API tools faq
paste
lllANONYMOUSlll

OpenVPN/lIIANONYMOUSIlI/AnonymousVPN

lllANONYMOUSlll
Oct 22nd, 2020
276
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 24.95 KB | None | 0 0
raw download clone embed print report
  1. #!/bin/bash
  2. #
  3. # https://github.com/Nyr/openvpn-install
  4. #
  5. # Copyright (c) 2013 Nyr. Released under the MIT License.
  6.  
  7.  
  8. # Detect Debian users running the script with "sh" instead of bash
  9. if readlink /proc/$$/exe | grep -q "dash"; then
  10. echo 'This installer needs to be run with "bash", not "sh".'
  11. exit
  12. fi
  13.  
  14. # Discard stdin. Needed when running from an one-liner which includes a newline
  15. read -N 999999 -t 0.001
  16.  
  17. # Detect OpenVZ 6
  18. if [[ $(uname -r | cut -d "." -f 1) -eq 2 ]]; then
  19. echo "The system is running an old kernel, which is incompatible with this installer."
  20. exit
  21. fi
  22.  
  23. # Detect OS
  24. # $os_version variables aren't always in use, but are kept here for convenience
  25. if grep -qs "ubuntu" /etc/os-release; then
  26. os="ubuntu"
  27. os_version=$(grep 'VERSION_ID' /etc/os-release | cut -d '"' -f 2 | tr -d '.')
  28. group_name="nogroup"
  29. elif [[ -e /etc/debian_version ]]; then
  30. os="debian"
  31. os_version=$(grep -oE '[0-9]+' /etc/debian_version | head -1)
  32. group_name="nogroup"
  33. elif [[ -e /etc/centos-release ]]; then
  34. os="centos"
  35. os_version=$(grep -oE '[0-9]+' /etc/centos-release | head -1)
  36. group_name="nobody"
  37. elif [[ -e /etc/fedora-release ]]; then
  38. os="fedora"
  39. os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)
  40. group_name="nobody"
  41. else
  42. echo "This installer seems to be running on an unsupported distribution.
  43. Supported distributions are Ubuntu, Debian, CentOS, and Fedora."
  44. exit
  45. fi
  46.  
  47. if [[ "$os" == "ubuntu" && "$os_version" -lt 1804 ]]; then
  48. echo "Ubuntu 18.04 or higher is required to use this installer.
  49. This version of Ubuntu is too old and unsupported."
  50. exit
  51. fi
  52.  
  53. if [[ "$os" == "debian" && "$os_version" -lt 9 ]]; then
  54. echo "Debian 9 or higher is required to use this installer.
  55. This version of Debian is too old and unsupported."
  56. exit
  57. fi
  58.  
  59. if [[ "$os" == "centos" && "$os_version" -lt 7 ]]; then
  60. echo "CentOS 7 or higher is required to use this installer.
  61. This version of CentOS is too old and unsupported."
  62. exit
  63. fi
  64.  
  65. # Detect environments where $PATH does not include the sbin directories
  66. if ! grep -q sbin <<< "$PATH"; then
  67. echo '$PATH does not include sbin. Try using "su -" instead of "su".'
  68. exit
  69. fi
  70.  
  71. if [[ "$EUID" -ne 0 ]]; then
  72. echo "This installer needs to be run with superuser privileges."
  73. exit
  74. fi
  75.  
  76. if [[ ! -e /dev/net/tun ]] || ! ( exec 7<>/dev/net/tun ) 2>/dev/null; then
  77. echo "The system does not have the TUN device available.
  78. TUN needs to be enabled before running this installer."
  79. exit
  80. fi
  81.  
  82. new_client () {
  83. # Generates the custom client.ovpn
  84. {
  85. cat /etc/openvpn/server/client-common.txt
  86. echo "<ca>"
  87. cat /etc/openvpn/server/easy-rsa/pki/ca.crt
  88. echo "</ca>"
  89. echo "<cert>"
  90. sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt
  91. echo "</cert>"
  92. echo "<key>"
  93. cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key
  94. echo "</key>"
  95. echo "<tls-crypt>"
  96. sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
  97. echo "</tls-crypt>"
  98. } > ~/"$client".ovpn
  99. }
  100.  
