From 7841a1801d5622a7d310d0f4d71901a9d976eb35 Mon Sep 17 00:00:00 2001 From: Unknown Date: Fri, 28 Feb 2020 17:23:36 -0500 Subject: [PATCH 1/6] Add custom IP range --- openvpn-install.sh | 46 ++++++++++++++++++++++++++++++++-------------- 1 file changed, 32 insertions(+), 14 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 90ea433..c38d142 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -104,8 +104,8 @@ function installUnbound () { apt-get install -y unbound # Configuration - echo 'interface: 10.8.0.1 -access-control: 10.8.0.1/24 allow + echo 'interface: ${VAR: : -1}1 +access-control: ${VAR: : -1}1/24 allow hide-identity: yes hide-version: yes use-caps-for-id: yes @@ -115,8 +115,8 @@ prefetch: yes' >> /etc/unbound/unbound.conf yum install -y unbound # Configuration - sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf - sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf + sed -i 's|# interface: 0.0.0.0$|interface: ${VAR: : -1}1|' /etc/unbound/unbound.conf + sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: ${VAR: : -1}1/24 allow|' /etc/unbound/unbound.conf sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf sed -i 's|use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf @@ -125,8 +125,8 @@ prefetch: yes' >> /etc/unbound/unbound.conf dnf install -y unbound # Configuration - sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf - sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf + sed -i 's|# interface: 0.0.0.0$|interface: ${VAR: : -1}1|' /etc/unbound/unbound.conf + sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: ${VAR: : -1}1/24 allow|' /etc/unbound/unbound.conf sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf sed -i 's|# use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf @@ -146,8 +146,8 @@ prefetch: yes' >> /etc/unbound/unbound.conf directory: "/etc/unbound" trust-anchor-file: trusted-key.key root-hints: root.hints - interface: 10.8.0.1 - access-control: 10.8.0.1/24 allow + interface: ${VAR: : -1}1 + access-control: ${VAR: : -1}1/24 allow port: 53 num-threads: 2 use-caps-for-id: yes @@ -174,8 +174,8 @@ private-address: ::ffff:0:0/96" >> /etc/unbound/unbound.conf # Add Unbound 'server' for the OpenVPN subnet echo 'server: -interface: 10.8.0.1 -access-control: 10.8.0.1/24 allow +interface: ${VAR: : -1}1 +access-control: ${VAR: : -1}1/24 allow hide-identity: yes hide-version: yes use-caps-for-id: yes @@ -243,6 +243,23 @@ function installQuestions () { read -rp "Do you want to enable IPv6 support (NAT)? [y/n]: " -e -i $SUGGESTION IPV6_SUPPORT done echo "" + echo "What IP range settings do you want OpenVPN to use?" + echo " 1) Default: 10.8.0.0" + echo " 2) Custom" + until [[ "$IP_CHOICE" =~ ^[1-2]$ ]]; do + read -rp "IP choice [1-2]: " -e -i 1 IP_CHOICE + done + case $IP_CHOICE in + 1) + IP_RANGE="10.8.0.0" + ;; + 2) + until [[ "$IP_RANGE" =~ ^([0-9]{1,3}\.){3}0$ ]]; do + read -rp "Custom IP [x.x.x.0]: " -e -i 10.8.0.0 IP_RANGE + done + ;; + esac + echo "" echo "What port do you want OpenVPN to listen to?" echo " 1) Default: 1194" echo " 2) Custom" @@ -586,6 +603,7 @@ function installOpenVPN () { APPROVE_INSTALL=${APPROVE_INSTALL:-y} APPROVE_IP=${APPROVE_IP:-y} IPV6_SUPPORT=${IPV6_SUPPORT:-n} + IP_CHOICE=${IP_CHOICE:-1} PORT_CHOICE=${PORT_CHOICE:-1} PROTOCOL_CHOICE=${PROTOCOL_CHOICE:-1} DNS=${DNS:-1} @@ -723,7 +741,7 @@ persist-key persist-tun keepalive 10 120 topology subnet -server 10.8.0.0 255.255.255.0 +server $IP_RANGE 255.255.255.0 ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf # DNS resolvers @@ -742,7 +760,7 @@ ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf done ;; 2) - echo 'push "dhcp-option DNS 10.8.0.1"' >> /etc/openvpn/server.conf + echo 'push "dhcp-option DNS ${VAR: : -1}1"' >> /etc/openvpn/server.conf ;; 3) # Cloudflare echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server.conf @@ -896,7 +914,7 @@ verb 3" >> /etc/openvpn/server.conf # Script to add rules echo "#!