设为首页收藏本站
切换到窄版

 找回密码
 立即注册
搜索
xyh-moon»论坛 › xyh-moon › 技术板块 › shadowsocks-all.sh
返回列表 发新帖
查看: 351|回复: 0

shadowsocks-all.sh

[复制链接]
fudyou

991

主题

92

回帖

5万

积分

管理员

积分
55457
发表于 2022-6-22 15:40:40 | 显示全部楼层 |阅读模式

( M1 i& G: _5 r/ b
  1. #!/bin/bash$ Z$ w$ n0 B8 l3 X9 E, u! H' ]- u, N; w
  2. #
    ! ^9 Y, r5 w0 ?: K2 U. g
  3. # https://github.com/Nyr/openvpn-install7 T/ w( k  m7 a; \+ T$ M; n
  4. #
    : \4 B; k9 v0 B  i; w
  5. # Copyright (c) 2013 Nyr. Released under the MIT License.
    4 B( f. K$ @2 }; n7 I
  6. * g: I! d/ D4 F# c" J! }% l
  7. $ {) A8 a  X+ m
  8. # Detect Debian users running the script with "sh" instead of bash
    - Z& l# |8 u+ D
  9. if readlink /proc/$$/exe | grep -q "dash"; then
    1 F7 h3 K6 ]$ D7 E/ y% z- }
  10.         echo 'This installer needs to be run with "bash", not "sh".'
    - S9 z, [) l" l( w( ~* o
  11.         exit
    - P# L$ B3 M8 t3 ]+ C6 ^
  12. fi
    1 u1 T# h. B7 ~6 ]( w* }3 C

  13. & E% A; Y+ q. B; d2 I. I, b$ D7 y, b
  14. # Discard stdin. Needed when running from an one-liner which includes a newline
    + Q# f$ E* Y4 p* U
  15. read -N 999999 -t 0.001/ {" q5 Q( W* d! C

  16. " t/ ^+ l" j9 P& g
  17. # Detect OpenVZ 60 z6 B8 Q9 X4 t7 `
  18. if [[ $(uname -r | cut -d "." -f 1) -eq 2 ]]; then. C0 v8 u! h5 c8 |. V8 p6 d
  19.         echo "The system is running an old kernel, which is incompatible with this installer."/ X; H4 W3 Z4 B% B& C
  20.         exit
    2 z; o  W) F& x3 f
  21. fi
    ! p8 [; k% m) F
  22. ! W& \, @% z0 o1 r& A8 {
  23. # Detect OS
    ! h6 m" c/ u0 d9 ]$ s4 D
  24. # $os_version variables aren't always in use, but are kept here for convenience+ w8 M1 a0 ]% l( L( u- z3 g4 u$ R. D
  25. if grep -qs "ubuntu" /etc/os-release; then4 t$ W4 n4 }3 S5 l2 U8 z( G9 J; ?
  26.         os="ubuntu"
    + p, f/ [# s, G
  27.         os_version=$(grep 'VERSION_ID' /etc/os-release | cut -d '"' -f 2 | tr -d '.')! U' o, g% r0 t, e0 v( }
  28.         group_name="nogroup"  E% m! Y- L; i4 G8 x/ N  w
  29. elif [[ -e /etc/debian_version ]]; then
    ' ^' J* c5 V7 D# p6 S. x
  30.         os="debian"
    6 d8 o, x2 L+ B9 V, p7 F; e
  31.         os_version=$(grep -oE '[0-9]+' /etc/debian_version | head -1), R& s9 w8 S' T4 j1 _6 C8 Q5 P
  32.         group_name="nogroup"4 d) W) ]' a: k+ j- u( R
  33. elif [[ -e /etc/almalinux-release || -e /etc/rocky-release || -e /etc/centos-release ]]; then: }2 H& r0 p2 p6 ]
  34.         os="centos"" C9 \& c. S  v
  35.         os_version=$(grep -shoE '[0-9]+' /etc/almalinux-release /etc/rocky-release /etc/centos-release | head -1)
    " K2 p/ h$ D. A: e. }8 C! Q
  36.         group_name="nobody"9 f" }0 w: f% T, g9 t  Q) _5 e! ~$ x# \
  37. elif [[ -e /etc/fedora-release ]]; then9 C5 E# \! e! V
  38.         os="fedora"
    2 J1 x; E& Q: s* c/ F
  39.         os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)# O3 H3 g( N$ R3 J
  40.         group_name="nobody"6 c3 \4 Y) G' j- i  m1 b8 U
  41. else
    * c5 L- }5 Q1 L! t6 E; t3 n6 Q
  42.         echo "This installer seems to be running on an unsupported distribution.- F* N. r! |. n" P1 G5 d2 a
  43. Supported distros are Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora."+ l0 v% _. I1 d. h0 g
  44.         exit
    5 z& d0 g+ l4 J
  45. fi" ?2 A) }) H: Y* A: l& @: t
  46. 4 F" l' M; D3 ]( ^1 S# k3 P" S
  47. if [[ "$os" == "ubuntu" && "$os_version" -lt 1804 ]]; then
    / P+ G, J1 k* P- s9 {0 E
  48.         echo "Ubuntu 18.04 or higher is required to use this installer.' e; {/ Z/ X- {5 u7 u: ^
  49. This version of Ubuntu is too old and unsupported."8 o9 y. J* }+ R
  50.         exit
    # j3 g5 y4 M; A# P+ C7 e4 ~4 }" [
  51. fi
    % @* z2 F+ b6 V4 Y/ P$ o
  52. 2 A$ f: C( V( D9 O; s+ p( z
  53. if [[ "$os" == "debian" && "$os_version" -lt 9 ]]; then  F+ i5 l0 Z8 z* U+ `' K/ ]7 E
  54.         echo "Debian 9 or higher is required to use this installer.
    - k/ a1 f- l8 S' L5 ?$ G! U" t# i
  55. This version of Debian is too old and unsupported."9 ]2 z* x% U9 E( R% j) v7 v
  56.         exit) A1 S, O" q  n' ?! Y1 S! N
  57. fi
    - ]: F: H3 T3 X, k

  58. 9 B8 |+ N2 m4 S
  59. if [[ "$os" == "centos" && "$os_version" -lt 7 ]]; then% i2 ~9 G* X2 ~0 }5 O! @: Z
  60.         echo "CentOS 7 or higher is required to use this installer.' I* s8 Q! ~; c# w5 t& z
  61. This version of CentOS is too old and unsupported."# T; x5 x2 }+ |+ s3 H" C: `3 R8 h9 A
  62.         exit
    " }( r; R9 i  c. C
  63. fi
    7 V+ ]3 S% o' g5 \5 K4 ?8 H/ u" h, r
  64. 8 i, k7 c: \( k
  65. # Detect environments where $PATH does not include the sbin directories" ]) [  S3 O; P  S
  66. if ! grep -q sbin <<< "$PATH"; then! B; z) y& y0 [" g1 ^
  67.         echo '$PATH does not include sbin. Try using "su -" instead of "su".'
    $ a' O! _# w" f2 `
  68.         exit
    . |+ e! h( u1 |- b/ M
  69. fi2 P$ R( {# E: v

