Skip to content

Commit a29e4fd

Browse files
gilper0xgilper0x
authored
Update vpn.sh
1 parent 4e905c2 commit a29e4fd

File tree

1 file changed

+65
-46
lines changed

1 file changed

+65
-46
lines changed

‎openvpn/vpn.sh‎

Lines changed: 65 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#!/bin/bash
22
# =========================================
3-
# SETUP OpenVPN
3+
# FIXED OPENVPN SETUP SCRIPT
44
# =========================================
55

66
export DEBIAN_FRONTEND=noninteractive
@@ -10,42 +10,54 @@ MYIP2="s/xxxxxxxxx/$MYIP/g"
1010
NIC=$(ip -o -4 route show to default | awk '{print $5}')
1111
DOMAIN=$(cat /usr/local/etc/xray/domain 2>/dev/null || cat /root/domain 2>/dev/null)
1212

13-
# =========================================
14-
# Install OpenVPN and dependencies
13+
# ---------- Install dependencies ----------
1514
apt purge -y openvpn easy-rsa
15+
apt autoremove -y
16+
apt update
1617
apt install -y openvpn easy-rsa unzip openssl iptables iptables-persistent netfilter-persistent
1718

18-
mkdir -p /etc/openvpn/server/easy-rsa/
19-
cd /etc/openvpn/
20-
wget https://raw.githubusercontent.com/givps/AutoScriptXray/master/openvpn/vpn.zip
21-
unzip vpn.zip && rm -f vpn.zip
22-
chown -R root:root /etc/openvpn/server/easy-rsa/
19+
# ---------- Clean old config ----------
20+
rm -rf /etc/openvpn
21+
mkdir -p /etc/openvpn
22+
23+
# ---------- Download and unzip VPN config ----------
24+
wget -O /etc/openvpn/vpn.zip https://raw.githubusercontent.com/givps/AutoScriptXray/master/openvpn/vpn.zip
25+
unzip /etc/openvpn/vpn.zip -d /etc/openvpn/ && rm -f /etc/openvpn/vpn.zip
26+
mv /etc/openvpn/vpn/server /etc/openvpn/
27+
rm -rf /etc/openvpn/vpn
2328

24-
# PAM plugin
29+
# ---------- Set permissions ----------
30+
chown -R root:root /etc/openvpn/server
31+
chmod 600 /etc/openvpn/server/*.key
32+
chmod 644 /etc/openvpn/server/*.crt /etc/openvpn/server/*.pem
33+
chmod +x /etc/openvpn/server/easy-rsa/easyrsa
34+
35+
# ---------- PAM plugin ----------
2536
mkdir -p /usr/lib/openvpn/
26-
cp /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so \
27-
/usr/lib/openvpn/openvpn-plugin-auth-pam.so
37+
cp -n /usr/lib/x86_64-linux-gnu/openvpn/plugins/openvpn-plugin-auth-pam.so /usr/lib/openvpn/openvpn-plugin-auth-pam.so || true
2838

29-
# Enable OpenVPN services
39+
# ---------- Enable OpenVPN services ----------
3040
sed -i 's/#AUTOSTART="all"/AUTOSTART="all"/g' /etc/default/openvpn
31-
systemctl enable --now openvpn-server@server-tcp-1194
32-
systemctl enable --now openvpn-server@server-udp-1195
41+
systemctl daemon-reload
42+
systemctl enable openvpn-server@server-tcp-1194
43+
systemctl enable openvpn-server@server-udp-1195
44+
systemctl enable openvpn-server@server-tcp-1196
3345

34-
# IPv4 forwarding
46+
# ---------- IPv4 forwarding ----------
3547
echo 1 > /proc/sys/net/ipv4/ip_forward
3648
sed -i 's/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/g' /etc/sysctl.conf
49+
sysctl -p
3750

38-
# =========================================
39-
# Generate client configs with embedded CA + login prompt
51+
# ---------- Make client configs ----------
4052
CA_CONTENT=$(cat /etc/openvpn/server/ca.crt)
4153

4254
make_ovpn() {
43-
local NAME=$1
44-
local PROTO=$2
45-
local PORT=$3
46-
local EXTRA=$4
55+
local NAME=$1
56+
local PROTO=$2
57+
local PORT=$3
58+
local EXTRA=$4
4759

48-
cat > /etc/openvpn/${NAME}.ovpn <<-EOF
60+
cat > /etc/openvpn/${NAME}.ovpn <<-EOF
4961
setenv FRIENDLY_NAME "${NAME^^}"
5062
client
5163
dev tun
@@ -67,37 +79,44 @@ $CA_CONTENT
6779
</ca>
6880
EOF
6981

70-
sed -i $MYIP2 /etc/openvpn/${NAME}.ovpn
71-
cp /etc/openvpn/${NAME}.ovpn /home/vps/public_html/${NAME}.ovpn
82+
sed -i $MYIP2 /etc/openvpn/${NAME}.ovpn
83+
mkdir -p /home/vps/public_html/
84+
cp /etc/openvpn/${NAME}.ovpn /home/vps/public_html/${NAME}.ovpn
85+
}
7286

73-
# TCP 1194
7487
make_ovpn "client-tcp-1194" "tcp" "1194"
75-
76-
# UDP 1195
7788
make_ovpn "client-udp-1195" "udp" "1195"
78-
79-
# SSL (TCP 888)
8089
make_ovpn "client-ssl-888" "tcp" "888"
8190

82-
# =========================================
83-
# Firewall rules for VPN subnets
84-
iptables -t nat -C POSTROUTING -s 10.6.0.0/24 -o $NIC -j MASQUERADE 2>/dev/null
85-
iptables -t nat -I POSTROUTING -s 10.6.0.0/24 -o $NIC -j MASQUERADE
86-
iptables -t nat -C POSTROUTING -s 10.7.0.0/24 -o $NIC -j MASQUERADE 2>/dev/null
87-
iptables -t nat -I POSTROUTING -s 10.7.0.0/24 -o $NIC -j MASQUERADE
88-
iptables -t nat -C POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE 2>/dev/null
89-
iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o $NIC -j MASQUERADE
90-
91-
iptables -C INPUT -p tcp --dport 1194 -j ACCEPT 2>/dev/null || \
92-
iptables -A INPUT -p tcp --dport 1194 -j ACCEPT
93-
iptables -C INPUT -p udp --dport 1195 -j ACCEPT 2>/dev/null || \
94-
iptables -A INPUT -p udp --dport 1195 -j ACCEPT
95-
iptables -C INPUT -p tcp --dport 888 -j ACCEPT 2>/dev/null || \
96-
iptables -A INPUT -p tcp --dport 888 -j ACCEPT
91+
# ---------- Firewall ----------
92+
for subnet in 10.6.0.0/24 10.7.0.0/24 10.8.0.0/24; do
93+
iptables -t nat -C POSTROUTING -s $subnet -o $NIC -j MASQUERADE 2>/dev/null || \
94+
iptables -t nat -I POSTROUTING -s $subnet -o $NIC -j MASQUERADE
95+
done
96+
97+
for port in 1194/tcp 1195/udp 888/tcp; do
98+
proto=$(echo $port | cut -d/ -f2)
99+
p=$(echo $port | cut -d/ -f1)
100+
iptables -C INPUT -p $proto --dport $p -j ACCEPT 2>/dev/null || \
101+
iptables -A INPUT -p $proto --dport $p -j ACCEPT
102+
done
97103

98104
netfilter-persistent save
99105
netfilter-persistent reload
100106

101-
# Restart OpenVPN
102-
systemctl restart openvpn
107+
cp /etc/openvpn/server/server-tcp-1194.conf /etc/openvpn/server/server-udp-1195.conf
108+
sed -i 's/^proto tcp/proto udp/' /etc/openvpn/server/server-udp-1195.conf
109+
sed -i 's/^port 1194/port 1195/' /etc/openvpn/server/server-udp-1195.conf
110+
111+
cp /etc/openvpn/server/server-tcp-1194.conf /etc/openvpn/server/server-tcp-1196.conf
112+
sed -i 's/^port 1194/port 1196/' /etc/openvpn/server/server-tcp-1196.conf
113+
114+
# ---------- Restart OpenVPN ----------
115+
systemctl daemon-reload
116+
systemctl restart openvpn-server@server-tcp-1194
117+
systemctl restart openvpn-server@server-udp-1195
118+
systemctl restart openvpn-server@server-tcp-1196
119+
systemctl enable openvpn-server@server-tcp-1194
120+
systemctl enable openvpn-server@server-udp-1195
121+
systemctl enable openvpn-server@server-tcp-1196
103122

0 commit comments

Comments
 (0)