From 34eca5b96fcd0fb2a49a33ce84178d0b389ebca5 Mon Sep 17 00:00:00 2001 From: Kyle Manna Date: Mon, 30 Jun 2014 22:43:00 -0700 Subject: [PATCH 1/4] ovpn: Convert from servername -> server_url * Previously the server name cached the common name generated during init and assumed always 1194/udp. * The new configuration allows for users to pass in a url in a new form that allows the protocol to be specified as well as the port. * Example: udp://vpn.example.com:1194 * Try to be backwards compatible. --- bin/ovpn_genconfig | 19 +++++++++++++------ bin/ovpn_getclient | 23 +++++++++++++++++------ bin/ovpn_init | 17 +++++++++++++---- 3 files changed, 43 insertions(+), 16 deletions(-) diff --git a/bin/ovpn_genconfig b/bin/ovpn_genconfig index e3e47ae..2c1b508 100755 --- a/bin/ovpn_genconfig +++ b/bin/ovpn_genconfig @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # # Generate OpenVPN configs @@ -6,14 +6,21 @@ set -ex -servername=$(cat "$OPENVPN/servername" 2> /dev/null) -cn=${1-$servername} +server_url=$1 +[ -z "$server_url" ] && server_url=$(cat "$OPENVPN/server_url" 2> /dev/null) -if [ -z "$cn" ]; then +if [[ "$server_url" =~ ^((udp|tcp)://)?([0-9a-zA-Z\.]+)(:([0-9]+))?$ ]]; then + proto=${BASH_REMATCH[2]}; + port=${BASH_REMATCH[5]}; +else echo "Common name not specified" exit 1 fi +# Apply defaults +[ -z "$proto" ] && proto=1194 +[ -z "$port" ] && port=udp + conf=$OPENVPN/udp1194.conf if [ -f "$conf" ]; then bak=$conf.$(date +%s).bak @@ -40,8 +47,8 @@ push "dhcp-option DNS 8.8.8.8" client-config-dir $OPENVPN/ccd route 192.168.254.0 255.255.255.0 -proto udp -port 1194 +proto $proto +port $port dev tun1194 status /tmp/openvpn-status-1194.log EOF diff --git a/bin/ovpn_getclient b/bin/ovpn_getclient index 5a476d1..4def85b 100755 --- a/bin/ovpn_getclient +++ b/bin/ovpn_getclient @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # # Get an OpenVPN client configuration file @@ -6,19 +6,30 @@ set -ex -cn=$1 +if [ -s "$OPENVPN/server_url" ]; then + server_url=$(cat "$OPENVPN/server_url" 2> /dev/null) +else + # TODO Backwards compatible, need to throw away eventually + server_url=$(cat "$OPENVPN/servername" 2> /dev/null) +fi -if [ -z "$cn" ]; then +if [[ "$server_url" =~ ^((udp|tcp)://)?([0-9a-zA-Z\.]+)(:([0-9]+))?$ ]]; then + proto=${BASH_REMATCH[2]}; + servername=${BASH_REMATCH[3]}; + port=${BASH_REMATCH[5]}; +else echo "Common name not specified" exit 1 fi +# Apply defaults +[ -z "$proto" ] && proto=1194 +[ -z "$port" ] && port=udp + if [ ! -f "$EASYRSA_PKI/private/$cn.key" ]; then easyrsa build-server-full $cn nopass fi -servername=$(cat $OPENVPN/servername) - cat < -remote $servername 1194 udp +remote $servername $port $proto EOF diff --git a/bin/ovpn_init b/bin/ovpn_init index e24291b..21a9fe2 100755 --- a/bin/ovpn_init +++ b/bin/ovpn_init @@ -1,4 +1,4 @@ -#!/bin/sh +#!/bin/bash # # Initialize the PKI and OpenVPN configs @@ -6,13 +6,22 @@ set -ex -cn=$1 +server_url=$1 -if [ -z "$cn" ]; then +# Server name is in the form "udp://vpn.example.com:1194" +if [[ "$server_url" =~ ^((udp|tcp)://)?([0-9a-zA-Z\.]+)(:([0-9]+))?