shadowsocks-all.sh

fudyou

1. #!/bin/bash
   
2. #
   & t- ~2 l1 ^# I$ E/ i
3. # https://github.com/Nyr/openvpn-install
   
4. #
   - R! p0 B( d$ |$ U. e
5. # Copyright (c) 2013 Nyr. Released under the MIT License.
   
6. 
   
7. 
   
8. # Detect Debian users running the script with "sh" instead of bash
   ; @+ ^! Z) [+ }- g! b% m- t
9. if readlink /proc/$$/exe | grep -q "dash"; then
   
10.         echo 'This installer needs to be run with "bash", not "sh".'
    ) K9 ^. K' J& ~6 I4 G& X% {
11.         exit
    
12. fi
    
13. 
    
14. # Discard stdin. Needed when running from an one-liner which includes a newline
    
15. read -N 999999 -t 0.001
    
16. 
    
17. # Detect OpenVZ 6
    
18. if [[ $(uname -r | cut -d "." -f 1) -eq 2 ]]; then
    ) H7 W3 \; O4 e' x" T& e7 @5 H
19.         echo "The system is running an old kernel, which is incompatible with this installer."
    ' |# C1 N' |% R/ M: ~
20.         exit
    6 i* u+ O6 V' [# E! c
21. fi
    
22. 
    
23. # Detect OS
    + ^% E' U9 O: n
24. # $os_version variables aren't always in use, but are kept here for convenience
    1 R, H) U  D$ w1 |5 M" I2 y9 Z
25. if grep -qs "ubuntu" /etc/os-release; then
    " c: G" m2 P; Q' q3 N" ^
26.         os="ubuntu"
    
27.         os_version=$(grep 'VERSION_ID' /etc/os-release | cut -d '"' -f 2 | tr -d '.')
    - n. N+ i# s  b# y3 C
28.         group_name="nogroup"
    
29. elif [[ -e /etc/debian_version ]]; then
    : T% o' ^4 F6 D& o( Y: I) |
30.         os="debian"
    2 `& ]- D5 `; p9 k1 H/ k
31.         os_version=$(grep -oE '[0-9]+' /etc/debian_version | head -1)
    
32.         group_name="nogroup"
    
33. elif [[ -e /etc/almalinux-release || -e /etc/rocky-release || -e /etc/centos-release ]]; then
    
34.         os="centos"
    
35.         os_version=$(grep -shoE '[0-9]+' /etc/almalinux-release /etc/rocky-release /etc/centos-release | head -1)
    $ @, r4 ~" i& ]8 T/ X
36.         group_name="nobody"
    0 A9 F9 L1 p6 v& x9 y
37. elif [[ -e /etc/fedora-release ]]; then
    
38.         os="fedora"
    
39.         os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)
    ; N! W: _( E2 ^; m
40.         group_name="nobody"
    
41. else
    ; I- `8 w! x1 i& Z" K
42.         echo "This installer seems to be running on an unsupported distribution.
    . F: d  j4 z8 r* w
43. Supported distros are Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora."
    
44.         exit
    
45. fi
    
46. 
    
47. if [[ "$os" == "ubuntu" && "$os_version" -lt 1804 ]]; then
    
48.         echo "Ubuntu 18.04 or higher is required to use this installer.
    - y' c. S2 V  r: o5 ~
49. This version of Ubuntu is too old and unsupported."
    
50.         exit
    ; n0 z* A4 \6 e; g4 P- Z
51. fi
    
52. 
    & F6 F% e5 j- p# P
53. if [[ "$os" == "debian" && "$os_version" -lt 9 ]]; then
    1 w/ a1 ^6 z/ N! j/ C
54.         echo "Debian 9 or higher is required to use this installer.
    6 N& x* Y. o& N! x+ [
55. This version of Debian is too old and unsupported."
    ( l8 C. `8 k8 _+ s& b
56.         exit
    1 s) A8 z7 L4 U$ ~8 s& j& M0 w' b/ R
57. fi
    0 A, x3 J. V2 M2 z3 y. V
58. 
    
59. if [[ "$os" == "centos" && "$os_version" -lt 7 ]]; then
    ! R( A9 H% Y; ^# C; f
60.         echo "CentOS 7 or higher is required to use this installer.
    2 v# @% r; U9 d! B3 k# {
61. This version of CentOS is too old and unsupported."
    ) n8 d# P3 H/ j4 }; X! _; D
62.         exit
    % ~5 U$ S* s) g; E
63. fi
    
64. 
    7 M3 r  u+ j' G0 `0 d
65. # Detect environments where $PATH does not include the sbin directories
    ( [$ h2 |' p, D
66. if ! grep -q sbin <<< "$PATH"; then
    
67.         echo '$PATH does not include sbin. Try using "su -" instead of "su".'
    9 r8 I4 X3 f( l
68.         exit
    ' \) R2 p: B7 X/ V! k' a; P
69. fi
    ' g# |' \: n6 w
70. 
    ; g+ A* e8 Q# X. O
71. if [[ "$EUID" -ne 0 ]]; then
    * ]! G: q3 O4 J4 ^: W+ ~/ F
72.         echo "This installer needs to be run with superuser privileges."
    % V. V# [7 J7 }5 g' `  v/ G1 t
73.         exit
    . ~( r5 _7 C) G- b/ |
74. fi
    ! g  {" Y! y9 u& K3 d% Z
75. 
    
