added alpine support
This commit is contained in:
Maksymilian Potok
parent
4f737ac2f8
commit
76f29a20df
@ -38,6 +38,13 @@ elif [[ -e /etc/fedora-release ]]; then
|
|||||||
os="fedora"
|
os="fedora"
|
||||||
os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)
|
os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)
|
||||||
group_name="nobody"
|
group_name="nobody"
|
||||||
|
elif [[ -e /etc/alpine-release ]]; then
|
||||||
|
os="alpine"
|
||||||
|
if [[ ! -d /dev/net ]]; then
|
||||||
|
mkdir -p /dev/net && \
|
||||||
|
mknod /dev/net/tun c 10 200 && \
|
||||||
|
chmod 600 /dev/net/tun
|
||||||
|
fi
|
||||||
else
|
else
|
||||||
echo "This installer seems to be running on an unsupported distribution.
|
echo "This installer seems to be running on an unsupported distribution.
|
||||||
Supported distributions are Ubuntu, Debian, CentOS, and Fedora."
|
Supported distributions are Ubuntu, Debian, CentOS, and Fedora."
|
||||||
@ -202,7 +209,7 @@ if [[ ! -e /etc/openvpn/server/server.conf ]]; then
|
|||||||
# We don't want to silently enable firewalld, so we give a subtle warning
|
# We don't want to silently enable firewalld, so we give a subtle warning
|
||||||
# If the user continues, firewalld will be installed and enabled during setup
|
# If the user continues, firewalld will be installed and enabled during setup
|
||||||
echo "firewalld, which is required to manage routing tables, will also be installed."
|
echo "firewalld, which is required to manage routing tables, will also be installed."
|
||||||
elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then
|
elif [[ "$os" == "debian" || "$os" == "ubuntu" || "$os" == "alpine" ]]; then
|
||||||
# iptables is way less invasive than firewalld so no warning is given
|
# iptables is way less invasive than firewalld so no warning is given
|
||||||
firewall="iptables"
|
firewall="iptables"
|
||||||
fi
|
fi
|
||||||
@ -220,6 +227,9 @@ LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disab
|
|||||||
elif [[ "$os" = "centos" ]]; then
|
elif [[ "$os" = "centos" ]]; then
|
||||||
yum install -y epel-release
|
yum install -y epel-release
|
||||||
yum install -y openvpn openssl ca-certificates tar $firewall
|
yum install -y openvpn openssl ca-certificates tar $firewall
|
||||||
|
elif [[ "$os" = "alpine" ]]; then
|
||||||
|
apk update
|
||||||
|
apk add openvpn openssl ca-certificates $firewall
|
||||||
else
|
else
|
||||||
# Else, OS must be Fedora
|
# Else, OS must be Fedora
|
||||||
dnf install -y openvpn openssl ca-certificates tar $firewall
|
dnf install -y openvpn openssl ca-certificates tar $firewall
|
||||||
@ -511,25 +521,27 @@ else
|
|||||||
if [[ "$remove" =~ ^[yY]$ ]]; then
|
if [[ "$remove" =~ ^[yY]$ ]]; then
|
||||||
port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
|
port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
|
||||||
protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
|
protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2)
|
||||||
if systemctl is-active --quiet firewalld.service; then
|
if [[ -x /run/systemd/system ]]; then
|
||||||
ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
|
if systemctl is-active --quiet firewalld.service; then
|
||||||
# Using both permanent and not permanent rules to avoid a firewalld reload.
|
ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
|
||||||
firewall-cmd --remove-port="$port"/"$protocol"
|
# Using both permanent and not permanent rules to avoid a firewalld reload.
|
||||||
firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
|
firewall-cmd --remove-port="$port"/"$protocol"
|
||||||
firewall-cmd --permanent --remove-port="$port"/"$protocol"
|
firewall-cmd --zone=trusted --remove-source=10.8.0.0/24
|
||||||
firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
|
firewall-cmd --permanent --remove-port="$port"/"$protocol"
|
||||||
firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
|
firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
|
||||||
firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
|
firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
|
||||||
if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
|
firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
|
||||||
ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
|
if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then
|
||||||
firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
|
ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
|
||||||
firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
|
firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
|
||||||
firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
|
firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
|
||||||
firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
|
firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
|
||||||
|
firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
systemctl disable --now openvpn-iptables.service
|
||||||
|
rm -f /etc/systemd/system/openvpn-iptables.service
|
||||||
fi
|
fi
|
||||||
else
|
|
||||||
systemctl disable --now openvpn-iptables.service
|
|
||||||
rm -f /etc/systemd/system/openvpn-iptables.service
|
|
||||||
fi
|
fi
|
||||||
if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
|
if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
|
||||||
semanage port -d -t openvpn_port_t -p "$protocol" "$port"
|
semanage port -d -t openvpn_port_t -p "$protocol" "$port"
|
||||||
@ -540,6 +552,8 @@ else
|
|||||||
rm -f /etc/sysctl.d/99-openvpn-forward.conf
|
rm -f /etc/sysctl.d/99-openvpn-forward.conf
|
||||||
if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
|
if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
|
||||||
apt-get remove --purge -y openvpn
|
apt-get remove --purge -y openvpn
|
||||||
|
elif [[ "$os" = "alpine" ]]; then
|
||||||
|
apk del openvpn
|
||||||
else
|
else
|
||||||
# Else, OS must be CentOS or Fedora
|
# Else, OS must be CentOS or Fedora
|
||||||
yum remove -y openvpn
|
yum remove -y openvpn
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user