Stanislas
d8aa625639
feat: add native firewalld support ( #1388 )
...
## Summary
- Add native firewalld support for RHEL/Fedora/CentOS systems
- When firewalld is active, use `firewall-cmd --permanent` instead of
raw iptables
- Rules persist across `firewall-cmd --reload`
- Fall back to iptables when firewalld is not active
- Add `After=firewalld.service` to iptables systemd unit for safety
## Changes
**Install:** Detect firewalld, use `firewall-cmd` to add port,
masquerade, and rich rules. Fall back to iptables if inactive.
**Uninstall:** Detect which method was used and clean up accordingly.
**Tests:** Add `fedora-42-firewalld` CI test with firewalld enabled.
---
Closes https://github.com/angristan/openvpn-install/issues/356
Closes https://github.com/angristan/openvpn-install/pull/1200
2025-12-13 20:49:40 +01:00
Stanislas
44c995df8e
feat: migrate to OpenVPN 2.4+ directory structure and improve distro compatibility ( #1364 )
...
## Summary
Migrates OpenVPN configuration to use the modern OpenVPN 2.4+ directory
structure and improves compatibility across different Linux
distributions.
Close https://github.com/angristan/openvpn-install/issues/1307 , close
https://github.com/angristan/openvpn-install/issues/788 , close
https://github.com/angristan/openvpn-install/issues/605 , close
https://github.com/angristan/openvpn-install/pull/653 , close
https://github.com/angristan/openvpn-install/issues/1214
### Directory Structure Changes
- All server files now in `/etc/openvpn/server/` instead of
`/etc/openvpn/`
- Uses `openvpn-server@server.service ` consistently across all distros
- `server.conf` uses relative paths for portability
### Distro-Specific User/Group Handling
Different distros configure OpenVPN differently:
| Distro | User | Group | systemd handles user? |
|--------|------|-------|----------------------|
| Debian/Ubuntu | nobody | nogroup | No |
| Fedora/RHEL/Amazon | openvpn | openvpn | No |
| Arch | openvpn | network | **Yes** (via `User=` in service) |
The script now:
1. Detects if an `openvpn` user exists and uses appropriate group
2. Checks if systemd service already has `User=` directive
3. Skips `user`/`group` in config when systemd handles it (avoids
"double privilege drop" error on Arch)
4. Sets file ownership with `chown -R` for non-root OpenVPN users
### Other Changes
- Updated FAQ.md with new paths
- Added systemd service file validation in tests
- Added CRL reload verification in tests
2025-12-12 22:09:18 +01:00
renovate[bot]
1aae852c60
chore(deps): update super-linter/super-linter action to v8 ( #1339 )
...
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
|
[super-linter/super-linter](https://redirect.github.com/super-linter/super-linter )
| action | major | `v7` -> `v8` |
---
### Release Notes
<details>
<summary>super-linter/super-linter (super-linter/super-linter)</summary>
###
[`v8`](https://redirect.github.com/super-linter/super-linter/blob/HEAD/CHANGELOG.md#680-2024-07-31 )
[Compare
Source](https://redirect.github.com/super-linter/super-linter/compare/v7...v8 )
##### 🚀 Features
- allow using both prettier and standardjs
([#​5679](https://redirect.github.com/super-linter/super-linter/issues/5679 ))
([2daf461](2daf461143https://redirect.github.com/super-linter/super-linter/issues/5940 ))
([20c4df5](20c4df58c0https://redirect.github.com/super-linter/super-linter/issues/5868 ))
([c770a8d](c770a8d253https://redirect.github.com/super-linter/super-linter/issues/5809 ))
([5be4926](5be4926633https://redirect.github.com/super-linter/super-linter/issues/5688 )
- write github actions step summary
([#​5867](https://redirect.github.com/super-linter/super-linter/issues/5867 ))
