From 76f29a20df1071bb90439b033b44c9fb148879b4 Mon Sep 17 00:00:00 2001 From: Maksymilian Potok Date: Sat, 24 Jul 2021 20:21:43 +0200 Subject: [PATCH] added alpine support --- openvpn-install.sh | 52 +++++++++++++++++++++++++++++----------------- 1 file changed, 33 insertions(+), 19 deletions(-) diff --git a/openvpn-install.sh b/openvpn-install.sh index 4df5783..3bdc9ab 100644 --- a/openvpn-install.sh +++ b/openvpn-install.sh @@ -38,6 +38,13 @@ elif [[ -e /etc/fedora-release ]]; then os="fedora" os_version=$(grep -oE '[0-9]+' /etc/fedora-release | head -1) group_name="nobody" +elif [[ -e /etc/alpine-release ]]; then + os="alpine" + if [[ ! -d /dev/net ]]; then + mkdir -p /dev/net && \ + mknod /dev/net/tun c 10 200 && \ + chmod 600 /dev/net/tun + fi else echo "This installer seems to be running on an unsupported distribution. Supported distributions are Ubuntu, Debian, CentOS, and Fedora." @@ -202,7 +209,7 @@ if [[ ! -e /etc/openvpn/server/server.conf ]]; then # We don't want to silently enable firewalld, so we give a subtle warning # If the user continues, firewalld will be installed and enabled during setup echo "firewalld, which is required to manage routing tables, will also be installed." - elif [[ "$os" == "debian" || "$os" == "ubuntu" ]]; then + elif [[ "$os" == "debian" || "$os" == "ubuntu" || "$os" == "alpine" ]]; then # iptables is way less invasive than firewalld so no warning is given firewall="iptables" fi @@ -220,6 +227,9 @@ LimitNPROC=infinity" > /etc/systemd/system/openvpn-server@server.service.d/disab elif [[ "$os" = "centos" ]]; then yum install -y epel-release yum install -y openvpn openssl ca-certificates tar $firewall + elif [[ "$os" = "alpine" ]]; then + apk update + apk add openvpn openssl ca-certificates $firewall else # Else, OS must be Fedora dnf install -y openvpn openssl ca-certificates tar $firewall @@ -511,25 +521,27 @@ else if [[ "$remove" =~ ^[yY]$ ]]; then port=$(grep '^port ' /etc/openvpn/server/server.conf | cut -d " " -f 2) protocol=$(grep '^proto ' /etc/openvpn/server/server.conf | cut -d " " -f 2) - if systemctl is-active --quiet firewalld.service; then - ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$') - # Using both permanent and not permanent rules to avoid a firewalld reload. - firewall-cmd --remove-port="$port"/"$protocol" - firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 - firewall-cmd --permanent --remove-port="$port"/"$protocol" - firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 - firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip" - firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip" - if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then - ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$') - firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64 - firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64 - firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6" - firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6" + if [[ -x /run/systemd/system ]]; then + if systemctl is-active --quiet firewalld.service; then + ip=$(firewall-cmd --direct --get-rules ipv4 nat POSTROUTING | grep '\-s 10.8.0.0/24 '"'"'!'"'"' -d 10.8.0.0/24' | grep -oE '[^ ]+$') + # Using both permanent and not permanent rules to avoid a firewalld reload. + firewall-cmd --remove-port="$port"/"$protocol" + firewall-cmd --zone=trusted --remove-source=10.8.0.0/24 + firewall-cmd --permanent --remove-port="$port"/"$protocol" + firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24 + firewall-cmd --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip" + firewall-cmd --permanent --direct --remove-rule ipv4 nat POSTROUTING 0 -s 10.8.0.0/24 ! -d 10.8.0.0/24 -j SNAT --to "$ip" + if grep -qs "server-ipv6" /etc/openvpn/server/server.conf; then + ip6=$(firewall-cmd --direct --get-rules ipv6 nat POSTROUTING | grep '\-s fddd:1194:1194:1194::/64 '"'"'!'"'"' -d fddd:1194:1194:1194::/64' | grep -oE '[^ ]+$') + firewall-cmd --zone=trusted --remove-source=fddd:1194:1194:1194::/64 + firewall-cmd --permanent --zone=trusted --remove-source=fddd:1194:1194:1194::/64 + firewall-cmd --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6" + firewall-cmd --permanent --direct --remove-rule ipv6 nat POSTROUTING 0 -s fddd:1194:1194:1194::/64 ! -d fddd:1194:1194:1194::/64 -j SNAT --to "$ip6" + fi + else + systemctl disable --now openvpn-iptables.service + rm -f /etc/systemd/system/openvpn-iptables.service fi - else - systemctl disable --now openvpn-iptables.service - rm -f /etc/systemd/system/openvpn-iptables.service fi if sestatus 2>/dev/null | grep "Current mode" | grep -q "enforcing" && [[ "$port" != 1194 ]]; then semanage port -d -t openvpn_port_t -p "$protocol" "$port" @@ -540,6 +552,8 @@ else rm -f /etc/sysctl.d/99-openvpn-forward.conf if [[ "$os" = "debian" || "$os" = "ubuntu" ]]; then apt-get remove --purge -y openvpn + elif [[ "$os" = "alpine" ]]; then + apk del openvpn else # Else, OS must be CentOS or Fedora yum remove -y openvpn