OpenVPN Install 2.0.3

🚀 OpenVPN Install v2.0.3

Security Hardening, Client Management & Reliability Improvements

Release Date: 2026-08-03

This release strengthens installation security, improves dual-stack IPv4/IPv6 deployment, introduces new client management utilities, and enhances reliability, maintainability, and code quality across the entire project.

---

✨ Added

🌐 Manual IPv6 Fallback

When automatic IPv6 discovery (ip -o -6 addr show scope global) does not detect a usable global IPv6 address—such as when only link-local addresses are available or IPv6 has not yet been assigned—the installer now offers a manual IPv6 configuration prompt.

This allows dual-stack deployments to proceed instead of silently falling back to IPv4-only mode.

---

👥 Client Management Utilities

Added several new management commands to simplify OpenVPN administration.

📋 list_clients

Displays all active client certificates from the EasyRSA PKI index.

🔌 list_connected

Shows currently connected VPN clients using the OpenVPN status log or ss.

🔄 renew_client

Regenerates an existing .ovpn bundle without modifying the associated certificate or private key.

---

🎨 Enhanced Terminal Interface

Introduced a refreshed command-line interface featuring bright ANSI colors and centralized logging helpers:

• log_header
• log_subheader
• log_prompt
• log_info
• log_ok
• log_warn
• log_error

This provides clearer output and a more consistent user experience.

---

🛑 Signal Handling

Added consolidated signal handlers for:

• EXIT
• SIGINT
• SIGTERM

The installer now automatically restores terminal colors and removes tracked temporary files on every exit path.

---

🔒 Security

🔐 Secure EasyRSA Downloads

Improved EasyRSA download security by:

• downloading into a secure mktemp file
• validating the archive using tar -tzf before extraction
• preventing installation from corrupted or partially downloaded archives

The curl fallback now uses:

-fsSL

to enforce redirect handling, SSL verification, silent operation, and proper error reporting.

---

🔐 Atomic Client Configuration Generation

Client .ovpn bundles are now generated using atomic writes:

• secure temporary file (mktemp)
• explicit chmod 600
• atomic move into place

This prevents partially written configuration files and insecure intermediate states.

---

📜 Atomic CRL Updates

Certificate Revocation Lists (crl.pem) are now replaced atomically using a staged copy-and-move process.

This guarantees the CRL is never left in an inconsistent state during rotation, helping prevent VPN service interruptions.

---

🌐 Secure DNS Resolver Detection

Local loopback resolvers are now ignored during automatic DNS detection, including:

• 127.0.0.1
• ::1

This prevents invalid resolver addresses from being pushed to VPN clients.

---

🐛 Fixed

👥 Management Menu

Improved reliability and safety of client management operations.

• Prevent duplicate client certificate names during creation with a clear error message.
• Require explicit [y/N] confirmation before revoking client certificates.
• Automatically execute systemctl daemon-reload after removing systemd unit files during uninstallation.
• Prevent uninstall failures when SELinux port labels do not exist by safely handling semanage port -d.

---

🔥 Firewall Compatibility

Corrected the regular expression used when removing firewalld direct SNAT rules.

The matcher now correctly recognizes destination-negated rules containing:

! -d

ensuring reliable firewall cleanup during uninstallation.

---

🗑️ Client Cleanup

Client .ovpn bundles are now automatically removed when the corresponding certificate is revoked.

---

🌐 IPv6 Validation

Improved IPv6 validation to correctly reject malformed addresses containing invalid leading or trailing colon boundaries.

---

📥 EasyRSA Version Detection

Improved EasyRSA redirect parsing by stripping carriage return (\r) characters from HTTP response headers, ensuring reliable version tag detection.

---

🔢 Port Validation

Port validation now strictly accepts only valid TCP/UDP ports within the range:

1–65535

---

📡 DNS Push Handling

Improved push_dns resolver detection with more robust fallback logic for systems using non-standard resolv.conf configurations.

---

🔄 Uninstallation

Improved backward compatibility by dynamically detecting the configured VPN subnet instead of relying on static defaults.

---

🧹 Cleanup Reliability

Replaced direct cd ... || exit 1 patterns with the centralized die() handler to ensure cleanup traps always execute during early failures.

---

🛠️ Shell Script Reliability

• Removed unused COLOR_WHITE and COLOR_DIM variables (ShellCheck SC2034).
• Improved append_line_if_missing() by validating file existence and using grep -- for safe end-of-options handling.
• Marked intentionally unused helper functions to satisfy ShellCheck (SC2317).

---

⚡ Changed

🧹 Logging Architecture

Centralized the top-level menu logger to reduce duplicated output logic and simplify long-term maintenance.