([57c8658](57c86588c3https://redirect.github.com/super-linter/super-linter/issues/5650 )
##### 🐛 Bugfixes
- avoid duplicated content in summary
([#​5939](https://redirect.github.com/super-linter/super-linter/issues/5939 ))
([ef57e13](ef57e132e1https://redirect.github.com/super-linter/super-linter/issues/5899 ))
([78ed3ef](78ed3ef5fchttps://redirect.github.com/super-linter/super-linter/issues/5927 ))
([eec862d](eec862d0eahttps://redirect.github.com/super-linter/super-linter/issues/5870 ))
([6bd7659](6bd76596f3⬆️ Dependency updates
- **bundler:** bump rubocop-minitest in /dependencies
([#​5875](https://redirect.github.com/super-linter/super-linter/issues/5875 ))
([9751e62](9751e62beehttps://redirect.github.com/super-linter/super-linter/issues/5777 ))
([763dcc4](763dcc4d45https://redirect.github.com/super-linter/super-linter/issues/5878 ))
([592d903](592d903c50https://redirect.github.com/super-linter/super-linter/issues/5872 ))
([587fe0a](587fe0a8b9https://redirect.github.com/super-linter/super-linter/issues/5754 ))
([6bb3f78](6bb3f789bbhttps://redirect.github.com/super-linter/super-linter/issues/5882 ))
([b5bf9f2](b5bf9f297dhttps://redirect.github.com/super-linter/super-linter/issues/5883 ))
([95feeac](95feeacb0ahttps://redirect.github.com/super-linter/super-linter/issues/5764 ))
([b75f1cf](b75f1cfcefhttps://redirect.github.com/super-linter/super-linter/issues/5873 ))
([f068663](f06866359bhttps://redirect.github.com/super-linter/super-linter/issues/5748 ))
([81ab76d](81ab76d001https://redirect.github.com/super-linter/super-linter/issues/5881 ))
([d84d439](d84d439393https://redirect.github.com/super-linter/super-linter/issues/5885 ))
([d384e67](d384e674c7https://redirect.github.com/super-linter/super-linter/issues/5856 ))
([81196f4](81196f4267https://redirect.github.com/super-linter/super-linter/issues/5884 ))
([8a044b5](8a044b58dehttps://redirect.github.com/super-linter/super-linter/issues/5765 ))
([4931da5](4931da55dahttps://redirect.github.com/super-linter/super-linter/issues/5858 ))
([ae1dba5](ae1dba53fdhttps://redirect.github.com/super-linter/super-linter/issues/5857 ))
([913bd0d](913bd0dd47https://redirect.github.com/super-linter/super-linter/issues/5768 ))
([33bb4b4](33bb4b46d4https://redirect.github.com/super-linter/super-linter/issues/5861 ))
([ed72e66](ed72e66416https://redirect.github.com/super-linter/super-linter/issues/5860 ))
([dd4313c](dd4313c9b3https://redirect.github.com/super-linter/super-linter/issues/5770 ))
([27170b8](27170b8e92https://redirect.github.com/super-linter/super-linter/issues/5849 ))
([19c5fce](19c5fcea2ehttps://redirect.github.com/babel/eslint-parser )
in /dependencies
([#​5886](https://redirect.github.com/super-linter/super-linter/issues/5886 ))
([387a2b5](387a2b5626https://redirect.github.com/babel/preset-react )
in /dependencies
([#​5740](https://redirect.github.com/super-linter/super-linter/issues/5740 ))
([4eeb628](4eeb62862ehttps://redirect.github.com/babel/preset-typescript )
in /dependencies
([#​5734](https://redirect.github.com/super-linter/super-linter/issues/5734 ))
([de4b193](de4b193006https://redirect.github.com/react-native/eslint-config )
in /dependencies
([#​5835](https://redirect.github.com/super-linter/super-linter/issues/5835 ))
([28c228d](28c228dfc0https://redirect.github.com/typescript-eslint/eslint-plugin )
in /dependencies
([#​5895](https://redirect.github.com/super-linter/super-linter/issues/5895 ))
([7f5b018](7f5b018fb7https://redirect.github.com/super-linter/super-linter/issues/5738 ))
([1312398](1312398b9chttps://redirect.github.com/super-linter/super-linter/issues/5797 ))
([8972772](8972772732https://redirect.github.com/super-linter/super-linter/issues/5890 ))
