shadowsocks-all.sh

fudyou

2 \* `, G% s8 ]5 t2 V6 Q5 B5 ^+ S

1. #!/bin/bash
   
2. #
   4 ?% m8 v4 N# a8 n2 A
3. # https://github.com/Nyr/openvpn-install
   
4. #
   : E6 o% F3 g6 [3 J
5. # Copyright (c) 2013 Nyr. Released under the MIT License.
   
6. 
   0 C' X( p  z8 a- t) e1 s" S% _
7. 
   
8. # Detect Debian users running the script with "sh" instead of bash
   / ~1 U0 u; O1 X8 t5 x
9. if readlink /proc/$$/exe | grep -q "dash"; then
   - C4 @1 c  W. G" U7 @
10.         echo 'This installer needs to be run with "bash", not "sh".'
    6 |) C5 T% U' k7 B
11.         exit
    % A1 q# o: [0 x  @( i0 f/ d
12. fi
    
13. 
    - `( u! w2 k7 U; l3 ]  @
14. # Discard stdin. Needed when running from an one-liner which includes a newline
    $ X6 C0 y7 ^' S2 Y4 O% t: h: N
15. read -N 999999 -t 0.001
    
16. 
    
17. # Detect OpenVZ 6
    ) i0 W+ x! Q9 N4 m& Z+ S
18. if [[ $(uname -r | cut -d "." -f 1) -eq 2 ]]; then
    
19.         echo "The system is running an old kernel, which is incompatible with this installer."
    
20.         exit
    ' H# }9 Q& I. @# [
21. fi
    - O9 v0 F% L, j  b0 {& O
22. 
    
23. # Detect OS
    ( n$ I/ o4 |1 @6 X
24. # $os_version variables aren't always in use, but are kept here for convenience
    
25. if grep -qs "ubuntu" /etc/os-release; then
    
26.         os="ubuntu"
    5 w  r0 m0 e, h" e! ?6 s2 ]
27.         os_version=$(grep 'VERSION_ID' /etc/os-release | cut -d '"' -f 2 | tr -d '.')
    ( f7 q/ T" d  P4 ~' {
28.         group_name="nogroup"
    
29. elif [[ -e /etc/debian_version ]]; then
    
30.         os="debian"
    1 Y, j6 ?" ]! A( L) |! [2 A; e" d
31.         os_version=$(grep -oE '[0-9]+' /etc/debian_version | head -1)
    . K. J0 I; Z. `0 g
32.         group_name="nogroup"
    ! U& Y/ {1 v5 W
33. elif [[ -e /etc/almalinux-release || -e /etc/rocky-release || -e /etc/centos-release ]]; then
    ! ^7 U3 n5 j/ _7 i: y/ M" ]5 r1 g
34.         os="centos"
    
35.         os_version=$(grep -shoE '[0-9]+' /etc/almalinux-release /etc/rocky-release /etc/centos-release | head -1)
    
36.         group_name="nobody"
    ' L4 u4 j# @. f! {$ y
37. elif [[ -e /etc/fedora-release ]]; then
    / I2 ^  J6 x- E' \, z' b" S
38.         os="fedora"
    3 C3 X/ P6 \! B0 s
39.         os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)
    
40.         group_name="nobody"
    ( q6 a" U! S! r2 e: }$ Y- f% q
41. else
    ! E% S- D" P/ |( K7 I5 c
42.         echo "This installer seems to be running on an unsupported distribution.
    ) A2 O1 I" p, X. A/ L$ n# K1 {; r
43. Supported distros are Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS and Fedora."
    
44.         exit
    
45. fi
    7 X$ `2 `/ v* @" r" J
46. 
      G. j/ M: C* s# n$ q8 B1 y5 C) e
47. if [[ "$os" == "ubuntu" && "$os_version" -lt 1804 ]]; then
    
48.         echo "Ubuntu 18.04 or higher is required to use this installer.
    
49. This version of Ubuntu is too old and unsupported."
    
50.         exit
    ; T/ o1 r1 {& ?& W7 ?9 B
51. fi
    ; g- O* c/ j0 ?6 \! X
52. 
    
53. if [[ "$os" == "debian" && "$os_version" -lt 9 ]]; then
    
54.         echo "Debian 9 or higher is required to use this installer.
    - w! e/ R0 S$ L: d+ p! v
55. This version of Debian is too old and unsupported."
    + r' j6 n/ ?, a0 m% J, x
56.         exit
    * D0 S6 h# A' V8 @' c. Z
57. fi
    $ w2 g( H# ~9 Z6 s4 L+ c- G
58. 
    1 R+ {8 P$ m1 ~
59. if [[ "$os" == "centos" && "$os_version" -lt 7 ]]; then
    
60.         echo "CentOS 7 or higher is required to use this installer.
    % U3 j5 q7 s7 q# F8 w
61. This version of CentOS is too old and unsupported."
    
62.         exit
    ! A. N! x+ B( u( z6 [
63. fi
    
64. 
    
65. # Detect environments where $PATH does not include the sbin directories
    
66. if ! grep -q sbin <<< "$PATH"; then
    2 x* P; ~3 }! d% J: U5 ~' Q
67.         echo '$PATH does not include sbin. Try using "su -" instead of "su".'
    
68.         exit
    5 r9 l5 C. R( ^* d
69. fi
    9 g, [  V- V9 d( j& y
70. 
      I2 ~/ j1 y- F5 }2 f
71. if [[ "$EUID" -ne 0 ]]; then
    0 N( [. D- M! r2 O
72.         echo "This installer needs to be run with superuser privileges."
    + q3 x- v6 l2 V# \' V# y
73.         exit
      n% z( v$ h1 N# ^0 Z' S
74. fi
    ! B+ g7 S  Y* T+ f  o
75. 
    
76. if [[ ! -e /dev/net/tun ]] || ! ( exec 7<>/dev/net/tun ) 2>/dev/null; then
    
77.         echo "The system does not have the TUN device available.
    / a* Q# X; _/ O
78. TUN needs to be enabled before running this installer."
    
79.         exit
    
80. fi
    * c- ?( [0 F. o# H' m( m9 `
81. 
    + X# ?( T! ?+ X- R. P& y7 B" L
82. new_client () {
    5 d% a0 a- S5 i; ]7 W  l
83.         # Generates the custom client.ovpn
    
84.         {
    
85.         cat /etc/openvpn/server/client-common.txt
    ; k: F$ N" ^7 V6 u
86.         echo "<ca>"
    9 m9 t9 i: R& Y( K
87.         cat /etc/openvpn/server/easy-rsa/pki/ca.crt
    5 A/ |# F* u0 n: g+ r8 \( K5 k
88.         echo "</ca>"
    9 q1 F0 X2 S9 A+ f" f* g- z
89.         echo "<cert>"
    
90.         sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt
    
91.         echo "</cert>"
    
92.         echo "<key>"
    ! {' f' M% a/ W5 p% r$ X
93.         cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key
    
94.         echo "</key>"
    
95.         echo "<tls-crypt>"
    
96.         sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key
    
97.         echo "</tls-crypt>"
    2 S3 ^& }* m" z$ u6 D4 g
98.         } > ~/"$client".ovpn
    
99. }
    
100. 
     ! Y0 c6 H% V+ y$ t1 Z5 i# s
101. if [[ ! -e /etc/openvpn/server/server.conf ]]; then
     
102.         # Detect some Debian minimal setups where neither wget nor curl are installed
     / ?; A; u9 f4 ]# {
103.         if ! hash wget 2>/dev/null && ! hash curl 2>/dev/null; then
     
104.                 echo "Wget is required to use this installer."
     , K- _, [7 j- `/ r9 p5 q: y
105.                 read -n1 -r -p "Press any key to install Wget and continue..."
     
106.                 apt-get update
     " C  X" n5 f) ]& m% i( y
107.                 apt-get install -y wget
     
108.         fi
     $ n2 d/ t  J5 X' ?
109.         clear
     
110.         echo 'Welcome to this OpenVPN road warrior installer!'
     5 \2 T. |4 w# S" {; E( [) M6 O$ B' M
111.         # If system has a single IPv4, it is selected automatically. Else, ask the user
     
112.         if [[ $(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}') -eq 1 ]]; then
     
113.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}')
     ( V: j( b4 c4 a: I  Q
114.         else
     
115.                 number_of_ip=$(ip -4 addr | grep inet | grep -vEc '127(\.[0-9]{1,3}){3}')
     
116.                 echo
     
117.                 echo "Which IPv4 address should be used?"
     
118.                 ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | nl -s ') '
     
119.                 read -p "IPv4 address [1]: " ip_number
     + T( J2 k! O$ f8 o
120.                 until [[ -z "$ip_number" || "$ip_number" =~ ^[0-9]+$ && "$ip_number" -le "$number_of_ip" ]]; do
     
121.                         echo "$ip_number: invalid selection."
     
122.                         read -p "IPv4 address [1]: " ip_number
     $ i! @8 O# w1 q& K7 e
123.                 done
     
124.                 [[ -z "$ip_number" ]] && ip_number="1"
     3 U$ n( s2 S) D, W2 {
125.                 ip=$(ip -4 addr | grep inet | grep -vE '127(\.[0-9]{1,3}){3}' | cut -d '/' -f 1 | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | sed -n "$ip_number"p)
     7 i6 F* S; B6 |4 J+ S  z) o, q
126.         fi
     7 [5 [- k$ q1 M' _+ n
127.         # If $ip is a private IP address, the server must be behind NAT
     * ~$ b. U: Z5 F
128.         if echo "$ip" | grep -qE '^(10\.|172\.1[6789]\.|172\.2[0-9]\.|172\.3[01]\.|192\.168)'; then
     0 M, M/ c" @: G7 m: b0 ~3 W
129.                 echo
     
130.                 echo "This server is behind NAT. What is the public IPv4 address or hostname?"
       t2 b" n- V* H7 |% L
131.                 # Get public IP and sanitize with grep
     
132.                 get_public_ip=$(grep -m 1 -oE '^[0-9]{1,3}(\.[0-9]{1,3}){3}$' <<< "$(wget -T 10 -t 1 -4qO- "http://ip1.dynupdate.no-ip.com/" || curl -m 10 -4Ls "http://ip1.dynupdate.no-ip.com/")")
     ! K, f$ R' m# Q0 W3 R- |
133.                 read -p "Public IPv4 address / hostname [$get_public_ip]: " public_ip
     $ B4 c+ h, J4 U* v% i
134.                 # If the checkip service is unavailable and user didn't provide input, ask again
     
135.                 until [[ -n "$get_public_ip" || -n "$public_ip" ]]; do
     
136.                         echo "Invalid input."
     
