mirror of
https://github.com/pivpn/pivpn.git
synced 2024-12-18 10:50:16 +00:00
Merge test (#929)
* added link to server status dashboard
* Replaced Header with bold instead
* More safeguards, some fixes, standardized some code, WireGuard update script, removed redundant code
- Add curl as a dependency for those who run the script without 'curl URL | bash'.
- Use POSIX 'command -v' instead of 'hash'.
- Check if packages have actually been installed and abort execution if they have not.
- Fixed issue with getStaticIPv4Settings() that prevented existing network settings
to be used as static IP settings when running the script unattended with empty
$IPv4addr and $IPv4gw variables.
- Exit if processing wireguard-linux-compat fails.
- Exit if 50unattended-upgrades fails to extract.
- Exit clientSTAT.sh if the wg0 interface is not available.
- Moved the Self Check to a single script since dedicated versions were very similar.
- Add 'pivpn -wg' to update WireGuard for users running Raspbian with armv6l kernel.
* Fixed cosmetic issue with spinner, added missing spinner to some APT commands
* Detect current netmask, validate user input when configuring a static IP
* Inform the user when updating the package cache, which can be slow on some RPis
* Invalidate $IPv4Addr and $IPv4gw when the user claims those settings are not correct
* Restart pihole in the more appropriate restartServices() function
* Improve static IP selection, validate public DNS name of the server
- Default to 'No' when asking if the RPi has DHCP reservation, considered
that the user may not be fully aware, furthermore, setting a static IP
anyways doesn't do harm.
- Validate existing IPv4 settings (address, gateway, DNS) to avoid filling
'/etc/dhcpcd.conf' with invalid data.
- Validate public DNS name of the server inside askPublicIPOrDNS() function
* Check DH parameters, fix 'pivpn -c', improvements when dealing with external repositories
- Added a basic sanity check to downloaded DH paramenters, which doubles as a
check for missing .pem file.
- Fix 'pivpn -c' showing the month number instead of the day of the month when
using WireGuard.
- Removing APT keys is risky, it would break APT update/upgrade if the user
already was already using the unstable repo.
- Replaced 'Checking for $i... installed' in favor of a more clear 'Checking for
$i... already installed'.
- Check whether the OpenVPN repo and the Debian unstable repo are already used.
* Improvements to getStaticIPv4Settings()
- Use a regular expression to extract IPs from the 'ip' command. With this,
there is a little need to validate output. Even though the regex will match
invalid IPs like 192.168.23.444, 'ip' can't return them, and even if it did,
the script would not have reached this function due to previous functions
using the network with broken routes and addresses.
- Get the IP address from the selected interface rather then from the 'ip route'
command as it's not guaranteed that such IP is the same of the interface the
user decided to use (though on a Raspberry Pi inside a home LAN, most likely
it is, but it also maskes easier to get the IP in the CIDR notation with a
single 'ip | grep' pipe).
* Moved command substitution to specific functions to avoid unnecessary execution
- Moved $availableInterfaces and $CurrentIPv4gw from the script header to
their relevant function, considered that if the OS is not Raspbian a static
IP is not set, so those variables are not used.
* Copy files from git repo using the 'install' command, switch DH params from 2ton.com.au to RFC 7919
- Now using DH parameters suggested by the RFC 7919 for use by TLS servers (the user can
still generate his own if he wishes).
https://wiki.mozilla.org/Security/Archive/Server_Side_TLS_4.0#Pre-defined_DHE_groups
This commit is contained in:
Orazio
GitHub
parent
f2fa01e3a5
commit
d691321b3e
21 changed files with 695 additions and 510 deletions
|
|
@ -24,12 +24,12 @@ PKG_INSTALL="${PKG_MANAGER} --yes --no-install-recommends install"
|
|||
PKG_COUNT="${PKG_MANAGER} -s -o Debug::NoLocking=true upgrade | grep -c ^Inst || true"
|
||||
|
||||
# Dependencies that are required by the script, regardless of the VPN protocol chosen
|
||||
BASE_DEPS=(git tar wget grep dnsutils whiptail net-tools bsdmainutils)
|
||||
BASE_DEPS=(git tar wget curl grep dnsutils whiptail net-tools bsdmainutils)
|
||||
|
||||
# Dependencies that where actually installed by the script. For example if the script requires
|
||||
# grep and dnsutils but dnsutils is already installed, we save grep here. This way when uninstalling
|
||||
# PiVPN we won't prompt to remove packages that may have been installed by the user for other reasons
|
||||
TO_INSTALL=()
|
||||
INSTALLED_PACKAGES=()
|
||||
|
||||
easyrsaVer="3.0.6"
|
||||
easyrsaRel="https://github.com/OpenVPN/easy-rsa/releases/download/v${easyrsaVer}/EasyRSA-unix-v${easyrsaVer}.tgz"
|
||||
|
|
@ -59,11 +59,6 @@ c=$(( columns / 2 ))
|
|||
r=$(( r < 20 ? 20 : r ))
|
||||
c=$(( c < 70 ? 70 : c ))
|
||||
|
||||
# Find IP used to route to outside world
|
||||
IPv4addr=$(ip route get 192.0.2.1 | awk '{print $7}')
|
||||
IPv4gw=$(ip route get 192.0.2.1 | awk '{print $3}')
|
||||
availableInterfaces=$(ip -o link | awk '/state UP/ {print $2}' | cut -d':' -f1 | cut -d'@' -f1)
|
||||
|
||||
######## SCRIPT ############
|
||||
|
||||
main(){
|
||||
|
|
@ -195,7 +190,7 @@ main(){
|
|||
fi
|
||||
|
||||
# Save installation setting to the final location
|
||||
echo "TO_INSTALL=(${TO_INSTALL[*]})" >> /tmp/setupVars.conf
|
||||
echo "INSTALLED_PACKAGES=(${INSTALLED_PACKAGES[*]})" >> /tmp/setupVars.conf
|
||||
$SUDO cp /tmp/setupVars.conf "$setupVars"
|
||||
|
||||
installScripts
|
||||
|
|
@ -235,7 +230,7 @@ askAboutExistingInstall(){
|
|||
# distroCheck, maybeOSSupport, noOSSupport
|
||||
distroCheck(){
|
||||
# if lsb_release command is on their system
|
||||
if hash lsb_release 2>/dev/null; then
|
||||
if command -v lsb_release > /dev/null; then
|
||||
|
||||
PLAT=$(lsb_release -si)
|
||||
OSCN=$(lsb_release -sc)
|
||||
|
|
@ -335,7 +330,7 @@ spinner(){
|
|||
local pid=$1
|
||||
local delay=0.50
|
||||
local spinstr='/-\|'
|
||||
while ps a | awk '{print $1}' | grep "${pid}"; do
|
||||
while ps a | awk '{print $1}' | grep -q "$pid"; do
|
||||
local temp=${spinstr#?}
|
||||
printf " [%c] " "${spinstr}"
|
||||
local spinstr=${temp}${spinstr%"$temp"}
|
||||
|
|
@ -399,7 +394,7 @@ updatePackageCache(){
|
|||
echo ":::"
|
||||
echo -ne "::: ${PKG_MANAGER} update has not been run today. Running now...\\n"
|
||||
# shellcheck disable=SC2086
|
||||
$SUDO ${UPDATE_PKG_CACHE} &> /dev/null
|
||||
$SUDO ${UPDATE_PKG_CACHE} &> /dev/null & spinner $!
|
||||
echo " done!"
|
||||
fi
|
||||
}
|
||||
|
|
@ -436,7 +431,7 @@ preconfigurePackages(){
|
|||
|
||||
# if ufw is enabled, configure that.
|
||||
# running as root because sometimes the executable is not in the user's $PATH
|
||||
if $SUDO bash -c 'hash ufw' 2>/dev/null; then
|
||||
if $SUDO bash -c 'command -v ufw' > /dev/null; then
|
||||
if LANG=en_US.UTF-8 $SUDO ufw status | grep -q inactive; then
|
||||
USING_UFW=0
|
||||
else
|
||||
|
|
@ -456,25 +451,46 @@ preconfigurePackages(){
|
|||
}
|
||||
|
||||
installDependentPackages(){
|
||||
declare -a TO_INSTALL=()
|
||||
|
||||
# Install packages passed in via argument array
|
||||
# No spinner - conflicts with set -e
|
||||
declare -a argArray1=("${!1}")
|
||||
|
||||
for i in "${argArray1[@]}"; do
|
||||
echo -n "::: Checking for $i..."
|
||||
if dpkg-query -W -f='${Status}' "${i}" 2>/dev/null | grep -q "ok installed"; then
|
||||
echo " installed!"
|
||||
else
|
||||
TO_INSTALL+=("${i}")
|
||||
echo " not installed!"
|
||||
fi
|
||||
if dpkg-query -W -f='${Status}' "${i}" 2>/dev/null | grep -q "ok installed"; then
|
||||
echo " already installed!"
|
||||
else
|
||||
echo " not installed!"
|
||||
# Add this package to the list of packages in the argument array that need to be installed
|
||||
TO_INSTALL+=("${i}")
|
||||
fi
|
||||
done
|
||||
|
||||
if command -v debconf-apt-progress &> /dev/null; then
|
||||
if command -v debconf-apt-progress > /dev/null; then
|
||||
# shellcheck disable=SC2086
|
||||
$SUDO debconf-apt-progress -- ${PKG_INSTALL} "${argArray1[@]}"
|
||||
$SUDO debconf-apt-progress -- ${PKG_INSTALL} "${TO_INSTALL[@]}"
|
||||
else
|
||||
${PKG_INSTALL} "${argArray1[@]}"
|
||||
# shellcheck disable=SC2086
|
||||
$SUDO ${PKG_INSTALL} "${TO_INSTALL[@]}"
|
||||
fi
|
||||
|
||||
local FAILED=0
|
||||
|
||||
for i in "${TO_INSTALL[@]}"; do
|
||||
if dpkg-query -W -f='${Status}' "${i}" 2>/dev/null | grep -q "ok installed"; then
|
||||
echo "::: Package $i successfully installed!"
|
||||
# Add this package to the total list of packages that were actually installed by the script
|
||||
INSTALLED_PACKAGES+=("${i}")
|
||||
else
|
||||
echo "::: Failed to install $i!"
|
||||
((FAILED++))
|
||||
fi
|
||||
done
|
||||
|
||||
if [ "$FAILED" -gt 0 ]; then
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
@ -507,6 +523,9 @@ local chooseInterfaceOptions
|
|||
# Loop sentinel variable
|
||||
local firstloop=1
|
||||
|
||||
# Find network interfaces whose state is UP, so as to skip virtual interfaces and the loopback interface
|
||||
availableInterfaces=$(ip -o link | awk '/state UP/ {print $2}' | cut -d':' -f1 | cut -d'@' -f1)
|
||||
|
||||
if [ -z "$availableInterfaces" ]; then
|
||||
echo "::: Could not find any active network interface, exiting"
|
||||
exit 1
|
||||
|
|
@ -580,7 +599,7 @@ validIP(){
|
|||
if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
|
||||
OIFS=$IFS
|
||||
IFS='.'
|
||||
read -r -a ip <<< "$ip"
|
||||
read -r -a ip <<< "$ip"
|
||||
IFS=$OIFS
|
||||
[[ ${ip[0]} -le 255 && ${ip[1]} -le 255 \
|
||||
&& ${ip[2]} -le 255 && ${ip[3]} -le 255 ]]
|
||||
|
|
@ -589,39 +608,56 @@ validIP(){
|
|||
return $stat
|
||||
}
|
||||
|
||||
validIPAndNetmask(){
|
||||
local ip=$1
|
||||
local stat=1
|
||||
ip="${ip/\//.}"
|
||||
|
||||
if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,2}$ ]]; then
|
||||
OIFS=$IFS
|
||||
IFS='.'
|
||||
read -r -a ip <<< "$ip"
|
||||
IFS=$OIFS
|
||||
[[ ${ip[0]} -le 255 && ${ip[1]} -le 255 \
|
||||
&& ${ip[2]} -le 255 && ${ip[3]} -le 255 \
|
||||
&& ${ip[4]} -le 32 ]]
|
||||
stat=$?
