iankelling.org Git - vpn-setup/blob - vpn-server-setup

   1 #!/bin/bash
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # Licensed under the Apache License, Version 2.0 (the "License");
   5 # you may not use this file except in compliance with the License.
   6 # You may obtain a copy of the License at
   7
   8 #     http://www.apache.org/licenses/LICENSE-2.0
   9
  10 # Unless required by applicable law or agreed to in writing, software
  11 # distributed under the License is distributed on an "AS IS" BASIS,
  12 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13 # See the License for the specific language governing permissions and
  14 # limitations under the License.
  15
  16
  17 set -eE -o pipefail
  18 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  19
  20 [[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
  21
  22 dns=true
  23 case $1 in
  24     -d)
  25         dns=false
  26         ;;
  27     -h|--help|*)
  28         cat <<'EOF'
  29 usage: ${0##*/} [-d|-h|--help]
  30
  31 -d  Do not push dns
  32 -h --help print help
  33
  34 Sets up a vpn server which pushes gateway route and dns server
  35 so all traffic goes through the vpn. requires systemd,
  36 and might have some debian specific paths.
  37 EOF
  38         exit
  39         ;;
  40 esac
  41
  42 apt-get update
  43 # suggests get's us openssl & easy rsa
  44 apt-get install --install-suggests -y openvpn
  45 apt-get install -y uuid-runtime
  46 mkdir -p /etc/openvpn/easy-rsa/keys
  47 cd /etc/openvpn/easy-rsa
  48 cp -r /usr/share/easy-rsa/* .
  49 source vars # dun care about setting cert cn etc from the non-example values
  50 ./clean-all
  51 # accept default prompts
  52 echo -e '\n\n\n\n\n\n\n\n' | ./build-ca
  53
  54 # This builds the server's key/cert. argument is the name of the file,
  55 # but it also is the default common name of the cert.
  56 # 'server' is the default name in our conf file for the name of the file
  57 # and I've seen no reason to change it.
  58 # Note, this is not idempotent.
  59 { echo -e '\n\n\n\n\n\n\n\n\n\n'; sleep 1; echo -e 'y\ny\n'; } | ./build-key-server server
  60 ./build-dh
  61 cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
  62 cp /etc/openvpn/easy-rsa/keys/{ca.crt,server.{crt,key},dh2048.pem} /etc/openvpn
  63 gzip -df /etc/openvpn/server.conf.gz
  64 # dh improve security,
  65 # remove comp-lzo to increase perf
  66 sed -i --follow-symlinks -f - /etc/openvpn/server.conf <<'EOF'
  67 s/^dh dh1024.pem/dh dh2048.pem/
  68 /^comp-lzo.*/d
  69 EOF
  70
  71 teeu() {
  72     while read -r line; do
  73         grep -xFq "$line" "$1" || echo "$line" | tee -a "$1"
  74     done
  75 }
  76
  77 teeu /etc/openvpn/server.conf <<'EOF'
  78 # not in example config, but openvpn outputs a warning about insecure
  79 # cipher without a setting like this (the default i can understand due
  80 # to compatibility issues, but not changing the example config... not
  81 # cool). exact cipher taken from config of vpn provider I trust. This
  82 # requires the same setting on the client side.
  83 cipher aes-256-cbc
  84 # Be the default gateway for clients.
  85 push "redirect-gateway def1"
  86 EOF
  87
  88 if $dns; then
  89     # Be the dns server for clients
  90     teeu /etc/openvpn/server.conf <<'EOF'
  91 push "dhcp-option DNS 10.8.0.1"
  92 EOF
  93 fi
  94
  95 echo "1" > /proc/sys/net/ipv4/ip_forward
  96 sed -i --follow-symlinks '/^ *net\.ipv4\.ip_forward=.*/d' /etc/sysctl.conf
  97 teeu /etc/sysctl.conf <<'EOF'
  98 net.ipv4.ip_forward=1
  99 EOF
 100
 101
 102 gw=$(ip route | sed -rn 's/^default via .* dev (\S+).*/\1/p')
 103
 104 sudo dd of=/etc/systemd/system/mynat.service <<EOF
 105 [Unit]
 106 Description=Turns on nat iptables setting
 107
 108 [Service]
 109 Type=oneshot
 110 RemainAfterExit=yes
 111 ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o $gw -j MASQUERADE
 112 ExecStop=/sbin/iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $gw -j MASQUERADE
 113
 114 [Install]
 115 WantedBy=multi-user.target
 116 EOF
 117 systemctl daemon-reload # needed if the file was already there
 118 systemctl enable mynat.service
 119 systemctl start mynat.service
 120
 121 systemctl restart openvpn@server