Patch/openvpn-install
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add openSUSE support

Browse Source
This commit is contained in:
Alexander Postol 2021-01-26 14:17:54 +03:00
parent 26e39cf4d7
commit b4004878dd
1 changed files with 85 additions and 54 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

139
openvpn-install.sh
View File

@ -38,6 +38,10 @@ elif [[ -e /etc/fedora-release ]]; then
os="fedora" os="fedora"
os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1) os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1)
group_name="nobody" group_name="nobody"
elif [[ -e /etc/os-release ]]; then
os="opensuse-leap"
os_version=$(grep -oE '[0-9]+' /etc/os-release | head -1)
group_name="nobody"
else else
echo "This installer seems to be running on an unsupported distribution. echo "This installer seems to be running on an unsupported distribution.
Supported distributions are Ubuntu, Debian, CentOS, and Fedora." Supported distributions are Ubuntu, Debian, CentOS, and Fedora."
@ -62,6 +66,12 @@ This version of CentOS is too old and unsupported."
exit exit
fi fi
if [[ "$os" == "opensuse-leap" && "$os_version" -eq 42 ]]; then
echo "openSUSE Leap 15 or higher is required to use this installer.
This version of openSUSE is too old and unsupported."
exit
fi
# Detect environments where $PATH does not include the sbin directories # Detect environments where $PATH does not include the sbin directories
if ! grep -q sbin <<< "$PATH"; then if ! grep -q sbin <<< "$PATH"; then
echo '$PATH does not include sbin. Try using "su -" instead of "su".' echo '$PATH does not include sbin. Try using "su -" instead of "su".'
@ -79,26 +89,34 @@ TUN needs to be enabled before running this installer."
exit exit
fi fi
if [[ "$os" == "opensuse-leap" ]]; then
conf_path=/etc/openvpn
service_name=openvpn@server.service
else
conf_path=/etc/openvpn/server
service_name=openvpn-server@server.service
fi
new_client () { new_client () {
# Generates the custom client.ovpn # Generates the custom client.ovpn
{ {
cat /etc/openvpn/server/client-common.txt cat $conf_path/client-common.txt
echo "<ca>" echo "<ca>"
cat /etc/openvpn/server/easy-rsa/pki/ca.crt cat $conf_path/easy-rsa/pki/ca.crt
echo "</ca>" echo "</ca>"
echo "<cert>" echo "<cert>"
sed -ne '/BEGIN CERTIFICATE/,$ p' /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt sed -ne '/BEGIN CERTIFICATE/,$ p' $conf_path/easy-rsa/pki/issued/"$client".crt
echo "</cert>" echo "</cert>"
echo "<key>" echo "<key>"
cat /etc/openvpn/server/easy-rsa/pki/private/"$client".key cat $conf_path/easy-rsa/pki/private/"$client".key
echo "</key>" echo "</key>"
echo "<tls-crypt>" echo "<tls-crypt>"
sed -ne '/BEGIN OpenVPN Static key/,$ p' /etc/openvpn/server/tc.key sed -ne '/BEGIN OpenVPN Static key/,$ p' $conf_path/tc.key
echo "</tls-crypt>" echo "</tls-crypt>"
} > ~/"$client".ovpn } > ~/"$client".ovpn
} }
if [[ ! -e /etc/openvpn/server/server.conf ]]; then if [[ ! -e $conf_path/server.conf ]]; then
clear clear
echo 'Welcome to this OpenVPN road warrior installer!' echo 'Welcome to this OpenVPN road warrior installer!'
# If system has a single IPv4, it is selected automatically. Else, ask the user # If system has a single IPv4, it is selected automatically. Else, ask the user
@ -197,7 +215,7 @@ if [[ ! -e /etc/openvpn/server/server.conf ]]; then
echo "OpenVPN installation is ready to begin." echo "OpenVPN installation is ready to begin."
# Install a firewall in the rare case where one is not already available # Install a firewall in the rare case where one is not already available
if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then if ! systemctl is-active --quiet firewalld.service && ! hash iptables 2>/dev/null; then
if [[ "$os" == "centos" || "$os" == "fedora" ]]; then if [[ "$os" == "centos" || "$os" == "fedora" || "$os" == "opensuse-leap" ]]; then
firewall="firewalld" firewall="firewalld"
# We don't want to silently enable firewalld, so we give a subtle warning # We don't want to silently enable firewalld, so we give a subtle warning
# If the user continues, firewalld will be installed and enabled during setup # If the user continues, firewalld will be installed and enabled during setup
@ -220,9 +238,12 @@ LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disab
elif [[ "$os" = "centos" ]]; then elif [[ "$os" = "centos" ]]; then
yum install -y epel-release yum install -y epel-release
yum install -y openvpn openssl ca-certificates tar $firewall yum install -y openvpn openssl ca-certificates tar $firewall
elif [[ "$os" = "fedora" ]]; then
dnf install -y openvpn openssl ca-certificates tar $firewall
else else
# Else, OS must be Fedora # Else, OS must be openSUSE
dnf install -y openvpn openssl ca-certificates tar $firewall zypper ref
zypper install openvpn openssl ca-certificates tar $firewal
fi fi
# If firewalld was just installed, enable it # If firewalld was just installed, enable it
if [[ "$firewall" == "firewalld" ]]; then if [[ "$firewall" == "firewalld" ]]; then
@ -230,10 +251,10 @@ LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disab
fi fi
# Get easy-rsa # Get easy-rsa
easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.8/EasyRSA-3.0.8.tgz' easy_rsa_url='https://github.com/OpenVPN/easy-rsa/releases/download/v3.0.8/EasyRSA-3.0.8.tgz'
mkdir -p /etc/openvpn/server/easy-rsa/ mkdir -p $conf_path/easy-rsa/
{ wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C /etc/openvpn/server/easy-rsa/ --strip-components 1 { wget -qO- "$easy_rsa_url" 2>/dev/null || curl -sL "$easy_rsa_url" ; } | tar xz -C $conf_path/easy-rsa/ --strip-components 1
chown -R root:root /etc/openvpn/server/easy-rsa/ chown -R root:root $conf_path/easy-rsa/
cd /etc/openvpn/server/easy-rsa/ cd $conf_path/easy-rsa/
# Create the PKI, set up the CA and the server and client certificates # Create the PKI, set up the CA and the server and client certificates
./easyrsa init-pki ./easyrsa init-pki
./easyrsa --batch build-ca nopass ./easyrsa --batch build-ca nopass
@ -241,13 +262,13 @@ LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disab
EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
# Move the stuff we need # Move the stuff we need
cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem /etc/openvpn/server cp pki/ca.crt pki/private/ca.key pki/issued/server.crt pki/private/server.key pki/crl.pem $conf_path
# CRL is read with each client connection, while OpenVPN is dropped to nobody # CRL is read with each client connection, while OpenVPN is dropped to nobody
chown nobody:"$group_name" /etc/openvpn/server/crl.pem chown nobody:"$group_name" $conf_path/crl.pem
# Without +x in the directory, OpenVPN can't run a stat() on the CRL file # Without +x in the directory, OpenVPN can't run a stat() on the CRL file
chmod o+x /etc/openvpn/server/ chmod o+x $conf_path/
# Generate key for tls-crypt # Generate key for tls-crypt
openvpn --genkey --secret /etc/openvpn/server/tc.key openvpn --genkey --secret $conf_path/tc.key
# Create the DH parameters file using the predefined ffdhe2048 group # Create the DH parameters file using the predefined ffdhe2048 group
echo '-----BEGIN DH PARAMETERS----- echo '-----BEGIN DH PARAMETERS-----
MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
@ -256,7 +277,7 @@ MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD 7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg== ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
-----END DH PARAMETERS-----' > /etc/openvpn/server/dh.pem -----END DH PARAMETERS-----' > $conf_path/dh.pem
# Generate server.conf # Generate server.conf
echo "local $ip echo "local $ip
port $port port $port
@ -269,15 +290,15 @@ dh dh.pem
auth SHA512 auth SHA512
tls-crypt tc.key tls-crypt tc.key
topology subnet topology subnet
server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf server 10.8.0.0 255.255.255.0" > $conf_path/server.conf
# IPv6 # IPv6
if [[ -z "$ip6" ]]; then if [[ -z "$ip6" ]]; then
echo 'push "redirect-gateway def1 bypass-dhcp"' >> /etc/openvpn/server/server.conf echo 'push "redirect-gateway def1 bypass-dhcp"' >> $conf_path/server.conf
else else
echo 'server-ipv6 fddd:1194:1194:1194::/64' >> /etc/openvpn/server/server.conf echo 'server-ipv6 fddd:1194:1194:1194::/64' >> $conf_path/server.conf
echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> /etc/openvpn/server/server.conf echo 'push "redirect-gateway def1 ipv6 bypass-dhcp"' >> $conf_path/server.conf
fi fi
echo 'ifconfig-pool-persist ipp.txt' >> /etc/openvpn/server/server.conf echo 'ifconfig-pool-persist ipp.txt' >> $conf_path/server.conf
# DNS # DNS
case "$dns" in case "$dns" in
1|"") 1|"")
@ -290,28 +311,28 @@ server 10.8.0.0 255.255.255.0" > /etc/openvpn/server/server.conf
fi fi
# Obtain the resolvers from resolv.conf and use them for OpenVPN # Obtain the resolvers from resolv.conf and use them for OpenVPN
grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do grep -v '^#\|^;' "$resolv_conf" | grep '^nameserver' | grep -oE '[0-9]{1,3}(\.[0-9]{1,3}){3}' | while read line; do
echo "push \"dhcp-option DNS $line\"" >> /etc/openvpn/server/server.conf echo "push \"dhcp-option DNS $line\"" >> $conf_path/server.conf
done done
;; ;;
2) 2)
echo 'push "dhcp-option DNS 8.8.8.8"' >> /etc/openvpn/server/server.conf echo 'push "dhcp-option DNS 8.8.8.8"' >> $conf_path/server.conf
echo 'push "dhcp-option DNS 8.8.4.4"' >> /etc/openvpn/server/server.conf echo 'push "dhcp-option DNS 8.8.4.4"' >> $conf_path/server.conf
;; ;;
3) 3)
echo 'push "dhcp-option DNS 1.1.1.1"' >> /etc/openvpn/server/server.conf echo 'push "dhcp-option DNS 1.1.1.1"' >> $conf_path/server.conf
echo 'push "dhcp-option DNS 1.0.0.1"' >> /etc/openvpn/server/server.conf echo 'push "dhcp-option DNS 1.0.0.1"' >> $conf_path/server.conf
;; ;;
4) 4)
echo 'push "dhcp-option DNS 208.67.222.222"' >> /etc/openvpn/server/server.conf echo 'push "dhcp-option DNS 208.67.222.222"' >> $conf_path/server.conf
echo 'push "dhcp-option DNS 208.67.220.220"' >> /etc/openvpn/server/server.conf echo 'push "dhcp-option DNS 208.67.220.220"' >> $conf_path/server.conf
;; ;;
5) 5)
echo 'push "dhcp-option DNS 9.9.9.9"' >> /etc/openvpn/server/server.conf echo 'push "dhcp-option DNS 9.9.9.9"' >> $conf_path/server.conf
echo 'push "dhcp-option DNS 149.112.112.112"' >> /etc/openvpn/server/server.conf echo 'push "dhcp-option DNS 149.112.112.112"' >> $conf_path/server.conf
;; ;;
6) 6)
echo 'push "dhcp-option DNS 94.140.14.14"' >> /etc/openvpn/server/server.conf echo 'push "dhcp-option DNS 94.140.14.14"' >> $conf_path/server.conf
echo 'push "dhcp-option DNS 94.140.15.15"' >> /etc/openvpn/server/server.conf echo 'push "dhcp-option DNS 94.140.15.15"' >> $conf_path/server.conf
;; ;;
esac esac
echo "keepalive 10 120 echo "keepalive 10 120
@ -322,17 +343,25 @@ persist-key
persist-tun persist-tun
status openvpn-status.log status openvpn-status.log