  70. ; q* b4 l0 F; R3 g2 I! a' k
  71. if [[ "$EUID" -ne 0 ]]; then
    5 }  m: c2 F" |
  72.         echo "This installer needs to be run with superuser privileges."1 V" P+ O4 B0 D1 \: L% F7 r' F
  73.         exit7 B- r1 w* }  z! x4 k
  74. fi9 E' H5 Z! U4 r& m! z. }
  75. : ~3 F+ e0 f2 i. O6 a
  76. if [[ ! -e /dev/net/tun ]] || ! ( exec 7<>/dev/net/tun ) 2>/dev/null; then
    * F1 q5 |. j. O0 n$ n1 Z) R0 ^; o$ w
  77.         echo "The system does not have the TUN device available.
    . D  c( @" Y) f8 B4 ~. z
  78. TUN needs to be enabled before running this installer."' m( D  U' U$ ^6 ?
  79.         exit# D0 V! o( h9 Y  i9 e* k5 h- f) W
  80. fi5 d# S* k/ v. _3 j1 u: P
  81. 4 Q7 i4 A4 }% W1 d
  82. new_client () {
    2 Y0 J6 s5 A' u" n7 X: w
  83.         # Generates the custom client.ovpn
    . ?0 w# c$ u7 g! i3 ^) F
  84.         {( X% C  I! ^$ m5 C4 R" D$ ~
  85.         cat /etc/openvpn/server/client-common.txt* g/ Y7 r" C# X, F9 t
  86.         echo "<ca>"6 H) E+ x; X& p" [* |! M
  87.         cat /etc/openvpn/server/easy-rsa/pki/ca.crt: x$ L$ A5 G& s, [
  88.         echo "</ca>"
    4 l5 C  C4 t0 E8 [
  89.         echo "<cert>"
    ' \- U0 W4 t) p) F3 S  p* o( B& l
  90.         sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt2 `5 m' E% |( x( I
  91.         echo "</cert>"/ n9 B6 x1 i) w
  92.         echo "<key>". ]# X. K5 I, t) p4 Q6 F
  93.         cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key. o0 @) Q% ~2 B$ f1 J3 }
  94.         echo "</key>"
    3 P& f3 L# Z' o' B4 k3 u' x
  95.         echo "<tls-crypt>"2 @7 z3 f3 S3 i) B
  96.         sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
    5 ^/ k, L- g% T
  97.         echo "</tls-crypt>"6 g6 u, I; [. y% |- M4 G* e& z
  98.         } > ~/"$client".ovpn; s( J- {" ~( _& q% B6 z8 z- @" `
  99. }
    + }, x$ V% I* c& p
  100. 0 {, a5 A$ L' W2 A' V
  101. if [[ ! -e /etc/openvpn/server/server.conf ]]; then! U; b: A! X. t  z9 j+ e
  102.         # Detect some Debian minimal setups where neither wget nor curl are installed
    8 S! \" Z( j5 W) J8 H* s, ]2 @
  103.         if ! hash wget 2>/dev/null && ! hash curl 2>/dev/null; then9 N) @! T$ K/ A( p8 w
  104.                 echo "Wget is required to use this installer."& @' b* r# U% t
  105.                 read -n1 -r -p "Press any key to install Wget and continue..."
    ! f4 q0 g: c1 X9 e) }: f! o- S
  106.                 apt-get update) ]7 a9 a( f& d2 M6 \+ E) [" h! c* m
  107.                 apt-get install -y wget
    . w- o" I% y( z& E8 L  m) G- i* W6 w
  108.         fi
    9 X& X! s( {$ d1 }# s. \& c
  109.         clear
    ; ^! k' w1 A8 H9 ]. L
  110.         echo 'Welcome to this OpenVPN road warrior installer!'5 I$ v1 q% ~1 v! I4 I5 W
  111.         # If system has a single IPv4, it is selected automatically. Else, ask the user
    ) S# w' `8 e# F4 K# [0 e
  112.         if [[ $(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}') -eq 1 ]]; then
    7 Z6 j' s6 ]1 h$ v$ i
  113.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}')
    / ^+ z- F* r9 A. P( {3 ?
  114.         else
    ( _2 t6 C6 Z: Q/ }  e8 l% E
  115.                 number_of_ip=$(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}')
    6 j6 v/ v4 U) s) f+ g8 V
  116.                 echo  q! }, l: R, W
  117.                 echo "Which IPv4 address should be used?"& N, h" b8 [! D  G% G( W' F
  118.                 ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | nl -s ') '
    . |! }5 }4 c( Z; K) K
  119.                 read -p "IPv4 address [1]: " ip_number' y3 v. f$ ^" V7 i! H, b; [$ C: h. q% I
  120.                 until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ip" ]]; do; ?) ^/ {9 x0 P9 m1 d' ]# Q# b9 R4 Q
  121.                         echo "$ip_number: invalid selection."
    5 J: a; C$ A; }4 a/ ~4 n
  122.                         read -p "IPv4 address [1]: " ip_number
    ) Q% B; V% L( ~5 C& U3 X' y# e# o/ P
  123.                 done
    # e+ L5 Z' ^2 p; G. F
  124.                 [[ -z "$ip_number" ]] && ip_number="1"/ m/ v( O4 f0 ]1 I: X
  125.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sed -n "$ip_number"p)* r' p& h0 I& L" B9 e0 x
  126.         fi2 ^9 E+ L$ h- r5 O+ l# m, @7 K4 E
  127.         # If $ip is a private IP address, the server must be behind NAT
    3 D2 x- f. o  X/ D" c# ?, k. Z
  128.         if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then9 s3 ]9 ]! M+ g) |2 _
  129.                 echo
    8 Z- @3 B9 H( q8 V. v/ n
  130.                 echo "This server is behind NAT. What is the public IPv4 address or hostname?"% ]+ f, x* l/ _$ V- r% f
  131.                 # Get public IP and sanitize with grep; M& Z' g, a. k! q2 f8 q6 E, l
  132.                 get_public_ip=$(grep -m 1 -oE '^[0-9]{1,3}(\.[0-9]{1,3}){3}$' <<< "$(wget -T 10 -t 1 -4qO- "http://ip1.dynupdate.no-ip.com/" || curl -m 10 -4Ls "http://ip1.dynupdate.no-ip.com/")")% d/ w: N# o, T, Z$ b# U$ {
  133.                 read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip  J- }0 _$ G5 h1 m3 K' @
  134.                 # If the checkip service is unavailable and user didn't provide input, ask again
    / X$ V0 C  |3 G" N: q
  135.                 until [[ -n "$get_public_ip" || -n "$public_ip" ]]; do" G( J  ^7 a3 ^3 A9 @0 k8 Q
  136.                         echo "Invalid input."- s: c; m1 V; f) Z6 f9 r
  137.                         read -p "Public IPv4 address / hostname: " public_ip& `$ a5 q* [# l0 k
  138.                 done+ R. d4 H& [! r. D
  139.                 [[ -z "$public_ip" ]] && public_ip="$get_public_ip"% q# s8 p2 K) Z" i
  140.         fi) l8 m- A$ H. d3 @: T' c
  141.         # If system has a single IPv6, it is selected automatically
    ( l, y/ `. G; B, I( G
  142.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -eq 1 ]]; then) G6 b) a* t# d7 N# r
  143.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}'), L/ U5 }& A4 J9 u  u  f
  144.         fi
    2 u0 P, U1 v' r9 \
  145.         # If system has multiple IPv6, ask the user to select one/ C  w* ~( ]* l3 U; F
