iankelling.org Git - vpn-setup/blob - vpn-server-setup

   1 #!/bin/bash
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16
  17 set -eE -o pipefail
  18 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  19
  20 [[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
  21
  22 dns=true
  23 route=true
  24 case $1 in
  25     -r) route=false ;;
  26     -d) dns=false ;;
  27     -h|--help|*)
  28         cat <<'EOF'
  29 usage: ${0##*/} [-d|-h|--help]
  30
  31 -r  Do not push default route
  32 -d  Do not push dns
  33 -h --help print help
  34
  35 Sets up a vpn server which pushes gateway route and dns server
  36 so all traffic goes through the vpn. requires systemd,
  37 and might have some debian specific paths.
  38 EOF
  39         exit
  40         ;;
  41 esac
  42
  43 apt-get update
  44 # suggests get's us openssl & easy rsa
  45 apt-get install --install-suggests -y openvpn
  46 apt-get install -y uuid-runtime
  47 mkdir -p /etc/openvpn/easy-rsa/keys
  48 cd /etc/openvpn/easy-rsa
  49 cp -r /usr/share/easy-rsa/* .
  50 source vars # dun care about setting cert cn etc from the non-example values
  51 ./clean-all
  52 # accept default prompts
  53 echo -e '\n\n\n\n\n\n\n\n' | ./build-ca
  54
  55 # This builds the server's key/cert. argument is the name of the file,
  56 # but it also is the default common name of the cert.
  57 # 'server' is the default name in our conf file for the name of the file
  58 # and I've seen no reason to change it.
  59 # Note, this is not idempotent.
  60 { echo -e '\n\n\n\n\n\n\n\n\n\n'; sleep 1; echo -e 'y\ny\n'; } | ./build-key-server server
  61 ./build-dh
  62 cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
  63 cp /etc/openvpn/easy-rsa/keys/{ca.crt,server.{crt,key},dh2048.pem} /etc/openvpn
  64 gzip -df /etc/openvpn/server.conf.gz
  65 # dh improve security,
  66 # remove comp-lzo to increase perf
  67 sed -i --follow-symlinks -f - /etc/openvpn/server.conf <<'EOF'
  68 s/^dh dh1024.pem/dh dh2048.pem/
  69 /^comp-lzo.*/d
  70 EOF
  71
  72
  73 cat >>/etc/openvpn/server.conf <<'EOF'
  74 # not in example config, but openvpn outputs a warning about insecure
  75 # cipher without a setting like this (the default i can understand due
  76 # to compatibility issues, but not changing the example config... not
  77 # cool). exact cipher taken from config of vpn provider I trust. This
  78 # requires the same setting on the client side.
  79 cipher aes-256-cbc
  80 # just sets up the ability to have client specific configs
  81 client-config-dir /etc/openvpn/client-config
  82 EOF
  83 mkdir -p /etc/openvpn/client-config
  84
  85 if $route; then
  86     cat >>/etc/openvpn/server.conf <<'EOF'
  87 # Be the default gateway for clients.
  88 push "redirect-gateway def1"
  89 EOF
  90 fi
  91
  92 if $dns; then
  93     # Be the dns server for clients
  94     cat >>/etc/openvpn/server.conf <<'EOF'
  95 push "dhcp-option DNS 10.8.0.1"
  96 EOF
  97 fi
  98
  99 echo "1" > /proc/sys/net/ipv4/ip_forward
 100 sed -i --follow-symlinks '/^ *net\.ipv4\.ip_forward=.*/d' /etc/sysctl.conf
 101 cat >>/etc/sysctl.conf <<'EOF'
 102 net.ipv4.ip_forward=1
 103 EOF
 104
 105
 106 gw=$(ip route | sed -rn 's/^default via .* dev (\S+).*/\1/p')
 107
 108 cat >/etc/systemd/system/vpnnat.service <<EOF
 109 [Unit]
 110 Description=Turns on nat iptables setting
 111
 112 [Service]
 113 Type=oneshot
 114 RemainAfterExit=yes
 115 ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o $gw -j MASQUERADE
 116 ExecStop=/sbin/iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $gw -j MASQUERADE
 117
 118 [Install]
 119 WantedBy=openvpn.service
 120 EOF
 121 systemctl daemon-reload # needed if the file was already there
 122 systemctl enable vpnnat.service
 123 systemctl start vpnnat.service
 124
 125 systemctl restart openvpn@server