shadowsocks-all.sh

fudyou

: T# T* p4 Q: l& j/ B

1. #!/bin/bash
   
2. #
   
3. # https://github.com/Nyr/openvpn-install
   2 N3 j) H3 P  H! u4 b
4. #
   
5. # Copyright (c) 2013 Nyr. Released under the MIT License.
   
6. 
   0 a8 {9 p: k6 m
7. 
   3 K+ ^5 }7 H- R$ M) o
8. # Detect Debian users running the script with "sh" instead of bash
   
9. if readlink /proc/$$/exe | grep -q "dash"; then
   9 m) A* i0 P/ ]* K; y
10.         echo 'This installer needs to be run with "bash", not "sh".'
    / W' R; S- W% h" z
11.         exit
    4 e* g5 _5 _" t8 ?, {7 E
12. fi
    1 K) g; }" g1 ?/ K4 D8 v/ w
13. 
    
14. # Discard stdin. Needed when running from an one-liner which includes a newline
    ( }% K* g: F, s5 L* F
15. read -N 999999 -t 0.001
    
16. 
    
17. # Detect OpenVZ 6
    
18. if [[ $(uname -r | cut -d "." -f 1) -eq 2 ]]; then
    
19.         echo "The system is running an old kernel, which is incompatible with this installer."
    : B3 Y) y/ e8 V7 L5 \
20.         exit
    
21. fi
    
22. 
    
23. # Detect OS
    
24. # $os_version variables aren't always in use, but are kept here for convenience
    ) r3 o4 B. y/ U# C
25. if grep -qs "ubuntu" /etc/os-release; then
    6 k* x7 x( E# y
26.         os="ubuntu"
    ( C3 p% V3 S+ U5 S8 d: f- z
27.         os_version=$(grep 'VERSION_ID' /etc/os-release | cut -d '"' -f 2 | tr -d '.')
    
28.         group_name="nogroup"
    0 t2 e2 P# }4 y) p
29. elif [[ -e /etc/debian_version ]]; then
    5 i9 C, g1 o- Y% \
30.         os="debian"
    % [; u/ [( o) R, }# y+ A+ ]
31.         os_version=$(grep -oE '[0-9]+' /etc/debian_version | head -1)
    5 Y" D+ C; W. O. c0 f6 H
32.         group_name="nogroup"
    9 }# y7 V$ q; r) z! ?8 a& C; R
33. elif [[ -e /etc/almalinux-release || -e /etc/rocky-release || -e /etc/centos-release ]]; then
    
34.         os="centos"
    
35.         os_version=$(grep -shoE '[0-9]+' /etc/almalinux-release /etc/rocky-release /etc/centos-release | head -1)
    % }$ s# y/ g0 \4 ^% R- {
36.         group_name="nobody"
    
37. elif [[ -e /etc/fedora-release ]]; then
    
38.         os="fedora"
    
39.         os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)
    
40.         group_name="nobody"
    & ], U- j& B) n
41. else
    + i9 Z7 ]  `1 \- R& [9 s) d
42.         echo "This installer seems to be running on an unsupported distribution.
    ' \% u- G6 t# q" B$ u) Z8 S
43. Supported distros are Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora."
    
44.         exit
    
45. fi
    
46. 
    
47. if [[ "$os" == "ubuntu" && "$os_version" -lt 1804 ]]; then
    . I+ b6 D/ E3 A! @2 m' \) H- ^
48.         echo "Ubuntu 18.04 or higher is required to use this installer.
    
49. This version of Ubuntu is too old and unsupported."
    
50.         exit
    
51. fi
    " s* f0 p- ~, h7 b  g
52. 
    
53. if [[ "$os" == "debian" && "$os_version" -lt 9 ]]; then
    3 l  [* o4 b) K; j7 [( w* I
54.         echo "Debian 9 or higher is required to use this installer.
    
55. This version of Debian is too old and unsupported."
    ( a# \& {" [+ O/ u* |
56.         exit
    % y  _# X; }& n& g6 z
57. fi
    
58. 
    $ O' z- @- B: _; l
59. if [[ "$os" == "centos" && "$os_version" -lt 7 ]]; then
    
60.         echo "CentOS 7 or higher is required to use this installer.
    / t' z" V! q5 k9 ^0 U
61. This version of CentOS is too old and unsupported."
    2 i3 T' e8 T6 d" n/ p' R
62.         exit
    ) W6 i# K+ v+ A$ w. T6 g6 G
63. fi
    
64. 
    
65. # Detect environments where $PATH does not include the sbin directories
    
66. if ! grep -q sbin <<< "$PATH"; then
    ( t( a5 k% M; u7 r8 ~+ d) d! A% D
67.         echo '$PATH does not include sbin. Try using "su -" instead of "su".'
    
68.         exit
    5 L5 G2 n3 A0 S( t* _* I) v
69. fi
    * I% Z2 r  u( m2 a  l
70. 
    9 F( ]" ?0 n0 k. j+ ?( H: L
71. if [[ "$EUID" -ne 0 ]]; then
    + m& f2 P9 @; ~3 h0 ^5 P
72.         echo "This installer needs to be run with superuser privileges."
    
