shadowsocks-all.sh

fudyou

1. #!/bin/bash
   
2. #
   2 V* ~1 X- p6 G- C: _
3. # https://github.com/Nyr/openvpn-install
   
4. #
   % ]4 |8 n2 J) P% D4 e* @0 u: J
5. # Copyright (c) 2013 Nyr. Released under the MIT License.
   ' T: n, e2 X1 J: u# @
6. 
   
7. 
   0 p$ F! }, C# d9 D7 e+ [% m' q* b8 g
8. # Detect Debian users running the script with "sh" instead of bash
   1 e" c; n, t* c3 p& u
9. if readlink /proc/$$/exe | grep -q "dash"; then
   
10.         echo 'This installer needs to be run with "bash", not "sh".'
    8 p9 n6 z% L9 J/ _* t1 d
11.         exit
    - I" W* R2 O3 I0 K& N
12. fi
    
13. 
    
14. # Discard stdin. Needed when running from an one-liner which includes a newline
    2 |+ `2 b2 W8 T* C5 |9 w" T+ F  t
15. read -N 999999 -t 0.001
    
16. 
      m, I5 b) Y# `3 i: P. A
17. # Detect OpenVZ 6
    8 [: M! @0 i* N
18. if [[ $(uname -r | cut -d "." -f 1) -eq 2 ]]; then
    
19.         echo "The system is running an old kernel, which is incompatible with this installer."
    : [+ w' h# W' P# a( c8 {
20.         exit
    
21. fi
    
22. 
    ; @. [$ U# m" V" q8 y
23. # Detect OS
    5 H+ M, d" y) z( p
24. # $os_version variables aren't always in use, but are kept here for convenience
    $ b. g) @6 }: H2 w; y9 s9 L0 T' @
25. if grep -qs "ubuntu" /etc/os-release; then
    5 @) ]/ i5 a: L  d: u% ]) f+ L
26.         os="ubuntu"
    0 Y. L8 |4 Y7 q  U, s" b2 W
27.         os_version=$(grep 'VERSION_ID' /etc/os-release | cut -d '"' -f 2 | tr -d '.')
    6 @" m7 @# J- ]& y3 l
28.         group_name="nogroup"
    
29. elif [[ -e /etc/debian_version ]]; then
    
30.         os="debian"
    
31.         os_version=$(grep -oE '[0-9]+' /etc/debian_version | head -1)
    
32.         group_name="nogroup"
    
33. elif [[ -e /etc/almalinux-release || -e /etc/rocky-release || -e /etc/centos-release ]]; then
    
34.         os="centos"
    . J: t+ V4 }( F0 A# a- O! r: i
35.         os_version=$(grep -shoE '[0-9]+' /etc/almalinux-release /etc/rocky-release /etc/centos-release | head -1)
    
36.         group_name="nobody"
    8 @3 D# N; Z1 z7 f8 F7 e2 Q8 Z
37. elif [[ -e /etc/fedora-release ]]; then
    ) f7 |& {9 @  k/ ^) f2 \
38.         os="fedora"
    * p1 t4 J9 L( Q8 G
39.         os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)
    6 I1 c4 f, t9 _$ B- F. s
40.         group_name="nobody"
    
41. else
    2 [2 Q& Z4 p: p' V' h
42.         echo "This installer seems to be running on an unsupported distribution.
    
43. Supported distros are Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora."
    
44.         exit
    9 G. X3 m* o  A/ e
45. fi
    8 ?2 g$ `, z' I- [8 L
46. 
    
47. if [[ "$os" == "ubuntu" && "$os_version" -lt 1804 ]]; then
    % S. s/ D2 p2 V8 l
48.         echo "Ubuntu 18.04 or higher is required to use this installer.
    
49. This version of Ubuntu is too old and unsupported."
    
50.         exit
    : R( A) j  X) ]
51. fi
    
52. 
    ' j8 P  {# n! T* j5 R0 z
53. if [[ "$os" == "debian" && "$os_version" -lt 9 ]]; then
    8 i7 B& y# D( _# P: b* D
54.         echo "Debian 9 or higher is required to use this installer.
    
55. This version of Debian is too old and unsupported."
    7 U3 J8 f* ~, _1 k* u. J
56.         exit
    / k6 Z% _/ E7 |$ T+ O
57. fi
    
58. 
    ) F1 I4 m3 V0 F. I% ]( }
59. if [[ "$os" == "centos" && "$os_version" -lt 7 ]]; then
    ! o3 T$ Q& |) e% J9 K2 O+ R6 P5 m
60.         echo "CentOS 7 or higher is required to use this installer.
    
61. This version of CentOS is too old and unsupported."
    
62.         exit
    
63. fi
    
64. 
    ; u* ~* s; E1 S( M$ S0 q
65. # Detect environments where $PATH does not include the sbin directories
    ! w' U) _, s: n- m  q
66. if ! grep -q sbin <<< "$PATH"; then
    1 c. @- H5 m$ n+ H9 ]$ D) Y
67.         echo '$PATH does not include sbin. Try using "su -" instead of "su".'
    
