mirror of
https://github.com/angristan/openvpn-install.git
synced 2025-05-09 10:18:22 +02:00
Merge 3e3c874b4929c3bb97d5aaf16f14487551ba9c9b into 7e32f6ae8373fe66e657cb693518c45768d0ea6e
This commit is contained in:
Luke Browning
GitHub
commit
5e9725cd65
@ -80,6 +80,7 @@ If you want to customise your installation, you can export them or specify them
|
||||
- `APPROVE_INSTALL=y`
|
||||
- `APPROVE_IP=y`
|
||||
- `IPV6_SUPPORT=n`
|
||||
- `IP_CHOICE=1`
|
||||
- `PORT_CHOICE=1`
|
||||
- `PROTOCOL_CHOICE=1`
|
||||
- `DNS=1`
|
||||
|
||||
@ -115,19 +115,19 @@ function installUnbound() {
|
||||
apt-get install -y unbound
|
||||
|
||||
# Configuration
|
||||
echo 'interface: 10.8.0.1
|
||||
access-control: 10.8.0.1/24 allow
|
||||
echo "interface: ${IP_RANGE: : -1}1
|
||||
access-control: ${IP_RANGE: : -1}1/24 allow
|
||||
hide-identity: yes
|
||||
hide-version: yes
|
||||
use-caps-for-id: yes
|
||||
prefetch: yes' >>/etc/unbound/unbound.conf
|
||||
prefetch: yes" >>/etc/unbound/unbound.conf
|
||||
|
||||
elif [[ $OS =~ (centos|amzn|oracle) ]]; then
|
||||
yum install -y unbound
|
||||
|
||||
# Configuration
|
||||
sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf
|
||||
sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf
|
||||
sed -i "s|# interface: 0.0.0.0$|interface: ${IP_RANGE: : -1}1|" /etc/unbound/unbound.conf
|
||||
sed -i "s|# access-control: 127.0.0.0/8 allow|access-control: ${IP_RANGE: : -1}1/24 allow|" /etc/unbound/unbound.conf
|
||||
sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf
|
||||
sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf
|
||||
sed -i 's|use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf
|
||||
@ -136,8 +136,8 @@ prefetch: yes' >>/etc/unbound/unbound.conf
|
||||
dnf install -y unbound
|
||||
|
||||
# Configuration
|
||||
sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf
|
||||
sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf
|
||||
sed -i "s|# interface: 0.0.0.0$|interface: ${IP_RANGE: : -1}1|" /etc/unbound/unbound.conf
|
||||
sed -i "s|# access-control: 127.0.0.0/8 allow|access-control: ${IP_RANGE: : -1}1/24 allow|" /etc/unbound/unbound.conf
|
||||
sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf
|
||||
sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf
|
||||
sed -i 's|# use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf
|
||||
@ -152,15 +152,15 @@ prefetch: yes' >>/etc/unbound/unbound.conf
|
||||
mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.old
|
||||
fi
|
||||
|
||||
echo 'server:
|
||||
echo "server:
|
||||
use-syslog: yes
|
||||
do-daemonize: no
|
||||
username: "unbound"
|
||||
directory: "/etc/unbound"
|
||||
trust-anchor-file: trusted-key.key
|
||||
root-hints: root.hints
|
||||
interface: 10.8.0.1
|
||||
access-control: 10.8.0.1/24 allow
|
||||
interface: ${IP_RANGE: : -1}1
|
||||
access-control: ${IP_RANGE: : -1}1/24 allow
|
||||
port: 53
|
||||
num-threads: 2
|
||||
use-caps-for-id: yes
|
||||
@ -168,7 +168,7 @@ prefetch: yes' >>/etc/unbound/unbound.conf
|
||||
hide-identity: yes
|
||||
hide-version: yes
|
||||
qname-minimisation: yes
|
||||
prefetch: yes' >/etc/unbound/unbound.conf
|
||||
prefetch: yes" >/etc/unbound/unbound.conf
|
||||
fi
|
||||
|
||||
# IPv6 DNS for all OS
|
||||
@ -193,9 +193,9 @@ private-address: ::ffff:0:0/96" >>/etc/unbound/unbound.conf
|
||||
echo 'include: /etc/unbound/openvpn.conf' >>/etc/unbound/unbound.conf
|
||||
|
||||
# Add Unbound 'server' for the OpenVPN subnet
|
||||
echo 'server:
|
||||
interface: 10.8.0.1
|
||||
access-control: 10.8.0.1/24 allow
|
||||
echo "server:
|
||||
interface: ${IP_RANGE: : -1}1
|
||||
access-control: ${IP_RANGE: : -1}1/24 allow
|
||||
hide-identity: yes
|
||||
hide-version: yes
|
||||
use-caps-for-id: yes
|
||||
@ -208,7 +208,7 @@ private-address: 169.254.0.0/16
|
||||
private-address: fd00::/8
|
||||
private-address: fe80::/10
|
||||
private-address: 127.0.0.0/8
|
||||
private-address: ::ffff:0:0/96' >/etc/unbound/openvpn.conf
|
||||
private-address: ::ffff:0:0/96" >/etc/unbound/openvpn.conf
|
||||
if [[ $IPV6_SUPPORT == 'y' ]]; then
|
||||
echo 'interface: fd42:42:42:42::1
|
||||
access-control: fd42:42:42:42::/112 allow' >>/etc/unbound/openvpn.conf
|
||||
@ -317,6 +317,23 @@ function installQuestions() {
|
||||
read -rp "Do you want to enable IPv6 support (NAT)? [y/n]: " -e -i $SUGGESTION IPV6_SUPPORT
|
||||
done
|
||||
echo ""
|
||||
echo "What IP range settings do you want OpenVPN to use?"