  146.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -gt 1 ]]; then
    " q/ g6 h: X( w* \: A2 G3 \% p
  147.                 number_of_ip6=$(ip -6 addr | grep -c 'inet6 [23]')* b* g" }8 t% q' \3 M
  148.                 echo
    8 R: v, M1 {! h- r9 l9 }, P( X
  149.                 echo "Which IPv6 address should be used?") j% o3 L) f) p, B5 i( }
  150.                 ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | nl -s ') '! ]/ h/ q6 Z9 H+ Q
  151.                 read -p "IPv6 address [1]: " ip6_number
    ' j! z# c+ J4 G' q% x8 B+ x
  152.                 until [[ -z "$ip6_number" || "$ip6_number" =~ ^[0-9]+$ && "$ip6_number" -le "$number_of_ip6" ]]; do( [3 R; i) N# I0 j! C- m3 \0 a" ~" U2 G
  153.                         echo "$ip6_number: invalid selection."
    3 ]& x" T/ B& Z  x9 M# D
  154.                         read -p "IPv6 address [1]: " ip6_number& r2 w5 o) k/ n& f: U/ |
  155.                 done6 \3 D5 U" f+ [! u2 q+ w
  156.                 [[ -z "$ip6_number" ]] && ip6_number="1"0 B3 b1 c2 w5 R6 J: A1 e8 U
  157.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | sed -n "$ip6_number"p)+ m% ^$ v* K. j0 Y
  158.         fi0 S6 c- j- r- a- t2 R& W# W
  159.         echo
    7 A9 i0 b% |  \( P% A0 B* o
  160.         echo "Which protocol should OpenVPN use?", O) p4 E7 z( s- |& T' S
  161.         echo "   1) UDP (recommended)"% c3 z* {  M1 h
  162.         echo "   2) TCP"
    ( l, f/ h1 b) \  \6 r% Q; T# J
  163.         read -p "Protocol [1]: " protocol0 }4 D! N, m. X7 m& C
  164.         until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
    + v8 F& |6 o/ H
  165.                 echo "$protocol: invalid selection."
    ; @% P# }* U6 [6 e' X4 X$ ]' [
  166.                 read -p "Protocol [1]: " protocol
    % u8 b- x( L0 u! ]1 h7 B* X
  167.         done
    ' D" R6 w  n- N3 W! {2 M# n
  168.         case "$protocol" in
    2 g( X8 U/ \4 G; W/ y3 L
  169.                 1|"") 6 y3 ~1 n8 q! W; k
  170.                 protocol=udp
    8 s+ ]: X  P% |. _4 c+ ^
  171.                 ;;) l8 Z9 p: d+ T2 E5 T. k2 ]- d
  172.                 2)
    1 a6 m2 v5 f6 Z9 o3 f" z
  173.                 protocol=tcp
    5 A% z& g% v) {& V2 d7 l# F
  174.                 ;;* u+ _% c3 ?' Z7 x1 C
  175.         esac: }$ Y. F- r3 a: A( t4 P
  176.         echo" [: U1 d3 u; T) C, ^6 b
  177.         echo "What port should OpenVPN listen to?"9 s. N  y; l. ]  W' L
  178.         read -p "Port [1194]: " port, d7 f4 J8 r4 _4 b# t% T
  179.         until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do. D7 J% k7 G* Z
  180.                 echo "$port: invalid port."8 y! D9 F! \; V0 m
  181.                 read -p "Port [1194]: " port" P2 G' \6 w/ z" h+ K
  182.         done3 F5 g4 z6 k$ \; r, E
  183.         [[ -z "$port" ]] && port="1194"
    3 o5 A. Y7 g, U1 s* ]+ e' G9 i$ e
  184.         echo
    ' ~+ C( l4 ^5 E# a" C. N- [
  185.         echo "Select a DNS server for the clients:"- L- h! {# B' ^( v& e9 t- l
  186.         echo "   1) Current system resolvers"4 v. Z4 q% g) X" m  M+ x9 H
  187.         echo "   2) Google"" l4 z6 f5 z2 M2 A" ~3 a+ i
  188.         echo "   3) 1.1.1.1"
    . O1 U8 S. w0 q. n7 P# p  E2 y- F
  189.         echo "   4) OpenDNS"" Q2 `8 i# h7 k) z5 U5 V3 i! o4 V  i
  190.         echo "   5) Quad9"
    - X# v0 r; ~, \
  191.         echo "   6) AdGuard"& H* M# s  H3 ^: ?0 \6 u( n3 l2 P( Y
  192.         read -p "DNS server [1]: " dns5 q8 ?9 e6 s# ^( _% |
  193.         until [[ -z "$dns" || "$dns" =~ ^[1-6]$ ]]; do
    ( F8 G2 y4 R  J) p6 _# s+ ~8 u3 _
  194.                 echo "$dns: invalid selection."8 C7 Q  A2 _3 p) z
  195.                 read -p "DNS server [1]: " dns7 c  U: R1 B+ j' E# g. B- z
  196.         done
    + w$ R0 j8 b1 g& ]; O5 T
  197.         echo8 s1 N9 y5 O9 q8 n- f/ G& ]7 R, f7 F
  198.         echo "Enter a name for the first client:"
    8 x& A0 W* |( ?. X
  199.         read -p "Name [client]: " unsanitized_client/ c0 d7 I. j( a3 _2 }9 @) s; u
  200.         # Allow a limited set of characters to avoid conflicts+ I0 U' J( f% {6 m
  201.         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
      \7 S/ x$ P+ o
  202.         [[ -z "$client" ]] && client="client"
    " D& d0 [9 J7 R7 U* \
  203.         echo+ o7 I0 V: C& |
  204.         echo "OpenVPN installation is ready to begin."
    ' U! P9 J: n  l. d6 q
  205.         # Install a firewall if firewalld or iptables are not already available* T9 m# e8 n* `# D' V
  206.         if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then; i% H/ c# l+ K5 N( t
  207.                 if [[ "$os" == "centos" || "$os" == "fedora" ]]; then& C* b/ R' G$ X  v8 c
  208.                         firewall="firewalld"
    ; O' _/ t% P+ z. B# Z/ V  A5 i
  209.                         # We don't want to silently enable firewalld, so we give a subtle warning$ b" W  H3 }  @, I; U
  210.                         # If the user continues, firewalld will be installed and enabled during setup* R$ Y+ u, u, v# f+ l
  211.                         echo "firewalld, which is required to manage routing tables, will also be installed."' F4 z7 k) H9 }3 `2 _4 u
  212.                 elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then
    - p7 H& `3 m: c8 M1 d9 n" `6 W8 B
  213.                         # iptables is way less invasive than firewalld so no warning is given
    # B) L+ z3 ?/ L$ j1 ^+ ~' F7 g
  214.                         firewall="iptables"
    ! L9 R# B+ ^- n
  215.                 fi9 m8 i( @% A) o, F
  216.         fi# M- x3 ]$ H3 x6 _' K
  217.         read -n1 -r -p "Press any key to continue..."
    ' s1 f, E4 R( M& H& m, p
  218.         # If running inside a container, disable LimitNPROC to prevent conflicts8 p- w( O# G- K, `) A8 ^
  219.         if systemd-detect-virt -cq; then" C1 P* X+ b& P6 }' h* K% r
  220.                 mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null, @( N3 |# o2 o2 b