---

🖥️ Terminal Cleanup

Improved terminal color restoration and cleanup routines to ensure the console is always restored to a clean state after normal completion or interruption.

---

📚 Documentation

• Updated DOCNOTE.
• Refreshed the inline CHANGELOG.
• Improved documentation formatting and release note consistency.

---

✅ Code Quality

The project now passes all configured static analysis and quality checks.

Tool	Status
ShellCheck	✅ 0 warnings
jscpd	✅ 0 duplicated blocks
cspell	✅ 0 misspellings

---

📊 Summary

Area	Improvements
✨ Features	Manual IPv6 fallback and new client management utilities
🔒 Security	Atomic downloads, .ovpn generation, CRL updates, and DNS hardening
🔥 Firewall	Improved firewalld direct rule removal
🌐 Networking	Better IPv6 validation and resolver detection
👥 Management	Safer client lifecycle operations
🐛 Bug Fixes	EasyRSA parsing, port validation, uninstall improvements
⚡ Maintainability	Centralized logging and cleanup handling
🧹 Code Quality	Zero ShellCheck warnings, zero duplicate code, zero spelling issues
📚 Documentation	Updated DOCNOTE and changelog formatting

---

👨‍💻 Maintainer

Harry Dertin Sutisna (ALSYUNDAWY)
Alsyundawy IT Solution

---

🔄 Full Changelog

Full Changelog: 2.0.2...2.0.3

OpenVPN Install 2.0.2

🚀 OpenVPN Install v2.0.2

Network Improvements, Compatibility Fixes & Code Quality

25 July 2026

This release introduces a new default VPN network, improves compatibility with existing installations, resolves several edge-case bugs, and further enhances script reliability and maintainability.

---

✨ Release Highlights

OpenVPN Install v2.0.2 focuses on simplifying long-term maintenance while improving network configuration, firewall compatibility, installer robustness, and overall code quality.

---

🔄 Changes

🌐 Updated Default VPN Network

The default IPv4 VPN subnet has been changed from:

10.8.0.0/24

to:

172.16.200.0/24

Benefits include:

• Reduced likelihood of conflicts with existing private networks
• Better suitability for enterprise and homelab environments
• Improved compatibility with common LAN addressing schemes

Existing installations remain compatible and are automatically detected during uninstallation.

---

📦 Distribution Support

To simplify long-term maintenance and testing, support for the following distributions has been removed:

• openSUSE
• Arch Linux

The project now focuses on maintaining the most widely deployed and thoroughly tested Linux distributions.

---

🛠️ Bug Fixes

✅ IPv4 Validation

Resolved an issue in is_valid_ipv4() where IPv4 octets containing leading zeros could trigger Bash octal arithmetic errors.

Example:

192.168.001.100

The validation routine now handles these values safely and consistently.

---

🔥 firewalld Compatibility

Improved pattern matching within:

firewalld_direct_rule_exists()

to correctly detect firewall rules that include priority prefixes.

This prevents duplicate rule creation and improves compatibility with newer firewalld versions.

---

🌐 DNS Resolver Detection

Added an additional fallback when parsing:

/etc/resolv.conf

This improves compatibility across systems using different resolver configurations.

---

📥 EasyRSA Download Parsing

Improved HTTP header parsing by automatically removing carriage return (\r) characters when processing EasyRSA download responses.

This prevents parsing failures on servers that return CRLF-formatted headers.

---

📄 Client Configuration Generation

Added a more resilient fallback helper:

generate_client_config()

to improve generation of bundled .ovpn client configuration files when the primary method is unavailable.

---

🔄 Backward Compatibility

The uninstaller now dynamically detects the configured VPN subnet instead of assuming the default value.

This ensures older installations continue to uninstall correctly even if they were created with previous subnet configurations.

---

⚡ Optimizations

🧹 Centralized Client Configuration Logic

Refactored client configuration generation into a centralized implementation.

Benefits include:

• Reduced code duplication
• Easier maintenance
• Improved consistency
• Better long-term extensibility

---

✅ ShellCheck Compliance

The entire project has been reviewed to ensure strict ShellCheck compliance, improving script reliability, readability, and maintainability.