137.                         read -p "Public IPv4 address / hostname: " public_ip
     + s  [% s1 Q$ [' t
138.                 done
     
139.                 [[ -z "$public_ip" ]] && public_ip="$get_public_ip"
     
140.         fi
     0 x! |( D/ c% h$ }# d
141.         # If system has a single IPv6, it is selected automatically
     & C1 p* a4 p  _* Y
142.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -eq 1 ]]; then
     " Z; ?* D; v4 T  b
143.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}')
     7 e4 ^# J0 j3 `3 V; ]
144.         fi
     % _. G6 C+ Y+ c/ M! U) a
145.         # If system has multiple IPv6, ask the user to select one
     
146.         if [[ $(ip -6 addr | grep -c 'inet6 [23]') -gt 1 ]]; then
     
147.                 number_of_ip6=$(ip -6 addr | grep -c 'inet6 [23]')
     & Z) q$ x3 g0 D9 r  U# ?8 f
148.                 echo
     # z8 L, y/ J$ c/ s7 \/ M3 h! f9 T, w  G
149.                 echo "Which IPv6 address should be used?"
     0 q9 R# i7 S- T2 T0 D9 m
150.                 ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | nl -s ') '
     ! v9 z' G3 s, Z0 d
151.                 read -p "IPv6 address [1]: " ip6_number
     
152.                 until [[ -z "$ip6_number" || "$ip6_number" =~ ^[0-9]+$ && "$ip6_number" -le "$number_of_ip6" ]]; do
     - X3 `/ I5 Y/ r2 c
153.                         echo "$ip6_number: invalid selection."
     4 h# Q( y9 n& u4 E
154.                         read -p "IPv6 address [1]: " ip6_number
     
155.                 done
     / Y% z' B0 `6 a( M$ N& F
156.                 [[ -z "$ip6_number" ]] && ip6_number="1"
     
157.                 ip6=$(ip -6 addr | grep 'inet6 [23]' | cut -d '/' -f 1 | grep -oE '([0-9a-fA-F]{0,4}:){1,7}[0-9a-fA-F]{0,4}' | sed -n "$ip6_number"p)
     
158.         fi
     % C3 h; x. D1 [
159.         echo
     7 u# m' u( i- H1 S7 b& A
160.         echo "Which protocol should OpenVPN use?"
     8 C* R0 m3 J8 ]) `4 r1 @
161.         echo "   1) UDP (recommended)"
     
162.         echo "   2) TCP"
     / Q9 ]9 a& S1 T/ J7 ?% D$ k
163.         read -p "Protocol [1]: " protocol
     
164.         until [[ -z "$protocol" || "$protocol" =~ ^[12]$ ]]; do
     
165.                 echo "$protocol: invalid selection."
     
166.                 read -p "Protocol [1]: " protocol
     
167.         done
     
168.         case "$protocol" in
     4 _- u+ B1 R) O! G6 ]
169.                 1|"")
     . d% o# x) @+ @
170.                 protocol=udp
     
171.                 ;;
     ( ?5 S+ K7 N" B" W! H
172.                 2)
     
173.                 protocol=tcp
     ' J+ V- f, T' ^
174.                 ;;
     8 L1 c2 d, `$ n8 C/ ~
175.         esac
     4 |3 V# M; H) Y" x9 `
176.         echo
     
177.         echo "What port should OpenVPN listen to?"
     9 E4 B, y9 `* n" S7 f
178.         read -p "Port [1194]: " port
     
179.         until [[ -z "$port" || "$port" =~ ^[0-9]+$ && "$port" -le 65535 ]]; do
     9 P7 ]4 W( c8 h
180.                 echo "$port: invalid port."
     " ~% R$ X* g$ E. [8 s9 w. U
181.                 read -p "Port [1194]: " port
     
182.         done
     
183.         [[ -z "$port" ]] && port="1194"
     - u* q/ V- Q8 X* D( c/ E
184.         echo
     & U& p$ W; k- ?: X' w. X
185.         echo "Select a DNS server for the clients:"
     & R6 p' f; c( u% ?8 ^+ f) X  g
186.         echo "   1) Current system resolvers"
     : K3 u, ?4 @' b3 `1 n  M+ |5 f
187.         echo "   2) Google"
     " a* G" ~7 ~% z) t0 u" P: `8 t
188.         echo "   3) 1.1.1.1"
     
189.         echo "   4) OpenDNS"
     
190.         echo "   5) Quad9"
     
191.         echo "   6) AdGuard"
     
192.         read -p "DNS server [1]: " dns
     0 r& X! c0 z* ^2 M* n& J2 w
193.         until [[ -z "$dns" || "$dns" =~ ^[1-6]$ ]]; do
     
194.                 echo "$dns: invalid selection."
     
195.                 read -p "DNS server [1]: " dns
     6 u5 S9 z. N0 E2 N, @5 U- I4 r7 M
196.         done
     
197.         echo
     ( f8 h8 F  G2 `& z
198.         echo "Enter a name for the first client:"
     ! W: t: A5 l, A  K% E1 s5 J' }# r
199.         read -p "Name [client]: " unsanitized_client
     
200.         # Allow a limited set of characters to avoid conflicts
     - v0 `( ?5 M  @, R3 j" @( Y
201.         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     ; x- V1 K' h+ Y6 v$ m$ E. @3 \7 I
202.         [[ -z "$client" ]] && client="client"
     ; U# ~# ?+ W: B
203.         echo
     * s7 S( O. U) z
204.         echo "OpenVPN installation is ready to begin."
     
