设为首页收藏本站
切换到窄版

 找回密码
 立即注册
搜索
xyh-moon»论坛 › xyh-moon › 技术板块 › shadowsocks-all.sh
返回列表 发新帖
查看: 421|回复: 0

shadowsocks-all.sh

[复制链接]
发表于 2022-6-22 15:40:40 | 显示全部楼层 |阅读模式
$ T" N! B+ Y  C
  1. #!/bin/bash8 y* u3 D3 ?7 R+ @
  2. #
    " k4 ?5 j" ~4 u, ~' z
  3. # https://github.com/Nyr/openvpn-install$ ]% O# ]" O9 @, [# p
  4. #
    ) a2 U0 ^- d' b" ~/ x2 p( P
  5. # Copyright (c) 2013 Nyr. Released under the MIT License.! N7 @" y, V+ x' ?% s) g$ d' L
  6. ! T6 t/ y% U- @& A2 ?2 O
  7. " |: ?/ i$ w, s* n! I9 r/ D
  8. # Detect Debian users running the script with "sh" instead of bash7 M9 T7 p' F& _& T! j
  9. if readlink /proc/$$/exe | grep -q "dash"; then
    " u, U0 Y4 P: [9 G# _8 p. O
  10.         echo 'This installer needs to be run with "bash", not "sh".'
      Z" k7 K8 ~7 g0 e
  11.         exit8 a: {7 a$ m5 t2 S
  12. fi$ z2 z" r3 ]+ `
  13. . W, a5 O$ D+ O! e
  14. # Discard stdin. Needed when running from an one-liner which includes a newline# t% q9 M0 o1 }6 [" V0 h
  15. read -N 999999 -t 0.0012 K' T1 C# s# T1 i4 ]
  16. 9 ]! R# h% a* p- K; d, W, l
  17. # Detect OpenVZ 6$ X+ U7 Z  C. t7 d6 v6 j
  18. if [[ $(uname -r | cut -d "." -f 1) -eq 2 ]]; then
    # f+ R) C4 U# ]& k. G2 \6 R
  19.         echo "The system is running an old kernel, which is incompatible with this installer."  D8 V$ o! T" s: K8 G" C
  20.         exit0 a0 n9 h( j' m  E
  21. fi6 w3 [- T" x/ z8 J
  22. 9 O0 H) Z! c: _' H; U: g
  23. # Detect OS
    4 Z$ W: p9 |( O# o8 q( E8 F# A
  24. # $os_version variables aren't always in use, but are kept here for convenience0 t0 ]! |! E1 ?+ Y
  25. if grep -qs "ubuntu" /etc/os-release; then* ?0 }. C; U9 j( E) R- u
  26.         os="ubuntu"1 S, R' E  Y/ k
  27.         os_version=$(grep 'VERSION_ID' /etc/os-release | cut -d '"' -f 2 | tr -d '.')4 T/ U0 y: R- ]
  28.         group_name="nogroup"6 \' u% I, y* x4 e  ^8 s, m0 Y
  29. elif [[ -e /etc/debian_version ]]; then
    0 u+ X# D$ ]$ U  D( T1 N
  30.         os="debian"
    2 [: F* |; \, P6 G, t
  31.         os_version=$(grep -oE '[0-9]+' /etc/debian_version | head -1)* b$ s+ n) X) o8 j. i0 o
  32.         group_name="nogroup"* U$ c: I6 O( i' }% v% y! m& [3 ^
  33. elif [[ -e /etc/almalinux-release || -e /etc/rocky-release || -e /etc/centos-release ]]; then
      L) Y: E+ T3 W: V5 Q
  34.         os="centos"
    8 ~& h  n8 V2 M2 N
  35.         os_version=$(grep -shoE '[0-9]+' /etc/almalinux-release /etc/rocky-release /etc/centos-release | head -1)
    * }* F8 K/ m+ J$ F- j- h
  36.         group_name="nobody"' T5 Z' q7 ^5 K+ k1 |
  37. elif [[ -e /etc/fedora-release ]]; then  X/ z1 a! `, {# n. S/ _) \
  38.         os="fedora"
    $ s- n: B& X' }8 p6 A  g" [
  39.         os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)) }. x  U- }0 P
  40.         group_name="nobody"
      l4 i2 F4 T: `- r( a
  41. else
    3 W8 X1 h' w9 [. ^) T2 j
  42.         echo "This installer seems to be running on an unsupported distribution.
    " a8 t3 O5 e' ~7 ^
  43. Supported distros are Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora."
    - d- T& A% F- I% O/ }! ~0 B
  44.         exit
    / P5 Q5 }/ \( n" M
  45. fi% V0 v* A0 Z7 b# \
  46. 2 ~1 j6 k; J+ t( T; d, T8 c
  47. if [[ "$os" == "ubuntu" && "$os_version" -lt 1804 ]]; then
    7 n# k7 a6 e* s5 z
  48.         echo "Ubuntu 18.04 or higher is required to use this installer.. G% I: G* C6 r* Z
  49. This version of Ubuntu is too old and unsupported."7 _) B) ]' ~2 j: f: ?1 ]+ x5 o
  50.         exit
    ' S0 N( h5 _" y# k  `! A; Q. }
  51. fi$ D" b5 f% C. a' v: |% m7 A
  52. & `5 \6 k: o0 W1 ~, Q
  53. if [[ "$os" == "debian" && "$os_version" -lt 9 ]]; then
    ! k+ M+ o* V$ b3 G) N/ u- N+ o: O
  54.         echo "Debian 9 or higher is required to use this installer." q% T  ^' m0 Z; I& |1 @
  55. This version of Debian is too old and unsupported."  [' w  ]! @1 Q$ A
  56.         exit6 y* w& V, L9 n/ \( s
  57. fi1 Y: V& Q  U+ |1 c' `

  58. 7 i" p4 g8 C' J0 f# d
  59. if [[ "$os" == "centos" && "$os_version" -lt 7 ]]; then
    % W* Y; g% v% c& L& ?
  60.         echo "CentOS 7 or higher is required to use this installer.
    * P4 s% k  z# b1 g- R4 I
  61. This version of CentOS is too old and unsupported."8 `+ a2 v# ~% i. A) y! C# M
  62.         exit& d# Q. `$ g; o/ \2 J) A! y; T% X
  63. fi$ w& F' j" v0 H& l
  64. ( F3 r- Q, ^; X4 Q! ?- X
  65. # Detect environments where $PATH does not include the sbin directories
    1 E+ }6 n/ ^- N# X. _' e
  66. if ! grep -q sbin <<< "$PATH"; then
    # F$ R1 {0 x* p; J7 j& N8 T
  67.         echo '$PATH does not include sbin. Try using "su -" instead of "su".'
    ; Z3 z+ j$ U$ O- J
  68.         exit0 Y$ C5 n2 d' g1 p% m
  69. fi
    6 D. N) q6 s; `' f# n0 H. Q
  70. 2 A$ g0 M3 r; t' b/ \& S0 t
  71. if [[ "$EUID" -ne 0 ]]; then
    & `8 I; a! n8 r* g- Z
  72.         echo "This installer needs to be run with superuser privileges."
    - y  d3 E3 ?$ d4 r0 `/ K: s
  73.         exit( Y4 q' o# |! F
  74. fi$ \& f0 X# P/ [
  75. 8 L9 I, \3 m7 @' y8 ?. N
  76. if [[ ! -e /dev/net/tun ]] || ! ( exec 7<>/dev/net/tun ) 2>/dev/null; then
    / i4 w8 R, P; Q3 p7 p# `
  77.         echo "The system does not have the TUN device available.
    + x& G6 F4 `( j5 _3 A" m
  78. TUN needs to be enabled before running this installer."
    ; R# J$ w, `1 ^
  79.         exit
    1 |$ s5 f! @( p8 I0 X
  80. fi
    $ O, \4 g' _: b* H3 B8 Q