76. if [[ ! -e /dev/net/tun ]] || ! ( exec 7<>/dev/net/tun ) 2>/dev/null; then
    / a% y  e  {8 h6 m: q+ }1 o
77.         echo "The system does not have the TUN device available.
    & N3 U1 A8 u+ f8 r; \0 E
78. TUN needs to be enabled before running this installer."
    . g) t7 A& ~4 [& P8 D! I9 u' u
79.         exit
    
80. fi
    - f4 u3 {6 F) Q% d! m9 V) }% u
81. 
    + i, r4 \( p, R# h
82. new_client () {
    
83.         # Generates the custom client.ovpn
    * ^$ M6 ~* s3 t. y2 Y: N
84.         {
    
85.         cat /etc/openvpn/server/client-common.txt
    9 z( T0 q- v0 i& i% W
86.         echo "<ca>"
    ! ~# M! k) S, g' [1 ?
87.         cat /etc/openvpn/server/easy-rsa/pki/ca.crt
    
88.         echo "</ca>"
    
89.         echo "<cert>"
    ; G. a9 T/ A% b% p7 e6 V
90.         sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt
    
91.         echo "</cert>"
    ) C1 x; u7 Y. `
92.         echo "<key>"
    
93.         cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key
    
94.         echo "</key>"
    & [5 b4 k3 n& L) F3 a9 Z- I& D. C
95.         echo "<tls-crypt>"
    : W$ a% R8 s9 L, T5 y7 J  z9 v
96.         sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
    6 I- n" U! y1 Z6 l7 c6 Q
97.         echo "</tls-crypt>"
    
98.         } > ~/"$client".ovpn
    ; C% ]. t0 G3 D; c0 A8 u' N2 m
99. }
    5 W0 @7 Y9 E6 \1 t
100. 
     
101. if [[ ! -e /etc/openvpn/server/server.conf ]]; then
     7 A/ c: z% @5 s4 }" I7 {  v
102.         # Detect some Debian minimal setups where neither wget nor curl are installed
     2 e+ x: A* D' ^
103.         if ! hash wget 2>/dev/null && ! hash curl 2>/dev/null; then
     ; _1 j" z% Q' x+ X: t3 A
104.                 echo "Wget is required to use this installer."
     : U- ], |! T) Z& P: v
105.                 read -n1 -r -p "Press any key to install Wget and continue..."
     
106.                 apt-get update
     % i) A9 }3 T3 K6 M( n6 e
107.                 apt-get install -y wget
     " v* }7 j$ q1 f4 Z- l# ^6 F, `
108.         fi
     ( D3 r& N1 m* h$ R) |
109.         clear
     6 b$ z5 v7 ^: P8 |& b# p, l! g
110.         echo 'Welcome to this OpenVPN road warrior installer!'
     
111.         # If system has a single IPv4, it is selected automatically. Else, ask the user
     
112.         if [[ $(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}') -eq 1 ]]; then
     + K' ~$ ?; J" m2 _' Q: W
113.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}')
     ' g6 \1 N2 c5 I- _- h- ~8 T, R
114.         else
     
115.                 number_of_ip=$(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}')
     & d6 G0 M8 y+ Y: h' v- \! _
116.                 echo
     
117.                 echo "Which IPv4 address should be used?"
     
118.                 ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | nl -s ') '
     & s0 y7 [/ _3 n+ e& S# B- r
119.                 read -p "IPv4 address [1]: " ip_number
     ! J: U% {! e  W
120.                 until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ip" ]]; do
     
121.                         echo "$ip_number: invalid selection."
     
122.                         read -p "IPv4 address [1]: " ip_number
       F) A" V" }# Z# X& k# x+ Q
123.                 done
     
124.                 [[ -z "$ip_number" ]] && ip_number="1"
     
125.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sed -n "$ip_number"p)
     8 }, w7 P6 N2 e/ P3 T2 m0 ]
126.         fi
     
127.         # If $ip is a private IP address, the server must be behind NAT
     
128.         if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
     
129.                 echo
     
130.                 echo "This server is behind NAT. What is the public IPv4 address or hostname?"
     5 R* t& e/ k! L+ I
131.                 # Get public IP and sanitize with grep
     
132.                 get_public_ip=$(grep -m 1 -oE '^[0-9]{1,3}(\.[0-9]{1,3}){3}$' <<< "$(wget -T 10 -t 1 -4qO- "http://ip1.dynupdate.no-ip.com/" || curl -m 10 -4Ls "http://ip1.dynupdate.no-ip.com/")")
     
133.                 read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip
     8 \* r0 L9 {- l
134.                 # If the checkip service is unavailable and user didn't provide input, ask again
     
135.                 until [[ -n "$get_public_ip" || -n "$public_ip" ]]; do
     
136.                         echo "Invalid input."
     
