echo " 9) Yandex Basic (Russia)"
echo " 10) AdGuard DNS (Russia)" echo " 10) AdGuard DNS (Russia)"
until [[ "$DNS" =~ ^[0-9]+$ ]] && [ "$DNS" -ge 1 -a "$DNS" -le 10 ]; do until [[ "$DNS" =~ ^[0-9]+$ ]] && [ "$DNS" -ge 1 -a "$DNS" -le 10 ]; do
read -rp "DNS [1-10]: " -e -i 1 DNS read -rp "DNS [1-10]: " -e -i 3 DNS
if [[ $DNS == 2 ]] && [[ -e /etc/unbound/unbound.conf ]]; then if [[ $DNS == 2 ]] && [[ -e /etc/unbound/unbound.conf ]]; then
echo "" echo ""
echo "Unbound is already installed." echo "Unbound is already installed."
@ -235,6 +245,7 @@ function installOpenVPN () {
read -rp "Apply configuration changes to Unbound? [y/n]: " -e CONTINUE read -rp "Apply configuration changes to Unbound? [y/n]: " -e CONTINUE
done done
if [[ $CONTINUE = "n" ]];then if [[ $CONTINUE = "n" ]];then
# Break the loop and cleanup
unset DNS unset DNS
unset CONTINUE unset CONTINUE
fi fi
@ -245,21 +256,15 @@ function installOpenVPN () {
echo "the encryption in OpenVPN and the choices I made in this script." echo "the encryption in OpenVPN and the choices I made in this script."
echo "Please note that all the choices proposed are secure (to a different degree)" echo "Please note that all the choices proposed are secure (to a different degree)"
echo "and are still viable to date, unlike some default OpenVPN options" echo "and are still viable to date, unlike some default OpenVPN options"
echo '' echo ""
echo "Choose which cipher you want to use for the data channel:" echo "Choose which cipher you want to use for the data channel:"
echo " 1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)" echo " 1) AES-128-CBC (recommended)"
echo " 2) AES-192-CBC" echo " 2) AES-192-CBC"
echo " 3) AES-256-CBC" echo " 3) AES-256-CBC"
echo "Alternatives to AES, use them only if you know what you're doing." until [[ "$CIPHER_CHOICE" =~ ^[0-9]+$ ]] && [ "$CIPHER_CHOICE" -ge 1 -a "$CIPHER_CHOICE" -le 3 ]; do
echo "They are relatively slower but as secure as AES." read -rp "CIPHER_CHOICE [1-7]: " -e -i 1 CIPHER_CHOICE
echo " 4) CAMELLIA-128-CBC"
echo " 5) CAMELLIA-192-CBC"
echo " 6) CAMELLIA-256-CBC"
echo " 7) SEED-CBC"
until [[ "$CIPHER" =~ ^[0-9]+$ ]] && [ "$CIPHER" -ge 1 -a "$CIPHER" -le 7 ]; do
read -rp "Cipher [1-7]: " -e -i 1 CIPHER
done done
case $CIPHER in case $CIPHER_CHOICE in
1) 1)
CIPHER="cipher AES-128-CBC" CIPHER="cipher AES-128-CBC"
;; ;;
@ -269,28 +274,16 @@ function installOpenVPN () {
3) 3)
CIPHER="cipher AES-256-CBC" CIPHER="cipher AES-256-CBC"
;; ;;
4)
CIPHER="cipher CAMELLIA-128-CBC"
;;
5)
CIPHER="cipher CAMELLIA-192-CBC"
;;
6)
CIPHER="cipher CAMELLIA-256-CBC"
;;
7)
CIPHER="cipher SEED-CBC"
;;
esac esac
echo "" echo ""
echo "Choose what size of Diffie-Hellman key you want to use:" echo "Choose what size of Diffie-Hellman key you want to use:"
echo " 1) 2048 bits (fastest)" echo " 1) 2048 bits (fastest)"
echo " 2) 3072 bits (recommended, best compromise)" echo " 2) 3072 bits (recommended, best compromise)"
