openvpn
This commit is contained in:
bedefaced
parent
070d8a305b
commit
7cdd35b28f
25
openvpn/dns.sh
Executable file
25
openvpn/dns.sh
Executable file
@ -0,0 +1,25 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
|
||||||
|
source $DIR/env.sh
|
||||||
|
|
||||||
|
if [[ ! -e $OPENVPNCONFIG ]] || [[ ! -r $OPENVPNCONFIG ]] || [[ ! -w $OPENVPNCONFIG ]]; then
|
||||||
|
echo "$PPPCONFIG is not exist or not accessible (are you root?)"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
DEFAULTDNS1="8.8.8.8"
|
||||||
|
DEFAULTDNS2="8.8.4.4"
|
||||||
|
|
||||||
|
read -p "Preffered DNS resolver #1: " -e -i $DEFAULTDNS1 DNS1
|
||||||
|
: ${DNS1:=$DEFAULTDNS1}
|
||||||
|
|
||||||
|
read -p "Preffered DNS resolver #2: " -e -i $DEFAULTDNS2 DNS2
|
||||||
|
: ${DNS2:=$DEFAULTDNS2}
|
||||||
|
|
||||||
|
sed -i -e "/dhcp-option DNS/d" $OPENVPNCONFIG
|
||||||
|
|
||||||
|
echo "push \"dhcp-option DNS $DNS1\"" >> $OPENVPNCONFIG
|
||||||
|
echo "push \"dhcp-option DNS $DNS2\"" >> $OPENVPNCONFIG
|
||||||
|
|
||||||
|
echo "$OPENVPNCONFIG updated!"
|
||||||
20
openvpn/env.sh
Executable file
20
openvpn/env.sh
Executable file
@ -0,0 +1,20 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
SYSCTLCONFIG=/etc/sysctl.conf
|
||||||
|
OPENVPNDIR=/etc/openvpn
|
||||||
|
OPENVPNCONFIG=$OPENVPNDIR/openvpn-server.conf
|
||||||
|
CADIR=$OPENVPNDIR/easy-rsa
|
||||||
|
IPTABLES=/etc/iptables.rules
|
||||||
|
RCLOCAL=/etc/rc.local
|
||||||
|
NOBODYGROUP=nogroup
|
||||||
|
|
||||||
|
LOCALPREFIX="172.20"
|
||||||
|
LOCALIP="$LOCALPREFIX.0.0"
|
||||||
|
LOCALMASK="/24"
|
||||||
|
|
||||||
|
LOCALIPMASK="$LOCALIP$LOCALMASK"
|
||||||
|
|
||||||
|
IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
|
||||||
|
if [[ "$IP" = "" ]]; then
|
||||||
|
IP=$(wget -4qO- "http://whatismyip.akamai.com/")
|
||||||
|
fi
|
||||||
137
openvpn/install.sh
Executable file
137
openvpn/install.sh
Executable file
@ -0,0 +1,137 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
STARTDIR=$(pwd)
|
||||||
|
|
||||||
|
DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
|
||||||
|
source $DIR/env.sh
|
||||||
|
|
||||||
|
if [[ "$EUID" -ne 0 ]]; then
|
||||||
|
echo "Sorry, you need to run this as root"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "Installing OpenVPN..."
|
||||||
|
apt-get install openvpn easy-rsa
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "Configuring routing..."
|
||||||
|
$DIR/sysctl.sh
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "Installing configuration files..."
|
||||||
|
yes | cp -rf $DIR/openvpn-server.conf.dist $OPENVPNCONFIG
|
||||||
|
|
||||||
|
sed -i -e "s@CADIR@$CADIR@g" $OPENVPNCONFIG
|
||||||
|
sed -i -e "s@LOCALPREFIX@$LOCALPREFIX@g" $OPENVPNCONFIG
|
||||||
|
sed -i -e "s@NOBODYGROUP@$NOBODYGROUP@g" $OPENVPNCONFIG
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "Configuring iptables firewall..."
|
||||||
|
$DIR/iptables-setup.sh
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "Do you want to create routing or bridging OpenVPN mode? "
|
||||||
|
echo "More information at: https://community.openvpn.net/openvpn/wiki/309-what-is-the-difference-between-bridging-and-routing"
|
||||||
|
echo " 1) routing"
|
||||||
|
echo " 2) bridging"
|
||||||
|
echo
|
||||||
|
read -p "Your choice [1 or 2]: " -e -i 1 MODE
|
||||||
|
case $MODE in
|
||||||
|
1)
|
||||||
|
DEVICE="tun"
|
||||||
|
sed -i -e "s/DEVICE/tun/g" $OPENVPNCONFIG
|
||||||
|
sed -i -e "/server-bridge/d" $OPENVPNCONFIG
|
||||||
|
;;
|
||||||
|
2)
|
||||||
|
DEVICE="tap"
|
||||||
|
sed -i -e "s/DEVICE/tap/g" $OPENVPNCONFIG
|
||||||
|
sed -i -e "/server /d" $OPENVPNCONFIG
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
echo "Hm... Strange answer..."
