Bernhard.Linz/openvpn-install
1
0
Fork 0
mirror of https://github.com/angristan/openvpn-install.git synced 2025-07-04 05:24:21 +02:00
Code Issues Projects Releases Wiki Activity

Merge branch 'master' into patch-7

Browse Source
This commit is contained in:
Henry N 2020-05-20 00:20:45 +02:00 committed by GitHub
commit 15fb5075ec
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
11 changed files with 817 additions and 534 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
.github/ISSUE_TEMPLATE.md vendored
View File

@ -1,13 +0,0 @@
<!---
Before opening an issue, please make sure:
- You installed OpenVPN with the latest version of the script
- You read the FAQ
- Your issue is about the script, NOT OpenVPN itself
- ⚠ PLEASE Post your OpenVPN version and OS for both the server and the client if needed
FYI, you can execute the script with `bash -x openvpn-install.sh` to enable debug mode.
You can format your comments with Markdown: https://guides.github.com/features/mastering-markdown/
--->

49
.github/ISSUE_TEMPLATE/bug-report-or-suport-request.md vendored Normal file
View File

@ -0,0 +1,49 @@
---
name: Bug report / Support request
about: Create a report to help us improve
title: ''
labels: ''
assignees: ''
---
**Checklist**
- [ ] I read the [README](https://github.com/angristan/openvpn-install/blob/master/README.md)
- [ ] I read the [FAQ](https://github.com/angristan/openvpn-install/blob/master/FAQ.md)
- [ ] I searched the [issues](https://github.com/angristan/openvpn-install/issues?q=is%3Aissue+)
- [ ] My issue is about the script, and not OpenVPN itself
<!---
If you need help with OpenVPN itself, please us the [community forums](https://forums.openvpn.net/) or [Stack Overflow](https://stackoverflow.com/questions/tagged/openvpn)
--->
**Describe the issue**
A clear and concise description of what the bug is.
**To Reproduce**
Steps to reproduce the behavior:
1. ...
**Expected behavior**
A clear and concise description of what you expected to happen.
**Logs**
If applicable, add logs or screenshots to help explain your problem.
If you can reproduce the issue, please run the script in debug mode and post the output: `bash -x openvpn-install.sh`
**Server if applicable):**
- OS: [e.g. Debian 10]
- Hosting provider (if applicable): [e.g. Vultr, AWS]
**Client (if applicable):**
- Device: [e.g. iPhone6]
- OS: [e.g. iOS8.1]
- Client: [e.g. OpenVPN Connect]
**Additional context**
Add any other context about the problem here.

31
.github/ISSUE_TEMPLATE/feature-request.md vendored Normal file
View File

@ -0,0 +1,31 @@
---
name: Feature request
about: Suggest an idea for this project
title: ''
labels: ''
assignees: ''
---
**Checklist**
- [ ] I read the [README](https://github.com/angristan/openvpn-install/blob/master/README.md)
- [ ] I read the [FAQ](https://github.com/angristan/openvpn-install/blob/master/FAQ.md)
- [ ] I searched the [issues](https://github.com/angristan/openvpn-install/issues?q=is%3Aissue+)
- [ ] My issue is about the script, and not OpenVPN itself
<!---
If you need help with OpenVPN itself, please us the [community forums](https://forums.openvpn.net/) or [Stack Overflow](https://stackoverflow.com/questions/tagged/openvpn)
--->
**Is your feature request related to a problem? Please describe.**
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
**Describe the solution you'd like**
A clear and concise description of what you want to happen.
**Describe alternatives you've considered**
A clear and concise description of any alternative solutions or features you've considered.
**Additional context**
Add any other context or screenshots about the feature request here.

26
.github/workflows/lint.yml vendored Normal file
View File

@ -0,0 +1,26 @@
on:
push:
branches:
- master
pull_request:
branches:
- master
name: Lint
jobs:
shellcheck:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: shellcheck
uses: ludeeus/action-shellcheck@0.0.1
env:
SHELLCHECK_OPTS: -e SC1091,SC2164,SC2034,SC1072,SC1073,SC1009
shfmt:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: shfmt
uses: bltavares/actions/shfmt@master
env:
SHFMT_ARGS: -d

11
.github/workflows/push.yml vendored
View File

@ -1,11 +0,0 @@
on: [push, pull_request]
name: ShellCheck
jobs:
shellcheck:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@master
- name: shellcheck
uses: ludeeus/action-shellcheck@0.0.1
with:
args: openvpn-install.sh -e SC1091,SC2164,SC2034,SC1072,SC1073,SC1009

97
.github/workflows/test.yml vendored Normal file
View File

@ -0,0 +1,97 @@
on:
push:
branches:
- master
name: Test
jobs:
install:
runs-on: ubuntu-latest
if: github.repository == 'angristan/openvpn-install' && github.actor == 'angristan'
strategy:
matrix:
os-image:
- debian-9-x64
- debian-10-x64
- ubuntu-18-04-x64
- ubuntu-16-04-x64
- ubuntu-20-04-x64
- fedora-30-x64
- fedora-31-x64
- centos-7-x64
- centos-8-x64
steps:
- uses: actions/checkout@master
- name: Setup doctl
uses: digitalocean/action-doctl@v2
with:
token: ${{ secrets.DIGITALOCEAN_ACCESS_TOKEN }}
- name: Create server
run: doctl compute droplet create openvpn-action-$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER-${{ matrix.os-image }} --size s-1vcpu-1gb --image ${{ matrix.os-image }} --region lon1 --enable-ipv6 --ssh-keys be:66:76:61:a8:71:93:aa:e3:19:ba:d8:0d:d2:2d:d4 --wait
- name: Get server ID
run: echo ::set-output name=value::$(doctl compute droplet list -o json | jq -r '.[] | select(.name == "'openvpn-action-$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER-${{ matrix.os-image }}'").id')
id: server_id
- name: Move server to dedicated project
run: doctl projects resources assign ${{ secrets.DIGITALOCEAN_PROJECT_ID }} --resource=do:droplet:${{ steps.server_id.outputs.value }}
- name: Wait for server to boot
run: sleep 90
- name: Get server IP
run: echo ::set-output name=value::$(doctl compute droplet list -o json | jq -r '.[] | select(.name == "'openvpn-action-$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER-${{ matrix.os-image }}'").networks.v4 | .[0].ip_address')
id: server_ip
- name: Get server OS
run: echo ::set-output name=value::$(echo ${{ matrix.os-image }} | cut -d '-' -f1)
id: server_os
- name: Setup remote server (Debian/Ubuntu)
if: steps.server_os.outputs.value == 'debian' || steps.server_os.outputs.value == 'ubuntu'
uses: appleboy/ssh-action@master
with:
host: ${{ steps.server_ip.outputs.value }}
username: root
key: ${{ secrets.SSH_KEY }}
script: set -x && apt-get update && apt-get install -y git
- name: Setup remote server (Fedora)
if: steps.server_os.outputs.value == 'fedora'
uses: appleboy/ssh-action@master
with:
host: ${{ steps.server_ip.outputs.value }}
username: root
key: ${{ secrets.SSH_KEY }}
script: set -x && dnf install -y git
- name: Setup remote server (CentOS)
if: steps.server_os.outputs.value == 'centos'
uses: appleboy/ssh-action@master
with:
host: ${{ steps.server_ip.outputs.value }}
username: root
key: ${{ secrets.SSH_KEY }}
script: set -x && yum install -y git
- name: Download repo and checkout current commit
uses: appleboy/ssh-action@master
with:
host: ${{ steps.server_ip.outputs.value }}
username: root
key: ${{ secrets.SSH_KEY }}
script: set -x && git clone https://github.com/angristan/openvpn-install.git && cd openvpn-install && git checkout ${{ github.event.pull_request.head.sha }}
- name: Run openvpn-install.sh in headless mode
uses: appleboy/ssh-action@master
with:
host: ${{ steps.server_ip.outputs.value }}
username: root
key: ${{ secrets.SSH_KEY }}
script: 'set -x && AUTO_INSTALL=y bash -x ~/openvpn-install/openvpn-install.sh && ps aux | grep openvpn | grep -v grep > /dev/null 2>&1 && echo "Success: OpenVPN is running" && exit 0 || echo "Failure: OpenVPN is not running" && exit 1'
- name: Delete server
run: doctl compute droplet delete -f openvpn-action-$GITHUB_RUN_ID-$GITHUB_RUN_NUMBER-${{ matrix.os-image }}
if: always()

2
.gitignore vendored
View File

@ -1,2 +0,0 @@
.vagrant/
*.log

85
FAQ.md
View File

@ -14,6 +14,45 @@ You can, of course, it's even recommended, update the `openvpn` package with you
--- ---
**Q:** How do I fix DNS leaks?
**A:** On Windows 10 DNS leaks are blocked by default with the `block-outside-dns` option.
On Linux you need to add these lines to your `.ovpn` file based on your Distribution.
Debian 9, 10 and Ubuntu 16.04, 18.04
```
script-security 2
up /etc/openvpn/update-resolv-conf
down /etc/openvpn/update-resolv-conf
```
Centos 6, 7
```
script-security 2
up /usr/share/doc/openvpn-2.4.8/contrib/pull-resolv-conf/client.up
down /usr/share/doc/openvpn-2.4.8/contrib/pull-resolv-conf/client.down
```
Centos 8, Fedora 30, 31
```
script-security 2
up /usr/share/doc/openvpn/contrib/pull-resolv-conf/client.up
down /usr/share/doc/openvpn/contrib/pull-resolv-conf/client.down
```
Arch Linux
```
script-security 2
up /usr/share/openvpn/contrib/pull-resolv-conf/client.up
down /usr/share/openvpn/contrib/pull-resolv-conf/client.down
```
---
**Q:** Can I use an OpenVPN 2.3 client? **Q:** Can I use an OpenVPN 2.3 client?
**A:** Yes. I really recommend using an up-to-date client, but if you really need it, choose the following options: **A:** Yes. I really recommend using an up-to-date client, but if you really need it, choose the following options:
@ -36,12 +75,52 @@ If your client is <2.3.3, remove `tls-version-min 1.2` from your `/etc/openvpn/s
**Q:** DNS is not working on my Linux client **Q:** DNS is not working on my Linux client
**A:** Make sure the `resolvconf` package is installed. If it does not solve the issue, look at https://wiki.archlinux.org/index.php/OpenVPN#Update_systemd-resolved_script **A:** See "How do I fix DNS leaks?" question
--- ---
**Q:** How to setup openVPN in a LXC container? (f.e. Proxmox) **Q:** What syctl and iptables changes are made by the script?
**A:** See https://github.com/Nyr/openvpn-install/wiki/How-to-setup-openVPN-in-a-LXC-container-(f.e.-Proxmox) **A:** Iptables rules are saved at `/etc/iptables/add-openvpn-rules.sh` and `/etc/iptables/rm-openvpn-rules.sh`. They are managed by the service `/etc/systemd/system/iptables-openvpn.service`
Sysctl options are at `/etc/sysctl.d/20-openvpn.conf`
--- ---
**Q:** How can I access other clients connected to the same OpenVPN server?
**A:** Add `client-to-client` to your `server.conf`
---
**Q:** My router can't connect
**A:**
- `Options error: No closing quotation (") in config.ovpn:46` :
type `yes` when asked to customize encryption settings and choose `tls-auth`
- `Options error: Unrecognized option or missing parameter(s) in config.ovpn:36: tls-version-min (2.3.2)` :
see question "Can I use an OpenVPN 2.3 client?"
---
**Q:** How can I access computers the OpenVPN server's remote LAN?
**A:** Add a route with the subnet of the remote network to `/etc/openvpn/server.conf` and restart openvpn. Example: `push "route 192.168.1.0 255.255.255.0"` if the server's LAN is `192.168.1.0/24`
---
**Q:** How can I add multiple users in one go?
**A:** Here is a sample bash script to achieve this:
```sh
userlist=(user1 user2 user3)
for i in ${userlist[@]};do
MENU_OPTION=1 CLIENT=$i PASS=1 ./openvpn-install.sh
done
```