  81. + [) a9 l) @+ N& ?2 N& ^
  82. new_client () {/ `/ b7 n1 L! }
  83.         # Generates the custom client.ovpn
    $ M: r! f- C, C+ l
  84.         {0 o4 @4 V" j! |# p* V7 z+ h% ?# n
  85.         cat /etc/openvpn/server/client-common.txt
    5 Z' _6 N2 e6 y- r/ i# Y+ Y) v' Y7 [
  86.         echo "<ca>"
    ! C& E5 |  y# y' F' B, Z- i* J
  87.         cat /etc/openvpn/server/easy-rsa/pki/ca.crt
    ; ^- r1 N+ t2 W9 C: d( b% [! n- f
  88.         echo "</ca>"
    * t& W) V/ e! }6 R& s
  89.         echo "<cert>"
    & y7 Z7 F* Y. l3 ^, {2 o# D" V
  90.         sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt9 d$ K! v; H/ S: a# Y
  91.         echo "</cert>"
    + P% ^5 D8 ]- a# J7 O
  92.         echo "<key>"0 [# d! R/ m; _3 `& D
  93.         cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key
    ( t  R) V0 p! G+ U6 H/ Y% m
  94.         echo "</key>"
    & c( v9 P% I! z; x
  95.         echo "<tls-crypt>"
    : D6 Q( d- Y0 V
  96.         sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key5 A5 o" |! O0 P  J- b
  97.         echo "</tls-crypt>"
    # z9 o8 b* a2 T- a
  98.         } > ~/"$client".ovpn% p( \8 X' @2 M
  99. }
    : e/ }2 ^; J+ I' N6 F+ _
  100. : D9 Q; w8 q4 F0 t5 o) B/ r8 W# {
  101. if [[ ! -e /etc/openvpn/server/server.conf ]]; then! u0 M- Q- q+ l' @
  102.         # Detect some Debian minimal setups where neither wget nor curl are installed$ w/ u0 v$ z7 n* J3 Y
  103.         if ! hash wget 2>/dev/null && ! hash curl 2>/dev/null; then7 Z/ w) f( F3 S/ \* t. U2 a
  104.                 echo "Wget is required to use this installer."" {3 i5 n7 r9 C9 T/ ]9 ]& O  t# E
  105.                 read -n1 -r -p "Press any key to install Wget and continue..."
    ; i) L  T+ Z& ?! T4 c
  106.                 apt-get update
    + ~3 z# g/ ~& V: v
  107.                 apt-get install -y wget
    * ^4 d; P1 n2 K$ C! h
  108.         fi
    4 n2 _9 b% f) }+ o
  109.         clear
    ) j  a2 {( k, L" C) C# U
  110.         echo 'Welcome to this OpenVPN road warrior installer!'8 b2 ~+ |- R, z: M' _4 P
  111.         # If system has a single IPv4, it is selected automatically. Else, ask the user' j! w; E( e' G' H: }
  112.         if [[ $(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}') -eq 1 ]]; then
    / x% ^3 c! Y1 o0 ^5 j3 b; j3 k
  113.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}')
    7 r+ h3 _0 H# m2 \0 J6 G/ e6 V, w
  114.         else
    7 T0 W- Q9 R$ g1 d' {: P
  115.                 number_of_ip=$(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}')
    / ~# h+ i. V" J2 m& B- r
  116.                 echo5 W/ y2 ^" s4 L/ N( T4 q" P* D) N
  117.                 echo "Which IPv4 address should be used?"
    6 ]6 D9 \  g* X$ x& I5 g
  118.                 ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | nl -s ') '
    1 g- I  s& _! C1 ~3 x* I) N- b2 r
  119.                 read -p "IPv4 address [1]: " ip_number
    4 c; z7 e5 D' S2 k, ^' U" Y
  120.                 until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ip" ]]; do
    8 W8 P' L( [# n2 o+ O
  121.                         echo "$ip_number: invalid selection."
    7 u% L/ x8 T/ C
  122.                         read -p "IPv4 address [1]: " ip_number
    8 y2 f, K8 e2 \' B2 f
  123.                 done
    ( L6 Q# f& z0 U( k6 E3 z4 a$ |; H
  124.                 [[ -z "$ip_number" ]] && ip_number="1"1 U; t/ q% P* t' c6 }
  125.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sed -n "$ip_number"p)4 e% f, R9 g  D. d, b. ^! L
  126.         fi
    0 S0 ^3 [; s* w; r
  127.         # If $ip is a private IP address, the server must be behind NAT
    : M2 m, [& e+ g, z* R9 Y1 {3 k; h4 E0 [
  128.         if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
    4 f- D0 F- R# u: w+ A2 u2 u, |* {
  129.                 echo
    $ W  E- m( E9 {' y+ a
  130.                 echo "This server is behind NAT. What is the public IPv4 address or hostname?"& Z  a1 a+ k- u1 i& r/ F7 a
  131.                 # Get public IP and sanitize with grep# D1 |; |8 t% |9 R) c3 B
  132.                 get_public_ip=$(grep -m 1 -oE '^[0-9]{1,3}(\.[0-9]{1,3}){3}$' <<< "$(wget -T 10 -t 1 -4qO- "http://ip1.dynupdate.no-ip.com/" || curl -m 10 -4Ls "http://ip1.dynupdate.no-ip.com/")")0 m5 Z( w$ t" T1 U* z
  133.                 read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip- ?- J3 ]$ @) [! D3 }1 j# l7 A
  134.                 # If the checkip service is unavailable and user didn't provide input, ask again8 q/ [7 k5 v- j' o+ z
  135.                 until [[ -n "$get_public_ip" || -n "$public_ip" ]]; do
    6 V: D$ b9 ?  g; a! N
  136.                         echo "Invalid input."
    7 j! T9 S, u5 p2 y" _
  137.                         read -p "Public IPv4 address / hostname: " public_ip
    , d% Q% J/ O& |5 [# C% A
  138.                 done
    8 T8 v% w. L- [- A
  139.                 [[ -z "$public_ip" ]] && public_ip="$get_public_ip"
    3 M. C& l, J+ A0 k! X( D5 ]
  140.         fi; @5 z9 V& a" U2 n
  141.         # If system has a single IPv6, it is selected automatically
    " E8 f0 X  E: ^$ M* e& b8 h
  142.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -eq 1 ]]; then, U$ Z9 l' y# p# z0 r" Z; q. \
  143.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}')
    8 N5 |: k3 U8 z- f1 m
  144.         fi- w8 `0 I, }/ q% \2 s8 Z
  145.         # If system has multiple IPv6, ask the user to select one8 I) }2 r0 k5 }, a
  146.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -gt 1 ]]; then: A2 s9 ]8 D/ z5 P6 v1 o+ u
  147.                 number_of_ip6=$(ip -6 addr | grep -c 'inet6 [23]')" f9 F5 r$ V+ R
  148.                 echo
    3 D+ `1 ~* j) \+ u& p
  149.                 echo "Which IPv6 address should be used?"# g0 V  Q. }. V& Y
  150.                 ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | nl -s ') '
    ; k& S/ Y2 n. R* Y( _' u
