#!/bin/bash
 
# Freifunk Community Pinneberg
# Automatisierung Exit-VPN
 
ip route replace 0.0.0.0/1 via $4 table freifunk
ip route replace 128.0.0.0/1 via $4 table freifunk
 
# Prüfe, ob Parameter angegeben sind. $1 ist der Provider.
# Falls nicht, versuche den Provider aus der Konfiguration zu ermitteln
if [ $# -eq 0 ]; then
    VPNCONF=$(grep -e "^AUTOSTART=" /etc/default/openvpn)
    PROVIDER=$(sed -e 's/^"//' -e 's/"$//' <<< ${VPNCONF#*=})
else
    PROVIDER=$1
fi
 
# Masquerading Regel überprüfen und ggf. korrigieren
FWRULE=$(iptables --line-numbers -t nat -vnL | grep MASQUERADE | head  -n 1 | awk '{$1=$1};1')
NATIF=$(echo "$FWRULE" | cut -d' ' -f 8)
RULENO=$(echo "$FWRULE" | cut -d' ' -f 1)
 
if [ "$NATIF" != "$PROVIDER" ]; then
    logger -t  exitvpn[$$] "change firewall interface from '$NATIF' to '$PROVIDER' (rule #$RULENO)"
    iptables -t nat -D POSTROUTING $RULENO
    iptables -t nat -A POSTROUTING -o $PROVIDER -j MASQUERADE
fi
 
exit 0

#!/bin/bash
 
# Prüfe, ob Parameter angegeben sind. $1 ist der Provider.
# Falls nicht, versuche den Provider aus der Konfiguration zu ermitteln
if [ $# -eq 0 ]; then
    VPNCONF=$(grep -e "^AUTOSTART=" /etc/default/openvpn)
    PROVIDER=$(sed -e 's/^"//' -e 's/"$//' <<< ${VPNCONF#*=})
else
    PROVIDER=$1
fi
 
# Masquerading Regel entfernen
FWRULE=$(iptables --line-numbers -t nat -vnL | grep MASQUERADE | head  -n 1 | awk '{$1=$1};1')
NATIF=$(echo "$FWRULE" | cut -d' ' -f 8)
RULENO=$(echo "$FWRULE" | cut -d' ' -f 1)
 
if [ "$NATIF" == "$PROVIDER" ]; then
    logger -t  exitvpn[$$] "removing firewall interface '$NATIF' (rule #$RULENO)"
    iptables -t nat -D POSTROUTING $RULENO
fi
 
exit 0

## ExitCountry = NL
client
dev-type tun
dev mullvad
proto udp
remote nl.mullvad.net
resolv-retry infinite
nobind
persist-key
persist-tun
comp-lzo
verb 3
remote-cert-tls server
ping-restart 60
script-security 2
route-noexec
up /etc/openvpn/exitvpn-up
down /etc/openvpn/exitvpn-down
ping 10
ca /etc/openvpn/mullvad/ca.crt
cert /etc/openvpn/mullvad/mullvad.crt
key /etc/openvpn/mullvad/mullvad.key

## ExitCountry = CH
client
dev-type tun
dev earthvpn
proto udp
remote zur-ch.earthvpn.com 1194
resolv-retry infinite
nobind
persist-key
persist-tun
ca /etc/openvpn/earthvpn/earthvpn.crt
auth-user-pass /etc/openvpn/earthvpn/secret.dat
# auth-nocache
remote-cert-tls server
# reneg-sec 0
reneg-sec 7200
verb 3
auth SHA1
cipher AES-128-CBC
ping 10
ping-restart 60
auth-retry nointeract
route-noexec
script-security 2
up /etc/openvpn/exitvpn-up
down /etc/openvpn/exitvpn-down
mute-replay-warnings

## ExitCountry = SE
# oVPN.to Server (se1.ovpn.to) Configuration built 2016-09-13 09:09:41
#
#### Allowed for Edit - oVPN-Client55314 Settings
verb 3
 
#### Server Settings (dont change anything down here!)
dev-type tun
dev ovpn.to
explicit-exit-notify 1
remote 193.105.134.118 443
proto udp
client
nobind
mute-replay-warnings
persist-tun
persist-remote-ip
resolv-retry infinite
comp-lzo no
auth SHA512
remote-cert-tls server
ns-cert-type server
topology subnet
cipher AES-256-CBC
fragment 1340
mssfix
tls-version-min 1.2
#STRONG TLSv1.2
tls-cipher TLS-DHE-RSA-WITH-AES-256-GCM-SHA384
 
#### Linux Part
ca "/etc/openvpn/se1.ovpn.to/se1.ovpn.to.crt"
cert "/etc/openvpn/se1.ovpn.to/client55314.crt"
key "/etc/openvpn/se1.ovpn.to/client55314.key"
tls-auth "/etc/openvpn/se1.ovpn.to/se1.ovpn.to.key" 1
#--INFO-- openvpn with user+group setting is unable to delete your routes on openvpn-stop!
#user openvpn
#group openvpn
#--INFO-- Use update-resolv-conf to FIX DNSLEAK! See https://wiki.archlinux.org/index.php/OpenVPN#DNS for Details! Works with ALL LINUX!!
route-noexec
script-security 2
up /etc/openvpn/exitvpn-up
down /etc/openvpn/exitvpn-down
#up /etc/openvpn/update-resolv-conf
#down /etc/openvpn/update-resolv-conf
#### Linux Special / Experimental Options
#fast-io
#nice -10
#mtu-disc yes
# oVPN-Config se1.ovpn.to END