Remove installing ufw

generate-client.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+# Check if running as root
+if [ "$EUID" -ne 0 ]; then 
+    echo "Please run as root"
+    exit 1
+fi
+
+if [ -z "$1" ]; then
+    echo "Usage: $0 <client-name>"
+    exit 1
+fi
+
+CLIENT_NAME=$1
+cd /etc/openvpn/server/easy-rsa
+
+# Generate client certificate and key
+./easyrsa gen-req $CLIENT_NAME nopass
+./easyrsa sign-req client $CLIENT_NAME
+
+# Make sure client directory exists
+mkdir -p /etc/openvpn/client
+
+# Create client configuration
+cat > /etc/openvpn/client/$CLIENT_NAME.ovpn << EOL
+client
+dev tun
+proto udp4
+remote $(curl -s -4 ifconfig.me) 1194
+resolv-retry infinite
+nobind
+persist-key
+persist-tun
+remote-cert-tls server
+cipher AES-256-GCM
+data-ciphers AES-256-GCM:AES-256-CBC:AES-128-GCM:CHACHA20-POLY1305
+block-outside-dns
+verb 3
+dhcp-option DNS 1.1.1.1
+dhcp-option DNS 1.0.0.1
+<ca>
+$(cat /etc/openvpn/server/ca.crt)
+</ca>
+<cert>
+$(cat /etc/openvpn/server/easy-rsa/pki/issued/$CLIENT_NAME.crt)
+</cert>
+<key>
+$(cat /etc/openvpn/server/easy-rsa/pki/private/$CLIENT_NAME.key)
+</key>
+EOL
+
+# Copy the configuration file to the current working directory
+WORKING_DIR=$(pwd)
+cp /etc/openvpn/client/$CLIENT_NAME.ovpn $WORKING_DIR/
+chmod 644 $WORKING_DIR/$CLIENT_NAME.ovpn
+
+echo "Client configuration created: /etc/openvpn/client/$CLIENT_NAME.ovpn"
+echo "A copy has also been saved to: $WORKING_DIR/$CLIENT_NAME.ovpn" 

setup_openvpn.sh

@@ -35,7 +35,7 @@ apt-get upgrade -y
 
 # Install OpenVPN and required packages
 echo "Installing OpenVPN and required packages..."
-apt-get install -y openvpn easy-rsa ufw
+apt-get install -y openvpn easy-rsa
 
 # Create directory for OpenVPN
 echo "Creating OpenVPN directory..."
@@ -75,7 +75,7 @@ cp pki/dh.pem /etc/openvpn/server/
 echo "Creating server configuration..."
 cat > /etc/openvpn/server/server.conf << EOF
 port 1194
-proto udp
+proto udp4
 dev tun
 ca /etc/openvpn/server/ca.crt
 cert /etc/openvpn/server/server.crt
@@ -83,10 +83,11 @@ key /etc/openvpn/server/server.key
 dh /etc/openvpn/server/dh.pem
 server 10.8.0.0 255.255.255.0
 push "redirect-gateway def1 bypass-dhcp"
-push "dhcp-option DNS 8.8.8.8"
-push "dhcp-option DNS 8.8.4.4"
+push "dhcp-option DNS 1.1.1.1"
+push "dhcp-option DNS 1.0.0.1"
+push "block-outside-dns"
 keepalive 10 120
-cipher AES-256-CBC
+cipher AES-256-GCM
 user nobody
 group nogroup
 persist-key
@@ -111,8 +112,13 @@ sysctl --system
 
 # Configure firewall
 echo "Configuring firewall..."
-ufw allow 1194/udp
-ufw allow OpenSSH
+# Allow OpenVPN and SSH traffic
+iptables -A INPUT -p udp --dport 1194 -j ACCEPT
+iptables -A INPUT -p tcp --dport 22 -j ACCEPT
+# Allow established connections
+iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
+# Allow loopback interface
+iptables -A INPUT -i lo -j ACCEPT
 
 # Set up NAT for VPN clients
 echo "Setting up NAT for VPN clients..."
@@ -130,16 +136,20 @@ echo "Making NAT rules persistent..."
 apt-get install -y iptables-persistent
 echo "y" | netfilter-persistent save
 
-echo "y" | ufw enable
-
-# Start OpenVPN service
-echo "Starting OpenVPN service..."
-systemctl start openvpn@server
+# Start and enable OpenVPN service
+echo "Starting and enabling OpenVPN service..."
+systemctl daemon-reload
 systemctl enable openvpn@server
+systemctl restart openvpn@server
+sleep 2
+
+# Verify the service is running
+echo "Verifying OpenVPN service status..."
+systemctl status openvpn@server || true
 
 # Create client certificate generation script
 echo "Creating client certificate generation script..."
-cat > /etc/openvpn/server/generate-client.sh << 'EOF'
+cat > /etc/openvpn/server/generate-client.sh << 'ENDOFFILE'
 #!/bin/bash
 
 if [ -z "$1" ]; then
@@ -160,39 +170,39 @@ mkdir -p /etc/openvpn/client
 # Create client configuration
 cat > /etc/openvpn/client/$CLIENT_NAME.ovpn << EOL
 client
-proto udp
 dev tun
-explicit-exit-notify
-remote $(curl -s ifconfig.me) 1194
+proto udp4
+remote \$(curl -s -4 ifconfig.me) 1194
 resolv-retry infinite
 nobind
 persist-key
 persist-tun
 remote-cert-tls server
-auth-user-pass auth.txt
-cipher AES-256-CBC
+cipher AES-256-GCM
+data-ciphers AES-256-GCM:AES-256-CBC:AES-128-GCM:CHACHA20-POLY1305
+block-outside-dns
 verb 3
+dhcp-option DNS 1.1.1.1
+dhcp-option DNS 1.0.0.1
 <ca>
-$(cat /etc/openvpn/server/ca.crt)
+\$(cat /etc/openvpn/server/ca.crt)
 </ca>
 <cert>
-$(cat /etc/openvpn/server/easy-rsa/pki/issued/$CLIENT_NAME.crt)
+\$(cat /etc/openvpn/server/easy-rsa/pki/issued/\$CLIENT_NAME.crt)
 </cert>
 <key>
-$(cat /etc/openvpn/server/easy-rsa/pki/private/$CLIENT_NAME.key)
+\$(cat /etc/openvpn/server/easy-rsa/pki/private/\$CLIENT_NAME.key)
 </key>
 EOL
 
-# Create auth.txt file
-cat > /etc/openvpn/client/auth.txt << EOL
-# Add your username and password here if needed
-# username
-# password
-EOL
+# Copy the configuration file to the current working directory
+WORKING_DIR=\$(dirname \$(readlink -f \$0))
+cp /etc/openvpn/client/\$CLIENT_NAME.ovpn \$WORKING_DIR/
+chmod 644 \$WORKING_DIR/\$CLIENT_NAME.ovpn
 
-echo "Client configuration created: /etc/openvpn/client/$CLIENT_NAME.ovpn"
-echo "Don't forget to configure auth.txt with your credentials if needed"
-EOF
+echo "Client configuration created: /etc/openvpn/client/\$CLIENT_NAME.ovpn"
+echo "A copy has also been saved to: \$WORKING_DIR/\$CLIENT_NAME.ovpn"
+ENDOFFILE
 
 chmod +x /etc/openvpn/server/generate-client.sh