From fa6fe949d0830cdca6f132c82a1880e522ff4988 Mon Sep 17 00:00:00 2001 From: hiroTochigi Date: Fri, 29 Sep 2023 21:42:52 -0500 Subject: [PATCH 1/9] rename config files --- vpn/templates/{clientSecure.conf => clientProxy.conf} | 0 vpn/templates/{serverSecure.conf => serverProxy.conf} | 0 2 files changed, 0 insertions(+), 0 deletions(-) rename vpn/templates/{clientSecure.conf => clientProxy.conf} (100%) rename vpn/templates/{serverSecure.conf => serverProxy.conf} (100%) diff --git a/vpn/templates/clientSecure.conf b/vpn/templates/clientProxy.conf similarity index 100% rename from vpn/templates/clientSecure.conf rename to vpn/templates/clientProxy.conf diff --git a/vpn/templates/serverSecure.conf b/vpn/templates/serverProxy.conf similarity index 100% rename from vpn/templates/serverSecure.conf rename to vpn/templates/serverProxy.conf From 6c38528bea5813d73697232af66c9cad850b59e2 Mon Sep 17 00:00:00 2001 From: hiroTochigi Date: Fri, 29 Sep 2023 21:47:50 -0500 Subject: [PATCH 2/9] remove error --- init.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/init.sh b/init.sh index bc20db9e..fab44237 100644 --- a/init.sh +++ b/init.sh @@ -107,7 +107,6 @@ function createEc2(){ --instance-type t2.micro \ --key-name $keyname \ --security-groups $groupName - --user-data file://./setupIpTables.txt } function findData(){ From 3758256b4c352965a327749e46027223b6110606 Mon Sep 17 00:00:00 2001 From: hiroTochigi Date: Fri, 29 Sep 2023 21:48:25 -0500 Subject: [PATCH 3/9] change file name as expected by systemctl --- vpn/executeScriptOnRemoteServer.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/vpn/executeScriptOnRemoteServer.sh b/vpn/executeScriptOnRemoteServer.sh index a0fdf2cc..1a018c41 100755 --- a/vpn/executeScriptOnRemoteServer.sh +++ b/vpn/executeScriptOnRemoteServer.sh @@ -35,7 +35,7 @@ ssh -i /root/.ssh/$sshkey root@$publicIp " if [ "$mode" == "proxy" ] then - scp -i /root/.ssh/$sshkey /etc/openvpn/server/serverProxy.conf root@$publicIp:/etc/openvpn/server/ + scp -i /root/.ssh/$sshkey /etc/openvpn/server/serverProxy.conf root@$publicIp:/etc/openvpn/server/server.conf else scp -i /root/.ssh/$sshkey /etc/openvpn/server/server.conf root@$publicIp:/etc/openvpn/server/ fi From 94b1347b4ebc0ce155f21037f096b419e75f81f9 Mon Sep 17 00:00:00 2001 From: hiroTochigi Date: Fri, 6 Oct 2023 22:44:13 -0500 Subject: [PATCH 4/9] driver experiment --- dependencies/createDirectories.sh | 25 +++++++++++++++++++++ driver.sh | 3 +++ vpn/executeBash.sh | 7 ++++++ vpn/makeVPNClient.sh | 36 +++++++++++++++++++++---------- vpn/makeVPNServer.sh | 6 ++++++ 5 files changed, 66 insertions(+), 11 deletions(-) create mode 100644 dependencies/createDirectories.sh create mode 100644 driver.sh create mode 100644 vpn/executeBash.sh diff --git a/dependencies/createDirectories.sh b/dependencies/createDirectories.sh new file mode 100644 index 00000000..0aac2370 --- /dev/null +++ b/dependencies/createDirectories.sh @@ -0,0 +1,25 @@ +#!/bin/bash + +scriptDir="$(dirname "$0")" + +dirPaths=( + "$scriptDir/vpn/server" + "$scriptDir/vpn/client" +) + +createDirectories() { + for dirPath in "${dirPaths[@]}"; do + if [ ! -d "$dirPath" ]; then + mkdir -p "$dirPath" + fi + done +} + +getServerDirectory(){ + echo "$scriptDir/vpn/server" +} + + +getClientDirectory(){ + echo "$scriptDir/vpn/client" +} \ No newline at end of file diff --git a/driver.sh b/driver.sh new file mode 100644 index 00000000..c197038a --- /dev/null +++ b/driver.sh @@ -0,0 +1,3 @@ +#!