feat: flexible IPv4/IPv6 support with independent endpoint and client addressing (#1419)

## Summary

Comprehensive IPv4/IPv6 overhaul that decouples server endpoint
addressing from client tunnel addressing, supporting all combinations
with automatic leak prevention.

### Supported Configurations

| Endpoint | Client Mode | Description |
|----------|-------------|-------------|
| IPv4 | IPv4-only | Traditional setup (4→4) |
| IPv4 | Dual-stack | IPv4 endpoint, clients get both (4→4/6) |
| IPv4 | IPv6-only | IPv4 endpoint, clients get IPv6 only (4→6) |
| IPv6 | IPv4-only | IPv6 endpoint, clients get IPv4 only (6→4) |
| IPv6 | Dual-stack | IPv6 endpoint, clients get both (6→4/6) |
| IPv6 | IPv6-only | Full IPv6 setup (6→6) |

### Leak Prevention

- **IPv4-only mode**: Pushes `block-ipv6` to clients, blocking all IPv6
traffic
- **IPv6-only mode**: Assigns IPv4 addresses and pushes
`redirect-gateway def1` to capture IPv4 traffic, which is then dropped
(no IPv4 NAT configured)
- **Dual-stack mode**: Both protocols tunneled normally

### New CLI Options

```
Network Options:
  --endpoint-type <4|6>     Endpoint IP version (default: 4)
  --client-ipv4             Enable IPv4 for VPN clients (default: enabled)
  --no-client-ipv4          Disable IPv4 for VPN clients
  --client-ipv6             Enable IPv6 for VPN clients (default: disabled)
  --no-client-ipv6          Disable IPv6 for VPN clients
  --subnet-ipv4 <x.x.x.0>   IPv4 VPN subnet (default: 10.8.0.0)
  --subnet-ipv6 <prefix>    IPv6 VPN subnet (default: fd42:42:42:42::)
```

### Usage Examples

```bash
# Dual-stack clients (IPv4 + IPv6)
./openvpn-install.sh install --client-ipv4 --client-ipv6

# IPv6-only clients (IPv4 traffic blocked)
./openvpn-install.sh install --no-client-ipv4 --client-ipv6

# IPv4-only clients (IPv6 traffic blocked) - default behavior
./openvpn-install.sh install --client-ipv4 --no-client-ipv6

# IPv6 server endpoint
./openvpn-install.sh install --endpoint-type 6 --endpoint 2001:db8::1

# Custom subnets
./openvpn-install.sh install --client-ipv6 --subnet-ipv4 10.9.0.0 --subnet-ipv6 fd00🔢5678::
```

### Implementation Details

**Core changes:**
- New `ENDPOINT_TYPE` variable (4 or 6) controls server listening
protocol
- New `CLIENT_IPV4`/`CLIENT_IPV6` variables control client tunnel
addressing
- Renamed `VPN_SUBNET` → `VPN_SUBNET_IPV4`, added `VPN_SUBNET_IPV6`
- Separate `resolvePublicIPv4()` and `resolvePublicIPv6()` functions
- New `validate_subnet_ipv6()` for ULA (fd00::/8) validation

**Protocol handling:**
- Uses `proto udp6`/`tcp6` when endpoint type is IPv6
- Firewall and SELinux commands handle both protocol variants

**Firewall updates:**
- firewalld: Conditional IPv6 masquerade and forwarding
- nftables: Separate ip/ip6 tables for NAT based on client config
- iptables: ip6tables rules only when IPv6 clients enabled

**DNS configuration:**
- Unbound listens on IPv4/IPv6 gateway addresses as needed
- All third-party DNS providers now include IPv6 servers:
  - Cloudflare: 2606:4700:4700::1111
  - Quad9: 2620:fe::fe
  - Google: 2001:4860:4860::8888
  - OpenDNS: 2620:119:35::35
  - AdGuard: 2a10:50c0::ad1:ff

**CI/Testing:**
- Added `ubuntu-24.04-dual-stack` test matrix entry
- Docker test container enables IPv6 forwarding
- `CLIENT_IPV6` environment variable passed to test container

## Test Plan

- [x] Shellcheck passes
- [x] CI Docker tests pass (including new dual-stack test)
- [x] Manual testing: IPv4-only mode blocks IPv6 traffic
- [x] Manual testing: IPv6-only mode blocks IPv4 traffic
- [x] Manual testing: Dual-stack mode tunnels both protocols

---

Closes #1317
Closes #1288
Closes #1084
Closes #701
Closes #350

README.md

@@ -43,7 +43,7 @@ That said, OpenVPN still makes sense when you need:
 - List and monitor connected clients
 - Uses [official OpenVPN repositories](https://community.openvpn.net/openvpn/wiki/OpenvpnSoftwareRepos) when possible for the latest stable releases
 - Firewall rules and forwarding managed seamlessly (native firewalld and nftables support, iptables fallback)
-- Configurable VPN subnet (default: `10.8.0.0/24`)
+- Configurable VPN subnets (IPv4: default `10.8.0.0/24`, IPv6: default `fd42:42:42:42::/112`)
 - Configurable tunnel MTU (default: `1500`)
 - If needed, the script can cleanly remove OpenVPN, including configuration and firewall rules
 - Customisable encryption settings, enhanced default settings (see [Security and Encryption](#security-and-encryption) below)
@@ -51,7 +51,11 @@ That said, OpenVPN still makes sense when you need:
 - Variety of DNS resolvers to be pushed to the clients
 - Choice to use a self-hosted resolver with Unbound (supports already existing Unbound installations)
 - Choice between TCP and UDP
-- NATed IPv6 support
+- Flexible IPv4/IPv6 support:
+  - IPv4 or IPv6 server endpoint (how clients connect)
+  - IPv4-only, IPv6-only, or dual-stack clients (VPN addressing and internet access)
+  - All combinations supported: 4→4, 4→4/6, 4→6, 6→4, 6→6, 6→4/6
+  - Automatic leak prevention: blocks undesired protocol in single-stack modes
 - Unprivileged mode: run as `nobody`/`nogroup`
 - Block DNS leaks on Windows 10
 - Randomised server certificate name
@@ -249,7 +253,19 @@ The `install` command supports many options for customization:
 ./openvpn-install.sh install --cipher AES-256-GCM --cert-type rsa --rsa-bits 4096
 
 # Custom VPN subnet
-./openvpn-install.sh install --subnet 10.9.0.0
+./openvpn-install.sh install --subnet-ipv4 10.9.0.0
+
+# Enable dual-stack (IPv4 + IPv6) for clients
+./openvpn-install.sh install --client-ipv4 --client-ipv6
+
+# IPv6-only clients (no IPv4)
+./openvpn-install.sh install --no-client-ipv4 --client-ipv6
+
+# IPv6 endpoint (server listens on IPv6, clients connect via IPv6)
+./openvpn-install.sh install --endpoint-type 6 --endpoint 2001:db8::1
+
+# Custom IPv6 subnet for dual-stack setup
+./openvpn-install.sh install --client-ipv6 --subnet-ipv6 fd00:1234:5678::
 
 # Skip initial client creation
 ./openvpn-install.sh install --no-client
@@ -267,9 +283,14 @@ The `install` command supports many options for customization:
 **Network Options:**
 
 - `--endpoint <host>` - Public IP or hostname for clients (default: auto-detected)
+- `--endpoint-type <4|6>` - Endpoint IP version (default: `4`)
 - `--ip <addr>` - Server listening IP (default: auto-detected)
-- `--ipv6` - Enable IPv6 support (default: disabled)
-- `--subnet <x.x.x.0>` - VPN subnet (default: `10.8.0.0`)
+- `--client-ipv4` - Enable IPv4 for VPN clients (default: enabled)
+- `--no-client-ipv4` - Disable IPv4 for VPN clients
+- `--client-ipv6` - Enable IPv6 for VPN clients (default: disabled)
+- `--no-client-ipv6` - Disable IPv6 for VPN clients
+- `--subnet-ipv4 <x.x.x.0>` - IPv4 VPN subnet (default: `10.8.0.0`)
+- `--subnet-ipv6 <prefix>` - IPv6 VPN subnet (default: `fd42:42:42:42::`)
 - `--port <num>` - OpenVPN port (default: `1194`)
 - `--port-random` - Use random port (49152-65535)
 - `--protocol <udp|tcp>` - Protocol (default: `udp`)