From cfe1758b0bf2f8921829c4e1c145764cfad7e892 Mon Sep 17 00:00:00 2001 From: vik_y Date: Fri, 9 Sep 2016 21:08:50 +0530 Subject: [PATCH] Adds an option to enable internal networking on VPN --- openvpn-install.sh | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 7ca4bf2..1a40f3b 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -193,6 +193,9 @@ else echo " 6) Verisign" read -p "DNS [1-6]: " -e -i 1 DNS echo "" + echo "Do you want to enable internal networking between the hosts connected to your VPN?" + read -p "Yes(y)/No(n):" -e -i n NATOPTION + echo "" echo "Finally, tell me your name for the client cert" echo "Please, use one word only, no special characters" read -p "Client name: " -e -i client CLIENT @@ -293,8 +296,14 @@ crl-verify crl.pem" >> /etc/openvpn/server.conf # Avoid an unneeded reboot echo 1 > /proc/sys/net/ipv4/ip_forward # Set NAT for the VPN subnet - iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to $IP - sed -i "1 a\iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to $IP" $RCLOCAL + if [[ "$NATOPTION" == 'y' ]];then + # Allows internal networking amongst hosts connected to the VPN. + iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP + sed -i "1 a\iptables -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $IP" $RCLOCAL + else + iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to $IP + sed -i "1 a\iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to $IP" $RCLOCAL + fi if pgrep firewalld; then # We don't use --add-service=openvpn because that would only work with # the default port. Using both permanent and not permanent rules to