$ ]]; then + proto=${BASH_REMATCH[2]}; + cn=${BASH_REMATCH[3]}; + port=${BASH_REMATCH[5]}; +else echo "Common name not specified" exit 1 fi +# Apply defaults +[ -z "$proto" ] && proto=1194 +[ -z "$port" ] && port=udp + # Specify "nopass" as arg[2] to make the CA insecure nopass=$2 @@ -37,7 +46,7 @@ openvpn --genkey --secret $OPENVPN/pki/ta.key # [ -n "$ptr" ] && cn=$ptr || cn=$ip4 #fi -echo "$cn" > $OPENVPN/servername +echo "$server_url" > $OPENVPN/server_url # For a server key with a password, manually init; this is autopilot easyrsa build-server-full $cn nopass From 836b473d20692bb24f9f62c5340572da381a0e0a Mon Sep 17 00:00:00 2001 From: Kyle Manna Date: Mon, 30 Jun 2014 22:56:26 -0700 Subject: [PATCH 2/4] ovpn: Remove reference to udp/1194 * Remove references to udp/1194. * Works better with non-standard ports and tcp. --- bin/ovpn_genconfig | 6 +++--- bin/ovpn_run | 7 ++++++- bin/ovpn_status | 2 +- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/bin/ovpn_genconfig b/bin/ovpn_genconfig index 2c1b508..3bf1f4c 100755 --- a/bin/ovpn_genconfig +++ b/bin/ovpn_genconfig @@ -21,7 +21,7 @@ fi [ -z "$proto" ] && proto=1194 [ -z "$port" ] && port=udp -conf=$OPENVPN/udp1194.conf +conf=$OPENVPN/openvpn.conf if [ -f "$conf" ]; then bak=$conf.$(date +%s).bak echo "Backing up $conf -> $bak" @@ -49,6 +49,6 @@ route 192.168.254.0 255.255.255.0 proto $proto port $port -dev tun1194 -status /tmp/openvpn-status-1194.log +dev tun0 +status /tmp/openvpn-status.log EOF diff --git a/bin/ovpn_run b/bin/ovpn_run index 77e0c21..4ff492f 100755 --- a/bin/ovpn_run +++ b/bin/ovpn_run @@ -20,4 +20,9 @@ iptables -t nat -A POSTROUTING -s 192.168.254.0/24 -o eth0 -j MASQUERADE # Dynamic subnet iptables -t nat -A POSTROUTING -s 192.168.255.0/24 -o eth0 -j MASQUERADE -openvpn --config "$OPENVPN/udp1194.conf" +conf="$OPENVPN/openvpn.conf" + +# TODO Remove after we stop caring about backwards compatibility +[ ! -s "$conf" ] && conf="$OPENVPN/udp1194.conf" + +openvpn --config "$conf" diff --git a/bin/ovpn_status b/bin/ovpn_status index 40a915a..4e99e20 100755 --- a/bin/ovpn_status +++ b/bin/ovpn_status @@ -6,4 +6,4 @@ set -ex -tail -F /tmp/openvpn-status-1194.log +tail -F /tmp/openvpn-status.log From 9951ca6ca209c876ac25da1e7161cc403ee72cbf Mon Sep 17 00:00:00 2001 From: Kyle Manna Date: Mon, 30 Jun 2014 23:43:41 -0700 Subject: [PATCH 3/4] README: Use long server_url * Attempt to reveal the configurability to the curious. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index cc4a8bf..8d66721 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ OpenVPN server in a Docker container complete with an EasyRSA PKI CA. * Initalize the `openvpn-data` container that will hold the configuration files and certificates - docker run --name openvpn-data -it kylemanna/openvpn ovpn_init VPN.SERVERNAME.COM + docker run --name openvpn-data -it kylemanna/openvpn ovpn_init udp://VPN.SERVERNAME.COM:1194 * Start OpenVPN server process From e4feb29b87175246b9f59491e545bb10a1ce031d Mon Sep 17 00:00:00 2001 From: Kyle Manna Date: Mon, 30 Jun 2014 23:45:36 -0700 Subject: [PATCH 4/4] README: Correct dynamic subnet * Correct dynamic client subnet that recently changed. --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 8d66721..e091b7c 100644 --- a/README.md +++ b/README.md @@ -58,7 +58,7 @@ is rooted. The topology used is `net30`, because it works on the widest range of OS. `p2p`, for instance, does not work on Windows. -The UDP server uses`192.168.255.128/25`. +The UDP server uses`192.168.255.0/24` for dynamic clients by default. The client profile specifies `redirect-gateway def1`, meaning that after establishing the VPN connection, all traffic will go through the VPN.