Bernhard.Linz/openvpn-install
1
0
Fork 0
mirror of https://github.com/angristan/openvpn-install.git synced 2025-05-09 18:28:23 +02:00
Code Issues Projects Releases Wiki Activity

Merge 3478c773f0938e777167297a0555ce4d8edccb33 into e2d4990ae194e37fd5162168a8aac5e2d89e0e8d

Browse Source
This commit is contained in:
joaduo 2025-02-06 22:01:15 +08:00 committed by GitHub
commit 3a071f8382
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 43 additions and 26 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

67
openvpn-install.sh
View File

@ -112,19 +112,19 @@ function installUnbound() {
apt-get install -y unbound apt-get install -y unbound
# Configuration # Configuration
echo 'interface: 10.8.0.1 echo "interface: $VPN_NETWORK.1
access-control: 10.8.0.1/24 allow access-control: $VPN_NETWORK.1/24 allow
hide-identity: yes hide-identity: yes
hide-version: yes hide-version: yes
use-caps-for-id: yes use-caps-for-id: yes
prefetch: yes' >>/etc/unbound/unbound.conf prefetch: yes" >>/etc/unbound/unbound.conf
elif [[ $OS =~ (centos|amzn|oracle) ]]; then elif [[ $OS =~ (centos|amzn|oracle) ]]; then
yum install -y unbound yum install -y unbound
# Configuration # Configuration
sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf sed -i "s|# interface: 0.0.0.0$|interface: $VPN_NETWORK.1|" /etc/unbound/unbound.conf
sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf sed -i "s|# access-control: 127.0.0.0/8 allow|access-control: $VPN_NETWORK.1/24 allow|" /etc/unbound/unbound.conf
sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf
sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf
sed -i 's|use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf sed -i 's|use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf
@ -133,8 +133,8 @@ prefetch: yes' >>/etc/unbound/unbound.conf
dnf install -y unbound dnf install -y unbound
# Configuration # Configuration
sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf sed -i "s|# interface: 0.0.0.0$|interface: $VPN_NETWORK.1|" /etc/unbound/unbound.conf
sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf sed -i "s|# access-control: 127.0.0.0/8 allow|access-control: $VPN_NETWORK.1/24 allow|" /etc/unbound/unbound.conf
sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf
sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf
sed -i 's|# use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf sed -i 's|# use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf
@ -149,15 +149,15 @@ prefetch: yes' >>/etc/unbound/unbound.conf
mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.old mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.old
fi fi
echo 'server: echo "server:
use-syslog: yes use-syslog: yes
do-daemonize: no do-daemonize: no
username: "unbound" username: \"unbound\"
directory: "/etc/unbound" directory: \"/etc/unbound\"
trust-anchor-file: trusted-key.key trust-anchor-file: trusted-key.key
root-hints: root.hints root-hints: root.hints
interface: 10.8.0.1 interface: $VPN_NETWORK.1
access-control: 10.8.0.1/24 allow access-control: $VPN_NETWORK.1/24 allow
port: 53 port: 53
num-threads: 2 num-threads: 2
use-caps-for-id: yes use-caps-for-id: yes
@ -165,7 +165,7 @@ prefetch: yes' >>/etc/unbound/unbound.conf
hide-identity: yes hide-identity: yes
hide-version: yes hide-version: yes
qname-minimisation: yes qname-minimisation: yes
prefetch: yes' >/etc/unbound/unbound.conf prefetch: yes" >/etc/unbound/unbound.conf
fi fi
# IPv6 DNS for all OS # IPv6 DNS for all OS
@ -190,9 +190,9 @@ private-address: ::ffff:0:0/96" >>/etc/unbound/unbound.conf
echo 'include: /etc/unbound/openvpn.conf' >>/etc/unbound/unbound.conf echo 'include: /etc/unbound/openvpn.conf' >>/etc/unbound/unbound.conf
# Add Unbound 'server' for the OpenVPN subnet # Add Unbound 'server' for the OpenVPN subnet
echo 'server: echo "server:
interface: 10.8.0.1 interface: $VPN_NETWORK.1
access-control: 10.8.0.1/24 allow access-control: $VPN_NETWORK.1/24 allow
hide-identity: yes hide-identity: yes
hide-version: yes hide-version: yes
use-caps-for-id: yes use-caps-for-id: yes
@ -205,7 +205,7 @@ private-address: 169.254.0.0/16
private-address: fd00::/8 private-address: fd00::/8
private-address: fe80::/10 private-address: fe80::/10
private-address: 127.0.0.0/8 private-address: 127.0.0.0/8
private-address: ::ffff:0:0/96' >/etc/unbound/openvpn.conf private-address: ::ffff:0:0/96" >/etc/unbound/openvpn.conf
if [[ $IPV6_SUPPORT == 'y' ]]; then if [[ $IPV6_SUPPORT == 'y' ]]; then
echo 'interface: fd42:42:42:42::1 echo 'interface: fd42:42:42:42::1
access-control: fd42:42:42:42::/112 allow' >>/etc/unbound/openvpn.conf access-control: fd42:42:42:42::/112 allow' >>/etc/unbound/openvpn.conf
@ -263,9 +263,15 @@ function installQuestions() {
echo "I need to ask you a few questions before starting the setup." echo "I need to ask you a few questions before starting the setup."