echo " 3) 4096 bits (most secure)" echo " 3) 4096 bits (most secure)"
until [[ "$DH_KEY_SIZE" =~ ^[0-9]+$ ]] && [ "$DH_KEY_SIZE" -ge 1 -a "$DH_KEY_SIZE" -le 3 ]; do until [[ "$DH_KEY_SIZE_CHOICE" =~ ^[0-9]+$ ]] && [ "$DH_KEY_SIZE_CHOICE" -ge 1 -a "$DH_KEY_SIZE_CHOICE" -le 3 ]; do
read -rp "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE read -rp "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE_CHOICE
done done
case $DH_KEY_SIZE in case $DH_KEY_SIZE_CHOICE in
1) 1)
DH_KEY_SIZE="2048" DH_KEY_SIZE="2048"
;; ;;
@ -302,14 +295,14 @@ function installOpenVPN () {
;; ;;
esac esac
echo "" echo ""
echo "Choose what size of RSA key you want to use:" echo "Choose what size of RSA key you want to use for the certificate:"
echo " 1) 2048 bits (fastest)" echo " 1) 2048 bits (fastest)"
echo " 2) 3072 bits (recommended, best compromise)" echo " 2) 3072 bits (recommended, best compromise)"
echo " 3) 4096 bits (most secure)" echo " 3) 4096 bits (most secure)"
until [[ "$RSA_KEY_SIZE" =~ ^[0-9]+$ ]] && [ "$RSA_KEY_SIZE" -ge 1 -a "$RSA_KEY_SIZE" -le 3 ]; do until [[ "$RSA_KEY_SIZE_CHOICE" =~ ^[0-9]+$ ]] && [ "$RSA_KEY_SIZE_CHOICE" -ge 1 -a "$RSA_KEY_SIZE_CHOICE" -le 3 ]; do
read -rp "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE read -rp "RSA key size [1-3]: " -e -i 2 RSA_KEY_SIZE_CHOICE
done done
case $RSA_KEY_SIZE in case $RSA_KEY_SIZE_CHOICE in
1) 1)
RSA_KEY_SIZE="2048" RSA_KEY_SIZE="2048"
;; ;;
@ -321,43 +314,28 @@ function installOpenVPN () {
;; ;;
esac esac
echo "" echo ""
echo "Do you want to protect the configuration file with a password?"
echo "(e.g. encrypt the private key with a password)"
echo " 1) Add a passwordless client"
echo " 2) Use a password for the client"
until [[ "$pass" =~ ^[1-2]$ ]]; do
read -rp "Select an option [1-2]: " -e -i 1 pass
done
echo ""
echo "Finally, tell me a name for the client certificate and configuration"
echo "Use one word only, no special characters"
until [[ "$CLIENT" =~ ^[a-zA-Z0-9_]+$ ]]; do
read -rp "Client name: " -e -i client CLIENT
done
echo ""
echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now" echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now"
echo "You will be able to generate a client at the end of the installtion."
read -n1 -r -p "Press any key to continue..." read -n1 -r -p "Press any key to continue..."
# Get the "public" interface from the default route
NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1)
if [[ "$OS" = 'debian' ]]; then if [[ "$OS" = 'debian' ]]; then
apt-get update apt-get update
apt-get install ca-certificates gnupg -y apt-get install ca-certificates gnupg -y
# We add the OpenVPN repo to get the latest version. # We add the OpenVPN repo to get the latest version.
# Debian 8
if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then
echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list
wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
apt-get update apt-get update
fi fi
# Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository.