verb 3 verb 3
crl-verify crl.pem" >> /etc/openvpn/server/server.conf crl-verify crl.pem" >> $conf_path/server.conf
if [[ "$protocol" = "udp" ]]; then if [[ "$protocol" = "udp" ]]; then
echo "explicit-exit-notify" >> /etc/openvpn/server/server.conf echo "explicit-exit-notify" >> $conf_path/server.conf
fi fi
# Enable net.ipv4.ip_forward for the system # Enable net.ipv4.ip_forward for the system
echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/30-openvpn-forward.conf if [[ "$os" == "opensuse-leap" ]]; then
sed '1 s/0/1/' /etc/sysctl.d/70-yast.conf
else
echo 'net.ipv4.ip_forward=1' > /etc/sysctl.d/30-openvpn-forward.conf
fi
# Enable without waiting for a reboot or service restart # Enable without waiting for a reboot or service restart
echo 1 > /proc/sys/net/ipv4/ip_forward echo 1 > /proc/sys/net/ipv4/ip_forward
if [[ -n "$ip6" ]]; then if [[ -n "$ip6" ]]; then
# Enable net.ipv6.conf.all.forwarding for the system # Enable net.ipv6.conf.all.forwarding for the system
echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/30-openvpn-forward.conf if [[ "$os" == "opensuse-leap" ]]; then
sed '2 s/0/1/' /etc/sysctl.d/70-yast.conf
else
echo "net.ipv6.conf.all.forwarding=1" >> /etc/sysctl.d/30-openvpn-forward.conf
fi
# Enable without waiting for a reboot or service restart # Enable without waiting for a reboot or service restart
echo 1 > /proc/sys/net/ipv6/conf/all/forwarding echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
fi fi
@ -419,9 +448,9 @@ auth SHA512
cipher AES-256-CBC cipher AES-256-CBC
ignore-unknown-option block-outside-dns ignore-unknown-option block-outside-dns
block-outside-dns block-outside-dns
verb 3" > /etc/openvpn/server/client-common.txt verb 3" > $conf_path/client-common.txt
# Enable and start the OpenVPN service # Enable and start the OpenVPN service
systemctl enable --now openvpn-server@server.service systemctl enable --now $service_name
# Generates the custom client.ovpn # Generates the custom client.ovpn
new_client new_client
echo echo
@ -449,12 +478,12 @@ else
echo "Provide a name for the client:" echo "Provide a name for the client:"
read -p "Name: " unsanitized_client read -p "Name: " unsanitized_client
client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client") client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
while [[ -z "$client" || -e /etc/openvpn/server/easy-rsa/pki/issued/"$client".crt ]]; do while [[ -z "$client" || -e $conf_path/easy-rsa/pki/issued/"$client".crt ]]; do
echo "$client: invalid name." echo "$client: invalid name."
read -p "Name: " unsanitized_client read -p "Name: " unsanitized_client
client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client") client=$(sed 's/[^0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_-]/_/g' <<< "$unsanitized_client")
done done
cd /etc/openvpn/server/easy-rsa/ cd $conf_path/easy-rsa/
EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass EASYRSA_CERT_EXPIRE=3650 ./easyrsa build-client-full "$client" nopass
# Generates the custom client.ovpn # Generates the custom client.ovpn
new_client new_client
@ -465,7 +494,7 @@ else
2) 2)
# This option could be documented a bit better and maybe even be simplified # This option could be documented a bit better and maybe even be simplified
# ...but what can I say, I want some sleep too # ...but what can I say, I want some sleep too
number_of_clients=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep -c "^V") number_of_clients=$(tail -n +2 $conf_path/easy-rsa/pki/index.txt | grep -c "^V")
if [[ "$number_of_clients" = 0 ]]; then if [[ "$number_of_clients" = 0 ]]; then
echo echo
echo "There are no existing clients!" echo "There are no existing clients!"
