minor rename and improvements

[vpn-setup] / vpn-server-setup

diff --git a/vpn-server-setup b/vpn-server-setup
index 5c21d4ea250f281756f2697bcfa85c6d90ada81e..4dcb2158c721f709dff01a5bc977e515e8a31f0a 100755 (executable)
--- a/vpn-server-setup
+++ b/vpn-server-setup
@@ -19,19 +19,26 @@ trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
 
 [[ $EUID == 0 ]] || exec sudo -E "$BASH_SOURCE" "$@"
 
+dns=true
 case $1 in
+    -d)
+        dns=false
+        ;;
     -h|--help|*)
         cat <<'EOF'
-usage: ${0##*/}
+usage: ${0##*/} [-d|-h|--help]
+
+-d  Do not push dns
+-h --help print help
 
 Sets up a vpn server which pushes gateway route and dns server
 so all traffic goes through the vpn. requires systemd,
 and might have some debian specific paths.
 EOF
+        exit
         ;;
 esac
 
-
 apt-get update
 # suggests get's us openssl & easy rsa
 apt-get install --install-suggests -y openvpn
@@ -54,7 +61,12 @@ echo -e '\n\n\n\n\n\n\n\n' | ./build-ca
 cp /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz /etc/openvpn/
 cp /etc/openvpn/easy-rsa/keys/{ca.crt,server.{crt,key},dh2048.pem} /etc/openvpn
 gzip -df /etc/openvpn/server.conf.gz
-sed -i --follow-symlinks 's/^dh dh1024.pem/dh dh2048.pem/' /etc/openvpn/server.conf
+# dh improve security,
+# remove comp-lzo to increase perf
+sed -i --follow-symlinks -f - /etc/openvpn/server.conf <<'EOF'
+s/^dh dh1024.pem/dh dh2048.pem/
+/^comp-lzo.*/d
+EOF
 
 teeu() {
     while read -r line; do
@@ -62,15 +74,27 @@ teeu() {
     done
 }
 
-# Be the default gateway for clients.
 teeu /etc/openvpn/server.conf <<'EOF'
+# not in example config, but openvpn outputs a warning about insecure
+# cipher without a setting like this (the default i can understand due
+# to compatibility issues, but not changing the example config... not
+# cool). exact cipher taken from config of vpn provider I trust. This
+# requires the same setting on the client side.
+cipher aes-256-cbc
+# Be the default gateway for clients.
 push "redirect-gateway def1"
+# just sets up the ability to have client specific configs
+client-config-dir /etc/openvpn/client-config
 EOF
+mkdir -p /etc/openvpn/client-config
 
-# Be the dns server for clients
-teeu /etc/openvpn/server.conf <<'EOF'
+
+if $dns; then
+    # Be the dns server for clients
+    teeu /etc/openvpn/server.conf <<'EOF'
 push "dhcp-option DNS 10.8.0.1"
 EOF
+fi
 
 echo "1" > /proc/sys/net/ipv4/ip_forward
 sed -i --follow-symlinks '/^ *net\.ipv4\.ip_forward=.*/d' /etc/sysctl.conf
@@ -81,7 +105,7 @@ EOF
 
 gw=$(ip route | sed -rn 's/^default via .* dev (\S+).*/\1/p')
 
-sudo dd of=/etc/systemd/system/mynat.service <<EOF
+sudo dd of=/etc/systemd/system/vpnnat.service <<EOF
 [Unit]
 Description=Turns on nat iptables setting
 
@@ -92,10 +116,10 @@ ExecStart=/sbin/iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o $gw -j MASQUERA
 ExecStop=/sbin/iptables -t nat -D POSTROUTING -s 10.8.0.0/24 -o $gw -j MASQUERADE
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=openvpn.service
 EOF
 systemctl daemon-reload # needed if the file was already there
-systemctl enable mynat.service
-systemctl start mynat.service
+systemctl enable vpnnat.service
+systemctl start vpnnat.service
 
 systemctl restart openvpn@server