68.         exit
    $ T& l/ x/ U  u1 A, G( N
69. fi
    9 k( t+ y- o# S2 L
70. 
    
71. if [[ "$EUID" -ne 0 ]]; then
    
72.         echo "This installer needs to be run with superuser privileges."
    
73.         exit
    
74. fi
    
75. 
      E/ ^. F4 U! D  d. X
76. if [[ ! -e /dev/net/tun ]] || ! ( exec 7<>/dev/net/tun ) 2>/dev/null; then
    
77.         echo "The system does not have the TUN device available.
    
78. TUN needs to be enabled before running this installer."
    , V6 B( I  o! f9 `; J8 u- R; O
79.         exit
    
80. fi
    / n2 h8 k6 A7 ~% y" r1 V
81. 
    ' _* S% U$ R' J- ]6 S% |% b
82. new_client () {
    
83.         # Generates the custom client.ovpn
    ( e$ N) s9 r2 u
84.         {
    . H) f" a# T$ }6 @# W( [1 x
85.         cat /etc/openvpn/server/client-common.txt
    . |, u; [( G: c; c
86.         echo "<ca>"
    
87.         cat /etc/openvpn/server/easy-rsa/pki/ca.crt
    
88.         echo "</ca>"
    : O6 [# A# M8 J
89.         echo "<cert>"
    
90.         sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt
    # A$ [# d% \; K" q. `6 A+ ]
91.         echo "</cert>"
    
92.         echo "<key>"
    : k! w& N! T: _' U$ m. U+ C
93.         cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key
    
94.         echo "</key>"
    # O5 U/ {2 p7 z) |# i
95.         echo "<tls-crypt>"
    ( q" a% l8 K. _9 @2 `
96.         sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
    4 D" ?) Q, @7 k9 ?3 Q
97.         echo "</tls-crypt>"
    6 B  _8 t" [- t$ M
98.         } > ~/"$client".ovpn
    7 X- d7 f- v" T# R5 Q
99. }
    
100. 
     3 V9 o9 q& D4 M1 m
101. if [[ ! -e /etc/openvpn/server/server.conf ]]; then
     1 q& M: Z  y0 i# `* r
102.         # Detect some Debian minimal setups where neither wget nor curl are installed
     
103.         if ! hash wget 2>/dev/null && ! hash curl 2>/dev/null; then
     " K) `, I0 N/ |/ K) |! F
104.                 echo "Wget is required to use this installer."
     * l$ J* a( z' k1 x6 }7 e" k
105.                 read -n1 -r -p "Press any key to install Wget and continue..."
     ) Q( [& m2 Z+ u( p9 l
106.                 apt-get update
     
107.                 apt-get install -y wget
     ' I+ C% t  V8 Z9 Y
108.         fi
     / n1 ?" @6 s; n# M8 v; p
109.         clear
     ( p, ]+ C& v( h; F
110.         echo 'Welcome to this OpenVPN road warrior installer!'
     - A( G; r4 T. v
111.         # If system has a single IPv4, it is selected automatically. Else, ask the user
     * O7 Y6 l; v+ P' Z0 F9 h. W
112.         if [[ $(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}') -eq 1 ]]; then
     ( K" B% J% K! F( C  Y, z
113.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}')
     
114.         else
       x& m4 y3 ^. ]6 `" ^2 m/ Y' x
115.                 number_of_ip=$(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}')
     
116.                 echo
     ; U; D$ k) s* ?8 F
117.                 echo "Which IPv4 address should be used?"
     
118.                 ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | nl -s ') '
     
119.                 read -p "IPv4 address [1]: " ip_number
     % C# i) f" G' _5 l3 i+ ^
120.                 until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ip" ]]; do
     7 ~$ }. d6 s7 F; _
121.                         echo "$ip_number: invalid selection."
     
122.                         read -p "IPv4 address [1]: " ip_number
     
123.                 done
     $ x" E$ y4 g3 g2 m1 `
124.                 [[ -z "$ip_number" ]] && ip_number="1"
     
125.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sed -n "$ip_number"p)
     / X( P% Y$ f4 Z9 k* ]
126.         fi
     
127.         # If $ip is a private IP address, the server must be behind NAT
     # Q9 U  m! m. q9 W/ `" k
128.         if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
     - k' f/ x1 T( g: N. l5 y8 ?  o$ g
129.                 echo
       [$ `2 z, E, a9 m* }+ p$ j6 v
130.                 echo "This server is behind NAT. What is the public IPv4 address or hostname?"
     9 q: M$ w# x! O  Q6 {
131.                 # Get public IP and sanitize with grep
     , `. Y; b0 u7 \9 a( h9 n2 c, X6 T/ Y
132.                 get_public_ip=$(grep -m 1 -oE '^[0-9]{1,3}(\.[0-9]{1,3}){3}$' <<< "$(wget -T 10 -t 1 -4qO- "http://ip1.dynupdate.no-ip.com/" || curl -m 10 -4Ls "http://ip1.dynupdate.no-ip.com/")")
     & }! }& E. e! k6 ~" s* |2 R
133.                 read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip
     
134.                 # If the checkip service is unavailable and user didn't provide input, ask again
     / @; c9 H7 }6 M. {! i7 d
135.                 until [[ -n "$get_public_ip" || -n "$public_ip" ]]; do
     7 n7 w$ c( U/ _( R8 m$ A) V3 x
136.                         echo "Invalid input."
     