  101. if [[ ! -e /etc/openvpn/server/server.conf ]]; then
  102. clear
  103. echo 'Welcome to this OpenVPN road warrior installer!'
  104. # If system has a single IPv4, it is selected automatically. Else, ask the user
  105. if [[ $(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}') -eq 1 ]]; then
  106. ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}')
  107. else
  108. number_of_ip=$(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}')
  109. echo
  110. echo "Which IPv4 address should be used?"
  111. ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | nl -s ') '
  112. read -p "IPv4 address [1]: " ip_number
  113. until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ip" ]]; do
  114. echo "$ip_number: invalid selection."
  115. read -p "IPv4 address [1]: " ip_number
  116. done
  117. [[ -z "$ip_number" ]] && ip_number="1"
  118. ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sed -n "$ip_number"p)
  119. fi
  120. # If $ip is a private IP address, the server must be behind NAT
  121. if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
  122. echo
  123. echo "This server is behind NAT. What is the public IPv4 address or hostname?"
  124. # Get public IP and sanitize with grep
  125. get_public_ip=$(grep -m 1 -oE '^[0-9]{1,3}(\.[0-9]{1,3}){3}$' <<< "$(wget -T 10 -t 1 -4qO- "http://ip1.dynupdate.no-ip.com/" || curl -m 10 -4Ls "http://ip1.dynupdate.no-ip.com/")")
  126. read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip
  127. # If the checkip service is unavailable and user didn't provide input, ask again
  128. until [[ -n "$get_public_ip" || -n "$public_ip" ]]; do
  129. echo "Invalid input."
  130. read -p "Public IPv4 address / hostname: " public_ip
  131. done
  132. [[ -z "$public_ip" ]] && public_ip="$get_public_ip"
  133. fi
  134. # If system has a single IPv6, it is selected automatically
  135. if [[ $(ip -6 addr | grep -c 'inet6 [23]') -eq 1 ]]; then
  136. ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}')
  137. fi
  138. # If system has multiple IPv6, ask the user to select one
  139. if [[ $(ip -6 addr | grep -c 'inet6 [23]') -gt 1 ]]; then
  140. number_of_ip6=$(ip -6 addr | grep -c 'inet6 [23]')
  141. echo
  142. echo "Which IPv6 address should be used?"
  143. ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | nl -s ') '
  144. read -p "IPv6 address [1]: " ip6_number
  145. until [[ -z "$ip6_number" || "$ip6_number" =~ ^[0-9]+$ && "$ip6_number" -le "$number_of_ip6" ]]; do
  146. echo "$ip6_number: invalid selection."
  147. read -p "IPv6 address [1]: " ip6_number
  148. done
  149. [[ -z "$ip6_number" ]] && ip6_number="1"
  150. ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | sed -n "$ip6_number"p)
  151. fi
  152. echo
  153. echo ::::::::: ::::::::: :::::::: ::::::::::: :::::::: :::::::: :::::::: :::
  154. echo :+: :+: :+: :+: :+: :+: :+: :+: :+: :+: :+: :+: :+: :+:
  155. echo +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+ +:+
  156. echo +#++:++#+ +#++:++#: +#+ +:+ +#+ +#+ +:+ +#+ +#+ +:+ +#+
  157. echo +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+ +#+
  158. echo #+# #+# #+# #+# #+# #+# #+# #+# #+# #+# #+# #+# #+#
  159. echo ### ### ### ######## ### ######## ######## ######## ##########
  160. echo.
  161. echo "Which Protocol Should OpenVPN Use?"
  162. echo " 1) UDP (Recommended)"
  163. echo " 2) TCP
  164. read -p "Protocol [1]: " protocol
  165. until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
  166. echo "$protocol: invalid selection."
