From ca0735cbcbb79f2557b4c1685777ec13f30bc370 Mon Sep 17 00:00:00 2001 From: Simon Rieger Date: Sun, 1 Oct 2017 15:03:40 +0200 Subject: [PATCH] openvpn-script-2.4-update --- openvpn-install.sh | 401 +++++++++++++++++++++++++++++++++------------ 1 file changed, 297 insertions(+), 104 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 7e7b886..0c7efef 100755 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -25,7 +25,7 @@ if [[ -e /etc/debian_version ]]; then VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID") RCLOCAL='/etc/rc.local' SYSCTL='/etc/sysctl.conf' - if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then + if [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then echo "Your version of Debian/Ubuntu is not supported." echo "I can't install a recent version of OpenVPN on your system." echo "" @@ -57,9 +57,7 @@ fi newclient () { # Where to write the custom client.ovpn? - if [ -e /home/$1 ]; then # if $1 is a user name - homeDir="/home/$1" - elif [ ${SUDO_USER} ]; then # if not, use SUDO_USER + if [ ${SUDO_USER} ]; then # if not, use SUDO_USER homeDir="/home/${SUDO_USER}" else # if not SUDO_USER, use /root homeDir="/root" @@ -75,10 +73,18 @@ newclient () { echo "" >> $homeDir/$1.ovpn cat /etc/openvpn/easy-rsa/pki/private/$1.key >> $homeDir/$1.ovpn echo "" >> $homeDir/$1.ovpn - echo "key-direction 1" >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn - cat /etc/openvpn/tls-auth.key >> $homeDir/$1.ovpn - echo "" >> $homeDir/$1.ovpn + #We verify if we used tls-crypt or tls-auth during the installation + TLS_SIG=$(cat /etc/openvpn/TLS_SIG) + if [[ $TLS_SIG == "1" ]]; then + echo "" >> ~/$1.ovpn + cat /etc/openvpn/tls-crypt.key >> ~/$1.ovpn + echo "" >> ~/$1.ovpn + elif [[ $TLS_SIG == "2" ]]; then + echo "key-direction 1" >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + cat /etc/openvpn/tls-auth.key >> $homeDir/$1.ovpn + echo "" >> $homeDir/$1.ovpn + fi } # Try to get our IP from the system and fallback to the Internet. @@ -183,6 +189,13 @@ if [[ -e /etc/openvpn/server.conf ]]; then fi rm -rf /etc/openvpn rm -rf /usr/share/doc/openvpn* + # Where are the client files? + if [ ${SUDO_USER} ]; then # if not, use SUDO_USER + homeDir="/home/${SUDO_USER}" + else # if not SUDO_USER, use /root + homeDir="/root" + fi + rm $homeDir*/.ovpn echo "" echo "OpenVPN removed!" else @@ -212,8 +225,10 @@ else echo "" echo "What protocol do you want for OpenVPN?" echo "Unless UDP is blocked, you should not use TCP (unnecessarily slower)" - while [[ $PROTOCOL != "UDP" && $PROTOCOL != "TCP" ]]; do - read -p "Protocol [UDP/TCP]: " -e -i UDP PROTOCOL + echo " 1) UDP (recommended)" + echo " 2) TCP" + while [[ $PROTOCOL != "1" && $PROTOCOL != "2" ]]; do + read -p "Protocol [1-2]: " -e -i 1 PROTOCOL done echo "" echo "What DNS do you want to use with the VPN?" @@ -227,83 +242,246 @@ else read -p "DNS [1-6]: " -e -i 1 DNS done echo "" + echo "Choose which compression algorithm you want to use:" + echo " 1) LZ4 (faster)" + echo " 2) LZ0 (use for OpenVPN 2.3 compatibility" + while [[ $COMPRESSION != "1" && $COMPRESSION != "2" ]]; do + read -p "Compression algorithm [1-2]: " -e -i 1 COMPRESSION + done + case $COMPRESSION in + 1) + COMPRESSION="lz4" + ;; + 2) + COMPRESSION="lzo" + ;; + esac + echo "" echo "See https://github.com/Angristan/OpenVPN-install#encryption to learn more about " - echo "the encryption in OpenVPN and the choices I made in this script." - echo "Please note that all the choices proposed are secure (to a different degree)" - echo "and are still viable to date, unlike some default OpenVPN options" - echo '' + echo "the encryption in OpenVPN and the choices proposed in this script." + echo "Please note that all the choices proposed are secure enough considering today's strandards, unlike some default OpenVPN options" + echo "You can just type "enter" if you don't know what to choose." + echo "Note that if you want to use an OpenVPN 2.3 client, You'll have to choose OpenVPN 2.3-compatible options." + echo "All OpenVPN 2.3-compatible choices are specified for each following option." + echo "" echo "Choose which cipher you want to use for the data channel:" - echo " 1) AES-128-CBC (fastest and sufficiently secure for everyone, recommended)" - echo " 2) AES-192-CBC" - echo " 3) AES-256-CBC" - echo "Alternatives to AES, use them only if you know what you're doing." - echo "They are relatively slower but as secure as AES." - echo " 4) CAMELLIA-128-CBC" - echo " 5) CAMELLIA-192-CBC" - echo " 6) CAMELLIA-256-CBC" - echo " 7) SEED-CBC" - while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" && $CIPHER != "7" ]]; do - read -p "Cipher [1-7]: " -e -i 1 CIPHER + echo " 1) AES-128-GCM (recommended)" + echo " 2) AES-192-GCM" + echo " 3) AES-256-GCM" + echo "Only use AES-CBC for OpenVPN 2.3 compatibilty" + echo " 4) AES-128-CBC" + echo " 5) AES-192-CBC" + echo " 6) AES-256-CBC" + while [[ $CIPHER != "1" && $CIPHER != "2" && $CIPHER != "3" && $CIPHER != "4" && $CIPHER != "5" && $CIPHER != "6" ]]; do + read -p "Data channel cipher [1-6]: " -e -i 1 CIPHER done case $CIPHER in 1) - CIPHER="cipher AES-128-CBC" + CIPHER="cipher AES-128-GCM" ;; 2) - CIPHER="cipher AES-192-CBC" + CIPHER="cipher AES-192-GCM" ;; 3) - CIPHER="cipher AES-256-CBC" + CIPHER="cipher AES-256-GCM" ;; 4) - CIPHER="cipher CAMELLIA-128-CBC" + CIPHER="cipher AES-128-CBC" ;; 5) - CIPHER="cipher CAMELLIA-192-CBC" + CIPHER="cipher AES-192-CBC" ;; 6) - CIPHER="cipher CAMELLIA-256-CBC" - ;; - 7) - CIPHER="cipher SEED-CBC" + CIPHER="cipher AES-256-CBC" ;; esac echo "" - echo "Choose what size of Diffie-Hellman key you want to use:" - echo " 1) 2048 bits (fastest)" - echo " 2) 3072 bits (recommended, best compromise)" - echo " 3) 4096 bits (most secure)" - while [[ $DH_KEY_SIZE != "1" && $DH_KEY_SIZE != "2" && $DH_KEY_SIZE != "3" ]]; do - read -p "DH key size [1-3]: " -e -i 2 DH_KEY_SIZE + echo "Choose what kind of certificate you want to use:" + echo "Elleptic Curves keys (EC) are recommended, they're faster, lighter and more secure." + echo "Use RSA for OpenVPN 2.3 compatibilty" + echo " 1) ECDSA (recommended)" + echo " 2) RSA" + while [[ $CERT_TYPE != "1" && $CERT_TYPE != "2" ]]; do + read -p "Certificate type [1-2]: " -e -i 1 CERT_TYPE done - case $DH_KEY_SIZE in + case $CERT_TYPE in 1) - DH_KEY_SIZE="2048" + echo "" + echo "Choose which curve you want to use for the EC key:" + echo " 1) secp256r1" + echo " 2) secp384r1 (recommended)" + echo " 3) secp521r1" + while [[ $CERT_CURVE != "1" && $CERT_CURVE != "2" && $CERT_CURVE != "3" ]]; do + read -p "Curve [1-3]: " -e -i 2 CERT_CURVE + done + case $CERT_CURVE in + 1) + CERT_CURVE="secp256r1" + ;; + 2) + CERT_CURVE="secp384r1" + ;; + 3) + CERT_CURVE="secp521r1" + ;; + esac ;; 2) - DH_KEY_SIZE="3072" - ;; - 3) - DH_KEY_SIZE="4096" + echo "" + echo "Choose which RSA key size you want to use:" + echo " 1) 2048 bits" + echo " 2) 3072 bits (recommended)" + echo " 3) 4096 bits" + while [[ $RSA_SIZE != "1" && $RSA_SIZE != "2" && $RSA_SIZE != "3" ]]; do + read -p "DH key size [1-3]: " -e -i 2 RSA_SIZE + done + case $RSA_SIZE in + 1) + RSA_SIZE="2048" + ;; + 2) + RSA_SIZE="3072" + ;; + 3) + RSA_SIZE="4096" + ;; + esac ;; esac echo "" - echo "Choose what size of RSA key you want to use:" - echo " 1) 2048 bits (fastest)" - echo " 2) 3072 bits (recommended, best compromise)" - echo " 3) 4096 bits (most secure)" - while [[ $RSA_KEY_SIZE != "1" && $RSA_KEY_SIZE != "2" && $RSA_KEY_SIZE != "3" ]]; do - read -p "DH key size [1-3]: " -e -i 2 RSA_KEY_SIZE + echo "Choose which hash algorithm you want to use for the certificate:" + echo " 1) SHA-256" + echo " 2) SHA-384 (recommended)" + echo " 3) SHA-512" + while [[ $CERT_HASH != "1" && $CERT_HASH != "2" && $CERT_HASH != "3" ]]; do + read -p "Hash algorithm [1-3]: " -e -i 2 CERT_HASH done - case $RSA_KEY_SIZE in + case $CERT_HASH in 1) - RSA_KEY_SIZE="2048" + CERT_HASH="sha256" ;; 2) - RSA_KEY_SIZE="3072" + CERT_HASH="sha384" ;; 3) - RSA_KEY_SIZE="4096" + CERT_HASH="sha512" + ;; + esac + echo "" + echo "Choose what kind of Diffie-Hellman key you want to use." + echo "Elleptic Curves (EC) are recommended, they're faster, lighter and more secure." + echo "Use DH for OpenVPN 2.3 compatibilty" + echo " 1) ECDH (recommended)" + echo " 2) DH" + while [[ $DH_TYPE != "1" && $DH_TYPE != "2" ]]; do + read -p "DH key type [1-2]: " -e -i 1 DH_TYPE + done + case $DH_TYPE in + 1) + echo "" + echo "Choose which curve you want to use for the ECDH key" + echo " 1) secp256r1" + echo " 2) secp384r1 (recommended)" + echo " 3) secp521r1" + while [[ $DH_CURVE != "1" && $DH_CURVE != "2" && $DH_CURVE != "3" ]]; do + read -p "Curve [1-3]: " -e -i 2 DH_CURVE + done + case $DH_CURVE in + 1) + DH_CURVE="secp256r1" + ;; + 2) + DH_CURVE="secp384r1" + ;; + 3) + DH_CURVE="secp521r1" + ;; + esac + ;; + 2) + echo"" + echo "Choose which DH key size you want to use" + echo " 1) 2048 bits" + echo " 2) 3072 bits (recommended)" + echo " 3) 4096 bits" + while [[ $DH_SIZE != "1" && $DH_SIZE != "2" && $DH_SIZE != "3" ]]; do + read -p "DH key size [1-3]: " -e -i 2 DH_SIZE + done + case $DH_SIZE in + 1) + DH_SIZE="2048" + ;; + 2) + DH_SIZE="3072" + ;; + 3) + DH_SIZE="4096" + ;; + esac + ;; + esac + echo "" + echo "Choose which cipher you want to use for the control channel:" + if [[ "$CERT_TYPE" = '1' ]]; then + echo " 1) ECDHE-ECDSA-AES-256-GCM-SHA384 (recommended)" + echo " 2) ECDHE-ECDSA-AES-128-GCM-SHA256" + while [[ $CC_ENC != "1" && $CC_ENC != "2" ]]; do + read -p "Control channel cipher [1-2]: " -e -i 1 CC_ENC + done + case $CC_ENC in + 1) + CC_ENC="TLS-ECDHE-ECDSA-WITH-AES-256-GCM-SHA384" + ;; + 2) + CC_ENC="TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256" + ;; + esac + elif [[ "$CERT_TYPE" = '2' ]]; then + echo " 1) ECDHE-RSA-AES-256-GCM-SHA384 (recommended)" + echo " 2) ECDHE-RSA-AES-128-GCM-SHA256" + while [[ $CC_ENC != "1" && $CC_ENC != "2" ]]; do + read -p "Control channel cipher [1-2]: " -e -i 1 CC_ENC + done + case $CC_ENC in + 1) + CC_ENC="TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384" + ;; + 2) + CC_ENC="TLS-ECDHE-RSA-WITH-AES-128-GCM-SHA256" + ;; + esac + fi + echo "" + echo "Do you want to use tls-crypt or tls-auth?" + echo "They both encrypt and authenticate all control channel packets with a key." + echo "tls-crypt is more advanced and secure than tls-auth, but it's an OpenVPN 2.4 feature." + echo " 1) tls-crypt (recommended)" + echo " 2) tls-auth (use only for OpenVPN 2.3 client compatibility)" + while [[ $TLS_SIG != "1" && $TLS_SIG != "2" ]]; do + read -p "Crontrol channel additional security layer [1-2]: " -e -i 1 TLS_SIG + done + echo"" + if [[ $CIPHER = "cipher AES-256-GCM" ]] || [[ $CIPHER = "cipher AES-192-GCM" ]] || [[ $CIPHER = "cipher AES-128-GCM" ]]; then + echo "Choose which message digest algorithm you want to use for the tls-auth/tls-crypt control channel packets:" + elif [[ $CIPHER = "cipher AES-256-CBC" ]] || [[ $CIPHER = "cipher AES-192-CBC" ]] || [[ $CIPHER = "cipher AES-128-CBC" ]]; then + echo "Choose which message digest algorithm you want to use for the data channel packets" + echo "and the tls-auth/tls-crypt control channel packets:" + fi + echo " 1) SHA-256" + echo " 2) SHA-384 (recommended)" + echo " 3) SHA-512" + while [[ $HMAC_AUTH != "1" && $HMAC_AUTH != "2" && $HMAC_AUTH != "3" ]]; do + read -p "HMAC authentication algorithm [1-3]: " -e -i 2 HMAC_AUTH + done + case $HMAC_AUTH in + 1) + HMAC_AUTH="SHA256" + ;; + 2) + HMAC_AUTH="SHA384" + ;; + 3) + HMAC_AUTH="SHA512" ;; esac echo "" @@ -319,32 +497,22 @@ else if [[ "$OS" = 'debian' ]]; then apt-get install ca-certificates -y # We add the OpenVPN repo to get the latest version. - # Debian 7 - if [[ "$VERSION_ID" = 'VERSION_ID="7"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable wheezy main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi # Debian 8 if [[ "$VERSION_ID" = 'VERSION_ID="8"' ]]; then echo "deb http://build.openvpn.net/debian/openvpn/stable jessie main" > /etc/apt/sources.list.d/openvpn.list wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt update - fi - # Ubuntu 12.04 - if [[ "$VERSION_ID" = 'VERSION_ID="12.04"' ]]; then - echo "deb http://build.openvpn.net/debian/openvpn/stable precise main" > /etc/apt/sources.list.d/openvpn.list - wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update - fi # Ubuntu 14.04 - if [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then + elif [[ "$VERSION_ID" = 'VERSION_ID="14.04"' ]]; then echo "deb http://build.openvpn.net/debian/openvpn/stable trusty main" > /etc/apt/sources.list.d/openvpn.list wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - - apt-get update + # Ubuntu 16.04 + elif [[ "$VERSION_ID" = 'VERSION_ID="16.04"' ]]; then + echo "deb http://build.openvpn.net/debian/openvpn/stable xenial main" > /etc/apt/sources.list.d/openvpn.list + wget -O - https://swupdate.openvpn.net/repos/repo-public.gpg | apt-key add - fi - # Ubuntu >= 16.04 and Debian > 8 have OpenVPN > 2.3.3 without the