Skip to content

Commit 20450d6

Browse files
lechuga16lechuga16
committed
Refactor OpenVPN support into separate modules for server and site-to-site configurations
- Updated documentation to reflect changes in OpenVPN support, including new variable names and configurations for `openvpn_server` and `openvpn_sitetosite`. - Removed the unified OpenVPN module and created dedicated modules: `ip_30_openvpn_server.sh`, `ip_31_openvpn_sitetosite.sh`, and their corresponding nftables versions. - Introduced new environment variables for site-to-site configurations and updated existing ones for server configurations. - Implemented validation and rule application logic for both OpenVPN server and site-to-site modules. - Added design notes for Oracle1 site-to-site configuration.
1 parent c3491b6 commit 20450d6

13 files changed

+617
-279
lines changed

‎README.md‎

Lines changed: 27 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -117,26 +117,33 @@ SSH_PORT="2222,22220:22229"
117117
WHITELISTED_IPS="198.51.100.10 203.0.113.5"
118118
WHITELISTED_DOMAINS="admin-gateway.example.net"
119119

120-
# OpenVPN (host o Docker)
121-
# Se configura solo si incluyes el módulo ip_openvpn/nf_openvpn
122-
VPN_PORT=1194
123-
VPN_PROTO="udp"
124-
VPN_SUBNET="10.8.0.0/24"
125-
VPN_INTERFACE="tun0" # o "tun+" para múltiples
126-
VPN_DOCKER_INTERFACE="docker0" # opcional para OpenVPN en Docker
127-
VPN_LAN_SUBNET="192.168.1.0/24"
128-
VPN_LAN_INTERFACE="enp3s0" # requerido si VPN_ENABLE_NAT=true
129-
VPN_ENABLE_NAT=false
130-
131-
# (Opcional) Alias del router/LAN vía VPN (DNAT) para evitar conflictos de subred en el cliente
132-
# Útil si el cliente VPN está en una red que también usa 192.168.1.0/24 y no puede acceder a 192.168.1.1.
133-
# Ejemplo: http://10.99.1.1 -> Router real: 192.168.1.1
134-
# Si cualquiera de las variables está vacía, NO se crea el alias.
135-
VPN_ROUTER_REAL_IP=""
136-
VPN_ROUTER_ALIAS_IP=""
137-
138-
VPN_LOG_ENABLED=false
139-
VPN_LOG_PREFIX="VPN_TRAFFIC: "
120+
# OpenVPN Server (host o Docker)
121+
# Se configura solo si incluyes el módulo openvpn_server
122+
OVPNSRV_PORT=1194
123+
OVPNSRV_PROTO="udp"
124+
OVPNSRV_SUBNET="10.8.0.0/24"
125+
OVPNSRV_INTERFACE="tun0" # o "tun+" para múltiples
126+
OVPNSRV_DOCKER_INTERFACE="docker0" # opcional para OpenVPN en Docker
127+
OVPNSRV_LAN_SUBNET="192.168.1.0/24"
128+
OVPNSRV_LAN_INTERFACE="enp3s0" # requerido si OVPNSRV_ENABLE_NAT=true
129+
OVPNSRV_ENABLE_NAT=false
130+
131+
# (Opcional) Alias del router/LAN vía VPN server (DNAT)
132+
OVPNSRV_ROUTER_REAL_IP=""
133+
OVPNSRV_ROUTER_ALIAS_IP=""
134+
OVPNSRV_LOG_ENABLED=false
135+
OVPNSRV_LOG_PREFIX="VPN_SERVER_TRAFFIC: "
136+
137+
# OpenVPN Site-to-Site
138+
# Se configura solo si incluyes el módulo openvpn_sitetosite.
139+
# Incompatible con openvpn_server: no usar ambos a la vez.
140+
OVPNS2S_INTERFACE="tun0"
141+
OVPNS2S_LOCAL_SUBNETS="192.168.1.0/24"
142+
OVPNS2S_REMOTE_SUBNETS=""
143+
OVPNS2S_ENABLE_NAT=false
144+
OVPNS2S_LOCAL_INTERFACE=""
145+
OVPNS2S_LOG_ENABLED=false
146+
OVPNS2S_LOG_PREFIX="VPN_S2S_TRAFFIC: "
140147

141148
# Puertos extra permitidos (servicios adicionales)
142149
# Formato: "puerto,puerto" o rangos "inicio:fin" (multiport)

‎configure-env.sh‎

Lines changed: 101 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -158,10 +158,10 @@ ask_yes_no() {
158158