  167. read -p "Protocol [1]: " protocol
  168. done
  169. case "$protocol" in
  170. 1|"")
  171. protocol=udp
  172. ;;
  173. 2)
  174. protocol=tcp
  175. ;;
  176. esac
  177. echo By IlIANONYMOUSIII
  178. echo ::::::::: :::::::: ::::::::: :::::::::::
  179. echo :+: :+: :+: :+: :+: :+: :+:
  180. echo +:+ +:+ +:+ +:+ +:+ +:+ +:+
  181. echo +#++:++#+ +#+ +:+ +#++:++#: +#+
  182. echo +#+ +#+ +#+ +#+ +#+ +#+
  183. echo #+# #+# #+# #+# #+# #+#
  184. echo ### ######## ### ### ###
  185. echo.
  186. echo "What Port Should OpenVPN Listen To?"
  187. read -p "Port [1194]: " port
  188. until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do
  189. echo "$port: invalid port."
  190. read -p "Port [1194]: " port
  191. done
  192. [[ -z "$port" ]] && port="1194"
  193. echo By IlIANONYMOUSIII
  194. echo ::::::::: :::: ::: ::::::::
  195. echo :+: :+: :+:+: :+: :+: :+:
  196. echo +:+ +:+ :+:+:+ +:+ +:+
  197. echo +#+ +:+ +#+ +:+ +#+ +#++:++#++
  198. echo +#+ +#+ +#+ +#+#+# +#+
  199. echo #+# #+# #+# #+#+# #+# #+#
  200. echo ######### ### #### ########
  201. echo.
  202. echo "Select a DNS Server For The Clients:"
  203. echo " 1) Current system resolvers"
  204. echo " 2) Google"
  205. echo " 3) 1.1.1.1"
  206. echo " 4) OpenDNS"
  207. echo " 5) Quad9"
  208. echo " 6) AdGuard"
  209. read -p "DNS server [1]: " dns
  210. until [[ -z "$dns" || "$dns" =~ ^[1-6]$ ]]; do
  211. echo "$dns: Invalid Selection."
  212. read -p "DNS server [1]: " dns
  213. done
  214. echo By IlIANONYMOUSIII
  215. echo :::: ::: ::: ::: ::: ::::::::::
  216. echo :+:+: :+: :+: :+: :+:+: :+:+: :+:
  217. echo :+:+:+ +:+ +:+ +:+ +:+ +:+:+ +:+ +:+
  218. echo +#+ +:+ +#+ +#++:++#++: +#+ +:+ +#+ +#++:++#
  219. echo +#+ +#+#+# +#+ +#+ +#+ +#+ +#+
  220. echo #+# #+#+# #+# #+# #+# #+# #+#
  221. echo ### #### ### ### ### ### ##########
  222. echo.
  223. echo "Enter A Name For The First Client And Be Wise:"
  224. read -p "Name [client]: " unsanitized_client
  225. # Allow a limited set of characters to avoid conflicts
  226. client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
  227. [[ -z "$client" ]] && client="client"
  228. echo
  229. echo "OpenVPN Installation Is Ready To Begin."
  230. # Install a firewall in the rare case where one is not already available
  231. if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then
  232. if [[ "$os" == "centos" || "$os" == "fedora" ]]; then
  233. firewall="firewalld"
  234. # We don't want to silently enable firewalld, so we give a subtle warning
  235. # If the user continues, firewalld will be installed and enabled during setup
  236. echo "firewalld, which is required to manage routing tables, will also be installed."
  237. elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then
  238. # iptables is way less invasive than firewalld so no warning is given
  239. firewall="iptables"
  240. fi
  241. fi
  242. read -n1 -r -p "Press any key to continue..."
  243. # If running inside a container, disable LimitNPROC to prevent conflicts
  244. if systemd-detect-virt -cq; then
  245. mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null
  246. echo "[Service]
  247. LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
  248. fi
  249. if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
  250. apt-get update
  251. apt-get install -y openvpn openssl ca-certificates $firewall
  252. elif [[ "$os" = "centos" ]]; then
  253. yum install -y epel-release
  254. yum install -y openvpn openssl ca-certificates tar $firewall
  255. else
  256. # Else, OS must be Fedora
  257. dnf install -y openvpn openssl ca-certificates tar $firewall
  258. fi
  259. # If firewalld was just installed, enable it
  260. if [[ "$firewall" == "firewalld" ]]; then
  261. systemctl enable --now firewalld.service
  262. fi
  263. # Get easy-rsa
  264. easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.8/EasyRSA-3.0.8.tgz'
  265. mkdir -p /etc/openvpn/server/easy-rsa/
  266. { wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1
  267. chown -R root:root /etc/openvpn/server/easy-rsa/
  268. cd /etc/openvpn/server/easy-rsa/
  269. # Create the PKI, set up the CA and the server and client certificates
  270. ./easyrsa init-pki
  271. ./easyrsa --batch build-ca nopass
  272. EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass
  273. EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
  274. EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
  275. # Move the stuff we need
  276. cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
  277. # CRL is read with each client connection, while OpenVPN is dropped to nobody
  278. chown nobody:"$group_name" /etc/openvpn/server/crl.pem
  279. # Without +x in the directory, OpenVPN can't run a stat() on the CRL file
  280. chmod o+x /etc/openvpn/server/
  281. # Generate key for tls-crypt
  282. openvpn --genkey --secret /etc/openvpn/server/tc.key
  283. # Create the DH parameters file using the predefined ffdhe2048 group
  284. echo '-----BEGIN DH PARAMETERS-----
  285. MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
  286. +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
  287. 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
  288. YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
  289. 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
  290. ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
  291. -----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem
  292. # Generate server.conf
  293. echo "local $ip
  294. port $port
  295. proto $protocol
  296. dev tun
  297. ca ca.crt
  298. cert server.crt
  299. key server.key
  300. dh dh.pem
  301. auth SHA512
  302. tls-crypt tc.key
  303. topology subnet
  304. server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf
  305. # IPv6
  306. if [[ -z "$ip6" ]]; then
  307. echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
  308. else
  309. echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf
  310. echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf
  311. fi
  312. echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf
  313. # DNS
  314. case "$dns" in
  315. 1|"")
  316. # Locate the proper resolv.conf
  317. # Needed for systems running systemd-resolved
  318. if grep -q '^nameserver 127.0.0.53' "/etc/resolv.conf"; then
  319. resolv_conf="/run/systemd/resolve/resolv.conf"
  320. else
  321. resolv_conf="/etc/resolv.conf"
  322. fi
  323. # Obtain the resolvers from resolv.conf and use them for OpenVPN
  324. grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do
  325. echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server/server.conf
  326. done
  327. ;;
  328. 2)
  329. echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf
  330. echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf
  331. ;;
  332. 3)
  333. echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf
  334. echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf
  335. ;;
  336. 4)
  337. echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf
  338. echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf
  339. ;;
  340. 5)
  341. echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf
  342. echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf
  343. ;;
  344. 6)
  345. echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf
  346. echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf
  347. ;;
  348. esac
  349. echo "keepalive 10 120
  350. cipher AES-256-CBC
  351. user nobody
  352. group $group_name
  353. persist-key
  354. persist-tun
  355. status openvpn-status.log
  356. verb 3
  357. crl-verify crl.pem" >> /etc/openvpn/server/server.conf
  358. if [[ "$protocol" = "udp" ]]; then
  359. echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf
  360. fi
  361. # Enable net.ipv4.ip_forward for the system
  362. echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/30-openvpn-forward.conf
  363. # Enable without waiting for a reboot or service restart
  364. echo 1 > /proc/sys/net/ipv4/ip_forward
  365. if [[ -n "$ip6" ]]; then
  366. # Enable net.ipv6.conf.all.forwarding for the system
  367. echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/30-openvpn-forward.conf
  368. # Enable without waiting for a reboot or service restart
  369. echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
  370. fi
  371. if systemctl is-active --quiet firewalld.service; then
  372. # Using both permanent and not permanent rules to avoid a firewalld
  373. # reload.
  374. # We don't use --add-service=openvpn because that would only work with
  375. # the default port and protocol.
