Removing the use of rc.local file
This commit is contained in:
DrXala
parent
1be7733c0b
commit
d3d7d18ab1
|
|
@ -24,7 +24,6 @@ if [[ -e /etc/debian_version ]]; then
|
|||
# Getting the version number, to verify that a recent version of OpenVPN is available
|
||||
VERSION_ID=$(cat /etc/os-release | grep "VERSION_ID")
|
||||
IPTABLES='/etc/iptables/iptables.rules'
|
||||
RCLOCAL='/etc/rc.local'
|
||||
SYSCTL='/etc/sysctl.conf'
|
||||
if [[ "$VERSION_ID" != 'VERSION_ID="7"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="8"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="9"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="12.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="14.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.04"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="16.10"' ]] && [[ "$VERSION_ID" != 'VERSION_ID="17.04"' ]]; then
|
||||
echo "Your version of Debian/Ubuntu is not supported."
|
||||
|
|
@ -44,14 +43,10 @@ if [[ -e /etc/debian_version ]]; then
|
|||
elif [[ -e /etc/centos-release || -e /etc/redhat-release ]]; then
|
||||
OS=centos
|
||||
IPTABLES='/etc/iptables/iptables.rules'
|
||||
RCLOCAL='/etc/rc.d/rc.local'
|
||||
SYSCTL='/etc/sysctl.conf'
|
||||
# Needed for CentOS 7
|
||||
chmod +x /etc/rc.d/rc.local
|
||||
elif [[ -e /etc/arch-release ]]; then
|
||||
OS=arch
|
||||
IPTABLES='/etc/iptables/iptables.rules'
|
||||
RCLOCAL='/etc/rc.local'
|
||||
SYSCTL='/etc/sysctl.d/openvpn.conf'
|
||||
else
|
||||
echo "Looks like you aren't running this installer on a Debian, Ubuntu, CentOS or ArchLinux system"
|
||||
|
|
@ -157,11 +152,16 @@ if [[ -e /etc/openvpn/server.conf ]]; then
|
|||
firewall-cmd --permanent --zone=trusted --remove-source=10.8.0.0/24
|
||||
fi
|
||||
if iptables -L -n | grep -qE 'REJECT|DROP'; then
|
||||
sed -i "/iptables -I INPUT -p udp --dport $PORT -j ACCEPT/d" $RCLOCAL
|
||||
sed -i "/iptables -I FORWARD -s 10.8.0.0\/24 -j ACCEPT/d" $RCLOCAL
|
||||
sed -i "/iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT/d" $RCLOCAL
|
||||
if [[ "$PROTOCOL" = 'udp' ]]; then
|
||||
iptables -D INPUT -p udp --dport $PORT -j ACCEPT
|
||||
else
|
||||
iptables -D INPUT -p tcp --dport $PORT -j ACCEPT
|
||||
fi
|
||||
iptables -D FORWARD -s 10.8.0.0/24 -j ACCEPT
|
||||
iptables-save > $IPTABLES
|
||||
fi
|
||||
sed -i '/iptables -t nat -A POSTROUTING -s 10.8.0.0\/24 -j SNAT --to /d' $RCLOCAL
|
||||
iptables -t nat -D POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE
|
||||
iptables-save > $IPTABLES
|
||||
if hash sestatus 2>/dev/null; then
|
||||
if sestatus | grep "Current mode" | grep -qs "enforcing"; then
|
||||
if [[ "$PORT" != '1194' ]]; then
|
||||
|
|
@ -423,28 +423,11 @@ WantedBy=multi-user.target" > /etc/systemd/system/iptables.service
|
|||
fi
|
||||
|
||||
if [[ "$OS" = 'arch' ]]; then
|
||||
# Install rc.local
|
||||
echo "[Unit]
|
||||
Description=/etc/rc.local compatibility
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=/etc/rc.local
|
||||
RemainAfterExit=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target" > /etc/systemd/system/rc-local.service
|
||||
chmod +x /etc/rc.local
|
||||
systemctl enable rc-local.service
|
||||
if ! grep '#!' $RCLOCAL; then
|
||||
echo "#!/bin/bash" > $RCLOCAL
|
||||
fi
|
||||
fi
|
||||
|
||||
# Install dependencies
|
||||
pacman -Syu openvpn iptables openssl wget ca-certificates curl --needed --noconfirm
|
||||
if [[ "$OS" = 'arch' ]]; then
|
||||
iptables-save > /etc/iptables/iptables.rules # iptables won't start if this file does not exist
|
||||
systemctl daemon-reload
|
||||
systemctl enable iptables
|
||||
systemctl start iptables
|
||||
fi
|
||||
|
|
@ -555,15 +538,10 @@ verb 3" >> /etc/openvpn/server.conf
|
|||
fi
|
||||
# Avoid an unneeded reboot
|
||||
echo 1 > /proc/sys/net/ipv4/ip_forward
|
||||
# Needed to use rc.local with some systemd distros
|
||||
if [[ "$OS" = 'debian' && ! -e $RCLOCAL ]]; then
|
||||
echo '#!/bin/sh -e
|
||||
exit 0' > $RCLOCAL
|
||||
fi
|
||||
chmod +x $RCLOCAL
|
||||
# Set NAT for the VPN subnet
|
||||
iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE
|
||||
sed -i "1 a\iptables -t nat -A POSTROUTING -o $NIC -s 10.8.0.0/24 -j MASQUERADE" $RCLOCAL
|
||||
# Save persitent iptables rules
|
||||
iptables-save > $IPTABLES
|
||||
if pgrep firewalld; then
|
||||
# We don't use --add-service=openvpn because that would only work with
|
||||
# the default port. Using both permanent and not permanent rules to
|
||||
|
|
@ -589,13 +567,8 @@ verb 3" >> /etc/openvpn/server.conf
|
|||
fi
|
||||
iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT
|
||||
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
|
||||
if [[ "$PROTOCOL" = 'UDP' ]]; then
|
||||
sed -i "1 a\iptables -I INPUT -p udp --dport $PORT -j ACCEPT" $RCLOCAL
|
||||
elif [[ "$PROTOCOL" = 'TCP' ]]; then
|
||||
sed -i "1 a\iptables -I INPUT -p tcp --dport $PORT -j ACCEPT" $RCLOCAL
|
||||
fi
|
||||
sed -i "1 a\iptables -I FORWARD -s 10.8.0.0/24 -j ACCEPT" $RCLOCAL
|
||||
sed -i "1 a\iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT" $RCLOCAL
|
||||
# save persitant OpenVPN rules
|
||||
iptables-save > $IPTABLES
|
||||
fi
|
||||
# If SELinux is enabled and a custom port was selected, we need this
|
||||
if hash sestatus 2>/dev/null; then
|
||||
|
|
|
|||
Loading…
Reference in New Issue