Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Merge test into master #950

Merged
merged 12 commits into from Feb 17, 2020
Merged

Merge test into master #950

merged 12 commits into from Feb 17, 2020

Conversation

orazioedoardo
Copy link
Member

Main changes from the test branch:

  1. When offering to use Pi-hole, identify VPN clients via clientname.pivpn using a dedicated hosts file. Clients can now be resolved by their names and also show up in the Pi-hole dashboard.
  2. Decide whether to tell dnsmasq to listen on the VPN interface depending on the user settings. The default Pi-hole listening behavior is "Listen only on interface whatever", which means we need to add the specific VPN interface. However, if the user has "Listen on all interfaces" or " "Listen on all interfaces, permit all origin", then we don't need to add the interface (self-explanatory).
  3. Set static IPs by default when using OpenVPN, (required by 2.).
  4. Restrict access to automatic backups (.tar.gz) of /etc/wireguard and /etc/openvpn to root.

@orazioedoardo
Implemented feature request from issue #942 (WireGuard)
3f616d9
@orazioedoardo
Set static IPs when using OpenVPN
ead280e 
  - Preparation for feature request from issue #942
@orazioedoardo
Implemented feature request from issue #942 (OpenVPN)
2c6ba65
@orazioedoardo
apt-transport-https is required since we will use HTTPS repos in the …
6fd451d 
…script
@orazioedoardo
Get $STATIC_IP before ccd folder is deleted (otherwhise $STATIC_IP wi…
0cb5546 
…ll be empty)
@orazioedoardo
Automatic backup of existing OpenVPN/WireGuard folder should only be …
3730d31 
…readable by root
@orazioedoardo
Improvements when importing GPG keys
337fa10 
  - Importing OpenVPN PGP key from keyserver should be more secure than
    downloading from the website as we specifically tell the keyserver
    which key we want, referring to its fingerprint
  - Exit if import is unsuccessful
@orazioedoardo
Minor fixes
41ed9c4 
  - LC_ALL=C should be the canonical way to override the locale, instead
    of setting a specific one.
  - apt-transport-https is required on Ubuntu < Bionic and Debian < Buster
@orazioedoardo
Fix Pi-hole support when dnsmasq is set to listen on all interfaces
87cf243
@orazioedoardo
Drop libmnl-dev requirement on armv6l
660d834 
- https://lists.zx2c4.com/pipermail/wireguard/2020-February/004963.html
@orazioedoardo
Fixed missing condition in if statement when deciding whether to list…
edbd23a 
…en on tun0/wg0
coolapso
coolapso requested changes Feb 15, 2020
View reviewed changes
Copy link
Member

@coolapso coolapso left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Check comments in the lines ...

we should not use hardocoded ips ... specially because one might want to use another ip range for the vpns own network.

there are multiple reasons for a user to change that .. one could be to avoid routing conflicts.

scripts/openvpn/makeOVPN.sh Outdated Show resolved Hide resolved
scripts/openvpn/makeOVPN.sh Outdated Show resolved Hide resolved
scripts/openvpn/makeOVPN.sh Outdated Show resolved Hide resolved
scripts/openvpn/removeOVPN.sh Outdated Show resolved Hide resolved
scripts/wireguard/makeCONF.sh Outdated Show resolved Hide resolved
scripts/wireguard/removeCONF.sh Outdated Show resolved Hide resolved
@orazioedoardo
Copy link
Member Author

Done, now VPN ranges are defined solely by the variables pivpnNET and subnetClass.

coolapso
coolapso approved these changes Feb 17, 2020
View reviewed changes
Copy link
Member

@coolapso coolapso left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Generally looks good.. i assume you have been testing this aigh? xD i din't had much time lately for testing

@orazioedoardo
Copy link
Member Author

Generally looks good.. i assume you have been testing this aigh? xD i din't had much time lately for testing

Just wanted to know it you liked the commit that removed hard coded VPN ranges. I did test these on Ubuntu 18.04, Debian 10 and Raspbian 10.

@orazioedoardo orazioedoardo merged commit 1f7b4b7 into master Feb 17, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@coolapso coolapso coolapso approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
2 participants
@orazioedoardo @coolapso