  376. firewall-cmd --add-port="$port"/"$protocol"
  377. firewall-cmd --zone=trusted --add-source=10.8.0.0/24
  378. firewall-cmd --permanent --add-port="$port"/"$protocol"
  379. firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
  380. # Set NAT for the VPN subnet
  381. firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
  382. firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
  383. if [[ -n "$ip6" ]]; then
  384. firewall-cmd --zone=trusted --add-source=fddd:1194:1194:1194::/64
  385. firewall-cmd --permanent --zone=trusted --add-source=fddd:1194:1194:1194::/64
  386. firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
  387. firewall-cmd --permanent --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
  388. fi
  389. else
  390. # Create a service to set up persistent iptables rules
  391. iptables_path=$(command -v iptables)
  392. ip6tables_path=$(command -v ip6tables)
  393. # nf_tables is not available as standard in OVZ kernels. So use iptables-legacy
  394. # if we are in OVZ, with a nf_tables backend and iptables-legacy is available.
  395. if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then
  396. iptables_path=$(command -v iptables-legacy)
  397. ip6tables_path=$(command -v ip6tables-legacy)
  398. fi
  399. echo "[Unit]
  400. Before=network.target
  401. [Service]
  402. Type=oneshot
  403. ExecStart=$iptables_path -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
  404. ExecStart=$iptables_path -I INPUT -p $protocol --dport $port -j ACCEPT
  405. ExecStart=$iptables_path -I FORWARD -s 10.8.0.0/24 -j ACCEPT
  406. ExecStart=$iptables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
  407. ExecStop=$iptables_path -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
  408. ExecStop=$iptables_path -D INPUT -p $protocol --dport $port -j ACCEPT
  409. ExecStop=$iptables_path -D FORWARD -s 10.8.0.0/24 -j ACCEPT
  410. ExecStop=$iptables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > /etc/systemd/system/openvpn-iptables.service
  411. if [[ -n "$ip6" ]]; then
  412. echo "ExecStart=$ip6tables_path -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
  413. ExecStart=$ip6tables_path -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
  414. ExecStart=$ip6tables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
  415. ExecStop=$ip6tables_path -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
  416. ExecStop=$ip6tables_path -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
  417. ExecStop=$ip6tables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> /etc/systemd/system/openvpn-iptables.service
  418. fi
  419. echo "RemainAfterExit=yes
  420. [Install]
  421. WantedBy=multi-user.target" >> /etc/systemd/system/openvpn-iptables.service
  422. systemctl enable --now openvpn-iptables.service
  423. fi
  424. # If SELinux is enabled and a custom port was selected, we need this
  425. if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
  426. # Install semanage if not already present
  427. if ! hash semanage 2>/dev/null; then
  428. if [[ "$os_version" -eq 7 ]]; then
  429. # Centos 7
  430. yum install -y policycoreutils-python
  431. else
  432. # CentOS 8 or Fedora
  433. dnf install -y policycoreutils-python-utils
  434. fi
  435. fi
  436. semanage port -a -t openvpn_port_t -p "$protocol" "$port"
  437. fi
  438. # If the server is behind NAT, use the correct IP address
  439. [[ -n "$public_ip" ]] && ip="$public_ip"
  440. # client-common.txt is created so we have a template to add further users later
  441. echo "client
  442. dev tun
  443. proto $protocol
  444. remote $ip $port
  445. resolv-retry infinite
  446. nobind
  447. persist-key
  448. persist-tun
  449. remote-cert-tls server
  450. auth SHA512
  451. cipher AES-256-CBC
  452. ignore-unknown-option block-outside-dns
  453. block-outside-dns
  454. verb 3" > /etc/openvpn/server/client-common.txt
  455. # Enable and start the OpenVPN service
  456. systemctl enable --now openvpn-server@server.service
  457. # Generates the custom client.ovpn
  458. new_client
  459. echo
  460. echo "Finished!"
  461. echo
  462. echo "The Client Configuration Is Available In:" ~/"$client.ovpn"
  463. echo "New Clients Can Be Added By Running This Script Again."
  464. else
  465. clear
  466. echo "OpenVPN Is Already Installed."
