openvpn/openvpnserver.sh at main · Trash666Kill/openvpn · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
#!/bin/bash
#
if [[ $EUID -ne 0 ]]; then
   	echo "This script must be run as sudo"
   	exit 1
else
#

target_user() {
# Define o usuário inicial
TARGET_USER=$(grep 1001 /etc/passwd | cut -f 1 -d ":")

# Cria o grupo de execução do serviço
adduser --system --no-create-home --group openvpn
}

packages() {
printf "\e[32m*\e[0m INSTALLING PACKAGES\n"
DEP="openvpn easy-rsa iptables"
apt -y install $DEP > /dev/null 2>&1
}


(

mkdir -v /etc/openvpn/server/easy-rsa
mkdir -pv /etc/openvpn/server/clients/"$TARGET_USER"
mkdir -p /etc/openvpn/server/ccd
ln -s /usr/share/easy-rsa/* /etc/openvpn/server/easy-rsa
cd /etc/openvpn/server/easy-rsa
./easyrsa --batch init-pki
./easyrsa --batch build-ca nopass
./easyrsa --batch build-server-full server nopass
./easyrsa --batch sign-req server server
./easyrsa --batch gen-dh
cd pki
openvpn --genkey tls-crypt-v2-server private/server.pem
cp -v ca.crt dh.pem ../../
cp -v private/server.key ../../
cp -v private/server.pem ../../
cp -v issued/server.crt ../../
chmod 400 /etc/openvpn/server/{server.key,server.crt,ca.crt}
{(
printf 'port 2944
proto udp
dev tun
allow-compression no
ca ca.crt
cert server.crt
key server.key
tls-crypt-v2 server.pem
dh dh.pem
topology subnet
server 10.8.11.0 255.255.255.0
ifconfig-pool-persist ipp.txt
push "dhcp-option DNS 9.9.9.9"
push "dhcp-option DNS 149.112.112.112"
push "block-outside-dns"
keepalive 10 120
cipher AES-256-GCM
ccd-exclusive
client-config-dir ccd
duplicate-cn
user openvpn
group openvpn
persist-key
persist-tun
verb 4
explicit-exit-notify 1' > ../../server.conf
chmod 640 /etc/openvpn/server/server.conf
)}
#
sysctl -w net.ipv4.ip_forward=1
sysctl net.ipv4.ip_forward
iptables -t nat -A POSTROUTING -s 10.8.15.0/24 -o enp1s0 -j MASQUERADE
echo "iptables -t nat -A POSTROUTING -s 10.8.15.0/24 -o enp1s0 -j MASQUERADE &" >> /etc/rc.local
#
cd ../
./easyrsa --batch --req-cn="$TARGET_USER" gen-req "$TARGET_USER" nopass
./easyrsa --batch --req-cn="$TARGET_USER" sign-req client "$TARGET_USER"
cd pki
openvpn --tls-crypt-v2 private/server.pem --genkey tls-crypt-v2-client private/"$TARGET_USER".pem
cp -v ca.crt ../../clients/"$TARGET_USER"
cp -v issued/"$TARGET_USER".crt ../../clients/"$TARGET_USER"
cp -v private/"$TARGET_USER".key ../../clients/"$TARGET_USER"
cp -v private/"$TARGET_USER".pem ../../clients/"$TARGET_USER"
#
cd ../../clients/"$TARGET_USER"
{(
cat <(echo -e 'client') \
<(echo -e 'proto udp') \
<(echo -e 'dev tun') \
<(echo -e 'remote vps24410.frlfryiwad7efpapvov5wnqzbf.com.br 2944') \
<(echo -e 'resolv-retry infinite') \
<(echo -e 'nobind') \
<(echo -e 'persist-key') \
<(echo -e 'persist-tun') \
<(echo -e 'remote-cert-tls server') \
<(echo -e 'cipher AES-256-GCM') \
<(echo -e '#user nobody') \
<(echo -e '#group nobody') \
<(echo -e 'redirect-gateway def1') \
<(echo -e 'verb 3') \
    <(echo -e '<ca>') \
    ca.crt \
    <(echo -e '</ca>\n<cert>') \
    "$TARGET_USER".crt \
    <(echo -e '</cert>\n<key>') \
    "$TARGET_USER".key \
    <(echo -e '</key>\n<tls-crypt-v2>') \
    "$TARGET_USER".pem \
    <(echo -e '</tls-crypt-v2>') \
    > "$TARGET_USER".ovpn
 printf 'push "route 10.8.11.1 255.255.255.255"' > ../../ccd/"$TARGET_USER"
 )}
 chown "$TARGET_USER":"$TARGET_USER" "$TARGET_USER".ovpn
 ) 2>&1 | tee outputfile
#
fi