# The we install OpenVPN
apt-get install openvpn iptables openssl wget ca-certificates curl -y apt-get install openvpn iptables openssl wget ca-certificates curl -y
elif [[ "$OS" = 'centos' || "$OS" = 'fedora' ]]; then elif [[ "$OS" = 'centos' ]]; then
if [[ "$OS" = 'centos' ]]; then yum install epel-release openvpn iptables openssl wget ca-certificates curl -y
yum install epel-release -y elif [[ "$OS" = 'fedora' ]]; then
fi dnf install openvpn iptables openssl wget ca-certificates curl -y
yum install openvpn iptables openssl wget ca-certificates curl -y
fi fi
# Find out if the machine uses nogroup or nobody for the permissionless group # Find out if the machine uses nogroup or nobody for the permissionless group
@ -372,6 +350,7 @@ function installOpenVPN () {
rm -rf /etc/openvpn/easy-rsa/ rm -rf /etc/openvpn/easy-rsa/
fi fi
# Install the latest version of easy-rsa from source
local version="3.0.4" local version="3.0.4"
wget -O ~/EasyRSA-${version}.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v${version}/EasyRSA-${version}.tgz wget -O ~/EasyRSA-${version}.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v${version}/EasyRSA-${version}.tgz
tar xzf ~/EasyRSA-${version}.tgz -C ~/ tar xzf ~/EasyRSA-${version}.tgz -C ~/
@ -386,22 +365,13 @@ function installOpenVPN () {
SERVER_NAME="server_$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)" SERVER_NAME="server_$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)"
echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars
echo "set_var EASYRSA_REQ_CN $SERVER_CN" >> vars echo "set_var EASYRSA_REQ_CN $SERVER_CN" >> vars
# Create the PKI, set up the CA, the DH params and the server + client certificates # Create the PKI, set up the CA, the DH params and the server certificate
./easyrsa init-pki ./easyrsa init-pki
./easyrsa --batch build-ca nopass ./easyrsa --batch build-ca nopass
openssl dhparam -out dh.pem $DH_KEY_SIZE openssl dhparam -out dh.pem $DH_KEY_SIZE
./easyrsa build-server-full $SERVER_NAME nopass ./easyrsa build-server-full $SERVER_NAME nopass
case $pass in
1)
./easyrsa build-client-full $CLIENT nopass
;;
2)
echo "⚠️ You will be asked for the client password below ⚠️"
./easyrsa build-client-full $CLIENT
;;
esac
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
# generate tls-auth key # Generate tls-auth key
openvpn --genkey --secret /etc/openvpn/tls-auth.key openvpn --genkey --secret /etc/openvpn/tls-auth.key
# Move all the generated files # Move all the generated files
cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/$SERVER_NAME.crt pki/private/$SERVER_NAME.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/$SERVER_NAME.crt pki/private/$SERVER_NAME.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn
@ -410,19 +380,12 @@ function installOpenVPN () {
# Generate server.conf # Generate server.conf
echo "port $PORT" > /etc/openvpn/server.conf echo "port $PORT" > /etc/openvpn/server.conf
if [[ "$IPV6" = 'n' ]]; then if [[ "$IPV6_SUPPORT" = 'n' ]]; then
if [[ "$PROTOCOL" = 'UDP' ]]; then echo "proto $PROTOCOL" >> /etc/openvpn/server.conf
echo "proto udp" >> /etc/openvpn/server.conf elif [[ "$IPV6_SUPPORT" = 'y' ]]; then
elif [[ "$PROTOCOL" = 'TCP' ]]; then echo "proto ${PROTOCOL}6" >> /etc/openvpn/server.conf
echo "proto tcp" >> /etc/openvpn/server.conf
fi
elif [[ "$IPV6" = 'y' ]]; then
if [[ "$PROTOCOL" = 'UDP' ]]; then
echo "proto udp6" >> /etc/openvpn/server.conf
elif [[ "$PROTOCOL" = 'TCP' ]]; then
echo "proto tcp6" >> /etc/openvpn/server.conf
fi
fi fi
echo "dev tun echo "dev tun
user nobody user nobody
group $NOGROUP group $NOGROUP
@ -432,6 +395,7 @@ keepalive 10 120
topology subnet topology subnet
server 10.8.0.0 255.255.255.0 server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf
# DNS resolvers # DNS resolvers
case $DNS in case $DNS in
1) 1)
@ -487,7 +451,8 @@ ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf
esac esac
echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf
if [[ "$IPV6" = 'y' ]]; then # IPv6 network settings if needed
if [[ "$IPV6_SUPPORT" = 'y' ]]; then
echo 'server-ipv6 fd42:42:42:42::/112 echo 'server-ipv6 fd42:42:42:42::/112
tun-ipv6 tun-ipv6
push tun-ipv6 push tun-ipv6
@ -514,10 +479,9 @@ verb 3" >> /etc/openvpn/server.conf