73.         exit
    ( i# I) }" S7 D5 {/ t
74. fi
    7 z) i, m" o5 L8 f4 ?2 Y4 v" j* p
75. 
      \# g# r- r# f/ i
76. if [[ ! -e /dev/net/tun ]] || ! ( exec 7<>/dev/net/tun ) 2>/dev/null; then
    1 v0 h6 J) o. O4 {8 u  w
77.         echo "The system does not have the TUN device available.
    
78. TUN needs to be enabled before running this installer."
    ; d4 D9 g- |+ p- L3 `+ X1 z6 ^% k
79.         exit
    
80. fi
    / {1 f: M! X4 t/ |! I1 c
81. 
    
82. new_client () {
      X* J' r3 z* r6 N
83.         # Generates the custom client.ovpn
    ! S( N$ F% ~" v1 x4 H) `
84.         {
    
85.         cat /etc/openvpn/server/client-common.txt
    , I8 M+ @6 \. s7 }
86.         echo "<ca>"
    ' u5 p  n2 K7 j8 b( {8 _* w; v! S
87.         cat /etc/openvpn/server/easy-rsa/pki/ca.crt
    " x: v) ~  X# S3 o1 |' @! s
88.         echo "</ca>"
    
89.         echo "<cert>"
    
90.         sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt
    6 [3 H" A. \# g+ U6 M3 H5 H7 g  I% u
91.         echo "</cert>"
    5 _; d, m7 i- Z" Y+ y( d
92.         echo "<key>"
    % W' ^. c$ d, x; [) o
93.         cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key
    
94.         echo "</key>"
    
95.         echo "<tls-crypt>"
    ; c* t# b$ H. p2 s  a3 S
96.         sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
    
97.         echo "</tls-crypt>"
    " W" v  O$ X. X; J5 p( {; p
98.         } > ~/"$client".ovpn
    
99. }
    " I% c% a. T1 S/ G% g: D+ K1 t
100. 
     0 i$ z3 h; |4 U/ _' {
101. if [[ ! -e /etc/openvpn/server/server.conf ]]; then
     . @' Q3 y* p' Q8 H& i
102.         # Detect some Debian minimal setups where neither wget nor curl are installed
     
103.         if ! hash wget 2>/dev/null && ! hash curl 2>/dev/null; then
     
104.                 echo "Wget is required to use this installer."
     
105.                 read -n1 -r -p "Press any key to install Wget and continue..."
     
106.                 apt-get update
     
107.                 apt-get install -y wget
     
108.         fi
     % B/ j  h( z- F6 Q" I
109.         clear
     / y9 ~6 i8 e/ f% _' F7 J+ P$ \6 `
110.         echo 'Welcome to this OpenVPN road warrior installer!'
     - g# a# B+ B* `) J& C  l
111.         # If system has a single IPv4, it is selected automatically. Else, ask the user
     
112.         if [[ $(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}') -eq 1 ]]; then
     
113.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}')
     . {' B/ @7 X% B0 U$ c
114.         else
     % v! m  l3 m9 A  I. c! c1 h
115.                 number_of_ip=$(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}')
     
116.                 echo
     ) {$ N/ z8 u6 r$ V  n7 k
117.                 echo "Which IPv4 address should be used?"
     + G4 n5 e$ `& ^8 \5 s1 w/ L
118.                 ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | nl -s ') '
     , m% w$ Q# m! y* q. ?& t' s
119.                 read -p "IPv4 address [1]: " ip_number
     
120.                 until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ip" ]]; do
     
121.                         echo "$ip_number: invalid selection."
     6 t) D0 ~+ H+ C" G0 N  m
122.                         read -p "IPv4 address [1]: " ip_number
     
123.                 done
     
124.                 [[ -z "$ip_number" ]] && ip_number="1"
     
125.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sed -n "$ip_number"p)
     
126.         fi
     
127.         # If $ip is a private IP address, the server must be behind NAT
     4 W3 p( m" ?) Z8 k1 j
128.         if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
     , e, c( d! U; r9 l1 D) _1 s
129.                 echo
     
130.                 echo "This server is behind NAT. What is the public IPv4 address or hostname?"
     
131.                 # Get public IP and sanitize with grep
     4 o7 |( j. R8 G
132.                 get_public_ip=$(grep -m 1 -oE '^[0-9]{1,3}(\.[0-9]{1,3}){3}$' <<< "$(wget -T 10 -t 1 -4qO- "http://ip1.dynupdate.no-ip.com/" || curl -m 10 -4Ls "http://ip1.dynupdate.no-ip.com/")")
     
133.                 read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip
     8 X6 F) x( p% f" ^1 j# r
134.                 # If the checkip service is unavailable and user didn't provide input, ask again
     8 B( X. T9 g/ N& W' O
135.                 until [[ -n "$get_public_ip" || -n "$public_ip" ]]; do
     
136.                         echo "Invalid input."
     * L) h; A  T  c
137.                         read -p "Public IPv4 address / hostname: " public_ip
     
138.                 done
     
139.                 [[ -z "$public_ip" ]] && public_ip="$get_public_ip"
     , v. j- P0 S: H# S" v6 z& f
140.         fi
     
141.         # If system has a single IPv6, it is selected automatically
     ; Y4 e2 d) b9 {0 t
142.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -eq 1 ]]; then
     
143.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}')
     0 Z/ }$ o& K! I: m6 d! l% x8 g
144.         fi
     
145.         # If system has multiple IPv6, ask the user to select one
       o/ g1 {, j& W* P4 H# h
146.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -gt 1 ]]; then
     , ~1 f1 H/ `0 x  t8 J& r
147.                 number_of_ip6=$(ip -6 addr | grep -c 'inet6 [23]')
     
148.                 echo
     
149.                 echo "Which IPv6 address should be used?"
     
150.                 ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | nl -s ') '
     
151.                 read -p "IPv6 address [1]: " ip6_number
     
152.                 until [[ -z "$ip6_number" || "$ip6_number" =~ ^[0-9]+$ && "$ip6_number" -le "$number_of_ip6" ]]; do
     
153.                         echo "$ip6_number: invalid selection."
       d" ~) X2 o- q5 w4 @6 G( ^5 ]) ~  {
154.                         read -p "IPv6 address [1]: " ip6_number
     
155.                 done
     ) |* Q( ~0 g9 {1 o: Q, T
156.                 [[ -z "$ip6_number" ]] && ip6_number="1"
     % i) h# o4 I3 i% }% A" Y
157.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | sed -n "$ip6_number"p)
     
158.         fi
     
159.         echo
     5 |9 x: x0 _5 Q
160.         echo "Which protocol should OpenVPN use?"
     
161.         echo "   1) UDP (recommended)"
     6 J6 }8 _2 T1 e+ v. r! X
162.         echo "   2) TCP"
     5 j) @- P% ^/ f3 A/ E. M" Y
163.         read -p "Protocol [1]: " protocol
     4 O0 B6 v( n4 S& n% I
164.         until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
     
165.                 echo "$protocol: invalid selection."
     
166.                 read -p "Protocol [1]: " protocol
     . {2 Q9 S  [, x/ y) u
167.         done
     
168.         case "$protocol" in
     
169.                 1|"")
     
170.                 protocol=udp
     
171.                 ;;
     : t, R# y; f1 R" p; m
172.                 2)
     
173.                 protocol=tcp
     0 o' y4 f! T- |" m
174.                 ;;
       y1 v" b4 z0 a, Y
175.         esac
     
176.         echo
       o8 q) i* \7 G) j" V/ \+ Q
177.         echo "What port should OpenVPN listen to?"
     
178.         read -p "Port [1194]: " port
     
179.         until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do
     ) ?. ^" l9 F2 @0 U. e
180.                 echo "$port: invalid port."
     
181.                 read -p "Port [1194]: " port
     $ E) m" q0 |$ |1 h/ |1 `' P. J
182.         done
     + p3 m; j- o  y0 u
183.         [[ -z "$port" ]] && port="1194"
     
184.         echo
     - z0 f; Z8 K  N7 [6 c- C& G0 P
185.         echo "Select a DNS server for the clients:"
       y* e4 v# @- R; B2 Y" z& ]" b1 E
186.         echo "   1) Current system resolvers"
     
187.         echo "   2) Google"
     4 J. q; p3 B+ ~* M9 @! N
188.         echo "   3) 1.1.1.1"
     
189.         echo "   4) OpenDNS"
     
190.         echo "   5) Quad9"
     
191.         echo "   6) AdGuard"
       \0 N( S& V6 F; s$ n
192.         read -p "DNS server [1]: " dns
     * H" T. M2 i' h& O* E/ P
193.         until [[ -z "$dns" || "$dns" =~ ^[1-6]$ ]]; do
     . v/ {0 e3 x" z$ o7 a4 c
194.                 echo "$dns: invalid selection."
     6 I/ e+ E; j/ C: i! o9 r4 x
195.                 read -p "DNS server [1]: " dns
     & L8 \) F; R* a- c. K- E8 _+ a
196.         done
     
197.         echo
     
198.         echo "Enter a name for the first client:"
     " m' U! s$ O$ J% R- i* h4 D4 u. }$ s
199.         read -p "Name [client]: " unsanitized_client
     
200.         # Allow a limited set of characters to avoid conflicts
     5 ^7 T) j4 x) L0 |& W
201.         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     0 Y% ~! X0 p1 C5 B3 J4 B1 V
202.         [[ -z "$client" ]] && client="client"
     - b1 O+ O! C$ P7 v4 G
203.         echo
     9 H' [8 i; T' w' Z+ b
204.         echo "OpenVPN installation is ready to begin."
     
205.         # Install a firewall if firewalld or iptables are not already available
     " Q  _4 b  h$ e
206.         if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then
     . G) H: n8 z0 |$ o+ j8 L
207.                 if [[ "$os" == "centos" || "$os" == "fedora" ]]; then
     
208.                         firewall="firewalld"
     
209.                         # We don't want to silently enable firewalld, so we give a subtle warning
     + g' ^* A# U% ^0 O9 U- Z5 c% x
210.                         # If the user continues, firewalld will be installed and enabled during setup
     
211.                         echo "firewalld, which is required to manage routing tables, will also be installed."
     
212.                 elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then
     
213.                         # iptables is way less invasive than firewalld so no warning is given
     & T6 r5 }: @* O% M" P. L
214.                         firewall="iptables"
     , E- X% K& v$ N
215.                 fi
     
216.         fi
     
217.         read -n1 -r -p "Press any key to continue..."
     6 |) \* N& t; l+ `/ Z+ f' {
218.         # If running inside a container, disable LimitNPROC to prevent conflicts
     * H; y$ F* B8 C$ P2 l) l# |
219.         if systemd-detect-virt -cq; then
     
220.                 mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null
     
221.                 echo "[Service]
     
222. LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     
223.         fi
     
224.         if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     
225.                 apt-get update
     $ U! a/ k% q, K% x3 @: z7 q
226.                 apt-get install -y openvpn openssl ca-certificates $firewall
     
227.         elif [[ "$os" = "centos" ]]; then
     1 Y6 f7 g$ Q, k6 }6 p
228.                 yum install -y epel-release
     
229.                 yum install -y openvpn openssl ca-certificates tar $firewall
     
230.         else
     
231.                 # Else, OS must be Fedora
     
232.                 dnf install -y openvpn openssl ca-certificates tar $firewall
     
233.         fi
     # b7 h( o1 T7 o, n: O
234.         # If firewalld was just installed, enable it
     % I% |/ l# J7 [
235.         if [[ "$firewall" == "firewalld" ]]; then
     
236.                 systemctl enable --now firewalld.service
     
237.         fi
     
238.         # Get easy-rsa
     ; Q8 |* {/ ~; Z
239.         easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.0/EasyRSA-3.1.0.tgz'
     3 r7 j: |) d& J* v! y* D  Y$ a
240.         mkdir -p /etc/openvpn/server/easy-rsa/
     ; ^, d5 b% U, C1 F/ b" [, L
241.         { wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1
     # ^/ _) e8 L7 I& B
242.         chown -R root:root /etc/openvpn/server/easy-rsa/
     
243.         cd /etc/openvpn/server/easy-rsa/
     * X( S5 ^$ Y6 Q; V( V
244.         # Create the PKI, set up the CA and the server and client certificates
     2 q4 K8 M4 J1 c9 U. g3 H! p
245.         ./easyrsa init-pki
     
246.         ./easyrsa --batch build-ca nopass
     
247.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass
     ; v% R& }/ j/ B- Q! p1 J3 ?+ O3 ]
248.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     
249.         EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     ; y, _( b- f6 o
250.         # Move the stuff we need
     
251.         cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
     
252.         # CRL is read with each client connection, while OpenVPN is dropped to nobody
     7 p& D, R, y6 k, P
253.         chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     % w1 J8 j+ X  o0 j, b
254.         # Without +x in the directory, OpenVPN can't run a stat() on the CRL file
     " i) I4 E* i1 q+ K- R# M6 X& a
255.         chmod o+x /etc/openvpn/server/
     
256.         # Generate key for tls-crypt
     8 \, C% j! J7 w; ]1 w/ W" `
257.         openvpn --genkey --secret /etc/openvpn/server/tc.key
     % k' b! u# [$ {) N' r) Y
258.         # Create the DH parameters file using the predefined ffdhe2048 group
     8 v- e) i! H& U  P6 H7 T. v
259.         echo '-----BEGIN DH PARAMETERS-----
     6 l8 `- b( n5 h
260. MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
     
261. +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
     7 B, C3 @6 C2 z7 E
262. 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
     
263. YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
     
264. 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
     
265. ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
     
266. -----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem
     
267.         # Generate server.conf
     : d+ @& R& _- X# H' @
268.         echo "local $ip
     2 P9 k+ _, X. j6 _
269. port $port
     ) G0 [0 l* C1 o1 t1 }
270. proto $protocol
     
271. dev tun
     2 x; J5 [7 C& t& N: f. k$ L; @
272. ca ca.crt
     9 V- l0 S4 _  y) L) i% I5 ]
273. cert server.crt
     . ~% z) v: V5 l
274. key server.key
     4 K. R9 k) V7 v) |
275. dh dh.pem
     
276. auth SHA512
     , [% S4 K: I. F+ r! d. n
277. tls-crypt tc.key
     
278. topology subnet
     ; g$ @  s+ ?3 t" d. P+ @7 p
279. server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf
     
280.         # IPv6
     
281.         if [[ -z "$ip6" ]]; then
     
282.                 echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     
283.         else
     
284.                 echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf
     - \1 B6 ~. K; V
285.                 echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     
286.         fi
     $ {5 O8 V7 X8 z# F. h
287.         echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf
     4 t- r/ q& K  z  o: y- }2 {- E
288.         # DNS
     
289.         case "$dns" in
     . j; B1 {8 G0 n5 p
290.                 1|"")
     2 G5 V, i6 a: W& }/ m8 E
291.                         # Locate the proper resolv.conf
     9 M* n/ E$ `+ g8 {% L1 F, x$ @
292.                         # Needed for systems running systemd-resolved
     5 p: M8 R; I# p  q2 F
293.                         if grep -q '^nameserver 127.0.0.53' "/etc/resolv.conf"; then
     : @8 s  b3 q& O& ?4 l9 _
294.                                 resolv_conf="/run/systemd/resolve/resolv.conf"
     
295.                         else
     3 f; w+ V2 g6 d9 a8 Z+ ~4 C
296.                                 resolv_conf="/etc/resolv.conf"
     ( N3 A% t0 Q8 Q$ U% C, N0 }, g
297.                         fi
     
298.                         # Obtain the resolvers from resolv.conf and use them for OpenVPN
     
299.                         grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do
     
300.                                 echo "push "dhcp-option DNS $line"" >> /etc/openvpn/server/server.conf
     
301.                         done
     
302.                 ;;
     * l2 ?1 L7 h# ~
303.                 2)
     
304.                         echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf
     ! s" q' G, }& b# s
305.                         echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf
     
306.                 ;;
     9 b# W# k$ b5 c, ?5 ?
307.                 3)
     
308.                         echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf
     2 Y8 A" F. |7 z" V
309.                         echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf
     4 E& n* C: E, i8 @4 Y
310.                 ;;
     
311.                 4)
     ( d6 H! g! s+ d  P, P
312.                         echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf
       g6 o. `% F+ l2 c+ |3 ~4 [; s2 G, A. @
313.                         echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf
     8 t5 z8 B& i7 b5 t. |
314.                 ;;
     
315.                 5)
     : N# G4 O" ^& Q2 L5 L* w
316.                         echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf
     * M: [! f6 q" F1 J: S8 A1 j
317.                         echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf
     
318.                 ;;
     
319.                 6)
     
320.                         echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf
     4 q! N0 e9 F6 ~' _) f8 }4 i- l* x
321.                         echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf
     ) [& T, n% G7 _2 H+ S* C
322.                 ;;
     
323.         esac
     . L- C/ T: A% V9 Q
324.         echo "keepalive 10 120
     
325. cipher AES-256-CBC
     2 ~* p1 _$ ]9 [4 _& r$ T
326. user nobody
     
327. group $group_name
     
328. persist-key
     + f( S8 |' e# U3 k( b+ O- H2 H
329. persist-tun
     0 ^* o! Z6 P  x0 G' I. W& J
330. verb 3
     
331. crl-verify crl.pem" >> /etc/openvpn/server/server.conf
     , N& y' o' {8 P% N
332.         if [[ "$protocol" = "udp" ]]; then
     * s$ J; {, ~/ i! m$ [
333.                 echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf
     
334.         fi
     
335.         # Enable net.ipv4.ip_forward for the system
     + B1 r4 _6 {* T5 T3 @9 F
336.         echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-openvpn-forward.conf
     # J; w( Q1 j* Y7 [
337.         # Enable without waiting for a reboot or service restart
     ; o! z- h. _+ e5 Q: _
338.         echo 1 > /proc/sys/net/ipv4/ip_forward
     
339.         if [[ -n "$ip6" ]]; then
     8 ?, a$ s- W) ?$ E( e3 J1 f
340.                 # Enable net.ipv6.conf.all.forwarding for the system
     - q" N$ ]9 y3 A  [: o
341.                 echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/99-openvpn-forward.conf
     / @3 c- Z  u: u" |5 L1 }
342.                 # Enable without waiting for a reboot or service restart
     ( [: U! P% s$ k, G$ x# k
343.                 echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
     
344.         fi
     
345.         if systemctl is-active --quiet firewalld.service; then
     
346.                 # Using both permanent and not permanent rules to avoid a firewalld
     + m7 C6 v4 n8 o/ U
347.                 # reload.
     
348.                 # We don't use --add-service=openvpn because that would only work with
     0 s5 H) X5 J; a2 @2 F8 d* G
349.                 # the default port and protocol.
     4 U% f; G5 k' _: G  [% o( D' m9 _! [
350.                 firewall-cmd --add-port="$port"/"$protocol"
     , u8 ~/ M% k; s$ N
351.                 firewall-cmd --zone=trusted --add-source=10.8.0.0/24
     
352.                 firewall-cmd --permanent --add-port="$port"/"$protocol"
     
353.                 firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
     
354.                 # Set NAT for the VPN subnet
     
355.                 firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     3 @6 a/ ^- @+ W6 D* }  {
356.                 firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
357.                 if [[ -n "$ip6" ]]; then
       ?) d3 J( z+ w; N3 e. X# k
358.                         firewall-cmd --zone=trusted --add-source=fddd:1194:1194:1194::/64
     
359.                         firewall-cmd --permanent --zone=trusted --add-source=fddd:1194:1194:1194::/64
     
360.                         firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
361.                         firewall-cmd --permanent --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
362.                 fi
     * G6 H' O4 q* }$ a- e
363.         else
     / _. }! ^. f: _, ?
364.                 # Create a service to set up persistent iptables rules
     
365.                 iptables_path=$(command -v iptables)
     
366.                 ip6tables_path=$(command -v ip6tables)
     . m1 A6 o* N1 F. Y8 n& W  _& `1 C
367.                 # nf_tables is not available as standard in OVZ kernels. So use iptables-legacy
     7 y1 {6 j( c, B* h' T
368.                 # if we are in OVZ, with a nf_tables backend and iptables-legacy is available.
     
369.                 if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then
     ) G) G2 A8 G# t4 a, o7 N" ]# P8 O5 T& J
370.                         iptables_path=$(command -v iptables-legacy)
     
371.                         ip6tables_path=$(command -v ip6tables-legacy)
     3 ^- z( `& B8 F1 D$ l5 }  D  w
372.                 fi
     . I0 M. `5 m! H1 u
373.                 echo "[Unit]
     * \* k0 T( y+ }
374. Before=network.target
     
375. [Service]
     
376. Type=oneshot
     9 O; v4 H+ ]$ M& N
377. ExecStart=$iptables_path -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     ( ?3 {1 U4 A* R/ d, i+ @- G2 y2 s& u
378. ExecStart=$iptables_path -I INPUT -p $protocol --dport $port -j ACCEPT
     
379. ExecStart=$iptables_path -I FORWARD -s 10.8.0.0/24 -j ACCEPT
     1 w; g& g0 A' L' x3 k5 Z
380. ExecStart=$iptables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     . Z1 ]) W  B; H) o. K8 i
381. ExecStop=$iptables_path -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     1 H; j! @# J$ @& B# H/ h7 ^. b9 n
382. ExecStop=$iptables_path -D INPUT -p $protocol --dport $port -j ACCEPT
     / q; ?/ ?& E6 s' D+ w
383. ExecStop=$iptables_path -D FORWARD -s 10.8.0.0/24 -j ACCEPT
     - D& t; @  |* V: p, y
384. ExecStop=$iptables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > /etc/systemd/system/openvpn-iptables.service
     5 |; q( w7 H7 m- O
385.                 if [[ -n "$ip6" ]]; then
     8 z; N+ J+ T1 f* h( A. L
386.                         echo "ExecStart=$ip6tables_path -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     
387. ExecStart=$ip6tables_path -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     
388. ExecStart=$ip6tables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     + w- A5 _' f0 U/ Z
389. ExecStop=$ip6tables_path -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     2 s( ~7 ~5 s2 f/ `0 c
390. ExecStop=$ip6tables_path -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     2 T( |6 W, D9 R- x9 t9 ?
391. ExecStop=$ip6tables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> /etc/systemd/system/openvpn-iptables.service
     - D+ H: |2 Z3 p
392.                 fi
     ' J4 V. _# B8 E% W3 S
393.                 echo "RemainAfterExit=yes
     1 ]+ ]4 t) N& G/ `+ B4 ]5 L
394. [Install]
     0 W7 _. p8 R9 Q- |% a
395. WantedBy=multi-user.target" >> /etc/systemd/system/openvpn-iptables.service
     0 B% q- b; U( t& `  y
396.                 systemctl enable --now openvpn-iptables.service
     . K3 `0 I  x9 `" s
397.         fi
       z9 Z* j( @  W( Q! H5 B( l! F
398.         # If SELinux is enabled and a custom port was selected, we need this
     . `' _. a  _3 Q, C& }
399.         if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     
400.                 # Install semanage if not already present
     ; U; b1 D$ O0 E4 I/ M- h1 p
401.                 if ! hash semanage 2>/dev/null; then
     
402.                         if [[ "$os_version" -eq 7 ]]; then
     
403.                                 # Centos 7
     
404.                                 yum install -y policycoreutils-python
     
405.                         else
     % q+ W  s/ z1 a) {2 x
406.                                 # CentOS 8 or Fedora
     
407.                                 dnf install -y policycoreutils-python-utils
     
408.                         fi
     
409.                 fi
     # a, L) A7 e. H: D( Y! ]. X
410.                 semanage port -a -t openvpn_port_t -p "$protocol" "$port"
     % X6 E0 a  p5 ^4 Z* v* {# F! z
411.         fi
     
412.         # If the server is behind NAT, use the correct IP address
     3 X( `- ^! s8 u5 _
413.         [[ -n "$public_ip" ]] && ip="$public_ip"
     9 Y. N! I& ?# q' S% v- A3 o
414.         # client-common.txt is created so we have a template to add further users later
     / p+ [- [+ y1 Y7 @6 G: n
415.         echo "client
     
416. dev tun
     1 r( b3 U  w! {; Y
417. proto $protocol
     5 N; H2 x8 Q( m5 m1 s5 o( v+ ~
418. remote $ip $port
     8 _: y# Z+ e+ K8 \9 F
419. resolv-retry infinite
     % ]! P( \. W2 {, [% G6 `# P
420. nobind
     