159159
module_default_include() {
160160
case "$1" in
161-
ip_loopback|ip_whitelist|ip_allowlist_ports|ip_openvpn|ip_tcp_ssh|ip_http_https_protect)
161+
ip_loopback|ip_whitelist|ip_allowlist_ports|ip_openvpn_server|ip_tcp_ssh|ip_http_https_protect)
162162
echo "true"
163163
;;
164-
ip_l4d2_tcpfilter_chain|ip_l4d2_tcp_protect|ip_l4d2_udp_base|ip_l4d2_packet_validation|ip_l4d2_a2s_filters)
164+
ip_openvpn_sitetosite|ip_l4d2_tcpfilter_chain|ip_l4d2_tcp_protect|ip_l4d2_udp_base|ip_l4d2_packet_validation|ip_l4d2_a2s_filters)
165165
echo "false"
166166
;;
167167
*)
@@ -188,7 +188,8 @@ module_token_to_module_ids() {
188188
finalize) echo "ip_finalize nf_finalize" ;;
189189
whitelist) echo "ip_whitelist nf_whitelist" ;;
190190
allowlist_ports) echo "ip_allowlist_ports nf_allowlist_ports" ;;
191-
openvpn) echo "ip_openvpn nf_openvpn" ;;
191+
openvpn_server) echo "ip_openvpn_server nf_openvpn_server" ;;
192+
openvpn_sitetosite) echo "ip_openvpn_sitetosite nf_openvpn_sitetosite" ;;
192193
tcp_ssh) echo "ip_tcp_ssh nf_tcp_ssh" ;;
193194
l4d2_tcp_protect) echo "ip_l4d2_tcp_protect nf_l4d2_tcp_protect" ;;
194195
http_https_protect) echo "ip_http_https_protect nf_http_https_protect" ;;
@@ -325,7 +326,8 @@ declare -a selectable_modules=(
325326
"ip_loopback|Loopback local"
326327
"ip_whitelist|Whitelist por IP/dominio"
327328
"ip_allowlist_ports|Allowlist de puertos manual"
328-
"ip_openvpn|Reglas OpenVPN"
329+
"ip_openvpn_server|OpenVPN modo servidor (clientes remotos)"
330+
"ip_openvpn_sitetosite|OpenVPN modo site-to-site"
329331
"ip_tcp_ssh|Acceso SSH base"
330332
"ip_l4d2_tcp_protect|Protección TCP L4D2"
331333
"ip_http_https_protect|Protección HTTP/HTTPS"
@@ -384,10 +386,13 @@ tcp_allow=""
384386
http_https_ports="80,443"
385387
http_https_rate="180/min"
386388
http_https_burst="360"
387-
vpn_port="1195"
388-
vpn_subnet="10.8.0.0/24"
389-
vpn_interface="tun0"
390-
vpn_proto="udp"
389+
ovpnsrv_port="1195"
390+
ovpnsrv_subnet="10.8.0.0/24"
391+
ovpnsrv_interface="tun0"
392+
ovpnsrv_proto="udp"
393+
ovpns2s_interface="tun0"
394+
ovpns2s_local_subnets="192.168.1.0/24"
395+
ovpns2s_remote_subnets=""
391396
l4d2_tcp_protection=""
392397

393398
if needs_var "SSH_PORT"; then
@@ -514,34 +519,64 @@ if needs_var "HTTP_HTTPS_PORTS" || needs_var "HTTP_HTTPS_RATE" || needs_var "HTT
514519
"HTTP_HTTPS_BURST debe ser numérico.")"
515520
fi
516521

517-
if needs_var "VPN_PORT" || needs_var "VPN_SUBNET" || needs_var "VPN_INTERFACE"; then
518-
say_section "OpenVPN"
519-
vpn_port="$(ask_with_context \
520-
"VPN_PORT" \
522+
if needs_var "OVPNSRV_PORT" || needs_var "OVPNSRV_SUBNET" || needs_var "OVPNSRV_INTERFACE"; then
523+
say_section "OpenVPN Server"
524+
ovpnsrv_port="$(ask_with_context \
525+
"OVPNSRV_PORT" \
521526
"Puerto de escucha de OpenVPN (1-65535)." \
522527
"docs/modules/06_openvpn.md" \
523-
"VPN_PORT" \
528+
"OVPNSRV_PORT" \
524529
"1195" \
525530
"is_port_number" \
526-
"VPN_PORT debe ser numérico entre 1 y 65535.")"
531+
"OVPNSRV_PORT debe ser numérico entre 1 y 65535.")"
527532

528-
vpn_subnet="$(ask_with_context \
529-
"VPN_SUBNET" \
533+
ovpnsrv_subnet="$(ask_with_context \
534+
"OVPNSRV_SUBNET" \
530535
"Subred del túnel en formato CIDR IPv4 (ej: 10.8.0.0/24)." \
531536
"docs/modules/06_openvpn.md" \
532-
"VPN_SUBNET" \
537+
"OVPNSRV_SUBNET" \
533538
"10.8.0.0/24" \
534539
"is_ipv4_cidr" \
535-
"VPN_SUBNET debe tener formato CIDR IPv4 válido (ej: 10.8.0.0/24).")"
540+
"OVPNSRV_SUBNET debe tener formato CIDR IPv4 válido (ej: 10.8.0.0/24).")"
536541

537-
vpn_interface="$(ask_with_context \
538-
"VPN_INTERFACE" \
542+
ovpnsrv_interface="$(ask_with_context \
543+
"OVPNSRV_INTERFACE" \
539544
"Interfaz del túnel OpenVPN (ej: tun0)." \
540545
"docs/modules/06_openvpn.md" \
541-
"VPN_INTERFACE" \
546+
"OVPNSRV_INTERFACE" \
542547
"tun0" \
543548
"is_interface_name" \
544-
"VPN_INTERFACE contiene caracteres no válidos.")"
549+
"OVPNSRV_INTERFACE contiene caracteres no válidos.")"
550+
fi
551+
552+
if needs_var "OVPNS2S_INTERFACE" || needs_var "OVPNS2S_LOCAL_SUBNETS" || needs_var "OVPNS2S_REMOTE_SUBNETS"; then
553+
say_section "OpenVPN Site-to-Site"
554+
ovpns2s_interface="$(ask_with_context \
555+
"OVPNS2S_INTERFACE" \
556+
"Interfaz del túnel site-to-site (ej: tun0)." \
557+
"docs/modules/06_openvpn.md" \
558+
"OVPNS2S_INTERFACE" \
559+
"tun0" \
560+
"is_interface_name" \
561+
"OVPNS2S_INTERFACE contiene caracteres no válidos.")"
562+
563+
ovpns2s_local_subnets="$(ask_with_context \
564+
"OVPNS2S_LOCAL_SUBNETS" \
565+
"Subred(es) locales publicadas por el sitio (CIDR, separadas por coma)." \
566+
"docs/modules/06_openvpn.md" \
567+
"OVPNS2S_LOCAL_SUBNETS" \
568+
"192.168.1.0/24" \
569+
"true" \
570+
"")"
571+
572+
ovpns2s_remote_subnets="$(ask_with_context \
573+
"OVPNS2S_REMOTE_SUBNETS" \
574+
"Subred(es) remotas del peer (CIDR, separadas por coma)." \
575+
"docs/modules/06_openvpn.md" \
576+
"OVPNS2S_REMOTE_SUBNETS" \
577+
"" \
578+
"true" \
579+
"")"
545580
fi
546581

547582
if [ "${module_enabled[ip_l4d2_udp_base]:-false}" = "true" ] || [ "${module_enabled[ip_l4d2_packet_validation]:-false}" = "true" ] || [ "${module_enabled[ip_l4d2_a2s_filters]:-false}" = "true" ]; then
@@ -618,9 +653,14 @@ elif [ "$has_l4d2_tcp_modules" = "true" ] && [ -z "$l4d2_tcp_protection" ] && ne
618653
has_l4d2_ports_needed="true"
619654
fi
620655

621-
has_openvpn_module="false"
622-
if needs_var "VPN_PORT" || needs_var "VPN_SUBNET" || needs_var "VPN_INTERFACE"; then
623-
has_openvpn_module="true"
656+
has_openvpn_server_module="false"
657+
if needs_var "OVPNSRV_PORT" || needs_var "OVPNSRV_SUBNET" || needs_var "OVPNSRV_INTERFACE"; then
658+
has_openvpn_server_module="true"
659+
fi
660+
661+
has_openvpn_s2s_module="false"
662+
if needs_var "OVPNS2S_INTERFACE" || needs_var "OVPNS2S_LOCAL_SUBNETS" || needs_var "OVPNS2S_REMOTE_SUBNETS"; then
663+
has_openvpn_s2s_module="true"
624664
fi
625665

626666
has_ssh_module="false"
@@ -761,21 +801,34 @@ LOG_PREFIX_SSH_ABUSE="SSH_ABUSE: "
761801
EOF
762802
fi
763803