137.                         read -p "Public IPv4 address / hostname: " public_ip
     9 r$ Y/ H; j- Y
138.                 done
     + J5 Q$ X3 |* g8 }/ `* b) ]
139.                 [[ -z "$public_ip" ]] && public_ip="$get_public_ip"
     
140.         fi
     5 g2 v- U( N" `$ k
141.         # If system has a single IPv6, it is selected automatically
     
142.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -eq 1 ]]; then
     
143.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}')
     
144.         fi
     
145.         # If system has multiple IPv6, ask the user to select one
     & t. \$ A# k' V2 v
146.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -gt 1 ]]; then
     8 j0 E* [# f4 B+ O2 C
147.                 number_of_ip6=$(ip -6 addr | grep -c 'inet6 [23]')
     
148.                 echo
     8 F. `* X8 F* z' [& [
149.                 echo "Which IPv6 address should be used?"
     
150.                 ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | nl -s ') '
     ' l5 {* d& F, o+ C6 V! ~# i
151.                 read -p "IPv6 address [1]: " ip6_number
     
152.                 until [[ -z "$ip6_number" || "$ip6_number" =~ ^[0-9]+$ && "$ip6_number" -le "$number_of_ip6" ]]; do
     ; Y3 w( G( y* C6 M3 i  o
153.                         echo "$ip6_number: invalid selection."
     
154.                         read -p "IPv6 address [1]: " ip6_number
     
155.                 done
     # ]4 ?4 l# f6 u# L
156.                 [[ -z "$ip6_number" ]] && ip6_number="1"
     
157.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | sed -n "$ip6_number"p)
     
158.         fi
     
159.         echo
     
160.         echo "Which protocol should OpenVPN use?"
     7 R/ F) H( {. A; M& @  z( e7 a
161.         echo "   1) UDP (recommended)"
     6 t, A  `; _! I3 E( z5 N% e
162.         echo "   2) TCP"
     
163.         read -p "Protocol [1]: " protocol
     
164.         until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
     * M6 j* _" X1 O% g
165.                 echo "$protocol: invalid selection."
       s( ^/ q3 o8 Y: m
166.                 read -p "Protocol [1]: " protocol
     
167.         done
     
168.         case "$protocol" in
     4 s4 J/ j8 k7 s  Y& d0 e
169.                 1|"")
     
170.                 protocol=udp
     
171.                 ;;
     
172.                 2)
     , X6 t, A, x/ o/ W9 L7 V  j
173.                 protocol=tcp
     4 P/ X% f( b, w9 m: f/ m2 e
174.                 ;;
     % C" o- N2 ~0 u) r, y
175.         esac
     5 p) Q+ [' p( J  }  s+ g
176.         echo
     % u  S0 m6 W8 d, t2 O3 E- i
177.         echo "What port should OpenVPN listen to?"
     7 A8 R5 R$ Y7 E& k
178.         read -p "Port [1194]: " port
     ; B2 [2 n. Q& A  j9 o2 @
179.         until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do
     
180.                 echo "$port: invalid port."
     
181.                 read -p "Port [1194]: " port
     9 n' e2 X1 u' m+ U1 @# r2 S
182.         done
     % f4 b. v8 {: ?' k8 h# ~! a, [
183.         [[ -z "$port" ]] && port="1194"
     . O( B& t) P& R* ]+ y. w
184.         echo
     " S5 t% D, P! D* P' o
185.         echo "Select a DNS server for the clients:"
     " v+ O, l' r& c5 x# m3 ]# A* J
186.         echo "   1) Current system resolvers"
     
187.         echo "   2) Google"
     4 [! L, Z! `& n! }# `0 |
188.         echo "   3) 1.1.1.1"
     
189.         echo "   4) OpenDNS"
     
190.         echo "   5) Quad9"
     
191.         echo "   6) AdGuard"
     
192.         read -p "DNS server [1]: " dns
       t! ^$ M/ U0 j, E
193.         until [[ -z "$dns" || "$dns" =~ ^[1-6]$ ]]; do
     
194.                 echo "$dns: invalid selection."
     