  151.                 read -p "IPv6 address [1]: " ip6_number
    $ P* v* K8 K: v$ K
  152.                 until [[ -z "$ip6_number" || "$ip6_number" =~ ^[0-9]+$ && "$ip6_number" -le "$number_of_ip6" ]]; do
    : x% h- p& c1 i, V# m" {2 v4 n0 ~1 u$ z
  153.                         echo "$ip6_number: invalid selection."
    : J! ^# B8 T- Q
  154.                         read -p "IPv6 address [1]: " ip6_number
    5 I3 c9 W4 [* l8 \, G% S" j5 r
  155.                 done
    + @( \$ C$ n! R7 v! s, [4 Z  q
  156.                 [[ -z "$ip6_number" ]] && ip6_number="1"& {( @* \$ \9 e! u) ?2 X
  157.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | sed -n "$ip6_number"p)
    * z2 D8 ~( @' M+ |# v& L! R7 M  f
  158.         fi( l3 C" g- C9 d+ I
  159.         echo" v( S  }3 N: j5 o, f; P+ u7 ^
  160.         echo "Which protocol should OpenVPN use?"
    9 B1 c8 |- c3 m5 Y# h
  161.         echo "   1) UDP (recommended)": D! }* M- T# `6 K
  162.         echo "   2) TCP"7 j% J; F# P0 R) |7 l' O8 o
  163.         read -p "Protocol [1]: " protocol
    4 g" p3 W8 C  Y5 A7 L) B2 q
  164.         until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
    % @5 Y$ O2 V- ~( _
  165.                 echo "$protocol: invalid selection."* z+ V" |; }  w. J. E% m$ ~& m
  166.                 read -p "Protocol [1]: " protocol
    8 G/ Y- g* I1 b, `) I" ~
  167.         done
    ) s* T, c( L  j) \
  168.         case "$protocol" in2 G( @1 Z0 q2 O7 w, n& B
  169.                 1|"")
    ; H' g; ~9 e. w, R, k+ m
  170.                 protocol=udp1 q9 \2 p2 \7 c; F& S; J2 }
  171.                 ;;2 C" v$ e: H9 _. h. F/ r
  172.                 2) 8 @/ n! P  ?4 [+ n/ {( N) W
  173.                 protocol=tcp! H5 f' Z! {/ I9 M6 Y$ U
  174.                 ;;$ p$ R* N( \2 P. g5 Q! d
  175.         esac
    1 g3 i; S9 ?$ T% l2 a" G
  176.         echo
    0 l8 n3 E/ a( h& f  X6 V
  177.         echo "What port should OpenVPN listen to?"
    4 d& R' ?8 M5 |) ]- m2 e
  178.         read -p "Port [1194]: " port" h! r" A7 U+ z/ a' P! ^+ H
  179.         until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do
    ! L+ u. E: z! S2 o9 G
  180.                 echo "$port: invalid port."7 }/ W! x4 o. p; ]
  181.                 read -p "Port [1194]: " port1 `- l6 i, }" ^  t0 S* a
  182.         done" }" J5 x: Z" `* @3 N6 V
  183.         [[ -z "$port" ]] && port="1194"- i6 T. e5 F) l2 N
  184.         echo
    * J/ H+ u( r2 R; l. M: ~4 y7 d3 i
  185.         echo "Select a DNS server for the clients:"
    7 s6 k+ M2 I+ P4 G+ c. k, s
  186.         echo "   1) Current system resolvers"
    $ O" _, T& H8 O$ H& A+ E
  187.         echo "   2) Google"
    ) E( {" p. G3 m/ K, m) Z5 y
  188.         echo "   3) 1.1.1.1"7 I% q1 V$ n% d7 M' D- H1 y* M
  189.         echo "   4) OpenDNS"3 s. |3 K! S( c5 }
  190.         echo "   5) Quad9": ?  }+ z3 b7 I  {# T
  191.         echo "   6) AdGuard"2 |4 P+ `: U" z% @4 d2 L
  192.         read -p "DNS server [1]: " dns
    4 |0 e3 d, s/ {- l: |0 `5 p! ~
  193.         until [[ -z "$dns" || "$dns" =~ ^[1-6]$ ]]; do" [1 @% H1 S7 N+ t" G: y9 A
  194.                 echo "$dns: invalid selection."4 d% Y3 u/ {) T" e
  195.                 read -p "DNS server [1]: " dns
    # d- [. `2 B' t* W5 d6 L
  196.         done) j6 k- ?5 [/ ~: G! U$ c2 P+ _) @
  197.         echo" X: w, g, w& E" U/ l# G/ C2 c
  198.         echo "Enter a name for the first client:"
    ! M% L/ e) c! I% ?
  199.         read -p "Name [client]: " unsanitized_client, {* Z7 G' E6 ^2 q5 h
  200.         # Allow a limited set of characters to avoid conflicts
    ; |! J: u% n5 s  R2 B# s9 N8 l3 Q) j
  201.         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
    ) X& P6 y+ ~* i4 g
  202.         [[ -z "$client" ]] && client="client"
    # `: f! V# J/ w( K* m' G8 R1 c
  203.         echo
      p( r9 z  l2 y. S. b+ n
  204.         echo "OpenVPN installation is ready to begin."9 S* }* d6 @; b% T0 R" F
  205.         # Install a firewall if firewalld or iptables are not already available9 v) e- W7 Z& S# b; i  q
  206.         if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then
    & E) E* U. [- U2 W
  207.                 if [[ "$os" == "centos" || "$os" == "fedora" ]]; then
    ; w  q- A& Q$ s4 M0 T8 H/ A$ A  l
  208.                         firewall="firewalld"
    ; g6 d% G' L9 a. ]
  209.                         # We don't want to silently enable firewalld, so we give a subtle warning
    $ G8 M: v5 X, Q& n
  210.                         # If the user continues, firewalld will be installed and enabled during setup2 I. `/ r1 R7 J9 s* F, v- c
  211.                         echo "firewalld, which is required to manage routing tables, will also be installed.") C$ z1 s! h$ b$ h! t
  212.                 elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then+ }- h/ F3 }$ N
  213.                         # iptables is way less invasive than firewalld so no warning is given* y1 n7 r, W* P" F. E
  214.                         firewall="iptables"
    % M2 T8 \9 E4 I! h# V7 q
  215.                 fi
    6 E3 J. H3 Y, G4 c
  216.         fi
    " v1 V- b8 x* J0 h( |7 K
  217.         read -n1 -r -p "Press any key to continue..."
    0 S9 ^8 d7 [; l# x5 i$ U
  218.         # If running inside a container, disable LimitNPROC to prevent conflicts
    3 t& e8 o% L0 r/ Y8 V
  219.         if systemd-detect-virt -cq; then. B& }% e/ Q& v! |& C8 n4 a7 Q" C
  220.                 mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null$ ]$ {2 w3 n3 S6 O  g! i
  221.                 echo "[Service]7 i! U, ~3 z1 G: _* X5 ^$ h
  222. LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
    6 Q3 h) r. Z2 e; U# c; M: }3 L
  223.         fi3 F" y! }4 H( I$ |0 P: ]$ m
  224.         if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then6 d7 @+ H/ a# ]4 W& x
  225.                 apt-get update5 Q9 J& K9 ?" v) L
