diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..e970233 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.project \ No newline at end of file diff --git a/openvpn-install.sh b/openvpn-install.sh index a31713a..5ed9a11 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -1,9 +1,22 @@ #!/bin/bash # shellcheck disable=SC1091,SC2164,SC2034,SC1072,SC1073,SC1009 -# Secure OpenVPN server installer for Debian, Ubuntu, CentOS, Amazon Linux 2, Fedora, Oracle Linux 8, Arch Linux, Rocky Linux and AlmaLinux. +# Secure OpenVPN server installer for Debian, Ubuntu, CentOS, Amazon Linux 2, Fedora, Oracle Linux 8, Arch Linux and Rocky Linux. # https://github.com/angristan/openvpn-install +#------------------------------------------- +# CONFIGURATION +#------------------------------------------- +IPNET="10.8.0.0" # Network address +IPADR="10.8.0.1" # IP address of the server +NETMASKCIDR="24" # Netmask in CIDR +NETMASK="255.255.255.0" # Netmask +IPADRCIDR="${IPADR}/${NETMASKCIDR}" +IPNETCIDR="${IPNET}/${NETMASKCIDR}" +#------------------------------------------- + + + function isRoot() { if [ "$EUID" -ne 0 ]; then return 1 @@ -112,8 +125,8 @@ function installUnbound() { apt-get install -y unbound # Configuration - echo 'interface: 10.8.0.1 -access-control: 10.8.0.1/24 allow + echo 'interface: $IPADR +access-control: $IPADRSCIDR allow hide-identity: yes hide-version: yes use-caps-for-id: yes @@ -123,8 +136,8 @@ prefetch: yes' >>/etc/unbound/unbound.conf yum install -y unbound # Configuration - sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf - sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf + sed -i 's|# interface: 0.0.0.0$|interface: $IPADR|' /etc/unbound/unbound.conf + sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: $IPADRCIDR allow|' /etc/unbound/unbound.conf sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf sed -i 's|use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf @@ -133,8 +146,8 @@ prefetch: yes' >>/etc/unbound/unbound.conf dnf install -y unbound # Configuration - sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf - sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf + sed -i 's|# interface: 0.0.0.0$|interface: $IPADR|' /etc/unbound/unbound.conf + sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: $IPADRCIDR allow|' /etc/unbound/unbound.conf sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf sed -i 's|# use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf @@ -156,8 +169,8 @@ prefetch: yes' >>/etc/unbound/unbound.conf directory: "/etc/unbound" trust-anchor-file: trusted-key.key root-hints: root.hints - interface: 10.8.0.1 - access-control: 10.8.0.1/24 allow + interface: $IPADR + access-control: $IPADRCIDR allow port: 53 num-threads: 2 use-caps-for-id: yes @@ -191,8 +204,8 @@ private-address: ::ffff:0:0/96" >>/etc/unbound/unbound.conf # Add Unbound 'server' for the OpenVPN subnet echo 'server: -interface: 10.8.0.1 -access-control: 10.8.0.1/24 allow +interface: $IPADR +access-control: $IPADRCIDR allow hide-identity: yes hide-version: yes use-caps-for-id: yes @@ -779,7 +792,7 @@ persist-key persist-tun keepalive 10 120 topology subnet -server 10.8.0.0 255.255.255.0 +server $IPNET $NETMASK ifconfig-pool-persist ipp.txt" >>/etc/openvpn/server.conf # DNS resolvers @@ -801,7 +814,7 @@ ifconfig-pool-persist ipp.txt" >>/etc/openvpn/server.conf done ;; 2) # Self-hosted DNS resolver (Unbound) - echo 'push "dhcp-option DNS 10.8.0.1"' >>/etc/openvpn/server.conf + echo 'push "dhcp-option DNS $IPADR"' >>/etc/openvpn/server.conf if [[ $IPV6_SUPPORT == 'y' ]]; then echo 'push "dhcp-option DNS fd42:42:42:42::1"' >>/etc/openvpn/server.conf fi @@ -965,7 +978,7 @@ verb 3" >>/etc/openvpn/server.conf # Script to add rules echo "#!/bin/sh -iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o $NIC -j MASQUERADE +iptables -t nat -I POSTROUTING 1 -s $IPNETCIDR -o $NIC -j MASQUERADE iptables -I INPUT 1 -i tun0 -j ACCEPT iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT @@ -981,7 +994,7 @@ ip6tables -I INPUT 1 -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" >>/etc/iptabl # Script to remove rules echo "#!/bin/sh -iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE +iptables -t nat -D POSTROUTING -s $IPNETCIDR -o $NIC -j MASQUERADE iptables -D INPUT -i tun0 -j ACCEPT iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT