mirror/openvpn-install
1
0
Fork 0
mirror of https://github.com/Nyr/openvpn-install.git synced 2025-02-26 01:53:13 +03:00
Code Issues Projects Releases Wiki Activity

add ca$IP.crt to client conf file

Browse Source
This commit is contained in:
Hoang Huynh 2014-02-27 23:20:53 +07:00
parent c3189eacb4
commit 101d1188b1
1 changed files with 18 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
openvpn-install.sh
View File

@ -1,17 +1,18 @@
#!/bin/bash
# OpenVPN road warrior installer for Debian-based distros
# This script will only work on Debian-based systems. It isn't bulletproof but
# it will probably work if you simply want to setup a VPN on your Debian/Ubuntu
# VPS. It has been designed to be as unobtrusive and universal as possible.
# TODO check for Debian-based distros
# Check for root
if [ $USER != 'root' ]; then
echo "Sorry, you need to run this as root"
exit
fi
# check for tun/tap
if [ ! -e /dev/net/tun ]; then
echo "TUN/TAP is not available, please enable it first (contact your provider if you don't know how)"
exit
@ -45,7 +46,7 @@ if [ -e /etc/openvpn/server.conf ]; then
echo ""
echo "Tell me a name for the client cert"
echo "Please, use one word only, no special characters"
read -p "Client name: " -e -i client CLIENT
read -p "Client name: " -e CLIENT
cd /etc/openvpn/easy-rsa/2.0/
source ./vars
# build-key for the client
@ -54,26 +55,28 @@ if [ -e /etc/openvpn/server.conf ]; then
"$EASY_RSA/pkitool" $CLIENT
# Let's generate the client config
mkdir ~/ovpn-$CLIENT
# add server IP to the file names to prevent duplication on client configs
cp /usr/share/doc/openvpn/examples/sample-config-files/client.conf ~/ovpn-$CLIENT/$CLIENT@$IP.conf
cp /etc/openvpn/easy-rsa/2.0/keys/ca.crt ~/ovpn-$CLIENT/ca@$IP.crt
cp /etc/openvpn/easy-rsa/2.0/keys/$CLIENT.crt ~/ovpn-$CLIENT/$CLIENT@$IP.crt
cp /etc/openvpn/easy-rsa/2.0/keys/$CLIENT.key ~/ovpn-$CLIENT/$CLIENT@$IP.key
cd ~/ovpn-$CLIENT
sed -i "s|ca ca.crt|ca ca@$IP.crt|" $CLIENT@$IP.conf
sed -i "s|cert client.crt|cert $CLIENT@$IP.crt|" $CLIENT@$IP.conf
sed -i "s|key client.key|key $CLIENT@$IP.key|" $CLIENT@$IP.conf
# this is the conf file for client's openvpn gui tool
# add an .ovpn file which is essentially the .conf file for client's openvpn gui tool
cp $CLIENT@$IP.conf $CLIENT@$IP.ovpn
tar -czf ../ovpn-$CLIENT.tar.gz $CLIENT@$IP.conf $CLIENT@$IP.ovpn ca@$IP.crt $CLIENT@$IP.crt $CLIENT@$IP.key
cd ~/
rm -rf ovpn-$CLIENT
echo ""
echo "Client $CLIENT added, certs available at ~/ovpn-$CLIENT.tar.gz"
echo "Client $CLIENT added, certs available at `pwd`/ovpn-$CLIENT.tar.gz"
exit
;;
2)
echo ""
echo "Tell me the existing client name"
read -p "Client name: " -e -i client CLIENT
read -p "Client name: " -e CLIENT
cd /etc/openvpn/easy-rsa/2.0/
. /etc/openvpn/easy-rsa/2.0/vars
. /etc/openvpn/easy-rsa/2.0/revoke-full $CLIENT
@ -93,7 +96,7 @@ if [ -e /etc/openvpn/server.conf ]; then
apt-get remove --purge -y openvpn openvpn-blacklist
rm -rf /etc/openvpn
rm -rf /usr/share/doc/openvpn
sed -i '/--dport 53 -j REDIRECT --to-port 1194/d' /etc/rc.local
sed -i '/--dport 53 -j REDIRECT --to-port/d' /etc/rc.local
sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0/d' /etc/rc.local
echo ""
echo "OpenVPN removed!"
@ -105,6 +108,10 @@ if [ -e /etc/openvpn/server.conf ]; then
else
echo 'Welcome to this quick OpenVPN "road warrior" installer'
echo ""
echo "This script will only work on Debian-based systems. It isn't bulletproof but"
echo "it will probably work if you simply want to setup a VPN on your Debian/Ubuntu"
echo "VPS. It has been designed to be as unobtrusive and universal as possible."
echo ""
# OpenVPN setup and first user creation
echo "I need to ask you a few questions before starting the setup"
echo "You can leave the default options and just press enter if you are ok with them"
@ -122,7 +129,7 @@ else
echo ""
echo "Finally, tell me your name for the client cert"
echo "Please, use one word only, no special characters"
read -p "Client name: " -e -i client CLIENT
read -p "Client name: " -e CLIENT
echo ""
echo "Okay, that was all I needed. We are ready to setup your OpenVPN server now"
read -n1 -r -p "Press any key to continue..."
@ -175,8 +182,8 @@ else
sed -i "s|port 1194|port $PORT|" server.conf
# Listen at port 53 too if user wants that
if [ $ALTPORT = 'y' ]; then
iptables -t nat -A PREROUTING -p udp -d $IP --dport 53 -j REDIRECT --to-port 1194
sed -i "/# By default this script does nothing./a\iptables -t nat -A PREROUTING -p udp -d $IP --dport 53 -j REDIRECT --to-port 1194" /etc/rc.local
iptables -t nat -A PREROUTING -p udp -d $IP --dport 53 -j REDIRECT --to-port $PORT
sed -i "/# By default this script does nothing./a\iptables -t nat -A PREROUTING -p udp -d $IP --dport 53 -j REDIRECT --to-port $PORT" /etc/rc.local
fi
# Enable net.ipv4.ip_forward for the system
sed -i 's|#net.ipv4.ip_forward=1|net.ipv4.ip_forward=1|' /etc/sysctl.conf