shadowsocks-all.sh

fudyou

1. #!/bin/bash
   - B/ K7 v; J) k" \0 M
2. #
   # f" @& h' {# f7 l# a* u- ~
3. # https://github.com/Nyr/openvpn-install
   ! m# {" Y3 A$ S8 s- f
4. #
   + f, I% K! O8 N" T
5. # Copyright (c) 2013 Nyr. Released under the MIT License.
   2 Y! \2 Y) H1 g0 T5 h/ a- k
6. 
   
7. 
   
8. # Detect Debian users running the script with "sh" instead of bash
   
9. if readlink /proc/$$/exe | grep -q "dash"; then
   
10.         echo 'This installer needs to be run with "bash", not "sh".'
    
11.         exit
    
12. fi
    8 n( h  G5 e- b/ F
13. 
    
14. # Discard stdin. Needed when running from an one-liner which includes a newline
    & S# z2 d6 _4 J8 A8 }3 a+ C
15. read -N 999999 -t 0.001
    2 w/ S! d3 a) @0 a( T- K5 u
16. 
    + ?+ O6 B; C, O3 `( i2 y8 q
17. # Detect OpenVZ 6
    ! {  k4 a' c" s) S6 |8 z# ?
18. if [[ $(uname -r | cut -d "." -f 1) -eq 2 ]]; then
    
19.         echo "The system is running an old kernel, which is incompatible with this installer."
    5 q, F4 ~; K' P% E0 E
20.         exit
    
21. fi
      L1 z6 |; ^0 O/ j. {
22. 
    # I3 B1 z" `5 ?% J4 ]+ X! d
23. # Detect OS
    5 A+ L( a  h1 {  Y" A3 o9 X
24. # $os_version variables aren't always in use, but are kept here for convenience
    4 W0 Z7 e) h5 U# a4 g- a
25. if grep -qs "ubuntu" /etc/os-release; then
    
26.         os="ubuntu"
    
27.         os_version=$(grep 'VERSION_ID' /etc/os-release | cut -d '"' -f 2 | tr -d '.')
    
28.         group_name="nogroup"
    
29. elif [[ -e /etc/debian_version ]]; then
    
30.         os="debian"
    / K9 T; `* ?- z. P, ~9 L/ C5 d
31.         os_version=$(grep -oE '[0-9]+' /etc/debian_version | head -1)
    
32.         group_name="nogroup"
    4 v% q1 L4 f& ]: j& L( A% {& [
33. elif [[ -e /etc/almalinux-release || -e /etc/rocky-release || -e /etc/centos-release ]]; then
    5 X& X; e- O1 X+ h9 k! i
34.         os="centos"
    ; M+ e0 ^+ U# O7 ~, s% u
35.         os_version=$(grep -shoE '[0-9]+' /etc/almalinux-release /etc/rocky-release /etc/centos-release | head -1)
    
36.         group_name="nobody"
    
37. elif [[ -e /etc/fedora-release ]]; then
    
38.         os="fedora"
    $ Y% @3 R8 N2 z! V2 B
39.         os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)
    
40.         group_name="nobody"
    
41. else
    ) Y* {8 W. o+ \0 y
42.         echo "This installer seems to be running on an unsupported distribution.
    ' O* V" `  U, v# h( j2 C
43. Supported distros are Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora."
    
44.         exit
    
45. fi
    
46. 
    
47. if [[ "$os" == "ubuntu" && "$os_version" -lt 1804 ]]; then
    1 F3 @# T' W0 [& ?9 d
48.         echo "Ubuntu 18.04 or higher is required to use this installer.
    
49. This version of Ubuntu is too old and unsupported."
    
50.         exit
    
51. fi
    
52. 
    
53. if [[ "$os" == "debian" && "$os_version" -lt 9 ]]; then
    0 Z4 ^" y, `7 k# l# v! \- L
54.         echo "Debian 9 or higher is required to use this installer.
    ) y% \; O# @  f5 [
55. This version of Debian is too old and unsupported."
    
56.         exit
    " c4 P% Y- t8 s# [* C  g
57. fi
    
58. 
    
59. if [[ "$os" == "centos" && "$os_version" -lt 7 ]]; then
    
60.         echo "CentOS 7 or higher is required to use this installer.
    % y9 s! K) t/ B2 N
61. This version of CentOS is too old and unsupported."
    ( E3 ?/ l5 v! D3 X# J
62.         exit
    
63. fi
    
64. 
    
65. # Detect environments where $PATH does not include the sbin directories
    
66. if ! grep -q sbin <<< "$PATH"; then
    
67.         echo '$PATH does not include sbin. Try using "su -" instead of "su".'
    
68.         exit
    
69. fi
    
70. 
    ' i* R% u" N. Z/ C( s( F/ k
71. if [[ "$EUID" -ne 0 ]]; then
    $ |. ^% P/ W, V# o: X/ T+ `  ~- s$ _
72.         echo "This installer needs to be run with superuser privileges."
    5 @# f, M$ E" B
73.         exit
    
74. fi
    : A( r) k2 O6 L1 B+ U9 {( b
75. 
    . U& C+ |7 i( @4 m0 s( ]
76. if [[ ! -e /dev/net/tun ]] || ! ( exec 7<>/dev/net/tun ) 2>/dev/null; then
    
77.         echo "The system does not have the TUN device available.
    