|
||||
echo " 1) Default: 10.8.0.0"
|
||||
echo " 2) Custom"
|
||||
until [[ "$IP_CHOICE" =~ ^[1-2]$ ]]; do
|
||||
read -rp "IP choice [1-2]: " -e -i 1 IP_CHOICE
|
||||
done
|
||||
case $IP_CHOICE in
|
||||
1)
|
||||
IP_RANGE="10.8.0.0"
|
||||
;;
|
||||
2)
|
||||
until [[ "$IP_RANGE" =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}0$ ]]; do
|
||||
read -rp "Custom IP [x.x.x.0]: " -e -i 10.8.0.0 IP_RANGE
|
||||
done
|
||||
;;
|
||||
esac
|
||||
echo ""
|
||||
echo "What port do you want OpenVPN to listen to?"
|
||||
echo " 1) Default: 1194"
|
||||
echo " 2) Custom"
|
||||
@ -661,6 +678,7 @@ function installOpenVPN() {
|
||||
APPROVE_INSTALL=${APPROVE_INSTALL:-y}
|
||||
APPROVE_IP=${APPROVE_IP:-y}
|
||||
IPV6_SUPPORT=${IPV6_SUPPORT:-n}
|
||||
IP_CHOICE=${IP_CHOICE:-1}
|
||||
PORT_CHOICE=${PORT_CHOICE:-1}
|
||||
PROTOCOL_CHOICE=${PROTOCOL_CHOICE:-1}
|
||||
DNS=${DNS:-1}
|
||||
@ -821,7 +839,7 @@ persist-key
|
||||
persist-tun
|
||||
keepalive 10 120
|
||||
topology subnet
|
||||
server 10.8.0.0 255.255.255.0
|
||||
server ${IP_RANGE} 255.255.255.0
|
||||
ifconfig-pool-persist ipp.txt" >>/etc/openvpn/server.conf
|
||||
|
||||
# DNS resolvers
|
||||
@ -843,7 +861,7 @@ ifconfig-pool-persist ipp.txt" >>/etc/openvpn/server.conf
|
||||
done
|
||||
;;
|
||||
2) # Self-hosted DNS resolver (Unbound)
|
||||
echo 'push "dhcp-option DNS 10.8.0.1"' >>/etc/openvpn/server.conf
|
||||
echo "push "dhcp-option DNS ${IP_RANGE: : -1}1"" >>/etc/openvpn/server.conf
|
||||
if [[ $IPV6_SUPPORT == 'y' ]]; then
|
||||
echo 'push "dhcp-option DNS fd42:42:42:42::1"' >>/etc/openvpn/server.conf
|
||||
fi
|
||||
@ -1003,7 +1021,7 @@ verb 3" >>/etc/openvpn/server.conf
|
||||
|
||||
# Script to add rules
|
||||
echo "#!/bin/sh
|
||||
iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o $NIC -j MASQUERADE
|
||||
iptables -t nat -I POSTROUTING 1 -s $IP_RANGE/24 -o $NIC -j MASQUERADE
|
||||
iptables -I INPUT 1 -i tun0 -j ACCEPT
|
||||
iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT
|
||||
iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT
|
||||
@ -1019,7 +1037,7 @@ ip6tables -I INPUT 1 -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" >>/etc/iptabl
|
||||
|
||||
# Script to remove rules
|
||||
echo "#!/bin/sh
|
||||
iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE
|
||||
iptables -t nat -D POSTROUTING -s $IP_RANGE/24 -o $NIC -j MASQUERADE
|
||||
iptables -D INPUT -i tun0 -j ACCEPT
|
||||
iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT
|
||||
iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT
|
||||
|
||||
Loading…
x
Reference in New Issue
Block a user