Browse Source
* Server.conf file deleted * New version of php-openvpn library * Few new env options in file and in scripts * New questions on evn stagefeature/refractoring
Paul Rock
7 years ago
8 changed files with 132 additions and 160 deletions
@ -1,91 +0,0 @@ |
|||||||
## GENERAL ## |
|
||||||
|
|
||||||
# TCP or UDP, port 443, tunneling |
|
||||||
mode server |
|
||||||
proto VPN_PROTO |
|
||||||
port VPN_PORT |
|
||||||
dev VPN_INIF |
|
||||||
|
|
||||||
## KEY, CERTS AND NETWORK CONFIGURATION ## |
|
||||||
# Identity |
|
||||||
ca ca.crt |
|
||||||
# Public key |
|
||||||
cert server.crt |
|
||||||
# Private key |
|
||||||
key server.key |
|
||||||
# Symmetric encryption |
|
||||||
dh dh.pem |
|
||||||
# Improve security (DDOS, port flooding...) |
|
||||||
# 0 for the server, 1 for the client |
|
||||||
tls-auth ta.key 0 |
|
||||||
# Encryption protocol |
|
||||||
cipher AES-256-CBC |
|
||||||
|
|
||||||
# Network |
|
||||||
# Subnetwork, the server will be the 10.8.0.1 and clients will take the other ips |
|
||||||
server VPN_SERVER |
|
||||||
|
|
||||||
# Redirect all IP network traffic originating on client machines to pass through the OpenVPN server |
|
||||||
push "redirect-gateway def1" |
|
||||||
|
|
||||||
# Alternatives DNS (FDN) |
|
||||||
push "dhcp-option DNS 80.67.169.12" |
|
||||||
push "dhcp-option DNS 80.67.169.40" |
|
||||||
|
|
||||||
# (OpenDNS) |
|
||||||
# push "dhcp-option DNS 208.67.222.222" |
|
||||||
# push "dhcp-option DNS 208.67.220.220" |
|
||||||
|
|
||||||
# (Google) |
|
||||||
# push "dhcp-option DNS 8.8.8.8" |
|
||||||
# push "dhcp-option DNS 8.8.4.4" |
|
||||||
|
|
||||||
# Ping every 10 seconds and if after 120 seconds the client doesn't respond we disconnect |
|
||||||
keepalive 10 120 |
|
||||||
# Regenerate key each 5 hours (disconnect the client) |
|
||||||
reneg-sec 18000 |
|
||||||
|
|
||||||
## SECURITY ## |
|
||||||
|
|
||||||
# Downgrade privileges of the daemon |
|
||||||
user VPN_USER |
|
||||||
group VPN_GROUP |
|
||||||
|
|
||||||
# Persist keys (because we are nobody, so we couldn't read them again) |
|
||||||
persist-key |
|
||||||
# Don't close and re open TUN/TAP device |
|
||||||
persist-tun |
|
||||||
# Enable compression |
|
||||||
comp-lzo |
|
||||||
|
|
||||||
## LOG ## |
|
||||||
|
|
||||||
# Verbosity |
|
||||||
# 3/4 for a normal utilisation |
|
||||||
verb 3 |
|
||||||
# Max 20 messages of the same category |
|
||||||
mute 20 |
|
||||||
# Log gile where we put the clients status |
|
||||||
status /var/log/openvpn/status.log |
|
||||||
# Log file |
|
||||||
log-append /var/log/openvpn/openvpn.log |
|
||||||
# Configuration directory of the clients |
|
||||||
client-config-dir ccd |
|
||||||
|
|
||||||
## PASS ## |
|
||||||
|
|
||||||
# Allow running external scripts with password in ENV variables |
|
||||||
script-security 3 |
|
||||||
|
|
||||||
# Use the authenticated username as the common name, rather than the common name from the client cert |
|
||||||
username-as-common-name |
|
||||||
# Client certificate is not required |
|
