mirror of
https://github.com/angristan/openvpn-install.git
synced 2026-08-11 09:08:13 +02:00
StanislasandGitHub
d2fc6d444b
## Summary - add independent install options for internet routing, client-to-client access, and explicit server-side networks - enforce the selected policy across firewalld, nftables, and iptables, including DCO traffic - use destination-scoped NAT for home LAN access and preserve client routes and DNS in split-tunnel mode - document the new defaults and add focused Docker policy coverage Defaults remain internet access enabled, client-to-client access disabled, and server-side network access disabled. Related: #1496 #443 #385 #624 #547 #1436 #1103 #1126 #575 #1434 #1213 #147
93 lines
2.9 KiB
Bash
Executable File
93 lines
2.9 KiB
Bash
Executable File
#!/bin/bash
|
|
# shellcheck disable=SC1091,SC2034
|
|
# SC1091: The installer path is provided by the test environment.
|
|
# SC2034: VPN subnet globals are consumed by sourced installer functions.
|
|
set -euo pipefail
|
|
|
|
INSTALLER=${1:-/opt/openvpn-install.sh}
|
|
TEMP_DIR=$(mktemp -d)
|
|
trap 'rm -rf "$TEMP_DIR"' EXIT
|
|
|
|
cat >"$TEMP_DIR/ip" <<'EOF'
|
|
#!/bin/bash
|
|
case "$*" in
|
|
"-4 -o route show type unicast")
|
|
cat <<'ROUTES'
|
|
default via 167.172.176.1 dev public0
|
|
10.8.0.0/24 dev tun-test proto kernel scope link
|
|
10.19.0.0/16 dev public0 proto kernel scope link src 10.19.0.5
|
|
10.135.0.0/16 dev eth1 proto kernel scope link src 10.135.0.2
|
|
10.135.0.0/16 dev eth1 proto kernel scope link src 10.135.0.2
|
|
10.200.0.0/16 via 10.135.0.1 dev eth1
|
|
100.64.0.0/10 dev tailscale0 proto kernel scope link
|
|
169.254.0.0/16 dev eth1 proto kernel scope link
|
|
172.20.0.0/16 dev docker0 proto kernel scope link
|
|
192.168.50.0/24 dev lan0 proto kernel scope link
|
|
203.0.113.0/24 dev public0 proto kernel scope link
|
|
ROUTES
|
|
;;
|
|
"-6 -o route show type unicast")
|
|
cat <<'ROUTES'
|
|
default via fe80::1 dev public0
|
|
fc00:1::/64 via fd12:3456::1 dev lan0
|
|
fd12:3456::/64 dev lan0 proto kernel metric 256
|
|
fe80::/64 dev public0 proto kernel metric 256
|
|
2001:db8::/64 dev public0 proto kernel metric 256
|
|
ROUTES
|
|
;;
|
|
"-4 -o address show dev public0 scope global")
|
|
cat <<'ADDRESSES'
|
|
2: public0 inet 203.0.113.10/24 brd 203.0.113.255 scope global public0
|
|
2: public0 inet 10.19.0.5/16 brd 10.19.255.255 scope global public0
|
|
ADDRESSES
|
|
;;
|
|
"-4 -o address show dev eth1 scope global")
|
|
echo "3: eth1 inet 10.135.0.2/16 brd 10.135.255.255 scope global eth1"
|
|
;;
|
|
esac
|
|
EOF
|
|
chmod +x "$TEMP_DIR/ip"
|
|
|
|
export FORCE_COLOR=0 LOG_FILE="" NON_INTERACTIVE_INSTALL=n OUTPUT_FORMAT=table
|
|
# shellcheck source=../openvpn-install.sh
|
|
source "$INSTALLER"
|
|
PATH="$TEMP_DIR:$PATH"
|
|
|
|
VPN_SUBNET_IPV4=10.8.0.0
|
|
VPN_SUBNET_IPV6=fd42:42:42:42::
|
|
|
|
assert_equal() {
|
|
local expected="$1" actual="$2" description="$3"
|
|
if [[ $actual != "$expected" ]]; then
|
|
echo "FAIL: $description" >&2
|
|
echo "Expected: $expected" >&2
|
|
echo "Actual: $actual" >&2
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
assert_equal \
|
|
"10.135.0.0/16,172.20.0.0/16,192.168.50.0/24,fd12:3456::/64" \
|
|
"$(detect_private_local_networks y y)" \
|
|
"detects unique, directly connected RFC1918 and ULA networks"
|
|
assert_equal \
|
|
"10.135.0.0/16,172.20.0.0/16,192.168.50.0/24" \
|
|
"$(detect_private_local_networks y n)" \
|
|
"honors IPv4-only client configuration"
|
|
assert_equal \
|
|
"fd12:3456::/64" \
|
|
"$(detect_private_local_networks n y)" \
|
|
"honors IPv6-only client configuration"
|
|
assert_equal "" "$(detect_private_local_networks n n)" "returns an empty list when both families are disabled"
|
|
|
|
if is_private_ipv4_network 10.0.0.0/7; then
|
|
echo "FAIL: IPv4 network broader than RFC1918 space was accepted" >&2
|
|
exit 1
|
|
fi
|
|
if is_private_ipv6_network fc00::/6; then
|
|
echo "FAIL: IPv6 network broader than ULA space was accepted" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "PASS: Local network candidate detection"
|