mirror/openvpn-install
1
0
Fork 0
mirror of https://github.com/Nyr/openvpn-install.git synced 2025-02-17 14:03:13 +03:00
Code Issues Projects Releases Wiki Activity

Buggy Stunnel

Browse Source
This commit is contained in:
Birkhoff 2018-07-11 01:18:45 -04:00
parent 4ce8bbc91b
commit bb6f9ecd78
No known key found for this signature in database
GPG Key ID: DAF5C86509D5C898
1 changed files with 63 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

81
openvpn-install.sh
View File

@ -61,7 +61,7 @@ if [[ -e /etc/openvpn/server.conf ]]; then
echo " 4) Exit" echo " 4) Exit"
read -p "Select an option [1-4]: " option read -p "Select an option [1-4]: " option
case $option in case $option in
1) 1)
echo echo
echo "Tell me a name for the client certificate." echo "Tell me a name for the client certificate."
echo "Please, use one word only, no special characters." echo "Please, use one word only, no special characters."
@ -72,6 +72,7 @@ if [[ -e /etc/openvpn/server.conf ]]; then
newclient "$CLIENT" newclient "$CLIENT"
echo echo
echo "Client $CLIENT added, configuration is available at:" ~/"$CLIENT.ovpn" echo "Client $CLIENT added, configuration is available at:" ~/"$CLIENT.ovpn"
echo "and ~/client.ssl. Install stunnel4 on client before you continue."
exit exit
;; ;;
2) 2)
@ -113,7 +114,7 @@ if [[ -e /etc/openvpn/server.conf ]]; then
fi fi
exit exit
;; ;;
3) 3)
echo echo
read -p "Do you really want to remove OpenVPN? [y/N]: " -e REMOVE read -p "Do you really want to remove OpenVPN? [y/N]: " -e REMOVE
if [[ "$REMOVE" = 'y' || "$REMOVE" = 'Y' ]]; then if [[ "$REMOVE" = 'y' || "$REMOVE" = 'Y' ]]; then
@ -185,23 +186,29 @@ else
echo "Which protocol do you want for OpenVPN connections?" echo "Which protocol do you want for OpenVPN connections?"
echo " 1) UDP (recommended)" echo " 1) UDP (recommended)"
echo " 2) TCP" echo " 2) TCP"
read -p "Protocol [1-2]: " -e -i 1 PROTOCOL echo " 3) TCP with OpenVPN over SSL"
case $PROTOCOL in read -p "Protocol [1-3]: " -e -i 1 PROTOCOLCHOICE
1) case $PROTOCOLCHOICE in
1)
PROTOCOL=udp PROTOCOL=udp
SSL=0
;; ;;
2) 2)
PROTOCOL=tcp PROTOCOL=tcp
SSL=0
;; ;;
3)
PROTOCOL=tcp
SSL=1
esac esac
echo echo
echo "What port do you want OpenVPN listening to?" echo "What port do you want OpenVPN listening to?"
read -p "Port: " -e -i 1194 PORT read -p "Port: " -e -i 443 PORT
echo echo
echo "Which cipher mode do you want to use?" echo "Which cipher mode do you want to use?"
echo " 1) AES-256-GCM (provides authenticated encryption)" echo " 1) AES-256-GCM (provides authenticated encryption)"
echo " 2) AES-256-CBC (compatible with versions of OpenVPN older than 2.4)" echo " 2) AES-256-CBC (compatible with versions of OpenVPN older than 2.4)"
read -p "Cipher Mode [1-2]" -e -i 1 CIPHERCHOICE read -p "Cipher Mode [1-2]: " -e -i 1 CIPHERCHOICE
case $CIPHERCHOICE in case $CIPHERCHOICE in
1) 1)
CIPHER=AES-256-GCM CIPHER=AES-256-GCM
@ -228,11 +235,11 @@ else
read -n1 -r -p "Press any key to continue..." read -n1 -r -p "Press any key to continue..."
if [[ "$OS" = 'debian' ]]; then if [[ "$OS" = 'debian' ]]; then
apt-get update apt-get update
apt-get install openvpn iptables openssl ca-certificates -y apt-get install openvpn iptables openssl ca-certificates stunnel4 -y
else else
# Else, the distro is CentOS # Else, the distro is CentOS
yum install epel-release -y yum install epel-release -y
yum install openvpn iptables openssl ca-certificates -y yum install openvpn iptables openssl ca-certificates stunnel4 -y
fi fi
# Get easy-rsa # Get easy-rsa
EASYRSAURL='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.4/EasyRSA-3.0.4.tgz' EASYRSAURL='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.4/EasyRSA-3.0.4.tgz'
@ -257,8 +264,29 @@ else
# Generate key for tls-auth # Generate key for tls-auth
openvpn --genkey --secret /etc/openvpn/ta.key openvpn --genkey --secret /etc/openvpn/ta.key
# Generate server.conf # Generate server.conf
echo "port $PORT if [[ $SSL==1 ]]; then
proto $PROTOCOL echo "port 1194" > /etc/openvpn/server.conf
echo "sslVersion = all
options = NO_SSLv2
chroot = /var/lib/stunnel4/
pid = /stunnel4.pid
debug = 0
output = /dev/null
setuid = root
setgid = root
socket = l:TCP_NODELAY=1
socket = r:TCP_NODELAY=1
compression = zlib
[openvpn]
accept = 0.0.0.0:$PORT
connect = 127.0.0.1:1194
cert=/etc/openvpn/server.crt
key=/etc/openvpn/server.key" > /etc/stunnel/stunnel.conf
else
echo "port $PORT" > /etc/openvpn/server.conf
fi
echo "proto $PROTOCOL
dev tun dev tun
sndbuf 0 sndbuf 0
rcvbuf 0 rcvbuf 0
@ -270,7 +298,7 @@ auth SHA512
tls-auth ta.key 0 tls-auth ta.key 0
topology subnet topology subnet
server 10.8.0.0 255.255.255.0 server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt" > /etc/openvpn/server.conf ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf
echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server.conf echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server.conf
# DNS # DNS
case $DNS in case $DNS in
@ -386,9 +414,13 @@ exit 0' > $RCLOCAL
dev tun dev tun
proto $PROTOCOL proto $PROTOCOL
sndbuf 0 sndbuf 0
rcvbuf 0 rcvbuf 0" > /etc/openvpn/client-common.txt
remote $IP $PORT if [[ $SSL=1 ]]; then
resolv-retry infinite echo "remote 127.0.0.1 1194" >> /etc/openvpn/client-common.txt
else
echo "remote $IP $PORT" >> /etc/openvpn/client-common.txt
fi
echo "resolv-retry infinite
nobind nobind
persist-key persist-key
persist-tun persist-tun
@ -399,12 +431,25 @@ comp-lzo
setenv opt block-outside-dns setenv opt block-outside-dns
key-direction 1 key-direction 1
reneg-sec $RENEGKEY reneg-sec $RENEGKEY
verb 3" > /etc/openvpn/client-common.txt verb 3" >> /etc/openvpn/client-common.txt
echo "client = yes
debug = 6
[openvpn]
accept = 127.0.0.1:1194
connect = $IP:$PORT
TIMEOUTclose = 0
verify = 3
CAfile = stunnel.crt" > /etc/openvpn/client.ssl
cp /etc/openvpn/client.ssl $HOME/
# Generates the custom client.ovpn # Generates the custom client.ovpn
newclient "$CLIENT" newclient "$CLIENT"
echo echo
echo "Finished!" echo "Finished!"
echo echo
echo "Your client configuration is available at:" ~/"$CLIENT.ovpn" echo "Your client configuration is available at: ~/$CLIENT.ovpn"
if [[ $SSL=1 ]]; then
echo "and ~/client.ssl. Install stunnel4 on client before you continue."
fi
echo "If you want to add more clients, you simply need to run this script again!" echo "If you want to add more clients, you simply need to run this script again!"
fi fi