195.                 read -p "DNS server [1]: " dns
     7 n% d+ E* k4 ~. Q' H  G
196.         done
     9 V) }$ ]) X. G  v' Q
197.         echo
     & v$ B8 i0 f* ?: g$ N  Q
198.         echo "Enter a name for the first client:"
     0 `9 ?0 r, ]  Q, {( g
199.         read -p "Name [client]: " unsanitized_client
     ! k- e" p, k* ~5 F& j9 R0 g
200.         # Allow a limited set of characters to avoid conflicts
     $ ~3 H8 H* x5 S" ~8 E
201.         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     ! W% p# x: b2 u& s
202.         [[ -z "$client" ]] && client="client"
     
203.         echo
     
204.         echo "OpenVPN installation is ready to begin."
     
205.         # Install a firewall if firewalld or iptables are not already available
     
206.         if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then
     
207.                 if [[ "$os" == "centos" || "$os" == "fedora" ]]; then
     
208.                         firewall="firewalld"
     % G! ?. u1 |- L
209.                         # We don't want to silently enable firewalld, so we give a subtle warning
     
210.                         # If the user continues, firewalld will be installed and enabled during setup
     
211.                         echo "firewalld, which is required to manage routing tables, will also be installed."
     ! x% M# A7 n0 W  m) H5 @4 \
212.                 elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then
     - R% t5 V- X# C! b
213.                         # iptables is way less invasive than firewalld so no warning is given
     
214.                         firewall="iptables"
     2 @% a, R  r" n/ |( B4 J6 P& x
215.                 fi
     : b, _- y' k. j; }
216.         fi
     3 [* t4 m. M3 ?1 V4 E' u" c# e
217.         read -n1 -r -p "Press any key to continue..."
     
218.         # If running inside a container, disable LimitNPROC to prevent conflicts
     - W* f2 L; M7 b( a" Q8 a5 k2 U2 \
219.         if systemd-detect-virt -cq; then
     6 r; {+ A% r( I# x$ T1 Y7 p# N: S( X
220.                 mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null
     
221.                 echo "[Service]
     - n+ I1 o  U* x: L1 X
222. LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     
223.         fi
     - }5 i6 g8 g: x1 N) A3 M
224.         if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     ; C) c$ A  z' G* |' J  m# w* G
225.                 apt-get update
     ' ]& ?: c2 B+ q+ J* z; t
226.                 apt-get install -y openvpn openssl ca-certificates $firewall
     
227.         elif [[ "$os" = "centos" ]]; then
     
228.                 yum install -y epel-release
     
229.                 yum install -y openvpn openssl ca-certificates tar $firewall
     
230.         else
     + J+ n3 g, g: z
231.                 # Else, OS must be Fedora
     ' E+ \# |* J0 D
232.                 dnf install -y openvpn openssl ca-certificates tar $firewall
     
233.         fi
     
234.         # If firewalld was just installed, enable it
       s+ W9 ^" E8 @( }) k: R8 Q
235.         if [[ "$firewall" == "firewalld" ]]; then
     : b; X( s/ t0 l9 u, [2 A
236.                 systemctl enable --now firewalld.service
     
237.         fi
     
238.         # Get easy-rsa
     0 n0 x3 m4 K* E( @+ J# f& G& Z
239.         easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.0/EasyRSA-3.1.0.tgz'
     
240.         mkdir -p /etc/openvpn/server/easy-rsa/
     
241.         { wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1
     + V/ N; W) F- h8 D
242.         chown -R root:root /etc/openvpn/server/easy-rsa/
     
243.         cd /etc/openvpn/server/easy-rsa/
     8 c& E+ }9 d! j4 C# S5 s
244.         # Create the PKI, set up the CA and the server and client certificates
     7 V% X, X9 o- }/ ?* u6 Q  I4 z0 E
245.         ./easyrsa init-pki
     
246.         ./easyrsa --batch build-ca nopass
     , @0 Z  m* w# m- Z$ m9 w( w7 N
247.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass
     
248.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     
249.         EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     0 `+ Q9 O& @& j+ @" o0 X/ j# F
250.         # Move the stuff we need
     % K/ @" Y# N# k5 h) x/ K. Q
251.         cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
     
252.         # CRL is read with each client connection, while OpenVPN is dropped to nobody
     
253.         chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     , L/ \5 O0 c4 ~2 E, z6 Z: K+ \
254.         # Without +x in the directory, OpenVPN can't run a stat() on the CRL file
     3 i' a) R; X) I( G5 [& t
255.         chmod o+x /etc/openvpn/server/
     : ]" _% _  h" p
256.         # Generate key for tls-crypt
     
257.         openvpn --genkey --secret /etc/openvpn/server/tc.key
     6 `: w8 s. e# ~3 m$ R, [
258.         # Create the DH parameters file using the predefined ffdhe2048 group
     # c! _) W- c+ e! i0 W5 m7 V2 C
259.         echo '-----BEGIN DH PARAMETERS-----
     
260. MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
     ( L+ Z" E: _# b
261. +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
     
262. 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
     
263. YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
     ; i2 k: N. x$ `9 E! c6 g! i5 b
264. 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
     8 j9 i& g: n* \  a1 r
265. ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
     