  226.                 apt-get install -y openvpn openssl ca-certificates $firewall
    , ?# v- A' L. y/ n3 Q# c* C
  227.         elif [[ "$os" = "centos" ]]; then
    5 E" ]6 u$ k7 `3 I1 p: P$ {
  228.                 yum install -y epel-release2 W. V$ o$ r# I6 n% h
  229.                 yum install -y openvpn openssl ca-certificates tar $firewall
    # t: w; V$ e5 e9 V0 ?
  230.         else# }+ Q( H% Y# B- y! k
  231.                 # Else, OS must be Fedora- b9 ~- p* A6 F+ D" r
  232.                 dnf install -y openvpn openssl ca-certificates tar $firewall8 N8 K: f. q! J
  233.         fi
    - t0 W9 V% |( \2 U" r$ N- u: E
  234.         # If firewalld was just installed, enable it
    " A5 K( I6 R2 {$ S2 B4 g
  235.         if [[ "$firewall" == "firewalld" ]]; then
    8 b( p7 C0 a- @* F
  236.                 systemctl enable --now firewalld.service/ u# Y2 }7 E! t( A0 J- B
  237.         fi
    # _* P4 j6 y' L# A* j" y/ d) |
  238.         # Get easy-rsa9 b6 H4 t/ ?# Y- T( f
  239.         easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.0/EasyRSA-3.1.0.tgz'  d7 R( R! H1 X  v# d" b4 O
  240.         mkdir -p /etc/openvpn/server/easy-rsa/+ R4 F' F* N& D+ D
  241.         { wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1
    5 H1 q6 }# ~/ Z
  242.         chown -R root:root /etc/openvpn/server/easy-rsa// N0 l% y/ E9 x* e! j9 W& j
  243.         cd /etc/openvpn/server/easy-rsa// I( Y5 c; z) [3 `
  244.         # Create the PKI, set up the CA and the server and client certificates8 R/ y4 K4 w. T" ^, @
  245.         ./easyrsa init-pki* Z2 C$ F4 |3 ~6 Z3 f' q; B4 J) o- N
  246.         ./easyrsa --batch build-ca nopass' l# H2 y% x% q& q7 Z
  247.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass
    7 F9 z$ H) v  v( \4 m# `
  248.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
    3 w6 G, q; F% u4 t: L& F
  249.         EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
    % Y# \  b7 k/ a7 F3 v) Z* D) |5 @
  250.         # Move the stuff we need
    % f, y: P" p  n# b; t2 i4 p' o) N
  251.         cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
    ( o& g" ^* |1 \, z( @* N7 P- n, q
  252.         # CRL is read with each client connection, while OpenVPN is dropped to nobody! n# T" h& ]- Z7 k1 T! E% T) y
  253.         chown nobody:"$group_name" /etc/openvpn/server/crl.pem
    , |7 i# W: a" J8 r/ ~- s
  254.         # Without +x in the directory, OpenVPN can't run a stat() on the CRL file/ S8 E' h* {$ ?
  255.         chmod o+x /etc/openvpn/server/
    ; G& b8 u) }5 l& G/ n) v
  256.         # Generate key for tls-crypt' G+ I' R8 ?8 o- p
  257.         openvpn --genkey --secret /etc/openvpn/server/tc.key
    ! E* e- B2 Z( w( N1 x
  258.         # Create the DH parameters file using the predefined ffdhe2048 group5 l8 d1 s/ W# N9 m: p: u- d! p
  259.         echo '-----BEGIN DH PARAMETERS-----9 V- i+ g# W6 f: C
  260. MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
    1 x2 F  X+ _- G) N8 L0 B8 ]+ t" }
  261. +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
    ! `7 h% l6 H& q2 [4 |1 h5 n' C2 u, ^
  262. 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
    , v, b% x8 z( t" R- x
  263. YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
    + d+ c( X# s3 Y- n* n
  264. 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD# }7 h3 ?/ P8 Z
  265. ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==7 G% G1 a/ Q' ?: Q0 \2 i3 ?
  266. -----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem* T, @( v6 K  ^1 Q8 Q$ u6 s
  267.         # Generate server.conf, v4 k6 m- p* O# R! X
  268.         echo "local $ip& t  ~6 H5 n' F1 |9 a/ S+ g
  269. port $port
    2 @0 X% {% h# r3 |% U# ^* k  Y
  270. proto $protocol
    , z- P- v* ]8 c( A
  271. dev tun
    8 L) r6 O) @, H9 I) |/ T" G, f% j
  272. ca ca.crt+ m; j) A7 N6 ?
  273. cert server.crt3 k3 |5 L) {: [; |( p& }( T' f
  274. key server.key
    # S3 I7 ~$ Y; t; A
  275. dh dh.pem
    : n" [- z" @/ j0 h
  276. auth SHA512* }' {, y% C: e  g& S! J
  277. tls-crypt tc.key
    ( N4 h' q8 n- ?7 G
  278. topology subnet
    4 J: `+ P9 g4 n# j
  279. server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf
    . D* {5 o+ e! ?! M4 o6 x
  280.         # IPv69 p* W5 X8 Q$ U+ q
  281.         if [[ -z "$ip6" ]]; then
    8 Z) @; [$ P' p+ _% P; n
  282.                 echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
    , s) m0 ]( v# g
  283.         else
    ) `$ l* F8 \4 b  Z5 i
  284.                 echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf
    ' |" q3 ~. q+ c" }! X
  285.                 echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf9 t$ \5 \* z3 U; Z2 i0 G
  286.         fi
    8 U1 H- U) M1 y# m5 z/ n
  287.         echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf4 W  R% \& i; g# w' o" w( T% E
  288.         # DNS
    8 ?$ u/ ]& |+ W6 l- G
  289.         case "$dns" in
    * p4 N9 v1 C) e6 l! @
  290.                 1|"")) B+ j# ~1 f4 p6 B- f+ ~7 S
  291.                         # Locate the proper resolv.conf% O0 C* @. j0 Z4 w- |. c6 ]
  292.                         # Needed for systems running systemd-resolved8 [. }+ z+ X0 ~  Q+ L# I
  293.                         if grep -q '^nameserver 127.0.0.53' "/etc/resolv.conf"; then
    ( {0 O( T$ r; [5 M: W
  294.                                 resolv_conf="/run/systemd/resolve/resolv.conf"6 h; q3 S0 d* I- M% W3 a' S
  295.                         else
    3 v/ |  M* Z, K7 ?4 |4 L( D3 e
  296.                                 resolv_conf="/etc/resolv.conf"
    ; H+ O4 i& a5 `, ~! O- x
  297.                         fi
    ! C2 O0 I$ m- `7 z7 F0 ~1 L  K
  298.                         # Obtain the resolvers from resolv.conf and use them for OpenVPN  g3 E; G3 r& C1 a! U
  299.                         grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do7 h0 U% o! T) [" d) L! m
  300.                                 echo "push "dhcp-option DNS $line"" >> /etc/openvpn/server/server.conf
    , L" L1 ?  k4 i
  301.                         done
    ( F! T+ ?& p) T
  302.                 ;;
    6 `: `* L; E: S* J  E/ a/ f
  303.                 2)9 J! M& T- m* v3 @+ N; w
  304.                         echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf
      N& a# l) n! e$ e" |+ l+ Z
  305.                         echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf6 n4 e; ^# ^4 f) l
  306.                 ;;5 U2 l) [1 h5 |. c7 v
  307.                 3)
    & R4 j3 K: @3 Q( q
  308.                         echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf
    5 n6 d" w$ i! R2 m, U
  309.                         echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf4 ?9 x- Z/ E" I% r4 ~  I7 X& d1 r
  310.                 ;;6 @, L- E% e, m0 {
  311.                 4)
    - Z7 Y* B" r* Y) U
  312.                         echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf, N8 M1 R, N& e# z
  313.                         echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf0 G: }& t0 J. P: ?; R; w% D
  314.                 ;;
    . Q; ^2 ?7 w' @7 R4 W
  315.                 5)7 |  x% a" X* _( z9 w2 \
  316.                         echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf
    0 a9 t; K* T7 X& f& l: _0 n
  317.                         echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf
    , ?) ?& u2 }, k, q8 Z. O
  318.                 ;;
    9 d8 Y; I% e2 H8 {1 l; I9 r
  319.                 6)
    0 [, b: {1 l4 E* o1 t
  320.                         echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf
    ' M6 c3 Z4 k+ w9 y' _  e5 `0 v! N$ `
  321.                         echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf8 w, ?9 `3 p) {6 Z% T( R/ [) ^
  322.                 ;;- A- b4 c: J3 P# a* q, h. h
  323.         esac3 F# v* ?' v0 s! A. @
  324.         echo "keepalive 10 120. X: V% w; T! C8 W/ n' `
  325. cipher AES-256-CBC' g5 s8 W5 N/ m& E& J3 m) w2 A
  326. user nobody, f$ ], \0 @* V8 g: k' k+ I8 x3 j
  327. group $group_name+ H' N5 R. i  e/ Z8 X1 \9 u
  328. persist-key
    * [+ A. ]- m1 F8 d: M6 X
  329. persist-tun$ G/ x4 d! u# A2 K
  330. verb 33 l# c+ w- i" I1 U# b  @7 ], w3 V
  331. crl-verify crl.pem" >> /etc/openvpn/server/server.conf6 a/ N- h; @( z3 c
  332.         if [[ "$protocol" = "udp" ]]; then3 O- S. v& L  ^! k8 @7 O
  333.                 echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf/ A1 a0 B$ D! F
  334.         fi
    / H, z. T) c  f/ x/ a9 ~* i0 X8 K
  335.         # Enable net.ipv4.ip_forward for the system
    - c$ K+ X7 R4 Q" r
  336.         echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-openvpn-forward.conf
    - j* o2 W4 T. J$ @! n1 p
  337.         # Enable without waiting for a reboot or service restart$ ~6 Z3 `/ U' u: K, }
  338.         echo 1 > /proc/sys/net/ipv4/ip_forward
    - G! `  h( [( s
  339.         if [[ -n "$ip6" ]]; then6 ]1 v5 r- H2 U# @+ F3 H: o# G" z
  340.                 # Enable net.ipv6.conf.all.forwarding for the system" {" l( e  N; ^% Z8 ^, K2 A
  341.                 echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/99-openvpn-forward.conf
    $ o! s& z' E- I
  342.                 # Enable without waiting for a reboot or service restart2 ?' i. y% _' k- T$ e, @- w' n9 {
  343.                 echo 1 > /proc/sys/net/ipv6/conf/all/forwarding" [4 n0 y- s/ ]. @
  344.         fi! S/ i4 D# \& c9 a+ a8 ~$ V
  345.         if systemctl is-active --quiet firewalld.service; then' S( m0 G1 \) p  |3 G/ u) Z
  346.                 # Using both permanent and not permanent rules to avoid a firewalld  E% g9 c8 C$ L- a# w- g
  347.                 # reload., z: i7 g$ b! p( v% a# k
  348.                 # We don't use --add-service=openvpn because that would only work with( l( ^  ^9 }, [, `  |/ s
  349.                 # the default port and protocol.
    : |$ V) Y; a8 @0 d
  350.                 firewall-cmd --add-port="$port"/"$protocol"
    7 n' E" d0 s  y- ]6 r
  351.                 firewall-cmd --zone=trusted --add-source=10.8.0.0/24
    + Q. P) ], d; L
  352.                 firewall-cmd --permanent --add-port="$port"/"$protocol"
      x: d$ F6 w; T
  353.                 firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
    0 z  Z# v4 s+ K
  354.                 # Set NAT for the VPN subnet. D0 S  M  f( Q( t
  355.                 firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"# f# q% |: C0 v9 M* u, i
  356.                 firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"6 a* \1 S: C/ L6 T1 W9 r4 E+ N
  357.                 if [[ -n "$ip6" ]]; then9 L/ k8 d0 C& S6 K/ B, o& R/ S/ S6 z
  358.                         firewall-cmd --zone=trusted --add-source=fddd:1194:1194:1194::/64/ m' }" [8 ^7 [, r. P& G: U5 t, S
  359.                         firewall-cmd --permanent --zone=trusted --add-source=fddd:1194:1194:1194::/64
    - a9 E8 e; V) t) D; X: ]; M, R# l- \
  360.                         firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
    6 [$ z6 f* n3 q9 g' c. i8 N# s
  361.                         firewall-cmd --permanent --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
    ( i9 N( O+ i; `* U
  362.                 fi" L% [, e! o) ?6 z4 a
  363.         else
    8 G% ?1 o" h& ]* O: @
  364.                 # Create a service to set up persistent iptables rules. Y. v* c/ W: H4 z3 h
  365.                 iptables_path=$(command -v iptables)) G  f# M! e2 G  _
  366.                 ip6tables_path=$(command -v ip6tables)
    ! Z$ Y* C8 Q2 E/ o% `  W
  367.                 # nf_tables is not available as standard in OVZ kernels. So use iptables-legacy6 `0 [& b: R- ^' @4 x8 g: z4 N
  368.                 # if we are in OVZ, with a nf_tables backend and iptables-legacy is available.
    ( Z+ I) a. x# E8 q% O
  369.                 if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then
    : B( @1 H! P$ |6 l- P+ D
  370.                         iptables_path=$(command -v iptables-legacy)8 C$ P5 {! ]6 r0 {2 N& [9 T
  371.                         ip6tables_path=$(command -v ip6tables-legacy)
    6 d7 @! A) V. Z/ g: o
  372.                 fi
    4 Y: c9 N5 d& P& b0 z! z( R
  373.                 echo "[Unit]0 X; |; p+ I( Z3 x, n
  374. Before=network.target8 S3 V2 X4 M1 o, y9 \
  375. [Service]: M0 o% `5 G; N5 k& Y
  376. Type=oneshot+ Y* q2 p7 x# b2 }2 @
  377. ExecStart=$iptables_path -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip5 K2 y' O/ C$ B6 E* ^, R
  378. ExecStart=$iptables_path -I INPUT -p $protocol --dport $port -j ACCEPT
    6 T+ j0 Z' W2 u) h& V4 |2 `* N! E
  379. ExecStart=$iptables_path -I FORWARD -s 10.8.0.0/24 -j ACCEPT- X4 y; K: O; I. |7 y
  380. ExecStart=$iptables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    & w7 u" d9 l% o$ c* p
  381. ExecStop=$iptables_path -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
    7 I5 o$ A- D" g' U, D
  382. ExecStop=$iptables_path -D INPUT -p $protocol --dport $port -j ACCEPT8 F& U6 j( R- U
  383. ExecStop=$iptables_path -D FORWARD -s 10.8.0.0/24 -j ACCEPT
    . p2 u0 S! R: b% T2 Z4 {+ r
  384. ExecStop=$iptables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > /etc/systemd/system/openvpn-iptables.service$ D; W* a3 B0 R: v8 ~/ {
  385.                 if [[ -n "$ip6" ]]; then
    1 V/ ~4 U3 z9 q7 L3 g
  386.                         echo "ExecStart=$ip6tables_path -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
    5 v' C* m& e/ u8 c1 Q: `
  387. ExecStart=$ip6tables_path -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
    5 X+ E0 }) g  R) R! j
  388. ExecStart=$ip6tables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
    % l% H! n+ o7 F
  389. ExecStop=$ip6tables_path -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
      i( o" O7 \  |' v! o* v
  390. ExecStop=$ip6tables_path -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
    1 e- ^+ G6 V! a. z" H
  391. ExecStop=$ip6tables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> /etc/systemd/system/openvpn-iptables.service8 l1 O3 d, ^. P$ _( t- k8 ^
  392.                 fi
    ! @. ^8 z1 n' C0 Y/ x) l+ {6 s
  393.                 echo "RemainAfterExit=yes) G( v) H2 X1 f6 J
  394. [Install]
    " |  L* ^$ F/ a0 r
  395. WantedBy=multi-user.target" >> /etc/systemd/system/openvpn-iptables.service
    3 F4 {7 s2 M* x8 c5 y. [/ t
  396.                 systemctl enable --now openvpn-iptables.service
    . J* X6 @7 N) j: m, p2 Z+ s  W: ~
  397.         fi
    : ]  s  ]& H4 t" [6 H, U5 t
  398.         # If SELinux is enabled and a custom port was selected, we need this: H" m5 S4 V$ @1 W
  399.         if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then" t8 ~* J8 W" b2 Q# C
  400.                 # Install semanage if not already present
    : [) E, s: l' R3 V, \- I
  401.                 if ! hash semanage 2>/dev/null; then+ h5 L) U; B. I% [
  402.                         if [[ "$os_version" -eq 7 ]]; then( j0 i' g$ j0 ?" Y& m/ v: h
  403.                                 # Centos 76 b- q4 ]% O! m; i& B- b
  404.                                 yum install -y policycoreutils-python: S8 L  V: W8 x) h
  405.                         else5 |# q1 B7 j) U& O6 I1 z7 C
  406.                                 # CentOS 8 or Fedora' f5 z# O! p& s& \" }
  407.                                 dnf install -y policycoreutils-python-utils
    4 {/ S, n% j! G: y
  408.                         fi& u" J) B, y+ C
  409.                 fi1 U* G. w5 y6 R! J/ U
  410.                 semanage port -a -t openvpn_port_t -p "$protocol" "$port") e# d& L' J, Z/ r+ y" N8 c
  411.         fi
    $ n$ l% J7 ^$ Q! h
  412.         # If the server is behind NAT, use the correct IP address9 d" Z( Z8 t% ?' [1 B6 J7 z
  413.         [[ -n "$public_ip" ]] && ip="$public_ip"
    6 ^! v& `0 Q' O; c* C7 p, G& W( }
  414.         # client-common.txt is created so we have a template to add further users later5 m1 `+ f! \7 I7 w# s. ^- n
  415.         echo "client
    7 m- @8 V/ Y* ~) [/ Z
  416. dev tun$ j) B1 Z) ~6 _5 W
  417. proto $protocol
    1 x0 W. T# V) F
  418. remote $ip $port
    8 v6 x/ _$ j! d- E0 d
  419. resolv-retry infinite8 ?: E4 Q, Z  H2 H) ~
  420. nobind
    " P: u: K; B! P
  421. persist-key% O# p) a6 t& O7 k6 c4 k. p
  422. persist-tun
      b6 s2 y" S5 o. y- w! T5 T  ^
  423. remote-cert-tls server
    4 ]$ H: U3 q( I  C8 H
  424. auth SHA512
    ( ^( M) C7 z+ ?  n& C
  425. cipher AES-256-CBC2 U, Z% J" B! n% [( y) b2 r5 {
  426. ignore-unknown-option block-outside-dns
    6 p' w. Q( F  ?; f
  427. block-outside-dns
    ; i+ `0 Y* a. r7 g" e! F1 x
  428. verb 3" > /etc/openvpn/server/client-common.txt
    ; k8 b2 L2 [4 C$ v
  429.         # Enable and start the OpenVPN service5 h/ ]4 W& [: k6 B$ ?" }1 B
  430.         systemctl enable --now openvpn-server@server.service: q0 ^( i) i% h' i# t
  431.         # Generates the custom client.ovpn! t3 \, G1 m" A0 z) F1 j- E
  432.         new_client2 p  [! l, M8 B6 `( h) e: [# X0 B
  433.         echo
    / t; C& V& U$ k  y, f
  434.         echo "Finished!"# a* ]8 k" }5 J6 M( f
  435.         echo
    / O6 o; t% }3 D( F
  436.         echo "The client configuration is available in:" ~/"$client.ovpn"
    " e8 V3 R: G& u' W
  437.         echo "New clients can be added by running this script again."
    : A/ k8 m" O7 ~  ^4 W7 i
  438. else
    ! \4 H$ g' O$ R5 A2 C# ~
  439.         clear% g3 [) r0 o( K4 o; Y7 m: B& G
  440.         echo "OpenVPN is already installed."
    : M8 U+ ?1 ?, x
  441.         echo3 L1 c2 S7 W4 D. }8 O) h: `
  442.         echo "Select an option:"9 D! i8 m7 z) I! \4 Y- W- N
  443.         echo "   1) Add a new client"
    7 ^) G- G  M2 }" i9 v9 l1 i& ~
  444.         echo "   2) Revoke an existing client"