/bin/bash +manageConfigPath=$(pwd) +source $manageConfigPath/vpn/executeBash.sh \ No newline at end of file diff --git a/vpn/executeBash.sh b/vpn/executeBash.sh new file mode 100644 index 00000000..bce6a21b --- /dev/null +++ b/vpn/executeBash.sh @@ -0,0 +1,7 @@ +#!/bin/bash +manageConfigPath=$(pwd) +source $manageConfigPath/../dependencies/createDirectories.sh + +createDirectories +getServerDirectory +getClientDirectory \ No newline at end of file diff --git a/vpn/makeVPNClient.sh b/vpn/makeVPNClient.sh index ecce1a96..a4a85f79 100755 --- a/vpn/makeVPNClient.sh +++ b/vpn/makeVPNClient.sh @@ -1,3 +1,4 @@ +#!/bin/bash mode=$1 balloonName=$1 @@ -20,6 +21,7 @@ source $manageConfigPath/../dependencies/securitygroupFunction.sh source $manageConfigPath/../dependencies/manageConfig.sh source $manageConfigPath/../dependencies/sshtunnelFunction.sh source $manageConfigPath/../dependencies/reverseShell.sh +source $manageConfigPath/../dependencies/createDirectories.sh source getRunningVPNEntityConfName.sh source deleteEasytlsIClientnline.sh @@ -27,24 +29,36 @@ source deleteEasytlsIClientnline.sh startpath=$(pwd) publicIp=$(getValueByAttribute $balloonName publicIp) +createDirectories + function makeClientConf(){ clientName=$1 - fileName=$clientName.conf + defaultName=$clientName.conf + proxyName=${clientName}Proxy.conf + if [ "$mode" == "proxy" ] then - cp $manageConfigPath/templates/clientProxy.conf /etc/openvpn/client/${clientName}Proxy.conf + cp $manageConfigPath/templates/clientProxy.conf /etc/openvpn/client/$proxyName + sed -i '/ca ca.crt/d' /etc/openvpn/client/$proxyName + sed -i '/cert client.crt/d' /etc/openvpn/client/$proxyName + sed -i '/key client.key/d' /etc/openvpn/client/$proxyName + sed -i '/tls-auth ta.key 1/d' /etc/openvpn/client/$proxyName + + echo '' >> /etc/openvpn/client/$proxyName + cat /usr/share/easy-rsa/pki/easytls/$clientName.inline >> /etc/openvpn/client/$proxyName + cp /etc/openvpn/client/$proxyName $startpath/$proxyName else - cp $manageConfigPath/templates/client.conf /etc/openvpn/client/$fileName + cp $manageConfigPath/templates/client.conf /etc/openvpn/client/$defaultName + sed -i '/ca ca.crt/d' /etc/openvpn/client/$defaultName + sed -i '/cert client.crt/d' /etc/openvpn/client/$defaultName + sed -i '/key client.key/d' /etc/openvpn/client/$defaultName + sed -i '/tls-auth ta.key 1/d' /etc/openvpn/client/$defaultName + + echo '' >> /etc/openvpn/client/$defaultName + cat /usr/share/easy-rsa/pki/easytls/$clientName.inline >> /etc/openvpn/client/$defaultName + cp /etc/openvpn/client/$defaultName $startpath/$defaultName fi - sed -i '/ca ca.crt/d' /etc/openvpn/client/$fileName - sed -i '/cert client.crt/d' /etc/openvpn/client/$fileName - sed -i '/key client.key/d' /etc/openvpn/client/$fileName - sed -i '/tls-auth ta.key 1/d' /etc/openvpn/client/$fileName - - echo '' >> /etc/openvpn/client/$fileName - cat /usr/share/easy-rsa/pki/easytls/$clientName.inline >> /etc/openvpn/client/$fileName - cp /etc/openvpn/client/$fileName $startpath/$fileName } diff --git a/vpn/makeVPNServer.sh b/vpn/makeVPNServer.sh index c033b0ce..bf770491 100755 --- a/vpn/makeVPNServer.sh +++ b/vpn/makeVPNServer.sh @@ -1,6 +1,12 @@ +#!