205.         # Install a firewall if firewalld or iptables are not already available
     
206.         if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then
     3 {  O! s% o+ c! m: q
207.                 if [[ "$os" == "centos" || "$os" == "fedora" ]]; then
     8 j! j6 |! ?& e" Q) `
208.                         firewall="firewalld"
       h$ W; T$ {4 A7 H4 I2 A6 S' [0 T$ U
209.                         # We don't want to silently enable firewalld, so we give a subtle warning
     . j% F- _6 e& X6 N
210.                         # If the user continues, firewalld will be installed and enabled during setup
     ' F& b1 E  ~. E
211.                         echo "firewalld, which is required to manage routing tables, will also be installed."
     . K8 o0 a. K9 m
212.                 elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then
     ) v+ @6 x: n  ?
213.                         # iptables is way less invasive than firewalld so no warning is given
     7 ]- j2 W7 s* }9 o
214.                         firewall="iptables"
     2 |% U& g- L* T- k1 {/ D: E  W
215.                 fi
     9 s" j" |( R# R& Y2 D
216.         fi
     8 H9 K( K( O/ i# e
217.         read -n1 -r -p "Press any key to continue..."
     ' a/ R" K& J* X
218.         # If running inside a container, disable LimitNPROC to prevent conflicts
     ; D/ s; m* P  n) Y
219.         if systemd-detect-virt -cq; then
     
220.                 mkdir /etc/systemd/system/openvpn-server@server.service.d/ 2>/dev/null
     + W( l* Y$ M' c* S  T3 d4 G9 R: F
221.                 echo "[Service]
     
222. LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     1 ?/ `, W* ~* u, D5 X
223.         fi
     6 |2 |# e* Y( Q' G
224.         if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     
225.                 apt-get update
     
226.                 apt-get install -y openvpn openssl ca-certificates $firewall
     
227.         elif [[ "$os" = "centos" ]]; then
     " G6 z1 \/ Y0 `) n$ K
228.                 yum install -y epel-release
     " b% o5 Z6 c0 i# M6 s& U4 q
229.                 yum install -y openvpn openssl ca-certificates tar $firewall
     ! m" F% s, m% O* E5 ^1 q6 e7 }' Q
230.         else
     # C2 z5 c' m# n7 ^1 }, v. s7 z0 T" K
231.                 # Else, OS must be Fedora
     
232.                 dnf install -y openvpn openssl ca-certificates tar $firewall
     ' `5 x# u6 R- S9 w& q
233.         fi
     : @, v6 D) F! }! _
234.         # If firewalld was just installed, enable it
     # b4 }  `$ y' H2 y" c1 K+ F
235.         if [[ "$firewall" == "firewalld" ]]; then
     4 P5 [1 |2 d+ {* k3 ?$ {
236.                 systemctl enable --now firewalld.service
     
237.         fi
     . h) Q& n  H9 p9 w
238.         # Get easy-rsa
     
239.         easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.1.0/EasyRSA-3.1.0.tgz'
     
240.         mkdir -p /etc/openvpn/server/easy-rsa/
     
241.         { wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1
     
242.         chown -R root:root /etc/openvpn/server/easy-rsa/
     ' b3 i; d! I+ \# R; N0 h( d, D( v1 u
243.         cd /etc/openvpn/server/easy-rsa/
     ' h% _8 g- a- g4 M5 [4 B
244.         # Create the PKI, set up the CA and the server and client certificates
     
245.         ./easyrsa init-pki
       D/ k9 r6 Y) z( c8 k
246.         ./easyrsa --batch build-ca nopass
     9 P# l0 K; o: N9 h# m/ z! K! K! v
247.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-server-full server nopass
     
248.         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     
249.         EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     
250.         # Move the stuff we need
     : _, E& @0 V% z1 D/ b5 ?
251.         cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server
     
252.         # CRL is read with each client connection, while OpenVPN is dropped to nobody
     , O2 o* U0 @: |) P& c3 G/ ^( h5 }
253.         chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     
254.         # Without +x in the directory, OpenVPN can't run a stat() on the CRL file
     . c& f! h( h4 n5 g4 E8 a# h
255.         chmod o+x /etc/openvpn/server/
     
256.         # Generate key for tls-crypt
     
257.         openvpn --genkey --secret /etc/openvpn/server/tc.key
     
258.         # Create the DH parameters file using the predefined ffdhe2048 group
     & P6 p. E. X2 [( p
259.         echo '-----BEGIN DH PARAMETERS-----
     0 s/ k' s2 p2 o+ j. F; y
260. MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
     ( s/ n2 Y( o- d9 O/ P
261. +8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
     
262. 87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
     
263. YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
     7 T$ K6 C7 O6 Q) a8 X6 Q$ @$ H* ~0 h
264. 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
     4 K  G9 x8 |+ R7 S. \
265. ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
     
266. -----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem
       n3 |/ y5 A1 n3 ?) O
267.         # Generate server.conf
     ! D8 u7 Y& d# z- C+ Q
268.         echo "local $ip
     
269. port $port
     * X- ^& X' _$ X' Y; i/ l9 Z6 l
270. proto $protocol
     
271. dev tun
     
272. ca ca.crt
     
273. cert server.crt
     
274. key server.key
     
275. dh dh.pem
     
276. auth SHA512
     ; t2 M$ t" b; a
277. tls-crypt tc.key
     
278. topology subnet
     ; y6 m8 d! B# K1 ]
279. server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf
     
280.         # IPv6
     5 F" o6 o6 m2 U0 P, e( J
281.         if [[ -z "$ip6" ]]; then
     
282.                 echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     
283.         else
     
284.                 echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf
     * u! n6 k- r8 W4 |/ d
285.                 echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf
     4 Z) D. ]! }2 W3 V0 F* Z
286.         fi
     + O" T+ d: v0 h, w$ ]7 `
287.         echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf
     . l4 J& U: W. B( x. B& a3 M4 r5 H( e, T
288.         # DNS
     
289.         case "$dns" in
     
290.                 1|"")
     
291.                         # Locate the proper resolv.conf
     
292.                         # Needed for systems running systemd-resolved
     1 U9 e- {8 T- L2 `! {( ]
293.                         if grep -q '^nameserver 127.0.0.53' "/etc/resolv.conf"; then
     
294.                                 resolv_conf="/run/systemd/resolve/resolv.conf"
     4 K  y& U+ \/ d  g- ]
295.                         else
     . q/ w3 o% ~$ k4 g& p+ s2 V+ }+ e0 ^
296.                                 resolv_conf="/etc/resolv.conf"
     
297.                         fi
     
298.                         # Obtain the resolvers from resolv.conf and use them for OpenVPN
     
299.                         grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do
     
300.                                 echo "push "dhcp-option DNS $line"" >> /etc/openvpn/server/server.conf
     
301.                         done
     1 P' C  }4 ~; x( @) Z- {
302.                 ;;
     0 T4 O9 C0 O, }9 u
303.                 2)
     , X1 [2 J3 J$ L. D# L& E, ^
304.                         echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf
     
305.                         echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf
     
306.                 ;;
     
307.                 3)
     3 d, t" b1 [+ I/ G$ S
308.                         echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf
     , V  Y4 p$ d: w
309.                         echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf
     8 P5 k6 {# g  ^/ \$ e8 C
310.                 ;;
     
311.                 4)
     6 z  s. U+ E9 [5 x9 f2 e" E
312.                         echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf
     
313.                         echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf
     4 Y5 p7 m7 w* I; L- i8 ?/ F
314.                 ;;
     4 @0 t$ f# ^  X! m. V
315.                 5)
     
316.                         echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf
     
317.                         echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf
     1 ?/ u$ Z  O  O
318.                 ;;
     - r! _/ i* Z+ M' `2 c. h
319.                 6)
     $ }; J- `! d! c  F+ `1 {4 G4 {
320.                         echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf
     4 t# z/ j3 j- m9 C% G
321.                         echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf
     
322.                 ;;
     8 y" y! v* D: D2 P1 v/ q" H( K
323.         esac
     ; D: c& T8 _( a
324.         echo "keepalive 10 120
     7 A0 m, g3 J2 o0 {: o- j" C
325. cipher AES-256-CBC
     
326. user nobody
     
327. group $group_name
     
328. persist-key
       Y% S; K9 T( S# D+ E& m) k
329. persist-tun
     
330. verb 3
     * I$ _5 Y/ ^% }4 K5 e& L
331. crl-verify crl.pem" >> /etc/openvpn/server/server.conf
     ; y7 G5 s3 Y$ H
332.         if [[ "$protocol" = "udp" ]]; then
     
333.                 echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf
     / j' O( H8 k+ v1 Z3 u/ q7 t3 l2 E
334.         fi
     8 R. B* }  U$ ?& V" h2 n* j: T
335.         # Enable net.ipv4.ip_forward for the system
     ; s5 J% a& Q9 R6 g, M; i) F! n; h
336.         echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/99-openvpn-forward.conf
     / T) n, P# e  a9 o. v2 v; Z
337.         # Enable without waiting for a reboot or service restart
     0 o( Z9 |! F! S% s
338.         echo 1 > /proc/sys/net/ipv4/ip_forward
     
339.         if [[ -n "$ip6" ]]; then
     
340.                 # Enable net.ipv6.conf.all.forwarding for the system
     
341.                 echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/99-openvpn-forward.conf
     
342.                 # Enable without waiting for a reboot or service restart
     8 `+ R0 r7 _6 h" D, U2 [8 Z$ q# V0 l7 M
343.                 echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
     0 E- P1 m8 b5 S/ F9 V0 C4 ?) g3 |4 b
344.         fi
     6 @9 r8 ~2 f% P) t( @
345.         if systemctl is-active --quiet firewalld.service; then
     
346.                 # Using both permanent and not permanent rules to avoid a firewalld
     
347.                 # reload.
     1 S& {  G5 K$ p" k7 D
348.                 # We don't use --add-service=openvpn because that would only work with
     
349.                 # the default port and protocol.
     
