Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for tls-scrypt-v2, sndbuf and rcvbuf and ability to override defaults #1257

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Add support for tls-scrypt-v2, sndbuf and rcvbuf and ability to override defaults #1257

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7e5c2f3
Use default vars
Oct 29, 2024
58059bc
Add support for tls-scrypt-v2
Oct 29, 2024
817dec5
Add sndbuf and rcvbuf setting support to resolve slow UDP
Oct 29, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 46 additions & 11 deletions openvpn-install.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -391,14 +391,22 @@ function installQuestions() {
done
if [[ $CUSTOMIZE_ENC == "n" ]]; then
# Use default, sane and fast parameters
CIPHER="AES-128-GCM"
CERT_TYPE="1" # ECDSA
CERT_CURVE="prime256v1"
CC_CIPHER="TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256"
DH_TYPE="1" # ECDH
DH_CURVE="prime256v1"
HMAC_ALG="SHA256"
TLS_SIG="1" # tls-crypt
CIPHER="${CIPHER:-AES-128-GCM}"
CERT_TYPE="${CERT_TYPE:-1}" # ECDSA
CERT_CURVE="${CERT_CURVE:-prime256v1}"
CC_CIPHER="${CC_CIPHER:-TLS-ECDHE-ECDSA-WITH-AES-128-GCM-SHA256}"
DH_TYPE="${DH_TYPE:-1}" # ECDH
DH_CURVE="${DH_CURVE:-prime256v1}"
HMAC_ALG="${HMAC_ALG:-SHA256}"
TLS_SIG="${TLS_SIG:-1}" # tls-crypt
echo "Using CIPHER=$CIPHER"
echo "Using CERT_TYPE=$CERT_TYPE"
echo "Using CERT_CURVE=$CERT_CURVE"
echo "Using CC_CIPHER=$CC_CIPHER"
echo "Using DH_TYPE=$DH_TYPE"
echo "Using DH_CURVE=$DH_CURVE"
echo "Using HMAC_ALG=$HMAC_ALG"
echo "Using TLS_SIG=$TLS_SIG"
else
echo ""
echo "Choose which cipher you want to use for the data channel:"
Expand Down Expand Up @@ -593,11 +601,13 @@ function installQuestions() {
;;
esac
echo ""
echo "You can add an additional layer of security to the control channel with tls-auth and tls-crypt"
echo "You can add an additional layer of security to the control channel with tls-auth, tls-crypt or tls-crypt-v2"
echo "tls-auth authenticates the packets, while tls-crypt authenticate and encrypt them."
echo "The tls-crypt-v2 is like tls-crypt but uses private keys which makes it the most secure."
echo " 1) tls-crypt (recommended)"
echo " 2) tls-auth"
until [[ $TLS_SIG =~ [1-2] ]]; do
echo " 3) tls-crypt-v2"
until [[ $TLS_SIG =~ [1-3] ]]; do
read -rp "Control channel additional security mechanism [1-2]: " -e -i 1 TLS_SIG
done
fi
Expand Down Expand Up @@ -750,6 +760,11 @@ function installOpenVPN() {
# Generate tls-auth key
openvpn --genkey --secret /etc/openvpn/tls-auth.key
;;
3)
# Generate tls-crypt-v2 key
openvpn --genkey tls-crypt-v2-server /etc/openvpn/tls-crypt-v2.key
mkdir -p /etc/openvpn/keys-v2
;;
esac
else
# If easy-rsa is already installed, grab the generated SERVER_NAME
Expand Down Expand Up @@ -885,6 +900,9 @@ push "redirect-gateway ipv6"' >>/etc/openvpn/server.conf
2)
echo "tls-auth tls-auth.key 0" >>/etc/openvpn/server.conf
;;
3)
echo "tls-crypt-v2 tls-crypt-v2.key" >>/etc/openvpn/server.conf
;;
esac

echo "crl-verify crl.pem
Expand All @@ -899,6 +917,8 @@ tls-version-min 1.2
tls-cipher $CC_CIPHER
client-config-dir /etc/openvpn/ccd
status /var/log/openvpn/status.log
#silence repeating messages
mute 20
verb 3" >>/etc/openvpn/server.conf

# Create client-config-dir dir
Expand Down Expand Up @@ -1012,6 +1032,10 @@ RemainAfterExit=yes
[Install]
WantedBy=multi-user.target" >/etc/systemd/system/iptables-openvpn.service

# resolve slow UDP traffic
sysctl -w net.core.rmem_max=${SRV_BUFF_SIZE_MAX:-8388608} # 8Mb
sysctl -w net.core.rmem_default=${SRV_BUFF_SIZE_DEFAULT:-262144} #256k

# Enable service and apply rules
systemctl daemon-reload
systemctl enable iptables-openvpn
Expand Down Expand Up @@ -1046,6 +1070,9 @@ tls-version-min 1.2
tls-cipher $CC_CIPHER
ignore-unknown-option block-outside-dns
setenv opt block-outside-dns # Prevent Windows 10 DNS leak
mute 20 #silence repeating messages
sndbuf ${CLIENT_BUFF_SIZE:-262144} #Set the TCP/UDP socket send buffer size. Defaults to operating system default.
rcvbuf ${CLIENT_BUFF_SIZE:-262144} #Set the TCP/UDP socket receive buffer size. Defaults to operating system default.
verb 3" >>/etc/openvpn/client-template.txt

if [[ $COMPRESSION_ENABLED == "y" ]]; then
Expand Down Expand Up @@ -1113,7 +1140,9 @@ function newClient() {
fi

# Determine if we use tls-auth or tls-crypt
if grep -qs "^tls-crypt" /etc/openvpn/server.conf; then
if grep -qs "^tls-crypt-v2" /etc/openvpn/server.conf; then
TLS_SIG="3"
elif grep -qs "^tls-crypt" /etc/openvpn/server.conf; then
TLS_SIG="1"
elif grep -qs "^tls-auth" /etc/openvpn/server.conf; then
TLS_SIG="2"
Expand Down Expand Up @@ -1146,6 +1175,12 @@ function newClient() {
cat /etc/openvpn/tls-auth.key
echo "</tls-auth>"
;;
3)
openvpn --tls-crypt-v2 /etc/openvpn/tls-crypt-v2.key --genkey tls-crypt-v2-client "/etc/openvpn/keys-v2/$CLIENT.key"
echo "<tls-crypt-v2>"
cat "/etc/openvpn/keys-v2/$CLIENT.key"
echo "</tls-crypt-v2>"
;;
esac
} >>"$homeDir/$CLIENT.ovpn"

Expand Down