  467. echo
  468. echo "Select An Option:"
  469. echo " 1) Add a new client"
  470. echo " 2) Revoke an existing client"
  471. echo " 3) Remove OpenVPN"
  472. echo " 4) Exit"
  473. read -p "Option: " option
  474. until [[ "$option" =~ ^[1-4]$ ]]; do
  475. echo "$option: Invalid Selection."
  476. read -p "Option: " option
  477. done
  478. case "$option" in
  479. 1)
  480. echo
  481. echo "Provide A Name For The Client:"
  482. read -p "Name: " unsanitized_client
  483. client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
  484. while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
  485. echo "$client: invalid name."
  486. read -p "Name: " unsanitized_client
  487. client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
  488. done
  489. cd /etc/openvpn/server/easy-rsa/
  490. EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
  491. # Generates the custom client.ovpn
  492. new_client
  493. echo
  494. echo "$client added. Configuration available in:" ~/"$client.ovpn"
  495. exit
  496. ;;
  497. 2)
  498. # This option could be documented a bit better and maybe even be simplified
  499. # ...but what can I say, I want some sleep too
  500. number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
  501. if [[ "$number_of_clients" = 0 ]]; then
  502. echo
  503. echo "There Are No Existing Clients!"
  504. exit
  505. fi
  506. echo
  507. echo "Select The Client To Revoke:"
  508. tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
  509. read -p "Client: " client_number
  510. until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
  511. echo "$client_number: Invalid Selection."
  512. read -p "Client: " client_number
  513. done
  514. client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
  515. echo
  516. read -p "Confirm $Client Revocation? [y/N]: " revoke
  517. until [[ "$Revoke" =~ ^[yYnN]*$ ]]; do
  518. echo "$Revoke: Invalid Selection."
  519. read -p "Confirm $client revocation? [y/N]: " revoke
  520. done
  521. if [[ "$revoke" =~ ^[yY]$ ]]; then
  522. cd /etc/openvpn/server/easy-rsa/
  523. ./easyrsa --batch revoke "$client"
  524. EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
  525. rm -f /etc/openvpn/server/crl.pem
  526. cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
  527. # CRL is read with each client connection, when OpenVPN is dropped to nobody
  528. chown nobody:"$group_name" /etc/openvpn/server/crl.pem
  529. echo
  530. echo "$Client Revoked!"
  531. else
  532. echo
  533. echo "$Client Revocation Aborted!"
  534. fi
  535. exit
  536. ;;
  537. 3)
  538. echo
  539. read -p "Confirm OpenVPN Removal? [y/N]: " remove
  540. until [[ "$Remove" =~ ^[yYnN]*$ ]]; do
  541. echo "$Remove: Invalid Selection."
  542. read -p "Confirm OpenVPN Removal? [y/N]: " remove
  543. done
  544. if [[ "$remove" =~ ^[yY]$ ]]; then
  545. port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
  546. protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
  547. if systemctl is-active --quiet firewalld.service; then
  548. ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
  549. # Using both permanent and not permanent rules to avoid a firewalld reload.
  550. firewall-cmd --remove-port="$port"/"$protocol"
  551. firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
  552. firewall-cmd --permanent --remove-port="$port"/"$protocol"
  553. firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
  554. firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
  555. firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
  556. if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
  557. ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
  558. firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
  559. firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
  560. firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
  561. firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
  562. fi
  563. else
  564. systemctl disable --now openvpn-iptables.service
  565. rm -f /etc/systemd/system/openvpn-iptables.service
  566. fi
  567. if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
  568. semanage port -d -t openvpn_port_t -p "$protocol" "$port"
  569. fi
  570. systemctl disable --now openvpn-server@server.service
  571. rm -rf /etc/openvpn/server
  572. rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
  573. rm -f /etc/sysctl.d/30-openvpn-forward.conf
  574. if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
  575. apt-get remove --purge -y openvpn
  576. else
  577. # Else, OS must be CentOS or Fedora
  578. yum remove -y openvpn
  579. fi
  580. echo
  581. echo "OpenVPN Removed!"
  582. else
  583. echo
  584. echo "OpenVPN Removal Aborted!"
  585. fi
  586. exit
  587. ;;
  588. 4)
  589. exit
  590. ;;
  591. esac
  592. fi
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!