diff --git a/openvpn-install.sh b/openvpn-install.sh index 5651bf9..6758883 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -201,7 +201,7 @@ function installQuestions () { if [[ $APPROVE_IP =~ n ]]; then read -rp "IP address: " -e -i "$IP" IP fi - # If $IP is a private IP address, the server must be behind NAT + # If $IP is a private IP address, the server must be behind NAT if echo "$IP" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then echo "" echo "It seems this server is behind NAT. What is its public IPv4 address or hostname?" @@ -855,13 +855,13 @@ verb 3" >> /etc/openvpn/server.conf # Add firewall rules --> firewalld / iptable (systemd scripts) if pgrep firewalld; then # Allow incoming traffic - # Define new openvpn service - cp /usr/lib/firewalld/services/openvpn.xml /etc/firewalld/services - sed -i "s|udp|${PROTOCOL}|" /etc/firewalld/services/openvpn.xml - sed -i "s|1194|${PORT}|" /etc/firewalld/services/openvpn.xml - - firewall-cmd --zone=public --add-service=openvpn + if [[ "$PORT" == '1194' ]] && [[ "$PROTOCOL" == "udp" ]]; then + firewall-cmd --zone=public --add-service=openvpn firewall-cmd --permanent --zone=public --add-service=openvpn + else + firewall-cmd --zone=public --add-port="$PORT/$PROTOCOL" + firewall-cmd --permanent --zone=public --add-port="$PORT/$PROTOCOL" + fi # Add trusted zone firewall-cmd --zone=trusted --add-source=10.8.0.0/24 @@ -1151,11 +1151,13 @@ function removeOpenVPN () { # Get OpenVPN protocol from the configuration PROTOCOL=$(grep '^proto ' /etc/openvpn/server.conf | cut -d " " -f 2) - firewall-cmd --zone=public --remove-service=openvpn - firewall-cmd --permanent --zone=public --remove-service=openvpn - - # Remove defined openvpn service - rm /etc/firewalld/services/openvpn.xml + if [[ "$PORT" == '1194' ]] && [[ "$PROTOCOL" == "udp" ]]; then + firewall-cmd --zone=public --remove-service=openvpn + firewall-cmd --permanent --zone=public --remove-service=openvpn + else + firewall-cmd --zone=public --remove-port="$PORT/$PROTOCOL" + firewall-cmd --permanent --zone=public --remove-port="$PORT/$PROTOCOL" + fi firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 @@ -1257,4 +1259,4 @@ if [[ -e /etc/openvpn/server.conf ]]; then manageMenu else installOpenVPN -fi +fi \ No newline at end of file