137.                         read -p "Public IPv4 address / hostname: " public_ip
     
138.                 done
     1 ~% \, p2 K. s
139.                 [[ -z "$public_ip" ]] && public_ip="$get_public_ip"
     
140.         fi
     
141.         # If system has a single IPv6, it is selected automatically
     
142.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -eq 1 ]]; then
     
143.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}')
     . M8 J& T. G$ w
144.         fi
     ! G# O% `+ Q9 v& f' D2 H
145.         # If system has multiple IPv6, ask the user to select one
     
146.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -gt 1 ]]; then
     " F% \3 f+ j, P  }- n  |
147.                 number_of_ip6=$(ip -6 addr | grep -c 'inet6 [23]')
     / ]* V0 u1 W3 p- L0 j2 {
148.                 echo
     
149.                 echo "Which IPv6 address should be used?"
     
150.                 ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | nl -s ') '
     ; H$ [: }( R- x( F6 Q9 r8 o8 g
151.                 read -p "IPv6 address [1]: " ip6_number
     
152.                 until [[ -z "$ip6_number" || "$ip6_number" =~ ^[0-9]+$ && "$ip6_number" -le "$number_of_ip6" ]]; do
     
153.                         echo "$ip6_number: invalid selection."
     ; m5 P9 V# e# Y2 w* x
154.                         read -p "IPv6 address [1]: " ip6_number
     
155.                 done
     ' E+ M$ v, v# x; B: Z9 I
156.                 [[ -z "$ip6_number" ]] && ip6_number="1"
     
157.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | sed -n "$ip6_number"p)
     : A7 I" H1 o3 O7 P3 b1 v* D
158.         fi
     
159.         echo
     
160.         echo "Which protocol should OpenVPN use?"
     - Y7 A/ Z' w& O
161.         echo "   1) UDP (recommended)"
     3 A# t" ]: D  Z$ Y
162.         echo "   2) TCP"
     1 b9 s/ f. b. W4 [: F. n
163.         read -p "Protocol [1]: " protocol
     
164.         until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
     
165.                 echo "$protocol: invalid selection."
     ; v& O! v3 m: \. y
166.                 read -p "Protocol [1]: " protocol
     
167.         done
     ; Z, }9 ~& a" h' H' x. ~" X/ |
168.         case "$protocol" in
     
169.                 1|"")
     : d, e; i9 H6 o0 ]( k
170.                 protocol=udp
       s3 U9 }3 \/ M; @: e* V
171.                 ;;
     4 C! E( d3 x( u% B6 \+ E: H
172.                 2)
     - @; {7 U: e6 w+ r
173.                 protocol=tcp
     ' `0 Z3 A8 J: Y0 d: n; q; T' l
174.                 ;;
     ; G- n" z9 n4 h
175.         esac
     $ u/ Z* Z( r/ i* k( u: i3 x
176.         echo
     9 ~& j$ [% X) ~2 u$ H5 p6 W4 b3 m
177.         echo "What port should OpenVPN listen to?"
     
178.         read -p "Port [1194]: " port
     9 J2 q/ w( E- Z- f7 d! k' K! s
179.         until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do
     + L7 W6 Y! {- C
180.                 echo "$port: invalid port."
     1 i! T$ M0 ?/ h
181.                 read -p "Port [1194]: " port
     0 G6 Q' _& a  o
182.         done
     
183.         [[ -z "$port" ]] && port="1194"
     + M- r7 g- x" `9 f  b
184.         echo
     3 E0 R6 Y1 D" E( b: z
185.         echo "Select a DNS server for the clients:"
     
186.         echo "   1) Current system resolvers"
     ) ?8 S+ g  f( N! F+ _4 T4 C) i6 c2 e9 r
187.         echo "   2) Google"
     ; F& [; i" A4 C) q! U0 s
188.         echo "   3) 1.1.1.1"
     ) h2 C; E/ Q3 M2 q5 g
189.         echo "   4) OpenDNS"
     & t, m! ?" S4 S2 B+ c8 n; W; V
190.         echo "   5) Quad9"
     
191.         echo "   6) AdGuard"
     
192.         read -p "DNS server [1]: " dns
     
193.         until [[ -z "$dns" || "$dns" =~ ^[1-6]$ ]]; do
     
194.                 echo "$dns: invalid selection."
     ! w, u  R# r% h" [$ i
195.                 read -p "DNS server [1]: " dns
     " F+ Q$ t( ]$ N7 j8 g* u
196.         done
     - Q) |( D5 @7 [) M1 R  B8 c
197.         echo
     ) i% i( M8 O% i! \9 i+ P
198.         echo "Enter a name for the first client:"
     : r  R( C* t$ C* L: I& p
199.         read -p "Name [client]: " unsanitized_client
     
200.         # Allow a limited set of characters to avoid conflicts
     
201.         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     % K, ~% |: k  x: D  a
202.         [[ -z "$client" ]] && client="client"
     
203.         echo
     
204.         echo "OpenVPN installation is ready to begin."
     - M) j# X& `# \/ @5 R2 R4 ~; s
205.         # Install a firewall if firewalld or iptables are not already available
     5 G# p% \; |6 _8 M# {+ A  O, `
206.         if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then
     