# Enable routing # Enable routing
echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.d/20-openvpn.conf echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.d/20-openvpn.conf
if [[ "$IPV6" = 'y' ]]; then if [[ "$IPV6_SUPPORT" = 'y' ]]; then
echo 'net.ipv6.conf.all.forwarding=1' >> /etc/sysctl.d/20-openvpn.conf echo 'net.ipv6.conf.all.forwarding=1' >> /etc/sysctl.d/20-openvpn.conf
fi fi
# Avoid an unneeded reboot # Avoid an unneeded reboot
sysctl --system sysctl --system
@ -525,15 +489,7 @@ verb 3" >> /etc/openvpn/server.conf
if hash sestatus 2>/dev/null; then if hash sestatus 2>/dev/null; then
if sestatus | grep "Current mode" | grep -qs "enforcing"; then if sestatus | grep "Current mode" | grep -qs "enforcing"; then
if [[ "$PORT" != '1194' ]]; then if [[ "$PORT" != '1194' ]]; then
# semanage isn't available in CentOS 6 by default semanage port -a -t openvpn_port_t -p $PROTOCOL $PORT
if ! hash semanage 2>/dev/null; then
yum install policycoreutils-python -y
fi
if [[ "$PROTOCOL" = 'UDP' ]]; then
semanage port -a -t openvpn_port_t -p udp $PORT
elif [[ "$PROTOCOL" = 'TCP' ]]; then
semanage port -a -t openvpn_port_t -p tcp $PORT
fi
fi fi
fi fi
fi fi
@ -557,7 +513,7 @@ verb 3" >> /etc/openvpn/server.conf
systemctl enable openvpn@server systemctl enable openvpn@server
fi fi
# Install iptables service # Add iptables rules in two scripts
mkdir /etc/iptables mkdir /etc/iptables
# Script to add rules # Script to add rules
@ -565,15 +521,10 @@ verb 3" >> /etc/openvpn/server.conf
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE
iptables -A INPUT -i tun0 -j ACCEPT iptables -A INPUT -i tun0 -j ACCEPT
iptables -A FORWARD -i $NIC -o tun0 -j ACCEPT iptables -A FORWARD -i $NIC -o tun0 -j ACCEPT
iptables -A FORWARD -i tun0 -o $NIC -j ACCEPT" > /etc/iptables/add-openvpn-rules.sh iptables -A FORWARD -i tun0 -o $NIC -j ACCEPT
iptables -A INPUT -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" > /etc/iptables/add-openvpn-rules.sh
if [[ "$PROTOCOL" = 'UDP' ]]; then if [[ "$IPV6_SUPPORT" = 'y' ]]; then
echo "iptables -A INPUT -i $NIC -p udp --dport $PORT -j ACCEPT" >> /etc/iptables/add-openvpn-rules.sh
elif [[ "$PROTOCOL" = 'TCP' ]]; then
echo "iptables -A INPUT -i $NIC -p tcp --dport $PORT -j ACCEPT" >> /etc/iptables/add-openvpn-rules.sh
fi
if [[ "$IPV6" = 'y' ]]; then
echo "ip6tables -t nat -A POSTROUTING -s fd42:42:42:42::/112 -o $NIC -j MASQUERADE echo "ip6tables -t nat -A POSTROUTING -s fd42:42:42:42::/112 -o $NIC -j MASQUERADE
ip6tables -A INPUT -i tun0 -j ACCEPT ip6tables -A INPUT -i tun0 -j ACCEPT
ip6tables -A FORWARD -i $NIC -o tun0 -j ACCEPT ip6tables -A FORWARD -i $NIC -o tun0 -j ACCEPT
@ -585,15 +536,10 @@ ip6tables -A FORWARD -i tun0 -o $NIC -j ACCEPT" >> /etc/iptables/add-openvpn-rul
iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE
iptables -D INPUT -i tun0 -j ACCEPT iptables -D INPUT -i tun0 -j ACCEPT
iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT
iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT" > /etc/iptables/rm-openvpn-rules.sh iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT
iptables -D INPUT -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" > /etc/iptables/rm-openvpn-rules.sh
if [[ "$PROTOCOL" = 'UDP' ]]; then if [[ "$IPV6_SUPPORT" = 'y' ]]; then
echo "iptables -D INPUT -i $NIC -p udp --dport $PORT -j ACCEPT" >> /etc/iptables/rm-openvpn-rules.sh
elif [[ "$PROTOCOL" = 'TCP' ]]; then
echo "iptables -D INPUT -i $NIC -p tcp --dport $PORT -j ACCEPT" >> /etc/iptables/rm-openvpn-rules.sh
fi
if [[ "$IPV6" = 'y' ]]; then
echo "ip6tables -t nat -D POSTROUTING -s fd42:42:42:42::/112 -o $NIC -j MASQUERADE echo "ip6tables -t nat -D POSTROUTING -s fd42:42:42:42::/112 -o $NIC -j MASQUERADE
ip6tables -D INPUT -i tun0 -j ACCEPT ip6tables -D INPUT -i tun0 -j ACCEPT
ip6tables -D FORWARD -i $NIC -o tun0 -j ACCEPT ip6tables -D FORWARD -i $NIC -o tun0 -j ACCEPT
@ -623,16 +569,16 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables-openvpn.service
systemctl enable iptables-openvpn systemctl enable iptables-openvpn
systemctl start iptables-openvpn systemctl start iptables-openvpn
# If the server is behind a NAT, use the correct IP address # If the server is behind a NAT, use the correct IP address for the clients to connect to
if [[ "$PUBLICIP" != "" ]]; then if [[ "$PUBLICIP" != "" ]]; then
