Open VPN

#!/bin/bash

#################################
###     Written by Astatic    ###
###                           ###
###      old@astatic.biz      ###
#################################


if [ "`cat /etc/issue | grep Debian | wc -l`" = "0" ]; then echo "This is not Debian."; exit 0; fi

echo -e "#################################
###     Written by Astatic    ###  
###                           ###
###      old@astatic.biz      ### 
#################################

Script was tested on Debian 6. If you use different version it may not work.
"
#---------- BEGIN: CHECKING VARIABLES ----------#
E_BADARGS=65

if [  -z $1 ]
then
    echo -e "Use in format:\nbash openvpn-setup.sh username ip port\nExample:\nbash openvpn-setup.sh astatic 91.92.45.68 5896"
    exit $E_BADARGS
else
    USER=$1
fi


if [  -z $2 ]
then
    echo -e "Use in format:\nbash openvpn-setup.sh username ip port\nExample:\nbash openvpn-setup.sh astatic 91.92.45.68 5896"
    exit $E_BADARGS
else
    IP=$2
fi


if [  -z $3 ]
then
    echo -e "Use in format:\nbash openvpn-setup.sh username ip port\nExample:\n bash openvpn-setup.sh astatic 91.92.45.68 5896"
    exit $E_BADARGS
else
    PORT=$3
fi

#---------- END: CHECKING VARIABLES ----------#

for i in {1..5}; do
echo "."
sleep 1
done


apt-get update
apt-get -y install openvpn lrzsz zip
mkdir /etc/openvpn/easy-rsa/
cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0/* /etc/openvpn/easy-rsa/
cd /etc/openvpn/easy-rsa/
source vars
./clean-all
./build-dh
./pkitool --initca
./pkitool --server server
cd keys
openvpn --genkey --secret ta.key
cp server.crt  /etc/openvpn/
cp server.key  /etc/openvpn/
cp ca.crt  /etc/openvpn/
cp dh1024.pem  /etc/openvpn/ 
cp ta.key /etc/openvpn/
cd /etc/openvpn/easy-rsa/
sed -i "s%changeme%changeme1%g" /etc/openvpn/easy-rsa/vars
source vars
./pkitool $USER

echo "port $PORT # порт который будет слушать openvpn
local $IP #ip на котором будет принимать подключения openvpn
proto udp
dev tun
ca ca.crt # сертификаты, ключи
cert server.crt
key server.key
dh dh1024.pem
server 10.8.0.0 255.255.255.0 # наша виртуальная сеть
ifconfig-pool-persist ipp.txt
keepalive 10 120
comp-lzo # сжимаем траф
persist-key
persist-tun
status off
client-to-client
push \"redirect-gateway def1\" #устанавливаем сервер шлюзом по умолчанию
client-config-dir ccd
verb 0 
log /dev/null
push \"dhcp-option DNS 8.8.8.8\" #используем гугловые днс вместо провайдерских
push \"dhcp-option DNS 8.8.4.4\"
cipher DES-EDE3-CBC
tls-auth ta.key 0
" > /etc/openvpn/server.conf

mkdir $USER

echo "tls-client 
proto udp
remote $IP #ip сервера
dev tun
port $PORT #ставим такой же порт как указали в конфиге openvpn на сервере 
persist-key
persist-tun
pull
route-method exe
route-delay 2
tls-auth \"ta.key\" 1
dh \"dh1024.pem\" 
ca \"ca.crt\" 
cert \"$USER.crt\"
key \"$USER.key\"
cipher DES-EDE3-CBC
comp-lzo" > /etc/openvpn/easy-rsa/$USER/$USER.ovpn

cp /etc/openvpn/ta.key $USER
cp /etc/openvpn/ca.crt $USER
cp /etc/openvpn/easy-rsa/keys/dh1024.pem $USER
cp /etc/openvpn/easy-rsa/keys/$USER.crt $USER
cp /etc/openvpn/easy-rsa/keys/$USER.key $USER
zip -r $USER.zip $USER

mv $USER.zip /root/

sed -i "s%#net.ipv4.ip_forward=1%net.ipv4.ip_forward=1%g" /etc/sysctl.conf
sed -i "/exit 0/d" /etc/rc.local

echo "
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT 
iptables -A FORWARD -d 10.8.0.0/24 -m state --state  ESTABLISHED,RELATED -j ACCEPT 
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source $IP

exit 0
" >> /etc/rc.local

update-rc.d openvpn defaults
sysctl -w net.ipv4.ip_forward=1
iptables -A FORWARD -s 10.8.0.0/24 -j ACCEPT 
iptables -A FORWARD -d 10.8.0.0/24 -m state --state  ESTABLISHED,RELATED -j ACCEPT 
iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -j SNAT --to-source $IP
/etc/init.d/openvpn start

rm -rf /etc/openvpn/easy-rsa/