350.                 firewall-cmd --add-port="$port"/"$protocol"
     ) S4 k' C0 W) [, M3 p6 z
351.                 firewall-cmd --zone=trusted --add-source=10.8.0.0/24
     
352.                 firewall-cmd --permanent --add-port="$port"/"$protocol"
     
353.                 firewall-cmd --permanent --zone=trusted --add-source=10.8.0.0/24
     
354.                 # Set NAT for the VPN subnet
     1 C) c& G+ ?) T( j3 G! q1 P
355.                 firewall-cmd --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     1 I- d; v% X6 P
356.                 firewall-cmd --permanent --direct --add-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     
357.                 if [[ -n "$ip6" ]]; then
     
358.                         firewall-cmd --zone=trusted --add-source=fddd:1194:1194:1194::/64
     
359.                         firewall-cmd --permanent --zone=trusted --add-source=fddd:1194:1194:1194::/64
     # m$ v  L; d( p( y4 }/ Z3 B! `6 f
360.                         firewall-cmd --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     
361.                         firewall-cmd --permanent --direct --add-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     6 s  j' Z* ]- Q0 i2 q5 H, G
362.                 fi
     
363.         else
     
364.                 # Create a service to set up persistent iptables rules
     
365.                 iptables_path=$(command -v iptables)
     
366.                 ip6tables_path=$(command -v ip6tables)
     
367.                 # nf_tables is not available as standard in OVZ kernels. So use iptables-legacy
     
368.                 # if we are in OVZ, with a nf_tables backend and iptables-legacy is available.
     
369.                 if [[ $(systemd-detect-virt) == "openvz" ]] && readlink -f "$(command -v iptables)" | grep -q "nft" && hash iptables-legacy 2>/dev/null; then
     
370.                         iptables_path=$(command -v iptables-legacy)
     : I! n. C8 z. C+ U. _3 F/ `: e3 r
371.                         ip6tables_path=$(command -v ip6tables-legacy)
     ' p2 p- ?! p3 O$ ^5 G  ]& g# j
372.                 fi
     . `9 `: T) R% P$ n3 ^8 h5 L, y0 _
373.                 echo "[Unit]
     / o: z$ Q1 h( N/ t4 g7 A% ~& H
374. Before=network.target
       x7 K0 V. X( U) I  F) \5 E3 j! }
375. [Service]
     8 i! y5 U! K" g" t, I: v
376. Type=oneshot
     
377. ExecStart=$iptables_path -t nat -A POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     / m4 x2 g$ o$ a% I5 y
378. ExecStart=$iptables_path -I INPUT -p $protocol --dport $port -j ACCEPT
     
379. ExecStart=$iptables_path -I FORWARD -s 10.8.0.0/24 -j ACCEPT
     ; M2 i4 `5 p! [$ B$ i
380. ExecStart=$iptables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     
381. ExecStop=$iptables_path -t nat -D POSTROUTING -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to $ip
     
382. ExecStop=$iptables_path -D INPUT -p $protocol --dport $port -j ACCEPT
     
383. ExecStop=$iptables_path -D FORWARD -s 10.8.0.0/24 -j ACCEPT
     
384. ExecStop=$iptables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" > /etc/systemd/system/openvpn-iptables.service
     " V9 u2 o9 N) j9 ]! l0 z  B3 e# w
385.                 if [[ -n "$ip6" ]]; then
     ) X# w) F6 K3 `- V7 b  A% [
386.                         echo "ExecStart=$ip6tables_path -t nat -A POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     + R. S9 V2 e  ?. z
387. ExecStart=$ip6tables_path -I FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     0 `) Y7 }$ ~  C
388. ExecStart=$ip6tables_path -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
     ! J9 |3 F- ~5 Z
389. ExecStop=$ip6tables_path -t nat -D POSTROUTING -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to $ip6
     
390. ExecStop=$ip6tables_path -D FORWARD -s fddd:1194:1194:1194::/64 -j ACCEPT
     
391. ExecStop=$ip6tables_path -D FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" >> /etc/systemd/system/openvpn-iptables.service
     3 u! q4 d' \# k" J# W" K' D+ I
392.                 fi
     
393.                 echo "RemainAfterExit=yes
     5 j" F4 o' J& j" n3 n; B" o2 `- p1 W
394. [Install]
     8 @" _; }5 v8 o6 j  N
395. WantedBy=multi-user.target" >> /etc/systemd/system/openvpn-iptables.service
     2 n" C$ ]( w. B4 M& Y+ N+ S3 g
396.                 systemctl enable --now openvpn-iptables.service
     
397.         fi
     ! U6 P7 [" V8 U
398.         # If SELinux is enabled and a custom port was selected, we need this
     % \0 L4 }! s2 R5 f
399.         if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     8 d1 a" u6 }0 x+ m6 P
400.                 # Install semanage if not already present
     # b: V) r+ Z% ]8 r
401.                 if ! hash semanage 2>/dev/null; then
     % ]# }# e& ]+ d4 s. o1 l
402.                         if [[ "$os_version" -eq 7 ]]; then
     
403.                                 # Centos 7
     
404.                                 yum install -y policycoreutils-python
     
405.                         else
     
406.                                 # CentOS 8 or Fedora
     1 I! c0 R6 \+ h6 Z# E
407.                                 dnf install -y policycoreutils-python-utils
     