IP=$PUBLICIP IP=$PUBLICIP
fi fi
# client-template.txt is created so we have a template to add further users later # client-template.txt is created so we have a template to add further users later
echo "client" > /etc/openvpn/client-template.txt echo "client" > /etc/openvpn/client-template.txt
if [[ "$PROTOCOL" = 'UDP' ]]; then if [[ "$PROTOCOL" = 'udp' ]]; then
echo "proto udp" >> /etc/openvpn/client-template.txt echo "proto udp" >> /etc/openvpn/client-template.txt
elif [[ "$PROTOCOL" = 'TCP' ]]; then elif [[ "$PROTOCOL" = 'tcp' ]]; then
echo "proto tcp-client" >> /etc/openvpn/client-template.txt echo "proto tcp-client" >> /etc/openvpn/client-template.txt
fi fi
echo "remote $IP $PORT echo "remote $IP $PORT
@ -653,76 +599,73 @@ setenv opt block-outside-dns
verb 3" >> /etc/openvpn/client-template.txt verb 3" >> /etc/openvpn/client-template.txt
# Generate the custom client.ovpn # Generate the custom client.ovpn
newclient newClient
echo "If you want to add more clients, you simply need to run this script another time!" echo "If you want to add more clients, you simply need to run this script another time!"
} }
function newClient () { function newClient () {
echo ""
echo "Tell me a name for the client."
echo "Use one word only, no special characters."
until [[ "$CLIENT" =~ ^[a-zA-Z0-9_]+$ ]]; do
read -rp "Client name: " -e CLIENT
done
echo "" echo ""
echo "Do you want to protect the configuration file with a password?" echo "Do you want to protect the configuration file with a password?"
echo "(e.g. encrypt the private key with a password)" echo "(e.g. encrypt the private key with a password)"
echo " 1) Add a passwordless client" echo " 1) Add a passwordless client"
echo " 2) Use a password for the client" echo " 2) Use a password for the client"
until [[ "$pass" =~ ^[1-2]$ ]]; do until [[ "$PASS" =~ ^[1-2]$ ]]; do
read -rp "Select an option [1-2]: " -e -i 1 local pass read -rp "Select an option [1-2]: " -e -i 1 PASS
done
echo ""
echo "Tell me a name for the client cert"
echo "Use one word only, no special characters"
until [[ "$client" =~ ^[a-zA-Z0-9_]+$ ]]; do
read -rp "Client name: " -e local client
done done
generateClient
}
function generateClient () {
cd /etc/openvpn/easy-rsa/ || return cd /etc/openvpn/easy-rsa/ || return
case $pass in case $PASS in
1) 1)
./easyrsa build-client-full $client nopass ./easyrsa build-client-full $CLIENT nopass
;; ;;
2) 2)
echo "⚠️ You will be asked for the client password below ⚠️" echo "⚠️ You will be asked for the client password below ⚠️"
./easyrsa build-client-full $client ./easyrsa build-client-full $CLIENT
;; ;;
esac esac
# Where to write the custom client.ovpn? # Home directory of the user, where the client configuration (.ovpn) will be written
if [ -e "/home/$client" ]; then # if $1 is a user name if [ -e "/home/$CLIENT" ]; then # if $1 is a user name
homeDir="/home/$client" homeDir="/home/$CLIENT"
elif [ "${SUDO_USER}" ]; then # if not, use SUDO_USER elif [ "${SUDO_USER}" ]; then # if not, use SUDO_USER
homeDir="/home/${SUDO_USER}" homeDir="/home/${SUDO_USER}"
else # if not SUDO_USER, use /root else # if not SUDO_USER, use /root
homeDir="/root" homeDir="/root"
fi fi
# Generates the custom client.ovpn # Generates the custom client.ovpn
cp /etc/openvpn/client-template.txt "$homeDir/$client.ovpn" cp /etc/openvpn/client-template.txt "$homeDir/$CLIENT.ovpn"
{ {
echo "<ca>" echo "<ca>"
cat "/etc/openvpn/easy-rsa/pki/ca.crt" cat "/etc/openvpn/easy-rsa/pki/ca.crt"
echo "</ca>" echo "</ca>"
echo "<cert>" echo "<cert>"
cat "/etc/openvpn/easy-rsa/pki/issued/$client.crt" cat "/etc/openvpn/easy-rsa/pki/issued/$CLIENT.crt"
echo "</cert>" echo "</cert>"
echo "<key>" echo "<key>"
cat "/etc/openvpn/easy-rsa/pki/private/$client.key" cat "/etc/openvpn/easy-rsa/pki/private/$CLIENT.key"
echo "</key>" echo "</key>"
echo "key-direction 1" echo "key-direction 1"
echo "<tls-auth>" echo "<tls-auth>"
cat "/etc/openvpn/tls-auth.key" cat "/etc/openvpn/tls-auth.key"
echo "</tls-auth>" echo "</tls-auth>"
} >> "$homeDir/$client.ovpn" } >> "$homeDir/$CLIENT.ovpn"
echo "" echo ""
echo "Client $client added, certs available at $homeDir/$client.ovpn" echo "Client $CLIENT added, the configuration file is available at $homeDir/$CLIENT.ovpn."
