diff --git a/README.md b/README.md index cc4a8bf..e091b7c 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ OpenVPN server in a Docker container complete with an EasyRSA PKI CA. * Initalize the `openvpn-data` container that will hold the configuration files and certificates - docker run --name openvpn-data -it kylemanna/openvpn ovpn_init VPN.SERVERNAME.COM + docker run --name openvpn-data -it kylemanna/openvpn ovpn_init udp://VPN.SERVERNAME.COM:1194 * Start OpenVPN server process @@ -58,7 +58,7 @@ is rooted. The topology used is `net30`, because it works on the widest range of OS. `p2p`, for instance, does not work on Windows. -The UDP server uses`192.168.255.128/25`. +The UDP server uses`192.168.255.0/24` for dynamic clients by default. The client profile specifies `redirect-gateway def1`, meaning that after establishing the VPN connection, all traffic will go through the VPN. diff --git a/bin/ovpn_genconfig b/bin/ovpn_genconfig index e3e47ae..3bf1f4c 100755 --- a/bin/ovpn_genconfig +++ b/bin/ovpn_genconfig @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # # Generate OpenVPN configs @@ -6,15 +6,22 @@ set -ex -servername=$(cat "$OPENVPN/servername" 2> /dev/null) -cn=${1-$servername} +server_url=$1 +[ -z "$server_url" ] && server_url=$(cat "$OPENVPN/server_url" 2> /dev/null) -if [ -z "$cn" ]; then +if [[ "$server_url" =~ ^((udp|tcp)://)?([0-9a-zA-Z\.]+)(:([0-9]+))?$ ]]; then + proto=${BASH_REMATCH[2]}; + port=${BASH_REMATCH[5]}; +else echo "Common name not specified" exit 1 fi -conf=$OPENVPN/udp1194.conf +# Apply defaults +[ -z "$proto" ] && proto=1194 +[ -z "$port" ] && port=udp + +conf=$OPENVPN/openvpn.conf if [ -f "$conf" ]; then bak=$conf.$(date +%s).bak echo "Backing up $conf -> $bak" @@ -40,8 +47,8 @@ push "dhcp-option DNS 8.8.8.8" client-config-dir $OPENVPN/ccd route 192.168.254.0 255.255.255.0 -proto udp -port 1194 -dev tun1194 -status /tmp/openvpn-status-1194.log +proto $proto +port $port +dev tun0 +status /tmp/openvpn-status.log EOF diff --git a/bin/ovpn_getclient b/bin/ovpn_getclient index 5a476d1..4def85b 100755 --- a/bin/ovpn_getclient +++ b/bin/ovpn_getclient @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # # Get an OpenVPN client configuration file @@ -6,19 +6,30 @@ set -ex -cn=$1 +if [ -s "$OPENVPN/server_url" ]; then + server_url=$(cat "$OPENVPN/server_url" 2> /dev/null) +else + # TODO Backwards compatible, need to throw away eventually + server_url=$(cat "$OPENVPN/servername" 2> /dev/null) +fi -if [ -z "$cn" ]; then +if [[ "$server_url" =~ ^((udp|tcp)://)?([0-9a-zA-Z\.]+)(:([0-9]+))?$ ]]; then + proto=${BASH_REMATCH[2]}; + servername=${BASH_REMATCH[3]}; + port=${BASH_REMATCH[5]}; +else echo "Common name not specified" exit 1 fi +# Apply defaults +[ -z "$proto" ] && proto=1194 +[ -z "$port" ] && port=udp + if [ ! -f "$EASYRSA_PKI/private/$cn.key" ]; then easyrsa build-server-full $cn nopass fi -servername=$(cat $OPENVPN/servername) - cat < -remote $servername 1194 udp +remote $servername $port $proto EOF diff --git a/bin/ovpn_init b/bin/ovpn_init index e24291b..21a9fe2 100755 --- a/bin/ovpn_init +++ b/bin/ovpn_init @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # # Initialize the PKI and OpenVPN configs @@ -6,13 +6,22 @@ set -ex -cn=$1 +server_url=$1 -if [ -z "$cn" ]; then +# Server name is in the form "udp://vpn.example.com:1194" +if [[ "$server_url" =~ ^((udp|tcp)://)?([0-9a-zA-Z\.]+)(:([0-9]+))?$ ]]; then + proto=${BASH_REMATCH[2]}; + cn=${BASH_REMATCH[3]}; + port=${BASH_REMATCH[5]}; +else echo "Common name not specified" exit 1 fi +# Apply defaults +[ -z "$proto" ] && proto=1194 +[ -z "$port" ] && port=udp + # Specify "nopass" as arg[2] to make the CA insecure nopass=$2 @@ -37,7 +46,7 @@ openvpn --genkey --secret $OPENVPN/pki/ta.key # [ -n "$ptr" ] && cn=$ptr || cn=$ip4 #fi -echo "$cn" > $OPENVPN/servername +echo "$server_url" > $OPENVPN/server_url # For a server key with a password, manually init; this is autopilot easyrsa build-server-full $cn nopass diff --git a/bin/ovpn_run b/bin/ovpn_run index 77e0c21..4ff492f 100755 --- a/bin/ovpn_run +++ b/bin/ovpn_run @@ -20,4 +20,9 @@ iptables -t nat -A POSTROUTING -s 192.168.254.0/24 -o eth0 -j MASQUERADE # Dynamic subnet iptables -t nat -A POSTROUTING -s 192.168.255.0/24 -o eth0 -j MASQUERADE -openvpn --config "$OPENVPN/udp1194.conf" +conf="$OPENVPN/openvpn.conf" + +# TODO Remove after we stop caring about backwards compatibility +[ ! -s "$conf" ] && conf="$OPENVPN/udp1194.conf" + +openvpn --config "$conf" diff --git a/bin/ovpn_status b/bin/ovpn_status index 40a915a..4e99e20 100755 --- a/bin/ovpn_status +++ b/bin/ovpn_status @@ -6,4 +6,4 @@ set -ex -tail -F /tmp/openvpn-status-1194.log +tail -F /tmp/openvpn-status.log