65
README.md
View File

@ -1,5 +1,7 @@
# openvpn-install # openvpn-install
![Test](https://github.com/angristan/openvpn-install/workflows/Test/badge.svg) ![Lint](https://github.com/angristan/openvpn-install/workflows/Lint/badge.svg)
OpenVPN installer for Debian, Ubuntu, Fedora, CentOS and Arch Linux. OpenVPN installer for Debian, Ubuntu, Fedora, CentOS and Arch Linux.
This script will let you setup your own secure VPN server in just a few seconds. This script will let you setup your own secure VPN server in just a few seconds.
@ -8,14 +10,14 @@ You can also check out [wireguard-install](https://github.com/angristan/wireguar
## Usage ## Usage
First, get the script and make it executable : First, get the script and make it executable:
```bash ```bash
curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh curl -O https://raw.githubusercontent.com/angristan/openvpn-install/master/openvpn-install.sh
chmod +x openvpn-install.sh chmod +x openvpn-install.sh
``` ```
Then run it : Then run it:
```sh ```sh
./openvpn-install.sh ./openvpn-install.sh
@ -25,7 +27,7 @@ You need to run the script as root and have the TUN module enabled.
The first time you run it, you'll have to follow the assistant and answer a few questions to setup your VPN server. The first time you run it, you'll have to follow the assistant and answer a few questions to setup your VPN server.
When OpenVPN is installed, you can run the script again, and you will get the choice to : When OpenVPN is installed, you can run the script again, and you will get the choice to:
- Add a client - Add a client
- Remove a client - Remove a client
@ -35,13 +37,14 @@ In your home directory, you will have `.ovpn` files. These are the client config
If you have any question, head to the [FAQ](#faq) first. Please read everything before opening an issue. If you have any question, head to the [FAQ](#faq) first. Please read everything before opening an issue.
**PLEASE do net send me emails or private messages asking for help.** The only place to get help is the issues. Other people may be able to help and in the future, other users may also run into the same issue as you. My time is not available for free just for you, you're not special. **PLEASE do not send me emails or private messages asking for help.** The only place to get help is the issues. Other people may be able to help and in the future, other users may also run into the same issue as you. My time is not available for free just for you, you're not special.
### Headless install ### Headless install
It's also possible to run the script headless, e.g. without waiting for user input, in an automated manner. It's also possible to run the script headless, e.g. without waiting for user input, in an automated manner.
Example usage: Example usage:
```bash ```bash
AUTO_INSTALL=y ./openvpn-install.sh AUTO_INSTALL=y ./openvpn-install.sh
@ -72,11 +75,14 @@ Other variables can be set depending on your choice (encryption, compression). Y
Password-protected clients are not supported by the headless installation method since user input is expected by Easy-RSA. Password-protected clients are not supported by the headless installation method since user input is expected by Easy-RSA.
The headless install is more-or-less idempotent, in that it has been made safe to run multiple times with the same parameters, e.g. by a state provisioner like Ansible/Terraform/Salt/Chef/Puppet. It will only install and regenerate the Easy-RSA PKI if it doesn't already exist, and it will only install OpenVPN and other upstream dependencies if OpenVPN isn't already installed. It will recreate all local config and re-generate the client file on each headless run.
### Headless User Addition ### Headless User Addition
It's also possible to automate the addition of a new user. Here, the key is to provide the (string) value of the `MENU_OPTION` variable along with the remaining mandatory variables before invoking the script. It's also possible to automate the addition of a new user. Here, the key is to provide the (string) value of the `MENU_OPTION` variable along with the remaining mandatory variables before invoking the script.
The following Bash script adds a new user `foo` to an existing OpenVPN configuration The following Bash script adds a new user `foo` to an existing OpenVPN configuration
```bash ```bash
#!/bin/bash #!/bin/bash
export MENU_OPTION="1" export MENU_OPTION="1"
@ -108,19 +114,16 @@ export PASS="1"
The script supports these OS and architectures: The script supports these OS and architectures:
| | i386 | amd64 | armhf | arm64 | | | i386 | amd64 | armhf | arm64 |
| -------------- | ---- | ----- | ----- | ----- | | --------------- | ---- | ----- | ----- | ----- |
| Amazon Linux 2 | ❔ | ✅ | ❔ | ❔ | | Amazon Linux 2 | ❔ | ✅ | ❔ | ❔ |
| Arch Linux | ❔ | ✅ | ❔ | ✅ | | Arch Linux | ❔ | ✅ | ❔ | ✅ |
| Centos 8 | ❌ | ✅ | ❔ | ❔ |
| CentOS 7 | ❔ | ✅ | ❌ | ✅ | | CentOS 7 | ❔ | ✅ | ❌ | ✅ |
| CentOS 8 | ❌ | ✅ | ❔ | ❔ |
| Debian 8 | ✅ | ✅ | ❌ | ❌ | | Debian 8 | ✅ | ✅ | ❌ | ❌ |
| Debian 9 | ❌ | ✅ | ✅ | ✅ | | Debian >= 9 | ❌ | ✅ | ✅ | ✅ |
| Debian 10 | ❔ | ✅ | ✅ | ❔ | | Fedora >= 27 | ❔ | ✅ | ❔ | ❔ |
| Fedora 27 | ❔ | ✅ | ❔ | ❔ |
| Fedora 28 | ❔ | ✅ | ❔ | ❔ |
| Ubuntu 16.04 | ✅ | ✅ | ❌ | ❌ | | Ubuntu 16.04 | ✅ | ✅ | ❌ | ❌ |
| Ubuntu 18.04 | ❌ | ✅ | ✅ | ✅ | | Ubuntu >= 18.04 | ❌ | ✅ | ✅ | ✅ |
| Ubuntu 19.04 | ❌ | ✅ | ✅ | ✅ |
To be noted: To be noted:
@ -142,9 +145,9 @@ More Q&A in [FAQ.md](FAQ.md).
**A:** I recommend these: **A:** I recommend these:
- [Vultr](https://goo.gl/Xyd1Sc): Worldwide locations, IPv6 support, starting at $3.50/month - [Vultr](https://goo.gl/Xyd1Sc): Worldwide locations, IPv6 support, starting at \$3.50/month
- [PulseHeberg](https://goo.gl/76yqW5): France, unlimited bandwidth, starting at €3/month - [PulseHeberg](https://goo.gl/76yqW5): France, unlimited bandwidth, starting at €3/month
- [Digital Ocean](https://goo.gl/qXrNLK): Worldwide locations, IPv6 support, starting at $5/month - [Digital Ocean](https://goo.gl/qXrNLK): Worldwide locations, IPv6 support, starting at \$5/month
--- ---
@ -178,8 +181,26 @@ More Q&A in [FAQ.md](FAQ.md).
Solutions that provision a ready to use OpenVPN server based on this script in one go are available for: Solutions that provision a ready to use OpenVPN server based on this script in one go are available for:
- AWS using Terraform at [`openvpn-terraform-install`](https://github.com/dumrauf/openvpn-terraform-install) - AWS using Terraform at [`openvpn-terraform-install`](https://github.com/dumrauf/openvpn-terraform-install)
## Contributing
### Contributors hall-of-fame
Thanks ❤️
[![](https://sourcerer.io/fame/angristan/angristan/openvpn-install/images/0)](https://github.com/angristan/openvpn-install/graphs/contributors)
[![](https://sourcerer.io/fame/angristan/angristan/openvpn-install/images/1)](https://github.com/angristan/openvpn-install/graphs/contributors)
[![](https://sourcerer.io/fame/angristan/angristan/openvpn-install/images/2)](https://github.com/angristan/openvpn-install/graphs/contributors)
[![](https://sourcerer.io/fame/angristan/angristan/openvpn-install/images/3)](https://github.com/angristan/openvpn-install/graphs/contributors)
[![](https://sourcerer.io/fame/angristan/angristan/openvpn-install/images/4)](https://github.com/angristan/openvpn-install/graphs/contributors)
[![](https://sourcerer.io/fame/angristan/angristan/openvpn-install/images/5)](https://github.com/angristan/openvpn-install/graphs/contributors)
[![](https://sourcerer.io/fame/angristan/angristan/openvpn-install/images/6)](https://github.com/angristan/openvpn-install/graphs/contributors)
[![](https://sourcerer.io/fame/angristan/angristan/openvpn-install/images/7)](https://github.com/angristan/openvpn-install/graphs/contributors)
### Code formatting
We use [shellcheck](https://github.com/koalaman/shellcheck) and [shfmt](https://github.com/mvdan/sh) to enforce bash styling guidelines and good practices. They are executed for each commit / PR with GitHub Actions, so you can check the configuration [here](https://github.com/angristan/openvpn-install/blob/master/.github/workflows/push.yml).
## Security and Encryption ## Security and Encryption
@ -190,6 +211,7 @@ OpenVPN 2.4 was a great update regarding encryption. It added support for ECDSA,
If you want more information about an option mentioned below, head to the [OpenVPN manual](https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage). It is very complete. If you want more information about an option mentioned below, head to the [OpenVPN manual](https://community.openvpn.net/openvpn/wiki/Openvpn24ManPage). It is very complete.
Most of OpenVPN's encryption-related stuff is managed by [Easy-RSA](https://github.com/OpenVPN/easy-rsa). Defaults parameters are in the [vars.example](https://github.com/OpenVPN/easy-rsa/blob/v3.0.6/easyrsa3/vars.example) file. Most of OpenVPN's encryption-related stuff is managed by [Easy-RSA](https://github.com/OpenVPN/easy-rsa). Defaults parameters are in the [vars.example](https://github.com/OpenVPN/easy-rsa/blob/v3.0.6/easyrsa3/vars.example) file.
### Compression ### Compression
By default, OpenVPN doesn't enable compression. This script provides support for LZ0 and LZ4 (v1/v2) algorithms, the latter being more efficient. By default, OpenVPN doesn't enable compression. This script provides support for LZ0 and LZ4 (v1/v2) algorithms, the latter being more efficient.
@ -227,15 +249,15 @@ By default, OpenVPN uses `BF-CBC` as the data channel cipher. Blowfish is an old
> >
> Using BF-CBC is no longer recommended, because of its 64-bit block size. This small block size allows attacks based on collisions, as demonstrated by SWEET32. See https://community.openvpn.net/openvpn/wiki/SWEET32 for details. > Using BF-CBC is no longer recommended, because of its 64-bit block size. This small block size allows attacks based on collisions, as demonstrated by SWEET32. See https://community.openvpn.net/openvpn/wiki/SWEET32 for details.
>Security researchers at INRIA published an attack on 64-bit block ciphers, such as 3DES and Blowfish. They show that they are able to recover plaintext when the same data is sent often enough, and show how they can use cross-site scripting vulnerabilities to send data of interest often enough. This works over HTTPS, but also works for HTTP-over-OpenVPN. See ​https://sweet32.info/ for a much better and more elaborate explanation. > Security researchers at INRIA published an attack on 64-bit block ciphers, such as 3DES and Blowfish. They show that they are able to recover plaintext when the same data is sent often enough, and show how they can use cross-site scripting vulnerabilities to send data of interest often enough. This works over HTTPS, but also works for HTTP-over-OpenVPN. See https://sweet32.info/ for a much better and more elaborate explanation.
> >
> OpenVPN's default cipher, BF-CBC, is affected by this attack. > OpenVPN's default cipher, BF-CBC, is affected by this attack.
Indeed, AES is today's standard. It's the fastest and more secure cipher available today. [SEED](https://en.wikipedia.org/wiki/SEED) and [Camellia](https://en.wikipedia.org/wiki/Camellia_(cipher)) are not vulnerable to date but are slower than AES and relatively less trusted. Indeed, AES is today's standard. It's the fastest and more secure cipher available today. [SEED](https://en.wikipedia.org/wiki/SEED) and [Camellia](<https://en.wikipedia.org/wiki/Camellia_(cipher)>) are not vulnerable to date but are slower than AES and relatively less trusted.
> Of the currently supported ciphers, OpenVPN currently recommends using AES-256-CBC or AES-128-CBC. OpenVPN 2.4 and newer will also support GCM. For 2.4+, we recommend using AES-256-GCM or AES-128-GCM. > Of the currently supported ciphers, OpenVPN currently recommends using AES-256-CBC or AES-128-CBC. OpenVPN 2.4 and newer will also support GCM. For 2.4+, we recommend using AES-256-GCM or AES-128-GCM.
AES-256 is 40% slower than AES-128, and there isn't any real reason to use a 256 bits key over a 128 bits key with AES. (Source : [1](http://security.stackexchange.com/questions/14068/why-most-people-use-256-bit-encryption-instead-of-128-bit),[2](http://security.stackexchange.com/questions/6141/amount-of-simple-operations-that-is-safely-out-of-reach-for-all-humanity/6149#6149)). Moreover, AES-256 is more vulnerable to [Timing attacks](https://en.wikipedia.org/wiki/Timing_attack). AES-256 is 40% slower than AES-128, and there isn't any real reason to use a 256 bits key over a 128 bits key with AES. (Source: [1](http://security.stackexchange.com/questions/14068/why-most-people-use-256-bit-encryption-instead-of-128-bit),[2](http://security.stackexchange.com/questions/6141/amount-of-simple-operations-that-is-safely-out-of-reach-for-all-humanity/6149#6149)). Moreover, AES-256 is more vulnerable to [Timing attacks](https://en.wikipedia.org/wiki/Timing_attack).
AES-GCM is an [AEAD cipher](https://en.wikipedia.org/wiki/Authenticated_encryption) which means it simultaneously provides confidentiality, integrity, and authenticity assurances on the data. AES-GCM is an [AEAD cipher](https://en.wikipedia.org/wiki/Authenticated_encryption) which means it simultaneously provides confidentiality, integrity, and authenticity assurances on the data.
@ -250,7 +272,7 @@ The script supports the following ciphers:
And defaults to `AES-128-GCM`. And defaults to `AES-128-GCM`.
OpenVPN 2.4 added a feature called "NCP": *Negotiable Crypto Parameters*. It means you can provide a cipher suite like with HTTPS. It is set to `AES-256-GCM:AES-128-GCM` by default and overrides the `--cipher` parameter when used with an OpenVPN 2.4 client. For the sake of simplicity, the script set both the `--cipher` and `--ncp-cipher` to the cipher chosen above. OpenVPN 2.4 added a feature called "NCP": _Negotiable Crypto Parameters_. It means you can provide a cipher suite like with HTTPS. It is set to `AES-256-GCM:AES-128-GCM` by default and overrides the `--cipher` parameter when used with an OpenVPN 2.4 client. For the sake of simplicity, the script set both the `--cipher` and `--ncp-cipher` to the cipher chosen above.
### Control channel ### Control channel
@ -311,6 +333,7 @@ About `tls-crypt`:
> Encrypt and authenticate all control channel packets with the key from keyfile. (See --tls-auth for more background.) > Encrypt and authenticate all control channel packets with the key from keyfile. (See --tls-auth for more background.)
> >
> Encrypting (and authenticating) control channel packets: > Encrypting (and authenticating) control channel packets:
>
> - provides more privacy by hiding the certificate used for the TLS connection, > - provides more privacy by hiding the certificate used for the TLS connection,
> - makes it harder to identify OpenVPN traffic as such, > - makes it harder to identify OpenVPN traffic as such,
> - provides "poor-man's" post-quantum security, against attackers who will never know the pre-shared key (i.e. no forward secrecy). > - provides "poor-man's" post-quantum security, against attackers who will never know the pre-shared key (i.e. no forward secrecy).
@ -323,9 +346,7 @@ The script supports both and uses `tls-crypt` by default.
## Say thanks ## Say thanks
*Sadly saythanks.io doesn't exist anymore... Thanks for the dozens of messages! It's really meaninful to me.* You can [say thanks](https://saythanks.io/to/angristan%40pm.me) if you want!
*Still want to help? Check the "sponsor" button at the top of the page!*
## Credits & Licence ## Credits & Licence

35
Vagrantfile vendored
View File

@ -1,35 +0,0 @@
# This Vagrantfile is used to test the script
# To run the script on all machines, export VAGRANT_AUTOSTART=true
autostart_machines = ENV['VAGRANT_AUTOSTART'] == 'true' || false
# else, run `vagrant up <hostname>`
machines = [
{ hostname: 'debian-10', box: 'debian/stretch64' },
{ hostname: 'debian-9', box: 'debian/stretch64' },
{ hostname: 'debian-8', box: 'debian/jessie64' },
{ hostname: 'ubuntu-1604', box: 'ubuntu/bionic64' },
{ hostname: 'ubuntu-1804', box: 'ubuntu/xenial64' },
{ hostname: 'centos-7', box: 'centos/7' },
{ hostname: 'fedora-29', box: 'fedora/29-cloud-base' },
{ hostname: 'fedora-28', box: 'fedora/28-cloud-base' },
{ hostname: 'archlinux', box: 'archlinux/archlinux' }
]
Vagrant.configure('2') do |config|
machines.each do |machine|
config.vm.provider 'virtualbox' do |v|
v.memory = 1024
v.cpus = 2
end
config.vm.define machine[:hostname], autostart: autostart_machines do |machineconfig|
machineconfig.vm.hostname = machine[:hostname]
machineconfig.vm.box = machine[:box]
machineconfig.vm.provision 'shell', inline: <<-SHELL
AUTO_INSTALL=y /vagrant/openvpn-install.sh
ps aux | grep openvpn | grep -v grep > /dev/null 2>&1 && echo "Success: OpenVPN is running" && exit 0 || echo "Failure: OpenVPN is not running" && exit 1
SHELL
end
end
end

409
openvpn-install.sh
View File

@ -3,50 +3,49 @@
# Secure OpenVPN server installer for Debian, Ubuntu, CentOS, Amazon Linux 2, Fedora and Arch Linux # Secure OpenVPN server installer for Debian, Ubuntu, CentOS, Amazon Linux 2, Fedora and Arch Linux
# https://github.com/angristan/openvpn-install # https://github.com/angristan/openvpn-install
function isRoot () { function isRoot() {
if [ "$EUID" -ne 0 ]; then if [ "$EUID" -ne 0 ]; then
return 1 return 1
fi fi
} }
function tunAvailable () { function tunAvailable() {
if [ ! -e /dev/net/tun ]; then if [ ! -e /dev/net/tun ]; then
return 1 return 1
fi fi
} }
function checkOS () { function checkOS() {
if [[ -e /etc/debian_version ]]; then if [[ -e /etc/debian_version ]]; then
OS="debian" OS="debian"
# shellcheck disable=SC1091 # shellcheck disable=SC1091
source /etc/os-release source /etc/os-release
if [[ "$ID" == "debian" || "$ID" == "raspbian" ]]; then if [[ $ID == "debian" || $ID == "raspbian" ]]; then
if [[ ! $VERSION_ID =~ (8|9|10) ]]; then if [[ $VERSION_ID -lt 8 ]]; then
echo "⚠️ Your version of Debian is not supported." echo "⚠️ Your version of Debian is not supported."
echo "" echo ""
echo "However, if you're using Debian >= 9 or unstable/testing then you can continue." echo "However, if you're using Debian >= 8 or unstable/testing then you can continue, at your own risk."
echo "Keep in mind they are not supported, though."
echo "" echo ""
until [[ $CONTINUE =~ (y|n) ]]; do until [[ $CONTINUE =~ (y|n) ]]; do
read -rp "Continue? [y/n]: " -e CONTINUE read -rp "Continue? [y/n]: " -e CONTINUE
done done