/bin/bash + +source $manageConfigPath/../dependencies/createDirectories.sh + mode=$1 serverName=openvpn-server +createDirectories + if [[ -n "$mode" && "$mode" != "default" && "$mode" != "proxy" ]]; then echo "Invalid mode: $mode. Mode must be 'proxy', 'default', or empty." From 0f1cf518dc9cf1b0df832a71c70905db6d3a469f Mon Sep 17 00:00:00 2001 From: hiroTochigi Date: Wed, 11 Oct 2023 22:10:12 -0500 Subject: [PATCH 5/9] fix making the incorrect conf file --- vpn/executeScriptOnRemoteServer.sh | 20 ++++++++++++++------ vpn/makeVPNClient.sh | 25 ++++++++++++++++++++----- vpn/makeVPNServer.sh | 27 ++++++++++++++++++--------- 3 files changed, 52 insertions(+), 20 deletions(-) diff --git a/vpn/executeScriptOnRemoteServer.sh b/vpn/executeScriptOnRemoteServer.sh index 1a018c41..c642ebee 100755 --- a/vpn/executeScriptOnRemoteServer.sh +++ b/vpn/executeScriptOnRemoteServer.sh @@ -32,13 +32,21 @@ sshkey=`treehouses sshtunnel key name | cut -d ' ' -f 5` ssh -i /root/.ssh/$sshkey root@$publicIp " apt update && apt upgrade && apt install -y openvpn" +function getServerConfName(){ + serverName=server + defaultName=$clientName.conf + proxyName=${clientName}Proxy.conf + if [ "$mode" == "proxy" ] + then + echo $proxyName + else + echo $defaultName + fi +} -if [ "$mode" == "proxy" ] -then - scp -i /root/.ssh/$sshkey /etc/openvpn/server/serverProxy.conf root@$publicIp:/etc/openvpn/server/server.conf -else - scp -i /root/.ssh/$sshkey /etc/openvpn/server/server.conf root@$publicIp:/etc/openvpn/server/ -fi +serverConfName=$(getServerConfName) + +scp -i /root/.ssh/$sshkey /etc/openvpn/server/$serverConfName root@$publicIp:/etc/openvpn/server/server.conf ssh -i /root/.ssh/$sshkey root@$publicIp " diff --git a/vpn/makeVPNClient.sh b/vpn/makeVPNClient.sh index a4a85f79..ada91520 100755 --- a/vpn/makeVPNClient.sh +++ b/vpn/makeVPNClient.sh @@ -31,6 +31,18 @@ publicIp=$(getValueByAttribute $balloonName publicIp) createDirectories +function getClientConfName(){ + clientName=$1 + defaultName=$clientName.conf + proxyName=${clientName}Proxy.conf + if [ "$mode" == "proxy" ] + then + echo $proxyName + else + echo $defaultName + fi +} + function makeClientConf(){ clientName=$1 defaultName=$clientName.conf @@ -94,15 +106,16 @@ function makeTlsAuthInline(){ function addIPAddress(){ fileName=$1 - sed -i "s/my-server-1/$publicIp/" /etc/openvpn/client/$fileName.conf + sed -i "s/my-server-1/$publicIp/" /etc/openvpn/client/$fileName } function makeClientCertificate(){ client=$1 makeClient $client makeTlsAuthInline $client - makeClientConf $client - addIPAddress $client + fileName=$(getClientConfName $client) + makeClientConf $fileName + addIPAddress $fileName } function checkFile(){ @@ -159,7 +172,8 @@ function getClientName(){ function makeClientConfig(){ client=$(getClientName) - checkFile $client + fileName=$(getClientConfName $client) + checkFile $fileName deleteEasytlsIClientnline $client cd /usr/share/easy-rsa/ makeClientCertificate $client @@ -167,7 +181,8 @@ function makeClientConfig(){ function makeClientConfigAndStart(){ client=$(getClientName) - checkFile $client + fileName=$(getClientConfName $client) + checkFile $fileName deleteEasytlsIClientnline $client cd /usr/share/easy-rsa/ makeClientCertificate $client diff --git a/vpn/makeVPNServer.sh b/vpn/makeVPNServer.sh index bf770491..6a3d7498 100755 --- a/vpn/makeVPNServer.sh +++ b/vpn/makeVPNServer.sh @@ -13,14 +13,22 @@ then exit 1 fi -# Make pki, one master ca, and one server -function makeVPNServer(){ +function getServerConfName(){ + serverName=server + defaultName=$clientName.conf + proxyName=${clientName}Proxy.conf if [ "$mode" == "proxy" ] then - cp ./templates/serverProxy.conf /etc/openvpn/server/ + echo $proxyName else - cp ./templates/server.conf /etc/openvpn/server/ + echo $defaultName fi +} + +# Make pki, one master ca, and one server +function makeVPNServer(){ + serverConfName=$(getServerConfName) + cp ./templates/$serverConfName /etc/openvpn/server/ cd /usr/share/easy-rsa/ cp vars.example vars @@ -37,12 +45,13 @@ function makeTlsKey(){ } function makeServerConfiguration(){ + serverConfName=$(getServerConfName) ./easytls ita $serverName 0 - cat /usr/share/easy-rsa/pki/easytls/$serverName.inline >> /etc/openvpn/server/server.conf - sed -i '/dh none/d' /etc/openvpn/server/server.conf - echo \ >> /etc/openvpn/server/server.conf - cat /usr/share/easy-rsa/pki/dh.pem >> /etc/openvpn/server/server.conf - echo \<\/dh\> >> /etc/openvpn/server/server.conf + cat /usr/share/easy-rsa/pki/easytls/$serverName.inline >> /etc/openvpn/server/$serverConfName + sed -i '/dh none/d' /etc/openvpn/server/$serverConfName + echo \ >> /etc/openvpn/server/$serverConfName + cat /usr/share/easy-rsa/pki/dh.pem >> /etc/openvpn/server/$serverConfName + echo \<\/dh\> >> /etc/openvpn/server/$serverConfName } function startVPNServer(){ From 4d916987b78d3ad07c0d293f23e4bd17c8ec1e86 Mon Sep 17 00:00:00 2001 From: hiroTochigi Date: Fri, 13 Oct 2023 21:58:04 -0500 Subject: [PATCH 6/9] bug fix --- vpn/executeScriptOnRemoteServer.sh | 4 ++-- vpn/makeVPNServer.sh | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/vpn/executeScriptOnRemoteServer.sh b/vpn/executeScriptOnRemoteServer.sh index c642ebee..a31a531e 100755 --- a/vpn/executeScriptOnRemoteServer.sh +++ b/vpn/executeScriptOnRemoteServer.sh @@ -34,8 +34,8 @@ ssh -i /root/.ssh/$sshkey root@$publicIp " function getServerConfName(){ serverName=server - defaultName=$clientName.conf - proxyName=${clientName}Proxy.conf + defaultName=$serverName.conf + proxyName=${serverName}Proxy.conf if [ "$mode" == "proxy" ] then echo $proxyName diff --git a/vpn/makeVPNServer.sh b/vpn/makeVPNServer.sh index 6a3d7498..b5136e21 100755 --- a/vpn/makeVPNServer.sh +++ b/vpn/makeVPNServer.sh @@ -15,8 +15,8 @@ fi function getServerConfName(){ serverName=server - defaultName=$clientName.conf - proxyName=${clientName}Proxy.conf + defaultName=$serverName.conf + proxyName=${serverName}Proxy.conf if [ "$mode" == "proxy" ] then echo $proxyName From 0b3bb81746c0d197ae10140ddf660e11111d15df Mon Sep 17 00:00:00 2001 From: hiroTochigi Date: Fri, 13 Oct 2023 22:38:00 -0500 Subject: [PATCH 7/9] fix bug --- vpn/makeVPNClient.sh | 1 - 1 file changed, 1 deletion(-) diff --git a/vpn/makeVPNClient.sh b/vpn/makeVPNClient.sh index ada91520..ae4e1f3a 100755 --- a/vpn/makeVPNClient.sh +++ b/vpn/makeVPNClient.sh @@ -114,7 +114,6 @@ function makeClientCertificate(){ makeClient $client makeTlsAuthInline $client fileName=$(getClientConfName $client) - makeClientConf $fileName addIPAddress $fileName } From 477e21a2ca379c84c17d748439b11cee99116b67 Mon Sep 17 00:00:00 2001 From: hiroTochigi Date: Fri, 20 Oct 2023 22:29:39 -0500 Subject: [PATCH 8/9] fixes the makeVPN functions --- vpn/makeVPNClient.sh | 8 ++++---- vpn/makeVPNServer.sh | 9 ++++++--- 2 files changed, 10 insertions(+), 7 deletions(-) diff --git a/vpn/makeVPNClient.sh b/vpn/makeVPNClient.sh index ae4e1f3a..3da987f1 100755 --- a/vpn/makeVPNClient.sh +++ b/vpn/makeVPNClient.sh @@ -43,6 +43,7 @@ function getClientConfName(){ fi } +# function makeClientConf(){ clientName=$1 defaultName=$clientName.conf @@ -113,6 +114,7 @@ function makeClientCertificate(){ client=$1 makeClient $client makeTlsAuthInline $client + makeClientConf $client fileName=$(getClientConfName $client) addIPAddress $fileName } @@ -171,8 +173,7 @@ function getClientName(){ function makeClientConfig(){ client=$(getClientName) - fileName=$(getClientConfName $client) - checkFile $fileName + checkFile $client deleteEasytlsIClientnline $client cd /usr/share/easy-rsa/ makeClientCertificate $client @@ -180,8 +181,7 @@ function makeClientConfig(){ function makeClientConfigAndStart(){ client=$(getClientName) - fileName=$(getClientConfName $client) - checkFile $fileName + checkFile $client deleteEasytlsIClientnline $client cd /usr/share/easy-rsa/ makeClientCertificate $client diff --git a/vpn/makeVPNServer.sh b/vpn/makeVPNServer.sh index b5136e21..77bdb8da 100755 --- a/vpn/makeVPNServer.sh +++ b/vpn/makeVPNServer.sh @@ -14,9 +14,9 @@ then fi function getServerConfName(){ - serverName=server - defaultName=$serverName.conf - proxyName=${serverName}Proxy.conf + localServerName=server + defaultName=$localServerName.conf + proxyName=${localServerName}Proxy.conf if [ "$mode" == "proxy" ] then echo $proxyName @@ -39,11 +39,13 @@ function makeVPNServer(){ ./easyrsa gen-dh } +# function makeTlsKey(){ ./easytls init-tls ./easytls build-tls-auth } +# function makeServerConfiguration(){ serverConfName=$(getServerConfName) ./easytls ita $serverName 0 @@ -54,6 +56,7 @@ function makeServerConfiguration(){ echo \<\/dh\> >> /etc/openvpn/server/$serverConfName } +# function startVPNServer(){ # Start openvpn-server status=$(systemctl status openvpn-server@server.service) From 1c349872da6469f0e669efa041caaaf6ad241845 Mon Sep 17 00:00:00 2001 From: hiroTochigi Date: Wed, 22 Nov 2023 20:17:25 -0600 Subject: [PATCH 9/9] push ipv4 address --- vpn/templates/serverProxy.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/vpn/templates/serverProxy.conf b/vpn/templates/serverProxy.conf index a471c3c4..dadaf8ab 100755 --- a/vpn/templates/serverProxy.conf +++ b/vpn/templates/serverProxy.conf @@ -1,5 +1,6 @@ port 1194 server 10.8.0.0 255.255.255.0 +server-ipv6 2001:DB8:100::/64 proto udp dev tun ifconfig-pool-persist /var/log/openvpn/ipp.txt @@ -8,6 +9,8 @@ ifconfig-pool-persist /var/log/openvpn/ipp.txt ;push "dhcp-option DNS 208.67.220.220" push "redirect-gateway def1" push "dhcp-option DNS 8.8.8.8" +push "dhcp-option DNS 2001:abde::1" +push "route-ipv6 ::/0" keepalive 10 120 cipher AES-256-CBC persist-key