|
||||
fi
|
||||
return $stat
|
||||
}
|
||||
|
||||
getStaticIPv4Settings() {
|
||||
# Grab their current DNS Server
|
||||
IPv4dns=$(grep nameserver /etc/resolv.conf | awk '{print $2}' | xargs)
|
||||
# Find the gateway IP used to route to outside world
|
||||
CurrentIPv4gw="$(ip -o route get 192.0.2.1 | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | awk 'NR==2')"
|
||||
|
||||
# Find the IP address (and netmask) of the desidered interface
|
||||
CurrentIPv4addr="$(ip -o -f inet address show dev "${IPv4dev}" | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\/[0-9]{1,2}')"
|
||||
|
||||
# Grab their current DNS servers
|
||||
IPv4dns=$(grep -v "^#" /etc/resolv.conf | grep -w nameserver | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | xargs)
|
||||
|
||||
if [ "${runUnattended}" = 'true' ]; then
|
||||
|
||||
if [ -z "$dhcpReserv" ] || [ "$dhcpReserv" -ne 1 ]; then
|
||||
local INVALID_STATIC_IPV4_SETTINGS=0
|
||||
local MISSING_STATIC_IPV4_SETTINGS=0
|
||||
|
||||
if [ -z "$IPv4addr" ]; then
|
||||
echo "::: Missing static IP address"
|
||||
INVALID_STATIC_IPV4_SETTINGS=1
|
||||
((MISSING_STATIC_IPV4_SETTINGS++))
|
||||
fi
|
||||
|
||||
if [ -z "$IPv4gw" ]; then
|
||||
echo "::: Missing static IP gateway"
|
||||
INVALID_STATIC_IPV4_SETTINGS=1
|
||||
((MISSING_STATIC_IPV4_SETTINGS++))
|
||||
fi
|
||||
|
||||
if [ "$INVALID_STATIC_IPV4_SETTINGS" -eq 1 ]; then
|
||||
echo "::: Incomplete static IP settings"
|
||||
exit 1
|
||||
fi
|
||||
if [ "$MISSING_STATIC_IPV4_SETTINGS" -eq 0 ]; then
|
||||
|
||||
if [ -z "$IPv4addr" ] && [ -z "$IPv4gw" ]; then
|
||||
echo "::: No static IP settings, using current settings"
|
||||
echo "::: Your static IPv4 address: ${IPv4addr}"
|
||||
echo "::: Your static IPv4 gateway: ${IPv4gw}"
|
||||
else
|
||||
if validIP "${IPv4addr%/*}"; then
|
||||
# If both settings are not empty, check if they are valid and proceed
|
||||
if validIPAndNetmask "${IPv4addr}"; then
|
||||
echo "::: Your static IPv4 address: ${IPv4addr}"
|
||||
else
|
||||
echo "::: ${IPv4addr%/*} is not a valid IP address"
|
||||
echo "::: ${IPv4addr} is not a valid IP address"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
|
@ -631,26 +667,45 @@ getStaticIPv4Settings() {
|
|||
echo "::: ${IPv4gw} is not a valid IP address"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
elif [ "$MISSING_STATIC_IPV4_SETTINGS" -eq 1 ]; then
|
||||
|
||||
# If either of the settings is missing, consider the input inconsistent
|
||||
echo "::: Incomplete static IP settings"
|
||||
exit 1
|
||||
|
||||
elif [ "$MISSING_STATIC_IPV4_SETTINGS" -eq 2 ]; then
|
||||
|
||||
# If both of the settings are missing, assume the user wants to use current settings
|
||||
IPv4addr="${CurrentIPv4addr}"
|
||||
IPv4gw="${CurrentIPv4gw}"
|
||||
echo "::: No static IP settings, using current settings"
|
||||
echo "::: Your static IPv4 address: ${IPv4addr}"
|
||||
echo "::: Your static IPv4 gateway: ${IPv4gw}"
|
||||
|
||||
fi
|
||||
else
|
||||
echo "::: Skipping setting static IP address"
|
||||
fi
|
||||
|
||||
echo "dhcpReserv=${dhcpReserv}" >> /tmp/setupVars.conf
|
||||
echo "IPv4addr=${IPv4addr%/*}" >> /tmp/setupVars.conf
|
||||
echo "IPv4addr=${IPv4addr}" >> /tmp/setupVars.conf
|
||||
echo "IPv4gw=${IPv4gw}" >> /tmp/setupVars.conf
|
||||
return
|
||||
fi
|
||||
|
||||
local ipSettingsCorrect
|
||||
local IPv4AddrValid
|
||||
local IPv4gwValid
|
||||
# Some users reserve IP addresses on another DHCP Server or on their routers,
|
||||
# Lets ask them if they want to make any changes to their interfaces.
|
||||
if (whiptail --backtitle "Calibrating network interface" --title "DHCP Reservation" --yesno \
|
||||
|
||||
if (whiptail --backtitle "Calibrating network interface" --title "DHCP Reservation" --yesno --defaultno \
|
||||
"Are you Using DHCP Reservation on your Router/DHCP Server?
|
||||
These are your current Network Settings:
|
||||
|
||||
IP address: ${IPv4addr}
|
||||
Gateway: ${IPv4gw}
|
||||
IP address: ${CurrentIPv4addr}
|
||||
Gateway: ${CurrentIPv4gw}
|
||||
|
||||
Yes: Keep using DHCP reservation
|
||||
No: Setup static IP address
|
||||
|
|
@ -658,56 +713,82 @@ Don't know what DHCP Reservation is? Answer No." ${r} ${c}); then
|
|||
dhcpReserv=1
|
||||
# shellcheck disable=SC2129
|
||||
echo "dhcpReserv=${dhcpReserv}" >> /tmp/setupVars.conf
|
||||
echo "IPv4addr=${IPv4addr%/*}" >> /tmp/setupVars.conf
|
||||
echo "IPv4gw=${IPv4gw}" >> /tmp/setupVars.conf
|
||||
# We don't really need to save them as we won't set a static IP but they might be useful for debugging
|
||||
echo "IPv4addr=${CurrentIPv4addr}" >> /tmp/setupVars.conf
|
||||
echo "IPv4gw=${CurrentIPv4gw}" >> /tmp/setupVars.conf
|
||||
else
|
||||
# Ask if the user wants to use DHCP settings as their static IP
|
||||
if (whiptail --backtitle "Calibrating network interface" --title "Static IP Address" --yesno "Do you want to use your current network settings as a static address?
|
||||
IP address: ${IPv4addr}
|
||||
Gateway: ${IPv4gw}" ${r} ${c}); then
|
||||
|
||||
echo "IPv4addr=${IPv4addr%/*}" >> /tmp/setupVars.conf
|
||||
echo "IPv4gw=${IPv4gw}" >> /tmp/setupVars.conf
|
||||
# If they choose yes, let the user know that the IP address will not be available via DHCP and may cause a conflict.
|
||||
whiptail --msgbox --backtitle "IP information" --title "FYI: IP Conflict" "It is possible your router could still try to assign this IP to a device, which would cause a conflict. But in most cases the router is smart enough to not do that.
|
||||
IP address: ${CurrentIPv4addr}
|
||||
Gateway: ${CurrentIPv4gw}" ${r} ${c}); then
|
||||
IPv4addr=${CurrentIPv4addr}
|
||||
IPv4gw=${CurrentIPv4gw}
|
||||
echo "IPv4addr=${IPv4addr}" >> /tmp/setupVars.conf
|
||||
echo "IPv4gw=${IPv4gw}" >> /tmp/setupVars.conf
|
||||
|
||||
# If they choose yes, let the user know that the IP address will not be available via DHCP and may cause a conflict.
|
||||
whiptail --msgbox --backtitle "IP information" --title "FYI: IP Conflict" "It is possible your router could still try to assign this IP to a device, which would cause a conflict. But in most cases the router is smart enough to not do that.
|
||||
If you are worried, either manually set the address, or modify the DHCP reservation pool so it does not include the IP you want.
|
||||
It is also possible to use a DHCP reservation, but if you are going to do that, you might as well set a static address." ${r} ${c}
|
||||
# Nothing else to do since the variables are already set above
|
||||
# Nothing else to do since the variables are already set above
|
||||
else
|
||||
# Otherwise, we need to ask the user to input their desired settings.
|
||||
# Start by getting the IPv4 address (pre-filling it with info gathered from DHCP)
|
||||
# Start a loop to let the user enter their information with the chance to go back and edit it if necessary
|
||||
# Otherwise, we need to ask the user to input their desired settings.
|
||||
# Start by getting the IPv4 address (pre-filling it with info gathered from DHCP)
|
||||
# Start a loop to let the user enter their information with the chance to go back and edit it if necessary
|
||||
until [[ ${ipSettingsCorrect} = True ]]; do
|
||||
# Ask for the IPv4 address
|
||||
if IPv4addr=$(whiptail --backtitle "Calibrating network interface" --title "IPv4 address" --inputbox "Enter your desired IPv4 address" ${r} ${c} "${IPv4addr}" 3>&1 1>&2 2>&3) ; then
|
||||
echo "::: Your static IPv4 address: ${IPv4addr}"
|
||||
# Ask for the gateway
|
||||
if IPv4gw=$(whiptail --backtitle "Calibrating network interface" --title "IPv4 gateway (router)" --inputbox "Enter your desired IPv4 default gateway" ${r} ${c} "${IPv4gw}" 3>&1 1>&2 2>&3) ; then
|
||||
echo "::: Your static IPv4 gateway: ${IPv4gw}"
|
||||
# Give the user a chance to review their settings before moving on
|
||||
if (whiptail --backtitle "Calibrating network interface" --title "Static IP Address" --yesno "Are these settings correct?
|
||||
IP address: ${IPv4addr}
|
||||
Gateway: ${IPv4gw}" ${r} ${c}); then
|
||||
# If the settings are correct, then we need to set the pivpnIP
|
||||
echo "IPv4addr=${IPv4addr%/*}" >> /tmp/setupVars.conf
|
||||
echo "IPv4gw=${IPv4gw}" >> /tmp/setupVars.conf
|
||||
# After that's done, the loop ends and we move on
|
||||
ipSettingsCorrect=True
|
||||
|
||||
until [[ ${IPv4AddrValid} = True ]]; do
|
||||
# Ask for the IPv4 address
|
||||
if IPv4addr=$(whiptail --backtitle "Calibrating network interface" --title "IPv4 address" --inputbox "Enter your desired IPv4 address" ${r} ${c} "${CurrentIPv4addr}" 3>&1 1>&2 2>&3) ; then
|
||||
if validIPAndNetmask "${IPv4addr}"; then
|
||||
echo "::: Your static IPv4 address: ${IPv4addr}"
|
||||
IPv4AddrValid=True
|
||||
else
|
||||
# If the settings are wrong, the loop continues
|
||||
ipSettingsCorrect=False
|
||||
whiptail --msgbox --backtitle "Calibrating network interface" --title "IPv4 address" "You've entered an invalid IP address: ${IPv4addr}\\n\\nPlease enter an IP address in the CIDR notation, example: 192.168.23.211/24\\n\\nIf you are not sure, please just keep the default." ${r} ${c}
|
||||
echo "::: Invalid IPv4 address: ${IPv4addr}"
|
||||
IPv4AddrValid=False
|
||||
fi
|
||||
else
|
||||
# Cancelling gateway settings window
|
||||
ipSettingsCorrect=False
|
||||
# Cancelling IPv4 settings window
|
||||
echo "::: Cancel selected. Exiting..."
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
until [[ ${IPv4gwValid} = True ]]; do
|
||||
# Ask for the gateway
|
||||
if IPv4gw=$(whiptail --backtitle "Calibrating network interface" --title "IPv4 gateway (router)" --inputbox "Enter your desired IPv4 default gateway" ${r} ${c} "${CurrentIPv4gw}" 3>&1 1>&2 2>&3) ; then
|
||||
if validIP "${IPv4gw}"; then
|
||||
echo "::: Your static IPv4 gateway: ${IPv4gw}"
|
||||
IPv4gwValid=True
|
||||
else
|
||||
whiptail --msgbox --backtitle "Calibrating network interface" --title "IPv4 gateway (router)" "You've entered an invalid gateway IP: ${IPv4gw}\\n\\nPlease enter the IP address of your gateway (router), example: 192.168.23.1\\n\\nIf you are not sure, please just keep the default." ${r} ${c}
|
||||
echo "::: Invalid IPv4 gateway: ${IPv4gw}"
|
||||
IPv4gwValid=False
|
||||
fi
|
||||
else
|
||||
# Cancelling gateway settings window
|
||||
echo "::: Cancel selected. Exiting..."