764-
if [ "$has_openvpn_module" = "true" ]; then
804+
if [ "$has_openvpn_server_module" = "true" ]; then
765805
cat >> "$output_file" <<EOF
766806
767-
VPN_PROTO="${vpn_proto}"
768-
VPN_PORT=${vpn_port}
769-
VPN_SUBNET="${vpn_subnet}"
770-
VPN_INTERFACE="${vpn_interface}"
771-
VPN_DOCKER_INTERFACE=""
772-
VPN_LAN_SUBNET="192.168.1.0/24"
773-
VPN_LAN_INTERFACE=""
774-
VPN_ENABLE_NAT=false
775-
VPN_ROUTER_REAL_IP=""
776-
VPN_ROUTER_ALIAS_IP=""
777-
VPN_LOG_ENABLED=false
778-
VPN_LOG_PREFIX="VPN_TRAFFIC: "
807+
OVPNSRV_PROTO="${ovpnsrv_proto}"
808+
OVPNSRV_PORT=${ovpnsrv_port}
809+
OVPNSRV_SUBNET="${ovpnsrv_subnet}"
810+
OVPNSRV_INTERFACE="${ovpnsrv_interface}"
811+
OVPNSRV_DOCKER_INTERFACE=""
812+
OVPNSRV_LAN_SUBNET="192.168.1.0/24"
813+
OVPNSRV_LAN_INTERFACE=""
814+
OVPNSRV_ENABLE_NAT=false
815+
OVPNSRV_ROUTER_REAL_IP=""
816+
OVPNSRV_ROUTER_ALIAS_IP=""
817+
OVPNSRV_LOG_ENABLED=false
818+
OVPNSRV_LOG_PREFIX="VPN_SERVER_TRAFFIC: "
819+
EOF
820+
fi
821+
822+
if [ "$has_openvpn_s2s_module" = "true" ]; then
823+
cat >> "$output_file" <<EOF
824+
825+
OVPNS2S_INTERFACE="${ovpns2s_interface}"
826+
OVPNS2S_LOCAL_SUBNETS="${ovpns2s_local_subnets}"
827+
OVPNS2S_REMOTE_SUBNETS="${ovpns2s_remote_subnets}"
828+
OVPNS2S_ENABLE_NAT=false
829+
OVPNS2S_LOCAL_INTERFACE=""
830+
OVPNS2S_LOG_ENABLED=false
831+
OVPNS2S_LOG_PREFIX="VPN_S2S_TRAFFIC: "
779832
EOF
780833
fi
781834

@@ -803,10 +856,16 @@ echo " SSH_RATE=$ssh_rate" >&2
803856
echo " SSH_BURST=$ssh_burst" >&2
804857
fi
805858

806-
if [ "$has_openvpn_module" = "true" ]; then
807-
echo " VPN_PORT=$vpn_port" >&2
808-
echo " VPN_SUBNET=$vpn_subnet" >&2
809-
echo " VPN_INTERFACE=$vpn_interface" >&2
859+
if [ "$has_openvpn_server_module" = "true" ]; then
860+
echo " OVPNSRV_PORT=$ovpnsrv_port" >&2
861+
echo " OVPNSRV_SUBNET=$ovpnsrv_subnet" >&2
862+
echo " OVPNSRV_INTERFACE=$ovpnsrv_interface" >&2
863+
fi
864+
865+
if [ "$has_openvpn_s2s_module" = "true" ]; then
866+
echo " OVPNS2S_INTERFACE=$ovpns2s_interface" >&2
867+
echo " OVPNS2S_LOCAL_SUBNETS=$ovpns2s_local_subnets" >&2
868+
echo " OVPNS2S_REMOTE_SUBNETS=$ovpns2s_remote_subnets" >&2
810869
fi
811870