if [[ "$CONTINUE" == "n" ]]; then if [[ $CONTINUE == "n" ]]; then
exit 1 exit 1
fi fi
fi fi
elif [[ "$ID" == "ubuntu" ]];then elif [[ $ID == "ubuntu" ]]; then
OS="ubuntu" OS="ubuntu"
if [[ ! $VERSION_ID =~ (16.04|18.04|19.04) ]]; then MAJOR_UBUNTU_VERSION=$(echo "$VERSION_ID" | cut -d '.' -f1)
if [[ $MAJOR_UBUNTU_VERSION -lt 16 ]]; then
echo "⚠️ Your version of Ubuntu is not supported." echo "⚠️ Your version of Ubuntu is not supported."
echo "" echo ""
echo "However, if you're using Ubuntu > 17 or beta, then you can continue." echo "However, if you're using Ubuntu >= 16.04 or beta, then you can continue, at your own risk."
echo "Keep in mind they are not supported, though."
echo "" echo ""
until [[ $CONTINUE =~ (y|n) ]]; do until [[ $CONTINUE =~ (y|n) ]]; do
read -rp "Continue? [y/n]: " -e CONTINUE read -rp "Continue? [y/n]: " -e CONTINUE
done done
if [[ "$CONTINUE" == "n" ]]; then if [[ $CONTINUE == "n" ]]; then
exit 1 exit 1
fi fi
fi fi
@ -54,10 +53,10 @@ function checkOS () {
elif [[ -e /etc/system-release ]]; then elif [[ -e /etc/system-release ]]; then
# shellcheck disable=SC1091 # shellcheck disable=SC1091
source /etc/os-release source /etc/os-release
if [[ "$ID" == "fedora" ]]; then if [[ $ID == "fedora" ]]; then
OS="fedora" OS="fedora"
fi fi
if [[ "$ID" == "centos" ]]; then if [[ $ID == "centos" ]]; then
OS="centos" OS="centos"
if [[ ! $VERSION_ID =~ (7|8) ]]; then if [[ ! $VERSION_ID =~ (7|8) ]]; then
echo "⚠️ Your version of CentOS is not supported." echo "⚠️ Your version of CentOS is not supported."
@ -67,9 +66,9 @@ function checkOS () {
exit 1 exit 1
fi fi
fi fi
if [[ "$ID" == "amzn" ]]; then if [[ $ID == "amzn" ]]; then
OS="amzn" OS="amzn"
if [[ ! $VERSION_ID == "2" ]]; then if [[ $VERSION_ID != "2" ]]; then
echo "⚠️ Your version of Amazon Linux is not supported." echo "⚠️ Your version of Amazon Linux is not supported."
echo "" echo ""
echo "The script only support Amazon Linux 2." echo "The script only support Amazon Linux 2."
@ -85,7 +84,7 @@ function checkOS () {
fi fi
} }
function initialCheck () { function initialCheck() {
if ! isRoot; then if ! isRoot; then
echo "Sorry, you need to run this as root" echo "Sorry, you need to run this as root"
exit 1 exit 1
@ -97,25 +96,28 @@ function initialCheck () {
checkOS checkOS
} }
function installUnbound () { function installUnbound() {
# If Unbound isn't installed, install it
if [[ ! -e /etc/unbound/unbound.conf ]]; then if [[ ! -e /etc/unbound/unbound.conf ]]; then
if [[ "$OS" =~ (debian|ubuntu) ]]; then if [[ $OS =~ (debian|ubuntu) ]]; then
apt-get install -y unbound apt-get install -y unbound
elif [[ "$OS" =~ (centos|amzn) ]]; then elif [[ $OS =~ (centos|amzn) ]]; then
yum install -y unbound yum install -y unbound
elif [[ "$OS" == "fedora" ]]; then elif [[ $OS == "fedora" ]]; then
dnf install -y unbound dnf install -y unbound
elif [[ "$OS" == "arch" ]]; then elif [[ $OS == "arch" ]]; then
pacman -Syu --noconfirm unbound pacman -Syu --noconfirm unbound
# Get root servers list # Get root servers list
curl -o /etc/unbound/root.hints https://www.internic.net/domain/named.cache curl -o /etc/unbound/root.hints https://www.internic.net/domain/named.cache
if [[ ! -f /etc/unbound/unbound.conf.old ]]; then
mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.old mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.old
fi
echo 'server: echo 'server:
trust-anchor-file: trusted-key.key trust-anchor-file: trusted-key.key
@ -129,10 +131,10 @@ function installUnbound () {
echo 'server: echo 'server:
interface: 10.8.0.1 interface: 10.8.0.1
access-control: 10.8.0.1/24 allow access-control: 10.8.0.1/24 allow
hide-identity: yes
hide-version: yes
use-caps-for-id: yes use-caps-for-id: yes
harden-glue: yes harden-glue: yes
hide-identity: yes
hide-version: yes
qname-minimisation: yes qname-minimisation: yes
prefetch: yes prefetch: yes
# DNS Rebinding fix # DNS Rebinding fix
@ -145,6 +147,12 @@ function installUnbound () {
private-address: 127.0.0.0/8 private-address: 127.0.0.0/8
private-address: ::ffff:0:0/96' >/etc/unbound/unbound.conf.d/openvpn.conf private-address: ::ffff:0:0/96' >/etc/unbound/unbound.conf.d/openvpn.conf
# IPv6 DNS for all OS
if [[ $IPV6_SUPPORT == 'y' ]]; then
echo ' interface: fd42:42:42:42::1
access-control: fd42:42:42:42::/112 allow' >>/etc/unbound/unbound.conf.d/openvpn.conf
fi
# Add as include, if no wildcard include exist # Add as include, if no wildcard include exist
if ! grep -q '/etc/unbound/unbound.conf.d/' /etc/unbound/unbound.conf; then if ! grep -q '/etc/unbound/unbound.conf.d/' /etc/unbound/unbound.conf; then
echo 'include: /etc/unbound/unbound.conf.d/openvpn.conf' >>/etc/unbound/unbound.conf echo 'include: /etc/unbound/unbound.conf.d/openvpn.conf' >>/etc/unbound/unbound.conf
@ -154,7 +162,7 @@ function installUnbound () {
systemctl restart unbound systemctl restart unbound
} }
function installQuestions () { function installQuestions() {
echo "Welcome to the OpenVPN installer!" echo "Welcome to the OpenVPN installer!"
echo "The git repository is available at: https://github.com/angristan/openvpn-install" echo "The git repository is available at: https://github.com/angristan/openvpn-install"
echo "" echo ""
@ -166,7 +174,11 @@ function installQuestions () {
echo "Unless your server is behind NAT, it should be your public IPv4 address." echo "Unless your server is behind NAT, it should be your public IPv4 address."
# Detect public IPv4 address and pre-fill for the user # Detect public IPv4 address and pre-fill for the user
IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) IP=$(ip -4 addr | sed -ne 's|^.* inet \([^/]*\)/.* scope global.*$|\1|p' | head -1)
if [[ -z $IP ]]; then
# Detect public IPv6 address
IP=$(ip -6 addr | sed -ne 's|^.* inet6 \([^/]*\)/.* scope global.*$|\1|p' | head -1)
fi
APPROVE_IP=${APPROVE_IP:-n} APPROVE_IP=${APPROVE_IP:-n}
if [[ $APPROVE_IP =~ n ]]; then if [[ $APPROVE_IP =~ n ]]; then
read -rp "IP address: " -e -i "$IP" IP read -rp "IP address: " -e -i "$IP" IP
@ -176,7 +188,7 @@ function installQuestions () {
echo "" echo ""
echo "It seems this server is behind NAT. What is its public IPv4 address or hostname?" echo "It seems this server is behind NAT. What is its public IPv4 address or hostname?"
echo "We need it for the clients to connect to the server." echo "We need it for the clients to connect to the server."
until [[ "$ENDPOINT" != "" ]]; do until [[ $ENDPOINT != "" ]]; do
read -rp "Public IPv4 address or hostname: " -e ENDPOINT read -rp "Public IPv4 address or hostname: " -e ENDPOINT
done done
fi fi
@ -185,7 +197,7 @@ function installQuestions () {
echo "Checking for IPv6 connectivity..." echo "Checking for IPv6 connectivity..."
echo "" echo ""
# "ping6" and "ping -6" availability varies depending on the distribution # "ping6" and "ping -6" availability varies depending on the distribution
if type ping6 > /dev/null 2>&1; then if type ping6 >/dev/null 2>&1; then
PING6="ping6 -c3 ipv6.google.com > /dev/null 2>&1" PING6="ping6 -c3 ipv6.google.com > /dev/null 2>&1"
else else
PING6="ping -6 -c3 ipv6.google.com > /dev/null 2>&1" PING6="ping -6 -c3 ipv6.google.com > /dev/null 2>&1"
@ -207,7 +219,7 @@ function installQuestions () {
echo " 1) Default: 1194" echo " 1) Default: 1194"
echo " 2) Custom" echo " 2) Custom"
echo " 3) Random [49152-65535]" echo " 3) Random [49152-65535]"
until [[ "$PORT_CHOICE" =~ ^[1-3]$ ]]; do until [[ $PORT_CHOICE =~ ^[1-3]$ ]]; do
read -rp "Port choice [1-3]: " -e -i 1 PORT_CHOICE read -rp "Port choice [1-3]: " -e -i 1 PORT_CHOICE
done done
case $PORT_CHOICE in case $PORT_CHOICE in
@ -215,7 +227,7 @@ function installQuestions () {
PORT="1194" PORT="1194"
;; ;;
2) 2)
until [[ "$PORT" =~ ^[0-9]+$ ]] && [ "$PORT" -ge 1 ] && [ "$PORT" -le 65535 ]; do until [[ $PORT =~ ^[0-9]+$ ]] && [ "$PORT" -ge 1 ] && [ "$PORT" -le 65535 ]; do
read -rp "Custom port [1-65535]: " -e -i 1194 PORT read -rp "Custom port [1-65535]: " -e -i 1194 PORT
done done
;; ;;
@ -230,7 +242,7 @@ function installQuestions () {
echo "UDP is faster. Unless it is not available, you shouldn't use TCP." echo "UDP is faster. Unless it is not available, you shouldn't use TCP."
echo " 1) UDP" echo " 1) UDP"
echo " 2) TCP" echo " 2) TCP"
until [[ "$PROTOCOL_CHOICE" =~ ^[1-2]$ ]]; do until [[ $PROTOCOL_CHOICE =~ ^[1-2]$ ]]; do
read -rp "Protocol [1-2]: " -e -i 1 PROTOCOL_CHOICE read -rp "Protocol [1-2]: " -e -i 1 PROTOCOL_CHOICE
done done
case $PROTOCOL_CHOICE in case $PROTOCOL_CHOICE in
@ -256,7 +268,7 @@ function installQuestions () {
echo " 11) AdGuard DNS (Anycast: worldwide)" echo " 11) AdGuard DNS (Anycast: worldwide)"
echo " 12) NextDNS (Anycast: worldwide)" echo " 12) NextDNS (Anycast: worldwide)"
echo " 13) Custom" echo " 13) Custom"
until [[ "$DNS" =~ ^[0-9]+$ ]] && [ "$DNS" -ge 1 ] && [ "$DNS" -le 13 ]; do until [[ $DNS =~ ^[0-9]+$ ]] && [ "$DNS" -ge 1 ] && [ "$DNS" -le 13 ]; do
read -rp "DNS [1-12]: " -e -i 3 DNS read -rp "DNS [1-12]: " -e -i 3 DNS
if [[ $DNS == 2 ]] && [[ -e /etc/unbound/unbound.conf ]]; then if [[ $DNS == 2 ]] && [[ -e /etc/unbound/unbound.conf ]]; then
echo "" echo ""
@ -269,18 +281,18 @@ function installQuestions () {
until [[ $CONTINUE =~ (y|n) ]]; do until [[ $CONTINUE =~ (y|n) ]]; do