echo "You can leave the default options and just press enter if you are ok with them." echo "You can leave the default options and just press enter if you are ok with them."
echo "" echo ""
echo "Please provide the VPN network prefix. If you are going to use 10.8.0.0/24, then type prefix 10.8.0"
until [[ $VPN_NETWORK =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){2}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ ]]; do
echo "Format must be like XXX.XXX.XXX"
read -rp "VPN_NETWORK: " -e -i "$VPN_NETWORK" VPN_NETWORK
done
echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to." echo "I need to know the IPv4 address of the network interface you want OpenVPN listening to."
echo "Unless your server is behind NAT, it should be your public IPv4 address." echo "Unless your server is behind NAT, it should be your public IPv4 address."
# Detect public IPv4 address and pre-fill for the user # Detect public IPv4 address and pre-fill for the user
IP=$(ip -4 addr | sed -ne 's|^.* inet \([^/]*\)/.* scope global.*$|\1|p' | head -1) IP=$(ip -4 addr | sed -ne 's|^.* inet \([^/]*\)/.* scope global.*$|\1|p' | head -1)
@ -367,8 +373,9 @@ function installQuestions() {
echo " 11) AdGuard DNS (Anycast: worldwide)" echo " 11) AdGuard DNS (Anycast: worldwide)"
echo " 12) NextDNS (Anycast: worldwide)" echo " 12) NextDNS (Anycast: worldwide)"
echo " 13) Custom" echo " 13) Custom"
until [[ $DNS =~ ^[0-9]+$ ]] && [ "$DNS" -ge 1 ] && [ "$DNS" -le 13 ]; do echo " 14) No DNS server and No traffic redirection to VPN"
read -rp "DNS [1-12]: " -e -i 11 DNS until [[ $DNS =~ ^[0-9]+$ ]] && [ "$DNS" -ge 1 ] && [ "$DNS" -le 14 ]; do
read -rp "DNS [1-14]: " -e -i 11 DNS
if [[ $DNS == 2 ]] && [[ -e /etc/unbound/unbound.conf ]]; then if [[ $DNS == 2 ]] && [[ -e /etc/unbound/unbound.conf ]]; then
echo "" echo ""
echo "Unbound is already installed." echo "Unbound is already installed."