78. TUN needs to be enabled before running this installer."
    
79.         exit
    
80. fi
    
81. 
    
82. new_client () {
    - D, ^0 ]* `& ?% N1 |: _7 l
83.         # Generates the custom client.ovpn
    4 B& C4 A% y5 s8 {7 D+ T
84.         {
    6 G; e- ^) r$ b5 ?' z! f1 {
85.         cat /etc/openvpn/server/client-common.txt
    6 _% _2 K/ Q/ [
86.         echo "<ca>"
    
87.         cat /etc/openvpn/server/easy-rsa/pki/ca.crt
    
88.         echo "</ca>"
    
89.         echo "<cert>"
    ; u! A2 o1 g; ^' I) ~6 k$ r% I
90.         sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt
    ' N- _; r; g0 l9 O5 N
91.         echo "</cert>"
    
92.         echo "<key>"
    3 E- m6 u' {! @! c4 B# ]9 y5 H
93.         cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key
    , j, q# I2 Q! J" g
94.         echo "</key>"
    
95.         echo "<tls-crypt>"
    
96.         sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
    . ^& b( L  [) T
97.         echo "</tls-crypt>"
    " i5 M! S3 J% x6 ]* j0 j
98.         } > ~/"$client".ovpn
    ) p% V& M- C8 S& @
99. }
    ( d7 |2 n; h" F# X* _
100. 
     
101. if [[ ! -e /etc/openvpn/server/server.conf ]]; then
     9 F5 [- G7 q6 c$ d+ H) v
102.         # Detect some Debian minimal setups where neither wget nor curl are installed
     1 k. R# S5 Z8 D  p7 f8 e
103.         if ! hash wget 2>/dev/null && ! hash curl 2>/dev/null; then
     1 ~; e9 U8 N( Q! f, f( E  ~( H
104.                 echo "Wget is required to use this installer."
     
105.                 read -n1 -r -p "Press any key to install Wget and continue..."
     & f& b5 t/ h9 p8 u; i3 g
106.                 apt-get update
     
107.                 apt-get install -y wget
     ) t9 _* E' G+ l- `$ M0 Z
108.         fi
     ; T) p7 y$ ], L
109.         clear
     
110.         echo 'Welcome to this OpenVPN road warrior installer!'
     
111.         # If system has a single IPv4, it is selected automatically. Else, ask the user
     
112.         if [[ $(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}') -eq 1 ]]; then
     * S5 d$ D6 N8 P6 B& h
113.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}')
     
114.         else
     
115.                 number_of_ip=$(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}')
     : E" C' z. g6 G& W$ m# _+ t
116.                 echo
     3 W# t+ G- l6 u! |- M6 X5 u, Z
117.                 echo "Which IPv4 address should be used?"
     
118.                 ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | nl -s ') '
     
119.                 read -p "IPv4 address [1]: " ip_number
     # C0 T6 s2 x) M$ C" V
120.                 until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ip" ]]; do
     3 }) h! _& f$ a' I: x6 m
121.                         echo "$ip_number: invalid selection."
     ! w5 ?8 _: w8 t& `, I& |
122.                         read -p "IPv4 address [1]: " ip_number
     ' y4 w, e2 @) @/ _/ p) m3 ^/ Z
123.                 done
     5 K/ k5 C! B* `8 L3 \
124.                 [[ -z "$ip_number" ]] && ip_number="1"
     5 u% e% A1 E# K  Z$ @6 G: t
125.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sed -n "$ip_number"p)
     . b& z# T. R) ?/ v5 z
126.         fi
     $ Z  O5 K/ m# |3 Y# k% R
127.         # If $ip is a private IP address, the server must be behind NAT
     
128.         if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
     
129.                 echo
     
130.                 echo "This server is behind NAT. What is the public IPv4 address or hostname?"
     " [' `2 I5 e4 T8 X
131.                 # Get public IP and sanitize with grep
     7 k3 j: I7 z; e0 |  A& X3 d
132.                 get_public_ip=$(grep -m 1 -oE '^[0-9]{1,3}(\.[0-9]{1,3}){3}$' <<< "$(wget -T 10 -t 1 -4qO- "http://ip1.dynupdate.no-ip.com/" || curl -m 10 -4Ls "http://ip1.dynupdate.no-ip.com/")")
     $ c$ L- b1 d% a. B* G2 M! E( y
133.                 read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip
     0 b  p% k5 i1 c. d# M3 d
134.                 # If the checkip service is unavailable and user didn't provide input, ask again
     
135.                 until [[ -n "$get_public_ip" || -n "$public_ip" ]]; do
     
136.                         echo "Invalid input."
     