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
# Give the user a chance to review their settings before moving on
|
||||
if (whiptail --backtitle "Calibrating network interface" --title "Static IP Address" --yesno "Are these settings correct?
|
||||
|
||||
IP address: ${IPv4addr}
|
||||
Gateway: ${IPv4gw}" ${r} ${c}); then
|
||||
# If the settings are correct, then we need to set the pivpnIP
|
||||
echo "IPv4addr=${IPv4addr}" >> /tmp/setupVars.conf
|
||||
echo "IPv4gw=${IPv4gw}" >> /tmp/setupVars.conf
|
||||
# After that's done, the loop ends and we move on
|
||||
ipSettingsCorrect=True
|
||||
else
|
||||
# Cancelling IPv4 settings window
|
||||
# If the settings are wrong, the loop continues
|
||||
ipSettingsCorrect=False
|
||||
echo "::: Cancel selected. Exiting..."
|
||||
exit 1
|
||||
IPv4AddrValid=False
|
||||
IPv4gwValid=False
|
||||
fi
|
||||
done
|
||||
# End the if statement for DHCP vs. static
|
||||
|
|
@ -964,18 +1045,29 @@ askWhichVPN(){
|
|||
installOpenVPN(){
|
||||
local PIVPN_DEPS
|
||||
|
||||
echo "::: Installing OpenVPN from Debian package... "
|
||||
|
||||
if [ "$PLAT" = "Debian" ] || [ "$PLAT" = "Ubuntu" ]; then
|
||||
echo "::: Adding OpenVPN repository... "
|
||||
# gnupg is used to add the openvpn PGP key to the APT keyring
|
||||
PIVPN_DEPS=(gnupg)
|
||||
installDependentPackages PIVPN_DEPS[@]
|
||||
|
||||
# We will download the repository key regardless of whether the user
|
||||
# has already enabled the openvpn repository or not, just to make sure
|
||||
# we have the right key
|
||||
echo "::: Adding repository key..."
|
||||
wget -qO- https://swupdate.openvpn.net/repos/repo-public.gpg | $SUDO apt-key add -
|
||||
echo "deb https://build.openvpn.net/debian/openvpn/stable $OSCN main" | $SUDO tee /etc/apt/sources.list.d/pivpn-openvpn-repo.list > /dev/null
|
||||
|
||||
if ! grep -qR "deb http.\?://build.openvpn.net/debian/openvpn/stable.\? $OSCN main" /etc/apt/sources.list*; then
|
||||
echo "::: Adding OpenVPN repository... "
|
||||
echo "deb https://build.openvpn.net/debian/openvpn/stable $OSCN main" | $SUDO tee /etc/apt/sources.list.d/pivpn-openvpn-repo.list > /dev/null
|
||||
fi
|
||||
|
||||
echo "::: Updating package cache..."
|
||||
# shellcheck disable=SC2086
|
||||
$SUDO ${UPDATE_PKG_CACHE} &> /dev/null
|
||||
$SUDO ${UPDATE_PKG_CACHE} &> /dev/null & spinner $!
|
||||
fi
|
||||
|
||||
echo "::: Installing OpenVPN from Debian package... "
|
||||
# grepcidr is used to redact IPs in the debug log whereas expect is used
|
||||
# to feed easy-rsa with passwords
|
||||
PIVPN_DEPS=(openvpn grepcidr expect)
|
||||
|
|
@ -983,6 +1075,8 @@ installOpenVPN(){
|
|||
}
|
||||
|
||||
installWireGuard(){
|
||||
local PIVPN_DEPS
|
||||
|
||||
if [ "$PLAT" = "Raspbian" ]; then
|
||||
|
||||
# If the running kernel is older than the kernel from the repo, dkms will
|
||||
|
|
@ -1036,19 +1130,28 @@ installWireGuard(){
|
|||
if [ "$(uname -m)" = "armv7l" ]; then
|
||||
|
||||
echo "::: Installing WireGuard from Debian package... "
|
||||
# dirmngr is used to download repository keys, whereas qrencode is used to generate qrcodes
|
||||
# from config file, for use with mobile clients
|
||||
PIVPN_DEPS=(dirmngr qrencode)
|
||||
# dirmngr is used to download repository keys for the unstable repo
|
||||
PIVPN_DEPS=(dirmngr)
|
||||
installDependentPackages PIVPN_DEPS[@]
|
||||
|
||||
echo "::: Adding repository keys..."
|
||||
$SUDO apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 04EE7237B7D453EC 648ACFD622F3D138
|
||||
|
||||
# This regular expression should match combinations like http[s]://mirror.example.com/debian[/] unstable main
|
||||
if ! grep -qR 'deb http.\?://.*/debian.\? unstable main' /etc/apt/sources.list*; then
|
||||
echo "::: Adding Debian repository... "
|
||||
echo "deb https://deb.debian.org/debian/ unstable main" | $SUDO tee /etc/apt/sources.list.d/pivpn-unstable.list > /dev/null
|
||||
fi
|
||||
|
||||
# Do not upgrade packages from the unstable repository except for wireguard
|
||||
echo "::: Adding Debian repository... "
|
||||
echo "deb https://deb.debian.org/debian/ unstable main" | $SUDO tee /etc/apt/sources.list.d/pivpn-unstable.list > /dev/null
|
||||
printf 'Package: *\nPin: release a=unstable\nPin-Priority: 1\n\nPackage: wireguard wireguard-dkms wireguard-tools\nPin: release a=unstable\nPin-Priority: 500\n' | $SUDO tee /etc/apt/preferences.d/pivpn-limit-unstable > /dev/null
|
||||
|
||||
$SUDO apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 04EE7237B7D453EC 648ACFD622F3D138
|
||||
# shellcheck disable=SC2086
|
||||
$SUDO ${UPDATE_PKG_CACHE} &> /dev/null
|
||||
PIVPN_DEPS=(raspberrypi-kernel-headers wireguard wireguard-tools wireguard-dkms)
|
||||
echo "::: Updating package cache..."
|
||||
# shellcheck disable=SC2086
|
||||
$SUDO ${UPDATE_PKG_CACHE} &> /dev/null & spinner $!
|
||||
|
||||
# qrencode is used to generate qrcodes from config file, for use with mobile clients
|
||||
PIVPN_DEPS=(raspberrypi-kernel-headers wireguard wireguard-tools wireguard-dkms qrencode)
|
||||
installDependentPackages PIVPN_DEPS[@]
|
||||
|
||||
elif [ "$(uname -m)" = "armv6l" ]; then
|
||||
|
|
@ -1064,7 +1167,7 @@ installWireGuard(){
|
|||
WG_TOOLS_SOURCE="https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-${WG_TOOLS_SNAPSHOT}.tar.xz"
|
||||
|
||||
echo "::: Downloading wireguard-tools source code... "
|
||||
wget -qO- "${WG_TOOLS_SOURCE}" | $SUDO tar Jxf - --directory /usr/src
|
||||
wget -qO- "${WG_TOOLS_SOURCE}" | $SUDO tar xJ --directory /usr/src
|
||||
echo "done!"
|
||||
|
||||
## || exits if cd fails.
|
||||
|
|
@ -1085,7 +1188,7 @@ installWireGuard(){
|
|||
# files from the file system
|
||||
echo "::: Installing WireGuard tools... "
|
||||
if $SUDO checkinstall --pkgname wireguard-tools --pkgversion "${WG_TOOLS_SNAPSHOT}" -y; then
|
||||
TO_INSTALL+=("wireguard-tools")
|
||||
INSTALLED_PACKAGES+=("wireguard-tools")
|
||||
echo "done!"
|
||||
else
|
||||
echo "failed!"
|
||||
|
|
@ -1098,16 +1201,16 @@ installWireGuard(){
|
|||
WG_MODULE_SOURCE="https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${WG_MODULE_SNAPSHOT}.tar.xz"
|
||||
|
||||
echo "::: Downloading wireguard-linux-compat source code... "
|
||||
wget -qO- "${WG_MODULE_SOURCE}" | $SUDO tar Jxf - --directory /usr/src
|
||||
wget -qO- "${WG_MODULE_SOURCE}" | $SUDO tar xJ --directory /usr/src
|
||||
echo "done!"
|
||||
|
||||
# Rename wireguard-linux-compat folder and move the source code to the parent folder
|
||||
# such that dkms picks up the module when referencing wireguard/"${WG_MODULE_SNAPSHOT}"
|
||||
cd /usr/src && \
|
||||
$SUDO mv wireguard-linux-compat-"${WG_MODULE_SNAPSHOT}" wireguard-"${WG_MODULE_SNAPSHOT}"
|
||||
$SUDO mv wireguard-linux-compat-"${WG_MODULE_SNAPSHOT}" wireguard-"${WG_MODULE_SNAPSHOT}" && \
|
||||
cd wireguard-"${WG_MODULE_SNAPSHOT}" && \
|
||||
$SUDO mv src/* . && \
|
||||
$SUDO rmdir src
|
||||
$SUDO rmdir src || exit 1
|
||||
|
||||
echo "::: Adding WireGuard modules via DKMS... "
|
||||
if $SUDO dkms add wireguard/"${WG_MODULE_SNAPSHOT}"; then
|
||||
|
|
@ -1129,7 +1232,7 @@ installWireGuard(){
|
|||
|
||||
echo "::: Installing WireGuard modules via DKMS... "
|
||||
if $SUDO dkms install wireguard/"${WG_MODULE_SNAPSHOT}"; then
|
||||
TO_INSTALL+=("wireguard-dkms")
|
||||
INSTALLED_PACKAGES+=("wireguard-dkms")
|
||||
echo "done!"
|
||||
else
|
||||
echo "failed!"
|
||||
|
|
@ -1144,11 +1247,17 @@ installWireGuard(){
|
|||
elif [ "$PLAT" = "Debian" ]; then
|
||||
|
||||
echo "::: Installing WireGuard from Debian package... "
|
||||
echo "::: Adding Debian repository... "
|
||||
echo "deb https://deb.debian.org/debian/ unstable main" | $SUDO tee /etc/apt/sources.list.d/pivpn-unstable.list > /dev/null
|
||||
if ! grep -qR 'deb http.\?://.*/debian.\? unstable main' /etc/apt/sources.list*; then
|
||||
echo "::: Adding Debian repository... "
|
||||
echo "deb https://deb.debian.org/debian/ unstable main" | $SUDO tee /etc/apt/sources.list.d/pivpn-unstable.list > /dev/null
|
||||
fi
|
||||
|
||||
printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' | $SUDO tee /etc/apt/preferences.d/pivpn-limit-unstable > /dev/null
|
||||
# shellcheck disable=SC2086
|
||||
$SUDO ${UPDATE_PKG_CACHE} &> /dev/null
|
||||
|
||||
echo "::: Updating package cache..."
|
||||
# shellcheck disable=SC2086
|
||||
$SUDO ${UPDATE_PKG_CACHE} &> /dev/null & spinner $!
|
||||
|
||||
PIVPN_DEPS=(linux-headers-amd64 qrencode wireguard wireguard-tools wireguard-dkms)
|
||||
installDependentPackages PIVPN_DEPS[@]
|
||||
|
||||
|
|
@ -1156,7 +1265,11 @@ installWireGuard(){
|
|||
|
||||
echo "::: Installing WireGuard from PPA... "
|
||||
$SUDO add-apt-repository ppa:wireguard/wireguard -y
|
||||
$SUDO ${UPDATE_PKG_CACHE}
|
||||
|
||||
echo "::: Updating package cache..."
|
||||
# shellcheck disable=SC2086
|
||||
$SUDO ${UPDATE_PKG_CACHE} &> /dev/null & spinner $!
|
||||
|
||||
PIVPN_DEPS=(qrencode wireguard wireguard-tools wireguard-dkms linux-headers-generic)
|
||||
installDependentPackages PIVPN_DEPS[@]
|
||||
|
||||
|
|
@ -1302,11 +1415,10 @@ askClientDNS(){
|
|||
fi
|
||||
|
||||
# Detect and offer to use Pi-hole
|
||||
if command -v pihole &>/dev/null; then
|
||||
if command -v pihole > /dev/null; then
|
||||
if (whiptail --backtitle "Setup PiVPN" --title "Pi-hole" --yesno "We have detected a Pi-hole installation, do you want to use it as the DNS server for the VPN, so you get ad blocking on the go?" ${r} ${c}); then
|
||||
pivpnDNS1="$vpnGw"
|
||||
echo "interface=$pivpnDEV" | $SUDO tee /etc/dnsmasq.d/02-pivpn.conf > /dev/null
|
||||
$SUDO pihole restartdns
|
||||
echo "pivpnDNS1=${pivpnDNS1}" >> /tmp/setupVars.conf
|
||||
echo "pivpnDNS2=${pivpnDNS2}" >> /tmp/setupVars.conf
|
||||
return
|
||||
|
|
@ -1480,36 +1592,46 @@ askPublicIPOrDNS(){
|
|||
return
|
||||
fi
|
||||
|
||||
METH=$(whiptail --title "Public IP or DNS" --radiolist "Will clients use a Public IP or DNS Name to connect to your server (press space to select)?" ${r} ${c} 2 \
|
||||
"$IPv4pub" "Use this public IP" "ON" \
|
||||
"DNS Entry" "Use a public DNS" "OFF" 3>&1 1>&2 2>&3)
|
||||
local publicDNSCorrect
|
||||
local publicDNSValid
|
||||
|
||||
exitstatus=$?
|
||||
if [ $exitstatus != 0 ]; then
|
||||
if METH=$(whiptail --title "Public IP or DNS" --radiolist "Will clients use a Public IP or DNS Name to connect to your server (press space to select)?" ${r} ${c} 2 \
|
||||
"$IPv4pub" "Use this public IP" "ON" \
|
||||
"DNS Entry" "Use a public DNS" "OFF" 3>&1 1>&2 2>&3); then
|
||||
|
||||
if [ "$METH" = "$IPv4pub" ]; then
|
||||
pivpnHOST="${IPv4pub}"
|
||||
else
|
||||
until [[ ${publicDNSCorrect} = True ]]; do
|
||||
|
||||
until [[ ${publicDNSValid} = True ]]; do
|
||||
if PUBLICDNS=$(whiptail --title "PiVPN Setup" --inputbox "What is the public DNS name of this Server?" ${r} ${c} 3>&1 1>&2 2>&3); then
|
||||
if validDomain "$PUBLICDNS"; then
|
||||
publicDNSValid=True
|
||||
pivpnHOST="${PUBLICDNS}"
|
||||
else
|
||||
whiptail --msgbox --backtitle "PiVPN Setup" --title "Invalid DNS name" "This DNS name is invalid. Please try again.\\n\\n DNS name: $PUBLICDNS\\n" ${r} ${c}
|
||||
publicDNSValid=False
|
||||
fi
|
||||
else
|
||||
echo "::: Cancel selected. Exiting..."
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
if (whiptail --backtitle "PiVPN Setup" --title "Confirm DNS Name" --yesno "Is this correct?\\n\\n Public DNS Name: $PUBLICDNS" ${r} ${c}) then
|
||||
publicDNSCorrect=True
|
||||
else
|
||||
publicDNSCorrect=False
|
||||
publicDNSValid=False
|
||||
fi
|
||||
done
|
||||
fi
|
||||
else
|
||||
echo "::: Cancel selected. Exiting..."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ "$METH" == "$IPv4pub" ]; then
|
||||
pivpnHOST="${IPv4pub}"
|
||||
else
|
||||
until [[ $publicDNSCorrect = True ]]
|
||||
do
|
||||
PUBLICDNS=$(whiptail --title "PiVPN Setup" --inputbox "What is the public DNS name of this Server?" ${r} ${c} 3>&1 1>&2 2>&3)
|
||||
exitstatus=$?
|
||||
if [ $exitstatus != 0 ]; then
|
||||
echo "::: Cancel selected. Exiting..."
|
||||
exit 1
|
||||
fi
|
||||
if (whiptail --backtitle "Confirm DNS Name" --title "Confirm DNS Name" --yesno "Is this correct?\\n\\n Public DNS Name: $PUBLICDNS" ${r} ${c}) then
|
||||
publicDNSCorrect=True
|
||||
pivpnHOST="${PUBLICDNS}"
|
||||
else
|
||||
publicDNSCorrect=False
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
echo "pivpnHOST=${pivpnHOST}" >> /tmp/setupVars.conf
|
||||
}
|
||||
|
||||
|
|
@ -1547,17 +1669,21 @@ askEncryption(){
|
|||
fi
|
||||
fi
|
||||
|
||||
if [ -z "$DOWNLOAD_DH_PARAM" ] || [ "$DOWNLOAD_DH_PARAM" -ne 1 ]; then
|
||||
DOWNLOAD_DH_PARAM=0
|
||||
echo "::: DH parameters will be generated locally"
|
||||
if [ -z "$USE_PREDEFINED_DH_PARAM" ]; then
|
||||
USE_PREDEFINED_DH_PARAM=1
|
||||
echo "::: Pre-defined DH parameters will be used"
|
||||
else
|
||||
echo "::: DH parameters will be downloaded from \"2 Ton Digital\""
|
||||
if [ "$USE_PREDEFINED_DH_PARAM" -eq 1 ]; then
|
||||
echo "::: Pre-defined DH parameters will be used"
|
||||
else
|
||||
echo "::: DH parameters will be generated locally"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "TWO_POINT_FOUR=${TWO_POINT_FOUR}" >> /tmp/setupVars.conf
|
||||
echo "pivpnENCRYPT=${pivpnENCRYPT}" >> /tmp/setupVars.conf
|
||||
echo "DOWNLOAD_DH_PARAM=${DOWNLOAD_DH_PARAM}" >> /tmp/setupVars.conf
|
||||
echo "USE_PREDEFINED_DH_PARAM=${USE_PREDEFINED_DH_PARAM}" >> /tmp/setupVars.conf
|
||||
return
|
||||
fi
|
||||
|
||||
|
|
@ -1583,15 +1709,15 @@ askEncryption(){
|
|||
exit 1
|
||||
fi
|
||||
|
||||
if ([ "$pivpnENCRYPT" -ge 3072 ] && whiptail --backtitle "Setup OpenVPN" --title "Download Diffie-Hellman Parameters" --yesno --defaultno "Download Diffie-Hellman parameters from a public DH parameter generation service?\\n\\nGenerating DH parameters for a $pivpnENCRYPT-bit key can take many hours on a Raspberry Pi. You can instead download DH parameters from \"2 Ton Digital\" that are generated at regular intervals as part of a public service. Downloaded DH parameters will be randomly selected from their database.\\nMore information about this service can be found here: https://2ton.com.au/safeprimes/\\n\\nIf you're paranoid, choose 'No' and Diffie-Hellman parameters will be generated on your device." ${r} ${c}); then
|
||||
DOWNLOAD_DH_PARAM=1
|
||||
if ([ "$pivpnENCRYPT" -ge 2048 ] && whiptail --backtitle "Setup OpenVPN" --title "Generate Diffie-Hellman Parameters" --yesno "Generating DH parameters can take many hours on a Raspberry Pi. You can instead use Pre-defined DH parameters recommended by the Internet Engineering Task Force.\\n\\nMore information about those can be found here: https://wiki.mozilla.org/Security/Archive/Server_Side_TLS_4.0#Pre-defined_DHE_groups\\n\\nIf you want unique parameters, choose 'No' and new Diffie-Hellman parameters will be generated on your device." ${r} ${c}); then
|
||||
USE_PREDEFINED_DH_PARAM=1
|
||||
else
|
||||
DOWNLOAD_DH_PARAM=0
|
||||
USE_PREDEFINED_DH_PARAM=0
|
||||
fi
|
||||
|
||||
echo "TWO_POINT_FOUR=${TWO_POINT_FOUR}" >> /tmp/setupVars.conf
|
||||
echo "pivpnENCRYPT=${pivpnENCRYPT}" >> /tmp/setupVars.conf
|
||||
echo "DOWNLOAD_DH_PARAM=${DOWNLOAD_DH_PARAM}" >> /tmp/setupVars.conf
|
||||
echo "USE_PREDEFINED_DH_PARAM=${USE_PREDEFINED_DH_PARAM}" >> /tmp/setupVars.conf
|
||||
}
|
||||
|
||||
confOpenVPN(){
|
||||
|
|
@ -1617,7 +1743,7 @@ confOpenVPN(){
|
|||
fi
|
||||
|
||||
# Get easy-rsa
|
||||
wget -qO- "${easyrsaRel}" | $SUDO tar xz -C /etc/openvpn
|
||||
wget -qO- "${easyrsaRel}" | $SUDO tar xz --directory /etc/openvpn
|
||||
$SUDO mv /etc/openvpn/EasyRSA-v${easyrsaVer} /etc/openvpn/easy-rsa
|
||||
# fix ownership
|
||||
$SUDO chown -R root:root /etc/openvpn/easy-rsa
|
||||
|
|
@ -1660,13 +1786,13 @@ set_var EASYRSA_ALGO ${pivpnCERT}" | $SUDO tee vars >/dev/null
|
|||
${SUDOE} ./easyrsa --batch build-ca nopass
|
||||
printf "\\n::: CA Complete.\\n"
|
||||
|
||||
if [ "$pivpnCERT" = "rsa" ]; then
|
||||
if [ "$pivpnCERT" = "rsa" ] && [ "$USE_PREDEFINED_DH_PARAM" -ne 1 ]; then
|
||||
if [ "${runUnattended}" = 'true' ]; then
|
||||
echo "::: The server key, Diffie-Hellman parameters, and HMAC key will now be generated."
|
||||
else
|
||||
whiptail --msgbox --backtitle "Setup OpenVPN" --title "Server Information" "The server key, Diffie-Hellman parameters, and HMAC key will now be generated." ${r} ${c}
|
||||
fi
|
||||
elif [ "$pivpnCERT" = "ec" ]; then
|
||||
elif [ "$pivpnCERT" = "ec" ] || { [ "$pivpnCERT" = "rsa" ] && [ "$USE_PREDEFINED_DH_PARAM" -eq 1 ]; }; then
|
||||
if [ "${runUnattended}" = 'true' ]; then
|
||||
echo "::: The server key and HMAC key will now be generated."
|
||||
else
|
||||
|
|
@ -1678,13 +1804,13 @@ set_var EASYRSA_ALGO ${pivpnCERT}" | $SUDO tee vars >/dev/null
|
|||
EASYRSA_CERT_EXPIRE=3650 ${SUDOE} ./easyrsa build-server-full "${SERVER_NAME}" nopass
|
||||
|
||||
if [ "$pivpnCERT" = "rsa" ]; then
|
||||
if [ ${DOWNLOAD_DH_PARAM} -eq 1 ]; then
|
||||
# Downloading parameters
|
||||
${SUDOE} curl -s "https://2ton.com.au/getprimes/random/dhparam/${pivpnENCRYPT}" -o "/etc/openvpn/easy-rsa/pki/dh${pivpnENCRYPT}.pem"
|
||||
if [ "${USE_PREDEFINED_DH_PARAM}" -eq 1 ]; then
|
||||
# Use Diffie-Hellman parameters from RFC 7919 (FFDHE)
|
||||
${SUDOE} install -m 644 "${pivpnFilesDir}"/files/etc/openvpn/easy-rsa/pki/ffdhe"${pivpnENCRYPT}".pem pki/dh"${pivpnENCRYPT}".pem
|
||||
else
|
||||
# Generate Diffie-Hellman key exchange
|
||||
${SUDOE} ./easyrsa gen-dh
|
||||
${SUDOE} mv "pki/dh.pem" "pki/dh${pivpnENCRYPT}.pem"
|
||||
${SUDOE} mv pki/dh.pem pki/dh"${pivpnENCRYPT}".pem
|
||||
fi
|
||||
fi
|
||||
|
||||
|
|
@ -1700,7 +1826,7 @@ set_var EASYRSA_ALGO ${pivpnCERT}" | $SUDO tee vars >/dev/null
|
|||
${SUDOE} chown "$debianOvpnUserGroup" /etc/openvpn/crl.pem
|
||||
|
||||
# Write config file for server using the template.txt file
|
||||
$SUDO cp $pivpnFilesDir/server_config.txt /etc/openvpn/server.conf
|
||||
$SUDO install -m 644 "$pivpnFilesDir"/files/etc/openvpn/server_config.txt /etc/openvpn/server.conf
|
||||
|
||||
# Apply client DNS settings
|
||||
${SUDOE} sed -i '0,/\(dhcp-option DNS \)/ s/\(dhcp-option DNS \).*/\1'${pivpnDNS1}'\"/' /etc/openvpn/server.conf
|
||||
|
|
@ -1747,7 +1873,7 @@ set_var EASYRSA_ALGO ${pivpnCERT}" | $SUDO tee vars >/dev/null
|
|||
}
|
||||
|
||||
confOVPN(){
|
||||
$SUDO cp $pivpnFilesDir/Default.txt /etc/openvpn/easy-rsa/pki/Default.txt
|
||||
$SUDO install -m 644 "$pivpnFilesDir"/files/etc/openvpn/easy-rsa/pki/Default.txt /etc/openvpn/easy-rsa/pki/Default.txt
|
||||
|
||||
$SUDO sed -i 's/IPv4pub/'"$pivpnHOST"'/' /etc/openvpn/easy-rsa/pki/Default.txt
|
||||
|
||||
|
|
@ -1951,6 +2077,10 @@ restartServices(){
|
|||
fi
|
||||
;;
|
||||
esac
|
||||
|
||||
if [ -f /etc/dnsmasq.d/02-pivpn.conf ]; then
|
||||
$SUDO pihole restartdns
|
||||
fi
|
||||
}
|
||||
|
||||
askUnattendedUpgrades(){
|
||||
|
|
@ -1982,7 +2112,7 @@ askUnattendedUpgrades(){
|
|||
|
||||
confUnattendedUpgrades(){
|
||||
local PIVPN_DEPS
|
||||
PIVPN_DEPS+=(unattended-upgrades)
|
||||
PIVPN_DEPS=(unattended-upgrades)
|
||||
installDependentPackages PIVPN_DEPS[@]
|
||||
aptConfDir="/etc/apt/apt.conf.d"
|
||||
|
||||
|
|
@ -1999,10 +2129,13 @@ confUnattendedUpgrades(){
|
|||
|
||||
# Fix Raspbian config
|
||||
if [ "$PLAT" = "Raspbian" ]; then
|
||||
wget -q -O "/tmp/${UNATTUPG_RELEASE}.tar.gz" "$UNATTUPG_CONFIG"
|
||||
cd /tmp/ && $SUDO tar xzf "/tmp/${UNATTUPG_RELEASE}.tar.gz"
|
||||
$SUDO cp /tmp/"unattended-upgrades-$UNATTUPG_RELEASE/data/50unattended-upgrades.Raspbian" "${aptConfDir}/50unattended-upgrades"
|
||||
$SUDO rm -rf "/tmp/unattended-upgrades-$UNATTUPG_RELEASE"
|
||||
wget -qO- "$UNATTUPG_CONFIG" | $SUDO tar xz --directory "${aptConfDir}" "unattended-upgrades-$UNATTUPG_RELEASE/data/50unattended-upgrades.Raspbian" --strip-components 2
|
||||
if test -s "${aptConfDir}/50unattended-upgrades.Raspbian"; then
|
||||
$SUDO mv "${aptConfDir}/50unattended-upgrades.Raspbian" "${aptConfDir}/50unattended-upgrades"
|
||||
else
|
||||
echo "$0: ERR: Failed to download \"50unattended-upgrades.Raspbian\"."
|
||||
exit 1
|
||||
fi
|
||||
fi
|
||||
|
||||
# Add the remaining settings for all other distributions
|
||||
|
|
@ -2033,14 +2166,11 @@ installScripts(){
|
|||
$SUDO chmod 0755 /opt/pivpn
|
||||
fi
|
||||
|
||||
$SUDO cp "$pivpnFilesDir"/scripts/*.sh /opt/pivpn/
|
||||
$SUDO cp "$pivpnFilesDir"/scripts/"$VPN"/*.sh /opt/pivpn/
|
||||
$SUDO chmod 0755 /opt/pivpn/*.sh
|
||||
$SUDO cp "$pivpnFilesDir"/scripts/"$VPN"/pivpn /usr/local/bin/pivpn
|
||||
$SUDO chmod 0755 /usr/local/bin/pivpn
|
||||
$SUDO cp "$pivpnFilesDir"/scripts/"$VPN"/bash-completion /etc/bash_completion.d/pivpn
|
||||
$SUDO chmod 0644 /etc/bash_completion.d/pivpn
|
||||
# shellcheck disable=SC1091
|
||||
$SUDO install -m 755 "$pivpnFilesDir"/scripts/*.sh -t /opt/pivpn
|
||||
$SUDO install -m 755 "$pivpnFilesDir"/scripts/"$VPN"/*.sh -t /opt/pivpn
|
||||
$SUDO install -m 755 "$pivpnFilesDir"/scripts/"$VPN"/pivpn /usr/local/bin/pivpn
|
||||
$SUDO install -m 644 "$pivpnFilesDir"/scripts/"$VPN"/bash-completion /etc/bash_completion.d/pivpn
|
||||
# shellcheck disable=SC1091
|
||||
. /etc/bash_completion.d/pivpn
|
||||
echo " done."
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,6 @@
|
|||
IPv4dev=eth0
|
||||
IPv4addr=192.168.23.211/24
|
||||
IPv4gw=192.168.23.1
|
||||
dhcpReserv=0
|
||||
install_user=pi
|
||||
VPN=openvpn
|
||||
|
|
@ -10,5 +12,5 @@ pivpnHOST=pivpn.example.com
|
|||
pivpnENCRYPT=256
|
||||
pivpnSEARCHDOMAIN=searchdomain.example.com
|
||||
TWO_POINT_FOUR=1
|
||||
DOWNLOAD_DH_PARAM=0
|
||||
USE_PREDEFINED_DH_PARAM=1
|
||||
UNATTUPG=1
|
||||
|
|
@ -1,4 +1,6 @@
|
|||
IPv4dev=eth0
|
||||
IPv4addr=192.168.23.211/24
|
||||
IPv4gw=192.168.23.1
|
||||
dhcpReserv=0
|
||||
install_user=pi
|
||||
VPN=wireguard
|
||||
8
files/etc/openvpn/easy-rsa/pki/ffdhe2048.pem
Normal file
8
files/etc/openvpn/easy-rsa/pki/ffdhe2048.pem
Normal file
|
|
@ -0,0 +1,8 @@
|
|||
-----BEGIN DH PARAMETERS-----
|
||||
MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
|
||||
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
|
||||
87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
|
||||
YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
|
||||
7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
|
||||
ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
|
||||
-----END DH PARAMETERS-----
|
||||
11
files/etc/openvpn/easy-rsa/pki/ffdhe3072.pem
Normal file
11
files/etc/openvpn/easy-rsa/pki/ffdhe3072.pem
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
-----BEGIN DH PARAMETERS-----
|
||||
MIIBiAKCAYEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
|
||||
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
|
||||
87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
|
||||
YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
|
||||
7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
|
||||
ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3
|
||||
7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32
|
||||
nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZsYu
|
||||
N///////////AgEC
|
||||
-----END DH PARAMETERS-----
|
||||
13
files/etc/openvpn/easy-rsa/pki/ffdhe4096.pem
Normal file
13
files/etc/openvpn/easy-rsa/pki/ffdhe4096.pem
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
-----BEGIN DH PARAMETERS-----
|
||||
MIICCAKCAgEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
|
||||
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
|
||||
87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
|
||||
YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
|
||||
7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
|
||||
ssbzSibBsu/6iGtCOGEfz9zeNVs7ZRkDW7w09N75nAI4YbRvydbmyQd62R0mkff3
|
||||
7lmMsPrBhtkcrv4TCYUTknC0EwyTvEN5RPT9RFLi103TZPLiHnH1S/9croKrnJ32
|
||||
nuhtK8UiNjoNq8Uhl5sN6todv5pC1cRITgq80Gv6U93vPBsg7j/VnXwl5B0rZp4e
|
||||
8W5vUsMWTfT7eTDp5OWIV7asfV9C1p9tGHdjzx1VA0AEh/VbpX4xzHpxNciG77Qx
|
||||
iu1qHgEtnmgyqQdgCpGBMMRtx3j5ca0AOAkpmaMzy4t6Gh25PXFAADwqTs6p+Y0K
|
||||
zAqCkc3OyX3Pjsm1Wn+IpGtNtahR9EGC4caKAH5eZV9q//////////8CAQI=
|
||||
-----END DH PARAMETERS-----
|
||||
|
|
@ -1,9 +1,16 @@
|
|||
#!/bin/bash
|
||||
# shellcheck disable=SC1091
|
||||
source /etc/pivpn/setupVars.conf
|
||||
# shellcheck disable=SC1090
|
||||
|
||||
backupdir=pivpnbackup
|
||||
date=$(date +%Y%m%d-%H%M%S)
|
||||
setupVars="/etc/pivpn/setupVars.conf"
|
||||
|
||||
if [ ! -f "${setupVars}" ]; then
|
||||
echo "::: Missing setup vars file!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# shellcheck disable=SC1090
|
||||
source "${setupVars}"
|
||||
|
||||
checkbackupdir(){
|
||||
|
||||
|
|
|
|||
|
|
@ -91,7 +91,7 @@ do
|
|||
NO_PASS="1"
|
||||
;;
|
||||
-b|--bitwarden)
|
||||
if command -v bw &> /dev/null; then
|
||||
if command -v bw > /dev/null; then
|
||||
BITWARDEN="2"
|
||||
else
|
||||
echo "Bitwarden not found, please install bitwarden"
|
||||
|
|
|
|||
|
|
@ -2,7 +2,6 @@
|
|||
# This scripts runs as root
|
||||
|
||||
setupVars="/etc/pivpn/setupVars.conf"
|
||||
ERR=0
|
||||
|
||||
if [ ! -f "${setupVars}" ]; then
|
||||
echo "::: Missing setup vars file!"
|
||||
|
|
@ -17,14 +16,6 @@ echo -e "::::\t\t\e[4mLatest commit\e[0m\t\t ::::"
|
|||
git --git-dir /etc/.pivpn/.git log -n 1
|
||||
printf "=============================================\n"
|
||||
echo -e "::::\t \e[4mInstallation settings\e[0m \t ::::"
|
||||
# Use the wildcard so setupVars.conf.update.bak from the previous install is not shown
|
||||
for filename in /etc/pivpn/*; do
|
||||
if [[ "$filename" != "/etc/pivpn/setupVars.conf"* ]]; then
|
||||
echo "$filename -> $(cat "$filename")"
|
||||
fi
|
||||
done
|
||||
printf "=============================================\n"
|
||||
echo -e "::::\t\e[4msetupVars file shown below\e[0m\t ::::"
|
||||
sed "s/$pivpnHOST/REDACTED/" < /etc/pivpn/setupVars.conf
|
||||
printf "=============================================\n"
|
||||
echo -e ":::: \e[4mServer configuration shown below\e[0m ::::"
|
||||
|
|
@ -37,152 +28,7 @@ echo -e ":::: \t\e[4mRecursive list of files in\e[0m\t ::::\n::: \e[4m/etc/openv
|
|||
ls -LR /etc/openvpn/easy-rsa/pki/ -Ireqs -Icerts_by_serial
|
||||
printf "=============================================\n"
|
||||
echo -e "::::\t\t\e[4mSelf check\e[0m\t\t ::::"
|
||||
|
||||
if [ "$(cat /proc/sys/net/ipv4/ip_forward)" -eq 1 ]; then
|
||||
echo ":: [OK] IP forwarding is enabled"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] IP forwarding is not enabled, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
sed -i '/net.ipv4.ip_forward=1/s/^#//g' /etc/sysctl.conf
|
||||
sysctl -p
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$USING_UFW" -eq 0 ]; then
|
||||
|
||||
if iptables -t nat -C POSTROUTING -s 10.8.0.0/24 -o "${IPv4dev}" -j MASQUERADE -m comment --comment "${VPN}-nat-rule" &> /dev/null; then
|
||||
echo ":: [OK] Iptables MASQUERADE rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Iptables MASQUERADE rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -o "${IPv4dev}" -j MASQUERADE -m comment --comment "${VPN}-nat-rule"
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$INPUT_CHAIN_EDITED" -eq 1 ]; then
|
||||
|
||||
if iptables -C INPUT -i "$IPv4dev" -p "$pivpnPROTO" --dport "$pivpnPORT" -j ACCEPT -m comment --comment "${VPN}-input-rule" &> /dev/null; then
|
||||
echo ":: [OK] Iptables INPUT rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Iptables INPUT rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
iptables -I INPUT 1 -i "$IPv4dev" -p "$pivpnPROTO" --dport "$pivpnPORT" -j ACCEPT -m comment --comment "${VPN}-input-rule"
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$FORWARD_CHAIN_EDITED" -eq 1 ]; then
|
||||
|
||||
if iptables -C FORWARD -s 10.8.0.0/24 -i tun0 -o "$IPv4dev" -j ACCEPT -m comment --comment "${VPN}-forward-rule" &> /dev/null; then
|
||||
echo ":: [OK] Iptables FORWARD rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Iptables FORWARD rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
iptables -I FORWARD 1 -d 10.8.0.0/24 -i "$IPv4dev" -o tun0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -m comment --comment "${VPN}-forward-rule"
|
||||
iptables -I FORWARD 2 -s 10.8.0.0/24 -i tun0 -o "$IPv4dev" -j ACCEPT -m comment --comment "${VPN}-forward-rule"
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
if LANG="en_US.UTF-8" ufw status | grep -qw 'active'; then
|
||||
echo ":: [OK] Ufw is enabled"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Ufw is not enabled, try to enable now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
ufw enable
|
||||
fi
|
||||
fi
|
||||
|
||||
if iptables -t nat -C POSTROUTING -s 10.8.0.0/24 -o "${IPv4dev}" -j MASQUERADE -m comment --comment "${VPN}-nat-rule" &> /dev/null; then
|
||||
echo ":: [OK] Iptables MASQUERADE rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Iptables MASQUERADE rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
sed "/delete these required/i *nat\n:POSTROUTING ACCEPT [0:0]\n-I POSTROUTING -s 10.8.0.0/24 -o $IPv4dev -j MASQUERADE -m comment --comment ${VPN}-nat-rule\nCOMMIT\n" -i /etc/ufw/before.rules
|
||||
ufw reload
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if iptables -C ufw-user-input -p "${pivpnPROTO}" --dport "${pivpnPORT}" -j ACCEPT &> /dev/null; then
|
||||
echo ":: [OK] Ufw input rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Ufw input rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
ufw insert 1 allow "$pivpnPORT"/"$pivpnPROTO"
|
||||
ufw reload
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if iptables -C ufw-user-forward -i tun0 -o "${IPv4dev}" -s 10.8.0.0/24 -j ACCEPT &> /dev/null; then
|
||||
echo ":: [OK] Ufw forwarding rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Ufw forwarding rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
ufw route insert 1 allow in on tun0 from 10.8.0.0/24 out on "$IPv4dev" to any
|
||||
ufw reload
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
if systemctl is-active -q openvpn; then
|
||||
echo ":: [OK] OpenVPN is running"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] OpenVPN is not running, try to start now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
systemctl start openvpn
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if systemctl is-enabled -q openvpn; then
|
||||
echo ":: [OK] OpenVPN is enabled (it will automatically start on reboot)"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] OpenVPN is not enabled, try to enable now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
systemctl enable openvpn
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
# grep -w (whole word) is used so port 11940 won't match when looking for 1194
|
||||
if netstat -uanpt | grep openvpn | grep -w "${pivpnPORT}" | grep -q "${pivpnPROTO}"; then
|
||||
echo ":: [OK] OpenVPN is listening on port ${pivpnPORT}/${pivpnPROTO}"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] OpenVPN is not listening, try to restart now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
systemctl restart openvpn
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$ERR" -eq 1 ]; then
|
||||
echo -e "[INFO] Run \e[1mpivpn -d\e[0m again to see if we detect issues"
|
||||
fi
|
||||
|
||||
/opt/pivpn/self_check.sh
|
||||
printf "=============================================\n"
|
||||
echo -e ":::: \e[4mSnippet of the server log\e[0m ::::"
|
||||
tail -20 /var/log/openvpn.log > /tmp/snippet
|
||||
|
|
|
|||
170
scripts/self_check.sh
Executable file
170
scripts/self_check.sh
Executable file
|
|
@ -0,0 +1,170 @@
|
|||
#!/bin/bash
|
||||
|
||||
subnetClass="24"
|
||||
setupVars="/etc/pivpn/setupVars.conf"
|
||||
ERR=0
|
||||
|
||||
if [ ! -f "${setupVars}" ]; then
|
||||
echo "::: Missing setup vars file!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
source "${setupVars}"
|
||||
|
||||
if [ "$VPN" = "wireguard" ]; then
|
||||
pivpnPROTO="udp"
|
||||
pivpnDEV="wg0"
|
||||
pivpnNET="10.6.0.0"
|
||||
VPN_SERVICE="wg-quick@wg0"
|
||||
VPN_PRETTY_NAME="WireGuard"
|
||||
elif [ "$VPN" = "openvpn" ]; then
|
||||
pivpnDEV="tun0"
|
||||
pivpnNET="10.8.0.0"
|
||||
VPN_SERVICE="openvpn"
|
||||
VPN_PRETTY_NAME="OpenVPN"
|
||||
fi
|
||||
|
||||
if [ "$(</proc/sys/net/ipv4/ip_forward)" -eq 1 ]; then
|
||||
echo ":: [OK] IP forwarding is enabled"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] IP forwarding is not enabled, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
sed -i '/net.ipv4.ip_forward=1/s/^#//g' /etc/sysctl.conf
|
||||
sysctl -p
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$USING_UFW" -eq 0 ]; then
|
||||
|
||||
if iptables -t nat -C POSTROUTING -s "${pivpnNET}/${subnetClass}" -o "${IPv4dev}" -j MASQUERADE -m comment --comment "${VPN}-nat-rule" &> /dev/null; then
|
||||
echo ":: [OK] Iptables MASQUERADE rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Iptables MASQUERADE rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
iptables -t nat -I POSTROUTING -s "${pivpnNET}/${subnetClass}" -o "${IPv4dev}" -j MASQUERADE -m comment --comment "${VPN}-nat-rule"
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$INPUT_CHAIN_EDITED" -eq 1 ]; then
|
||||
|
||||
if iptables -C INPUT -i "${IPv4dev}" -p "${pivpnPROTO}" --dport "${pivpnPORT}" -j ACCEPT -m comment --comment "${VPN}-input-rule" &> /dev/null; then
|
||||
echo ":: [OK] Iptables INPUT rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Iptables INPUT rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
iptables -I INPUT 1 -i "${IPv4dev}" -p "${pivpnPROTO}" --dport "${pivpnPORT}" -j ACCEPT -m comment --comment "${VPN}-input-rule"
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$FORWARD_CHAIN_EDITED" -eq 1 ]; then
|
||||
|
||||
if iptables -C FORWARD -s "${pivpnNET}/${subnetClass}" -i "${pivpnDEV}" -o "${IPv4dev}" -j ACCEPT -m comment --comment "${VPN}-forward-rule" &> /dev/null; then
|
||||
echo ":: [OK] Iptables FORWARD rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Iptables FORWARD rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
iptables -I FORWARD 1 -d "${pivpnNET}/${subnetClass}" -i "${IPv4dev}" -o "${pivpnDEV}" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -m comment --comment "${VPN}-forward-rule"
|
||||
iptables -I FORWARD 2 -s "${pivpnNET}/${subnetClass}" -i "${pivpnDEV}" -o "${IPv4dev}" -j ACCEPT -m comment --comment "${VPN}-forward-rule"
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
if LANG="en_US.UTF-8" ufw status | grep -qw 'active'; then
|
||||
echo ":: [OK] Ufw is enabled"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Ufw is not enabled, try to enable now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
ufw enable
|
||||
fi
|
||||
fi
|
||||
|
||||
if iptables -t nat -C POSTROUTING -s "${pivpnNET}/${subnetClass}" -o "${IPv4dev}" -j MASQUERADE -m comment --comment "${VPN}-nat-rule" &> /dev/null; then
|
||||
echo ":: [OK] Iptables MASQUERADE rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Iptables MASQUERADE rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
sed "/delete these required/i *nat\n:POSTROUTING ACCEPT [0:0]\n-I POSTROUTING -s ${pivpnNET}/${subnetClass} -o ${IPv4dev} -j MASQUERADE -m comment --comment ${VPN}-nat-rule\nCOMMIT\n" -i /etc/ufw/before.rules
|
||||
ufw reload
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if iptables -C ufw-user-input -p "${pivpnPROTO}" --dport "${pivpnPORT}" -j ACCEPT &> /dev/null; then
|
||||
echo ":: [OK] Ufw input rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Ufw input rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
ufw insert 1 allow "${pivpnPORT}"/"${pivpnPROTO}"
|
||||
ufw reload
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if iptables -C ufw-user-forward -i "${pivpnDEV}" -o "${IPv4dev}" -s "${pivpnNET}/${subnetClass}" -j ACCEPT &> /dev/null; then
|
||||
echo ":: [OK] Ufw forwarding rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Ufw forwarding rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
ufw route insert 1 allow in on "${pivpnDEV}" from "${pivpnNET}/${subnetClass}" out on "${IPv4dev}" to any
|
||||
ufw reload
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
if systemctl is-active -q "${VPN_SERVICE}"; then
|
||||
echo ":: [OK] ${VPN_PRETTY_NAME} is running"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] ${VPN_PRETTY_NAME} is not running, try to start now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
systemctl start "${VPN_SERVICE}"
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if systemctl is-enabled -q "${VPN_SERVICE}"; then
|
||||
echo ":: [OK] ${VPN_PRETTY_NAME} is enabled (it will automatically start on reboot)"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] ${VPN_PRETTY_NAME} is not enabled, try to enable now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
systemctl enable "${VPN_SERVICE}"
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
# grep -w (whole word) is used so port 11940 won't match when looking for 1194
|
||||
if netstat -antu | grep -wqE "${pivpnPROTO}.*${pivpnPORT}"; then
|
||||
echo ":: [OK] ${VPN_PRETTY_NAME} is listening on port ${pivpnPORT}/${pivpnPROTO}"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] ${VPN_PRETTY_NAME} is not listening, try to restart now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
systemctl restart "${VPN_SERVICE}"
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$ERR" -eq 1 ]; then
|
||||
echo -e "[INFO] Run \e[1mpivpn -d\e[0m again to see if we detect issues"
|
||||
fi
|
||||
|
|
@ -5,6 +5,7 @@
|
|||
### FIXME: use variables where appropriate, reduce magic numbers by 99.9%, at least.
|
||||
|
||||
PKG_MANAGER="apt-get"
|
||||
UPDATE_PKG_CACHE="${PKG_MANAGER} update"
|
||||
subnetClass="24"
|
||||
setupVars="/etc/pivpn/setupVars.conf"
|
||||
|
||||
|
|
@ -33,7 +34,7 @@ spinner(){
|
|||
local pid=$1
|
||||
local delay=0.50
|
||||
local spinstr='/-\|'
|
||||
while ps a | awk '{print $1}' | grep "$pid"; do
|
||||
while ps a | awk '{print $1}' | grep -q "$pid"; do
|
||||
local temp=${spinstr#?}
|
||||
printf " [%c] " "$spinstr"
|
||||
local spinstr=$temp${spinstr%"$temp"}
|
||||
|
|
@ -101,7 +102,7 @@ removeAll(){
|
|||
# Purge dependencies
|
||||
echo "::: Purge dependencies..."
|
||||
|
||||
for i in "${TO_INSTALL[@]}"; do
|
||||
for i in "${INSTALLED_PACKAGES[@]}"; do
|
||||
while true; do
|
||||
read -rp "::: Do you wish to remove $i from your system? [Y/n]: " yn
|
||||
case $yn in
|
||||
|
|
@ -113,11 +114,11 @@ removeAll(){
|
|||
if [ "$PLAT" = "Debian" ] || { [ "$PLAT" = "Raspbian" ] && [ "$(uname -m)" = "armv7l" ]; }; then
|
||||
rm -f /etc/apt/sources.list.d/pivpn-unstable.list
|
||||
rm -f /etc/apt/preferences.d/pivpn-limit-unstable
|
||||
$PKG_MANAGER update &> /dev/null
|
||||
elif [ "$PLAT" = "Ubuntu" ]; then
|
||||
add-apt-repository ppa:wireguard/wireguard -r -y
|
||||
$PKG_MANAGER update &> /dev/null
|
||||
fi
|
||||
echo "::: Updating package cache..."