@ -658,6 +665,7 @@ function installOpenVPN() {
APPROVE_INSTALL=${APPROVE_INSTALL:-y} APPROVE_INSTALL=${APPROVE_INSTALL:-y}
APPROVE_IP=${APPROVE_IP:-y} APPROVE_IP=${APPROVE_IP:-y}
IPV6_SUPPORT=${IPV6_SUPPORT:-n} IPV6_SUPPORT=${IPV6_SUPPORT:-n}
VPN_NETWORK=${VPN_NETWORK:-10.8.0}
PORT_CHOICE=${PORT_CHOICE:-1} PORT_CHOICE=${PORT_CHOICE:-1}
PROTOCOL_CHOICE=${PROTOCOL_CHOICE:-1} PROTOCOL_CHOICE=${PROTOCOL_CHOICE:-1}
DNS=${DNS:-1} DNS=${DNS:-1}
@ -816,7 +824,7 @@ persist-key
persist-tun persist-tun
keepalive 10 120 keepalive 10 120
topology subnet topology subnet
server 10.8.0.0 255.255.255.0 server $VPN_NETWORK.0 255.255.255.0
ifconfig-pool-persist ipp.txt" >>/etc/openvpn/server.conf ifconfig-pool-persist ipp.txt" >>/etc/openvpn/server.conf
# DNS resolvers # DNS resolvers
@ -838,7 +846,7 @@ ifconfig-pool-persist ipp.txt" >>/etc/openvpn/server.conf
done done
;; ;;
2) # Self-hosted DNS resolver (Unbound) 2) # Self-hosted DNS resolver (Unbound)
echo 'push "dhcp-option DNS 10.8.0.1"' >>/etc/openvpn/server.conf echo "push \"dhcp-option DNS $VPN_NETWORK.1\"" >>/etc/openvpn/server.conf
if [[ $IPV6_SUPPORT == 'y' ]]; then if [[ $IPV6_SUPPORT == 'y' ]]; then
echo 'push "dhcp-option DNS fd42:42:42:42::1"' >>/etc/openvpn/server.conf echo 'push "dhcp-option DNS fd42:42:42:42::1"' >>/etc/openvpn/server.conf
fi fi
@ -889,8 +897,13 @@ ifconfig-pool-persist ipp.txt" >>/etc/openvpn/server.conf
echo "push \"dhcp-option DNS $DNS2\"" >>/etc/openvpn/server.conf echo "push \"dhcp-option DNS $DNS2\"" >>/etc/openvpn/server.conf
fi fi
;; ;;
14) # No DNS
echo "No DNS push config"
;;
esac esac
if [[ $DNS != 14 ]]; then
echo 'push "redirect-gateway def1 bypass-dhcp"' >>/etc/openvpn/server.conf echo 'push "redirect-gateway def1 bypass-dhcp"' >>/etc/openvpn/server.conf
fi
# IPv6 network settings if needed # IPv6 network settings if needed
if [[ $IPV6_SUPPORT == 'y' ]]; then if [[ $IPV6_SUPPORT == 'y' ]]; then
@ -998,7 +1011,7 @@ verb 3" >>/etc/openvpn/server.conf
# Script to add rules # Script to add rules
echo "#!/bin/sh echo "#!/bin/sh
iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o $NIC -j MASQUERADE iptables -t nat -I POSTROUTING 1 -s $VPN_NETWORK.0/24 -o $NIC -j MASQUERADE
iptables -I INPUT 1 -i tun0 -j ACCEPT iptables -I INPUT 1 -i tun0 -j ACCEPT
iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT
iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT
@ -1014,7 +1027,7 @@ ip6tables -I INPUT 1 -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" >>/etc/iptabl
# Script to remove rules # Script to remove rules
echo "#!/bin/sh echo "#!/bin/sh
iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE iptables -t nat -D POSTROUTING -s $VPN_NETWORK.0/24 -o $NIC -j MASQUERADE
iptables -D INPUT -i tun0 -j ACCEPT iptables -D INPUT -i tun0 -j ACCEPT
iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT
iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT
@ -1081,10 +1094,14 @@ tls-cipher $CC_CIPHER
ignore-unknown-option block-outside-dns ignore-unknown-option block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak setenv opt block-outside-dns # Prevent Windows 10 DNS leak
verb 3" >>/etc/openvpn/client-template.txt verb 3" >>/etc/openvpn/client-template.txt
if [[ $COMPRESSION_ENABLED == "y" ]]; then if [[ $COMPRESSION_ENABLED == "y" ]]; then
echo "compress $COMPRESSION_ALG" >>/etc/openvpn/client-template.txt echo "compress $COMPRESSION_ALG" >>/etc/openvpn/client-template.txt
fi fi
if [[ $CLIENT_TEMPLATE_APPEND != "" ]]; then
echo "appending costum config CLIENT_TEMPLATE_APPEND to /etc/openvpn/client-template.txt ..."
echo "" >>/etc/openvpn/client-template.txt
echo "$CLIENT_TEMPLATE_APPEND" >>/etc/openvpn/client-template.txt
fi
# Generate the custom client.ovpn # Generate the custom client.ovpn
newClient newClient