||||||
verify-client-cert none |
|
||||||
# Maximum of clients |
|
||||||
max-clients 50 |
|
||||||
|
|
||||||
# Use the connection script when a user wants to login |
|
||||||
auth-user-pass-verify SCRIPTS_LOGIN via-env |
|
||||||
# Run this scripts when the client connects/disconnects |
|
||||||
client-connect SCRIPTS_CONNECT |
|
||||||
client-disconnect SCRIPTS_DISCONNECT |
|
||||||
@ -0,0 +1,63 @@ |
|||||||
|
<?php |
||||||
|
// Enable dotEnv support |
||||||
|
require_once __DIR__ . '/../vendor/autoload.php'; |
||||||
|
$dotenv = new Dotenv\Dotenv(__DIR__ . '/../'); |
||||||
|
if (file_exists(__DIR__ . '/../.env')) $dotenv->load(); |
||||||
|
|
||||||
|
$_ovpn = new EvilFreelancer\OpenVPN(); |
||||||
|
|
||||||
|
// TCP or UDP, port 443, tunneling |
||||||
|
$_ovpn |
||||||
|
->addParam('server') |
||||||
|
->addParam('dev', getenv('VPN_DEV')) |
||||||
|
->addParam('proto', getenv('VPN_PROTO')) |
||||||
|
->addParam('port', getenv('VPN_LISTEN_PORT')); |
||||||
|
|
||||||
|
// If listening address is set |
||||||
|
if (!empty(getenv('VPN_LISTEN'))) |
||||||
|
$_ovpn->addParam('listen', getenv('VPN_LISTEN')); |
||||||
|
|
||||||
|
// KEY, CERTS AND NETWORK CONFIGURATION |
||||||
|
$_ovpn |
||||||
|
->addCert('ca', getenv('VPN_CONF') . '/ca.crt') |
||||||
|
->addCert('cert', getenv('VPN_CONF') . '/server.crt') |
||||||
|
->addCert('key', getenv('VPN_CONF') . '/server.key') |
||||||
|
->addCert('dh', getenv('VPN_CONF') . '/dh.pem') |
||||||
|
->addCert('tls-auth', getenv('VPN_CONF') . '/ta.key', false, '0') |
||||||
|
->addParam('cipher', 'AES-256-CBC') |
||||||
|
->addParam('server', getenv('VPN_SERVER')) |
||||||
|
->addPush('redirect-gateway def1') |
||||||
|
->addPush('dhcp-option DNS 8.8.8.8') |
||||||
|
->addPush('dhcp-option DNS 8.8.4.4') |
||||||
|
->addParam('keepalive', '10 120') |
||||||
|
->addParam('reneg-sec', '18000'); |
||||||
|
|
||||||
|
// SECURITY |
||||||
|
$_ovpn |
||||||
|
->addParam('user', getenv('VPN_USER')) |
||||||
|
->addParam('group', getenv('VPN_GROUP')) |
||||||
|
->addParam('persist-key') |
||||||
|
->addParam('persist-tun') |
||||||
|
->addParam('comp-lzo'); |
||||||
|
|
||||||
|
// LOG |
||||||
|
$_ovpn |
||||||
|
->addParam('verb', 3) |
||||||
|
->addParam('mute', 20) |
||||||
|
->addParam('status', '/var/log/openvpn/status.log') |
||||||
|
->addParam('log-append', '/var/log/openvpn/openvpn.log') |
||||||
|
->addParam('client-config-dir', 'ccd'); |
||||||
|
|
||||||
|
// PASS |
||||||
|
$_ovpn |
||||||
|
->addParam('script-security', 3) |
||||||
|
->addParam('username-as-common-name') |
||||||
|
->addParam('verify-client-cert', 'none') |
||||||
|
->addParam('max-clients', '50') |
||||||
|
->addParam('auth-user-pass-verify', getenv('SCRIPTS_LOGIN') . ' via-env') |
||||||
|
->addParam('client-connect', getenv('SCRIPTS_CONNECT')) |
||||||
|
->addParam('client-disconnect', getenv('SCRIPTS_DISCONNECT')); |
||||||
|
|
||||||
|
$config = $_ovpn->generateConfig(); |
||||||
|
|
||||||
|
die("$config"); |
||||||
Loading…
Reference in new issue