207.                 if [[ "$os" == "centos" || "$os" == "fedora" ]]; then
     ! E# s* E9 v: p9 e- C) y3 l
208.                         firewall="firewalld"
     
209.                         # We don't want to silently enable firewalld, so we give a subtle warning
     
210.                         # If the user continues, firewalld will be installed and enabled during setup
     ! U  X1 J% v* y
211.                         echo "firewalld, which is required to manage routing tables, will also be installed."
     + e* D$ V) y0 w
212.                 elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then
     - f" v9 U- |4 t; Q: @
213.                         # iptables is way less invasive than firewalld so no warning is given
     8 |: X2 t! i. r- N* y
214.                         firewall="iptables"
     
215.                 fi
     
216.         fi
     
217.         read -n1 -r -p "Press any key to continue..."
     
218.         # If running inside a container, disable LimitNPROC to prevent conflicts
     
219.         if systemd-detect-virt -cq; then
     & u2 ], W( n) }
220.                 mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null
     
221.                 echo "[Service]
     + u  w- H( V* D8 Q* g) ^* f& c3 R
222. LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     
223.         fi
     ; b4 I. r, d" F6 ~* b# u; K
224.         if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     - B- _- X/ b; y& u  l
225.                 apt-get update
     
226.                 apt-get install -y openvpn openssl ca-certificates $firewall
     * j' P7 ^7 X0 ^  s7 g) J
227.         elif [[ "$os" = "centos" ]]; then
     $ U  v9 q* Y- f+ N( U, R; O0 [4 y) y
228.                 yum install -y epel-release
     2 e8 N& V4 H3 x$ Y4 p
229.                 yum install -y openvpn openssl ca-certificates tar $firewall
     8 E4 e, {: o0 G8 \6 c! o7 L
230.         else
     
231.                 # Else, OS must be Fedora
     / h( g; x* g. ^/ q
232.                 dnf install -y openvpn openssl ca-certificates tar $firewall
     # y( {8 ^& }0 z
233.         fi
     + r7 l4 g$ ^) P: Y
234.         # If firewalld was just installed, enable it
     
235.         if [[ "$firewall" == "firewalld" ]]; then
     7 |/ a2 F9 l# l1 p" c
236.                 systemctl enable --now firewalld.service
     $ K" l5 @3 ]8 R0 e' H7 p% u4 M; f
237.         fi
     
238.         # Get easy-rsa
     
239.         easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.0/EasyRSA-3.1.0.tgz'
     0 k4 O8 @2 q% _4 q1 ~" G
240.         mkdir -p /etc/openvpn/server/easy-rsa/
     
241.         { wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1
     2 z) H6 z+ `9 C  y
242.         chown -R root:root /etc/openvpn/server/easy-rsa/
     1 W  `/ T8 }2 @3 v. _
243.         cd /etc/openvpn/server/easy-rsa/
     3 i; w5 z, B2 ]/ h$ ~' z
244.         # Create the PKI, set up the CA and the server and client certificates
     2 z& l2 V3 }$ R5 c1 ~3 z* v
245.         ./easyrsa init-pki
     ; k, C3 W5 k5 _6 _- V
246.         ./easyrsa --batch build-ca nopass
     
247.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass
     2 ?, d# D+ \/ G1 V/ T
248.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     
249.         EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     
250.         # Move the stuff we need
     : G4 i6 a/ r7 |; B7 p3 m
251.         cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
     0 a3 b  z1 C1 a( `8 w7 s2 _
252.         # CRL is read with each client connection, while OpenVPN is dropped to nobody
     8 f8 W; a1 Y6 P7 G+ u
253.         chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     , t) V0 `2 `* b* f7 M
254.         # Without +x in the directory, OpenVPN can't run a stat() on the CRL file
     1 C: K( E3 S# q$ C
255.         chmod o+x /etc/openvpn/server/
     
256.         # Generate key for tls-crypt
     " v1 `' [  a# Z3 z6 x8 T! M
257.         openvpn --genkey --secret /etc/openvpn/server/tc.key
     
258.         # Create the DH parameters file using the predefined ffdhe2048 group
     
259.         echo '-----BEGIN DH PARAMETERS-----
     + ]+ a, n$ Z- f2 M. P
260. MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
     
261. +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
     
262. 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
     8 h9 X8 Y5 t# F6 Q5 {' I1 O6 c1 \
263. YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
     
264. 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
     ' L9 v% a# q& G# q5 n& \* v
265. ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
     6 |; z4 w( N2 [0 q6 s2 u  d; i
266. -----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem
     8 ?$ |% c. J5 e( _3 m
267.         # Generate server.conf
     
268.         echo "local $ip
     + z" H6 M/ D7 I( {. q+ Y5 m9 z" _
269. port $port
     - q6 B! u5 y) k3 M( J) G
270. proto $protocol
     9 }4 z) O+ N" J* m6 p
271. dev tun
       f/ p7 ~. |6 I% O) g1 S) r2 @
272. ca ca.crt
     : ?0 q6 y2 m- v0 m
273. cert server.crt
     