421. persist-key
     & P' R/ @% f% v! g; d
422. persist-tun
     & x, v) A/ G. w6 V
423. remote-cert-tls server
     
424. auth SHA512
     
425. cipher AES-256-CBC
     
426. ignore-unknown-option block-outside-dns
     
427. block-outside-dns
     $ I8 e% s; r* X; w* J
428. verb 3" > /etc/openvpn/server/client-common.txt
     
429.         # Enable and start the OpenVPN service
     1 K& G5 }  m, G. ~  L5 G/ N5 Z, W
430.         systemctl enable --now openvpn-server@server.service
     6 }( X7 D) [+ E3 K; }5 G* C
431.         # Generates the custom client.ovpn
     & `0 t, [* f4 s! j
432.         new_client
     5 \# B! Q9 C$ }0 X6 u; o
433.         echo
     
434.         echo "Finished!"
     
435.         echo
     
436.         echo "The client configuration is available in:" ~/"$client.ovpn"
     * S$ V0 d+ T- g  q; R
437.         echo "New clients can be added by running this script again."
     
438. else
     . J+ c1 ^6 z+ a  ^% j
439.         clear
     
440.         echo "OpenVPN is already installed."
     
441.         echo
     
442.         echo "Select an option:"
     5 @2 q( p3 N, V
443.         echo "   1) Add a new client"
     
444.         echo "   2) Revoke an existing client"
     2 Y) M7 s% n% I7 x& a" w" m
445.         echo "   3) Remove OpenVPN"
     
446.         echo "   4) Exit"
     
447.         read -p "Option: " option
     
448.         until [[ "$option" =~ ^[1-4]$ ]]; do
     
449.                 echo "$option: invalid selection."
     
450.                 read -p "Option: " option
     
451.         done
     7 ]; ?2 k( q3 h2 Z& \9 s
452.         case "$option" in
     
453.                 1)
     + W2 ~7 C) h5 c) E, j0 u; @. a, H' {
454.                         echo
     4 \, Z4 ^1 G$ \, D" E; [$ S9 g& l
455.                         echo "Provide a name for the client:"
     0 _2 O3 t, n$ y' U
456.                         read -p "Name: " unsanitized_client
     
457.                         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     2 j; Q- `5 \: O0 `2 E
458.                         while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
     1 D7 ?; t+ F; `, A/ \
459.                                 echo "$client: invalid name."
     
460.                                 read -p "Name: " unsanitized_client
     / k6 @' O. a4 ^7 ?
461.                                 client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     
462.                         done
     " X9 W8 W2 ^1 }( k2 v. r, @
463.                         cd /etc/openvpn/server/easy-rsa/
     
464.                         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     ' p% }) w; s  S' G$ p; p* f9 r* N
465.                         # Generates the custom client.ovpn
     ( [. N; e4 B7 i9 ?# N
466.                         new_client
     
467.                         echo
     ' U; G, [5 [0 N0 X
468.                         echo "$client added. Configuration available in:" ~/"$client.ovpn"
     
469.                         exit
     
470.                 ;;
     7 D. Y* Q+ w# a4 _' o) o
471.                 2)
     
472.                         # This option could be documented a bit better and maybe even be simplified
     
473.                         # ...but what can I say, I want some sleep too
     % G+ q4 J. r& y1 X# @8 [( o
474.                         number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
     
475.                         if [[ "$number_of_clients" = 0 ]]; then
     # y1 p) l0 M( x7 B0 v
476.                                 echo
     : C3 U8 x4 {1 z" F0 R2 _8 T0 I
477.                                 echo "There are no existing clients!"
     
478.                                 exit
     
479.                         fi
     ! K' h1 _2 U/ `9 N- X% e
480.                         echo
     
481.                         echo "Select the client to revoke:"
     ) d( a4 k/ n  y/ ]. p$ N; w
482.                         tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
     # V) a8 f" d: E
483.                         read -p "Client: " client_number
     
484.                         until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
     
485.                                 echo "$client_number: invalid selection."
     
486.                                 read -p "Client: " client_number
     
487.                         done
       x7 |  O1 ?, b; }/ }+ a" u6 N4 ^6 I3 s" _
488.                         client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
     1 P" S% L$ S$ F- w5 y  X3 \
489.                         echo
       P4 c3 ^5 e5 w6 a
490.                         read -p "Confirm $client revocation? [y/N]: " revoke
     ' ^  t! }3 b- S/ w& m2 d
491.                         until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
     
492.                                 echo "$revoke: invalid selection."
     
493.                                 read -p "Confirm $client revocation? [y/N]: " revoke
     
494.                         done
     
495.                         if [[ "$revoke" =~ ^[yY]$ ]]; then
     
496.                                 cd /etc/openvpn/server/easy-rsa/
     & U4 R/ v' _# ^1 u; x4 Y2 }/ O0 F) ?
497.                                 ./easyrsa --batch revoke "$client"
     
498.                                 EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     . @1 Y! t" v$ V
499.                                 rm -f /etc/openvpn/server/crl.pem
     
500.                                 cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
     
501.                                 # CRL is read with each client connection, when OpenVPN is dropped to nobody
     * H1 \2 z1 {, x4 ?0 u
502.                                 chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     
503.                                 echo
     1 r9 R( V& K% }, B4 n  F
504.                                 echo "$client revoked!"
     
505.                         else
     # }9 F, B# {. h( M: f; j8 {& [: G8 A
506.                                 echo
     2 c! [, a1 t4 P% z$ }1 |
507.                                 echo "$client revocation aborted!"
     
508.                         fi
     
509.                         exit
     
510.                 ;;
     ) Z( ~& O( F. H# [7 E
511.                 3)
       N) v7 @" `0 X7 g* L- @
512.                         echo
       R/ K5 }/ k; D# o# p8 M( Y' p$ I
513.                         read -p "Confirm OpenVPN removal? [y/N]: " remove
     * c$ M% t6 [4 r- [# l
514.                         until [[ "$remove" =~ ^[yYnN]*$ ]]; do
     
515.                                 echo "$remove: invalid selection."
     5 J$ p" c6 _' [* D  J
516.                                 read -p "Confirm OpenVPN removal? [y/N]: " remove
     / @/ Q8 S8 i4 H5 ^
517.                         done
     6 s) x, p% R! ?: ^
518.                         if [[ "$remove" =~ ^[yY]$ ]]; then
     
519.                                 port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     
520.                                 protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     0 c6 V) v7 N7 U' M) V5 G
521.                                 if systemctl is-active --quiet firewalld.service; then
     
522.                                         ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
     1 \5 N7 D+ Y" H: k7 A3 _. _! V
523.                                         # Using both permanent and not permanent rules to avoid a firewalld reload.
     9 z: R* D+ W; E1 k9 s6 h$ F8 b) \$ ^
524.                                         firewall-cmd --remove-port="$port"/"$protocol"
     
525.                                         firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
     
526.                                         firewall-cmd --permanent --remove-port="$port"/"$protocol"
     
527.                                         firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
     ( d8 \! O  l8 R" s0 {8 [0 W
528.                                         firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
529.                                         firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
530.                                         if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
     ' p, o! }  |' R
531.                                                 ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
     
532.                                                 firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     
533.                                                 firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     6 Q8 G8 I- ~8 r& S  u3 V
534.                                                 firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
535.                                                 firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
536.                                         fi
     / Q3 b& o" @! z5 d4 H1 P2 V
537.                                 else
     1 E7 z8 a6 K6 }$ f+ b
538.                                         systemctl disable --now openvpn-iptables.service
     - e, `* H5 U5 {7 w7 m. e& p. F* W! c1 W
539.                                         rm -f /etc/systemd/system/openvpn-iptables.service
     . r& R4 R& c, j0 v3 G2 e6 e
540.                                 fi
     7 N, ^8 {1 g6 Q4 m( k* Z& L; k
541.                                 if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     : x  O$ L) \) @+ E
542.                                         semanage port -d -t openvpn_port_t -p "$protocol" "$port"
     
543.                                 fi
     ! B/ u5 i) n6 f& q) Q5 L2 `! k& ]
544.                                 systemctl disable --now openvpn-server@server.service
     1 c$ @8 x$ K/ E& v, \- K1 W
545.                                 rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     7 P2 \6 I" d' y, {- a5 m8 R0 k/ E
546.                                 rm -f /etc/sysctl.d/99-openvpn-forward.conf
     
547.                                 if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     
548.                                         rm -rf /etc/openvpn/server
     
549.                                         apt-get remove --purge -y openvpn
     4 _9 \, c1 z& A8 p% \# T
550.                                 else
     ; F+ M: E* G- H5 \4 Y+ w
551.                                         # Else, OS must be CentOS or Fedora
     # X$ f5 w7 ?' v  ?% f
552.                                         yum remove -y openvpn
     
553.                                         rm -rf /etc/openvpn/server
     
554.                                 fi
     ' L' \3 N, X7 W. ^
555.                                 echo
     ' j$ T* x) B& i0 A  q' y3 ]
556.                                 echo "OpenVPN removed!"
     
557.                         else
     
558.                                 echo
     ' p9 _6 g/ g% J) s  }7 P6 @9 M
559.                                 echo "OpenVPN removal aborted!"
     : s' Z9 \& P: r2 B) j
560.                         fi
     
561.                         exit
     * c$ E3 ]$ y" \( o+ ?& k
562.                 ;;
     4 D; K* s- O  }$ |0 s
563.                 4)
     7 R. r$ M* {  c1 N4 g/ W* b6 ~, b
564.                         exit
     4 P( R- Z6 d! u* S( j# Q/ T
565.                 ;;
     
566.         esac
     
567. fi
     6 Q# c- K5 c: q: m% k1 T

复制代码

: P( T  w" |5 D9 U
6 x  d/ ^, t8 }4 }

1 c. s0 T+ r4 z% V3 U