137.                         read -p "Public IPv4 address / hostname: " public_ip
     
138.                 done
     
139.                 [[ -z "$public_ip" ]] && public_ip="$get_public_ip"
     $ j3 T( A2 C" v+ g
140.         fi
     ; a1 k) u) W" m& Z% `
141.         # If system has a single IPv6, it is selected automatically
     * u9 ?! k/ h' q: z
142.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -eq 1 ]]; then
     4 Z2 L$ t: F& W) r
143.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}')
     
144.         fi
     ; l$ J1 e' ]& @, ]8 P
145.         # If system has multiple IPv6, ask the user to select one
     
146.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -gt 1 ]]; then
       @$ L: m% S1 r3 g: C% G9 K5 c
147.                 number_of_ip6=$(ip -6 addr | grep -c 'inet6 [23]')
     
148.                 echo
     
149.                 echo "Which IPv6 address should be used?"
     
150.                 ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | nl -s ') '
     0 n; t+ m( V9 z) L1 k+ w
151.                 read -p "IPv6 address [1]: " ip6_number
     ) ?4 T0 A( D5 e7 V
152.                 until [[ -z "$ip6_number" || "$ip6_number" =~ ^[0-9]+$ && "$ip6_number" -le "$number_of_ip6" ]]; do
     
153.                         echo "$ip6_number: invalid selection."
     
154.                         read -p "IPv6 address [1]: " ip6_number
     + T9 e+ y+ z. c9 P
155.                 done
     
156.                 [[ -z "$ip6_number" ]] && ip6_number="1"
     
157.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | sed -n "$ip6_number"p)
     5 h! M, F% K/ V% u: n! T& s
158.         fi
     
159.         echo
     8 \# E* g- r3 W& b1 U
160.         echo "Which protocol should OpenVPN use?"
     
161.         echo "   1) UDP (recommended)"
     % x' \* f6 O; k+ z7 g
162.         echo "   2) TCP"
     
163.         read -p "Protocol [1]: " protocol
     
164.         until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
     ( E" W. [2 _1 O  h' z# |, B4 T
165.                 echo "$protocol: invalid selection."
     ) |+ _9 v; \  ?" |. {
166.                 read -p "Protocol [1]: " protocol
     0 i) m9 q8 Z. m
167.         done
     1 J" w8 \6 I& v7 V  ?/ x5 h
168.         case "$protocol" in
     
169.                 1|"")
     
170.                 protocol=udp
     
171.                 ;;
     
172.                 2)
     
173.                 protocol=tcp
     
174.                 ;;
     , s7 b6 r7 E+ O0 v6 H
175.         esac
     " l3 v1 K0 o9 e/ E$ K
176.         echo
     ! ]. q! l1 t! z" s' p& Q
177.         echo "What port should OpenVPN listen to?"
     . i9 e* S2 c6 |) i
178.         read -p "Port [1194]: " port
     5 N+ a, T' w6 {8 U( F  C9 f8 g
179.         until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do
     
180.                 echo "$port: invalid port."
     0 U, {! w7 V" n4 K% w; C1 Q
181.                 read -p "Port [1194]: " port
     % A- [* q0 \/ D4 M
182.         done
     ; v7 s: G9 U3 S" X: d- n
183.         [[ -z "$port" ]] && port="1194"
     
184.         echo
     ; _- }) F9 v8 [. e0 k9 `5 D' ]
185.         echo "Select a DNS server for the clients:"
     
186.         echo "   1) Current system resolvers"
     & O% l) e4 t: Q) Q5 s( @, h% b
187.         echo "   2) Google"
     # s: n: _, g' A  ?
188.         echo "   3) 1.1.1.1"
     8 t+ N1 ^8 N0 j% n7 k1 t- z
189.         echo "   4) OpenDNS"
     9 b2 K: E6 r2 R3 l) n7 d3 c
190.         echo "   5) Quad9"
     6 E! r$ H8 i7 ^! e! Y+ P9 D
191.         echo "   6) AdGuard"
     
192.         read -p "DNS server [1]: " dns
     / c: @/ F- j$ M" u( ~: g$ m
193.         until [[ -z "$dns" || "$dns" =~ ^[1-6]$ ]]; do
     
194.                 echo "$dns: invalid selection."
     
195.                 read -p "DNS server [1]: " dns
     
196.         done
     % w  m5 ~# [" w2 S0 }
197.         echo
     / r7 i; N+ E6 @* i# l6 [
198.         echo "Enter a name for the first client:"
     
199.         read -p "Name [client]: " unsanitized_client
     
200.         # Allow a limited set of characters to avoid conflicts
       r1 }8 r6 `3 U: w7 Q* {7 `
201.         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     # c) ]. n8 z" ]. _/ p
202.         [[ -z "$client" ]] && client="client"
     ! Z: A" Y1 G9 j# }  a7 d
203.         echo
     " x! r* y4 k1 U5 n( d. W% `
204.         echo "OpenVPN installation is ready to begin."
     