274. key server.key
     : g( p! l4 F5 m/ e
275. dh dh.pem
     
276. auth SHA512
     
277. tls-crypt tc.key
       n' R& @8 r1 v
278. topology subnet
     
279. server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf
     % ~5 X5 G' v7 ?% w& ~/ _
280.         # IPv6
     ( n0 c6 G% L' E) N8 u* s9 F
281.         if [[ -z "$ip6" ]]; then
     
282.                 echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     - q; v0 F- {7 [8 A. S
283.         else
     7 E2 S2 a& m$ r: E
284.                 echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf
     
285.                 echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     0 V8 j4 \- ?) x" g" v6 F; g- k
286.         fi
     0 O0 |" C; o6 d# w- o
287.         echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf
     
288.         # DNS
     
289.         case "$dns" in
     " K0 O9 q, r+ A: u" ]4 a( q
290.                 1|"")
     
291.                         # Locate the proper resolv.conf
     ; ~! C. r7 o, Z+ y! D  c+ b( s
292.                         # Needed for systems running systemd-resolved
     
293.                         if grep -q '^nameserver 127.0.0.53' "/etc/resolv.conf"; then
     8 u) x* |" B" y0 l
294.                                 resolv_conf="/run/systemd/resolve/resolv.conf"
     
295.                         else
     
296.                                 resolv_conf="/etc/resolv.conf"
     0 J: G2 h3 ]8 w2 m
297.                         fi
     
298.                         # Obtain the resolvers from resolv.conf and use them for OpenVPN
     0 T* E$ y7 L6 Q$ I
299.                         grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do
     $ J2 C! l) k# S% {
300.                                 echo "push "dhcp-option DNS $line"" >> /etc/openvpn/server/server.conf
     7 S4 a; _* y2 G
301.                         done
     " U7 [# o3 p1 u9 w
302.                 ;;
     " q' v( e  o$ P
303.                 2)
     
304.                         echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf
     # z1 H' s9 D! @# e* t
305.                         echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf
     # Y+ p1 a7 Q6 L- ?5 a& }) n# D( E
306.                 ;;
     
307.                 3)
     
308.                         echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf
     
309.                         echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf
     
310.                 ;;
     1 b- Y0 E& q/ `+ v: W5 Z
311.                 4)
     $ t0 k! l" q0 t) `: E
312.                         echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf
     , I  z% x$ [' I( _+ y
313.                         echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf
       G( C! G: L* i4 `' n
314.                 ;;
     
315.                 5)
     5 u2 |' c5 u9 L: z
316.                         echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf
     ! G' ^) e) N: `$ {2 X6 s5 d* S; X
317.                         echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf
     
318.                 ;;
       x9 P5 J& Q* Y; v! u& L4 U6 T6 S; s
319.                 6)
     
320.                         echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf
     $ M( R4 y' C% l2 D
321.                         echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf
     
322.                 ;;
     0 x$ I" s" X. ]0 [! I. R  }
323.         esac
     $ x6 M% s5 E+ t; @6 I. R6 W
324.         echo "keepalive 10 120
       @3 F* G2 \, Z4 W& Q6 j
325. cipher AES-256-CBC
     " U0 t) z/ e6 ?" z! x; K0 c, [
326. user nobody
     
327. group $group_name
     7 p/ C! w0 d1 C5 |4 U2 N! l
328. persist-key
     % B0 }, [9 E/ t
329. persist-tun
     - }7 ]2 X( g, j' i$ c3 j# U
330. verb 3
     
331. crl-verify crl.pem" >> /etc/openvpn/server/server.conf
     
332.         if [[ "$protocol" = "udp" ]]; then
     
333.                 echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf
       Y8 M5 U& D6 H0 z# o) f* p
334.         fi
     
335.         # Enable net.ipv4.ip_forward for the system
     
336.         echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-openvpn-forward.conf
     
337.         # Enable without waiting for a reboot or service restart
     
338.         echo 1 > /proc/sys/net/ipv4/ip_forward
     
339.         if [[ -n "$ip6" ]]; then
     & x* _. e$ ?3 o$ {  o
340.                 # Enable net.ipv6.conf.all.forwarding for the system
     $ D9 x! {3 C4 ~9 _9 |6 g
341.                 echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/99-openvpn-forward.conf
     0 z& Y( P: C# w0 L; a. j9 z
342.                 # Enable without waiting for a reboot or service restart
     7 n* e9 |& \. e  `% }0 `
343.                 echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
     
344.         fi
     
345.         if systemctl is-active --quiet firewalld.service; then
     9 e$ B7 r" Z' H' U
346.                 # Using both permanent and not permanent rules to avoid a firewalld
     
347.                 # reload.
     . w8 {2 w* M2 O5 h$ N* |  c' b# ]: R, `
348.                 # We don't use --add-service=openvpn because that would only work with
     ! Z2 V' M$ F' w: e8 m; |* l4 c! Z
349.                 # the default port and protocol.
     * U. U2 N* l& G- Z0 ^3 g7 y2 @
350.                 firewall-cmd --add-port="$port"/"$protocol"
     