exit echo "Download the .ovpn file and import it in your OpenVPN client."
} }
function revokeClient () { function revokeClient () {
@ -730,7 +673,7 @@ function revokeClient () {
if [[ "$NUMBEROFCLIENTS" = '0' ]]; then if [[ "$NUMBEROFCLIENTS" = '0' ]]; then
echo "" echo ""
echo "You have no existing clients!" echo "You have no existing clients!"
exit 5 exit 1
fi fi
echo "" echo ""
@ -746,6 +689,7 @@ function revokeClient () {
cd /etc/openvpn/easy-rsa/ cd /etc/openvpn/easy-rsa/
./easyrsa --batch revoke $CLIENT ./easyrsa --batch revoke $CLIENT
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
# Cleanup
rm -f pki/reqs/$CLIENT.req rm -f pki/reqs/$CLIENT.req
rm -f pki/private/$CLIENT.key rm -f pki/private/$CLIENT.key
rm -f pki/issued/$CLIENT.crt rm -f pki/issued/$CLIENT.crt
@ -756,9 +700,7 @@ function revokeClient () {
rm -f /root/$CLIENT.ovpn 2>/dev/null rm -f /root/$CLIENT.ovpn 2>/dev/null
echo "" echo ""
echo "Certificate for client $CLIENT revoked" echo "Certificate for client $CLIENT revoked."
echo "Exiting..."
exit
} }
function removeOpenVPN () { function removeOpenVPN () {
@ -767,7 +709,7 @@ function removeOpenVPN () {
if [[ "$REMOVE" = 'y' ]]; then if [[ "$REMOVE" = 'y' ]]; then
PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2)
# Remove ipatbles rules related to the script # Remove the iptables rules related to the script
systemctl stop iptables-openvpn systemctl stop iptables-openvpn
# Cleanup # Cleanup
systemctl disable iptables-openvpn systemctl disable iptables-openvpn
@ -776,6 +718,7 @@ function removeOpenVPN () {
rm /etc/iptables/add-openvpn-rules.sh rm /etc/iptables/add-openvpn-rules.sh
rm /etc/iptables/rm-openvpn-rules.sh rm /etc/iptables/rm-openvpn-rules.sh
# SELinux
if hash sestatus 2>/dev/null; then if hash sestatus 2>/dev/null; then
if sestatus | grep "Current mode" | grep -qs "enforcing"; then if sestatus | grep "Current mode" | grep -qs "enforcing"; then
if [[ "$PORT" != '1194' ]]; then if [[ "$PORT" != '1194' ]]; then
@ -783,11 +726,16 @@ function removeOpenVPN () {
fi fi
fi fi
fi fi
if [[ "$OS" = 'debian' ]]; then if [[ "$OS" = 'debian' ]]; then
apt-get autoremove --purge -y openvpn apt-get autoremove --purge -y openvpn
else elif [[ "$OS" = 'centos' ]]; then
yum remove openvpn -y yum remove openvpn -y
elif [[ "$OS" = 'fedora' ]]; then
dnf remove openvpn -y
fi fi
# Cleanup
OVPNS=$(ls /etc/openvpn/easy-rsa/pki/issued | awk -F "." {'print $1'}) OVPNS=$(ls /etc/openvpn/easy-rsa/pki/issued | awk -F "." {'print $1'})
for i in $OVPNS;do for i in $OVPNS;do
rm $(find /home -maxdepth 2 | grep $i.ovpn) 2>/dev/null rm $(find /home -maxdepth 2 | grep $i.ovpn) 2>/dev/null
@ -797,8 +745,8 @@ function removeOpenVPN () {
rm -rf /usr/share/doc/openvpn* rm -rf /usr/share/doc/openvpn*
rm -f /etc/sysctl.d/20-openvpn.conf rm -f /etc/sysctl.d/20-openvpn.conf
# Unbound
if [[ -e /etc/unbound/openvpn.conf ]]; then if [[ -e /etc/unbound/openvpn.conf ]]; then