|
||||
${UPDATE_PKG_CACHE} &> /dev/null & spinner $!
|
||||
|
||||
elif [ "${i}" = "wireguard-dkms" ]; then
|
||||
|
||||
|
|
@ -135,12 +136,6 @@ removeAll(){
|
|||
rm -rf /usr/src/wireguard-tools-"${WG_TOOLS_SNAPSHOT}"
|
||||
fi
|
||||
|
||||
elif [ "${i}" = "dirmngr" ]; then
|
||||
|
||||
# If dirmngr was installed, then we had previously installed wireguard on armv7l Raspbian
|
||||
# so we remove the repository keys
|
||||
apt-key remove E1CF20DDFFE4B89E802658F1E0B11894F66AEC98 80D15823B7FD1561F9F7BCDDDC30D7C23CBBABEE &> /dev/null
|
||||
|
||||
elif [ "${i}" = "unattended-upgrades" ]; then
|
||||
|
||||
### REALLY???
|
||||
|
|
@ -152,7 +147,8 @@ removeAll(){
|
|||
|
||||
if [ "$PLAT" = "Debian" ] || [ "$PLAT" = "Ubuntu" ]; then
|
||||
rm -f /etc/apt/sources.list.d/pivpn-openvpn-repo.list
|
||||
$PKG_MANAGER update &> /dev/null
|
||||
echo "::: Updating package cache..."
|
||||
${UPDATE_PKG_CACHE} &> /dev/null & spinner $!
|
||||
fi
|
||||
deluser openvpn
|
||||
rm -f /etc/rsyslog.d/30-openvpn.conf
|
||||
|
|
|
|||
|
|
@ -15,6 +15,17 @@ fi
|
|||
|
||||
source "${setupVars}"
|
||||
|
||||
scriptusage(){
|
||||
echo "::: Updates PiVPN scripts"
|
||||
echo ":::"
|
||||
echo "::: Usage: pivpn <-up|update> [-t|--test]"
|
||||
echo ":::"
|
||||
echo "::: Commands:"
|
||||
echo "::: [none] Updates from master branch"
|
||||
echo "::: -t, test Updates from test branch"
|
||||
echo "::: -h, help Show this usage dialog"
|
||||
}
|
||||
|
||||
###Functions
|
||||
##Updates scripts
|
||||
updatepivpnscripts(){
|
||||
|
|
@ -68,14 +79,6 @@ cloneupdttest(){
|
|||
git -C "$pivpnlocalpath" checkout master
|
||||
}
|
||||
|
||||
scriptusage(){
|
||||
echo -e "Updates pivpn scripts,
|
||||
|
||||
Usage:
|
||||
pivpn update | updates from master branch
|
||||
pivpn update -t or --test | updates from test branch"
|
||||
}
|
||||
|
||||
## SCRIPT
|
||||
|
||||
if [[ $# -eq 0 ]]; then
|
||||
|
|
@ -83,15 +86,15 @@ if [[ $# -eq 0 ]]; then
|
|||
else
|
||||
while true; do
|
||||
case "$1" in
|
||||
-t|--test|test)
|
||||
-t|test)
|
||||
updatefromtest
|
||||
exit 0
|
||||
;;
|
||||
-h|--help|help)
|
||||
-h|help)
|
||||
scriptusage
|
||||
exit 0
|
||||
;;
|
||||
* )
|
||||
*)
|
||||
updatepivpnscripts
|
||||
exit 0
|
||||
;;
|
||||
|
|
|
|||
|
|
@ -4,8 +4,8 @@ _pivpn()
|
|||
COMPREPLY=()
|
||||
cur="${COMP_WORDS[COMP_CWORD]}"
|
||||
prev="${COMP_WORDS[COMP_CWORD-1]}"
|
||||
dashopts="-a -c -d -l -qr -r -h -u -up -bk"
|
||||
opts="add clients debug list qrcode remove help uninstall update backup"
|
||||
dashopts="-a -c -d -l -qr -r -h -u -up -wg -bk"
|
||||
opts="add clients debug list qrcode remove help uninstall update wgupdate backup"
|
||||
if [ "${#COMP_WORDS[@]}" -eq 2 ]
|
||||
then
|
||||
if [[ ${cur} == -* ]] ; then
|
||||
|
|
|
|||
|
|
@ -10,7 +10,11 @@ hr(){
|
|||
numfmt --to=iec-i --suffix=B "$1"
|
||||
}
|
||||
|
||||
DUMP="$(wg show wg0 dump | tail -n +2)"
|
||||
if DUMP="$(wg show wg0 dump)"; then
|
||||
DUMP="$(tail -n +2 <<< "$DUMP")"
|
||||
else
|
||||
exit 1
|
||||
fi
|
||||
|
||||
printf "\e[1m::: Connected Clients List :::\e[0m\n"
|
||||
|
||||
|
|
@ -28,7 +32,7 @@ while IFS= read -r LINE; do
|
|||
CLIENT_NAME="$(grep "$PUBLIC_KEY" clients.txt | awk '{ print $1 }')"
|
||||
|
||||
if [ "$LAST_SEEN" -ne 0 ]; then
|
||||
printf "%s \t %s \t %s \t %s \t %s \t %s\n" "$CLIENT_NAME" "$REMOTE_IP" "${VIRTUAL_IP/\/32/}" "$(hr "$BYTES_RECEIVED")" "$(hr "$BYTES_SENT")" "$(date -d @"$LAST_SEEN" '+%b %m %Y - %T')"
|
||||
printf "%s \t %s \t %s \t %s \t %s \t %s\n" "$CLIENT_NAME" "$REMOTE_IP" "${VIRTUAL_IP/\/32/}" "$(hr "$BYTES_RECEIVED")" "$(hr "$BYTES_SENT")" "$(date -d @"$LAST_SEEN" '+%b %d %Y - %T')"
|
||||
else
|
||||
printf "%s \t %s \t %s \t %s \t %s \t %s\n" "$CLIENT_NAME" "$REMOTE_IP" "${VIRTUAL_IP/\/32/}" "$(hr "$BYTES_RECEIVED")" "$(hr "$BYTES_SENT")" "(not yet)"
|
||||
fi
|
||||
|
|
|
|||
|
|
@ -2,6 +2,13 @@
|
|||
|
||||
setupVars="/etc/pivpn/setupVars.conf"
|
||||
|
||||
if [ ! -f "${setupVars}" ]; then
|
||||
echo "::: Missing setup vars file!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
source "${setupVars}"
|
||||
|
||||
helpFunc(){
|
||||
echo "::: Create a client conf profile"
|
||||
echo ":::"
|
||||
|
|
@ -39,13 +46,6 @@ while test $# -gt 0; do
|
|||
shift
|
||||
done
|
||||
|
||||
if [ ! -f "${setupVars}" ]; then
|
||||
echo "::: Missing setup vars file!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
source "${setupVars}"
|
||||
|
||||
# The home folder variable was sourced from the settings file.
|
||||
if [ ! -d "${install_home}/configs" ]; then
|
||||
mkdir "${install_home}/configs"
|
||||
|
|
|
|||
|
|
@ -54,6 +54,11 @@ updateScripts(){
|
|||
exit 0
|
||||
}
|
||||
|
||||
updateWireGuard(){
|
||||
$SUDO /opt/pivpn/wgUPDATE.sh
|
||||
exit 0
|
||||
}
|
||||
|
||||
backup(){
|
||||
$SUDO /opt/pivpn/backup.sh
|
||||
}
|
||||
|
|
@ -73,7 +78,8 @@ showHelp(){
|
|||
echo "::: -h, help Show this help dialog"
|
||||
echo "::: -u, uninstall Uninstall pivpn from your system!"
|
||||
echo "::: -up, update Updates PiVPN Scripts"
|
||||
echo "::: -bk, Backup Backup vpn configs and user profiles"
|
||||
echo "::: -wg, wgupdate Updates WireGuard"
|
||||
echo "::: -bk, backup Backup VPN configs and user profiles"
|
||||
exit 0
|
||||
}
|
||||
|
||||
|
|
@ -92,6 +98,7 @@ case "$1" in
|
|||
"-h" | "help" ) showHelp;;
|
||||
"-u" | "uninstall" ) uninstallServer;;
|
||||
"-up" | "update" ) updateScripts "$@" ;;
|
||||
"-wg" | "wgupdate" ) updateWireGuard ;;
|
||||
"-bk" | "backup" ) backup ;;
|
||||
* ) showHelp;;
|
||||
esac
|
||||
|
|
|
|||
|
|
@ -10,32 +10,30 @@ fi
|
|||
|
||||
source "${setupVars}"
|
||||
|
||||
EXAMPLE="$(head -1 /etc/wireguard/configs/clients.txt | awk '{print $1}')"
|
||||
ERR=0
|
||||
|
||||
echo -e "::::\t\t\e[4mPiVPN debug\e[0m\t\t ::::"
|
||||
printf "=============================================\n"
|
||||
echo -e "::::\t\t\e[4mLatest commit\e[0m\t\t ::::"
|
||||
git --git-dir /etc/.pivpn/.git log -n 1
|
||||
printf "=============================================\n"
|
||||
echo -e "::::\t \e[4mInstallation settings\e[0m \t ::::"
|
||||
sed "s/$pivpnHOST/REDACTED/" < /etc/pivpn/setupVars.conf
|
||||
sed "s/$pivpnHOST/REDACTED/" < /etc/pivpn/setupVars.conf
|
||||
printf "=============================================\n"
|
||||
echo -e ":::: \e[4mServer configuration shown below\e[0m ::::"
|
||||
cd /etc/wireguard/keys
|
||||
cp ../wg0.conf ../wg0.tmp
|
||||
# Replace every key in the server configuration with just its file name
|
||||
for k in *; do
|
||||
sed "s#$(cat "$k")#$k#" -i ../wg0.tmp
|
||||
sed "s#$(<"$k")#$k#" -i ../wg0.tmp
|
||||
done
|
||||
cat ../wg0.tmp
|
||||
rm ../wg0.tmp
|
||||
printf "=============================================\n"
|
||||
echo -e ":::: \e[4mClient configuration shown below\e[0m ::::"
|
||||
EXAMPLE="$(head -1 /etc/wireguard/configs/clients.txt | awk '{print $1}')"
|
||||
if [ -n "$EXAMPLE" ]; then
|
||||
cp ../configs/"$EXAMPLE".conf ../configs/"$EXAMPLE".tmp
|
||||
for k in *; do
|
||||
sed "s#$(cat "$k")#$k#" -i ../configs/"$EXAMPLE".tmp
|
||||
sed "s#$(<"$k")#$k#" -i ../configs/"$EXAMPLE".tmp
|
||||
done
|
||||
sed "s/$pivpnHOST/REDACTED/" < ../configs/"$EXAMPLE".tmp
|
||||
rm ../configs/"$EXAMPLE".tmp
|
||||
|
|
@ -48,151 +46,7 @@ echo -e ":::: \t\e[4mRecursive list of files in\e[0m\t ::::\n::::\e\t[4m/etc/wir
|
|||
ls -LR /etc/wireguard
|
||||
printf "=============================================\n"
|
||||
echo -e "::::\t\t\e[4mSelf check\e[0m\t\t ::::"
|
||||
|
||||
if [ "$(cat /proc/sys/net/ipv4/ip_forward)" -eq 1 ]; then
|
||||
echo ":: [OK] IP forwarding is enabled"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] IP forwarding is not enabled, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
sed -i '/net.ipv4.ip_forward=1/s/^#//g' /etc/sysctl.conf
|
||||
sysctl -p
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$USING_UFW" -eq 0 ]; then
|
||||
|
||||
if iptables -t nat -C POSTROUTING -s 10.6.0.0/24 -o "${IPv4dev}" -j MASQUERADE -m comment --comment "${VPN}-nat-rule" &> /dev/null; then
|
||||
echo ":: [OK] Iptables MASQUERADE rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Iptables MASQUERADE rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
iptables -t nat -I POSTROUTING -s 10.6.0.0/24 -o "${IPv4dev}" -j MASQUERADE -m comment --comment "${VPN}-nat-rule"
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$INPUT_CHAIN_EDITED" -eq 1 ]; then
|
||||
|
||||
if iptables -C INPUT -i "$IPv4dev" -p udp --dport "$pivpnPORT" -j ACCEPT -m comment --comment "${VPN}-input-rule" &> /dev/null; then
|
||||
echo ":: [OK] Iptables INPUT rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Iptables INPUT rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
iptables -I INPUT 1 -i "$IPv4dev" -p udp --dport "$pivpnPORT" -j ACCEPT -m comment --comment "${VPN}-input-rule"
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$FORWARD_CHAIN_EDITED" -eq 1 ]; then
|
||||
|
||||
if iptables -C FORWARD -s 10.6.0.0/24 -i wg0 -o "$IPv4dev" -j ACCEPT -m comment --comment "${VPN}-forward-rule" &> /dev/null; then
|
||||
echo ":: [OK] Iptables FORWARD rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Iptables FORWARD rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
iptables -I FORWARD 1 -d 10.6.0.0/24 -i "$IPv4dev" -o wg0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT -m comment --comment "${VPN}-forward-rule"
|
||||
iptables -I FORWARD 2 -s 10.6.0.0/24 -i wg0 -o "$IPv4dev" -j ACCEPT -m comment --comment "${VPN}-forward-rule"