205.         # Install a firewall if firewalld or iptables are not already available
     * ?! h" o5 k6 ^; [% V
206.         if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then
     
207.                 if [[ "$os" == "centos" || "$os" == "fedora" ]]; then
     
208.                         firewall="firewalld"
     ' t* g7 Y/ E% y( M* l/ R3 |
209.                         # We don't want to silently enable firewalld, so we give a subtle warning
     2 q2 }+ d* n* e: L  i; ~# v: P
210.                         # If the user continues, firewalld will be installed and enabled during setup
     
211.                         echo "firewalld, which is required to manage routing tables, will also be installed."
     
212.                 elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then
     
213.                         # iptables is way less invasive than firewalld so no warning is given
     
214.                         firewall="iptables"
     6 _4 ~/ j! w% r
215.                 fi
     
216.         fi
     
217.         read -n1 -r -p "Press any key to continue..."
     4 ^5 S( O% p" l6 p1 r9 `( _
218.         # If running inside a container, disable LimitNPROC to prevent conflicts
     
219.         if systemd-detect-virt -cq; then
     
220.                 mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null
     
221.                 echo "[Service]
     / D' `1 X! g$ a6 c, a0 _8 z/ Q
222. LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     
223.         fi
     
224.         if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     
225.                 apt-get update
     . _# u9 m  `" p4 z+ y: K
226.                 apt-get install -y openvpn openssl ca-certificates $firewall
     
227.         elif [[ "$os" = "centos" ]]; then
     
228.                 yum install -y epel-release
     7 K3 r9 _( `. C" Y( i
229.                 yum install -y openvpn openssl ca-certificates tar $firewall
     
230.         else
     4 Q* Q8 z9 `# X, k2 k/ H
231.                 # Else, OS must be Fedora
     : ?8 p) F5 o, R2 R9 W
232.                 dnf install -y openvpn openssl ca-certificates tar $firewall
     
233.         fi
       H, I- p. p9 d6 }' _8 y: V
234.         # If firewalld was just installed, enable it
     
235.         if [[ "$firewall" == "firewalld" ]]; then
     
236.                 systemctl enable --now firewalld.service
       ~* E. @' `. y- X! G
237.         fi
     % \: R& V" \: Z. ^
238.         # Get easy-rsa
       E4 s' q. g! y1 Z- o( X) W: p  O
239.         easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.0/EasyRSA-3.1.0.tgz'
     6 G2 n' m: R4 \# {- J$ T8 M* {1 K
240.         mkdir -p /etc/openvpn/server/easy-rsa/
     
241.         { wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1
     % i% \, z+ S. P3 ^3 ^
242.         chown -R root:root /etc/openvpn/server/easy-rsa/
     
243.         cd /etc/openvpn/server/easy-rsa/
     
244.         # Create the PKI, set up the CA and the server and client certificates
     . }% x6 }. @" k) |3 R& y
245.         ./easyrsa init-pki
     ) n2 B6 G8 _( }+ @: i; P$ v6 ^
246.         ./easyrsa --batch build-ca nopass
     
247.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass
     ; b) B4 a. o& z4 S# c% J& x
248.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     % d9 e7 C- v! O0 d( M7 V$ Z/ l
249.         EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     ; V! ^; v$ ?+ d6 S0 k5 G! m; V
250.         # Move the stuff we need
     
251.         cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
     
252.         # CRL is read with each client connection, while OpenVPN is dropped to nobody
     : z! ?. E. p" O" J3 n( I
253.         chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     
254.         # Without +x in the directory, OpenVPN can't run a stat() on the CRL file
     
255.         chmod o+x /etc/openvpn/server/
     4 _+ ]/ R6 W8 T4 p7 n7 E; Y
256.         # Generate key for tls-crypt
     8 T  V) `/ L+ T0 W& y  v) S7 Z
257.         openvpn --genkey --secret /etc/openvpn/server/tc.key
     3 U9 d; ?/ ?; N/ F# t% M: ^
258.         # Create the DH parameters file using the predefined ffdhe2048 group
     ( y6 _' b" V4 r/ j% w( D
259.         echo '-----BEGIN DH PARAMETERS-----
     
260. MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
     
261. +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
     
262. 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
     9 c5 M  k' B% X8 c% x0 V
263. YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
     " P8 t1 g6 {4 G7 w. I9 O
264. 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
     / c* @1 L# o9 n% c  s
265. ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
     
266. -----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem
     * k4 m2 p0 ^$ [- ~: _" J" X$ k
267.         # Generate server.conf
     
268.         echo "local $ip
     . p! c; z; n% S4 Y  s9 K3 i. W' f* ^
269. port $port
     . [' g, O& \, ~$ k+ x! F2 n+ E
270. proto $protocol
     ; i) Q& a& F1 a! E/ F$ E5 [
271. dev tun
     7 z9 u. T: N  I) E) `0 Y! M
272. ca ca.crt
     * G# y; C' A2 o5 d: ~& b- D
273. cert server.crt
     
274. key server.key
     
275. dh dh.pem
     
276. auth SHA512
     / Y  V! g/ ~+ U. c7 J
277. tls-crypt tc.key
     & T2 x- n& A  ]& k7 j( y
278. topology subnet
     
279. server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf
     0 F6 |/ d- I! J3 e( Y. D
280.         # IPv6
     
281.         if [[ -z "$ip6" ]]; then
     7 ^4 G+ F% x2 z- h
282.                 echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     
283.         else
     ( {5 ]7 I* z. m9 A1 T, d
284.                 echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf
     1 B0 l" q5 d, v' o
285.                 echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     6 P( x2 q/ x3 q8 `% e
286.         fi
     * |! L  @9 _! m3 T8 W' i+ {. X
287.         echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf
     ' n: Q/ k' Y* D3 Z
288.         # DNS
     
289.         case "$dns" in
     1 D8 G* M+ R7 X3 w9 P
290.                 1|"")
     
291.                         # Locate the proper resolv.conf
     ; j/ Z! b2 `+ X) _8 ~. F
292.                         # Needed for systems running systemd-resolved
     9 c+ D) e  J# q( _
293.                         if grep -q '^nameserver 127.0.0.53' "/etc/resolv.conf"; then
     0 g( N" k2 l& n: B  y9 r
294.                                 resolv_conf="/run/systemd/resolve/resolv.conf"
     # |0 d% {+ A$ @( A
295.                         else
     
296.                                 resolv_conf="/etc/resolv.conf"
     
297.                         fi
     
298.                         # Obtain the resolvers from resolv.conf and use them for OpenVPN
     
299.                         grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do
     
300.                                 echo "push "dhcp-option DNS $line"" >> /etc/openvpn/server/server.conf
     3 W1 ~  P5 H9 d& R4 S0 i* Y, Q" f# F0 C
301.                         done
     
302.                 ;;
     
303.                 2)
     
304.                         echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf
     ! a. U1 C4 X# [' K
305.                         echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf
     
306.                 ;;
     
307.                 3)
     0 h9 A( Z, \3 R9 U" b
308.                         echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf
     4 i* f# Q  f( w* a
309.                         echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf
     5 N- s+ C2 }2 j: Q' D! P( g7 R: R5 T
310.                 ;;
     
311.                 4)
     
312.                         echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf
     
313.                         echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf
     9 [0 m, V4 C4 j0 v, L5 I
314.                 ;;
     ! m7 |6 z. |/ x9 {0 |( S
315.                 5)
     " s. }; n3 J: p7 h. j! H4 g( P
316.                         echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf
     + V' o% M1 t9 X
317.                         echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf
     & `7 j( l/ t+ o& s9 t
318.                 ;;
     
319.                 6)
     
320.                         echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf
     
321.                         echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf
     
322.                 ;;
     
323.         esac
     
324.         echo "keepalive 10 120
     
325. cipher AES-256-CBC
     
326. user nobody
     
327. group $group_name
     / i7 N! {, p0 r
328. persist-key
     
329. persist-tun
     
330. verb 3
     9 @4 t) x3 t8 Q6 f( ?" W; m; F
331. crl-verify crl.pem" >> /etc/openvpn/server/server.conf
     4 W1 }2 c/ d; K" i2 s+ w) d9 h# A; _
332.         if [[ "$protocol" = "udp" ]]; then
     
333.                 echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf
     ; m& O2 Q6 n2 l; n
334.         fi
     : Q# ]: ~* k* @8 ^+ t2 [) |
335.         # Enable net.ipv4.ip_forward for the system
     
336.         echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-openvpn-forward.conf
     ' `2 p4 C4 z. Z5 G) [; A% {  [
337.         # Enable without waiting for a reboot or service restart
     1 n1 x- {6 j* E" [' H) S
338.         echo 1 > /proc/sys/net/ipv4/ip_forward
     8 k  C& i: J! V0 g
339.         if [[ -n "$ip6" ]]; then
     
340.                 # Enable net.ipv6.conf.all.forwarding for the system
     2 U. ~! U- {, |( @( \) ~, j/ e
341.                 echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/99-openvpn-forward.conf
     
342.                 # Enable without waiting for a reboot or service restart
     / p# V* \* s, a
343.                 echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
     . S/ X) I) `+ v2 K
344.         fi
     $ c% w% ~( I8 w7 s
345.         if systemctl is-active --quiet firewalld.service; then
     
346.                 # Using both permanent and not permanent rules to avoid a firewalld
     
347.                 # reload.
     9 v* A2 y/ D2 H8 \0 n, L5 N
348.                 # We don't use --add-service=openvpn because that would only work with
     8 p* {9 b4 H6 k
349.                 # the default port and protocol.
     , G" C9 M4 M- P; ?8 ?2 r3 y* ~$ |
350.                 firewall-cmd --add-port="$port"/"$protocol"
     6 i1 h& U8 v" |/ x% e& c
351.                 firewall-cmd --zone=trusted --add-source=10.8.0.0/24
       Y+ Y- w* a; q' [, v3 d
352.                 firewall-cmd --permanent --add-port="$port"/"$protocol"
     % M% L) ~3 m; x. ~' M+ _( G
353.                 firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
     , K' ~  [1 h' }% R% B- q9 j
354.                 # Set NAT for the VPN subnet
     
355.                 firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
356.                 firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
357.                 if [[ -n "$ip6" ]]; then
     4 u4 Q* d+ f8 u" a+ P3 l
358.                         firewall-cmd --zone=trusted --add-source=fddd:1194:1194:1194::/64
     
359.                         firewall-cmd --permanent --zone=trusted --add-source=fddd:1194:1194:1194::/64
     
360.                         firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
361.                         firewall-cmd --permanent --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     * r: G4 o' d* _- i$ B2 R, u) R; @
362.                 fi
     
363.         else
     8 F# p( h7 p! t$ ]3 P2 f2 G
364.                 # Create a service to set up persistent iptables rules
     : ]3 \+ X; x) X+ f* R# V7 |$ M
365.                 iptables_path=$(command -v iptables)
     $ D2 F# c7 O+ x8 Q9 S8 B
366.                 ip6tables_path=$(command -v ip6tables)
     
367.                 # nf_tables is not available as standard in OVZ kernels. So use iptables-legacy
     6 h1 S2 ^4 t, D7 e
368.                 # if we are in OVZ, with a nf_tables backend and iptables-legacy is available.
     $ }: }9 Y" Z" z
369.                 if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then
     
370.                         iptables_path=$(command -v iptables-legacy)
     5 ^; S) ?/ k- o) a. ^1 L
371.                         ip6tables_path=$(command -v ip6tables-legacy)
     
372.                 fi
     
373.                 echo "[Unit]
     7 i( [% Y6 I% S
374. Before=network.target
     ' @, X$ P/ Q! [8 R0 ?1 i* h/ x
375. [Service]
     + i! J% @8 m8 G% n! Q) N1 p
376. Type=oneshot
     & u) ^. z/ o4 \0 k
377. ExecStart=$iptables_path -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     + `& Z0 n: S8 m1 _2 U
378. ExecStart=$iptables_path -I INPUT -p $protocol --dport $port -j ACCEPT
       h8 N  c# a1 y6 u; R  E
379. ExecStart=$iptables_path -I FORWARD -s 10.8.0.0/24 -j ACCEPT
     $ P; X+ m$ d+ c5 w9 W% G
380. ExecStart=$iptables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     4 `  p5 @3 v7 L
381. ExecStop=$iptables_path -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     3 m1 p6 u2 c! W2 `
382. ExecStop=$iptables_path -D INPUT -p $protocol --dport $port -j ACCEPT
     
383. ExecStop=$iptables_path -D FORWARD -s 10.8.0.0/24 -j ACCEPT
     3 y. z" _' L/ b5 n
384. ExecStop=$iptables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > /etc/systemd/system/openvpn-iptables.service
     
385.                 if [[ -n "$ip6" ]]; then
     + H5 K2 [& f0 u$ a: E- s+ a' A
386.                         echo "ExecStart=$ip6tables_path -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     4 t$ @# Q9 n6 t5 Y* L
387. ExecStart=$ip6tables_path -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     
388. ExecStart=$ip6tables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     
389. ExecStop=$ip6tables_path -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     
390. ExecStop=$ip6tables_path -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     ' g  l- `! d; }3 [, F* ?* @
391. ExecStop=$ip6tables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> /etc/systemd/system/openvpn-iptables.service
     
392.                 fi
     6 w9 Y( \. E& e" C1 Y
393.                 echo "RemainAfterExit=yes
     5 L0 u. H# C% x/ B" A
394. [Install]
     
395. WantedBy=multi-user.target" >> /etc/systemd/system/openvpn-iptables.service
     # O$ J+ O) k0 Y% C. x2 X  C
396.                 systemctl enable --now openvpn-iptables.service
     % B' @6 C; C: ]) w# o' V4 i
397.         fi
     0 d4 o' _' V  l8 S' N$ I4 p( t
398.         # If SELinux is enabled and a custom port was selected, we need this
     
399.         if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     
400.                 # Install semanage if not already present
     9 y. U3 R: ^. V) s- w; p) F5 M2 _
401.                 if ! hash semanage 2>/dev/null; then
     6 Q) ]9 o  G$ n, f- j5 Z- D
402.                         if [[ "$os_version" -eq 7 ]]; then
     
403.                                 # Centos 7
     * f: i; r% F5 b: m) @, C1 e
404.                                 yum install -y policycoreutils-python
     
405.                         else
     : ~( r& b" n! X
406.                                 # CentOS 8 or Fedora
     
407.                                 dnf install -y policycoreutils-python-utils
     3 D) H; }  q% d- P
408.                         fi
     ) K, o/ Z( h8 I" T+ A+ d# a: I! D
409.                 fi
     
410.                 semanage port -a -t openvpn_port_t -p "$protocol" "$port"
     2 [' E5 L9 ]" V; Y; b
411.         fi
     , v9 j' [6 o8 m) j
412.         # If the server is behind NAT, use the correct IP address
     6 Z! W/ w6 A2 F8 W
413.         [[ -n "$public_ip" ]] && ip="$public_ip"
     9 X& k0 v! p$ q
414.         # client-common.txt is created so we have a template to add further users later
     : C5 O& g+ ^4 ^
415.         echo "client
     
416. dev tun
     
417. proto $protocol
     
418. remote $ip $port
     + |  f. E: P, l2 ^
419. resolv-retry infinite
     & j# [, C2 @; [1 u$ l
420. nobind
     
421. persist-key
     & w7 h8 l* o+ P. J7 Q" ^! n8 |0 q/ [
422. persist-tun
     6 a( |. q2 J9 q' i1 x
423. remote-cert-tls server
     
424. auth SHA512
     
425. cipher AES-256-CBC
     2 j! F5 S- X8 u
426. ignore-unknown-option block-outside-dns
     
427. block-outside-dns
     * B/ B) H; P! W! b: l) @  \7 @
428. verb 3" > /etc/openvpn/server/client-common.txt
     
429.         # Enable and start the OpenVPN service
     
430.         systemctl enable --now openvpn-server@server.service
     
431.         # Generates the custom client.ovpn
     
432.         new_client
     + E* G3 T& \" Q0 Y4 C
433.         echo
     
434.         echo "Finished!"
     
435.         echo
     
436.         echo "The client configuration is available in:" ~/"$client.ovpn"
     * m- `5 E, k# Z
437.         echo "New clients can be added by running this script again."
     8 m" ^7 C5 O4 }+ z: Y
438. else
     # ]) l/ ]( L: r4 a) _9 u' H$ `  {$ m# \
439.         clear
     * L; i  _5 s( u
440.         echo "OpenVPN is already installed."
     
441.         echo
     3 B2 g% m; c# v; f8 e+ r6 x# m- m
442.         echo "Select an option:"
     
443.         echo "   1) Add a new client"
     ' Y* a  }" q% s8 [
444.         echo "   2) Revoke an existing client"
     ; B- F6 {& Y; @
445.         echo "   3) Remove OpenVPN"
     
446.         echo "   4) Exit"
     
447.         read -p "Option: " option
     
448.         until [[ "$option" =~ ^[1-4]$ ]]; do
     ) K9 w& z+ T! Q/ G' \4 Y: l2 m+ V
449.                 echo "$option: invalid selection."
     
450.                 read -p "Option: " option
     
451.         done
     
452.         case "$option" in
     
453.                 1)
     
454.                         echo
     
455.                         echo "Provide a name for the client:"
     ' j6 m2 A# z% i4 G2 I) H
456.                         read -p "Name: " unsanitized_client
     1 d2 K0 B' {! [: k* Z  i4 {& T
457.                         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     3 E/ P# q! Q2 B3 V# s* N6 v
458.                         while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
     ( I' @' ~" l1 @6 E: K: f  `7 d
459.                                 echo "$client: invalid name."
     
460.                                 read -p "Name: " unsanitized_client
     / D+ ]; ~  E  C$ H0 ^
461.                                 client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     
462.                         done
     
463.                         cd /etc/openvpn/server/easy-rsa/
     ! x8 ]7 w& E: f+ Z8 }8 G9 w% L
464.                         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     3 ]' U* o, b2 T
465.                         # Generates the custom client.ovpn
     
466.                         new_client
     1 ?: S- B$ E! Y) z- A
467.                         echo
     0 [3 U9 Y2 ]$ o4 t: ^/ O
468.                         echo "$client added. Configuration available in:" ~/"$client.ovpn"
     
469.                         exit
     
470.                 ;;
     ' n# Y2 W" x6 O7 M  R
471.                 2)
     
472.                         # This option could be documented a bit better and maybe even be simplified
     ( U7 ~2 E- H8 v! N, H7 b
473.                         # ...but what can I say, I want some sleep too
     
474.                         number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
     0 e1 g1 z* [0 \
475.                         if [[ "$number_of_clients" = 0 ]]; then
     8 |4 s8 H! Y1 w* y; H7 e- P8 k8 R
476.                                 echo
     
477.                                 echo "There are no existing clients!"
     * |/ o; L* Z' ~/ |+ n% K3 o
478.                                 exit
     
479.                         fi
     4 s5 o! E5 j* N! A; p
480.                         echo
     
481.                         echo "Select the client to revoke:"
     
482.                         tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
     
483.                         read -p "Client: " client_number
     
484.                         until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
     7 P; K2 A! b  h+ a3 M9 W# y
485.                                 echo "$client_number: invalid selection."
     