408.                         fi
     
409.                 fi
     + q& R' ]2 |% M5 |& U
410.                 semanage port -a -t openvpn_port_t -p "$protocol" "$port"
     ' I+ d, A# V) R! T
411.         fi
     4 J; g( S! |- C5 B5 T* `, ^6 ~
412.         # If the server is behind NAT, use the correct IP address
     
413.         [[ -n "$public_ip" ]] && ip="$public_ip"
     $ y) N1 }+ g- G4 z# v! U) T
414.         # client-common.txt is created so we have a template to add further users later
     
415.         echo "client
     9 m2 U+ M) s2 s  B
416. dev tun
     . v* W2 V! D! C1 S4 ^+ t* D; Q% O
417. proto $protocol
     ( y$ q+ ?- K/ m
418. remote $ip $port
     7 R8 `" @: O1 h4 W
419. resolv-retry infinite
     
420. nobind
     & W2 o) [3 O8 t4 \4 ~
421. persist-key
     
422. persist-tun
     
423. remote-cert-tls server
     7 x6 H3 d8 x3 x) S6 w5 [0 o! z
424. auth SHA512
     : `+ {/ R; i9 _: m3 [
425. cipher AES-256-CBC
     
426. ignore-unknown-option block-outside-dns
     
427. block-outside-dns
     8 `6 y* c/ x  J- T
428. verb 3" > /etc/openvpn/server/client-common.txt
     ; ~' i3 ^5 ?3 Y5 a- j( [
429.         # Enable and start the OpenVPN service
     
430.         systemctl enable --now openvpn-server@server.service
     + y( Z( |1 t: [! H( E# R
431.         # Generates the custom client.ovpn
     $ W) J; y& N  v  J6 f
432.         new_client
     ' F- ]: L0 a" c, ?1 |
433.         echo
     5 z, S( m4 C6 {8 V$ c7 a0 `
434.         echo "Finished!"
     
435.         echo
     / O' o8 r0 D0 v; }
436.         echo "The client configuration is available in:" ~/"$client.ovpn"
     
437.         echo "New clients can be added by running this script again."
     ' Q2 e3 ^1 y0 K  q' k# f7 t
438. else
     
439.         clear
     0 a4 _; Q9 ?* H* N+ ^  E9 n
440.         echo "OpenVPN is already installed."
     
441.         echo
     
442.         echo "Select an option:"
     
443.         echo "   1) Add a new client"
     
444.         echo "   2) Revoke an existing client"
     " N+ E) m) e, W
445.         echo "   3) Remove OpenVPN"
     
446.         echo "   4) Exit"
     
447.         read -p "Option: " option
     
448.         until [[ "$option" =~ ^[1-4]$ ]]; do
     
449.                 echo "$option: invalid selection."
     / V9 g9 N" ~6 h  \1 z7 |- k6 d8 ~/ f
450.                 read -p "Option: " option
     
451.         done
     ( p( ~% C- s& Y5 w
452.         case "$option" in
     
453.                 1)
     . D% x7 u  R$ i# o2 ^' W, E
454.                         echo
     
455.                         echo "Provide a name for the client:"
     3 e( h- [) b- n8 n! r
456.                         read -p "Name: " unsanitized_client
     : p" b( C) p: M% W3 c# W
457.                         client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     
458.                         while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do
     # a1 G- J  _: h) ]) W- s* E; H& [
459.                                 echo "$client: invalid name."
     
460.                                 read -p "Name: " unsanitized_client
     6 m* F1 B  F1 E! C: l$ z- K
461.                                 client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
     / R1 f& r, n* r( @3 x, {' V3 _
462.                         done
     5 s$ ~5 g. {) N# @  w
463.                         cd /etc/openvpn/server/easy-rsa/
       _' Z; t( Z  c0 K7 C- s9 v
464.                         EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
     ( P% O0 g6 R. t% L9 S3 L
465.                         # Generates the custom client.ovpn
     
466.                         new_client
     ) D* b! @2 i8 i2 O; t
467.                         echo
     
468.                         echo "$client added. Configuration available in:" ~/"$client.ovpn"
     
469.                         exit
     
470.                 ;;
     8 O/ A8 T  F, I# N$ x8 M& N' o
471.                 2)
     
472.                         # This option could be documented a bit better and maybe even be simplified
     
473.                         # ...but what can I say, I want some sleep too
       v: T+ p9 D7 z
474.                         number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V")
     
475.                         if [[ "$number_of_clients" = 0 ]]; then
     ) a, x4 h$ V0 P5 l
476.                                 echo
     0 b( o( n+ l! @  E% `; ~- @2 d- {
477.                                 echo "There are no existing clients!"
     ( A0 Q4 _* }; v7 w( L0 j6 L
478.                                 exit
     
479.                         fi
     
480.                         echo
     0 n6 d8 `; U7 w. ~4 K' h
481.                         echo "Select the client to revoke:"
     
482.                         tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
     0 ?9 }. n5 Q. q: c2 P% M# ]  X
483.                         read -p "Client: " client_number
     . e2 y! X- A# k$ _% y( [
484.                         until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
     7 [) G5 Y1 }1 ?! @7 k4 c
485.                                 echo "$client_number: invalid selection."
     