|
||||||
|
exit
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "Configuring DNS parameters..."
|
||||||
|
$DIR/dns.sh
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "Creating server keys..."
|
||||||
|
make-cadir $CADIR
|
||||||
|
cd $CADIR
|
||||||
|
source ./vars
|
||||||
|
./clean-all
|
||||||
|
./build-ca
|
||||||
|
./build-key-server --batch openvpn-server
|
||||||
|
./build-dh
|
||||||
|
openvpn --genkey --secret ta.key
|
||||||
|
|
||||||
|
ADDUSER="no"
|
||||||
|
ANSUSER="yes"
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "Configuring VPN users..."
|
||||||
|
while [ "$ANSUSER" != "$ADDUSER" ];
|
||||||
|
do
|
||||||
|
while [[ -z "$LOGIN" ]];
|
||||||
|
do
|
||||||
|
read -p "Enter name: " LOGIN
|
||||||
|
done
|
||||||
|
|
||||||
|
./build-key --batch $LOGIN
|
||||||
|
|
||||||
|
if [ $? -eq 0 ]; then
|
||||||
|
|
||||||
|
# copy files and OVPN config
|
||||||
|
mkdir "$STARTDIR/$LOGIN"
|
||||||
|
cp $CADIR/keys/ca.crt $CADIR/keys/$LOGIN.key $CADIR/keys/$LOGIN.crt ta.key "$STARTDIR/$LOGIN/"
|
||||||
|
|
||||||
|
DIST="$STARTDIR/$LOGIN/openvpn-server.ovpn"
|
||||||
|
cp $DIR/openvpn-server.ovpn.dist $DIST
|
||||||
|
sed -i -e "s@LOGIN@$LOGIN@g" $DIST
|
||||||
|
sed -i -e "s@IP@$IP@g" $DIST
|
||||||
|
sed -i -e "s@DEVICE@$DEVICE@g" $DIST
|
||||||
|
|
||||||
|
SRC="$STARTDIR/$LOGIN"
|
||||||
|
DIST="$STARTDIR/$LOGIN/openvpn-server-embedded.ovpn"
|
||||||
|
cp $DIR/openvpn-server-embedded.ovpn.dist $DIST
|
||||||
|
sed -i -e "s@IP@$IP@g" $DIST
|
||||||
|
sed -i -e "s@DEVICE@$DEVICE@g" $DIST
|
||||||
|
|
||||||
|
echo "<ca>" >> $DIST
|
||||||
|
cat $SRC/ca.crt >> $DIST
|
||||||
|
echo "</ca>" >> $DIST
|
||||||
|
|
||||||
|
echo "<cert>" >> $DIST
|
||||||
|
cat $SRC/$LOGIN.crt >> $DIST
|
||||||
|
echo "</cert>" >> $DIST
|
||||||
|
|
||||||
|
echo "<key>" >> $DIST
|
||||||
|
cat $SRC/$LOGIN.key >> $DIST
|
||||||
|
echo "</key>" >> $DIST
|
||||||
|
|
||||||
|
echo "<tls-auth>" >> $DIST
|
||||||
|
cat $SRC/ta.key >> $DIST
|
||||||
|
echo "</tls-auth>" >> $DIST
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "Created directory $STARTDIR/$LOGIN with necessary files."
|
||||||
|
chown -R ${USER:=$(/usr/bin/id -run)}:$USER $STARTDIR/$LOGIN/
|
||||||
|
|
||||||
|
fi
|
||||||
|
|
||||||
|
read -p "Would you want add another user? [no] " ANSUSER
|
||||||
|
: ${ANSUSER:=$ADDUSER}
|
||||||
|
done
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "Starting OpenVPN..."
|
||||||
|
systemctl enable openvpn
|
||||||
|
service openvpn restart
|
||||||
|
|
||||||
|
echo
|
||||||
|
echo "Installation script completed!"