---

📈 Summary of Improvements

Area	Improvements
🌐 Networking	Default VPN subnet updated to 172.16.200.0/24
🔥 Firewall	Improved firewalld rule detection
📥 Installer	More robust EasyRSA download parsing
📄 Client Profiles	Added resilient .ovpn generation fallback
🔄 Compatibility	Dynamic subnet detection during uninstall
🧹 Code Quality	Centralized configuration logic and improved ShellCheck compliance
📦 Maintenance	Removed openSUSE and Arch Linux support

---

👨‍💻 Maintainer

Harry Dertin Sutisna (ALSYUNDAWY)
Alsyundawy IT Solution

---

🔄 Full Changelog

2.0.1...2.0.2

OpenVPN Install 2.0.1

🚀 Release v2.0.1 — Stability, Security & Multi-Distribution Expansion

Release Date: 19 July 2026

This release focuses on broader Linux distribution compatibility, stronger security hardening, improved reliability, and better installation consistency across all supported platforms. It also introduces automatic Easy-RSA version detection to ensure deployments always use the latest upstream release. :contentReference[oaicite:0]{index=0}

---

✨ Highlights

• ✅ Added support for RHEL 8, AlmaLinux 8, Rocky Linux 8, and Oracle Linux 8
• 🔄 Automatic retrieval of the latest Easy-RSA release from upstream
• 🔒 Enhanced security throughout installation, certificate handling, and file management
• ⚡ Improved reliability for DNS, firewall, CRL, and Unbound operations
• 🛠️ Refined helper functions and logging for easier maintenance

---

➕ Added

Linux Distribution Support

• Added native support for:
  • RHEL 8
  • AlmaLinux 8
  • Rocky Linux 8
  • Oracle Linux 8

Easy-RSA

• Added dynamic Easy-RSA version detection and download, ensuring the installer always deploys the latest stable upstream release. :contentReference[oaicite:1]{index=1}

---

🛠️ Improvements

Reliability

• Improved IPv4/IPv6 address discovery using ip -o
• Centralized logging and helper routines
• Improved resolver parsing with full IPv6 resolver support
• More reliable detection of the Unbound service using systemctl is-active

Firewall

• Improved Firewalld direct rule insertion and removal for fully idempotent behavior

---

🐞 Bug Fixes

Package Management

• Fixed package removal commands for:
  • Arch Linux (Pacman)
  • openSUSE (Zypper)

Certificate Management

• Fixed atomic CRL replacement using mv, preventing temporary VPN interruptions during certificate revocation updates
• Removed existing .ovpn files before regeneration to eliminate insecure overwrite scenarios

DNS & Validation

• Hardened IPv4 and IPv6 validation for custom DNS input
• Prevented empty package arguments when firewall packages are not required

System Compatibility

• Improved /etc/os-release parsing while avoiding unnecessary shell state pollution

---

🔒 Security

• Enforced secure file creation with umask 077
• Added explicit permission handling using chmod
• Hardened command execution and dependency validation
• Improved uninstall resilience and failure recovery
• Reduced unsafe shell command handling throughout the installer

---

🚀 Release v2.0.0 — Official Repository Integration & Advanced DNS Support

Release Date: 19 July 2026

Version 2.0.0 is a major feature release introducing official OpenVPN repository integration, 35 public DNS providers, native dual-stack IPv6 DNS support, local Unbound resolver integration, extensive ShellCheck compliance, and comprehensive security hardening.

---

✨ Highlights

• 🚀 Official OpenVPN 2.6 repository integration
• 🌐 35 integrated public DNS providers
• 🌍 Native IPv4 + IPv6 DNS push support
• 🛡️ Local Unbound recursive resolver with DNSSEC hardening
• ✅ Full ShellCheck compliance improvements
• ⚡ Cleaner, modular, and more maintainable codebase

---

➕ Added

Official OpenVPN Repository

Added automatic installation from the official OpenVPN repository for:

• Debian
• Ubuntu
• RHEL
• Fedora

Public DNS Providers

Integrated 35 public DNS providers, including:

• Google Public DNS
• Cloudflare (Standard, Security, Family)
• Quad9 (Secure, Unsecured, ECS)
• OpenDNS (Home, FamilyShield)
• AdGuard (Default, Family, Non-Filtering)
• AliDNS
• DNSPod
• 114DNS
• Baidu DNS
• OneDNS
• DNSPai
• CleanBrowsing (Security, Adult, Family)
• Verisign
• DNS.WATCH
• Yandex (Basic, Safe, Family)
• Level3 / Lumen
• Neustar (Default, Threat Protection, Family)
• Oracle Dyn
• Alternate DNS
• Comodo Secure DNS
• Freenom World DNS

Networking

• Added IPv6 DNS push support across all supported DNS providers
• Added Local Unbound Resolver (Option 1) featuring:
  • DNSSEC validation
  • DNS rebinding protection
  • OpenVPN-optimized configuration

Installer

Added new installer components:

• installOpenVPNRepo()
• installUnbound()
• Automatic Unbound service validation with retry logic