812871
if [ "$has_l4d2_ports_needed" = "true" ]; then

‎docs/iptables.rules.md‎

Lines changed: 35 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -115,34 +115,50 @@ LOG_PREFIX_A2S_INFO="A2S_INFO_FLOOD: "
115115
# ... [12 prefijos más para categorización]
116116
```
117117

118-
### Soporte OpenVPN (host o Docker)
118+
### Soporte OpenVPN Server (host o Docker)
119119

120120
El script puede abrir el puerto de OpenVPN, permitir acceso desde el tun hacia el host y habilitar forwarding controlado hacia la LAN. Esto evita que el tráfico VPN pase por las cadenas de rate limiting del juego.
121121

122-
**Variables principales:**
122+
**Variables principales (`openvpn_server`):**
123123
```bash
124-
VPN_PROTO="udp"
125-
VPN_PORT=1194
126-
VPN_SUBNET="10.8.0.0/24"
127-
VPN_INTERFACE="tun0" # o "tun+" para varios
128-
VPN_DOCKER_INTERFACE="docker0" # opcional (OpenVPN en Docker)
129-
VPN_LAN_SUBNET="192.168.1.0/24"
130-
VPN_LAN_INTERFACE="enp3s0" # requerido si VPN_ENABLE_NAT=true
131-
VPN_ENABLE_NAT=false
132-
VPN_LOG_ENABLED=false
133-
VPN_LOG_PREFIX="VPN_TRAFFIC: "
124+
OVPNSRV_PROTO="udp"
125+
OVPNSRV_PORT=1194
126+
OVPNSRV_SUBNET="10.8.0.0/24"
127+
OVPNSRV_INTERFACE="tun0" # o "tun+" para varios
128+
OVPNSRV_DOCKER_INTERFACE="docker0" # opcional (OpenVPN en Docker)
129+
OVPNSRV_LAN_SUBNET="192.168.1.0/24"
130+
OVPNSRV_LAN_INTERFACE="enp3s0" # requerido si OVPNSRV_ENABLE_NAT=true
131+
OVPNSRV_ENABLE_NAT=false
132+
OVPNSRV_LOG_ENABLED=false
133+
OVPNSRV_LOG_PREFIX="VPN_SERVER_TRAFFIC: "
134134
```
135135

136136
**Reglas generadas (resumen):**
137-
- INPUT: permite handshake OpenVPN en `VPN_PORT` y acceso desde `VPN_SUBNET` por la interfaz VPN.
138-
- FORWARD: permite `VPN_SUBNET -> VPN_LAN_SUBNET` y retorno `ESTABLISHED,RELATED`.
139-
- NAT opcional: `MASQUERADE` para `VPN_SUBNET` cuando no existe ruta estática en el router.
137+
- INPUT: permite handshake OpenVPN en `OVPNSRV_PORT` y acceso desde `OVPNSRV_SUBNET` por la interfaz VPN.
138+
- FORWARD: permite `OVPNSRV_SUBNET -> OVPNSRV_LAN_SUBNET` y retorno `ESTABLISHED,RELATED`.
139+
- NAT opcional: `MASQUERADE` para `OVPNSRV_SUBNET` cuando no existe ruta estática en el router.
140140
- Logging opcional: limitado por rate limit para evitar spam.
141141

142142
**Notas:**
143-
- Para OpenVPN en Docker con bridge, define `VPN_DOCKER_INTERFACE` (ej. `docker0` o `br+`).
143+
- Para OpenVPN en Docker con bridge, define `OVPNSRV_DOCKER_INTERFACE` (ej. `docker0` o `br+`).
144144
- Asegura `net.ipv4.ip_forward=1` si usas forwarding/NAT.
145-
- `VPN_INTERFACE="tun+"` usa wildcard de iptables; en algunas distros puede requerir compatibilidad `iptables-legacy`/`iptables-nft`.
145+
- `OVPNSRV_INTERFACE="tun+"` usa wildcard de iptables; en algunas distros puede requerir compatibilidad `iptables-legacy`/`iptables-nft`.
146+
147+
### Soporte OpenVPN Site-to-Site
148+
149+
Habilita enrutamiento entre subredes locales/remotas usando el módulo `openvpn_sitetosite`.
150+
151+
```bash
152+
OVPNS2S_INTERFACE="tun0"
153+
OVPNS2S_LOCAL_SUBNETS="192.168.1.0/24"
154+
OVPNS2S_REMOTE_SUBNETS="10.20.0.0/24,10.30.0.0/24"
155+
OVPNS2S_ENABLE_NAT=false
156+
OVPNS2S_LOCAL_INTERFACE=""
157+
OVPNS2S_LOG_ENABLED=false
158+
OVPNS2S_LOG_PREFIX="VPN_S2S_TRAFFIC: "
159+
```
160+
161+
`openvpn_server` y `openvpn_sitetosite` son incompatibles y no pueden ejecutarse juntos.
146162

147163
**Modos Docker soportados (comportamiento esperado):**
148164
1. **OpenVPN host-native o container con `network_mode: host`**
@@ -205,10 +221,10 @@ sudo ./iptables.rules.sh --dry-run --verbose
205221
sudo ./iptables.rules.sh
206222
207223
# Ejecutar subconjunto de módulos
208-
sudo ./iptables.rules.sh --only ip_whitelist --only ip_openvpn
224+
sudo ./iptables.rules.sh --only ip_whitelist --only ip_openvpn_server
209225
210226
# Omitir módulos específicos
211-
sudo ./iptables.rules.sh --skip ip_openvpn
227+
sudo ./iptables.rules.sh --skip ip_openvpn_server
212228
213229
# Verificar reglas aplicadas
214230
sudo iptables -L -n -v --line-numbers

0 commit comments

Comments
 (0)