351.                 firewall-cmd --zone=trusted --add-source=10.8.0.0/24
     5 n' Q9 r1 W* O5 Y. G* ?% z
352.                 firewall-cmd --permanent --add-port="$port"/"$protocol"
     
353.                 firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
     
354.                 # Set NAT for the VPN subnet
     
355.                 firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     ! h! R! A; w* b( @, z
356.                 firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
357.                 if [[ -n "$ip6" ]]; then
     
358.                         firewall-cmd --zone=trusted --add-source=fddd:1194:1194:1194::/64
     
359.                         firewall-cmd --permanent --zone=trusted --add-source=fddd:1194:1194:1194::/64
     . M% `; k& y" c4 ^1 ?5 X
360.                         firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
361.                         firewall-cmd --permanent --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     1 i0 O0 m4 L- r/ M% o( v2 L; {
362.                 fi
     4 O9 |9 Z  u) V5 Y
363.         else
     
364.                 # Create a service to set up persistent iptables rules
     & |6 X9 @; c( i
365.                 iptables_path=$(command -v iptables)
     0 A6 v2 R) [- u( g* w4 q5 H
366.                 ip6tables_path=$(command -v ip6tables)
       U8 P- F8 c$ a. r" C
367.                 # nf_tables is not available as standard in OVZ kernels. So use iptables-legacy
     4 m+ Z: D- R3 k, K: ~8 h; R
368.                 # if we are in OVZ, with a nf_tables backend and iptables-legacy is available.
     
369.                 if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then
     
370.                         iptables_path=$(command -v iptables-legacy)
     9 m( z# p6 @. _0 r. I4 d8 n5 M
371.                         ip6tables_path=$(command -v ip6tables-legacy)
     
372.                 fi
     # j% D4 E, N' @% @
373.                 echo "[Unit]
     7 }3 x  A5 G- r
374. Before=network.target
     
375. [Service]
     
376. Type=oneshot
     
377. ExecStart=$iptables_path -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     
378. ExecStart=$iptables_path -I INPUT -p $protocol --dport $port -j ACCEPT
     
379. ExecStart=$iptables_path -I FORWARD -s 10.8.0.0/24 -j ACCEPT
     3 [& n: X: \9 q
380. ExecStart=$iptables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     : n* e% r) D9 t3 g; w5 v
381. ExecStop=$iptables_path -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     
382. ExecStop=$iptables_path -D INPUT -p $protocol --dport $port -j ACCEPT
     
383. ExecStop=$iptables_path -D FORWARD -s 10.8.0.0/24 -j ACCEPT
     
384. ExecStop=$iptables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > /etc/systemd/system/openvpn-iptables.service
     1 f& B  w2 I3 }3 G: p
385.                 if [[ -n "$ip6" ]]; then
     
386.                         echo "ExecStart=$ip6tables_path -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     1 O3 Q! f1 G' Y4 t$ G8 G3 s
387. ExecStart=$ip6tables_path -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     7 y$ O" h5 Q  j8 Y6 ^- K/ }
388. ExecStart=$ip6tables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     - U; ]# Y8 j& W6 b. A% Z
389. ExecStop=$ip6tables_path -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     $ I, `$ h: Y: z0 q7 y1 n
390. ExecStop=$ip6tables_path -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     ) X- H4 F& n" L
391. ExecStop=$ip6tables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> /etc/systemd/system/openvpn-iptables.service
     4 F' R$ m3 S7 W. G7 z$ H3 e
392.                 fi
     ' ^& _! l, ?+ y0 z
393.                 echo "RemainAfterExit=yes
     
394. [Install]
     3 P0 F3 I3 z- }; F8 g+ }% F/ s
395. WantedBy=multi-user.target" >> /etc/systemd/system/openvpn-iptables.service
     1 P) G- _5 w0 i& n
396.                 systemctl enable --now openvpn-iptables.service
     
397.         fi
     : d% h3 V1 m% o3 p) ~
398.         # If SELinux is enabled and a custom port was selected, we need this
     
399.         if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     1 [6 S, r& E" w& @9 g
400.                 # Install semanage if not already present
     
401.                 if ! hash semanage 2>/dev/null; then
     1 `" f5 C3 y! L4 i! U" i
402.                         if [[ "$os_version" -eq 7 ]]; then
     
403.                                 # Centos 7
       ^/ U: u, @7 `1 _9 @; e" ^
404.                                 yum install -y policycoreutils-python
     3 w! y; \8 w1 Q/ j3 Y5 J0 w
405.                         else
     3 O% Q' J. ^/ O- q" Q+ f
406.                                 # CentOS 8 or Fedora
     
407.                                 dnf install -y policycoreutils-python-utils
     0 R/ D# |8 y* @  y6 T$ p, C2 A& L
408.                         fi
     " x, g7 p% ?) W' u5 X( h
409.                 fi
     + d4 }0 r3 e! f/ \1 N3 f9 B& e0 w+ B
410.                 semanage port -a -t openvpn_port_t -p "$protocol" "$port"
     