|
||||
iptables-save > /etc/iptables/rules.v4
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
|
||||
else
|
||||
|
||||
if LANG="en_US.UTF-8" ufw status | grep -qw 'active'; then
|
||||
echo ":: [OK] Ufw is enabled"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Ufw is not enabled, try to enable now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
ufw enable
|
||||
fi
|
||||
fi
|
||||
|
||||
if iptables -t nat -C POSTROUTING -s 10.6.0.0/24 -o "${IPv4dev}" -j MASQUERADE -m comment --comment "${VPN}-nat-rule" &> /dev/null; then
|
||||
echo ":: [OK] Iptables MASQUERADE rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Iptables MASQUERADE rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
sed "/delete these required/i *nat\n:POSTROUTING ACCEPT [0:0]\n-I POSTROUTING -s 10.6.0.0/24 -o $IPv4dev -j MASQUERADE -m comment --comment ${VPN}-nat-rule\nCOMMIT\n" -i /etc/ufw/before.rules
|
||||
ufw reload
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if iptables -C ufw-user-input -p udp --dport "${pivpnPORT}" -j ACCEPT &> /dev/null; then
|
||||
echo ":: [OK] Ufw input rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Ufw input rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
ufw insert 1 allow "$pivpnPORT"/udp
|
||||
ufw reload
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if iptables -C ufw-user-forward -i wg0 -o "${IPv4dev}" -s 10.6.0.0/24 -j ACCEPT &> /dev/null; then
|
||||
echo ":: [OK] Ufw forwarding rule set"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] Ufw forwarding rule is not set, attempt fix now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
ufw route insert 1 allow in on wg0 from 10.6.0.0/24 out on "$IPv4dev" to any
|
||||
ufw reload
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
fi
|
||||
|
||||
if systemctl is-active -q wg-quick@wg0; then
|
||||
echo ":: [OK] WireGuard is running"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] WireGuard is not running, try to start now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
systemctl start wg-quick@wg0
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if systemctl is-enabled -q wg-quick@wg0; then
|
||||
echo ":: [OK] WireGuard is enabled (it will automatically start on reboot)"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] WireGuard is not enabled, try to enable now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
systemctl enable wg-quick@wg0
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
# grep -w (whole word) is used so port 11940 won't match when looking for 1194
|
||||
if netstat -uanp | grep -w "${pivpnPORT}" | grep -q 'udp'; then
|
||||
echo ":: [OK] WireGuard is listening on port ${pivpnPORT}/udp"
|
||||
else
|
||||
ERR=1
|
||||
read -r -p ":: [ERR] WireGuard is not listening, try to restart now? [Y/n] " REPLY
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]] || [[ -z ${REPLY} ]]; then
|
||||
systemctl restart wg-quick@wg0
|
||||
echo "Done"
|
||||
fi
|
||||
fi
|
||||
|
||||
if [ "$ERR" -eq 1 ]; then
|
||||
echo -e "[INFO] Run \e[1mpivpn -d\e[0m again to see if we detect issues"
|
||||
fi
|
||||
/opt/pivpn/self_check.sh
|
||||
printf "=============================================\n"
|
||||
echo -e ":::: \e[1mWARNING\e[0m: This script should have automatically masked sensitive ::::"
|
||||
echo -e ":::: information, however, still make sure that \e[4mPrivateKey\e[0m, \e[4mPublicKey\e[0m ::::"
|
||||
|
|
|
|||
|
|
@ -2,6 +2,13 @@
|
|||
|
||||
setupVars="/etc/pivpn/setupVars.conf"
|
||||
|
||||
if [ ! -f "${setupVars}" ]; then
|
||||
echo "::: Missing setup vars file!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
source "${setupVars}"
|
||||
|
||||
helpFunc(){
|
||||
echo "::: Remove a client conf profile"
|
||||
echo ":::"
|
||||
|
|
@ -29,13 +36,6 @@ do
|
|||
shift
|
||||
done
|
||||
|
||||
if [ ! -f "${setupVars}" ]; then
|
||||
echo "::: Missing setup vars file!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
source "${setupVars}"
|
||||
|
||||
cd /etc/wireguard
|
||||
if [ ! -s configs/clients.txt ]; then
|
||||
echo "::: There are no clients to remove"
|
||||
|
|
|
|||
132
scripts/wireguard/wgUPDATE.sh
Executable file
132
scripts/wireguard/wgUPDATE.sh
Executable file
|
|
@ -0,0 +1,132 @@
|
|||
#!/bin/bash
|
||||
|
||||
setupVars="/etc/pivpn/setupVars.conf"
|
||||
|
||||
if [ ! -f "${setupVars}" ]; then
|
||||
echo "::: Missing setup vars file!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
source "${setupVars}"
|
||||
|
||||
if [ "$(uname -m)" != "armv6l" ]; then
|
||||
echo "On your system, WireGuard updates via the package manager"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
CURRENT_WG_TOOLS_SNAPSHOT="${WG_TOOLS_SNAPSHOT}"
|
||||
WG_TOOLS_SNAPSHOT="$(curl -s https://build.wireguard.com/distros.json | jq -r '."upstream-tools"."version"')"
|
||||
|
||||
if dpkg --compare-versions "${WG_TOOLS_SNAPSHOT}" gt "${CURRENT_WG_TOOLS_SNAPSHOT}"; then
|
||||
|
||||
read -r -p "A new wireguard-tools update is available (${WG_TOOLS_SNAPSHOT}), install? [Y/n]: "
|
||||
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]]; then
|
||||
echo "::: Upgrading wireguard-tools from ${CURRENT_WG_TOOLS_SNAPSHOT} to ${WG_TOOLS_SNAPSHOT}..."
|
||||
|
||||
WG_TOOLS_SOURCE="https://git.zx2c4.com/wireguard-tools/snapshot/wireguard-tools-${WG_TOOLS_SNAPSHOT}.tar.xz"
|
||||
echo "::: Downloading wireguard-tools source code... "
|
||||
wget -qO- "${WG_TOOLS_SOURCE}" | tar xJ --directory /usr/src
|
||||
echo "done!"
|
||||
|
||||
## || exits if cd fails.
|
||||
cd /usr/src/wireguard-tools-"${WG_TOOLS_SNAPSHOT}/src" || exit 1
|
||||
|
||||
# We install the userspace tools manually since DKMS only compiles and
|
||||
# installs the kernel module
|
||||
echo "::: Compiling WireGuard tools... "
|
||||
if make; then
|
||||
echo "done!"
|
||||
else
|
||||
echo "failed!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Use checkinstall to install userspace tools so if the user wants to uninstall
|
||||
# PiVPN we can just do apt remove wireguard-tools, instead of manually removing
|
||||
# files from the file system
|
||||
echo "::: Installing WireGuard tools... "
|
||||
if checkinstall --pkgname wireguard-tools --pkgversion "${WG_TOOLS_SNAPSHOT}" -y; then
|
||||
echo "done!"
|
||||
else
|
||||
echo "failed!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "::: Removing old source code ..."
|
||||
rm -rf /usr/src/wireguard-tools-"${CURRENT_WG_TOOLS_SNAPSHOT}"
|
||||
|
||||
sed "s/WG_TOOLS_SNAPSHOT=${CURRENT_WG_TOOLS_SNAPSHOT}/WG_TOOLS_SNAPSHOT=${WG_TOOLS_SNAPSHOT}/" -i "${setupVars}"
|
||||
|
||||
echo "::: Upgrade completed!"
|
||||
fi
|
||||
else
|
||||
echo "::: You are running the lastest version of wireguard-tools (${CURRENT_WG_TOOLS_SNAPSHOT})"
|
||||
fi
|
||||
|
||||
CURRENT_WG_MODULE_SNAPSHOT="${WG_MODULE_SNAPSHOT}"
|
||||
WG_MODULE_SNAPSHOT="$(curl -s https://build.wireguard.com/distros.json | jq -r '."upstream-linuxcompat"."version"')"
|
||||
|
||||
if dpkg --compare-versions "${WG_MODULE_SNAPSHOT}" gt "${CURRENT_WG_MODULE_SNAPSHOT}"; then
|
||||
|
||||
read -r -p "A new wireguard-dkms update is available (${WG_MODULE_SNAPSHOT}), install? [Y/n]: "
|
||||
|
||||
if [[ ${REPLY} =~ ^[Yy]$ ]]; then
|
||||
echo "::: Upgrading wireguard-dkms from ${CURRENT_WG_MODULE_SNAPSHOT} to ${WG_MODULE_SNAPSHOT}..."
|
||||
|
||||
WG_MODULE_SOURCE="https://git.zx2c4.com/wireguard-linux-compat/snapshot/wireguard-linux-compat-${WG_MODULE_SNAPSHOT}.tar.xz"
|
||||
echo "::: Downloading wireguard-linux-compat source code... "
|
||||
wget -qO- "${WG_MODULE_SOURCE}" | tar xJ --directory /usr/src
|
||||
echo "done!"
|
||||
|
||||
# Rename wireguard-linux-compat folder and move the source code to the parent folder
|
||||
# such that dkms picks up the module when referencing wireguard/"${WG_MODULE_SNAPSHOT}"
|
||||
cd /usr/src && \
|
||||
mv wireguard-linux-compat-"${WG_MODULE_SNAPSHOT}" wireguard-"${WG_MODULE_SNAPSHOT}" && \
|
||||
cd wireguard-"${WG_MODULE_SNAPSHOT}" && \
|
||||
mv src/* . && \
|
||||
rmdir src || exit 1
|
||||
|
||||
echo "::: Adding WireGuard module via DKMS... "
|
||||
if dkms add wireguard/"${WG_MODULE_SNAPSHOT}"; then
|
||||
echo "done!"
|
||||
else
|
||||
echo "failed!"
|
||||
dkms remove wireguard/"${WG_MODULE_SNAPSHOT}" --all
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "::: Compiling WireGuard module via DKMS... "
|
||||
if dkms build wireguard/"${WG_MODULE_SNAPSHOT}"; then
|
||||
echo "done!"
|
||||
else
|
||||
echo "failed!"
|
||||
dkms remove wireguard/"${WG_MODULE_SNAPSHOT}" --all
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "::: Installing WireGuard module via DKMS... "
|
||||
if dkms install wireguard/"${WG_MODULE_SNAPSHOT}"; then
|
||||
echo "done!"
|
||||
else
|
||||
echo "failed!"
|
||||
dkms remove wireguard/"${WG_MODULE_SNAPSHOT}" --all
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "::: Removing old kernel module and source code..."
|
||||
if dkms remove wireguard/"${CURRENT_WG_MODULE_SNAPSHOT}" --all; then
|
||||
rm -rf /usr/src/wireguard-"${CURRENT_WG_MODULE_SNAPSHOT}"
|
||||
echo "done!"
|
||||
else
|
||||
echo "failed!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
sed "s/WG_TOOLS_SNAPSHOT=${CURRENT_WG_MODULE_SNAPSHOT}/WG_TOOLS_SNAPSHOT=${WG_MODULE_SNAPSHOT}/" -i "${setupVars}"
|
||||
|
||||
echo "::: Upgrade completed!"
|
||||
fi
|
||||
else
|
||||
echo "::: You are running the lastest version of wireguard-dkms (${CURRENT_WG_MODULE_SNAPSHOT})"
|
||||
fi
|
||||
Loading…
Reference in a new issue