Merge branch 'tweak_configs'

README.md

@@ -7,7 +7,7 @@ OpenVPN server in a Docker container complete with an EasyRSA PKI CA.
 * Initalize the `openvpn-data` container that will hold the configuration files
   and certificates
 
-        docker run --name openvpn-data -it kylemanna/openvpn ovpn_init VPN.SERVERNAME.COM
+        docker run --name openvpn-data -it kylemanna/openvpn ovpn_init udp://VPN.SERVERNAME.COM:1194
 
 * Start OpenVPN server process
 
@@ -58,7 +58,7 @@ is rooted.
 The topology used is `net30`, because it works on the widest range of OS.
 `p2p`, for instance, does not work on Windows.
 
-The UDP server uses`192.168.255.128/25`.
+The UDP server uses`192.168.255.0/24` for dynamic clients by default.
 
 The client profile specifies `redirect-gateway def1`, meaning that after
 establishing the VPN connection, all traffic will go through the VPN.

bin/ovpn_genconfig

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 #
 # Generate OpenVPN configs
@@ -6,15 +6,22 @@
 
 set -ex
 
-servername=$(cat "$OPENVPN/servername" 2> /dev/null)
-cn=${1-$servername}
+server_url=$1
+[ -z "$server_url" ] && server_url=$(cat "$OPENVPN/server_url" 2> /dev/null)
 
-if [ -z "$cn" ]; then
+if [[ "$server_url" =~ ^((udp|tcp)://)?([0-9a-zA-Z\.]+)(:([0-9]+))?$ ]]; then
+    proto=${BASH_REMATCH[2]};
+    port=${BASH_REMATCH[5]};
+else
     echo "Common name not specified"
     exit 1
 fi
 
-conf=$OPENVPN/udp1194.conf
+# Apply defaults
+[ -z "$proto" ] && proto=1194
+[ -z "$port" ] && port=udp
+
+conf=$OPENVPN/openvpn.conf
 if [ -f "$conf" ]; then
     bak=$conf.$(date +%s).bak
     echo "Backing up $conf -> $bak"
@@ -40,8 +47,8 @@ push "dhcp-option DNS 8.8.8.8"
 client-config-dir $OPENVPN/ccd
 route 192.168.254.0 255.255.255.0
 
-proto udp
-port 1194
-dev tun1194
-status /tmp/openvpn-status-1194.log
+proto $proto
+port $port
+dev tun0
+status /tmp/openvpn-status.log
 EOF

bin/ovpn_getclient

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 #
 # Get an OpenVPN client configuration file
@@ -6,19 +6,30 @@
 
 set -ex
 
-cn=$1
+if [ -s "$OPENVPN/server_url" ]; then
+    server_url=$(cat "$OPENVPN/server_url" 2> /dev/null)
+else
+    # TODO Backwards compatible, need to throw away eventually
+    server_url=$(cat "$OPENVPN/servername" 2> /dev/null)
+fi
 
-if [ -z "$cn" ]; then
+if [[ "$server_url" =~ ^((udp|tcp)://)?([0-9a-zA-Z\.]+)(:([0-9]+))?$ ]]; then
+    proto=${BASH_REMATCH[2]};
+    servername=${BASH_REMATCH[3]};
+    port=${BASH_REMATCH[5]};
+else
     echo "Common name not specified"
     exit 1
 fi
 
+# Apply defaults
+[ -z "$proto" ] && proto=1194
+[ -z "$port" ] && port=udp
+
 if [ ! -f "$EASYRSA_PKI/private/$cn.key" ]; then
     easyrsa build-server-full $cn nopass
 fi
 
-servername=$(cat $OPENVPN/servername)
-
 cat <<EOF
 client
 nobind
@@ -44,6 +55,6 @@ $(cat $EASYRSA_PKI/ta.key)
 key-direction 1
 
 <connection>
-remote $servername 1194 udp
+remote $servername $port $proto
 </connection>
 EOF

bin/ovpn_init

@@ -1,4 +1,4 @@
-#!/bin/sh
+#!/bin/bash
 
 #
 # Initialize the PKI and OpenVPN configs
@@ -6,13 +6,22 @@
 
 set -ex
 
-cn=$1
+server_url=$1
 
-if [ -z "$cn" ]; then
+# Server name is in the form "udp://vpn.example.com:1194"
+if [[ "$server_url" =~ ^((udp|tcp)://)?([0-9a-zA-Z\.]+)(:([0-9]+))?$ ]]; then
+    proto=${BASH_REMATCH[2]};
+    cn=${BASH_REMATCH[3]};
+    port=${BASH_REMATCH[5]};
+else
     echo "Common name not specified"
     exit 1
 fi
 
+# Apply defaults
+[ -z "$proto" ] && proto=1194
+[ -z "$port" ] && port=udp
+
 # Specify "nopass" as arg[2] to make the CA insecure
 nopass=$2
 
@@ -37,7 +46,7 @@ openvpn --genkey --secret $OPENVPN/pki/ta.key
 #    [ -n "$ptr" ] && cn=$ptr || cn=$ip4
 #fi
 
-echo "$cn" > $OPENVPN/servername
+echo "$server_url" > $OPENVPN/server_url
 
 # For a server key with a password, manually init; this is autopilot
 easyrsa build-server-full $cn nopass

bin/ovpn_run

@@ -20,4 +20,9 @@ iptables -t nat -A POSTROUTING -s 192.168.254.0/24 -o eth0 -j MASQUERADE
 # Dynamic subnet
 iptables -t nat -A POSTROUTING -s 192.168.255.0/24 -o eth0 -j MASQUERADE
 
-openvpn --config "$OPENVPN/udp1194.conf"
+conf="$OPENVPN/openvpn.conf"
+
+# TODO Remove after we stop caring about backwards compatibility
+[ ! -s "$conf" ] && conf="$OPENVPN/udp1194.conf"
+
+openvpn --config "$conf"

bin/ovpn_status

@@ -6,4 +6,4 @@
 
 set -ex
 
-tail -F /tmp/openvpn-status-1194.log
+tail -F /tmp/openvpn-status.log