read -rp "Apply configuration changes to Unbound? [y/n]: " -e CONTINUE read -rp "Apply configuration changes to Unbound? [y/n]: " -e CONTINUE
done done
if [[ $CONTINUE == "n" ]];then if [[ $CONTINUE == "n" ]]; then
# Break the loop and cleanup # Break the loop and cleanup
unset DNS unset DNS
unset CONTINUE unset CONTINUE
fi fi
elif [[ $DNS == "13" ]]; then elif [[ $DNS == "13" ]]; then
until [[ "$DNS1" =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ ]]; do until [[ $DNS1 =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ ]]; do
read -rp "Primary DNS: " -e DNS1 read -rp "Primary DNS: " -e DNS1
done done
until [[ "$DNS2" =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ ]]; do until [[ $DNS2 =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ ]]; do
read -rp "Secondary DNS (optional): " -e DNS2 read -rp "Secondary DNS (optional): " -e DNS2
if [[ "$DNS2" == "" ]]; then if [[ $DNS2 == "" ]]; then
break break
fi fi
done done
@ -291,7 +303,7 @@ function installQuestions () {
until [[ $COMPRESSION_ENABLED =~ (y|n) ]]; do until [[ $COMPRESSION_ENABLED =~ (y|n) ]]; do
read -rp"Enable compression? [y/n]: " -e -i n COMPRESSION_ENABLED read -rp"Enable compression? [y/n]: " -e -i n COMPRESSION_ENABLED
done done
if [[ $COMPRESSION_ENABLED == "y" ]];then if [[ $COMPRESSION_ENABLED == "y" ]]; then
echo "Choose which compression algorithm you want to use: (they are ordered by efficiency)" echo "Choose which compression algorithm you want to use: (they are ordered by efficiency)"
echo " 1) LZ4-v2" echo " 1) LZ4-v2"
echo " 2) LZ4" echo " 2) LZ4"
@ -320,7 +332,7 @@ function installQuestions () {
until [[ $CUSTOMIZE_ENC =~ (y|n) ]]; do until [[ $CUSTOMIZE_ENC =~ (y|n) ]]; do
read -rp "Customize encryption settings? [y/n]: " -e -i n CUSTOMIZE_ENC read -rp "Customize encryption settings? [y/n]: " -e -i n CUSTOMIZE_ENC
done done
if [[ $CUSTOMIZE_ENC == "n" ]];then if [[ $CUSTOMIZE_ENC == "n" ]]; then
# Use default, sane and fast parameters # Use default, sane and fast parameters
CIPHER="AES-128-GCM" CIPHER="AES-128-GCM"
CERT_TYPE="1" # ECDSA CERT_TYPE="1" # ECDSA
@ -339,7 +351,7 @@ function installQuestions () {
echo " 4) AES-128-CBC" echo " 4) AES-128-CBC"
echo " 5) AES-192-CBC" echo " 5) AES-192-CBC"
echo " 6) AES-256-CBC" echo " 6) AES-256-CBC"
until [[ "$CIPHER_CHOICE" =~ ^[1-6]$ ]]; do until [[ $CIPHER_CHOICE =~ ^[1-6]$ ]]; do
read -rp "Cipher [1-6]: " -e -i 1 CIPHER_CHOICE read -rp "Cipher [1-6]: " -e -i 1 CIPHER_CHOICE
done done
case $CIPHER_CHOICE in case $CIPHER_CHOICE in
@ -397,7 +409,7 @@ function installQuestions () {
echo " 1) 2048 bits (recommended)" echo " 1) 2048 bits (recommended)"
echo " 2) 3072 bits" echo " 2) 3072 bits"
echo " 3) 4096 bits" echo " 3) 4096 bits"
until [[ "$RSA_KEY_SIZE_CHOICE" =~ ^[1-3]$ ]]; do until [[ $RSA_KEY_SIZE_CHOICE =~ ^[1-3]$ ]]; do
read -rp "RSA key size [1-3]: " -e -i 1 RSA_KEY_SIZE_CHOICE read -rp "RSA key size [1-3]: " -e -i 1 RSA_KEY_SIZE_CHOICE
done done
case $RSA_KEY_SIZE_CHOICE in case $RSA_KEY_SIZE_CHOICE in
@ -482,7 +494,7 @@ function installQuestions () {
echo " 1) 2048 bits (recommended)" echo " 1) 2048 bits (recommended)"
echo " 2) 3072 bits" echo " 2) 3072 bits"
echo " 3) 4096 bits" echo " 3) 4096 bits"
until [[ "$DH_KEY_SIZE_CHOICE" =~ ^[1-3]$ ]]; do until [[ $DH_KEY_SIZE_CHOICE =~ ^[1-3]$ ]]; do
read -rp "DH key size [1-3]: " -e -i 1 DH_KEY_SIZE_CHOICE read -rp "DH key size [1-3]: " -e -i 1 DH_KEY_SIZE_CHOICE
done done
case $DH_KEY_SIZE_CHOICE in case $DH_KEY_SIZE_CHOICE in
@ -500,9 +512,9 @@ function installQuestions () {
esac esac
echo "" echo ""
# The "auth" options behaves differently with AEAD ciphers # The "auth" options behaves differently with AEAD ciphers
if [[ "$CIPHER" =~ CBC$ ]]; then if [[ $CIPHER =~ CBC$ ]]; then
echo "The digest algorithm authenticates data channel packets and tls-auth packets from the control channel." echo "The digest algorithm authenticates data channel packets and tls-auth packets from the control channel."
elif [[ "$CIPHER" =~ GCM$ ]]; then elif [[ $CIPHER =~ GCM$ ]]; then
echo "The digest algorithm authenticates tls-auth packets from the control channel." echo "The digest algorithm authenticates tls-auth packets from the control channel."
fi fi
echo "Which digest algorithm do you want to use for HMAC?" echo "Which digest algorithm do you want to use for HMAC?"
@ -541,7 +553,7 @@ function installQuestions () {
fi fi
} }
function installOpenVPN () { function installOpenVPN() {
if [[ $AUTO_INSTALL == "y" ]]; then if [[ $AUTO_INSTALL == "y" ]]; then
# Set default choices so that no questions will be asked. # Set default choices so that no questions will be asked.
APPROVE_INSTALL=${APPROVE_INSTALL:-y} APPROVE_INSTALL=${APPROVE_INSTALL:-y}
@ -556,9 +568,13 @@ function installOpenVPN () {
PASS=${PASS:-1} PASS=${PASS:-1}
CONTINUE=${CONTINUE:-y} CONTINUE=${CONTINUE:-y}
# Behind NAT, we'll default to the publicly reachable IPv4. # Behind NAT, we'll default to the publicly reachable IPv4/IPv6.
PUBLIC_IPV4=$(curl ifconfig.co) if [[ $IPV6_SUPPORT == "y" ]]; then
ENDPOINT=${ENDPOINT:-$PUBLIC_IPV4} PUBLIC_IP=$(curl https://ifconfig.co)
else
PUBLIC_IP=$(curl -4 https://ifconfig.co)
fi
ENDPOINT=${ENDPOINT:-$PUBLIC_IP}
fi fi
# Run setup questions first, and set other variales if auto-install # Run setup questions first, and set other variales if auto-install
@ -566,51 +582,60 @@ function installOpenVPN () {
# Get the "public" interface from the default route # Get the "public" interface from the default route
NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1) NIC=$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1)
if [[ -z "$NIC" ]] && [[ "$IPV6_SUPPORT" == 'y' ]]; then if [[ -z $NIC ]] && [[ $IPV6_SUPPORT == 'y' ]]; then
NIC=$(ip -6 route show default | sed -ne 's/^default .* dev \([^ ]*\) .*$/\1/p') NIC=$(ip -6 route show default | sed -ne 's/^default .* dev \([^ ]*\) .*$/\1/p')
fi fi
# $NIC can not be empty for script rm-openvpn-rules.sh # $NIC can not be empty for script rm-openvpn-rules.sh
if [[ -z "$NIC" ]]; then if [[ -z $NIC ]]; then
echo echo
echo "Can not detect public interface." echo "Can not detect public interface."
echo "This needs for setup MASQUERADE." echo "This needs for setup MASQUERADE."
until [[ $CONTINUE =~ (y|n) ]]; do until [[ $CONTINUE =~ (y|n) ]]; do
read -rp "Continue? [y/n]: " -e CONTINUE read -rp "Continue? [y/n]: " -e CONTINUE
done done
if [[ "$CONTINUE" == "n" ]]; then if [[ $CONTINUE == "n" ]]; then
exit 1 exit 1
fi fi
fi fi
if [[ "$OS" =~ (debian|ubuntu) ]]; then # If OpenVPN isn't installed yet, install it. This script is more-or-less
# idempotent on multiple runs, but will only install OpenVPN from upstream
# the first time.
if [[ ! -e /etc/openvpn/server.conf ]]; then
if [[ $OS =~ (debian|ubuntu) ]]; then
apt-get update apt-get update
apt-get -y install ca-certificates gnupg apt-get -y install ca-certificates gnupg
# We add the OpenVPN repo to get the latest version. # We add the OpenVPN repo to get the latest version.
if [[ "$VERSION_ID" == "8" ]]; then if [[ $VERSION_ID == "8" ]]; then
echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" >/etc/apt/sources.list.d/openvpn.list
wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
apt-get update apt-get update
fi fi
if [[ "$VERSION_ID" == "16.04" ]]; then if [[ $VERSION_ID == "16.04" ]]; then
echo "deb http://build.openvpn.net/debian/openvpn/stable xenial main" > /etc/apt/sources.list.d/openvpn.list echo "deb http://build.openvpn.net/debian/openvpn/stable xenial main" >/etc/apt/sources.list.d/openvpn.list
wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add -
apt-get update apt-get update
fi fi
# Ubuntu > 16.04 and Debian > 8 have OpenVPN >= 2.4 without the need of a third party repository. # Ubuntu > 16.04 and Debian > 8 have OpenVPN >= 2.4 without the need of a third party repository.
apt-get install -y openvpn iptables openssl wget ca-certificates curl apt-get install -y openvpn iptables openssl wget ca-certificates curl
elif [[ "$OS" == 'centos' ]]; then elif [[ $OS == 'centos' ]]; then
yum install -y epel-release yum install -y epel-release
yum install -y openvpn iptables openssl wget ca-certificates curl tar 'policycoreutils-python*' yum install -y openvpn iptables openssl wget ca-certificates curl tar 'policycoreutils-python*'
elif [[ "$OS" == 'amzn' ]]; then elif [[ $OS == 'amzn' ]]; then
amazon-linux-extras install -y epel amazon-linux-extras install -y epel
yum install -y openvpn iptables openssl wget ca-certificates curl yum install -y openvpn iptables openssl wget ca-certificates curl
elif [[ "$OS" == 'fedora' ]]; then elif [[ $OS == 'fedora' ]]; then
dnf install -y openvpn iptables openssl wget ca-certificates curl dnf install -y openvpn iptables openssl wget ca-certificates curl policycoreutils-python-utils
elif [[ "$OS" == 'arch' ]]; then elif [[ $OS == 'arch' ]]; then
# Install required dependencies and upgrade the system # Install required dependencies and upgrade the system
pacman --needed --noconfirm -Syu openvpn iptables openssl wget ca-certificates curl pacman --needed --noconfirm -Syu openvpn iptables openssl wget ca-certificates curl
fi fi
# An old version of easy-rsa was available by default in some openvpn packages
if [[ -d /etc/openvpn/easy-rsa/ ]]; then
rm -rf /etc/openvpn/easy-rsa/
fi
fi