266. -----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem
     9 t; q+ ?  A, @/ a
267.         # Generate server.conf
     ; d5 K4 n8 r$ [% H# X
268.         echo "local $ip
     
269. port $port
     
270. proto $protocol
     9 Y4 ]6 g' d" t2 w
271. dev tun
     - S( ^4 Z6 Y7 e) i
272. ca ca.crt
     # a% i! {( t+ Y
273. cert server.crt
     
274. key server.key
     
275. dh dh.pem
     ! X0 T/ r. L/ H# |6 z2 [! z+ j+ |" R
276. auth SHA512
     
277. tls-crypt tc.key
     
278. topology subnet
     3 B3 ?! Y0 {& y- `" m
279. server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf
     * W+ T8 u7 q$ U2 ?& @$ g5 s
280.         # IPv6
     
281.         if [[ -z "$ip6" ]]; then
     
282.                 echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
       N6 D" ^6 L; }0 v1 a
283.         else
     9 p  U! a4 ~3 {! }$ k0 ^
284.                 echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf
     
285.                 echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     
286.         fi
     
287.         echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf
     
288.         # DNS
     : o, K* |' n  w) I# g1 C6 i
289.         case "$dns" in
     
290.                 1|"")
     
291.                         # Locate the proper resolv.conf
     ; [- X, t" Z' z! `: u8 ?! V* k
292.                         # Needed for systems running systemd-resolved
     
293.                         if grep -q '^nameserver 127.0.0.53' "/etc/resolv.conf"; then
     
294.                                 resolv_conf="/run/systemd/resolve/resolv.conf"
     
295.                         else
     ) ^3 Q( W0 q; m( ]0 J( D2 o- z5 F
296.                                 resolv_conf="/etc/resolv.conf"
     
297.                         fi
     
298.                         # Obtain the resolvers from resolv.conf and use them for OpenVPN
     ! M" }" ]; B3 Z8 K" s7 y& |6 b9 [) u
299.                         grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do
     
300.                                 echo "push "dhcp-option DNS $line"" >> /etc/openvpn/server/server.conf
     
301.                         done
     % [: Y1 O% t; v  d' }) `* s
302.                 ;;
     
303.                 2)
     
304.                         echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf
     
305.                         echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf
     
306.                 ;;
     - b% _  x: Q) k6 v" Z7 j
307.                 3)
     % F0 _3 Z, q5 X6 a1 S
308.                         echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf
     
309.                         echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf
     
310.                 ;;
     
311.                 4)
     ! g- u& D+ R' p! A* d, D
312.                         echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf
     
313.                         echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf
     
314.                 ;;
     # p' [$ s" x7 }7 @
315.                 5)
     
316.                         echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf
     + v: s; B# P1 C" l
317.                         echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf
     
318.                 ;;
     
319.                 6)
     
320.                         echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf
     5 ]+ Z' k# I& `! u) N
321.                         echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf
     0 k: h4 P4 P: p8 ~
322.                 ;;
     
323.         esac
     
324.         echo "keepalive 10 120
     
325. cipher AES-256-CBC
     1 n5 O2 c; x  ^# U
326. user nobody
     ' [& X: r" Z0 a/ G* u" B
327. group $group_name
     
328. persist-key
     3 ]! a; |) F6 y7 }% Y
329. persist-tun
     8 x  @" K) e* I1 v3 }8 w" K+ ?% G7 H
330. verb 3
     
331. crl-verify crl.pem" >> /etc/openvpn/server/server.conf
     
332.         if [[ "$protocol" = "udp" ]]; then
     
333.                 echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf
     * L2 z5 }0 d/ l. h* C5 @. z
334.         fi
     8 L9 L5 ], W1 L' }* i( }  p8 v# _0 q
335.         # Enable net.ipv4.ip_forward for the system
     3 G/ F# g( L7 K2 c) q
336.         echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-openvpn-forward.conf
     
337.         # Enable without waiting for a reboot or service restart
     
338.         echo 1 > /proc/sys/net/ipv4/ip_forward
     
339.         if [[ -n "$ip6" ]]; then
     % o6 a# r& }9 g- H
340.                 # Enable net.ipv6.conf.all.forwarding for the system
     
341.                 echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/99-openvpn-forward.conf
     
342.                 # Enable without waiting for a reboot or service restart
     
343.                 echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
     
344.         fi
     
345.         if systemctl is-active --quiet firewalld.service; then
     
346.                 # Using both permanent and not permanent rules to avoid a firewalld
     ) X* t! ^  o# d! y( E+ _. f
347.                 # reload.
     
348.                 # We don't use --add-service=openvpn because that would only work with
     
349.                 # the default port and protocol.
     
350.                 firewall-cmd --add-port="$port"/"$protocol"
     $ I* g4 P  k( h! r3 C0 {7 L0 D% o
351.                 firewall-cmd --zone=trusted --add-source=10.8.0.0/24
     
352.                 firewall-cmd --permanent --add-port="$port"/"$protocol"
     
353.                 firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
     ( P& j( s9 v) w+ t8 k8 r9 z
354.                 # Set NAT for the VPN subnet
     2 @; {8 q( N& g6 z3 T
355.                 firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
356.                 firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
357.                 if [[ -n "$ip6" ]]; then
     1 B2 E& U, e' B' D' U; m
358.                         firewall-cmd --zone=trusted --add-source=fddd:1194:1194:1194::/64
     
359.                         firewall-cmd --permanent --zone=trusted --add-source=fddd:1194:1194:1194::/64
     
360.                         firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
361.                         firewall-cmd --permanent --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
362.                 fi
     & w8 N/ I! E# O  }5 F( N/ `
363.         else
     
364.                 # Create a service to set up persistent iptables rules
     
365.                 iptables_path=$(command -v iptables)
     
366.                 ip6tables_path=$(command -v ip6tables)
     
367.                 # nf_tables is not available as standard in OVZ kernels. So use iptables-legacy
     
368.                 # if we are in OVZ, with a nf_tables backend and iptables-legacy is available.
     
369.                 if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then
     
370.                         iptables_path=$(command -v iptables-legacy)
     $ w& A. ~5 |9 {5 p' @; |) S" T! F
371.                         ip6tables_path=$(command -v ip6tables-legacy)
     * `: _6 ?% Q* `9 w* z' Q) @+ X7 _
372.                 fi
     
373.                 echo "[Unit]
     3 Z: @4 u# n( p+ K7 V4 d. H, C
374. Before=network.target
     : }  A6 T- d3 |) ]* s: _
375. [Service]
     
376. Type=oneshot
     / N$ {: ]. k9 a6 l5 o
377. ExecStart=$iptables_path -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     
378. ExecStart=$iptables_path -I INPUT -p $protocol --dport $port -j ACCEPT
     
379. ExecStart=$iptables_path -I FORWARD -s 10.8.0.0/24 -j ACCEPT
     ! v& p2 F) d& d
380. ExecStart=$iptables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     
381. ExecStop=$iptables_path -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     
382. ExecStop=$iptables_path -D INPUT -p $protocol --dport $port -j ACCEPT
     
383. ExecStop=$iptables_path -D FORWARD -s 10.8.0.0/24 -j ACCEPT
     
384. ExecStop=$iptables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > /etc/systemd/system/openvpn-iptables.service
     
385.                 if [[ -n "$ip6" ]]; then
     0 h( E" w3 s/ w8 ~* e
386.                         echo "ExecStart=$ip6tables_path -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     7 z. E2 _' j$ V, {' }+ j  m
387. ExecStart=$ip6tables_path -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     
388. ExecStart=$ip6tables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     
389. ExecStop=$ip6tables_path -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     
390. ExecStop=$ip6tables_path -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     
391. ExecStop=$ip6tables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> /etc/systemd/system/openvpn-iptables.service
     
392.                 fi
     # G1 C1 n1 y3 q' h0 ^4 R- l* s. p
393.                 echo "RemainAfterExit=yes
     4 d6 `- w6 z  {5 `0 I# {! e1 [
394. [Install]
     
395. WantedBy=multi-user.target" >> /etc/systemd/system/openvpn-iptables.service
     
396.                 systemctl enable --now openvpn-iptables.service
     
397.         fi
     
398.         # If SELinux is enabled and a custom port was selected, we need this
     
399.         if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     1 t/ k6 R' d* E; D; \# F( k
400.                 # Install semanage if not already present
     ; p' K1 L0 y4 ]2 T
401.                 if ! hash semanage 2>/dev/null; then
     , w. a4 {, ^2 ?4 O5 K# F/ ^
402.                         if [[ "$os_version" -eq 7 ]]; then
     8 e* }7 ~- N9 @+ [/ Q  ?
403.                                 # Centos 7
     
404.                                 yum install -y policycoreutils-python
     0 D* ?  X) g. u
405.                         else
     
406.                                 # CentOS 8 or Fedora
     $ W; m; N7 q/ I* ]; H& U! H
407.                                 dnf install -y policycoreutils-python-utils
     3 S! I7 K! O0 \9 q. N4 f
408.                         fi
     
409.                 fi
     ! C2 u+ ~! }! }/ R+ X" a
410.                 semanage port -a -t openvpn_port_t -p "$protocol" "$port"
     8 K2 ?1 W: C6 ?8 k( j  V1 W
411.         fi
     - R+ d, E3 f! a9 ^/ J+ D- n
412.         # If the server is behind NAT, use the correct IP address
     : ?6 p+ i$ r; k9 L: J/ T
413.         [[ -n "$public_ip" ]] && ip="$public_ip"
     3 Z; Q; B- r$ Z1 }' x1 M
414.         # client-common.txt is created so we have a template to add further users later
     