|
||||||
|
|
||||||
88
openvpn/iptables-setup.sh
Executable file
88
openvpn/iptables-setup.sh
Executable file
@ -0,0 +1,88 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
||||||
|
source $DIR/env.sh
|
||||||
|
|
||||||
|
if [[ ! -e $IPTABLES ]]; then
|
||||||
|
touch $IPTABLES
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ! -e $IPTABLES ]] || [[ ! -r $IPTABLES ]] || [[ ! -w $IPTABLES ]]; then
|
||||||
|
echo "$IPTABLES is not exist or not accessible (are you root?)"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# backup and remove rules with $LOCALIP
|
||||||
|
iptables-save > $IPTABLES.backup
|
||||||
|
|
||||||
|
IFS=$'\n'
|
||||||
|
|
||||||
|
iptablesclear=$(iptables -S -t nat | sed -n -e '/$LOCALPREFIX/p' | sed -e 's/-A/-D/g')
|
||||||
|
for line in $iptablesclear
|
||||||
|
do
|
||||||
|
cmd="iptables -t nat $line"
|
||||||
|
eval $cmd
|
||||||
|
done
|
||||||
|
|
||||||
|
# detect default gateway interface
|
||||||
|
echo "Found next network interfaces:"
|
||||||
|
ifconfig -a | sed 's/[ \t].*//;/^\(lo\|\)$/d'
|
||||||
|
echo
|
||||||
|
GATE=$(route | grep '^default' | grep -o '[^ ]*$')
|
||||||
|
read -p "Enter your external network interface: " -i $GATE -e GATE
|
||||||
|
|
||||||
|
STATIC="yes"
|
||||||
|
read -p "Your external IP is $IP. Is this IP static? [yes] " ANSIP
|
||||||
|
: ${ANSIP:=$STATIC}
|
||||||
|
|
||||||
|
if [ "$STATIC" == "$ANSIP" ]; then
|
||||||
|
# SNAT
|
||||||
|
sed -i -e "s@PUBLICIP@$IP@g" $OPENVPNCONFIG
|
||||||
|
iptables -t nat -A POSTROUTING -s $LOCALIPMASK -o $GATE -j SNAT --to-source $IP
|
||||||
|
else
|
||||||
|
# MASQUERADE
|
||||||
|
sed -i -e "/PUBLICIP/d" $OPENVPNCONFIG
|
||||||
|
iptables -t nat -A POSTROUTING -o $GATE -j MASQUERADE
|
||||||
|
fi
|
||||||
|
|
||||||
|
DROP="yes"
|
||||||
|
read -p "Would you want to disable client-to-client routing? [yes] " ANSDROP
|
||||||
|
: ${ANSDROP:=$DROP}
|
||||||
|
|
||||||
|
if [ "$DROP" == "$ANSDROP" ]; then
|
||||||
|
# disable forwarding
|
||||||
|
sed -i -e "/client-to-client/d" $OPENVPNCONFIG
|
||||||
|
iptables -I FORWARD -s $LOCALIPMASK -d $LOCALIPMASK -j DROP
|
||||||
|
iptables -A FORWARD -i tun+ -o tun+ -j DROP
|
||||||
|
iptables -A FORWARD -i tap+ -o tap+ -j DROP
|
||||||
|
else
|
||||||
|
echo "Deleting DROP rules if exists..."
|
||||||
|
iptables -D FORWARD -s $LOCALIPMASK -d $LOCALIPMASK -j DROP
|
||||||
|
iptables -D FORWARD -i tap+ -o tap+ -j DROP
|
||||||
|
iptables -D FORWARD -i tun+ -o tun+ -j DROP
|
||||||
|
fi
|
||||||
|
|
||||||
|
# MSS Clamping
|
||||||
|
iptables -t mangle -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
|
||||||
|
|
||||||
|
# TUN/TAP
|
||||||
|
iptables -A INPUT -i tun+ -j ACCEPT
|
||||||
|
iptables -A INPUT -i tap+ -j ACCEPT
|
||||||
|
iptables -A OUTPUT -o tun+ -j ACCEPT
|
||||||
|
iptables -A OUTPUT -o tap+ -j ACCEPT
|
||||||
|
|
||||||
|
# OpenVPN
|
||||||
|
iptables -A INPUT -p udp --dport 1194 -j ACCEPT
|
||||||
|
|
||||||
|
iptables-save | awk '($0 !~ /^-A/)||!($0 in a) {a[$0];print}' > $IPTABLES
|
||||||
|
|
||||||
|
RESTORPRESENTS=$(grep iptables-restore $RCLOCAL)
|
||||||
|
if [ $? -ne 0 ]; then
|
||||||
|
sed -i -e "/exit 0/d" $RCLOCAL
|
||||||
|
echo "iptables-restore < $IPTABLES" >> $RCLOCAL
|
||||||
|
echo "exit 0" >> $RCLOCAL
|
||||||
|
fi
|
||||||
|
|
||||||
|
iptables -F
|
||||||
|
iptables-restore < $IPTABLES
|
||||||
|
|
||||||
12
openvpn/openvpn-server-embedded.ovpn.dist
Normal file
12
openvpn/openvpn-server-embedded.ovpn.dist
Normal file
@ -0,0 +1,12 @@
|
|||||||
