mirror of
https://github.com/angristan/openvpn-install.git
synced 2025-12-16 17:07:02 +01:00
6b07477dd9
## Summary Comprehensive IPv4/IPv6 overhaul that decouples server endpoint addressing from client tunnel addressing, supporting all combinations with automatic leak prevention. ### Supported Configurations | Endpoint | Client Mode | Description | |----------|-------------|-------------| | IPv4 | IPv4-only | Traditional setup (4→4) | | IPv4 | Dual-stack | IPv4 endpoint, clients get both (4→4/6) | | IPv4 | IPv6-only | IPv4 endpoint, clients get IPv6 only (4→6) | | IPv6 | IPv4-only | IPv6 endpoint, clients get IPv4 only (6→4) | | IPv6 | Dual-stack | IPv6 endpoint, clients get both (6→4/6) | | IPv6 | IPv6-only | Full IPv6 setup (6→6) | ### Leak Prevention - **IPv4-only mode**: Pushes `block-ipv6` to clients, blocking all IPv6 traffic - **IPv6-only mode**: Assigns IPv4 addresses and pushes `redirect-gateway def1` to capture IPv4 traffic, which is then dropped (no IPv4 NAT configured) - **Dual-stack mode**: Both protocols tunneled normally ### New CLI Options ``` Network Options: --endpoint-type <4|6> Endpoint IP version (default: 4) --client-ipv4 Enable IPv4 for VPN clients (default: enabled) --no-client-ipv4 Disable IPv4 for VPN clients --client-ipv6 Enable IPv6 for VPN clients (default: disabled) --no-client-ipv6 Disable IPv6 for VPN clients --subnet-ipv4 <x.x.x.0> IPv4 VPN subnet (default: 10.8.0.0) --subnet-ipv6 <prefix> IPv6 VPN subnet (default: fd42:42:42:42::) ``` ### Usage Examples ```bash # Dual-stack clients (IPv4 + IPv6) ./openvpn-install.sh install --client-ipv4 --client-ipv6 # IPv6-only clients (IPv4 traffic blocked) ./openvpn-install.sh install --no-client-ipv4 --client-ipv6 # IPv4-only clients (IPv6 traffic blocked) - default behavior ./openvpn-install.sh install --client-ipv4 --no-client-ipv6 # IPv6 server endpoint ./openvpn-install.sh install --endpoint-type 6 --endpoint 2001:db8::1 # Custom subnets ./openvpn-install.sh install --client-ipv6 --subnet-ipv4 10.9.0.0 --subnet-ipv6 fd00🔢5678:: ``` ### Implementation Details **Core changes:** - New `ENDPOINT_TYPE` variable (4 or 6) controls server listening protocol - New `CLIENT_IPV4`/`CLIENT_IPV6` variables control client tunnel addressing - Renamed `VPN_SUBNET` → `VPN_SUBNET_IPV4`, added `VPN_SUBNET_IPV6` - Separate `resolvePublicIPv4()` and `resolvePublicIPv6()` functions - New `validate_subnet_ipv6()` for ULA (fd00::/8) validation **Protocol handling:** - Uses `proto udp6`/`tcp6` when endpoint type is IPv6 - Firewall and SELinux commands handle both protocol variants **Firewall updates:** - firewalld: Conditional IPv6 masquerade and forwarding - nftables: Separate ip/ip6 tables for NAT based on client config - iptables: ip6tables rules only when IPv6 clients enabled **DNS configuration:** - Unbound listens on IPv4/IPv6 gateway addresses as needed - All third-party DNS providers now include IPv6 servers: - Cloudflare: 2606:4700:4700::1111 - Quad9: 2620:fe::fe - Google: 2001:4860:4860::8888 - OpenDNS: 2620:119:35::35 - AdGuard: 2a10:50c0::ad1:ff **CI/Testing:** - Added `ubuntu-24.04-dual-stack` test matrix entry - Docker test container enables IPv6 forwarding - `CLIENT_IPV6` environment variable passed to test container ## Test Plan - [x] Shellcheck passes - [x] CI Docker tests pass (including new dual-stack test) - [x] Manual testing: IPv4-only mode blocks IPv6 traffic - [x] Manual testing: IPv6-only mode blocks IPv4 traffic - [x] Manual testing: Dual-stack mode tunnels both protocols --- Closes #1317 Closes #1288 Closes #1084 Closes #701 Closes #350