415.         echo "client
     
416. dev tun
     . g$ m5 J2 o+ B- ~, }4 N+ U- X8 d
417. proto $protocol
     
418. remote $ip $port
     
419. resolv-retry infinite
     5 h2 J9 F9 ~  Z
420. nobind
     0 q% r# ^+ Y3 u% z+ u) X9 a
421. persist-key
     
422. persist-tun
     
423. remote-cert-tls server
     ; e% t9 [* `' g  ^% r. w5 \
424. auth SHA512
     
425. cipher AES-256-CBC
     
426. ignore-unknown-option block-outside-dns
     ; E' D2 i9 t! Z6 X! `! I
427. block-outside-dns
     
428. verb 3" > /etc/openvpn/server/client-common.txt
     ) x: `  R9 D5 v& [0 |
429.         # Enable and start the OpenVPN service
     - K) R) N6 X' g+ J# }4 S! x
430.         systemctl enable --now openvpn-server@server.service
     9 h5 F  U7 ?$ d" f( U+ I: Z
431.         # Generates the custom client.ovpn
     ; x; C6 E" z8 x$ X
432.         new_client
     
433.         echo
     ( H4 ~1 S& W. \8 o$ \
434.         echo "Finished!"
     
435.         echo
     
436.         echo "The client configuration is available in:" ~/"$client.ovpn"
     7 w, A# n0 D1 d: n, t4 }
437.         echo "New clients can be added by running this script again."
     % K$ c- B: m6 D
438. else
     
439.         clear
     9 x6 R2 \* N2 h; _/ F
440.         echo "OpenVPN is already installed."
     + g" W; O0 M) U: h" B
441.         echo
     
442.         echo "Select an option:"
     
443.         echo "   1) Add a new client"
     
444.         echo "   2) Revoke an existing client"
     3 q1 Z0 t8 H; s* s
445.         echo "   3) Remove OpenVPN"
     
446.         echo "   4) Exit"
     
447.         read -p "Option: " option
     
448.         until [[ "$option" =~ ^[1-4]$ ]]; do
     " |5 `$ k. ?) e, d6 `1 k
449.                 echo "$option: invalid selection."
     & G: X1 D% e5 Q# g# O0 b
450.                 read -p "Option: " option
     
451.         done
     
452.         case "$option" in
     . y, G- b. E5 o# Q% u$ Y: J3 F! o8 E
453.                 1)
     
454.                         echo
     
455.                         echo "Provide a name for the client:"
     % g8 y* J) y' S0 B$ Q: c& [
456.                         read -p "Name: " unsanitized_client
     
457.                         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     & s6 [1 k1 k3 p4 C" ^5 H: p
458.                         while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
     
459.                                 echo "$client: invalid name."
     
460.                                 read -p "Name: " unsanitized_client
     
461.                                 client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     ; `% R+ S- N+ N2 @  {5 M
462.                         done
     2 G' Z8 G7 k, f( [
463.                         cd /etc/openvpn/server/easy-rsa/
     ; H4 i5 F: G( `) [% W
464.                         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     
465.                         # Generates the custom client.ovpn
     , k  r+ c. x- Q4 T
466.                         new_client
     7 r4 \2 ^2 b, t2 v! |& n8 P
467.                         echo
     $ k6 d) ?) F4 S3 G2 p( V1 y
468.                         echo "$client added. Configuration available in:" ~/"$client.ovpn"
     ' s  b# a" M4 q. Q# \# ?) s/ f
469.                         exit
     1 i0 w; u# c/ B" X: Y: |
470.                 ;;
     8 B/ F9 w: [7 C1 d5 o) S
471.                 2)
     
472.                         # This option could be documented a bit better and maybe even be simplified
     
473.                         # ...but what can I say, I want some sleep too
     ! r; [" U3 o5 E( h2 b/ m' z1 h8 W
474.                         number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
     & p2 B1 K) R/ i3 U% a
475.                         if [[ "$number_of_clients" = 0 ]]; then
     
476.                                 echo
     
477.                                 echo "There are no existing clients!"
     
478.                                 exit
     
479.                         fi
     
480.                         echo
     . L, D( b4 r3 j5 J$ `% a$ N
481.                         echo "Select the client to revoke:"
     
482.                         tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
     * \" r3 E6 j/ l" |$ Z2 o6 M
483.                         read -p "Client: " client_number
     3 T4 `) I  i2 y$ A1 z) d& l. w5 V
484.                         until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
     
485.                                 echo "$client_number: invalid selection."
     
486.                                 read -p "Client: " client_number
     / I+ P" @+ P0 o: ^- q+ d
487.                         done
     * j5 |; `+ S; q* `& P, M: W1 i3 m
488.                         client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
     
489.                         echo
     
490.                         read -p "Confirm $client revocation? [y/N]: " revoke
     : C+ L2 z  F: n' H1 Q' j# }( L
491.                         until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
     $ l5 z) H% r! R. q( N2 W
492.                                 echo "$revoke: invalid selection."
     