  221.                 echo "[Service]
    & B! s6 F  v( Y) y
  222. LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf% _. M6 W3 ~% O
  223.         fi2 y( L7 O/ m* G* {8 O
  224.         if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
    , B6 G! ]8 k) m$ s
  225.                 apt-get update. s  a6 J# E4 O2 q4 B8 n
  226.                 apt-get install -y openvpn openssl ca-certificates $firewall
    & Y4 C6 O/ Q  C. T$ b
  227.         elif [[ "$os" = "centos" ]]; then8 c8 l$ R; _5 p  R3 S- t3 o; ~
  228.                 yum install -y epel-release
    , N7 N/ c' G9 X
  229.                 yum install -y openvpn openssl ca-certificates tar $firewall0 r( o9 b% z/ b  Y- r: Y# L
  230.         else
    % ^- D" R9 T! G" Q5 @/ Q, k
  231.                 # Else, OS must be Fedora
    1 s4 L/ c0 F" \8 z5 E. B' G2 |2 Q
  232.                 dnf install -y openvpn openssl ca-certificates tar $firewall
    0 l/ w4 h4 v) _% ?" @6 h9 `, L
  233.         fi
    , F. h' Y4 v1 q3 a5 ]! s' D
  234.         # If firewalld was just installed, enable it
    1 ]4 Z- a$ d( t# a: c( U5 d4 L
  235.         if [[ "$firewall" == "firewalld" ]]; then! V) f2 B- K4 D3 m
  236.                 systemctl enable --now firewalld.service
    ! I7 Z- k) M+ \& N
  237.         fi0 j) }5 N" Z+ e- A
  238.         # Get easy-rsa
    2 s# u  Q, n, t' T' f% j7 o5 O6 X
  239.         easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.0/EasyRSA-3.1.0.tgz'
    + W0 E* r2 y/ b
  240.         mkdir -p /etc/openvpn/server/easy-rsa/
    . s% t* V2 }8 {' m
  241.         { wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1
    * `2 N2 r6 k, t
  242.         chown -R root:root /etc/openvpn/server/easy-rsa/
    / x) N! e8 [' Y" d0 Y& w' E
  243.         cd /etc/openvpn/server/easy-rsa/
    $ I" R4 M) K5 f; a: [
  244.         # Create the PKI, set up the CA and the server and client certificates# q2 v) c/ b* u5 k: @
  245.         ./easyrsa init-pki3 g3 X! _7 [  b% ~, l* ]
  246.         ./easyrsa --batch build-ca nopass
    $ R8 q8 s  E) S
  247.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass# J* x6 h2 C! D$ Z1 `/ K
  248.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass( i* p6 j4 W! A7 @7 t/ V' @
  249.         EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl8 h0 t' @! W. j- K3 @9 V# c
  250.         # Move the stuff we need
      v; L& y# `% }1 [, G. x
  251.         cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server4 t! {7 M. k! D( S) T
  252.         # CRL is read with each client connection, while OpenVPN is dropped to nobody9 E, w* O4 T) I4 V9 n' ^$ b
  253.         chown nobody:"$group_name" /etc/openvpn/server/crl.pem
    & a5 N' p- b8 l
  254.         # Without +x in the directory, OpenVPN can't run a stat() on the CRL file! U( F) g* G/ C/ W5 A# m( @' Y& E
  255.         chmod o+x /etc/openvpn/server/  w2 C' @) n; p' W. R( p) ]( a7 Y
  256.         # Generate key for tls-crypt% x* v4 m+ o+ `
  257.         openvpn --genkey --secret /etc/openvpn/server/tc.key* X, N' _# o" m' G7 B! Y6 ~
  258.         # Create the DH parameters file using the predefined ffdhe2048 group
    3 u$ V$ e( B5 k6 t; I9 g0 {
  259.         echo '-----BEGIN DH PARAMETERS-----
    3 w; W/ e' \* E1 D. [( C
  260. MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz6 |( h+ M; r' n4 o8 {# q0 J
  261. +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
    . m0 K  V) q4 D: h
  262. 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
    1 K5 f7 n. M% F0 [' {2 ~
  263. YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
    # t# Z# V7 B  M$ [2 H" F
  264. 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
    ! z- c" z- w& w  w+ g9 _
  265. ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
    ) ^" a7 y* i1 g; r& P3 ?
  266. -----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem" Z: ]: Q- q* R9 i4 r
  267.         # Generate server.conf
    , N5 o, [. Y' [* m: f" w
  268.         echo "local $ip
    # E5 t0 r7 g7 h- y9 c
  269. port $port
    * t" A7 e! h0 o% ]; E# f' t* B1 B) m5 G
  270. proto $protocol
    . A( o! L" g6 E, \3 `- V5 |0 j
  271. dev tun1 I8 X" S" G4 p+ j: z% w8 y* E
  272. ca ca.crt
    $ Y5 W+ u6 W% O, X5 d. C2 j1 H
  273. cert server.crt
    % Z) T$ Y! E( `. K4 d% I+ ~
  274. key server.key9 f: p% f* i3 J" g
  275. dh dh.pem
    6 [# c5 [3 m9 A9 w( M% @" ~3 D
  276. auth SHA512
    6 H' D) ^" v- I9 ?  D: D- V" K; X
  277. tls-crypt tc.key
    4 V8 }+ O  s: n
  278. topology subnet
    6 P5 K3 i' @+ @. L! s' [3 W% o9 ]
  279. server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf
    6 ]* M& s7 \' B0 e0 p' Y
  280.         # IPv6. Z0 _3 P) M6 B; L
  281.         if [[ -z "$ip6" ]]; then* ~( B9 H6 |9 `/ D9 i3 ?1 y
  282.                 echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
    5 M5 w1 o, u0 |5 [( \
  283.         else  W* u- j& g( H$ w- g
  284.                 echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf
    . ]3 w/ k7 J8 A- {
  285.                 echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf
    ; f7 }4 k5 e- H6 H" Y0 V. h: j
  286.         fi1 f, h4 I( j0 u: ?% T) {
  287.         echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf7 E3 ^  I, [/ w  O: U& P) X% ~
  288.         # DNS
    2 ]5 U5 q; R& s1 b3 v1 A  O- S
  289.         case "$dns" in
    ' h9 I* Y. S1 m/ @& m% R& g7 t
  290.                 1|"")
    * P. g# x; h0 F/ e& U/ }
  291.                         # Locate the proper resolv.conf& Y+ j- g1 @; ^" |" M1 H& a
  292.                         # Needed for systems running systemd-resolved. E7 ~7 |" }8 P0 g+ o
  293.                         if grep -q '^nameserver 127.0.0.53' "/etc/resolv.conf"; then
    4 u8 S; e* F8 x5 p
  294.                                 resolv_conf="/run/systemd/resolve/resolv.conf". o. U4 E! ]3 W7 q$ r# Q- q
  295.                         else# z2 @* k3 t# q* n2 a
  296.                                 resolv_conf="/etc/resolv.conf"
    ! v) u" q# c" R
  297.                         fi" I; T; i. S; H9 G
