mirror of
https://github.com/Nyr/openvpn-install.git
synced 2024-11-23 21:46:08 +03:00
Customizable OpenVPN network.
This commit is contained in:
dmcallejo
parent
6e21afcdda
commit
ae9b3808cf
@ -123,25 +123,26 @@ if [[ -e /etc/openvpn/server.conf ]]; then
|
||||
if [[ "$REMOVE" = 'y' || "$REMOVE" = 'Y' ]]; then
|
||||
PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2)
|
||||
PROTOCOL=$(grep '^proto ' /etc/openvpn/server.conf | cut -d " " -f 2)
|
||||
NETWORK=$(grep '^server ' /etc/openvpn/server.conf | cut -d " " -f 2)
|
||||
if pgrep firewalld; then
|
||||
IP=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24 -j SNAT --to ' | cut -d " " -f 10)
|
||||
IP=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s '$NETWORK'/24 '"'"'!'"'"' -d '$NETWORK'/24 -j SNAT --to ' | cut -d " " -f 10)
|
||||
# Using both permanent and not permanent rules to avoid a firewalld reload.
|
||||
firewall-cmd --zone=public --remove-port=$PORT/$PROTOCOL
|
||||
firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
|
||||
firewall-cmd --zone=trusted --remove-source=$NETWORK/24
|
||||
firewall-cmd --permanent --zone=public --remove-port=$PORT/$PROTOCOL
|
||||
firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
|
||||
firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP
|
||||
firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP
|
||||
firewall-cmd --permanent --zone=trusted --remove-source=$NETWORK/24
|
||||
firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s $NETWORK/24 ! -d $NETWORK/24 -j SNAT --to $IP
|
||||
firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s $NETWORK/24 ! -d $NETWORK/24 -j SNAT --to $IP
|
||||
else
|
||||
IP=$(grep 'iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to ' $RCLOCAL | cut -d " " -f 14)
|
||||
iptables -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP
|
||||
sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 ! -d 10.8.0.0\/24 -j SNAT --to /d' $RCLOCAL
|
||||
IP=$(grep 'iptables -t nat -A POSTROUTING -s '$NETWORK'/24 ! -d '$NETWORK'/24 -j SNAT --to ' $RCLOCAL | cut -d " " -f 14)
|
||||
iptables -t nat -D POSTROUTING -s $NETWORK/24 ! -d $NETWORK/24 -j SNAT --to $IP
|
||||
sed -i '/iptables -t nat -A POSTROUTING -s '$NETWORK'\/24 ! -d '$NETWORK'\/24 -j SNAT --to /d' $RCLOCAL
|
||||
if iptables -L -n | grep -qE '^ACCEPT'; then
|
||||
iptables -D INPUT -p $PROTOCOL --dport $PORT -j ACCEPT
|
||||
iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT
|
||||
iptables -D FORWARD -s $NETWORK/24 -j ACCEPT
|
||||
iptables -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
sed -i "/iptables -I INPUT -p $PROTOCOL --dport $PORT -j ACCEPT/d" $RCLOCAL
|
||||
sed -i "/iptables -I FORWARD -s 10.8.0.0\/24 -j ACCEPT/d" $RCLOCAL
|
||||
sed -i "/iptables -I FORWARD -s $NETWORK\/24 -j ACCEPT/d" $RCLOCAL
|
||||
sed -i "/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT/d" $RCLOCAL
|
||||
fi
|
||||
fi
|
||||
@ -179,7 +180,7 @@ else
|
||||
# Autodetect IP address and pre-fill for the user
|
||||
IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
|
||||
read -p "IP address: " -e -i $IP IP
|
||||
# If $IP is a private IP address, the server must be behind NAT
|
||||
# If $IP is a private IP address, the server must be behind NAT
|
||||
if echo "$IP" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
|
||||
echo
|
||||
echo "This server is behind NAT. What is the public IPv4 address or hostname?"
|
||||
@ -202,6 +203,9 @@ else
|
||||
echo "What port do you want OpenVPN listening to?"
|
||||
read -p "Port: " -e -i 1194 PORT
|
||||
echo
|
||||
echo "What network do you want your OpenVPN to use?"
|
||||
read -p "Port: " -e -i 10.8.0.0 NETWORK
|
||||
echo
|
||||
echo "Which DNS do you want to use with the VPN?"
|
||||
echo " 1) Current system resolvers"
|
||||
echo " 2) 1.1.1.1"
|
||||
@ -259,7 +263,7 @@ dh dh.pem
|
||||
auth SHA512
|
||||
tls-auth ta.key 0
|
||||
topology subnet
|
||||
server 10.8.0.0 255.255.255.0
|
||||
server $NETWORK 255.255.255.0
|
||||
ifconfig-pool-persist ipp.txt" > /etc/openvpn/server.conf
|
||||
echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server.conf
|
||||
# DNS
|
||||
@ -313,12 +317,12 @@ crl-verify crl.pem" >> /etc/openvpn/server.conf
|
||||
# We don't use --add-service=openvpn because that would only work with
|
||||
# the default port and protocol.
|
||||
firewall-cmd --zone=public --add-port=$PORT/$PROTOCOL
|
||||
firewall-cmd --zone=trusted --add-source=10.8.0.0/24
|
||||
firewall-cmd --zone=trusted --add-source=$NETWORK/24
|
||||
firewall-cmd --permanent --zone=public --add-port=$PORT/$PROTOCOL
|
||||
firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
|
||||
firewall-cmd --permanent --zone=trusted --add-source=$NETWORK/24
|
||||
# Set NAT for the VPN subnet
|
||||
firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP
|
||||
firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP
|
||||
firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s $NETWORK/24 ! -d $NETWORK/24 -j SNAT --to $IP
|
||||
firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s $NETWORK/24 ! -d $NETWORK/24 -j SNAT --to $IP
|
||||
else
|
||||
# Needed to use rc.local with some systemd distros
|
||||
if [[ "$OS" = 'debian' && ! -e $RCLOCAL ]]; then
|
||||
@ -327,17 +331,17 @@ exit 0' > $RCLOCAL
|
||||
fi
|
||||
chmod +x $RCLOCAL
|
||||
# Set NAT for the VPN subnet
|
||||
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP
|
||||
sed -i "1 a\iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP" $RCLOCAL
|
||||
iptables -t nat -A POSTROUTING -s $NETWORK/24 ! -d $NETWORK/24 -j SNAT --to $IP
|
||||
sed -i "1 a\iptables -t nat -A POSTROUTING -s $NETWORK/24 ! -d $NETWORK/24 -j SNAT --to $IP" $RCLOCAL
|
||||
if iptables -L -n | grep -qE '^(REJECT|DROP)'; then
|
||||
# If iptables has at least one REJECT rule, we asume this is needed.
|
||||
# Not the best approach but I can't think of other and this shouldn't
|
||||
# cause problems.
|
||||
iptables -I INPUT -p $PROTOCOL --dport $PORT -j ACCEPT
|
||||
iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
|
||||
iptables -I FORWARD -s $NETWORK/24 -j ACCEPT
|
||||
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
sed -i "1 a\iptables -I INPUT -p $PROTOCOL --dport $PORT -j ACCEPT" $RCLOCAL
|
||||
sed -i "1 a\iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT" $RCLOCAL
|
||||
sed -i "1 a\iptables -I FORWARD -s $NETWORK/24 -j ACCEPT" $RCLOCAL
|
||||
sed -i "1 a\iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" $RCLOCAL
|
||||
fi
|
||||
fi
|
||||
@ -394,4 +398,4 @@ verb 3" > /etc/openvpn/client-common.txt
|
||||
echo
|
||||
echo "Your client configuration is available at:" ~/"$CLIENT.ovpn"
|
||||
echo "If you want to add more clients, you simply need to run this script again!"
|
||||
fi
|
||||
fi
|
||||
Loading…
Reference in New Issue
Block a user