Skip to content

OpenVPN Install 2.0.3

Latest
Latest

Choose a tag to compare

View all tags
@alsyundawy alsyundawy released this 03 Aug 13:30
2.0.3
9721847

🚀 OpenVPN Install v2.0.3

Security Hardening, Client Management & Reliability Improvements

Release Date: 2026-08-03

This release strengthens installation security, improves dual-stack IPv4/IPv6 deployment, introduces new client management utilities, and enhances reliability, maintainability, and code quality across the entire project.

✨ Added

🌐 Manual IPv6 Fallback

When automatic IPv6 discovery (ip -o -6 addr show scope global) does not detect a usable global IPv6 address—such as when only link-local addresses are available or IPv6 has not yet been assigned—the installer now offers a manual IPv6 configuration prompt.

This allows dual-stack deployments to proceed instead of silently falling back to IPv4-only mode.

👥 Client Management Utilities

Added several new management commands to simplify OpenVPN administration.

📋 list_clients

Displays all active client certificates from the EasyRSA PKI index.

🔌 list_connected

Shows currently connected VPN clients using the OpenVPN status log or ss.

🔄 renew_client

Regenerates an existing .ovpn bundle without modifying the associated certificate or private key.

🎨 Enhanced Terminal Interface

Introduced a refreshed command-line interface featuring bright ANSI colors and centralized logging helpers:

  • log_header
  • log_subheader
  • log_prompt
  • log_info
  • log_ok
  • log_warn
  • log_error

This provides clearer output and a more consistent user experience.

🛑 Signal Handling

Added consolidated signal handlers for:

  • EXIT
  • SIGINT
  • SIGTERM

The installer now automatically restores terminal colors and removes tracked temporary files on every exit path.

🔒 Security

🔐 Secure EasyRSA Downloads

Improved EasyRSA download security by:

  • downloading into a secure mktemp file
  • validating the archive using tar -tzf before extraction
  • preventing installation from corrupted or partially downloaded archives

The curl fallback now uses:

-fsSL

to enforce redirect handling, SSL verification, silent operation, and proper error reporting.

🔐 Atomic Client Configuration Generation

Client .ovpn bundles are now generated using atomic writes:

  • secure temporary file (mktemp)
  • explicit chmod 600
  • atomic move into place

This prevents partially written configuration files and insecure intermediate states.

📜 Atomic CRL Updates

Certificate Revocation Lists (crl.pem) are now replaced atomically using a staged copy-and-move process.

This guarantees the CRL is never left in an inconsistent state during rotation, helping prevent VPN service interruptions.

🌐 Secure DNS Resolver Detection

Local loopback resolvers are now ignored during automatic DNS detection, including:

  • 127.0.0.1
  • ::1

This prevents invalid resolver addresses from being pushed to VPN clients.

🐛 Fixed

👥 Management Menu

Improved reliability and safety of client management operations.

  • Prevent duplicate client certificate names during creation with a clear error message.
  • Require explicit [y/N] confirmation before revoking client certificates.
  • Automatically execute systemctl daemon-reload after removing systemd unit files during uninstallation.
  • Prevent uninstall failures when SELinux port labels do not exist by safely handling semanage port -d.

🔥 Firewall Compatibility

Corrected the regular expression used when removing firewalld direct SNAT rules.

The matcher now correctly recognizes destination-negated rules containing:

! -d

ensuring reliable firewall cleanup during uninstallation.

🗑️ Client Cleanup

Client .ovpn bundles are now automatically removed when the corresponding certificate is revoked.

🌐 IPv6 Validation

Improved IPv6 validation to correctly reject malformed addresses containing invalid leading or trailing colon boundaries.

📥 EasyRSA Version Detection

Improved EasyRSA redirect parsing by stripping carriage return (\r) characters from HTTP response headers, ensuring reliable version tag detection.

🔢 Port Validation

Port validation now strictly accepts only valid TCP/UDP ports within the range:

1–65535

📡 DNS Push Handling

Improved push_dns resolver detection with more robust fallback logic for systems using non-standard resolv.conf configurations.

🔄 Uninstallation

Improved backward compatibility by dynamically detecting the configured VPN subnet instead of relying on static defaults.

🧹 Cleanup Reliability

Replaced direct cd ... || exit 1 patterns with the centralized die() handler to ensure cleanup traps always execute during early failures.

🛠️ Shell Script Reliability

  • Removed unused COLOR_WHITE and COLOR_DIM variables (ShellCheck SC2034).
  • Improved append_line_if_missing() by validating file existence and using grep -- for safe end-of-options handling.
  • Marked intentionally unused helper functions to satisfy ShellCheck (SC2317).

⚡ Changed

🧹 Logging Architecture

Centralized the top-level menu logger to reduce duplicated output logic and simplify long-term maintenance.

🖥️ Terminal Cleanup

Improved terminal color restoration and cleanup routines to ensure the console is always restored to a clean state after normal completion or interruption.

📚 Documentation

  • Updated DOCNOTE.
  • Refreshed the inline CHANGELOG.
  • Improved documentation formatting and release note consistency.

✅ Code Quality

The project now passes all configured static analysis and quality checks.

Tool Status
ShellCheck ✅ 0 warnings
jscpd ✅ 0 duplicated blocks
cspell ✅ 0 misspellings

📊 Summary

Area Improvements
✨ Features Manual IPv6 fallback and new client management utilities
🔒 Security Atomic downloads, .ovpn generation, CRL updates, and DNS hardening
🔥 Firewall Improved firewalld direct rule removal
🌐 Networking Better IPv6 validation and resolver detection
👥 Management Safer client lifecycle operations
🐛 Bug Fixes EasyRSA parsing, port validation, uninstall improvements
⚡ Maintainability Centralized logging and cleanup handling
🧹 Code Quality Zero ShellCheck warnings, zero duplicate code, zero spelling issues
📚 Documentation Updated DOCNOTE and changelog formatting

👨‍💻 Maintainer

Harry Dertin Sutisna (ALSYUNDAWY)
Alsyundawy IT Solution

🔄 Full Changelog

Full Changelog: 2.0.2...2.0.3

Assets 7
Loading