  298.                         # Obtain the resolvers from resolv.conf and use them for OpenVPN5 {6 _+ T( `* g8 d" Z
  299.                         grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do; ~9 h. N$ w$ ~
  300.                                 echo "push "dhcp-option DNS $line"" >> /etc/openvpn/server/server.conf9 t- F2 G$ f" h/ V4 Y3 ~8 o$ Y
  301.                         done
    , S( v5 j/ B: e
  302.                 ;;
    6 Q4 u" W% k& n/ j# Y6 u
  303.                 2): A8 P+ S6 g7 V
  304.                         echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf" d. }% {% n* W7 W  q! N$ D
  305.                         echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf
    9 N' P  h) M0 A+ N) e. r3 L; }; ?3 B
  306.                 ;;
    ) t6 B0 k, l# G- T
  307.                 3)( Y3 L" h9 L5 r( B
  308.                         echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf+ H* w$ A' E% U$ F, V8 l" x
  309.                         echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf& z, Z' Q0 W$ S, ?/ V0 `
  310.                 ;;* m, s5 ?2 I5 b& f2 T
  311.                 4)1 O4 Y3 Q% o+ `  T5 Q+ Q
  312.                         echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf6 b5 r! A' c: i) b; P/ e. J
  313.                         echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf% Z" b0 {! w( S" S. I
  314.                 ;;
    4 k& k) U( x) N7 P! P4 E
  315.                 5)
    - n1 y  v3 T- @7 L( w6 Z  x
  316.                         echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf
    ! m" c- |  P$ t) v5 b
  317.                         echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf
    + q. g/ g% Z" z9 j6 w$ d8 G# j% {
  318.                 ;;; Y/ `2 d$ ]; C' O5 M
  319.                 6)3 Y& a5 }- a3 g1 @. R, S2 x9 S
  320.                         echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf
    4 x6 d8 m1 r& o2 Z% p
  321.                         echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf
    " x4 ?: K; R" m
  322.                 ;;; ]- x( V3 ]3 M6 P1 o; T
  323.         esac; n( |& F6 F7 I0 p! x# \
  324.         echo "keepalive 10 120
    5 f+ {: C; A2 Z/ j& ]# e
  325. cipher AES-256-CBC
    ; W, C! O4 X; f$ L
  326. user nobody
    % C4 ?6 ~' v. J8 x6 R
  327. group $group_name- b" [. `& b3 ]# j4 ?
  328. persist-key
    : U8 A1 I: y5 Q0 F4 A
  329. persist-tun! h5 [; D) K& E
  330. verb 3
    4 T# v& @" [# y, U* J* E
  331. crl-verify crl.pem" >> /etc/openvpn/server/server.conf
    % V. P2 h9 U8 i1 f. X* y
  332.         if [[ "$protocol" = "udp" ]]; then+ x; b' k& Z; `
  333.                 echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf5 N- T( M1 g- G9 j5 @& O) R
  334.         fi
    ) E. U2 l& B2 p4 D5 H& U! V9 x0 {4 M
  335.         # Enable net.ipv4.ip_forward for the system6 v* v% o/ y/ ?) C  [
  336.         echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-openvpn-forward.conf
    . L; f) Y, y  ~
  337.         # Enable without waiting for a reboot or service restart
    - w- Y, P, i3 Y7 I6 H
  338.         echo 1 > /proc/sys/net/ipv4/ip_forward2 W4 q! z8 ~9 ?/ ]! W: L
  339.         if [[ -n "$ip6" ]]; then6 u* v' B9 g1 A& h/ _5 _% q  ]
  340.                 # Enable net.ipv6.conf.all.forwarding for the system+ `: |* Z4 C: A6 u- E
  341.                 echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/99-openvpn-forward.conf2 T  a! c' @! E% ]
  342.                 # Enable without waiting for a reboot or service restart5 h. v4 A2 B4 Q5 Z, W7 x
  343.                 echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
    . Z) N. g7 e- }7 {6 q! g
  344.         fi
    9 v  h7 B/ ]; P& T; M. }
  345.         if systemctl is-active --quiet firewalld.service; then
    " }9 K2 D  a, [! V, E
  346.                 # Using both permanent and not permanent rules to avoid a firewalld
    + u5 b! L' o  _! {; Z+ C- @  p; w
  347.                 # reload.8 [+ l1 Y* O  y3 ]' E- |" Q$ ?
  348.                 # We don't use --add-service=openvpn because that would only work with& ~) J- Q: D* n6 T1 K% M
  349.                 # the default port and protocol.; V, ~( X3 O! l' K" b$ [: r- H- ^
  350.                 firewall-cmd --add-port="$port"/"$protocol", \6 n3 b0 ]7 w3 C) X3 A
  351.                 firewall-cmd --zone=trusted --add-source=10.8.0.0/24' s- b+ V% f) p/ A# C8 o
  352.                 firewall-cmd --permanent --add-port="$port"/"$protocol"% P2 n) Y5 X1 I. M. {, c
  353.                 firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24% v7 q$ P4 P. h; |: J0 @5 \
  354.                 # Set NAT for the VPN subnet
    6 g2 H3 F5 q; f
  355.                 firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
    ! i* x  x5 Y8 x! ]
  356.                 firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"* Z: g2 y7 b7 V
  357.                 if [[ -n "$ip6" ]]; then- `& D+ @: y4 q2 ]" Y& Q/ P/ R
  358.                         firewall-cmd --zone=trusted --add-source=fddd:1194:1194:1194::/64  Y5 V7 a# ?* E* O
  359.                         firewall-cmd --permanent --zone=trusted --add-source=fddd:1194:1194:1194::/64" o! e9 A0 B9 t3 _9 \" I
  360.                         firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
    9 |; Q) `! x  ^
  361.                         firewall-cmd --permanent --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
    % M  T. l5 b$ Q, u( ^1 I
  362.                 fi# _; z1 l. Z2 S! g/ o* E9 ?
  363.         else
    + l6 F. _  ]9 P; p0 V  I
  364.                 # Create a service to set up persistent iptables rules% A/ q; v* v9 |8 ]+ `
  365.                 iptables_path=$(command -v iptables)
    * s0 v2 R6 o( r% \' ~& h
  366.                 ip6tables_path=$(command -v ip6tables)
      b7 d# S$ \6 k! [& j7 U
  367.                 # nf_tables is not available as standard in OVZ kernels. So use iptables-legacy
    ( s3 B9 R3 A6 U' c$ ^, `/ w
  368.                 # if we are in OVZ, with a nf_tables backend and iptables-legacy is available.
    - b/ ^. q" c1 I) n  C3 b
  369.                 if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then
    + H+ g) f, U3 f5 R  H+ q
  370.                         iptables_path=$(command -v iptables-legacy)
    4 f. [/ {5 v8 Q2 M
  371.                         ip6tables_path=$(command -v ip6tables-legacy)) q$ D; N, v1 ?( n# E  D8 [7 f6 \
  372.                 fi
    5 e, Z+ P$ w8 Z/ ?8 C
  373.                 echo "[Unit]% G* @" z1 U: L
  374. Before=network.target
    4 f8 X/ V+ @% e& n  j) Z+ }
  375. [Service]
    + p6 r- {/ g. ?$ I7 h& M' n& b$ Y$ a
  376. Type=oneshot
    ! i0 F, m8 J3 p( K: N* r4 c* @5 F
  377. ExecStart=$iptables_path -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip$ k. s: n# _% a
  378. ExecStart=$iptables_path -I INPUT -p $protocol --dport $port -j ACCEPT
    % Y, p; l/ @+ V
  379. ExecStart=$iptables_path -I FORWARD -s 10.8.0.0/24 -j ACCEPT- S/ ~; K; P& ^% n* ^. p5 i7 s* h0 f7 s
  380. ExecStart=$iptables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    . o( Y; e$ D% s6 a. q! g0 @6 F7 E
  381. ExecStop=$iptables_path -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip. o7 o4 E. ~& R; `% C! b! v
  382. ExecStop=$iptables_path -D INPUT -p $protocol --dport $port -j ACCEPT
    + [6 H1 p+ g) Q+ I0 s
  383. ExecStop=$iptables_path -D FORWARD -s 10.8.0.0/24 -j ACCEPT# r8 Q9 p6 ]( W, D
  384. ExecStop=$iptables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > /etc/systemd/system/openvpn-iptables.service7 m1 `, w' |, {# d. y- \! }  g( G
  385.                 if [[ -n "$ip6" ]]; then/ @2 Q; P7 ]) y0 M
  386.                         echo "ExecStart=$ip6tables_path -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip65 L6 Q. W7 @; {4 D- p% X4 A
  387. ExecStart=$ip6tables_path -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT* Z" ^2 `' j2 I9 w: r6 q7 f
  388. ExecStart=$ip6tables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT6 I- R+ k- a% Z2 F
  389. ExecStop=$ip6tables_path -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
    . ]8 r! }4 @1 o
  390. ExecStop=$ip6tables_path -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
    2 z5 i; Y* b8 W8 Y, y6 O# N, A7 n/ L/ O
  391. ExecStop=$ip6tables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> /etc/systemd/system/openvpn-iptables.service
    9 F6 y5 n! F9 O3 `+ N/ e
  392.                 fi
    ! Q5 V* P' l2 ^3 A, H1 e/ P
  393.                 echo "RemainAfterExit=yes, E3 J/ [1 i$ E/ x
  394. [Install]( h9 |$ V, Z6 g
  395. WantedBy=multi-user.target" >> /etc/systemd/system/openvpn-iptables.service' P" U, R2 r' v4 v% g
  396.                 systemctl enable --now openvpn-iptables.service
    ( V: \% O/ G0 P
  397.         fi( u4 t9 a# a6 L, `/ X# Z! x3 N
  398.         # If SELinux is enabled and a custom port was selected, we need this
    ( e/ `* Q! @" V. n* D
  399.         if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
    7 ^% J) z4 X1 C- n3 u
  400.                 # Install semanage if not already present5 b9 g! F- e: o% N8 K% U- a$ f. J
  401.                 if ! hash semanage 2>/dev/null; then
    ) t( V% ]! o4 {* H% l
  402.                         if [[ "$os_version" -eq 7 ]]; then
    , b7 V) |1 {  l  V" i
  403.                                 # Centos 7
    0 U  s$ b9 {! I/ a* a
  404.                                 yum install -y policycoreutils-python6 G7 ]# W# t6 o" Y' v6 a( Z2 k1 R* ?
  405.                         else0 C: \3 p* [, L" ?
  406.                                 # CentOS 8 or Fedora' m3 K% K1 P. w" w: ~1 E
  407.                                 dnf install -y policycoreutils-python-utils
    3 e$ e1 B) ]5 t+ o0 t) h1 ]
  408.                         fi
    1 Y" K! ^* ~5 B/ R
  409.                 fi
    - R. J$ m+ Y1 h4 {
  410.                 semanage port -a -t openvpn_port_t -p "$protocol" "$port", V' y. B, _! E  j" L
  411.         fi, X6 w8 B- x& U; \6 c- M
  412.         # If the server is behind NAT, use the correct IP address$ N+ s8 U" ]& l$ D" \" Z* y
  413.         [[ -n "$public_ip" ]] && ip="$public_ip"/ V( I$ R% R8 J
  414.         # client-common.txt is created so we have a template to add further users later7 n6 R  n0 C1 z
  415.         echo "client
    ) G5 w" M# _+ E/ R" D
  416. dev tun$ f  b$ g( J% S. a' \% Y
  417. proto $protocol
    9 V- m$ S- ~; e) h- E8 @5 v
  418. remote $ip $port
    2 ]$ a2 d7 P3 ]7 ]4 o
  419. resolv-retry infinite+ p5 U' u0 L3 I* B! x2 W- K, k  a
  420. nobind
    + t7 c/ |& ?* s4 i% l7 d" I! @
  421. persist-key! x3 V  @( q; n: `) G3 E+ e4 y
  422. persist-tun
    7 E. ^/ F2 s4 A( ^. F0 c
  423. remote-cert-tls server6 m5 o' c. o5 C
  424. auth SHA512
    ! P, B) {1 ]9 ?2 Z; p$ K
  425. cipher AES-256-CBC
    2 G- w/ ^7 H% l
  426. ignore-unknown-option block-outside-dns
    $ d, X1 c7 ~/ |, u+ q& }. W6 A5 J1 A& f
  427. block-outside-dns
    % Y  ?1 t" ~) G" M
  428. verb 3" > /etc/openvpn/server/client-common.txt7 U  R) l! s4 f% i
  429.         # Enable and start the OpenVPN service
    ( O: k  Q5 I2 }* G
  430.         systemctl enable --now openvpn-server@server.service# Z' m7 i9 ~' y9 {. G
  431.         # Generates the custom client.ovpn4 X; {. S$ a4 O7 [
  432.         new_client0 l+ J5 [" I, q2 k% y7 e
  433.         echo
    2 a4 l( f5 Z1 w9 H5 D
  434.         echo "Finished!"# {5 ?' _4 l, f" Z* ]2 e; h; u
  435.         echo
    : ]3 n. W. x/ L) Y: K
  436.         echo "The client configuration is available in:" ~/"$client.ovpn"
    + W, X2 p. ~9 m- v6 J: k7 x
  437.         echo "New clients can be added by running this script again."
    4 ~2 ~  I, t9 T& ]7 k6 R  T
  438. else
    7 q9 t0 g4 N8 `4 n
  439.         clear
    & {. Z! f* g! Y1 A! z
  440.         echo "OpenVPN is already installed."
    % r. r: v8 n! z7 [! t  l2 E  l
  441.         echo
    8 U$ m6 w+ {/ L6 m
  442.         echo "Select an option:"
    8 u+ I3 [2 W) M( `! {* G
  443.         echo "   1) Add a new client"
      D/ l; I6 M, g. S/ Z
  444.         echo "   2) Revoke an existing client": F% E" m& b/ ]/ F# }
  445.         echo "   3) Remove OpenVPN"5 x" m% Z$ c6 c6 x( u( W
  446.         echo "   4) Exit"3 p$ X+ e$ D5 c4 F3 y3 G1 ]
  447.         read -p "Option: " option
    ) o4 O8 Q3 N+ ^
  448.         until [[ "$option" =~ ^[1-4]$ ]]; do
    * d5 ~" q$ M  W. C
  449.                 echo "$option: invalid selection."; u: |; J8 e. N/ w9 M: ]
  450.                 read -p "Option: " option
    : C3 f3 g4 }0 L1 z% R9 p
  451.         done) r7 {/ P" ]% k5 _& W; V: Y" n
  452.         case "$option" in
    . k& K4 ]9 V# _6 A3 b
  453.                 1)
    ! c  R' Z7 f3 [5 ^( v% x
  454.                         echo6 i  g9 _8 Q0 N/ D8 s: B
  455.                         echo "Provide a name for the client:"
    3 l6 w& O2 h1 z" K) z+ Q) r, L9 D
  456.                         read -p "Name: " unsanitized_client' H  \' @% }: W3 j
  457.                         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")7 v6 E$ B* X5 ?$ ]
  458.                         while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
    : k2 {% r1 G; D1 C2 X& {" t; a
  459.                                 echo "$client: invalid name."
    # o+ u3 P  M8 ~0 Y9 D
  460.                                 read -p "Name: " unsanitized_client4 {' I1 V6 A) E8 v# E+ O
  461.                                 client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
    4 x0 X, t  C' e  \" {: Y) p3 R" z
  462.                         done! q9 r7 U0 R% e% y0 S
  463.                         cd /etc/openvpn/server/easy-rsa/
    3 P- D5 t! |0 a) k
  464.                         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
    6 P- o: p, N7 v0 p# v9 |1 {
  465.                         # Generates the custom client.ovpn
    * F5 w; G* U3 Q: R: m3 |7 O
  466.                         new_client
    $ j  l" f# S  W1 l
  467.                         echo
    ' q0 E5 d5 E4 ~( J+ @
  468.                         echo "$client added. Configuration available in:" ~/"$client.ovpn"
    8 s* p% ^( `, q& q6 v9 L* ]/ w
  469.                         exit: R9 f; L4 y4 y: `1 ^% C% u1 W
  470.                 ;;, B/ Y0 M% J7 w: i, ]
  471.                 2)
    2 q' o8 q; R* D/ H/ C: s1 M
  472.                         # This option could be documented a bit better and maybe even be simplified$ F4 b* N4 u+ o- J7 T
  473.                         # ...but what can I say, I want some sleep too* C8 J0 a! J+ u) x1 Y
  474.                         number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
    : z, ]4 Y6 V: X! Z7 e- N7 l
  475.                         if [[ "$number_of_clients" = 0 ]]; then
    , U; s- G- u; ^6 `
  476.                                 echo
    0 T' @0 F% {" D( [" `% o' z
  477.                                 echo "There are no existing clients!"
    1 z; T9 m9 S% Y7 c( L
  478.                                 exit
      _9 A8 ]% [% z; a( B( v& V6 r
  479.                         fi
    ) n% I. }" \& i) j5 i3 Z
  480.                         echo7 X; @' V* ?/ v8 h' c& f
  481.                         echo "Select the client to revoke:"
    ' u2 A7 _4 Y: Q# ^* V
  482.                         tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '0 {5 r( S+ k: P  T! O  L! Q* @
  483.                         read -p "Client: " client_number
    3 D# z/ G' n2 [& e( P* `1 y; b
  484.                         until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do) Q/ X4 c/ d+ z8 {# e2 P0 G- V: b
  485.                                 echo "$client_number: invalid selection."
    8 ^# Q  A; w. G/ P
  486.                                 read -p "Client: " client_number9 X( M- k4 i* x3 f. F) z
  487.                         done0 b6 j9 J; ~: H# ]7 @
  488.                         client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
    2 b' X% s" X# I; J8 u0 [7 r
  489.                         echo0 u5 \' E1 h! \; r" r9 m
  490.                         read -p "Confirm $client revocation? [y/N]: " revoke2 p) R' I' h0 @: r  W3 a; u9 x
  491.                         until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
    4 z/ E3 i  c5 V; u2 g
  492.                                 echo "$revoke: invalid selection."
    0 J- x" s# X0 t( C
  493.                                 read -p "Confirm $client revocation? [y/N]: " revoke; r" T( k& C8 b2 G! D( T5 @7 l* Z4 Z
  494.                         done
    : W% t' J# s1 u* T3 e' x
  495.                         if [[ "$revoke" =~ ^[yY]$ ]]; then# X' a/ x( L0 R+ R- ]
  496.                                 cd /etc/openvpn/server/easy-rsa/0 J. D5 S. }& T2 w6 s
  497.                                 ./easyrsa --batch revoke "$client"" |- I% f0 }% f/ a8 m
  498.                                 EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
    , p  G6 b4 F! k$ q2 G8 L+ P
  499.                                 rm -f /etc/openvpn/server/crl.pem
    * w" T. |, @  S' U' r) C2 v: H
  500.                                 cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
    $ _7 @5 `8 k* \
  501.                                 # CRL is read with each client connection, when OpenVPN is dropped to nobody
    ; p9 o1 L% `( G1 f+ C, B
  502.                                 chown nobody:"$group_name" /etc/openvpn/server/crl.pem
    0 W2 C' i- j1 Z: L
  503.                                 echo* p; X$ b( L! V# d
  504.                                 echo "$client revoked!"
    ' A: O" d" j; ]; C. M. ~0 v7 g
  505.                         else6 F$ p3 Z' L: c& {9 A6 ?
  506.                                 echo
    8 m- ~6 B( b5 H
  507.                                 echo "$client revocation aborted!"7 W5 a6 i0 C6 U/ Y7 Y* A
  508.                         fi
    . n  c6 i2 G1 f# }) o4 H/ y
  509.                         exit
    $ d6 x- B8 U: K2 b, r4 {. R
  510.                 ;;+ W& Z, @2 ]: G! ?$ R
  511.                 3)
    % ]% f! N3 [+ M
  512.                         echo5 h" R' E$ G; v5 `9 t+ |
  513.                         read -p "Confirm OpenVPN removal? [y/N]: " remove4 a: K$ \* O( D0 r* C& c" m
  514.                         until [[ "$remove" =~ ^[yYnN]*$ ]]; do
    # o! P: q4 H' T6 K2 e, n1 B
  515.                                 echo "$remove: invalid selection."
    6 Y2 d4 C& s6 t: D: F
  516.                                 read -p "Confirm OpenVPN removal? [y/N]: " remove: }! F* P7 U- z* Y
  517.                         done
    2 L% e  M1 C/ Y! Q
  518.                         if [[ "$remove" =~ ^[yY]$ ]]; then
    3 B9 Y3 ~+ R9 x4 u7 ~
  519.                                 port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
    - f! f" G! T& j. p! |/ l3 U
  520.                                 protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
    ! G* X4 A4 [/ [7 a& @
  521.                                 if systemctl is-active --quiet firewalld.service; then5 k  j% S7 k8 z" m8 H7 Z6 l
  522.                                         ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
    ) K) `3 J# }6 j, W) j
  523.                                         # Using both permanent and not permanent rules to avoid a firewalld reload.8 j, C+ O) b+ @. A
  524.                                         firewall-cmd --remove-port="$port"/"$protocol"
    ! c1 d8 `/ a9 d% G* P6 V+ v4 ?$ o* N# n
  525.                                         firewall-cmd --zone=trusted --remove-source=10.8.0.0/24& T: v5 Z% {( O" m" F! ^
  526.                                         firewall-cmd --permanent --remove-port="$port"/"$protocol"- k! v9 r/ h/ a% v! p/ v6 ?
  527.                                         firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24  @  s9 g# [2 ~8 e+ B! x8 V* `! A
  528.                                         firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"" j1 g, _/ P4 a$ }
  529.                                         firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
    0 F* i) }# V: \  n0 T' d) {
  530.                                         if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
    . G3 P# z. d/ Q# ^
  531.                                                 ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
    & y$ Q$ q6 q: c& z3 |2 K# r3 l
  532.                                                 firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
    2 ^/ D5 @7 ~3 \
  533.                                                 firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
    - r1 v; }8 R9 P9 {4 d. T! g
  534.                                                 firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
    ' X2 w. }+ m% L  S4 j
  535.                                                 firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
    ) U# h! l0 l1 n% H
  536.                                         fi; {. s9 q$ E( N3 s
  537.                                 else
    ; x7 B, r* W- x7 T2 V
  538.                                         systemctl disable --now openvpn-iptables.service& r1 R- c# @' h5 R. Q/ U* V
  539.                                         rm -f /etc/systemd/system/openvpn-iptables.service, V- y+ V/ j3 J" H) c
  540.                                 fi
    3 W6 _% `, g" r. K. I. O4 Q) H% Q) L
  541.                                 if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then7 e- w% q/ A8 k" x8 h
  542.                                         semanage port -d -t openvpn_port_t -p "$protocol" "$port"( U, c% Y$ N# A) B
  543.                                 fi
    ! f! _7 T( B( }4 g. o  Q
  544.                                 systemctl disable --now openvpn-server@server.service
    * P) A/ P4 m$ Q
  545.                                 rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf; R. g% y& j9 c; _+ y: p- i( h2 c
  546.                                 rm -f /etc/sysctl.d/99-openvpn-forward.conf/ e. g" h- E% E% @% m
  547.                                 if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
    . s/ Y% G% |" h: X$ R
  548.                                         rm -rf /etc/openvpn/server' p& \: G6 G! N( H6 k. m- X! [
  549.                                         apt-get remove --purge -y openvpn4 W& L9 d+ b+ H% I2 [
  550.                                 else
    4 r4 u/ B3 O7 `+ s! p% S: v3 H
  551.                                         # Else, OS must be CentOS or Fedora
    2 P9 a6 Q- d! B& r$ X
  552.                                         yum remove -y openvpn
    & K5 A8 f( i# B6 i3 a& A9 R
  553.                                         rm -rf /etc/openvpn/server
    ' g" J! @7 W  }# S
  554.                                 fi
    - S( m" X2 L! ~" t5 h
  555.                                 echo
    % X, ^; I/ ^5 O" {- k6 Z
  556.                                 echo "OpenVPN removed!"
    7 f' n0 w0 O/ U1 a9 I2 K6 [! B! R2 z
  557.                         else% _  n5 C+ m, t: P- B% o* U% I
  558.                                 echo
    + y$ s! O% x& b2 L# U
  559.                                 echo "OpenVPN removal aborted!"
    " I; e8 G/ K  i3 |  I
  560.                         fi" `+ U. X* `9 E& U1 Z
  561.                         exit
    . e6 b! l7 u7 M5 H3 w& ^
  562.                 ;;
    9 T" K! @! X+ s1 @. T7 K
  563.                 4)
    ( G& b' y( B8 @/ E
  564.                         exit
      }: B1 N6 J; u0 B! ]2 w! d
  565.                 ;;0 L& {: L0 E* y  ~; ~
  566.         esac& |) }7 |9 x& |0 g8 f0 `, N) G+ C
  567. fi
      I) d& V" D( z  N
复制代码
; |& t, z$ n1 d' F: b1 R

2 a4 B# a; v5 H3 o- K* O8 l) S# n& A7 A( w. r

& P1 w8 q- _" }# f9 v

shadowsocks-all.sh

601.59 KB, 下载次数: 12, 下载积分: 金钱 -5

shadowsocks-all.sh
回复

使用道具 举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

Archiver|手机版|小黑屋|

GMT+8, 2026-8-5 10:19 AM , Processed in 0.089162 second(s), 25 queries .

Powered by xyh-moon X3.5

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表