need of a third party repository. + # Ubuntu >= 17.04 and Debian > 9 have OpenVPN 2.4 without the need of a third party repository. # The we install OpenVPN + apt-get update apt-get install openvpn iptables openssl wget ca-certificates curl -y elif [[ "$OS" = 'centos' ]]; then yum install epel-release -y @@ -392,6 +560,10 @@ WantedBy=multi-user.target" > /etc/systemd/system/rc-local.service systemctl start iptables fi fi + + #To remember if we use tls-crypt or tls-auth when generating a new client conf + echo $TLS_SIG > /etc/openvpn/TLS_SIG + # Find out if the machine uses nogroup or nobody for the permissionless group if grep -qs "^nogroup:" /etc/group; then NOGROUP=nogroup @@ -411,27 +583,42 @@ WantedBy=multi-user.target" > /etc/systemd/system/rc-local.service chown -R root:root /etc/openvpn/easy-rsa/ rm -rf ~/EasyRSA-3.0.3.tgz cd /etc/openvpn/easy-rsa/ - echo "set_var EASYRSA_KEY_SIZE $RSA_KEY_SIZE" > vars + if [[ $CERT_TYPE == "1" ]]; then + echo "set_var EASYRSA_ALGO ec +set_var EASYRSA_CURVE $CERT_CURVE" > vars + elif [[ $CERT_TYPE == "2" ]]; then + echo "set_var EASYRSA_KEY_SIZE $RSA_SIZE" > vars + fi + echo 'set_var EASYRSA_DIGEST "'$CERT_HASH'"' >> vars # Create the PKI, set up the CA, the DH params and the server + client certificates ./easyrsa init-pki ./easyrsa --batch build-ca nopass - openssl dhparam -out dh.pem $DH_KEY_SIZE + if [[ $DH_TYPE == "2" ]]; then + openssl dhparam -out dh.pem $DH_SIZE + fi ./easyrsa build-server-full server nopass ./easyrsa build-client-full $CLIENT nopass ./easyrsa gen-crl - # generate tls-auth key - openvpn --genkey --secret /etc/openvpn/tls-auth.key + if [[ $TLS_SIG == "1" ]]; then + # Generate tls-crypt key + openvpn --genkey --secret /etc/openvpn/tls-crypt.key + elif [[ $TLS_SIG == "2" ]]; then + # Generate tls-auth key + openvpn --genkey --secret /etc/openvpn/tls-auth.key + fi # Move all the generated files - cp pki/ca.crt pki/private/ca.key dh.pem pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn + cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key /etc/openvpn/easy-rsa/pki/crl.pem /etc/openvpn + if [[ $DH_TYPE == "2" ]]; then + cp dh.pem /etc/openvpn + fi # Make cert revocation list readable for non-root chmod 644 /etc/openvpn/crl.pem # Generate server.conf - echo "local $IP" > /etc/openvpn/server.conf - echo "port $PORT" >> /etc/openvpn/server.conf - if [[ "$PROTOCOL" = 'UDP' ]]; then + echo "port $PORT" > /etc/openvpn/server.conf + if [[ "$PROTOCOL" = '1' ]]; then echo "proto udp" >> /etc/openvpn/server.conf - elif [[ "$PROTOCOL" = 'TCP' ]]; then + elif [[ "$PROTOCOL" = '2' ]]; then echo "proto tcp" >> /etc/openvpn/server.conf fi echo "dev tun @@ -476,14 +663,25 @@ echo 'push "redirect-gateway def1 bypass-dhcp" '>> /etc/openvpn/server.conf echo "crl-verify crl.pem ca ca.crt cert server.crt -key server.key -tls-auth tls-auth.key 0 -dh dh.pem -auth SHA256 +key server.key" >> /etc/openvpn/server.conf +if [[ $TLS_SIG == "1" ]]; then + echo "tls-crypt tls-crypt.key 0" >> /etc/openvpn/server.conf +elif [[ $TLS_SIG == "2" ]]; then + echo "tls-auth tls-auth.key 0" >> /etc/openvpn/server.conf +fi +if [[ $DH_TYPE == "1" ]]; then + echo "dh none +ecdh-curve $DH_CURVE" >> /etc/openvpn/server.conf +elif [[ $DH_TYPE == "2" ]]; then + echo "dh dh.pem" >> /etc/openvpn/server.conf +fi +echo "auth $HMAC_AUTH $CIPHER +ncp-disable tls-server tls-version-min 1.2 -tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 +tls-cipher $CC_ENC +compress $COMPRESSION status openvpn.log verb 3" >> /etc/openvpn/server.conf @@ -512,10 +710,10 @@ verb 3" >> /etc/openvpn/server.conf # We don't use --add-service=openvpn because that would only work with # the default port. Using both permanent and not permanent rules to # avoid a firewalld reload. - if [[ "$PROTOCOL" = 'UDP' ]]; then + if [[ "$PROTOCOL" = '1' ]]; then firewall-cmd --zone=public --add-port=$PORT/udp firewall-cmd --permanent --zone=public --add-port=$PORT/udp - elif [[ "$PROTOCOL" = 'TCP' ]]; then + elif [[ "$PROTOCOL" = '2' ]]; then firewall-cmd --zone=public --add-port=$PORT/tcp firewall-cmd --permanent --zone=public --add-port=$PORT/tcp fi @@ -526,16 +724,16 @@ verb 3" >> /etc/openvpn/server.conf # If iptables has at least one REJECT rule, we asume this is needed. # Not the best approach but I can't think of other and this shouldn't # cause problems. - if [[ "$PROTOCOL" = 'UDP' ]]; then + if [[ "$PROTOCOL" = '1' ]]; then iptables -I INPUT -p udp --dport $PORT -j ACCEPT - elif [[ "$PROTOCOL" = 'TCP' ]]; then + elif [[ "$PROTOCOL" = '2' ]]; then iptables -I INPUT -p tcp --dport $PORT -j ACCEPT fi iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT - if [[ "$PROTOCOL" = 'UDP' ]]; then + if [[ "$PROTOCOL" = '1' ]]; then sed -i "1 a\iptables -I INPUT -p udp --dport $PORT -j ACCEPT" $RCLOCAL - elif [[ "$PROTOCOL" = 'TCP' ]]; then + elif [[ "$PROTOCOL" = '2' ]]; then sed -i "1 a\iptables -I INPUT -p tcp --dport $PORT -j ACCEPT" $RCLOCAL fi sed -i "1 a\iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT" $RCLOCAL @@ -549,9 +747,9 @@ verb 3" >> /etc/openvpn/server.conf if ! hash semanage 2>/dev/null; then yum install policycoreutils-python -y fi - if [[ "$PROTOCOL" = 'UDP' ]]; then + if [[ "$PROTOCOL" = '1' ]]; then semanage port -a -t openvpn_port_t -p udp $PORT - elif [[ "$PROTOCOL" = 'TCP' ]]; then + elif [[ "$PROTOCOL" = '2' ]]; then semanage port -a -t openvpn_port_t -p tcp $PORT fi fi @@ -609,9 +807,9 @@ verb 3" >> /etc/openvpn/server.conf fi # client-template.txt is created so we have a template to add further users later echo "client" > /etc/openvpn/client-template.txt - if [[ "$PROTOCOL" = 'UDP' ]]; then + if [[ "$PROTOCOL" = '1' ]]; then echo "proto udp" >> /etc/openvpn/client-template.txt - elif [[ "$PROTOCOL" = 'TCP' ]]; then + elif [[ "$PROTOCOL" = '2' ]]; then echo "proto tcp-client" >> /etc/openvpn/client-template.txt fi echo "remote $IP $PORT @@ -621,11 +819,11 @@ nobind persist-key persist-tun remote-cert-tls server -auth SHA256 +auth $HMAC_AUTH $CIPHER tls-client tls-version-min 1.2 -tls-cipher TLS-DHE-RSA-WITH-AES-128-GCM-SHA256 +tls-cipher $CC_ENC setenv opt block-outside-dns verb 3" >> /etc/openvpn/client-template.txt @@ -638,8 +836,3 @@ verb 3" >> /etc/openvpn/client-template.txt echo "If you want to add more clients, you simply need to run this script another time!" fi exit 0; - -# routing -iptables -t nat -F POSTROUTING -echo 1 > /proc/sys/net/ipv4/ip_forward -iptables -t nat -A POSTROUTING -o eth0 -s 10.8.0.0/24 -j MASQUERADE