Fabio/openvpn-install
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

added feature for selecting custom subnet-configuration for openvpn-installation including regarding questions

Browse source
This commit is contained in:
Tim Mitsch 2020-02-29 11:58:56 +01:00
parent 4b0f47b534
commit b066039d7d
1 changed files with 40 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

55
openvpn-install.sh
View file

@ -104,8 +104,8 @@ function installUnbound () {
apt-get install -y unbound
# Configuration
echo 'interface: 10.8.0.1
access-control: 10.8.0.1/24 allow
echo 'interface: $VPN_SUBNET.1
access-control: $VPN_SUBNET.1/24 allow
hide-identity: yes
hide-version: yes
use-caps-for-id: yes
@ -115,8 +115,8 @@ prefetch: yes' >> /etc/unbound/unbound.conf
yum install -y unbound
# Configuration
sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf
sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf
sed -i 's|# interface: 0.0.0.0$|interface: $VPN_SUBNET.1|' /etc/unbound/unbound.conf
sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: $VPN_SUBNET.1/24 allow|' /etc/unbound/unbound.conf
sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf
sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf
sed -i 's|use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf
@ -125,8 +125,8 @@ prefetch: yes' >> /etc/unbound/unbound.conf
dnf install -y unbound
# Configuration
sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf
sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf
sed -i 's|# interface: 0.0.0.0$|interface: $VPN_SUBNET.1|' /etc/unbound/unbound.conf
sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: $VPN_SUBNET.1/24 allow|' /etc/unbound/unbound.conf
sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf
sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf
sed -i 's|# use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf
@ -146,8 +146,8 @@ prefetch: yes' >> /etc/unbound/unbound.conf
directory: "/etc/unbound"
trust-anchor-file: trusted-key.key
root-hints: root.hints
interface: 10.8.0.1
access-control: 10.8.0.1/24 allow
interface: $VPN_SUBNET.1
access-control: $VPN_SUBNET.1/24 allow
port: 53
num-threads: 2
use-caps-for-id: yes
@ -174,8 +174,8 @@ private-address: ::ffff:0:0/96" >> /etc/unbound/unbound.conf
# Add Unbound 'server' for the OpenVPN subnet
echo 'server:
interface: 10.8.0.1
access-control: 10.8.0.1/24 allow
interface: $VPN_SUBNET.1
access-control: $VPN_SUBNET.1/24 allow
hide-identity: yes
hide-version: yes
use-caps-for-id: yes
@ -262,10 +262,35 @@ function installQuestions () {
3)
# Generate random number within private ports range
PORT=$(shuf -i49152-65535 -n1)
echo "Random Port: $PORT"
echo "Random Port: $PORT"π
;;
esac
echo ""
echo "Custom octets: Notice when using custom octets only private networks as from RFC 1918 (https://tools.ietf.org/html/rfc1918) are allowed: (10.x.x.0, 192.168.x.0)."
until [[ "$CUSTOM_OCTETS" =~ (y|n) ]]; do
read -rp "Do you want to define custom octets for your OpenVPN-Adressing (default is $VPN_SUBNET.x)? [y/n] " -e -i 'n' CUSTOM_OCTETS
done
if [[ $CUSTOM_OCTETS == "y" ]];then
until [[ "$OCTET01" =~ ^[0-9]+$ ]] && ([ "$OCTET01" -eq 10 ] || [ "$OCTET01" -eq 192 ]); do
read -rp "First octet [10,192]: " -e -i 10 OCTET01
done
if [[ $OCTET01 -eq 192 ]];then
$OCTET02 = 168
else
until [[ "$OCTET02" =~ ^[0-9]+$ ]] && ([ "$OCTET02" -ge 0 ] && [ "$OCTET02" -le 255 ]); do
read -rp "Second octet [0-255]: " -e -i 8 OCTET02
done
fi
until [[ "$OCTET03" =~ ^[0-9]+$ ]] && ([ "$OCTET03" -ge 0 ] && [ "$OCTET03" -le 255 ]); do
read -rp "Third octet [0-255]: " -e -i 0 OCTET03
done
VPN_SUBNET="$OCTET01.$OCTET02.$OCTET03"
echo "Using subnet $VPN_SUBNET.0 for further installation"
else
VPN_SUBNET="$VPN_SUBNET"
fi
echo ""
echo "What protocol do you want OpenVPN to use?"
echo "UDP is faster. Unless it is not available, you shouldn't use TCP."
echo " 1) UDP"
@ -723,7 +748,7 @@ persist-key
persist-tun
keepalive 10 120
topology subnet
server 10.8.0.0 255.255.255.0
server $VPN_SUBNET.0 255.255.255.0
ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf
# DNS resolvers
@ -742,7 +767,7 @@ ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf
done
;;
2)
echo 'push "dhcp-option DNS 10.8.0.1"' >> /etc/openvpn/server.conf
echo 'push "dhcp-option DNS $VPN_SUBNET.1"' >> /etc/openvpn/server.conf
;;
3) # Cloudflare
echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server.conf
@ -896,7 +921,7 @@ verb 3" >> /etc/openvpn/server.conf
# Script to add rules
echo "#!/bin/sh
iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o $NIC -j MASQUERADE
iptables -t nat -I POSTROUTING 1 -s $VPN_SUBNET.0/24 -o $NIC -j MASQUERADE
iptables -I INPUT 1 -i tun0 -j ACCEPT
iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT
iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT
@ -911,7 +936,7 @@ ip6tables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT" >> /etc/iptables/add-openvpn-r
# Script to remove rules
echo "#!/bin/sh
iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE
iptables -t nat -D POSTROUTING -s $VPN_SUBNET.0/24 -o $NIC -j MASQUERADE
iptables -D INPUT -i tun0 -j ACCEPT
iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT
iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT