From c5b4907fd69929a1e87c0c0099528282cb42ae26 Mon Sep 17 00:00:00 2001 From: Nyr Date: Sun, 15 May 2016 19:22:32 +0200 Subject: [PATCH] Enable tls-auth --- openvpn-install.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/openvpn-install.sh b/openvpn-install.sh index 303cfd9..30f756e 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -53,6 +53,9 @@ newclient () { echo "" >> ~/$1.ovpn cat /etc/openvpn/easy-rsa/pki/private/$1.key >> ~/$1.ovpn echo "" >> ~/$1.ovpn + echo "" >> ~/$1.ovpn + cat /etc/openvpn/ta.key >> ~/$1.ovpn + echo "" >> ~/$1.ovpn } # Try to get our IP from the system and fallback to the Internet. @@ -221,6 +224,8 @@ else ./easyrsa gen-crl # Move the stuff we need cp pki/ca.crt pki/private/ca.key pki/dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn + # Generate key for tls-auth + openvpn --genkey --secret /etc/openvpn/ta.key # Generate server.conf echo "port $PORT proto udp @@ -231,6 +236,7 @@ ca ca.crt cert server.crt key server.key dh dh.pem +tls-auth ta.key 0 topology subnet server 10.8.0.0 255.255.255.0 ifconfig-pool-persist ipp.txt" > /etc/openvpn/server.conf @@ -362,6 +368,7 @@ persist-tun remote-cert-tls server comp-lzo setenv opt block-outside-dns +key-direction 1 verb 3" > /etc/openvpn/client-common.txt # Generates the custom client.ovpn newclient "$CLIENT"