493.                                 read -p "Confirm $client revocation? [y/N]: " revoke
     
494.                         done
     . V% Q% Z# {5 ?2 }; V# S0 U0 V3 O
495.                         if [[ "$revoke" =~ ^[yY]$ ]]; then
     
496.                                 cd /etc/openvpn/server/easy-rsa/
     ' ~1 h! P" Y, s! L" P
497.                                 ./easyrsa --batch revoke "$client"
     0 L( M8 H# @) @
498.                                 EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     
499.                                 rm -f /etc/openvpn/server/crl.pem
     , ]7 A- w" O# I7 W9 Z. O  |9 e5 H/ e
500.                                 cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
     . |  n2 J7 C% m6 A1 g+ b% |! Y# C! [
501.                                 # CRL is read with each client connection, when OpenVPN is dropped to nobody
     
502.                                 chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     . S! W, V$ g$ X% u7 j
503.                                 echo
     1 M2 C/ I- O9 \* K  R
504.                                 echo "$client revoked!"
     
505.                         else
     
506.                                 echo
     1 W# P+ d7 J& b+ z) H$ ^5 B
507.                                 echo "$client revocation aborted!"
     ) y6 L& [3 ^! h
508.                         fi
     0 s% ?5 t8 l- r5 ~
509.                         exit
     ! S! q6 k) M$ w) {
510.                 ;;
     ! p# c0 J+ C! {0 n# [* c
511.                 3)
     # f  N& W' ~# B
512.                         echo
     
513.                         read -p "Confirm OpenVPN removal? [y/N]: " remove
     : Z/ i, J' ?' [6 S4 p
514.                         until [[ "$remove" =~ ^[yYnN]*$ ]]; do
     * m/ y$ q" F- w4 b
515.                                 echo "$remove: invalid selection."
     
516.                                 read -p "Confirm OpenVPN removal? [y/N]: " remove
     $ ], f1 Q% i, w; r5 K: x. L
517.                         done
     
518.                         if [[ "$remove" =~ ^[yY]$ ]]; then
     
519.                                 port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     ; \) m) X. B: e7 ]9 }5 v* n5 J$ N
520.                                 protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     5 ]( p  G+ \+ T
521.                                 if systemctl is-active --quiet firewalld.service; then
     ( @$ P. w! O4 j( L
522.                                         ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
     
523.                                         # Using both permanent and not permanent rules to avoid a firewalld reload.
     
524.                                         firewall-cmd --remove-port="$port"/"$protocol"
     
525.                                         firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
     ' y) P5 m$ u  T5 B0 [
526.                                         firewall-cmd --permanent --remove-port="$port"/"$protocol"
     8 e/ I6 Y1 R; F6 C1 H5 v' F
527.                                         firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
     
528.                                         firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     ! B: i  ]% \2 S7 J  p
529.                                         firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
530.                                         if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
     6 @. p2 B1 [7 d5 Q' M0 s5 y0 D
531.                                                 ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
     
532.                                                 firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     
533.                                                 firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     
534.                                                 firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
535.                                                 firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
       R5 u: q1 ?, S' m/ c
536.                                         fi
     " k) T+ w/ p. q: o) Q
537.                                 else
     
538.                                         systemctl disable --now openvpn-iptables.service
     
539.                                         rm -f /etc/systemd/system/openvpn-iptables.service
     
540.                                 fi
     8 r9 M6 ]- Z0 X
541.                                 if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     ) e2 u+ T; i7 c8 |
542.                                         semanage port -d -t openvpn_port_t -p "$protocol" "$port"
     , p8 H' k$ d" _9 I
543.                                 fi
     
544.                                 systemctl disable --now openvpn-server@server.service
     
545.                                 rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     
546.                                 rm -f /etc/sysctl.d/99-openvpn-forward.conf
     
547.                                 if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     
548.                                         rm -rf /etc/openvpn/server
     , d/ u5 q/ q4 J9 ^3 j
549.                                         apt-get remove --purge -y openvpn
     
550.                                 else
     
551.                                         # Else, OS must be CentOS or Fedora
     , M) n# o1 e! N
552.                                         yum remove -y openvpn
     1 V. u3 i6 j( ~1 z
553.                                         rm -rf /etc/openvpn/server
     + ^" }6 P) y! p
554.                                 fi
     & ]$ h. T/ \# o& z. g2 g
555.                                 echo
     
556.                                 echo "OpenVPN removed!"
     5 c! S. X0 S9 b6 r8 m' P
557.                         else
     0 f8 Z5 E, I9 Q
558.                                 echo
     
559.                                 echo "OpenVPN removal aborted!"
     
560.                         fi
     
561.                         exit
     
562.                 ;;
     0 \% x8 T  s% Y. I
563.                 4)
     5 X8 B5 o& R0 b3 V( P4 q# V
564.                         exit
     $ t( p+ i9 q& Z! T
565.                 ;;
     
566.         esac
     
567. fi
     5 ]- z% T1 @$ H# l) X

复制代码

; `* b/ Z. `4 a