486.                                 read -p "Client: " client_number
     
487.                         done
     
488.                         client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
     
489.                         echo
     
490.                         read -p "Confirm $client revocation? [y/N]: " revoke
     
491.                         until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
     0 M. s1 s! }+ T2 i+ j) R
492.                                 echo "$revoke: invalid selection."
     9 @2 Q5 `# D' J% J
493.                                 read -p "Confirm $client revocation? [y/N]: " revoke
     
494.                         done
     
495.                         if [[ "$revoke" =~ ^[yY]$ ]]; then
     
496.                                 cd /etc/openvpn/server/easy-rsa/
     / }9 C0 G6 @7 H0 U
497.                                 ./easyrsa --batch revoke "$client"
     
498.                                 EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     
499.                                 rm -f /etc/openvpn/server/crl.pem
     
500.                                 cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
     8 n9 B+ v; F8 E5 x6 e5 v/ `  F
501.                                 # CRL is read with each client connection, when OpenVPN is dropped to nobody
     
502.                                 chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     
503.                                 echo
     
504.                                 echo "$client revoked!"
     6 y5 T: ]) I- g' i; A# l9 l
505.                         else
     9 c( Q0 q$ }) T* e
506.                                 echo
     
507.                                 echo "$client revocation aborted!"
     
508.                         fi
     3 [* h& J& f; v6 ^
509.                         exit
     
510.                 ;;
     5 }/ X$ l+ t* h$ O1 _
511.                 3)
     ) S+ h+ u' H: c" ^/ M
512.                         echo
     
513.                         read -p "Confirm OpenVPN removal? [y/N]: " remove
     + \% O# K7 Z% s& |$ R3 s) t
514.                         until [[ "$remove" =~ ^[yYnN]*$ ]]; do
     " F7 C0 a6 B* J8 z  Y
515.                                 echo "$remove: invalid selection."
     + q! [2 |* r7 u9 N1 |0 _
516.                                 read -p "Confirm OpenVPN removal? [y/N]: " remove
     
517.                         done
     
518.                         if [[ "$remove" =~ ^[yY]$ ]]; then
     
519.                                 port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     5 W2 X$ `" u5 a) e8 U
520.                                 protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     
521.                                 if systemctl is-active --quiet firewalld.service; then
     
522.                                         ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
     & }7 T; ?5 h1 j/ r$ N/ m' I
523.                                         # Using both permanent and not permanent rules to avoid a firewalld reload.
     
524.                                         firewall-cmd --remove-port="$port"/"$protocol"
     . |5 ]) \3 s4 c7 h; U! z8 p, c7 X
525.                                         firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
     
526.                                         firewall-cmd --permanent --remove-port="$port"/"$protocol"
     . `2 g$ Y- p/ G
527.                                         firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
     , D  ~( v/ l% {
528.                                         firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     ; |3 T) u1 i/ X2 a
529.                                         firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     : t4 K9 |+ m, ]9 P
530.                                         if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
     
531.                                                 ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
     
532.                                                 firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     
533.                                                 firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     
534.                                                 firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     + l8 o5 M" P' c' ]- V1 b6 h8 r. i
535.                                                 firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
536.                                         fi
     
537.                                 else
     
538.                                         systemctl disable --now openvpn-iptables.service
     % \4 v: C9 |# S' N
539.                                         rm -f /etc/systemd/system/openvpn-iptables.service
     
540.                                 fi
     
541.                                 if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     $ z/ P4 Q5 z" M1 K
542.                                         semanage port -d -t openvpn_port_t -p "$protocol" "$port"
     & Y, K. E& v& `$ H
543.                                 fi
     # ^) P, O7 ~5 `! d# m% C
544.                                 systemctl disable --now openvpn-server@server.service
     
545.                                 rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     " H& D# S& w! |4 b8 F. H2 J% M
546.                                 rm -f /etc/sysctl.d/99-openvpn-forward.conf
     
547.                                 if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     
548.                                         rm -rf /etc/openvpn/server
     
549.                                         apt-get remove --purge -y openvpn
     ; C- F$ y- F. i% O
550.                                 else
     * y) l. U5 @) e8 I. E. w2 b3 N* \& _
551.                                         # Else, OS must be CentOS or Fedora
     ) N. E, ^2 B% i
552.                                         yum remove -y openvpn
     
553.                                         rm -rf /etc/openvpn/server
     
554.                                 fi
     ' ?  W# `5 }8 f7 G4 B
555.                                 echo
     
556.                                 echo "OpenVPN removed!"
     ; K9 r5 `! A4 c& n% T
557.                         else
     . ?! u. w. K5 ~- {$ b" U) J: t
558.                                 echo
     
559.                                 echo "OpenVPN removal aborted!"
     # r- ^; L% i$ X( P
560.                         fi
     , Q+ e; Y; l$ n( W: r% N
561.                         exit
     
562.                 ;;
     
563.                 4)
     9 v8 c: F; {$ ^5 f; C$ ~7 o
564.                         exit
     , b) d) x6 S6 H1 G. \  t
565.                 ;;
     / J  Q9 W# _- L7 U
566.         esac
     " ^8 f' v# T/ b$ R
567. fi
     2 ^/ A( G  G* t3 O8 p5 h) v/ L" f

复制代码

  W0 U8 L9 f! k1 r

5 Y0 v5 I8 A2 e7 `1 E) [