bedefaced
9 years ago
parent
070d8a305b
commit
7cdd35b28f
@ -0,0 +1,25 @@ |
|||||||
|
#!/usr/bin/env bash |
||||||
|
|
||||||
|
DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd ) |
||||||
|
source $DIR/env.sh |
||||||
|
|
||||||
|
if [[ ! -e $OPENVPNCONFIG ]] || [[ ! -r $OPENVPNCONFIG ]] || [[ ! -w $OPENVPNCONFIG ]]; then |
||||||
|
echo "$PPPCONFIG is not exist or not accessible (are you root?)" |
||||||
|
exit 1 |
||||||
|
fi |
||||||
|
|
||||||
|
DEFAULTDNS1="8.8.8.8" |
||||||
|
DEFAULTDNS2="8.8.4.4" |
||||||
|
|
||||||
|
read -p "Preffered DNS resolver #1: " -e -i $DEFAULTDNS1 DNS1 |
||||||
|
: ${DNS1:=$DEFAULTDNS1} |
||||||
|
|
||||||
|
read -p "Preffered DNS resolver #2: " -e -i $DEFAULTDNS2 DNS2 |
||||||
|
: ${DNS2:=$DEFAULTDNS2} |
||||||
|
|
||||||
|
sed -i -e "/dhcp-option DNS/d" $OPENVPNCONFIG |
||||||
|
|
||||||
|
echo "push \"dhcp-option DNS $DNS1\"" >> $OPENVPNCONFIG |
||||||
|
echo "push \"dhcp-option DNS $DNS2\"" >> $OPENVPNCONFIG |
||||||
|
|
||||||
|
echo "$OPENVPNCONFIG updated!" |
||||||
@ -0,0 +1,20 @@ |
|||||||
|
#!/usr/bin/env bash |
||||||
|
|
||||||
|
SYSCTLCONFIG=/etc/sysctl.conf |
||||||
|
OPENVPNDIR=/etc/openvpn |
||||||
|
OPENVPNCONFIG=$OPENVPNDIR/openvpn-server.conf |
||||||
|
CADIR=$OPENVPNDIR/easy-rsa |
||||||
|
IPTABLES=/etc/iptables.rules |
||||||
|
RCLOCAL=/etc/rc.local |
||||||
|
NOBODYGROUP=nogroup |
||||||
|
|
||||||
|
LOCALPREFIX="172.20" |
||||||
|
LOCALIP="$LOCALPREFIX.0.0" |
||||||
|
LOCALMASK="/24" |
||||||
|
|
||||||
|
LOCALIPMASK="$LOCALIP$LOCALMASK" |
||||||
|
|
||||||
|
IP=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -o -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1) |
||||||
|
if [[ "$IP" = "" ]]; then |
||||||
|
IP=$(wget -4qO- "http://whatismyip.akamai.com/") |
||||||
|
fi |
||||||
@ -0,0 +1,137 @@ |
|||||||
|
#!/usr/bin/env bash |
||||||
|
|
||||||
|
STARTDIR=$(pwd) |
||||||
|
|
||||||
|
DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd ) |
||||||
|
source $DIR/env.sh |
||||||
|
|
||||||
|
if [[ "$EUID" -ne 0 ]]; then |
||||||
|
echo "Sorry, you need to run this as root" |
||||||
|
exit 1 |
||||||
|
fi |
||||||
|
|
||||||
|
echo |
||||||
|
echo "Installing OpenVPN..." |
||||||
|
apt-get install openvpn easy-rsa |
||||||
|
|
||||||
|
echo |
||||||
|
echo "Configuring routing..." |
||||||
|
$DIR/sysctl.sh |
||||||
|
|
||||||
|
echo |
||||||
|
echo "Installing configuration files..." |
||||||
|
yes | cp -rf $DIR/openvpn-server.conf.dist $OPENVPNCONFIG |
||||||
|
|
||||||
|
sed -i -e "s@CADIR@$CADIR@g" $OPENVPNCONFIG |
||||||
|
sed -i -e "s@LOCALPREFIX@$LOCALPREFIX@g" $OPENVPNCONFIG |
||||||
|
sed -i -e "s@NOBODYGROUP@$NOBODYGROUP@g" $OPENVPNCONFIG |
||||||
|
|
||||||
|
echo |
||||||
|
echo "Configuring iptables firewall..." |
||||||
|
$DIR/iptables-setup.sh |
||||||
|
|
||||||
|
echo |
||||||
|
echo "Do you want to create routing or bridging OpenVPN mode? " |
||||||
|
echo "More information at: https://community.openvpn.net/openvpn/wiki/309-what-is-the-difference-between-bridging-and-routing" |
||||||
|
echo " 1) routing" |
||||||
|
echo " 2) bridging" |
||||||
|
echo |
||||||
|
read -p "Your choice [1 or 2]: " -e -i 1 MODE |
||||||
|
case $MODE in |
||||||
|
1) |
||||||
|
DEVICE="tun" |
||||||
|
sed -i -e "s/DEVICE/tun/g" $OPENVPNCONFIG |
||||||
|
sed -i -e "/server-bridge/d" $OPENVPNCONFIG |
||||||
|
;; |
||||||
|
2) |
||||||
|
DEVICE="tap" |
||||||
|
sed -i -e "s/DEVICE/tap/g" $OPENVPNCONFIG |
||||||
|
sed -i -e "/server /d" $OPENVPNCONFIG |
||||||
|
;; |
||||||
|
*) |
||||||
|
echo "Hm... Strange answer..." |
||||||
|
exit |
||||||
|
;; |
||||||
|
esac |
||||||
|
|
||||||
|
echo |
||||||
|
echo "Configuring DNS parameters..." |
||||||
|
$DIR/dns.sh |
||||||
|
|
||||||
|
echo |
||||||
|
echo "Creating server keys..." |
||||||
|
make-cadir $CADIR |
||||||
|
cd $CADIR |
||||||
|
source ./vars |
||||||
|
./clean-all |
||||||
|
./build-ca |
||||||
|
./build-key-server --batch openvpn-server |
||||||
|
./build-dh |
||||||
|
openvpn --genkey --secret ta.key |
||||||
|
|
||||||
|
ADDUSER="no" |
||||||
|
ANSUSER="yes" |
||||||
|
|
||||||
|
echo |
||||||
|
echo "Configuring VPN users..." |
||||||
|
while [ "$ANSUSER" != "$ADDUSER" ]; |
||||||
|
do |
||||||
|
while [[ -z "$LOGIN" ]]; |
||||||
|
do |
||||||
|
read -p "Enter name: " LOGIN |
||||||
|
done |
||||||
|
|
||||||
|
./build-key --batch $LOGIN |
||||||
|
|
||||||
|
if [ $? -eq 0 ]; then |
||||||
|
|
||||||
|
# copy files and OVPN config |
||||||
|
mkdir "$STARTDIR/$LOGIN" |
||||||
|
cp $CADIR/keys/ca.crt $CADIR/keys/$LOGIN.key $CADIR/keys/$LOGIN.crt ta.key "$STARTDIR/$LOGIN/" |
||||||
|
|
||||||
|
DIST="$STARTDIR/$LOGIN/openvpn-server.ovpn" |
||||||
|
cp $DIR/openvpn-server.ovpn.dist $DIST |
||||||
|
sed -i -e "s@LOGIN@$LOGIN@g" $DIST |
||||||
|
sed -i -e "s@IP@$IP@g" $DIST |
||||||
|
sed -i -e "s@DEVICE@$DEVICE@g" $DIST |
||||||
|
|
||||||
|
SRC="$STARTDIR/$LOGIN" |
||||||
|
DIST="$STARTDIR/$LOGIN/openvpn-server-embedded.ovpn" |
||||||
|
cp $DIR/openvpn-server-embedded.ovpn.dist $DIST |
||||||
|
sed -i -e "s@IP@$IP@g" $DIST |
||||||
|
sed -i -e "s@DEVICE@$DEVICE@g" $DIST |
||||||
|
|
||||||
|
echo "<ca>" >> $DIST |
||||||
|
cat $SRC/ca.crt >> $DIST |
||||||
|
echo "</ca>" >> $DIST |
||||||
|
|
||||||
|
echo "<cert>" >> $DIST |
||||||
|
cat $SRC/$LOGIN.crt >> $DIST |
||||||
|
echo "</cert>" >> $DIST |
||||||
|
|
||||||
|
echo "<key>" >> $DIST |
||||||
|
cat $SRC/$LOGIN.key >> $DIST |
||||||
|
echo "</key>" >> $DIST |
||||||
|
|
||||||
|
echo "<tls-auth>" >> $DIST |
||||||
|
cat $SRC/ta.key >> $DIST |
||||||
|
echo "</tls-auth>" >> $DIST |
||||||
|
|
||||||
|
echo |
||||||
|
echo "Created directory $STARTDIR/$LOGIN with necessary files." |
||||||
|
chown -R ${USER:=$(/usr/bin/id -run)}:$USER $STARTDIR/$LOGIN/ |
||||||
|
|
||||||
|
fi |
||||||
|
|
||||||
|
read -p "Would you want add another user? [no] " ANSUSER |
||||||
|
: ${ANSUSER:=$ADDUSER} |
||||||
|
done |
||||||
|
|
||||||
|
echo |
||||||
|
echo "Starting OpenVPN..." |
||||||
|
systemctl enable openvpn |
||||||
|
service openvpn restart |
||||||
|
|
||||||
|
echo |
||||||
|
echo "Installation script completed!" |
||||||
|
|
||||||
@ -0,0 +1,88 @@ |
|||||||
|
#!/usr/bin/env bash |
||||||
|
|
||||||
|
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" |
||||||
|
source $DIR/env.sh |
||||||
|
|
||||||
|
if [[ ! -e $IPTABLES ]]; then |
||||||
|
touch $IPTABLES |
||||||
|
fi |
||||||
|
|
||||||
|
if [[ ! -e $IPTABLES ]] || [[ ! -r $IPTABLES ]] || [[ ! -w $IPTABLES ]]; then |
||||||
|
echo "$IPTABLES is not exist or not accessible (are you root?)" |
||||||
|
exit 1 |
||||||
|
fi |
||||||
|
|
||||||
|
# backup and remove rules with $LOCALIP |
||||||
|
iptables-save > $IPTABLES.backup |
||||||
|
|
||||||
|
IFS=$'\n' |
||||||
|
|
||||||
|
iptablesclear=$(iptables -S -t nat | sed -n -e '/$LOCALPREFIX/p' | sed -e 's/-A/-D/g') |
||||||
|
for line in $iptablesclear |
||||||
|
do |
||||||
|
cmd="iptables -t nat $line" |
||||||
|
eval $cmd |
||||||
|
done |
||||||
|
|
||||||
|
# detect default gateway interface |
||||||
|
echo "Found next network interfaces:" |
||||||
|
ifconfig -a | sed 's/[ \t].*//;/^\(lo\|\)$/d' |
||||||
|
echo |
||||||
|
GATE=$(route | grep '^default' | grep -o '[^ ]*$') |
||||||
|
read -p "Enter your external network interface: " -i $GATE -e GATE |
||||||
|
|
||||||
|
STATIC="yes" |
||||||
|
read -p "Your external IP is $IP. Is this IP static? [yes] " ANSIP |
||||||
|
: ${ANSIP:=$STATIC} |
||||||
|
|
||||||
|
if [ "$STATIC" == "$ANSIP" ]; then |
||||||
|
# SNAT |
||||||
|
sed -i -e "s@PUBLICIP@$IP@g" $OPENVPNCONFIG |
||||||
|
iptables -t nat -A POSTROUTING -s $LOCALIPMASK -o $GATE -j SNAT --to-source $IP |
||||||
|
else |
||||||
|
# MASQUERADE |
||||||
|
sed -i -e "/PUBLICIP/d" $OPENVPNCONFIG |
||||||
|
iptables -t nat -A POSTROUTING -o $GATE -j MASQUERADE |
||||||
|
fi |
||||||
|
|
||||||
|
DROP="yes" |
||||||
|
read -p "Would you want to disable client-to-client routing? [yes] " ANSDROP |
||||||
|
: ${ANSDROP:=$DROP} |
||||||
|
|
||||||
|
if [ "$DROP" == "$ANSDROP" ]; then |
||||||
|
# disable forwarding |
||||||
|
sed -i -e "/client-to-client/d" $OPENVPNCONFIG |
||||||
|
iptables -I FORWARD -s $LOCALIPMASK -d $LOCALIPMASK -j DROP |
||||||
|
iptables -A FORWARD -i tun+ -o tun+ -j DROP |
||||||
|
iptables -A FORWARD -i tap+ -o tap+ -j DROP |
||||||
|
else |
||||||
|
echo "Deleting DROP rules if exists..." |
||||||
|
iptables -D FORWARD -s $LOCALIPMASK -d $LOCALIPMASK -j DROP |
||||||
|
iptables -D FORWARD -i tap+ -o tap+ -j DROP |
||||||
|
iptables -D FORWARD -i tun+ -o tun+ -j DROP |
||||||
|
fi |
||||||
|
|
||||||
|
# MSS Clamping |
||||||
|
iptables -t mangle -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu |
||||||
|
|
||||||
|
# TUN/TAP |
||||||
|
iptables -A INPUT -i tun+ -j ACCEPT |
||||||
|
iptables -A INPUT -i tap+ -j ACCEPT |
||||||
|
iptables -A OUTPUT -o tun+ -j ACCEPT |
||||||
|
iptables -A OUTPUT -o tap+ -j ACCEPT |
||||||
|
|
||||||
|
# OpenVPN |
||||||
|
iptables -A INPUT -p udp --dport 1194 -j ACCEPT |
||||||
|
|
||||||
|
iptables-save | awk '($0 !~ /^-A/)||!($0 in a) {a[$0];print}' > $IPTABLES |
||||||
|
|
||||||
|
RESTORPRESENTS=$(grep iptables-restore $RCLOCAL) |
||||||
|
if [ $? -ne 0 ]; then |
||||||
|
sed -i -e "/exit 0/d" $RCLOCAL |
||||||
|
echo "iptables-restore < $IPTABLES" >> $RCLOCAL |
||||||
|
echo "exit 0" >> $RCLOCAL |
||||||
|
fi |
||||||
|
|
||||||
|
iptables -F |
||||||
|
iptables-restore < $IPTABLES |
||||||
|
|
||||||
@ -0,0 +1,12 @@ |
|||||||
|
client |
||||||
|
dev DEVICE |
||||||
|
persist-key |
||||||
|
persist-tun |
||||||
|
tls-client |
||||||
|
cipher DES-EDE3-CBC |
||||||
|
remote IP |
||||||
|
port 1194 |
||||||
|
proto udp |
||||||
|
resolv-retry infinite |
||||||
|
redirect-gateway |
||||||
|
key-direction 1 |
||||||
@ -0,0 +1,25 @@ |
|||||||
|
mode server |
||||||
|
port 1194 |
||||||
|
proto udp |
||||||
|
dev DEVICE |
||||||
|
ca CADIR/keys/ca.crt |
||||||
|
cert CADIR/keys/openvpn-server.crt |
||||||
|
key CADIR/keys/openvpn-server.key |
||||||
|
dh CADIR/keys/dh2048.pem |
||||||
|
tls-server |
||||||
|
tls-auth CADIR/ta.key 0 |
||||||
|
server LOCALPREFIX.0.0 255.255.255.0 |
||||||
|
server-bridge LOCALPREFIX.0.1 255.255.255.0 LOCALPREFIX.0.10 LOCALPREFIX.0.100 |
||||||
|
local PUBLICIP |
||||||
|
client-to-client |
||||||
|
cipher DES-EDE3-CBC |
||||||
|
user nobody |
||||||
|
group NOBODYGROUP |
||||||
|
max-clients 100 |
||||||
|
keepalive 10 120 |
||||||
|
persist-key |
||||||
|
persist-tun |
||||||
|
push "route-gateway dhcp" |
||||||
|
push "redirect-gateway def1 bypass-dhcp" |
||||||
|
push "dhcp-option DNS 8.8.8.8" |
||||||
|
push "dhcp-option DNS 8.8.4.4" |
||||||
@ -0,0 +1,16 @@ |
|||||||
|
client |
||||||
|
dev DEVICE |
||||||
|
persist-key |
||||||
|
persist-tun |
||||||
|
cipher DES-EDE3-CBC |
||||||
|
remote IP |
||||||
|
port 1194 |
||||||
|
proto udp |
||||||
|
resolv-retry infinite |
||||||
|
redirect-gateway |
||||||
|
tls-client |
||||||
|
tls-auth ta.key 1 |
||||||
|
ca ca.crt |
||||||
|
cert LOGIN.crt |
||||||
|
key LOGIN.key |
||||||
|
|
||||||
@ -0,0 +1,33 @@ |
|||||||
|
#!/usr/bin/env bash |
||||||
|
|
||||||
|
DIR=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd ) |
||||||
|
source $DIR/env.sh |
||||||
|
|
||||||
|
if [[ ! -e $SYSCTLCONFIG ]] || [[ ! -r $SYSCTLCONFIG ]] || [[ ! -w $SYSCTLCONFIG ]]; then |
||||||
|
echo "$SYSCTLCONFIG is not exist or not accessible (are you root?)" |
||||||
|
exit 1 |
||||||
|
fi |
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.ip_forward/d" $SYSCTLCONFIG |
||||||
|
echo "net.ipv4.ip_forward=1" >> $SYSCTLCONFIG |
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.conf.all.accept_redirects/d" $SYSCTLCONFIG |
||||||
|
echo "net.ipv4.conf.all.accept_redirects=0" >> $SYSCTLCONFIG |
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.conf.all.send_redirects/d" $SYSCTLCONFIG |
||||||
|
echo "net.ipv4.conf.all.send_redirects=0" >> $SYSCTLCONFIG |
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.conf.default.rp_filter/d" $SYSCTLCONFIG |
||||||
|
echo "net.ipv4.conf.default.rp_filter=0" >> $SYSCTLCONFIG |
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.conf.default.accept_source_route/d" $SYSCTLCONFIG |
||||||
|
echo "net.ipv4.conf.default.accept_source_route=0" >> $SYSCTLCONFIG |
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.conf.default.send_redirects/d" $SYSCTLCONFIG |
||||||
|
echo "net.ipv4.conf.default.send_redirects=0" >> $SYSCTLCONFIG |
||||||
|
|
||||||
|
sed -i -e "/net.ipv4.icmp_ignore_bogus_error_responses/d" $SYSCTLCONFIG |
||||||
|
echo "net.ipv4.icmp_ignore_bogus_error_responses=1" >> $SYSCTLCONFIG |
||||||
|
|
||||||
|
sysctl -p |
||||||
|
service procps restart |
||||||
Loading…
Reference in new issue