---

🛠️ Improvements

Code Quality

• Replaced repetitive DNS case blocks with an array-driven push_dns() helper
• Improved restart validation for Unbound with automatic retry (up to 10 attempts)
• Updated project documentation, headers, feature descriptions, and inline comments

---

🐞 Bug Fixes

Resolved multiple ShellCheck findings, including:

• SC2164 — Protected all cd operations with proper error handling
• SC2155 — Separated declaration and assignment
• SC2086 — Properly quoted variable expansions
• SC2006 — Replaced legacy backticks with $()
• SC2166 — Replaced legacy test expressions with modern [[ ]]

Additional improvements:

• Custom DNS validation now fully supports IPv6 addresses

---

🔒 Security

Unbound Hardening

Enabled:

• hide-identity
• hide-version
• harden-glue
• harden-dnssec-stripped

Additional protections:

• DNS rebinding protection for RFC1918 private networks
• IPv6 ULA rebinding protection
• use-caps-for-id (0x20 encoding) to improve DNS spoofing resistance

---

📦 Summary

Version	Focus
v2.0.1	Platform expansion, reliability improvements, security hardening, Easy-RSA automation
v2.0.0	Official OpenVPN repositories, 35 DNS providers, Unbound integration, IPv6 support, ShellCheck compliance, modular architecture

Full Changelog: 2.0.0...2.0.1

OpenVPN Install 2.0.0

🚀 Release v2.0.0 — Official Repository Integration & Advanced DNS Support

Release Date: 19 July 2026

Version 2.0.0 is a major feature release introducing official OpenVPN repository integration, 35 public DNS providers, native dual-stack IPv6 DNS support, local Unbound resolver integration, extensive ShellCheck compliance, and comprehensive security hardening.

---

✨ Highlights

• 🚀 Official OpenVPN 2.6 repository integration
• 🌐 35 integrated public DNS providers
• 🌍 Native IPv4 + IPv6 DNS push support
• 🛡️ Local Unbound recursive resolver with DNSSEC hardening
• ✅ Full ShellCheck compliance improvements
• ⚡ Cleaner, modular, and more maintainable codebase

---

➕ Added

Official OpenVPN Repository

Added automatic installation from the official OpenVPN repository for:

• Debian
• Ubuntu
• RHEL
• Fedora

Public DNS Providers

Integrated 35 public DNS providers, including:

• Google Public DNS
• Cloudflare (Standard, Security, Family)
• Quad9 (Secure, Unsecured, ECS)
• OpenDNS (Home, FamilyShield)
• AdGuard (Default, Family, Non-Filtering)
• AliDNS
• DNSPod
• 114DNS
• Baidu DNS
• OneDNS
• DNSPai
• CleanBrowsing (Security, Adult, Family)
• Verisign
• DNS.WATCH
• Yandex (Basic, Safe, Family)
• Level3 / Lumen
• Neustar (Default, Threat Protection, Family)
• Oracle Dyn
• Alternate DNS
• Comodo Secure DNS
• Freenom World DNS

Networking

• Added IPv6 DNS push support across all supported DNS providers
• Added Local Unbound Resolver (Option 1) featuring:
  • DNSSEC validation
  • DNS rebinding protection
  • OpenVPN-optimized configuration

Installer

Added new installer components:

• installOpenVPNRepo()
• installUnbound()
• Automatic Unbound service validation with retry logic

---

🛠️ Improvements

Code Quality

• Replaced repetitive DNS case blocks with an array-driven push_dns() helper
• Improved restart validation for Unbound with automatic retry (up to 10 attempts)
• Updated project documentation, headers, feature descriptions, and inline comments

---

🐞 Bug Fixes

Resolved multiple ShellCheck findings, including:

• SC2164 — Protected all cd operations with proper error handling
• SC2155 — Separated declaration and assignment
• SC2086 — Properly quoted variable expansions
• SC2006 — Replaced legacy backticks with $()
• SC2166 — Replaced legacy test expressions with modern [[ ]]

Additional improvements:

• Custom DNS validation now fully supports IPv6 addresses

---

🔒 Security

Unbound Hardening

Enabled:

• hide-identity
• hide-version
• harden-glue
• harden-dnssec-stripped

Additional protections:

• DNS rebinding protection for RFC1918 private networks
• IPv6 ULA rebinding protection
• use-caps-for-id (0x20 encoding) to improve DNS spoofing resistance

---

📦 Summary

Version	Focus
v2.0.0	Official OpenVPN repositories, 35 DNS providers, Unbound integration, IPv6 support, ShellCheck compliance, modular architecture

Full Changelog: https://github.com/alsyundawy/OpenVPN-Install/commits/2.0.0