411.         fi
     
412.         # If the server is behind NAT, use the correct IP address
     
413.         [[ -n "$public_ip" ]] && ip="$public_ip"
     
414.         # client-common.txt is created so we have a template to add further users later
     
415.         echo "client
     ; q% {1 j( u. d( F  M" R) Y& C+ i
416. dev tun
     
417. proto $protocol
     
418. remote $ip $port
     
419. resolv-retry infinite
     
420. nobind
     
421. persist-key
     ) h" s" X& K' G8 w+ l7 S
422. persist-tun
     
423. remote-cert-tls server
     1 x9 [5 e) p* J5 }4 M
424. auth SHA512
     
425. cipher AES-256-CBC
     
426. ignore-unknown-option block-outside-dns
     & i# Z0 K, S7 q6 U, z6 ^
427. block-outside-dns
     
428. verb 3" > /etc/openvpn/server/client-common.txt
     2 q$ I9 Z& G+ {& B9 F; E# E
429.         # Enable and start the OpenVPN service
     + L3 k! {+ G" T4 H/ L# ^5 x
430.         systemctl enable --now openvpn-server@server.service
     # o* e, ~6 ^! m  a: P* Q
431.         # Generates the custom client.ovpn
     
432.         new_client
     
433.         echo
     % D. P; Y& Z+ e/ W$ o  U
434.         echo "Finished!"
     
435.         echo
     9 n8 D2 Z2 x) v' y2 r
436.         echo "The client configuration is available in:" ~/"$client.ovpn"
     5 N- [* V4 f: i! @$ R) a
437.         echo "New clients can be added by running this script again."
     2 X" w$ V8 y" S- X
438. else
     $ D0 o- ^: |% B5 o' @
439.         clear
     
440.         echo "OpenVPN is already installed."
     - R. \8 Z% ~: X: x9 ^+ F4 ]* `. \
441.         echo
     
442.         echo "Select an option:"
     
443.         echo "   1) Add a new client"
     ( @9 Y1 i% [4 X+ ]% F) w
444.         echo "   2) Revoke an existing client"
     * Y( a0 n, T0 P& q
445.         echo "   3) Remove OpenVPN"
     
446.         echo "   4) Exit"
     
447.         read -p "Option: " option
     
448.         until [[ "$option" =~ ^[1-4]$ ]]; do
     
449.                 echo "$option: invalid selection."
     : K1 @: [, O$ P1 [  I2 Q7 L+ j7 K
450.                 read -p "Option: " option
     
451.         done
     - o  @( c( Q! v. ?7 k3 c9 G  f6 w
452.         case "$option" in
     
453.                 1)
     
454.                         echo
     
455.                         echo "Provide a name for the client:"
     
456.                         read -p "Name: " unsanitized_client
     : D) v5 J& J- K7 Y! r
457.                         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     / {1 q  W/ V. ?
458.                         while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
     8 K7 M' ^2 n. h
459.                                 echo "$client: invalid name."
     ( M( D; l) g1 m) r/ b8 o
460.                                 read -p "Name: " unsanitized_client
     + E, ^; u8 s$ t0 R! W( ]
461.                                 client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     
462.                         done
     
463.                         cd /etc/openvpn/server/easy-rsa/
     # b! H9 |- X2 I8 M. `
464.                         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     
465.                         # Generates the custom client.ovpn
     
466.                         new_client
     
467.                         echo
     2 h" m' r) [/ q) {1 [) Y5 Z
468.                         echo "$client added. Configuration available in:" ~/"$client.ovpn"
     4 Y+ _4 n# C) ~$ z; m" U+ G' v1 @
469.                         exit
     
470.                 ;;
     ) [5 @- k' L! a% c' [; Z+ g
471.                 2)
     - h1 Y3 b7 |9 k9 _% I2 |
472.                         # This option could be documented a bit better and maybe even be simplified
     1 z4 \3 u' i- \
473.                         # ...but what can I say, I want some sleep too
     : z& y2 A+ \4 G, S" Q; V9 a3 ]% P
474.                         number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
     
475.                         if [[ "$number_of_clients" = 0 ]]; then
     5 B8 D' J; {, j+ A0 M! m
476.                                 echo
     
477.                                 echo "There are no existing clients!"
     # W! K+ D9 b1 C$ f
478.                                 exit
     4 Q8 L. k' X: K! z$ C
479.                         fi
     * t/ H5 S3 Y+ u4 k+ p6 N
480.                         echo
     - L4 v# Y* U. t
481.                         echo "Select the client to revoke:"
     2 }1 S" Q' U+ e# C' o
482.                         tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
     
483.                         read -p "Client: " client_number
     + T* R: v! w, y* V5 `! B. T
484.                         until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
     
485.                                 echo "$client_number: invalid selection."
     