([fe3e1f8](fe3e1f83b7https://redirect.github.com/super-linter/super-linter/issues/5851 ))
([c2e85a9](c2e85a9f03https://redirect.github.com/super-linter/super-linter/issues/5852 ))
([042c6b1](042c6b1917https://redirect.github.com/super-linter/super-linter/issues/5887 ))
([22b7ba9](22b7ba91d0https://redirect.github.com/super-linter/super-linter/issues/5891 ))
([b601212](b6012126dfhttps://redirect.github.com/super-linter/super-linter/issues/5897 ))
([ef71e94](ef71e944abhttps://redirect.github.com/super-linter/super-linter/issues/5896 ))
([09a01eb](09a01ebbe6https://redirect.github.com/super-linter/super-linter/issues/5853 ))
([55b065d](55b065d3c2https://redirect.github.com/super-linter/super-linter/issues/5832 ))
([8605c2b](8605c2b584https://redirect.github.com/super-linter/super-linter/issues/5877 ))
([e90ee32](e90ee328a2https://redirect.github.com/super-linter/super-linter/issues/5876 ))
([ebf8cc8](ebf8cc807ahttps://redirect.github.com/super-linter/super-linter/issues/5879 ))
([47392ad](47392ad663https://redirect.github.com/super-linter/super-linter/issues/5780 ))
([f019ee3](f019ee34d2https://redirect.github.com/super-linter/super-linter/issues/5880 ))
([3fd69a1](3fd69a107bhttps://redirect.github.com/super-linter/super-linter/issues/5874 ))
([2b6aa12](2b6aa12906https://redirect.github.com/super-linter/super-linter/issues/5847 ))
([31da61e](31da61e189🧰 Maintenance
- add super-linter configuration in the bug template
([#​5910](https://redirect.github.com/super-linter/super-linter/issues/5910 ))
([26ddd8b](26ddd8b084https://redirect.github.com/super-linter/super-linter/issues/5894 ))
([cc20e45](cc20e4561ehttps://redirect.github.com/super-linter/super-linter/issues/5863 ))
([d9d1909](d9d19095echttps://redirect.github.com/super-linter/super-linter/issues/5871 ))
([12da497](12da4973c6https://redirect.github.com/super-linter/super-linter/issues/5862 ))
([fc094cc](fc094cc1a4https://redirect.github.com/super-linter/super-linter/issues/5869 ))
([bcf8ca8](bcf8ca82adhttps://redirect.github.com/super-linter/super-linter/issues/5928 ))
([70e0239](70e0239117https://redirect.github.com/super-linter/super-linter/issues/5864 ))
([ce59f5c](ce59f5c323https://redirect.github.com/super-linter/super-linter/issues/5892 ))
([d2d7334](d2d73347d3https://redirect.github.com/super-linter/super-linter/issues/5898 ))
([e374e48](e374e48933https://redirect.github.com/super-linter/super-linter/issues/5901 ))
([2ecf945](2ecf945339📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).
🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.
♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/ ).
View the [repository job
log](https://developer.mend.io/github/angristan/openvpn-install ).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi40Mi4yIiwidXBkYXRlZEluVmVyIjoiNDIuNDIuMiIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6W119-->
---------
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: Stanislas Lange <git@slange.me >
2025-12-11 11:12:00 +01:00
Stanislas
6b09270347
feat: add certificate renewal functionality ( #1328 )
...
## Summary
- Add certificate renewal for both client and server certificates
- Allow custom validity period during renewal (prompts user, defaults to
3650 days)
- Show expiry info inline in menus (e.g., "Renew the server certificate
(expires in 3542 days)")
- Regenerate `.ovpn` files after client renewal
- Restart OpenVPN service after server renewal
- Extract reusable helper functions to reduce code duplication
- Add robust input validation and error handling
## New menu option
```
What do you want to do?
1) Add a new user
2) Revoke existing user
3) Renew certificate ← NEW
4) Remove OpenVPN
5) Exit
```
## Renewal submenu
```
What do you want to renew?
