Bernhard.Linz/openvpn-install
1
0
Fork 0
mirror of https://github.com/angristan/openvpn-install.git synced 2025-03-14 22:53:14 +01:00
Code Issues Projects Releases Wiki Activity

one unbound config for all OS

Browse Source 
Fix for #602
Create new config as /etc/unbound/unbound.conf.d/openvpn.conf,
include this into /etc/unbound/unbound.conf.
On uninstall simple remove the include, if if was injected by openvpn-install.
This commit is contained in:
Henry N 2020-04-01 00:57:56 +02:00 committed by GitHub
parent 7ed9cac8d7
commit 148cbf93a9
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 19 additions and 51 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
openvpn-install.sh
View File

@ -103,34 +103,12 @@ function installUnbound () {
if [[ "$OS" =~ (debian|ubuntu) ]]; then if [[ "$OS" =~ (debian|ubuntu) ]]; then
apt-get install -y unbound apt-get install -y unbound
# Configuration
echo 'interface: 10.8.0.1
access-control: 10.8.0.1/24 allow
hide-identity: yes
hide-version: yes
use-caps-for-id: yes
prefetch: yes' >> /etc/unbound/unbound.conf
elif [[ "$OS" =~ (centos|amzn) ]]; then elif [[ "$OS" =~ (centos|amzn) ]]; then
yum install -y unbound yum install -y unbound
# Configuration
sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf
sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf
sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf
sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf
sed -i 's|use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf
elif [[ "$OS" = "fedora" ]]; then elif [[ "$OS" = "fedora" ]]; then
dnf install -y unbound dnf install -y unbound
# Configuration
sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf
sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf
sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf
sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf
sed -i 's|# use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf
elif [[ "$OS" = "arch" ]]; then elif [[ "$OS" = "arch" ]]; then
pacman -Syu --noconfirm unbound pacman -Syu --noconfirm unbound
@ -146,48 +124,38 @@ prefetch: yes' >> /etc/unbound/unbound.conf
directory: "/etc/unbound" directory: "/etc/unbound"
trust-anchor-file: trusted-key.key trust-anchor-file: trusted-key.key
root-hints: root.hints root-hints: root.hints
interface: 10.8.0.1
access-control: 10.8.0.1/24 allow
port: 53 port: 53
num-threads: 2 num-threads: 2
use-caps-for-id: yes
harden-glue: yes harden-glue: yes
hide-identity: yes qname-minimisation: yes' >/etc/unbound/unbound.conf
hide-version: yes
qname-minimisation: yes
prefetch: yes' > /etc/unbound/unbound.conf
fi fi
fi
if [[ ! "$OS" =~ (fedora|centos|amzn) ]];then # Add Unbound 'server' for the OpenVPN subnet
# DNS Rebinding fix mkdir -p /etc/unbound/unbound.conf.d
echo "private-address: 10.0.0.0/8 echo 'server:
private-address: 172.16.0.0/12
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: fd00::/8
private-address: fe80::/10
private-address: 127.0.0.0/8
private-address: ::ffff:0:0/96" >> /etc/unbound/unbound.conf
fi
else # Unbound is already installed
echo 'include: /etc/unbound/openvpn.conf' >> /etc/unbound/unbound.conf
# Add Unbound 'server' for the OpenVPN subnet
echo 'server:
interface: 10.8.0.1 interface: 10.8.0.1
access-control: 10.8.0.1/24 allow access-control: 10.8.0.1/24 allow
hide-identity: yes hide-identity: yes
hide-version: yes hide-version: yes
use-caps-for-id: yes use-caps-for-id: yes
prefetch: yes prefetch: yes' >/etc/unbound/unbound.conf.d/openvpn.conf
private-address: 10.0.0.0/8
if [[ ! "$OS" =~ (fedora|centos|amzn) ]];then
# DNS Rebinding fix
echo 'private-address: 10.0.0.0/8
private-address: 172.16.0.0/12 private-address: 172.16.0.0/12
private-address: 192.168.0.0/16 private-address: 192.168.0.0/16
private-address: 169.254.0.0/16 private-address: 169.254.0.0/16
private-address: fd00::/8 private-address: fd00::/8
private-address: fe80::/10 private-address: fe80::/10
private-address: 127.0.0.0/8 private-address: 127.0.0.0/8
private-address: ::ffff:0:0/96' > /etc/unbound/openvpn.conf private-address: ::ffff:0:0/96' >>/etc/unbound/unbound.conf.d/openvpn.conf
fi
# Add as include, if no wildcard include exist
if ! grep -q '/etc/unbound/unbound.conf.d/' /etc/unbound/unbound.conf; then
echo 'include: /etc/unbound/unbound.conf.d/openvpn.conf' >>/etc/unbound/unbound.conf
fi fi
systemctl enable unbound systemctl enable unbound
@ -1128,8 +1096,8 @@ function revokeClient () {
function removeUnbound () { function removeUnbound () {
# Remove OpenVPN-related config # Remove OpenVPN-related config
sed -i 's|include: \/etc\/unbound\/openvpn.conf||' /etc/unbound/unbound.conf sed -i '/include .*\/openvpn.conf/d' /etc/unbound/unbound.conf
rm /etc/unbound/openvpn.conf rm /etc/unbound/unbound.conf.d/openvpn.conf
systemctl restart unbound systemctl restart unbound
until [[ $REMOVE_UNBOUND =~ (y|n) ]]; do until [[ $REMOVE_UNBOUND =~ (y|n) ]]; do
@ -1227,7 +1195,7 @@ function removeOpenVPN () {
rm -rf /var/log/openvpn rm -rf /var/log/openvpn
# Unbound # Unbound
if [[ -e /etc/unbound/openvpn.conf ]]; then if [[ -e /etc/unbound/unbound.conf.d/openvpn.conf ]]; then
removeUnbound removeUnbound
fi fi
echo "" echo ""