486.                                 read -p "Client: " client_number
     
487.                         done
     6 @2 J! e; O! X& n  U1 e( k, G
488.                         client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
     0 B& w1 @, J" A" a* a, b+ R
489.                         echo
     9 v9 O9 J7 ]" C( ~
490.                         read -p "Confirm $client revocation? [y/N]: " revoke
     
491.                         until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
     % O% ]. Y1 f5 J( x1 H
492.                                 echo "$revoke: invalid selection."
     & R' X" b- q( j& ?3 s; t
493.                                 read -p "Confirm $client revocation? [y/N]: " revoke
     ( `0 H3 w; P- q) T: S$ k
494.                         done
     
495.                         if [[ "$revoke" =~ ^[yY]$ ]]; then
     
496.                                 cd /etc/openvpn/server/easy-rsa/
     
497.                                 ./easyrsa --batch revoke "$client"
     
498.                                 EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     # c# J8 y2 V. w9 @
499.                                 rm -f /etc/openvpn/server/crl.pem
     
500.                                 cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
     ' k4 R: C* T, g& j
501.                                 # CRL is read with each client connection, when OpenVPN is dropped to nobody
     , [* {% I) O& c7 d
502.                                 chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     0 F4 [" P- v1 R
503.                                 echo
     ( i3 R8 B- r4 @& j/ g8 O) i
504.                                 echo "$client revoked!"
     
505.                         else
     - q4 v+ z! B. A
506.                                 echo
     1 @  }8 P6 W! h+ P& y, I
507.                                 echo "$client revocation aborted!"
     " R8 j( `3 P) v5 R
508.                         fi
     / V" L  ?: O8 q0 ]" ?
509.                         exit
     
510.                 ;;
     ) ?+ W3 N/ \: }( d' W
511.                 3)
     
512.                         echo
     
513.                         read -p "Confirm OpenVPN removal? [y/N]: " remove
     & A/ s4 s9 W3 |, N: K2 z0 T
514.                         until [[ "$remove" =~ ^[yYnN]*$ ]]; do
     
515.                                 echo "$remove: invalid selection."
     
516.                                 read -p "Confirm OpenVPN removal? [y/N]: " remove
     
517.                         done
     $ m& J6 i# I7 [: r9 p( b
518.                         if [[ "$remove" =~ ^[yY]$ ]]; then
     2 A) K- C) V3 d+ V; U, Y
519.                                 port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     
520.                                 protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     ( p7 b! W4 b& d. T; @0 J  [( ~% X
521.                                 if systemctl is-active --quiet firewalld.service; then
     / [  ^& T$ R: P% M/ J
522.                                         ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
     
523.                                         # Using both permanent and not permanent rules to avoid a firewalld reload.
     3 k' n6 b( ^( O
524.                                         firewall-cmd --remove-port="$port"/"$protocol"
     / {6 E7 U1 J- v3 y+ j
525.                                         firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
     
526.                                         firewall-cmd --permanent --remove-port="$port"/"$protocol"
     0 h9 v) C  K$ P
527.                                         firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
     * g6 d% f9 a$ q
528.                                         firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     6 i) ?% k0 p/ F$ _
529.                                         firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
530.                                         if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
     . {! v  P5 C' f- @  N
531.                                                 ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
     
532.                                                 firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     
533.                                                 firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     
534.                                                 firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     7 o2 w- L: J% d0 q" O
535.                                                 firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
536.                                         fi
     6 L: K" @0 |7 J; `4 {; D
537.                                 else
     * z4 T' p, ^8 z# {4 q0 ]/ K4 P
538.                                         systemctl disable --now openvpn-iptables.service
     
539.                                         rm -f /etc/systemd/system/openvpn-iptables.service
     
540.                                 fi
     
541.                                 if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     7 y9 _% h% i' \& u+ g: l
542.                                         semanage port -d -t openvpn_port_t -p "$protocol" "$port"
     
543.                                 fi
     ( J- U! @/ s1 \7 O, g
544.                                 systemctl disable --now openvpn-server@server.service
     ( F8 M. c' U  E5 `9 C  A) x& p
545.                                 rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     1 o, ~* t0 O) K! }4 [% c# {
546.                                 rm -f /etc/sysctl.d/99-openvpn-forward.conf
     0 u& D! }  \  F4 [
547.                                 if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     $ Y+ ~) q: D5 O8 O% _
548.                                         rm -rf /etc/openvpn/server
     
549.                                         apt-get remove --purge -y openvpn
     
550.                                 else
     
551.                                         # Else, OS must be CentOS or Fedora
     * L6 t5 @  S" y1 P# P7 |4 j
552.                                         yum remove -y openvpn
     
553.                                         rm -rf /etc/openvpn/server
     
554.                                 fi
     
555.                                 echo
     
556.                                 echo "OpenVPN removed!"
     
557.                         else
     
558.                                 echo
     % Z0 u5 M) i* ?
559.                                 echo "OpenVPN removal aborted!"
     & }4 m! [" t4 n; r% c- e
560.                         fi
     
561.                         exit
     , ^* f0 o  n8 W- F) A
562.                 ;;
     ' y2 q- F$ s8 r/ W$ f8 O% n# F" w0 D1 _
563.                 4)
     8 s: l6 {  K8 p: B
564.                         exit
     
565.                 ;;
     
566.         esac
     $ q. j3 }- `8 V: F5 ?) Y/ I5 a
567. fi
     

复制代码

" u. ?# x, ^8 q

) r$ Z! L3 s. x0 P$ d