    5 r. S8 P1 t1 n3 f7 V5 u
  445.         echo "   3) Remove OpenVPN"
    ( E/ ]  C# i( r! e; X% S: Q
  446.         echo "   4) Exit". }! B8 @. R0 q9 J+ `
  447.         read -p "Option: " option$ l  L* n, [% d& R. A
  448.         until [[ "$option" =~ ^[1-4]$ ]]; do2 }1 `5 q  J; [5 O2 F# c
  449.                 echo "$option: invalid selection."
    , N0 H% @% q) Z1 n
  450.                 read -p "Option: " option
    " ?5 C8 @* Q3 I& h% o
  451.         done- Z$ u" Q6 r4 {6 \6 D& n
  452.         case "$option" in
    : z& q4 I) `$ W4 i& ]3 _
  453.                 1): S. f. M4 K3 Y6 _
  454.                         echo
    * c( @; q  S/ a$ b
  455.                         echo "Provide a name for the client:"" G* m4 ~; E; X9 H
  456.                         read -p "Name: " unsanitized_client3 f& S+ M0 I7 q! b8 v
  457.                         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
    . ?: I9 G# _) B% A% u' i
  458.                         while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do  U* ?9 [1 e4 e) _) ^3 n
  459.                                 echo "$client: invalid name."
    / q2 l+ Q8 u3 c+ D& m
  460.                                 read -p "Name: " unsanitized_client7 \) h& _# ~& b4 X
  461.                                 client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
    & Z( b# D: B+ ^3 o
  462.                         done
    . j% s( K& c5 R) ~
  463.                         cd /etc/openvpn/server/easy-rsa/- [! M9 @: F, C+ Y3 R( f
  464.                         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
    8 _* f* T# h5 A- y
  465.                         # Generates the custom client.ovpn
    % l$ }( ]7 o! U
  466.                         new_client
    ( J: R7 r! {3 |# O* I% Y
  467.                         echo; _6 _8 t2 H/ f0 \
  468.                         echo "$client added. Configuration available in:" ~/"$client.ovpn"
    - s' y) m" W7 m) w% T$ A
  469.                         exit) q2 r2 m9 `3 C7 l( l, G" G
  470.                 ;;
    9 U6 n) N0 T" c; z3 Z' e
  471.                 2)
    * X  Z0 q4 S$ n  P
  472.                         # This option could be documented a bit better and maybe even be simplified& c1 D; H% x+ g6 y4 E1 U$ I9 F
  473.                         # ...but what can I say, I want some sleep too3 M6 ?& C# K8 L  j7 f( t
  474.                         number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
    : r; ~  }& l7 X1 g! t
  475.                         if [[ "$number_of_clients" = 0 ]]; then
    * d9 @+ R& E/ y& w
  476.                                 echo
    1 s* `& ~, U* c7 U* t4 {$ r
  477.                                 echo "There are no existing clients!"
    & g: [1 P- f  B% K2 T
  478.                                 exit
    ' k, V" Z% Z* p) h/ n5 }) `
  479.                         fi6 Q9 x$ T/ D1 R2 ], I
  480.                         echo
    " K8 b/ o  s9 L3 k$ Q
  481.                         echo "Select the client to revoke:"" X2 Y, E! ]0 L# M+ X$ Q' Z
  482.                         tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
    " M# b* |3 }& Z2 r
  483.                         read -p "Client: " client_number- ~4 l! j  q) x, m# Y
  484.                         until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
    0 K: Y% {* [& K! ^4 p7 N
  485.                                 echo "$client_number: invalid selection."+ B+ |  y: q. @8 C7 f5 R8 z8 h
  486.                                 read -p "Client: " client_number
    7 _8 j8 [8 b9 J3 E" E
  487.                         done# v% t  a; D  v
  488.                         client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)' o" D$ x# t# Y, A
  489.                         echo* W9 M4 D4 ~7 w) w: f
  490.                         read -p "Confirm $client revocation? [y/N]: " revoke
    / X8 r! N, G! q2 f+ R; |6 e7 U4 d
  491.                         until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
    : X5 c9 x$ |1 d0 E- ?. Q
  492.                                 echo "$revoke: invalid selection."* Q# a- u" x, f% u- P7 M2 y
  493.                                 read -p "Confirm $client revocation? [y/N]: " revoke
    7 j5 ~  p/ A" n( ?* H' G0 L/ }' u
  494.                         done7 C) {7 u- o# p: [
  495.                         if [[ "$revoke" =~ ^[yY]$ ]]; then3 T4 ^8 {; N+ p6 `% |8 G
  496.                                 cd /etc/openvpn/server/easy-rsa/# x$ L1 M) E( Z
  497.                                 ./easyrsa --batch revoke "$client"
    5 g" i- V( }& j* n+ M, }
  498.                                 EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
    1 r. X% R0 T. D1 D' k/ l3 S: L) W
  499.                                 rm -f /etc/openvpn/server/crl.pem  n. q$ n* N5 u4 }$ S# \- K
  500.                                 cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem( q) N* X5 u# c3 }( X
  501.                                 # CRL is read with each client connection, when OpenVPN is dropped to nobody' s7 _3 G, F' W7 ^- h; A9 l% `
  502.                                 chown nobody:"$group_name" /etc/openvpn/server/crl.pem
    3 V5 U& o2 k* b& D
  503.                                 echo7 m$ z2 E0 ^4 B9 Q2 [, B
  504.                                 echo "$client revoked!"
    ' p( V# H- v& g3 i
  505.                         else. C0 \3 z' e* U7 S: |+ q' e
  506.                                 echo
    # n4 o" s: H2 x8 \# _( X. m
  507.                                 echo "$client revocation aborted!"; `/ m1 j- d( _% S6 x8 V, B
  508.                         fi# ]* t! G/ I8 h# H7 Y) B
  509.                         exit$ o$ ^- B+ \# l9 O
  510.                 ;;
    3 z- _- X$ o& M, y2 `* Q- ^
  511.                 3)
    9 X( r2 g0 S+ x/ H0 e7 Q5 Y. H
  512.                         echo% p! \( S5 d1 [; [) b6 Q9 [
  513.                         read -p "Confirm OpenVPN removal? [y/N]: " remove
    / r3 M2 F6 U5 A- |# F; c
  514.                         until [[ "$remove" =~ ^[yYnN]*$ ]]; do# `0 t+ t8 h! ^& y
  515.                                 echo "$remove: invalid selection."1 S3 y( \8 E# a3 B5 H" N( a
  516.                                 read -p "Confirm OpenVPN removal? [y/N]: " remove! `3 r) c4 s$ M9 s
  517.                         done" j9 D1 {& w9 G0 @1 m8 t+ X  g% F" h
  518.                         if [[ "$remove" =~ ^[yY]$ ]]; then& j" m6 J0 _. z1 {, p$ u
  519.                                 port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
    6 D/ v; E. B9 n( \
  520.                                 protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)0 C2 Z9 J! s- o
  521.                                 if systemctl is-active --quiet firewalld.service; then9 T5 a( c. B5 `; v  a' r0 j* D# V. f
  522.                                         ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$'), n6 [& w" [+ X) y
  523.                                         # Using both permanent and not permanent rules to avoid a firewalld reload.0 t0 \6 @/ e& J7 w& b* l  D# Q
  524.                                         firewall-cmd --remove-port="$port"/"$protocol"
    - `6 `& x& R  x! C8 u1 O
  525.                                         firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
    ' L# b* m: B0 j, I! X
  526.                                         firewall-cmd --permanent --remove-port="$port"/"$protocol"% P, }6 \/ Q2 T& T
  527.                                         firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24# b' Z$ l, e6 }5 y+ F2 v
  528.                                         firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"/ ]4 L) j9 x. x0 d6 T# z3 B
  529.                                         firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
    ( R+ t  E3 q5 B  `% {
  530.                                         if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
    ) Q/ A1 g+ A" t8 D5 c6 @: S: ^% t/ Q
  531.                                                 ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
    , |. a& |- [: z, M9 L$ P" d$ g
  532.                                                 firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64! O5 Z: D. Z5 D6 K. g- e8 ^
  533.                                                 firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/645 c' p' j# ^, s$ R+ k( X
  534.                                                 firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"! ~- I8 m8 ]# y7 ^: O! g) O
  535.                                                 firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"3 l1 d3 }3 Y6 e% x0 w$ p
  536.                                         fi! ~5 ?" ^! e" l* B- S" N
  537.                                 else5 C! g* W$ Y$ h% h) `, L* f0 |5 r+ Y
  538.                                         systemctl disable --now openvpn-iptables.service! @; D% V& G/ ^/ `* h
  539.                                         rm -f /etc/systemd/system/openvpn-iptables.service4 f: ]; A# U) p
  540.                                 fi
    2 l) F1 n! O, T( b) \. T
  541.                                 if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
      I9 w" D0 X7 R! A
  542.                                         semanage port -d -t openvpn_port_t -p "$protocol" "$port"+ p% s* B7 Q4 `9 ], k
  543.                                 fi
      Z6 t' Y9 A8 U- n3 T
  544.                                 systemctl disable --now openvpn-server@server.service7 b* n' t, o0 N( k' o/ _
  545.                                 rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
    . j/ d5 R3 w) P" g9 R. |# R% y6 d
  546.                                 rm -f /etc/sysctl.d/99-openvpn-forward.conf- B  W, q1 y& g$ O/ [- ?! x
  547.                                 if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
    # t6 y7 R! d: C
  548.                                         rm -rf /etc/openvpn/server2 r* \& ?+ J( x$ M8 t5 k
  549.                                         apt-get remove --purge -y openvpn3 r: N1 Y) r" d3 a1 J/ m
  550.                                 else
    1 I5 ~" v8 c: S
  551.                                         # Else, OS must be CentOS or Fedora
      G1 D7 D& R# C
  552.                                         yum remove -y openvpn! c+ e0 J; ?' D! l0 S8 l
  553.                                         rm -rf /etc/openvpn/server+ S) Q# |5 y1 T: F! E8 Y/ d( z2 b
  554.                                 fi
    0 b2 [5 o% [* t  K: I( y4 c& @: O/ z
  555.                                 echo
    1 Z  ^0 a8 b4 T4 d6 y$ }9 J" s
  556.                                 echo "OpenVPN removed!"
    ; J% z, \, G/ @) q' r! Z
  557.                         else$ |2 h  i3 M4 F9 K" {$ Q; m( {1 i
  558.                                 echo
    # q! b$ j( m7 t$ B
  559.                                 echo "OpenVPN removal aborted!"
    ( d' P: l$ ^" G; i  y# [
  560.                         fi0 K+ u2 ?9 i4 `/ q- C! \9 b
  561.                         exit
      Y+ Q8 Q; w6 u3 {, O
  562.                 ;;
    2 ~& \( @3 W: X
  563.                 4)
      v" _3 M8 \6 ^
  564.                         exit
    ; M# v! L4 D( q7 X" c  ]6 S, }
  565.                 ;;9 d: Q4 o5 h/ O. `! b4 }( t
  566.         esac, U. v; ?) J: [# U7 l
  567. fi
    * H9 Q0 c" f0 E! D9 c6 K
复制代码

! R1 Q1 a- Z+ G$ J9 j* {. y' M- V# M9 o+ e! f
+ {, j: e: z2 h# J2 J8 _
! n3 V1 l' J+ F  w: W) f% M

shadowsocks-all.sh

601.59 KB, 下载次数: 12, 下载积分: 金钱 -5

shadowsocks-all.sh
回复

使用道具 举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

Archiver|手机版|小黑屋|

GMT+8, 2026-11-3 04:43 AM , Processed in 0.099445 second(s), 26 queries .

Powered by xyh-moon X3.5

© 2001-2026 Discuz! Team.

快速回复 返回顶部 返回列表