# Find out if the machine uses nogroup or nobody for the permissionless group # Find out if the machine uses nogroup or nobody for the permissionless group
if grep -qs "^nogroup:" /etc/group; then if grep -qs "^nogroup:" /etc/group; then
@ -619,42 +644,35 @@ function installOpenVPN () {
NOGROUP=nobody NOGROUP=nobody
fi fi
# An old version of easy-rsa was available by default in some openvpn packages # Install the latest version of easy-rsa from source, if not already installed.
if [[ -d /etc/openvpn/easy-rsa/ ]]; then if [[ ! -d /etc/openvpn/easy-rsa/ ]]; then
rm -rf /etc/openvpn/easy-rsa/ local version="3.0.7"
fi wget -O ~/easy-rsa.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v${version}/EasyRSA-${version}.tgz
mkdir /etc/openvpn/easy-rsa
# Install the latest version of easy-rsa from source tar xzf ~/easy-rsa.tgz --strip-components=1 --directory /etc/openvpn/easy-rsa
local version="3.0.6" rm -f ~/easy-rsa.tgz
wget -O ~/EasyRSA-unix-v${version}.tgz https://github.com/OpenVPN/easy-rsa/releases/download/v${version}/EasyRSA-unix-v${version}.tgz
tar xzf ~/EasyRSA-unix-v${version}.tgz -C ~/
mv ~/EasyRSA-v${version} /etc/openvpn/easy-rsa
chown -R root:root /etc/openvpn/easy-rsa/
rm -f ~/EasyRSA-unix-v${version}.tgz
cd /etc/openvpn/easy-rsa/ || return cd /etc/openvpn/easy-rsa/ || return
case $CERT_TYPE in case $CERT_TYPE in
1) 1)
echo "set_var EASYRSA_ALGO ec" > vars echo "set_var EASYRSA_ALGO ec" >vars
echo "set_var EASYRSA_CURVE $CERT_CURVE" >> vars echo "set_var EASYRSA_CURVE $CERT_CURVE" >>vars
;; ;;
2) 2)
echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" >vars
;; ;;
esac esac
# Generate a random, alphanumeric identifier of 16 characters for CN and one for server name # Generate a random, alphanumeric identifier of 16 characters for CN and one for server name
SERVER_CN="cn_$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)" SERVER_CN="cn_$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)"
echo "$SERVER_CN" >SERVER_CN_GENERATED
SERVER_NAME="server_$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)" SERVER_NAME="server_$(head /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 16 | head -n 1)"
echo "set_var EASYRSA_REQ_CN $SERVER_CN" >> vars echo "$SERVER_NAME" >SERVER_NAME_GENERATED
echo "set_var EASYRSA_REQ_CN $SERVER_CN" >>vars
# Create the PKI, set up the CA, the DH params and the server certificate # Create the PKI, set up the CA, the DH params and the server certificate
./easyrsa init-pki ./easyrsa init-pki
# Workaround to remove unharmful error until easy-rsa 3.0.7
# https://github.com/OpenVPN/easy-rsa/issues/261
sed -i 's/^RANDFILE/#RANDFILE/g' pki/openssl-easyrsa.cnf
./easyrsa --batch build-ca nopass ./easyrsa --batch build-ca nopass
if [[ $DH_TYPE == "2" ]]; then if [[ $DH_TYPE == "2" ]]; then
@ -675,6 +693,12 @@ function installOpenVPN () {
openvpn --genkey --secret /etc/openvpn/tls-auth.key openvpn --genkey --secret /etc/openvpn/tls-auth.key
;; ;;
esac esac
else
# If easy-rsa is already installed, grab the generated SERVER_NAME
# for client configs
cd /etc/openvpn/easy-rsa/ || return
SERVER_NAME=$(cat SERVER_NAME_GENERATED)
fi
# Move all the generated files # Move all the generated files
cp pki/ca.crt pki/private/ca.key "pki/issued/$SERVER_NAME.crt" "pki/private/$SERVER_NAME.key" /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn cp pki/ca.crt pki/private/ca.key "pki/issued/$SERVER_NAME.crt" "pki/private/$SERVER_NAME.key" /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn
@ -686,11 +710,11 @@ function installOpenVPN () {
chmod 644 /etc/openvpn/crl.pem chmod 644 /etc/openvpn/crl.pem
# Generate server.conf # Generate server.conf
echo "port $PORT" > /etc/openvpn/server.conf echo "port $PORT" >/etc/openvpn/server.conf
if [[ "$IPV6_SUPPORT" == 'n' ]]; then if [[ $IPV6_SUPPORT == 'n' ]]; then
echo "proto $PROTOCOL" >> /etc/openvpn/server.conf echo "proto $PROTOCOL" >>/etc/openvpn/server.conf
elif [[ "$IPV6_SUPPORT" == 'y' ]]; then elif [[ $IPV6_SUPPORT == 'y' ]]; then
echo "proto ${PROTOCOL}6" >> /etc/openvpn/server.conf echo "proto ${PROTOCOL}6" >>/etc/openvpn/server.conf
fi fi
echo "dev tun echo "dev tun
@ -701,7 +725,7 @@ persist-tun
keepalive 10 120 keepalive 10 120
topology subnet topology subnet
server 10.8.0.0 255.255.255.0 server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf ifconfig-pool-persist ipp.txt" >>/etc/openvpn/server.conf
# DNS resolvers # DNS resolvers
case $DNS in case $DNS in
@ -714,88 +738,94 @@ ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf
RESOLVCONF='/etc/resolv.conf' RESOLVCONF='/etc/resolv.conf'
fi fi
# Obtain the resolvers from resolv.conf and use them for OpenVPN # Obtain the resolvers from resolv.conf and use them for OpenVPN
grep -v '#' $RESOLVCONF | grep 'nameserver' | grep -E -o '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | while read -r line; do sed -ne 's/^nameserver[[:space:]]\+\([^[:space:]]\+\).*$/\1/p' $RESOLVCONF | while read -r line; do
echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server.conf # Copy, if it's a IPv4 |or| if IPv6 is enabled, IPv4/IPv6 does not matter
if [[ $line =~ ^[0-9.]*$ ]] || [[ $IPV6_SUPPORT == 'y' ]]; then
echo "push \"dhcp-option DNS $line\"" >>/etc/openvpn/server.conf
fi
done done
;; ;;
2) # Self-hosted DNS resolver (Unbound) 2) # Self-hosted DNS resolver (Unbound)
echo 'push "dhcp-option DNS 10.8.0.1"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 10.8.0.1"' >>/etc/openvpn/server.conf
if [[ $IPV6_SUPPORT == 'y' ]]; then
echo 'push "dhcp-option DNS fd42:42:42:42::1"' >>/etc/openvpn/server.conf
fi
;; ;;
3) # Cloudflare 3) # Cloudflare
echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 1.0.0.1"' >>/etc/openvpn/server.conf
echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 1.1.1.1"' >>/etc/openvpn/server.conf
;; ;;
4) # Quad9 4) # Quad9
echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 9.9.9.9"' >>/etc/openvpn/server.conf
echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 149.112.112.112"' >>/etc/openvpn/server.conf
;; ;;
5) # Quad9 uncensored 5) # Quad9 uncensored
echo 'push "dhcp-option DNS 9.9.9.10"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 9.9.9.10"' >>/etc/openvpn/server.conf
echo 'push "dhcp-option DNS 149.112.112.10"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 149.112.112.10"' >>/etc/openvpn/server.conf
;; ;;
6) # FDN 6) # FDN
echo 'push "dhcp-option DNS 80.67.169.40"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 80.67.169.40"' >>/etc/openvpn/server.conf
echo 'push "dhcp-option DNS 80.67.169.12"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 80.67.169.12"' >>/etc/openvpn/server.conf
;; ;;
7) # DNS.WATCH 7) # DNS.WATCH
echo 'push "dhcp-option DNS 84.200.69.80"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 84.200.69.80"' >>/etc/openvpn/server.conf
echo 'push "dhcp-option DNS 84.200.70.40"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 84.200.70.40"' >>/etc/openvpn/server.conf
;; ;;
8) # OpenDNS 8) # OpenDNS
echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 208.67.222.222"' >>/etc/openvpn/server.conf
echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 208.67.220.220"' >>/etc/openvpn/server.conf
;; ;;
9) # Google 9) # Google
echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 8.8.8.8"' >>/etc/openvpn/server.conf
echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 8.8.4.4"' >>/etc/openvpn/server.conf
;; ;;
10) # Yandex Basic 10) # Yandex Basic
echo 'push "dhcp-option DNS 77.88.8.8"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 77.88.8.8"' >>/etc/openvpn/server.conf
echo 'push "dhcp-option DNS 77.88.8.1"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 77.88.8.1"' >>/etc/openvpn/server.conf
;; ;;
11) # AdGuard DNS 11) # AdGuard DNS
echo 'push "dhcp-option DNS 176.103.130.130"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 176.103.130.130"' >>/etc/openvpn/server.conf
echo 'push "dhcp-option DNS 176.103.130.131"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 176.103.130.131"' >>/etc/openvpn/server.conf
;; ;;
12) # NextDNS 12) # NextDNS
echo 'push "dhcp-option DNS 45.90.28.167"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 45.90.28.167"' >>/etc/openvpn/server.conf
echo 'push "dhcp-option DNS 45.90.30.167"' >> /etc/openvpn/server.conf echo 'push "dhcp-option DNS 45.90.30.167"' >>/etc/openvpn/server.conf
;; ;;
13) # Custom DNS 13) # Custom DNS
echo "push \"dhcp-option DNS $DNS1\"" >> /etc/openvpn/server.conf echo "push \"dhcp-option DNS $DNS1\"" >>/etc/openvpn/server.conf
if [[ "$DNS2" != "" ]]; then if [[ $DNS2 != "" ]]; then
echo "push \"dhcp-option DNS $DNS2\"" >> /etc/openvpn/server.conf echo "push \"dhcp-option DNS $DNS2\"" >>/etc/openvpn/server.conf
fi fi
;; ;;
esac esac
echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server.conf echo 'push "redirect-gateway def1 bypass-dhcp"' >>/etc/openvpn/server.conf
# IPv6 network settings if needed # IPv6 network settings if needed
if [[ "$IPV6_SUPPORT" == 'y' ]]; then if [[ $IPV6_SUPPORT == 'y' ]]; then
echo 'server-ipv6 fd42:42:42:42::/112 echo 'server-ipv6 fd42:42:42:42::/112
tun-ipv6 tun-ipv6
push tun-ipv6 push tun-ipv6
push "route-ipv6 2000::/3" push "route-ipv6 2000::/3"
push "redirect-gateway ipv6"' >> /etc/openvpn/server.conf push "redirect-gateway ipv6"' >>/etc/openvpn/server.conf