@ -473,13 +502,13 @@ else
fi fi
echo echo
echo "Select the client to revoke:" echo "Select the client to revoke:"
tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') ' tail -n +2 $conf_path/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | nl -s ') '
read -p "Client: " client_number read -p "Client: " client_number
until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do until [[ "$client_number" =~ ^[0-9]+$ && "$client_number" -le "$number_of_clients" ]]; do
echo "$client_number: invalid selection." echo "$client_number: invalid selection."
read -p "Client: " client_number read -p "Client: " client_number
done done
client=$(tail -n +2 /etc/openvpn/server/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p) client=$(tail -n +2 $conf_path/easy-rsa/pki/index.txt | grep "^V" | cut -d '=' -f 2 | sed -n "$client_number"p)
echo echo
read -p "Confirm $client revocation? [y/N]: " revoke read -p "Confirm $client revocation? [y/N]: " revoke
until [[ "$revoke" =~ ^[yYnN]*$ ]]; do until [[ "$revoke" =~ ^[yYnN]*$ ]]; do
@ -487,13 +516,13 @@ else
read -p "Confirm $client revocation? [y/N]: " revoke read -p "Confirm $client revocation? [y/N]: " revoke
done done
if [[ "$revoke" =~ ^[yY]$ ]]; then if [[ "$revoke" =~ ^[yY]$ ]]; then
cd /etc/openvpn/server/easy-rsa/ cd $conf_path/easy-rsa/
./easyrsa --batch revoke "$client" ./easyrsa --batch revoke "$client"
EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl EASYRSA_CRL_DAYS=3650 ./easyrsa gen-crl
rm -f /etc/openvpn/server/crl.pem rm -f $conf_path/crl.pem
cp /etc/openvpn/server/easy-rsa/pki/crl.pem /etc/openvpn/server/crl.pem cp $conf_path/easy-rsa/pki/crl.pem $conf_path/crl.pem
# CRL is read with each client connection, when OpenVPN is dropped to nobody # CRL is read with each client connection, when OpenVPN is dropped to nobody
chown nobody:"$group_name" /etc/openvpn/server/crl.pem chown nobody:"$group_name" $conf_path/crl.pem
echo echo
echo "$client revoked!" echo "$client revoked!"
else else
@ -510,8 +539,8 @@ else
read -p "Confirm OpenVPN removal? [y/N]: " remove read -p "Confirm OpenVPN removal? [y/N]: " remove
done done
if [[ "$remove" =~ ^[yY]$ ]]; then if [[ "$remove" =~ ^[yY]$ ]]; then
port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2) port=$(grep '^port ' $conf_path/server.conf | cut -d " " -f 2)
protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2) protocol=$(grep '^proto ' $conf_path/server.conf | cut -d " " -f 2)
if systemctl is-active --quiet firewalld.service; then if systemctl is-active --quiet firewalld.service; then
ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$') ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$')
# Using both permanent and not permanent rules to avoid a firewalld reload. # Using both permanent and not permanent rules to avoid a firewalld reload.
@ -521,7 +550,7 @@ else
firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip" firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip" firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip"
if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then if grep -qs "server-ipv6" $conf_path/server.conf; then
ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$') ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$')
firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64 firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64
firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64 firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64
@ -535,12 +564,14 @@ else
if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then
semanage port -d -t openvpn_port_t -p "$protocol" "$port" semanage port -d -t openvpn_port_t -p "$protocol" "$port"
fi fi
systemctl disable --now openvpn-server@server.service systemctl disable --now $service_name
rm -rf /etc/openvpn/server rm -rf $conf_path
rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf rm -f /etc/systemd/system/openvpn-server@server.service.d/disable-limitnproc.conf
rm -f /etc/sysctl.d/30-openvpn-forward.conf rm -f /etc/sysctl.d/30-openvpn-forward.conf
if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then
apt-get remove --purge -y openvpn apt-get remove --purge -y openvpn
elif [[ "$os" == "opensuse-leap" ]]; then
zypper remove --no-clean-deps openvpn
else else
# Else, OS must be CentOS or Fedora # Else, OS must be CentOS or Fedora
yum remove -y openvpn yum remove -y openvpn