486.                                 read -p "Client: " client_number
     
487.                         done
     
488.                         client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
     
489.                         echo
     : x! Y: N, u' f  S1 ^: u8 G6 B; J
490.                         read -p "Confirm $client revocation? [y/N]: " revoke
     
491.                         until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
     
492.                                 echo "$revoke: invalid selection."
     / y- q* s: L0 W# p% }3 S
493.                                 read -p "Confirm $client revocation? [y/N]: " revoke
     & l+ F! P, A' N2 C' M
494.                         done
     - W" _% W$ Z1 k; W( [/ e
495.                         if [[ "$revoke" =~ ^[yY]$ ]]; then
     5 j7 O) I8 _  i9 \/ b0 T" `
496.                                 cd /etc/openvpn/server/easy-rsa/
     
497.                                 ./easyrsa --batch revoke "$client"
     
498.                                 EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
     
499.                                 rm -f /etc/openvpn/server/crl.pem
     * T( I& r/ {0 ^6 h4 K
500.                                 cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem
     
501.                                 # CRL is read with each client connection, when OpenVPN is dropped to nobody
     
502.                                 chown nobody:"$group_name" /etc/openvpn/server/crl.pem
     
503.                                 echo
     
504.                                 echo "$client revoked!"
     9 h0 ^2 k" Y" R/ Q9 V) i
505.                         else
       V8 k2 m6 s; K( }
506.                                 echo
     , i; Q2 n3 M$ }# {. X4 Z
507.                                 echo "$client revocation aborted!"
     
508.                         fi
     
509.                         exit
       N# {0 i0 n& L. p% {7 {& X
510.                 ;;
     * P0 O: g$ b! i% t/ X& v
511.                 3)
     9 G  x( v* ?$ ]5 Y
512.                         echo
     
513.                         read -p "Confirm OpenVPN removal? [y/N]: " remove
     
514.                         until [[ "$remove" =~ ^[yYnN]*$ ]]; do
     ( I7 F9 Y1 X6 W2 G
515.                                 echo "$remove: invalid selection."
     
516.                                 read -p "Confirm OpenVPN removal? [y/N]: " remove
     " Q6 z+ {5 p/ u
517.                         done
     
518.                         if [[ "$remove" =~ ^[yY]$ ]]; then
     * A1 b6 h! `, z& n7 F& r* l
519.                                 port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
       ?6 }9 |# f& y1 Q/ {6 ?" F+ q, w, ]
520.                                 protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
     
521.                                 if systemctl is-active --quiet firewalld.service; then
     
522.                                         ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
     
523.                                         # Using both permanent and not permanent rules to avoid a firewalld reload.
     
524.                                         firewall-cmd --remove-port="$port"/"$protocol"
     6 I8 m1 ?* b- U" O" c" M4 o
525.                                         firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
     
526.                                         firewall-cmd --permanent --remove-port="$port"/"$protocol"
     , ?% ~1 j! v- P" ?5 r( Q* f
527.                                         firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
     
528.                                         firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     " _( X4 c5 ~  a( {
529.                                         firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
     ' k5 x6 c( Y6 b1 H$ t
530.                                         if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
     
531.                                                 ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
     
532.                                                 firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     0 K0 U4 u# e5 S! r( m
533.                                                 firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
     ' J& [  p/ D; f
534.                                                 firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     ) b% n( F! u4 l4 i2 `/ ^$ z0 d7 o
535.                                                 firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
     $ \1 I1 Z6 `8 x7 {
536.                                         fi
     0 R; `/ H* J9 U, u8 @
537.                                 else
     ! L; P- G  u% O1 i4 ~
538.                                         systemctl disable --now openvpn-iptables.service
     * _4 [2 m0 |$ {3 b
539.                                         rm -f /etc/systemd/system/openvpn-iptables.service
     
540.                                 fi
     
541.                                 if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
     
542.                                         semanage port -d -t openvpn_port_t -p "$protocol" "$port"
     
543.                                 fi
     ( T/ S( s" p% y* p. Z+ Y- H, o& L
544.                                 systemctl disable --now openvpn-server@server.service
     
545.                                 rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
     " D+ |! n# G9 B  G% u/ }
546.                                 rm -f /etc/sysctl.d/99-openvpn-forward.conf
     
547.                                 if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
     
548.                                         rm -rf /etc/openvpn/server
     
549.                                         apt-get remove --purge -y openvpn
     
550.                                 else
     
551.                                         # Else, OS must be CentOS or Fedora
     " {; G2 E6 A& d' G  b! v3 z  s
552.                                         yum remove -y openvpn
     
553.                                         rm -rf /etc/openvpn/server
       s% F8 V8 N0 N( l
554.                                 fi
     
555.                                 echo
     7 T4 l& z) @3 u" n/ C& H+ }8 O0 H( C
556.                                 echo "OpenVPN removed!"
     
557.                         else
     
558.                                 echo
     . ~+ U. J/ j* j( z& G- J+ G: E4 L
559.                                 echo "OpenVPN removal aborted!"
     2 f& D# e, ^. W3 T8 t
560.                         fi
     
561.                         exit
     ( L7 B7 X4 S, i9 _4 G/ y
562.                 ;;
     
563.                 4)
     
564.                         exit
     
565.                 ;;
     " j, c2 x  e% w  v* {& N
566.         esac
     , c; _2 s$ o+ x5 E7 E% `
567. fi
     # f; x; j/ \0 k# L9 X

复制代码

& F$ c8 {* r/ E9 s5 f* V) }
- V6 O  P. o% I( i, k