fi fi
if [[ $COMPRESSION_ENABLED == "y" ]]; then if [[ $COMPRESSION_ENABLED == "y" ]]; then
echo "compress $COMPRESSION_ALG" >> /etc/openvpn/server.conf echo "compress $COMPRESSION_ALG" >>/etc/openvpn/server.conf
fi fi
if [[ $DH_TYPE == "1" ]]; then if [[ $DH_TYPE == "1" ]]; then
echo "dh none" >> /etc/openvpn/server.conf echo "dh none" >>/etc/openvpn/server.conf
echo "ecdh-curve $DH_CURVE" >> /etc/openvpn/server.conf echo "ecdh-curve $DH_CURVE" >>/etc/openvpn/server.conf
elif [[ $DH_TYPE == "2" ]]; then elif [[ $DH_TYPE == "2" ]]; then
echo "dh dh.pem" >> /etc/openvpn/server.conf echo "dh dh.pem" >>/etc/openvpn/server.conf
fi fi
case $TLS_SIG in case $TLS_SIG in
1) 1)
echo "tls-crypt tls-crypt.key 0" >> /etc/openvpn/server.conf echo "tls-crypt tls-crypt.key 0" >>/etc/openvpn/server.conf
;; ;;
2) 2)
echo "tls-auth tls-auth.key 0" >> /etc/openvpn/server.conf echo "tls-auth tls-auth.key 0" >>/etc/openvpn/server.conf
;; ;;
esac esac
@ -809,16 +839,19 @@ ncp-ciphers $CIPHER
tls-server tls-server
tls-version-min 1.2 tls-version-min 1.2
tls-cipher $CC_CIPHER tls-cipher $CC_CIPHER
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log status /var/log/openvpn/status.log
verb 3" >> /etc/openvpn/server.conf verb 3" >>/etc/openvpn/server.conf
# Create client-config-dir dir
mkdir -p /etc/openvpn/ccd
# Create log dir # Create log dir
mkdir -p /var/log/openvpn mkdir -p /var/log/openvpn
# Enable routing # Enable routing
echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.d/20-openvpn.conf echo 'net.ipv4.ip_forward=1' >/etc/sysctl.d/20-openvpn.conf
if [[ "$IPV6_SUPPORT" == 'y' ]]; then if [[ $IPV6_SUPPORT == 'y' ]]; then
echo 'net.ipv6.conf.all.forwarding=1' >> /etc/sysctl.d/20-openvpn.conf echo 'net.ipv6.conf.all.forwarding=1' >>/etc/sysctl.d/20-openvpn.conf
fi fi
# Apply sysctl rules # Apply sysctl rules
sysctl --system sysctl --system
@ -826,14 +859,14 @@ verb 3" >> /etc/openvpn/server.conf
# If SELinux is enabled and a custom port was selected, we need this # If SELinux is enabled and a custom port was selected, we need this
if hash sestatus 2>/dev/null; then if hash sestatus 2>/dev/null; then
if sestatus | grep "Current mode" | grep -qs "enforcing"; then if sestatus | grep "Current mode" | grep -qs "enforcing"; then
if [[ "$PORT" != '1194' ]]; then if [[ $PORT != '1194' ]]; then
semanage port -a -t openvpn_port_t -p "$PROTOCOL" "$PORT" semanage port -a -t openvpn_port_t -p "$PROTOCOL" "$PORT"
fi fi
fi fi
fi fi
# Finally, restart and enable OpenVPN # Finally, restart and enable OpenVPN
if [[ "$OS" == 'arch' || "$OS" == 'fedora' || "$OS" == 'centos' ]]; then if [[ $OS == 'arch' || $OS == 'fedora' || $OS == 'centos' ]]; then
# Don't modify package-provided service # Don't modify package-provided service
cp /usr/lib/systemd/system/openvpn-server@.service /etc/systemd/system/openvpn-server@.service cp /usr/lib/systemd/system/openvpn-server@.service /etc/systemd/system/openvpn-server@.service
@ -842,14 +875,14 @@ verb 3" >> /etc/openvpn/server.conf
# Another workaround to keep using /etc/openvpn/ # Another workaround to keep using /etc/openvpn/
sed -i 's|/etc/openvpn/server|/etc/openvpn|' /etc/systemd/system/openvpn-server@.service sed -i 's|/etc/openvpn/server|/etc/openvpn|' /etc/systemd/system/openvpn-server@.service
# On fedora, the service hardcodes the ciphers. We want to manage the cipher ourselves, so we remove it from the service # On fedora, the service hardcodes the ciphers. We want to manage the cipher ourselves, so we remove it from the service
if [[ "$OS" == "fedora" ]];then if [[ $OS == "fedora" ]]; then
sed -i 's|--cipher AES-256-GCM --ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC||' /etc/systemd/system/openvpn-server@.service sed -i 's|--cipher AES-256-GCM --ncp-ciphers AES-256-GCM:AES-128-GCM:AES-256-CBC:AES-128-CBC:BF-CBC||' /etc/systemd/system/openvpn-server@.service
fi fi
systemctl daemon-reload systemctl daemon-reload
systemctl enable openvpn-server@server systemctl enable openvpn-server@server
systemctl restart openvpn-server@server systemctl restart openvpn-server@server
elif [[ "$OS" == "ubuntu" ]] && [[ "$VERSION_ID" == "16.04" ]]; then elif [[ $OS == "ubuntu" ]] && [[ $VERSION_ID == "16.04" ]]; then
# On Ubuntu 16.04, we use the package from the OpenVPN repo # On Ubuntu 16.04, we use the package from the OpenVPN repo
# This package uses a sysvinit service # This package uses a sysvinit service
systemctl enable openvpn systemctl enable openvpn
@ -868,7 +901,7 @@ verb 3" >> /etc/openvpn/server.conf
systemctl restart openvpn@server systemctl restart openvpn@server
fi fi
if [[ $DNS == 2 ]];then if [[ $DNS == 2 ]]; then
installUnbound installUnbound
fi fi
@ -881,13 +914,14 @@ iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o $NIC -j MASQUERADE
iptables -I INPUT 1 -i tun0 -j ACCEPT iptables -I INPUT 1 -i tun0 -j ACCEPT
iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT
iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT
iptables -I INPUT 1 -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" > /etc/iptables/add-openvpn-rules.sh iptables -I INPUT 1 -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" >/etc/iptables/add-openvpn-rules.sh
if [[ "$IPV6_SUPPORT" == 'y' ]]; then if [[ $IPV6_SUPPORT == 'y' ]]; then
echo "ip6tables -t nat -I POSTROUTING 1 -s fd42:42:42:42::/112 -o $NIC -j MASQUERADE echo "ip6tables -t nat -I POSTROUTING 1 -s fd42:42:42:42::/112 -o $NIC -j MASQUERADE
ip6tables -I INPUT 1 -i tun0 -j ACCEPT ip6tables -I INPUT 1 -i tun0 -j ACCEPT
ip6tables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT ip6tables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT
ip6tables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT" >> /etc/iptables/add-openvpn-rules.sh ip6tables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT
ip6tables -I INPUT 1 -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" >>/etc/iptables/add-openvpn-rules.sh
fi fi
# Script to remove rules # Script to remove rules
@ -896,13 +930,14 @@ iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE
iptables -D INPUT -i tun0 -j ACCEPT iptables -D INPUT -i tun0 -j ACCEPT
iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT
iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT
iptables -D INPUT -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" > /etc/iptables/rm-openvpn-rules.sh iptables -D INPUT -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" >/etc/iptables/rm-openvpn-rules.sh
if [[ "$IPV6_SUPPORT" == 'y' ]]; then if [[ $IPV6_SUPPORT == 'y' ]]; then
echo "ip6tables -t nat -D POSTROUTING -s fd42:42:42:42::/112 -o $NIC -j MASQUERADE echo "ip6tables -t nat -D POSTROUTING -s fd42:42:42:42::/112 -o $NIC -j MASQUERADE
ip6tables -D INPUT -i tun0 -j ACCEPT ip6tables -D INPUT -i tun0 -j ACCEPT
ip6tables -D FORWARD -i $NIC -o tun0 -j ACCEPT ip6tables -D FORWARD -i $NIC -o tun0 -j ACCEPT
ip6tables -D FORWARD -i tun0 -o $NIC -j ACCEPT" >> /etc/iptables/rm-openvpn-rules.sh ip6tables -D FORWARD -i tun0 -o $NIC -j ACCEPT
ip6tables -D INPUT -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" >>/etc/iptables/rm-openvpn-rules.sh
fi fi
chmod +x /etc/iptables/add-openvpn-rules.sh chmod +x /etc/iptables/add-openvpn-rules.sh
@ -921,7 +956,7 @@ ExecStop=/etc/iptables/rm-openvpn-rules.sh
RemainAfterExit=yes RemainAfterExit=yes
[Install] [Install]
WantedBy=multi-user.target" > /etc/systemd/system/iptables-openvpn.service WantedBy=multi-user.target" >/etc/systemd/system/iptables-openvpn.service
# Enable service and apply rules # Enable service and apply rules
systemctl daemon-reload systemctl daemon-reload
@ -929,17 +964,17 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables-openvpn.service
systemctl start iptables-openvpn systemctl start iptables-openvpn
# If the server is behind a NAT, use the correct IP address for the clients to connect to # If the server is behind a NAT, use the correct IP address for the clients to connect to
if [[ "$ENDPOINT" != "" ]]; then if [[ $ENDPOINT != "" ]]; then
IP=$ENDPOINT IP=$ENDPOINT
fi fi
# client-template.txt is created so we have a template to add further users later # client-template.txt is created so we have a template to add further users later
echo "client" > /etc/openvpn/client-template.txt echo "client" >/etc/openvpn/client-template.txt
if [[ "$PROTOCOL" == 'udp' ]]; then if [[ $PROTOCOL == 'udp' ]]; then
echo "proto udp" >> /etc/openvpn/client-template.txt echo "proto udp" >>/etc/openvpn/client-template.txt
echo "explicit-exit-notify" >> /etc/openvpn/client-template.txt echo "explicit-exit-notify" >>/etc/openvpn/client-template.txt
elif [[ "$PROTOCOL" == 'tcp' ]]; then elif [[ $PROTOCOL == 'tcp' ]]; then
echo "proto tcp-client" >> /etc/openvpn/client-template.txt echo "proto tcp-client" >>/etc/openvpn/client-template.txt
fi fi
echo "remote $IP $PORT echo "remote $IP $PORT
dev tun dev tun
@ -955,24 +990,25 @@ cipher $CIPHER
tls-client tls-client
tls-version-min 1.2 tls-version-min 1.2
tls-cipher $CC_CIPHER tls-cipher $CC_CIPHER
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3" >> /etc/openvpn/client-template.txt verb 3" >>/etc/openvpn/client-template.txt
if [[ $COMPRESSION_ENABLED == "y" ]]; then if [[ $COMPRESSION_ENABLED == "y" ]]; then
echo "compress $COMPRESSION_ALG" >> /etc/openvpn/client-template.txt echo "compress $COMPRESSION_ALG" >>/etc/openvpn/client-template.txt
fi fi
# Generate the custom client.ovpn # Generate the custom client.ovpn
newClient newClient
echo "If you want to add more clients, you simply need to run this script another time!" echo "If you want to add more clients, you simply need to run this script another time!"
} }
function newClient () { function newClient() {
echo "" echo ""
echo "Tell me a name for the client." echo "Tell me a name for the client."
echo "Use one word only, no special characters." echo "Use one word only, no special characters."
until [[ "$CLIENT" =~ ^[a-zA-Z0-9_]+$ ]]; do until [[ $CLIENT =~ ^[a-zA-Z0-9_]+$ ]]; do
read -rp "Client name: " -e CLIENT read -rp "Client name: " -e CLIENT
done done
@ -982,10 +1018,16 @@ function newClient () {
echo " 1) Add a passwordless client" echo " 1) Add a passwordless client"
echo " 2) Use a password for the client" echo " 2) Use a password for the client"
until [[ "$PASS" =~ ^[1-2]$ ]]; do until [[ $PASS =~ ^[1-2]$ ]]; do
read -rp "Select an option [1-2]: " -e -i 1 PASS read -rp "Select an option [1-2]: " -e -i 1 PASS
done done
CLIENTEXISTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c -E "/CN=$CLIENT\$")
if [[ $CLIENTEXISTS == '1' ]]; then
echo ""
echo "The specified client CN was already found in easy-rsa, please choose another name."
exit
else
cd /etc/openvpn/easy-rsa/ || return cd /etc/openvpn/easy-rsa/ || return
case $PASS in case $PASS in
1) 1)
@ -996,6 +1038,8 @@ function newClient () {
./easyrsa build-client-full "$CLIENT" ./easyrsa build-client-full "$CLIENT"
;; ;;
esac esac
echo "Client $CLIENT added."
fi
# Home directory of the user, where the client configuration (.ovpn) will be written # Home directory of the user, where the client configuration (.ovpn) will be written
if [ -e "/home/$CLIENT" ]; then # if $1 is a user name if [ -e "/home/$CLIENT" ]; then # if $1 is a user name
@ -1041,18 +1085,18 @@ function newClient () {
echo "</tls-auth>" echo "</tls-auth>"
;; ;;
esac esac
} >> "$homeDir/$CLIENT.ovpn" } >>"$homeDir/$CLIENT.ovpn"
echo "" echo ""
echo "Client $CLIENT added, the configuration file is available at $homeDir/$CLIENT.ovpn." echo "The configuration file has been written to $homeDir/$CLIENT.ovpn."
echo "Download the .ovpn file and import it in your OpenVPN client." echo "Download the .ovpn file and import it in your OpenVPN client."
exit 0 exit 0
} }
function revokeClient () { function revokeClient() {
NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V") NUMBEROFCLIENTS=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep -c "^V")
if [[ "$NUMBEROFCLIENTS" == '0' ]]; then if [[ $NUMBEROFCLIENTS == '0' ]]; then
echo "" echo ""
echo "You have no existing clients!" echo "You have no existing clients!"
exit 1 exit 1
@ -1061,20 +1105,17 @@ function revokeClient () {
echo "" echo ""
echo "Select the existing client certificate you want to revoke" echo "Select the existing client certificate you want to revoke"
tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
if [[ "$NUMBEROFCLIENTS" == '1' ]]; then until [[ $CLIENTNUMBER -ge 1 && $CLIENTNUMBER -le $NUMBEROFCLIENTS ]]; do
if [[ $CLIENTNUMBER == '1' ]]; then
read -rp "Select one client [1]: " CLIENTNUMBER read -rp "Select one client [1]: " CLIENTNUMBER
else else
read -rp "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER read -rp "Select one client [1-$NUMBEROFCLIENTS]: " CLIENTNUMBER
fi fi
done
CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p) CLIENT=$(tail -n +2 /etc/openvpn/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$CLIENTNUMBER"p)
cd /etc/openvpn/easy-rsa/ || return cd /etc/openvpn/easy-rsa/ || return
./easyrsa --batch revoke "$CLIENT" ./easyrsa --batch revoke "$CLIENT"
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
# Cleanup
rm -f "pki/reqs/$CLIENT.req"
rm -f "pki/private/$CLIENT.key"
rm -f "pki/issued/$CLIENT.crt"
rm -f /etc/openvpn/crl.pem rm -f /etc/openvpn/crl.pem
cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem cp /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn/crl.pem
chmod 644 /etc/openvpn/crl.pem chmod 644 /etc/openvpn/crl.pem
@ -1086,7 +1127,7 @@ function revokeClient () {
echo "Certificate for client $CLIENT revoked." echo "Certificate for client $CLIENT revoked."
} }
function removeUnbound () { function removeUnbound() {
# Remove OpenVPN-related config # Remove OpenVPN-related config
sed -i '/include: \/etc\/unbound\/unbound\.conf\.d\/openvpn\.conf/d' /etc/unbound/unbound.conf sed -i '/include: \/etc\/unbound\/unbound\.conf\.d\/openvpn\.conf/d' /etc/unbound/unbound.conf
rm /etc/unbound/unbound.conf.d/openvpn.conf rm /etc/unbound/unbound.conf.d/openvpn.conf
@ -1097,17 +1138,17 @@ function removeUnbound () {
read -rp "Do you want to completely remove Unbound? [y/n]: " -e REMOVE_UNBOUND read -rp "Do you want to completely remove Unbound? [y/n]: " -e REMOVE_UNBOUND
done done
if [[ "$REMOVE_UNBOUND" == 'y' ]]; then if [[ $REMOVE_UNBOUND == 'y' ]]; then
# Stop Unbound # Stop Unbound
systemctl stop unbound systemctl stop unbound
if [[ "$OS" =~ (debian|ubuntu) ]]; then if [[ $OS =~ (debian|ubuntu) ]]; then
apt-get autoremove --purge -y unbound apt-get autoremove --purge -y unbound
elif [[ "$OS" == 'arch' ]]; then elif [[ $OS == 'arch' ]]; then
pacman --noconfirm -R unbound pacman --noconfirm -R unbound
elif [[ "$OS" =~ (centos|amzn) ]]; then elif [[ $OS =~ (centos|amzn) ]]; then
yum remove -y unbound yum remove -y unbound
elif [[ "$OS" == 'fedora' ]]; then elif [[ $OS == 'fedora' ]]; then
dnf remove -y unbound dnf remove -y unbound
fi fi
@ -1122,21 +1163,22 @@ function removeUnbound () {
fi fi
} }
function removeOpenVPN () { function removeOpenVPN() {
echo "" echo ""
# shellcheck disable=SC2034 # shellcheck disable=SC2034
read -rp "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE read -rp "Do you really want to remove OpenVPN? [y/n]: " -e -i n REMOVE
if [[ "$REMOVE" == 'y' ]]; then if [[ $REMOVE == 'y' ]]; then
# Get OpenVPN port from the configuration # Get OpenVPN port from the configuration
PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2) PORT=$(grep '^port ' /etc/openvpn/server.conf | cut -d " " -f 2)
PROTOCOL=$(grep '^proto ' /etc/openvpn/server.conf | cut -d " " -f 2)
# Stop OpenVPN # Stop OpenVPN
if [[ "$OS" =~ (fedora|arch|centos) ]]; then if [[ $OS =~ (fedora|arch|centos) ]]; then
systemctl disable openvpn-server@server systemctl disable openvpn-server@server
systemctl stop openvpn-server@server systemctl stop openvpn-server@server
# Remove customised service # Remove customised service
rm /etc/systemd/system/openvpn-server@.service rm /etc/systemd/system/openvpn-server@.service
elif [[ "$OS" == "ubuntu" ]] && [[ "$VERSION_ID" == "16.04" ]]; then elif [[ $OS == "ubuntu" ]] && [[ $VERSION_ID == "16.04" ]]; then
systemctl disable openvpn systemctl disable openvpn
systemctl stop openvpn systemctl stop openvpn
else else
@ -1158,23 +1200,23 @@ function removeOpenVPN () {
# SELinux # SELinux
if hash sestatus 2>/dev/null; then if hash sestatus 2>/dev/null; then
if sestatus | grep "Current mode" | grep -qs "enforcing"; then if sestatus | grep "Current mode" | grep -qs "enforcing"; then
if [[ "$PORT" != '1194' ]]; then if [[ $PORT != '1194' ]]; then
semanage port -d -t openvpn_port_t -p udp "$PORT" semanage port -d -t openvpn_port_t -p "$PROTOCOL" "$PORT"
fi fi
fi fi
fi fi
if [[ "$OS" =~ (debian|ubuntu) ]]; then if [[ $OS =~ (debian|ubuntu) ]]; then
apt-get autoremove --purge -y openvpn apt-get autoremove --purge -y openvpn
if [[ -e /etc/apt/sources.list.d/openvpn.list ]];then if [[ -e /etc/apt/sources.list.d/openvpn.list ]]; then
rm /etc/apt/sources.list.d/openvpn.list rm /etc/apt/sources.list.d/openvpn.list
apt-get update apt-get update
fi fi
elif [[ "$OS" == 'arch' ]]; then elif [[ $OS == 'arch' ]]; then
pacman --noconfirm -R openvpn pacman --noconfirm -R openvpn
elif [[ "$OS" =~ (centos|amzn) ]]; then elif [[ $OS =~ (centos|amzn) ]]; then
yum remove -y openvpn yum remove -y openvpn
elif [[ "$OS" == 'fedora' ]]; then elif [[ $OS == 'fedora' ]]; then
dnf remove -y openvpn dnf remove -y openvpn
fi fi
@ -1198,8 +1240,7 @@ function removeOpenVPN () {
fi fi
} }
function manageMenu () { function manageMenu() {
clear
echo "Welcome to OpenVPN-install!" echo "Welcome to OpenVPN-install!"
echo "The git repository is available at: https://github.com/angristan/openvpn-install" echo "The git repository is available at: https://github.com/angristan/openvpn-install"
echo "" echo ""
@ -1210,7 +1251,7 @@ function manageMenu () {
echo " 2) Revoke existing user" echo " 2) Revoke existing user"
echo " 3) Remove OpenVPN" echo " 3) Remove OpenVPN"
echo " 4) Exit" echo " 4) Exit"
until [[ "$MENU_OPTION" =~ ^[1-4]$ ]]; do until [[ $MENU_OPTION =~ ^[1-4]$ ]]; do
read -rp "Select an option [1-4]: " MENU_OPTION read -rp "Select an option [1-4]: " MENU_OPTION
done done
@ -1234,7 +1275,7 @@ function manageMenu () {
initialCheck initialCheck
# Check if OpenVPN is already installed # Check if OpenVPN is already installed
if [[ -e /etc/openvpn/server.conf ]]; then if [[ -e /etc/openvpn/server.conf && $AUTO_INSTALL != "y" ]]; then
manageMenu manageMenu
else else
installOpenVPN installOpenVPN