1) Renew a client certificate
2) Renew the server certificate (expires in 3542 days)
3) Back to main menu
```
Client list shows expiry for each:
```
Select the existing client certificate you want to renew
1) alice (expires in 3542 days)
2) bob (expires in 30 days)
3) charlie (EXPIRED 5 days ago)
```
## Helper functions added
Extracted common code into reusable functions:
- `getHomeDir()` - home directory detection
- `regenerateCRL()` - CRL regeneration after cert changes
- `generateClientConfig()` - .ovpn file generation
- `selectClient()` - client listing with optional expiry display
- `getDaysUntilExpiry()` - certificate expiry calculation
- `formatExpiry()` - human-readable expiry formatting
## Test plan
- [x] Client certificate renewal tested in Docker CI
- [x] Server certificate renewal tested in Docker CI
- [x] Certificate validity verified after renewal (~3650 days)
- [x] VPN connectivity tested with renewed certificate
Closes #974 #1002 #1228 #1060
2025-12-09 21:49:19 +01:00
Stanislas
93284de7df
Fix typo in FAQ
...
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-12-04 23:04:11 +01:00
Stanislas Lange
39dd034717
Fix textlint terminology: websites -> sites
2025-12-04 23:04:11 +01:00
Stanislas Lange
bfcd624592
docs: fix sysctl config path in FAQ (20 -> 99)
...
The script uses /etc/sysctl.d/99-openvpn.conf but the FAQ
incorrectly referenced /etc/sysctl.d/20-openvpn.conf
2025-12-04 23:04:11 +01:00
s7r
38d3bf9afa
Update FAQ with IPv6 prefix policies for ULA addresses ( #1083 )
...
* Update FAQ with IPv6 prefix policies for ULA addresses
Most operating systems will prefer IPv4 rather than IPv6 ULA, which defeats the purpose of redirect-gateway ipv6. It's nothing the script can do to automate this.
2023-01-18 23:05:09 +01:00
Stanislas
ea236de3e3
Create user from text file
...
Fix #732
2020-12-08 21:39:51 +01:00
Stanislas
5acd9a0446
Update FAQ.md
2020-12-08 21:26:39 +01:00
Stanislas
b2e96b0762
Update FAQ.md
2020-12-08 21:24:38 +01:00
Stanislas
bd047c08d7
ci: use super-linter ( #683 )
2020-10-21 13:59:49 +02:00
Gal Bracha
7ddd525edf
Update FAQ.md
...
Added instructions on the `/etc/openvpn/client-template.txt` as requested
2020-10-12 10:28:22 +03:00
Gal Bracha
9623867026
FAQ - Added how to set up part of the routing
...
# Implements
Updated `FAQ.md` - Added how to set only some of the traffic to go through the VPN and the rest using the normal connection
2020-09-08 11:47:31 +03:00
robiiinos
2a73a41f71
Add new dns leak tests to FAQ
2020-06-27 14:49:12 +02:00
Techroy23
e952d58995
docs(faq): add batch client generation script ( #645 )
2020-04-28 14:23:18 +02:00
randomshell
c785b230e9
docs(faq): add info for remote LAN access ( #630 )
2020-04-27 19:02:35 +02:00
Stanislas Lange
c2d7729c20
style(faq): format markdown
2020-04-27 15:32:05 +02:00
randomshell
a3e6652d6d
docs(faq): update DNS not working question ( #632 )
2020-04-27 14:20:04 +02:00
randomshell
0481e10bce
Add FAQ for client-to-client ( #631 )
2020-04-27 10:39:33 +02:00
randomshell
72c99f3e8f
Add FAQ for router clients ( #629 )
2020-04-24 18:00:59 +02:00
Stanislas Lange
0188c442a2
FAQ: Remove obsolete entry
...
Fix #634
2020-04-23 18:49:26 +02:00
randomshell
fcc4cc4afd
Add FAQ entry for sysctl and iptables changes ( #626 )
2020-04-22 11:39:42 +02:00
randomshell
777bedaa38
Add FAQ for DNS Leaks blocking ( #627 )
2020-04-22 11:38:31 +02:00
Stanislas
d31efe9e7b
Move FAQ from wiki to git to allow contributions ( #611 )
...
Signed-off-by: Stanislas Lange <angristan@pm.me >
2020-04-04 11:54:17 +02:00