# Remove OpenVPN-related config # Remove OpenVPN-related config
sed -i 's|include: \/etc\/unbound\/openvpn.conf||' /etc/unbound/unbound.conf sed -i 's|include: \/etc\/unbound\/openvpn.conf||' /etc/unbound/unbound.conf
rm /etc/unbound/openvpn.conf rm /etc/unbound/openvpn.conf
@ -807,22 +755,25 @@ function removeOpenVPN () {
until [[ $REMOVE_UNBOUND == "y" || $REMOVE_UNBOUND == "n" ]]; do until [[ $REMOVE_UNBOUND == "y" || $REMOVE_UNBOUND == "n" ]]; do
echo "" echo ""
echo "If you were already using Unbound before installing OpenVPN, I removed the configuration related to OpenVPN." echo "If you were already using Unbound before installing OpenVPN, I removed the configuration related to OpenVPN."
echo "You can keep using Unbound as before."
read -rp "Do you want to completely remove Unbound? [y/n]: " -e REMOVE_UNBOUND read -rp "Do you want to completely remove Unbound? [y/n]: " -e REMOVE_UNBOUND
done done
if [[ "$REMOVE_UNBOUND" = 'y' ]]; then if [[ "$REMOVE_UNBOUND" = 'y' ]]; then
if [[ "$OS" = 'debian' ]]; then if [[ "$OS" = 'debian' ]]; then
apt-get autoremove --purge -y unbound apt-get autoremove --purge -y unbound
else elif [[ "$OS" = 'centos' ]]; then
yum remove unbound -y yum remove unbound -y
elif [[ "$OS" = 'fedora' ]]; then
dnf remove unbound -y
fi fi
rm -rf /etc/unbound/
echo "" echo ""
echo "Unbound removed!" echo "Unbound removed!"
else else
echo "" echo ""
echo "Unbound not removed!" echo "Unbound wasn't removed."
fi fi
fi fi
echo "" echo ""
@ -831,27 +782,25 @@ function removeOpenVPN () {
echo "" echo ""
echo "Removal aborted!" echo "Removal aborted!"
fi fi
exit
} }
function manageMenu () { function manageMenu () {
clear clear
echo "OpenVPN-install (github.com/Angristan/OpenVPN-install)" echo "Welcome to OpenVPN-install!"
echo "The git repository is available at: https://github.com/angristan/openvpn-install"
echo "" echo ""
echo "Looks like OpenVPN is already installed" echo "It looks like OpenVPN is already installed."
echo "" echo ""
echo "What do you want to do?" echo "What do you want to do?"
echo " 1) Add a cert for a new user" echo " 1) Add a new user"
echo " 2) Revoke existing user cert" echo " 2) Revoke existing user"
echo " 3) Remove OpenVPN" echo " 3) Remove OpenVPN"
echo " 4) Exit" echo " 4) Exit"
read -rp "Select an option [1-4]: " option read -rp "Select an option [1-4]: " option
case $option in case $option in
1) 1)
# Generates the custom client.ovpn newClient
newclient
;; ;;
2) 2)
revokeClient revokeClient
@ -860,19 +809,19 @@ function manageMenu () {
removeOpenVPN removeOpenVPN
;; ;;
4) 4)
exit exit 0
;; ;;
esac esac
} }
# Main # Main
# Check for root, TUN, OS...
initialCheck initialCheck
# Check if OpenVPN is already installed
if [[ -e /etc/openvpn/server.conf ]]; then if [[ -e /etc/openvpn/server.conf ]]; then
manageMenu manageMenu
else else
installOpenVPN installOpenVPN
fi fi
exit 0