/bin/sh -iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o $NIC -j MASQUERADE +iptables -t nat -I POSTROUTING 1 -s $IP_RANGE/24 -o $NIC -j MASQUERADE iptables -I INPUT 1 -i tun0 -j ACCEPT iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT @@ -911,7 +929,7 @@ ip6tables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT" >> /etc/iptables/add-openvpn-r # Script to remove rules echo "#!/bin/sh -iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE +iptables -t nat -D POSTROUTING -s #IP_RANGE/24 -o $NIC -j MASQUERADE iptables -D INPUT -i tun0 -j ACCEPT iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT From d7cbcf7ec1a58ec77125e937c84d2dd0491211fc Mon Sep 17 00:00:00 2001 From: Unknown Date: Fri, 28 Feb 2020 17:24:05 -0500 Subject: [PATCH 2/6] Update README.md --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index ca3cdf7..4357c6f 100644 --- a/README.md +++ b/README.md @@ -56,6 +56,7 @@ If you want to customise your installation, you can export them or specify them - `APPROVE_INSTALL=y` - `APPROVE_IP=y` - `IPV6_SUPPORT=n` +- `IP_CHOICE=1` - `PORT_CHOICE=1` - `PROTOCOL_CHOICE=1` - `DNS=1` From 239b5be082d24e9d6a8793b5a21e68b54e6501c9 Mon Sep 17 00:00:00 2001 From: Unknown Date: Sat, 29 Feb 2020 01:35:33 -0500 Subject: [PATCH 3/6] Fix IP_RANGE variable substitution --- openvpn-install.sh | 36 ++++++++++++++++++------------------ 1 file changed, 18 insertions(+), 18 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index c38d142..1dc6683 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -104,19 +104,19 @@ function installUnbound () { apt-get install -y unbound # Configuration - echo 'interface: ${VAR: : -1}1 -access-control: ${VAR: : -1}1/24 allow + echo "interface: ${IP_RANGE: : -1}1 +access-control: ${IP_RANGE: : -1}1/24 allow hide-identity: yes hide-version: yes use-caps-for-id: yes -prefetch: yes' >> /etc/unbound/unbound.conf +prefetch: yes" >> /etc/unbound/unbound.conf elif [[ "$OS" =~ (centos|amzn) ]]; then yum install -y unbound # Configuration - sed -i 's|# interface: 0.0.0.0$|interface: ${VAR: : -1}1|' /etc/unbound/unbound.conf - sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: ${VAR: : -1}1/24 allow|' /etc/unbound/unbound.conf + sed -i "s|# interface: 0.0.0.0$|interface: ${IP_RANGE: : -1}1|" /etc/unbound/unbound.conf + sed -i "s|# access-control: 127.0.0.0/8 allow|access-control: ${IP_RANGE: : -1}1/24 allow|" /etc/unbound/unbound.conf sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf sed -i 's|use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf @@ -125,8 +125,8 @@ prefetch: yes' >> /etc/unbound/unbound.conf dnf install -y unbound # Configuration - sed -i 's|# interface: 0.0.0.0$|interface: ${VAR: : -1}1|' /etc/unbound/unbound.conf - sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: ${VAR: : -1}1/24 allow|' /etc/unbound/unbound.conf + sed -i "s|# interface: 0.0.0.0$|interface: ${IP_RANGE: : -1}1|" /etc/unbound/unbound.conf + sed -i "s|# access-control: 127.0.0.0/8 allow|access-control: ${IP_RANGE: : -1}1/24 allow|" /etc/unbound/unbound.conf sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf sed -i 's|# use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf @@ -139,15 +139,15 @@ prefetch: yes' >> /etc/unbound/unbound.conf mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.old - echo 'server: + echo "server: use-syslog: yes do-daemonize: no - username: "unbound" - directory: "/etc/unbound" + username: \"unbound\" + directory: \"/etc/unbound\" trust-anchor-file: trusted-key.key root-hints: root.hints - interface: ${VAR: : -1}1 - access-control: ${VAR: : -1}1/24 allow + interface: ${IP_RANGE: : -1}1 + access-control: ${IP_RANGE: : -1}1/24 allow port: 53 num-threads: 2 use-caps-for-id: yes @@ -155,7 +155,7 @@ prefetch: yes' >> /etc/unbound/unbound.conf hide-identity: yes hide-version: yes qname-minimisation: yes - prefetch: yes' > /etc/unbound/unbound.conf + prefetch: yes" > /etc/unbound/unbound.conf fi if [[ ! "$OS" =~ (fedora|centos|amzn) ]];then @@ -173,9 +173,9 @@ private-address: ::ffff:0:0/96" >> /etc/unbound/unbound.conf echo 'include: /etc/unbound/openvpn.conf' >> /etc/unbound/unbound.conf # Add Unbound 'server' for the OpenVPN subnet - echo 'server: -interface: ${VAR: : -1}1 -access-control: ${VAR: : -1}1/24 allow + echo "server: +interface: ${IP_RANGE: : -1}1 +access-control: ${IP_RANGE: : -1}1/24 allow hide-identity: yes hide-version: yes use-caps-for-id: yes @@ -187,7 +187,7 @@ private-address: 169.254.0.0/16 private-address: fd00::/8 private-address: fe80::/10 private-address: 127.0.0.0/8 -private-address: ::ffff:0:0/96' > /etc/unbound/openvpn.conf +private-address: ::ffff:0:0/96" > /etc/unbound/openvpn.conf fi systemctl enable unbound @@ -760,7 +760,7 @@ ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf done ;; 2) - echo 'push "dhcp-option DNS ${VAR: : -1}1"' >> /etc/openvpn/server.conf + echo "push \"dhcp-option DNS ${IP_RANGE: : -1}1\"" >> /etc/openvpn/server.conf ;; 3) # Cloudflare echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server.conf From 8d57810fb98e2a4adceedffa447a1e7f62794261 Mon Sep 17 00:00:00 2001 From: Luke Browning Date: Wed, 4 Mar 2020 16:44:47 -0500 Subject: [PATCH 4/6] Escape IP_RANGE variable Co-Authored-By: randomshell <43271778+randomshell@users.noreply.github.com> --- openvpn-install.sh | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 1dc6683..222f15e 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -741,7 +741,7 @@ persist-key persist-tun keepalive 10 120 topology subnet -server $IP_RANGE 255.255.255.0 +server ${IP_RANGE} 255.255.255.0 ifconfig-pool-persist ipp.txt" >> /etc/openvpn/server.conf # DNS resolvers @@ -914,7 +914,7 @@ verb 3" >> /etc/openvpn/server.conf # Script to add rules echo "#!/bin/sh -iptables -t nat -I POSTROUTING 1 -s $IP_RANGE/24 -o $NIC -j MASQUERADE +iptables -t nat -I POSTROUTING 1 -s ${IP_RANGE}/24 -o ${NIC} -j MASQUERADE iptables -I INPUT 1 -i tun0 -j ACCEPT iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT @@ -929,7 +929,7 @@ ip6tables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT" >> /etc/iptables/add-openvpn-r # Script to remove rules echo "#!/bin/sh -iptables -t nat -D POSTROUTING -s #IP_RANGE/24 -o $NIC -j MASQUERADE +iptables -t nat -D POSTROUTING -s ${IP_RANGE}/24 -o ${NIC} -j MASQUERADE iptables -D INPUT -i tun0 -j ACCEPT iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT From 030c2e587c645ecb2711558f785e60df881950f6 Mon Sep 17 00:00:00 2001 From: Luke Browning Date: Fri, 18 Dec 2020 22:45:49 -0500 Subject: [PATCH 5/6] Fix IP Regex Refined IP regex to only match IPs within the IPv4 spec. --- openvpn-install.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 222f15e..c78a3e1 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -254,7 +254,7 @@ function installQuestions () { IP_RANGE="10.8.0.0" ;; 2) - until [[ "$IP_RANGE" =~ ^([0-9]{1,3}\.){3}0$ ]]; do + until [[ "$IP_RANGE" =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}0$ ]]; do read -rp "Custom IP [x.x.x.0]: " -e -i 10.8.0.0 IP_RANGE done ;; From 784624585fe93de7602a0d1233f92f3050650089 Mon Sep 17 00:00:00 2001 From: Rhys Williams Date: Mon, 7 Jun 2021 19:29:03 +0200 Subject: [PATCH 6/6] Merge Updates --- openvpn-install.sh | 26 +++++++++++++------------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 3b31e43..f911467 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -112,19 +112,19 @@ function installUnbound() { apt-get install -y unbound # Configuration - echo 'interface: ${IP_RANGE: : -1}1 + echo "interface: ${IP_RANGE: : -1}1 access-control: ${IP_RANGE: : -1}1/24 allow hide-identity: yes hide-version: yes use-caps-for-id: yes -prefetch: yes' >>/etc/unbound/unbound.conf +prefetch: yes" >>/etc/unbound/unbound.conf elif [[ $OS =~ (centos|amzn|oracle) ]]; then yum install -y unbound # Configuration - sed -i 's|# interface: 0.0.0.0$|interface: ${IP_RANGE: : -1}1|' /etc/unbound/unbound.conf - sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: ${IP_RANGE: : -1}1/24 allow|' /etc/unbound/unbound.conf + sed -i "s|# interface: 0.0.0.0$|interface: ${IP_RANGE: : -1}1|" /etc/unbound/unbound.conf + sed -i "s|# access-control: 127.0.0.0/8 allow|access-control: ${IP_RANGE: : -1}1/24 allow|" /etc/unbound/unbound.conf sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf sed -i 's|use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf @@ -133,8 +133,8 @@ prefetch: yes' >>/etc/unbound/unbound.conf dnf install -y unbound # Configuration - sed -i 's|# interface: 0.0.0.0$|interface: ${IP_RANGE: : -1}1|' /etc/unbound/unbound.conf - sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: ${IP_RANGE: : -1}1/24 allow|' /etc/unbound/unbound.conf + sed -i "s|# interface: 0.0.0.0$|interface: ${IP_RANGE: : -1}1|" /etc/unbound/unbound.conf + sed -i "s|# access-control: 127.0.0.0/8 allow|access-control: ${IP_RANGE: : -1}1/24 allow|" /etc/unbound/unbound.conf sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf sed -i 's|# use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf @@ -149,7 +149,7 @@ prefetch: yes' >>/etc/unbound/unbound.conf mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.old fi - echo 'server: + echo "server: use-syslog: yes do-daemonize: no username: "unbound" @@ -165,7 +165,7 @@ prefetch: yes' >>/etc/unbound/unbound.conf hide-identity: yes hide-version: yes qname-minimisation: yes - prefetch: yes' >/etc/unbound/unbound.conf + prefetch: yes" >/etc/unbound/unbound.conf fi # IPv6 DNS for all OS @@ -190,7 +190,7 @@ private-address: ::ffff:0:0/96" >>/etc/unbound/unbound.conf echo 'include: /etc/unbound/openvpn.conf' >>/etc/unbound/unbound.conf # Add Unbound 'server' for the OpenVPN subnet - echo 'server: + echo "server: interface: ${IP_RANGE: : -1}1 access-control: ${IP_RANGE: : -1}1/24 allow hide-identity: yes @@ -205,7 +205,7 @@ private-address: 169.254.0.0/16 private-address: fd00::/8 private-address: fe80::/10 private-address: 127.0.0.0/8 -private-address: ::ffff:0:0/96' >/etc/unbound/openvpn.conf +private-address: ::ffff:0:0/96" >/etc/unbound/openvpn.conf if [[ $IPV6_SUPPORT == 'y' ]]; then echo 'interface: fd42:42:42:42::1 access-control: fd42:42:42:42::/112 allow' >>/etc/unbound/openvpn.conf @@ -819,7 +819,7 @@ ifconfig-pool-persist ipp.txt" >>/etc/openvpn/server.conf done ;; 2) # Self-hosted DNS resolver (Unbound) - echo 'push "dhcp-option DNS ${IP_RANGE: : -1}1"' >>/etc/openvpn/server.conf + echo "push "dhcp-option DNS ${IP_RANGE: : -1}1"" >>/etc/openvpn/server.conf if [[ $IPV6_SUPPORT == 'y' ]]; then echo 'push "dhcp-option DNS fd42:42:42:42::1"' >>/etc/openvpn/server.conf fi @@ -983,7 +983,7 @@ verb 3" >>/etc/openvpn/server.conf # Script to add rules echo "#!/bin/sh -iptables -t nat -I POSTROUTING 1 -s ${IP_RANGE}/24 -o ${NIC} -j MASQUERADE +iptables -t nat -I POSTROUTING 1 -s $IP_RANGE/24 -o $NIC -j MASQUERADE iptables -I INPUT 1 -i tun0 -j ACCEPT iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT @@ -999,7 +999,7 @@ ip6tables -I INPUT 1 -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" >>/etc/iptabl # Script to remove rules echo "#!/bin/sh -iptables -t nat -D POSTROUTING -s ${IP_RANGE}/24 -o ${NIC} -j MASQUERADE +iptables -t nat -D POSTROUTING -s $IP_RANGE/24 -o $NIC -j MASQUERADE iptables -D INPUT -i tun0 -j ACCEPT iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT