Bernhard.Linz/openvpn-install
1
0
Fork 0
mirror of https://github.com/angristan/openvpn-install.git synced 2025-01-09 08:10:05 +01:00
Code Issues Projects Releases Wiki Activity

changed script for own IPV4 vpn adress

Browse Source
This commit is contained in:
Ronni 2021-09-05 10:59:00 +02:00
parent 8783719459
commit a4ca71aee9
2 changed files with 29 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.gitignore vendored Normal file
View File

@ -0,0 +1 @@
.project

43
openvpn-install.sh
View File

@ -1,9 +1,22 @@
#!/bin/bash #!/bin/bash
# shellcheck disable=SC1091,SC2164,SC2034,SC1072,SC1073,SC1009 # shellcheck disable=SC1091,SC2164,SC2034,SC1072,SC1073,SC1009
# Secure OpenVPN server installer for Debian, Ubuntu, CentOS, Amazon Linux 2, Fedora, Oracle Linux 8, Arch Linux, Rocky Linux and AlmaLinux. # Secure OpenVPN server installer for Debian, Ubuntu, CentOS, Amazon Linux 2, Fedora, Oracle Linux 8, Arch Linux and Rocky Linux.
# https://github.com/angristan/openvpn-install # https://github.com/angristan/openvpn-install
#-------------------------------------------
# CONFIGURATION
#-------------------------------------------
IPNET="10.8.0.0" # Network address
IPADR="10.8.0.1" # IP address of the server
NETMASKCIDR="24" # Netmask in CIDR
NETMASK="255.255.255.0" # Netmask
IPADRCIDR="${IPADR}/${NETMASKCIDR}"
IPNETCIDR="${IPNET}/${NETMASKCIDR}"
#-------------------------------------------
function isRoot() { function isRoot() {
if [ "$EUID" -ne 0 ]; then if [ "$EUID" -ne 0 ]; then
return 1 return 1
@ -112,8 +125,8 @@ function installUnbound() {
apt-get install -y unbound apt-get install -y unbound
# Configuration # Configuration
echo 'interface: 10.8.0.1 echo 'interface: $IPADR
access-control: 10.8.0.1/24 allow access-control: $IPADRSCIDR allow
hide-identity: yes hide-identity: yes
hide-version: yes hide-version: yes
use-caps-for-id: yes use-caps-for-id: yes
@ -123,8 +136,8 @@ prefetch: yes' >>/etc/unbound/unbound.conf
yum install -y unbound yum install -y unbound
# Configuration # Configuration
sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf sed -i 's|# interface: 0.0.0.0$|interface: $IPADR|' /etc/unbound/unbound.conf
sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: $IPADRCIDR allow|' /etc/unbound/unbound.conf
sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf
sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf
sed -i 's|use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf sed -i 's|use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf
@ -133,8 +146,8 @@ prefetch: yes' >>/etc/unbound/unbound.conf
dnf install -y unbound dnf install -y unbound
# Configuration # Configuration
sed -i 's|# interface: 0.0.0.0$|interface: 10.8.0.1|' /etc/unbound/unbound.conf sed -i 's|# interface: 0.0.0.0$|interface: $IPADR|' /etc/unbound/unbound.conf
sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: 10.8.0.1/24 allow|' /etc/unbound/unbound.conf sed -i 's|# access-control: 127.0.0.0/8 allow|access-control: $IPADRCIDR allow|' /etc/unbound/unbound.conf
sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-identity: no|hide-identity: yes|' /etc/unbound/unbound.conf
sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf sed -i 's|# hide-version: no|hide-version: yes|' /etc/unbound/unbound.conf
sed -i 's|# use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf sed -i 's|# use-caps-for-id: no|use-caps-for-id: yes|' /etc/unbound/unbound.conf
@ -156,8 +169,8 @@ prefetch: yes' >>/etc/unbound/unbound.conf
directory: "/etc/unbound" directory: "/etc/unbound"
trust-anchor-file: trusted-key.key trust-anchor-file: trusted-key.key
root-hints: root.hints root-hints: root.hints
interface: 10.8.0.1 interface: $IPADR
access-control: 10.8.0.1/24 allow access-control: $IPADRCIDR allow
port: 53 port: 53
num-threads: 2 num-threads: 2
use-caps-for-id: yes use-caps-for-id: yes
@ -191,8 +204,8 @@ private-address: ::ffff:0:0/96" >>/etc/unbound/unbound.conf
# Add Unbound 'server' for the OpenVPN subnet # Add Unbound 'server' for the OpenVPN subnet
echo 'server: echo 'server:
interface: 10.8.0.1 interface: $IPADR
access-control: 10.8.0.1/24 allow access-control: $IPADRCIDR allow
hide-identity: yes hide-identity: yes
hide-version: yes hide-version: yes
use-caps-for-id: yes use-caps-for-id: yes
@ -779,7 +792,7 @@ persist-key
persist-tun persist-tun
keepalive 10 120 keepalive 10 120
topology subnet topology subnet
server 10.8.0.0 255.255.255.0 server $IPNET $NETMASK
ifconfig-pool-persist ipp.txt" >>/etc/openvpn/server.conf ifconfig-pool-persist ipp.txt" >>/etc/openvpn/server.conf
# DNS resolvers # DNS resolvers
@ -801,7 +814,7 @@ ifconfig-pool-persist ipp.txt" >>/etc/openvpn/server.conf
done done
;; ;;
2) # Self-hosted DNS resolver (Unbound) 2) # Self-hosted DNS resolver (Unbound)
echo 'push "dhcp-option DNS 10.8.0.1"' >>/etc/openvpn/server.conf echo 'push "dhcp-option DNS $IPADR"' >>/etc/openvpn/server.conf
if [[ $IPV6_SUPPORT == 'y' ]]; then if [[ $IPV6_SUPPORT == 'y' ]]; then
echo 'push "dhcp-option DNS fd42:42:42:42::1"' >>/etc/openvpn/server.conf echo 'push "dhcp-option DNS fd42:42:42:42::1"' >>/etc/openvpn/server.conf
fi fi
@ -965,7 +978,7 @@ verb 3" >>/etc/openvpn/server.conf
# Script to add rules # Script to add rules
echo "#!/bin/sh echo "#!/bin/sh
iptables -t nat -I POSTROUTING 1 -s 10.8.0.0/24 -o $NIC -j MASQUERADE iptables -t nat -I POSTROUTING 1 -s $IPNETCIDR -o $NIC -j MASQUERADE
iptables -I INPUT 1 -i tun0 -j ACCEPT iptables -I INPUT 1 -i tun0 -j ACCEPT
iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT iptables -I FORWARD 1 -i $NIC -o tun0 -j ACCEPT
iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT iptables -I FORWARD 1 -i tun0 -o $NIC -j ACCEPT
@ -981,7 +994,7 @@ ip6tables -I INPUT 1 -i $NIC -p $PROTOCOL --dport $PORT -j ACCEPT" >>/etc/iptabl
# Script to remove rules # Script to remove rules
echo "#!/bin/sh echo "#!/bin/sh
iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE iptables -t nat -D POSTROUTING -s $IPNETCIDR -o $NIC -j MASQUERADE
iptables -D INPUT -i tun0 -j ACCEPT iptables -D INPUT -i tun0 -j ACCEPT
iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT iptables -D FORWARD -i $NIC -o tun0 -j ACCEPT
iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT iptables -D FORWARD -i tun0 -o $NIC -j ACCEPT