|
client
|
||||||
|
dev DEVICE
|
||||||
|
persist-key
|
||||||
|
persist-tun
|
||||||
|
tls-client
|
||||||
|
cipher DES-EDE3-CBC
|
||||||
|
remote IP
|
||||||
|
port 1194
|
||||||
|
proto udp
|
||||||
|
resolv-retry infinite
|
||||||
|
redirect-gateway
|
||||||
|
key-direction 1
|
||||||
25
openvpn/openvpn-server.conf.dist
Normal file
25
openvpn/openvpn-server.conf.dist
Normal file
@ -0,0 +1,25 @@
|
|||||||
|
mode server
|
||||||
|
port 1194
|
||||||
|
proto udp
|
||||||
|
dev DEVICE
|
||||||
|
ca CADIR/keys/ca.crt
|
||||||
|
cert CADIR/keys/openvpn-server.crt
|
||||||
|
key CADIR/keys/openvpn-server.key
|
||||||
|
dh CADIR/keys/dh2048.pem
|
||||||
|
tls-server
|
||||||
|
tls-auth CADIR/ta.key 0
|
||||||
|
server LOCALPREFIX.0.0 255.255.255.0
|
||||||
|
server-bridge LOCALPREFIX.0.1 255.255.255.0 LOCALPREFIX.0.10 LOCALPREFIX.0.100
|
||||||
|
local PUBLICIP
|
||||||
|
client-to-client
|
||||||
|
cipher DES-EDE3-CBC
|
||||||
|
user nobody
|
||||||
|
group NOBODYGROUP
|
||||||
|
max-clients 100
|
||||||
|
keepalive 10 120
|
||||||
|
persist-key
|
||||||
|
persist-tun
|
||||||
|
push "route-gateway dhcp"
|
||||||
|
push "redirect-gateway def1 bypass-dhcp"
|
||||||
|
push "dhcp-option DNS 8.8.8.8"
|
||||||
|
push "dhcp-option DNS 8.8.4.4"
|
||||||
16
openvpn/openvpn-server.ovpn.dist
Normal file
16
openvpn/openvpn-server.ovpn.dist
Normal file
@ -0,0 +1,16 @@
|
|||||||
|
client
|
||||||
|
dev DEVICE
|
||||||
|
persist-key
|
||||||
|
persist-tun
|
||||||
|
cipher DES-EDE3-CBC
|
||||||
|
remote IP
|
||||||
|
port 1194
|
||||||
|
proto udp
|
||||||
|
resolv-retry infinite
|
||||||
|
redirect-gateway
|
||||||
|
tls-client
|
||||||
|
tls-auth ta.key 1
|
||||||
|
ca ca.crt
|
||||||
|
cert LOGIN.crt
|
||||||
|
key LOGIN.key
|
||||||
|
|
||||||
33
openvpn/sysctl.sh
Executable file
33
openvpn/sysctl.sh
Executable file
@ -0,0 +1,33 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
|
||||||
|
DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )
|
||||||
|
source $DIR/env.sh
|
||||||
|
|
||||||
|
if [[ ! -e $SYSCTLCONFIG ]] || [[ ! -r $SYSCTLCONFIG ]] || [[ ! -w $SYSCTLCONFIG ]]; then
|
||||||
|
echo "$SYSCTLCONFIG is not exist or not accessible (are you root?)"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.ip_forward/d" $SYSCTLCONFIG
|
||||||
|
echo "net.ipv4.ip_forward=1" >> $SYSCTLCONFIG
|
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.conf.all.accept_redirects/d" $SYSCTLCONFIG
|
||||||
|
echo "net.ipv4.conf.all.accept_redirects=0" >> $SYSCTLCONFIG
|
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.conf.all.send_redirects/d" $SYSCTLCONFIG
|
||||||
|
echo "net.ipv4.conf.all.send_redirects=0" >> $SYSCTLCONFIG
|
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.conf.default.rp_filter/d" $SYSCTLCONFIG
|
||||||
|
echo "net.ipv4.conf.default.rp_filter=0" >> $SYSCTLCONFIG
|
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.conf.default.accept_source_route/d" $SYSCTLCONFIG
|
||||||
|
echo "net.ipv4.conf.default.accept_source_route=0" >> $SYSCTLCONFIG
|
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.conf.default.send_redirects/d" $SYSCTLCONFIG
|
||||||
|
echo "net.ipv4.conf.default.send_redirects=0" >> $SYSCTLCONFIG
|
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.icmp_ignore_bogus_error_responses/d" $SYSCTLCONFIG
|
||||||
|
echo "net.ipv4.icmp_ignore_bogus_error_responses=1" >> $SYSCTLCONFIG
|
||||||
|
|
||||||
|
sysctl -p
|
||||||
|
service procps restart
|
||||||
Loading…
x
Reference in New Issue
Block a user