Extra 19.0 updates

Makefile

@@ -1,6 +1,5 @@
 WEBMIN_FW_TCP_INCOMING = 22 80 443 12321
 WEBMIN_FW_UDP_INCOMING = 1194
-WEBMIN_FW_NAT_EXTRA = -A POSTROUTING -o eth0 -j MASQUERADE
 
 COMMON_OVERLAYS = tkl-webcp timezone
 COMMON_CONF = tkl-webcp

changelog

@@ -2,7 +2,19 @@ turnkey-openvpn-19.0 (1) turnkey; urgency=low
 
   * Install OpenVPN from Debian repos - v2.6.14.
 
-  * Fix missing Cipher/Auth in server.conf - closes #2064.
+  * Fix (and updated deprecated) missing Cipher/Auth in server.conf - closes
+    #2064.
+
+  * Update/modernize other default OpenVPN config, including increased key
+    size. A future release will likely move to eliptic curve algorithm; e.g.
+    ecp384r1.
+
+  * Move masquerade firewall config to systemd service rather than Webmin.
+    Allows separation of default/shared TurnKey firewall rules (disabled by
+    default as per all other apps) and OpenVPN specific conf.
+
+  * Include IPv6 notes/docs in build code repo (openvpn/docs/ipv6.md). A
+    future TurnKey release will ship with them pre-enabled/pre-applied.
 
   * Upgraded base distribution to Debian 13.x/Trixie.
 

conf.d/main

@@ -3,9 +3,8 @@
 EASY_RSA=/etc/openvpn/easy-rsa
 HTDOCS=/var/www/openvpn/htdocs
 OPENSSL_CONF=$EASY_RSA/openssl-easyrsa.cnf
-SRC=/usr/local/src
 
-# enable ip forwarding
+# enable ipv4 forwarding
 echo 'net.ipv4.ip_forward=1' >> /etc/sysctl.d/40-openvpn.conf
 
 mkdir -p $EASY_RSA
@@ -36,5 +35,5 @@ systemctl enable openvpn@server
 # enable openvpn-tun service (creates /dev/net/tun device in containers - closes #1011)
 systemctl enable openvpn-tun.service
 
-echo 'cipher AES-256-GCM' >> /etc/openvpn/server.conf
-echo 'auth SHA512' >> /etc/openvpn/server.conf
+# enable masquerade firewall rule service for OpenVPN LAN reachback
+systemctl enable openvpn-masquerade.service

docs/ipv6.md

@@ -0,0 +1,96 @@
+OpenVPN IPv6 Configuration - OpenVPN v2.6+
+==========================================
+
+Inclusion of some updated IPv6 default config are intended for a future TurnKey
+release. In the meantime here are some (untested) notes. Please confirm their
+validity before rolling out for production. Also please provide feedback if you
+try them out.
+
+OpenVPN config
+==============
+
+Config file: `/etc/openvpn/server.conf`
+
+Protocol
+--------
+
+To set IPv6 as the preferred (UDP) listening address for clients to connect to,
+append '6' to the existing `proto udp` config line. I.e. so it looks like this:
+
+```
+proto udp6
+```
+
+The above will fall back to IPv4 when IPv6 is not available. The current
+default (`proto udp`) will do the opposite. I.e. default to IPv4 & fallback to
+IPv6 if IPv4 is not available.
+
+IPv6 Tunnel Interface
+---------------------
+
+To assign clients IPv6 addresses **within** the tunnel, _add_ these lines:
+
+```
+tun-ipv6
+push "tun-ipv6"
+```
+
+Push IPv6 Routes to Clients
+---------------------------
+
+Examples:
+
+Redirect all client IPv6 traffic through the VPN:
+
+```
+push "redirect-gateway ipv6"
+```
+
+Route public IPv6 traffic through the tunnel:
+```
+push "route-ipv6 2000::/3"
+```
+
+Route the VPN's own IPv6 subnet:
+```
+push "route-ipv6 fd42:42:42::/112"
+```
+
+Redirect _all_ IPv6 traffic through the VPN:
+```
+push "redirect-gateway ipv6"
+```
+
+DNS
+---
+
+Push an IPv6-capable DNS server to clients. E.g. Cloudflare DNS:
+
+```
+push "dhcp-option DNS 2606:4700:4700::1111"
+```
+
+Host server system config
+=========================
+
+IPv6 Forwarding
+---------------
+
+Enable IPv6 network forwarding:
+
+```
+echo 'net.ipv6.ip_forward=1' >> /etc/sysctl.d/40-openvpn.conf
+```
+
+And reboot. To check that it has been applied:
+
+```
+sysctl net.ipv6.conf.all.forwarding
+```
+
+Firewall - ip6tables
+--------------------
+
+The default TurnKey firewall rules should already be appropriate for IPv6.
+Currently TurnKey still uses iptables config (legacy wrapper around nftables)
+via Webmin. You can inspect the rules via Webmin, or `/etc/iptables/rules.v6`.

overlay/etc/systemd/system/openvpn-masquerade.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=OpenVPN LAN masquerade firewall conf for VPN reachback
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
+ExecStop=/sbin/iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

overlay/usr/lib/inithooks/bin/openvpn-server-init.sh

@@ -50,7 +50,7 @@ KEY_NAME="${KEY_NAME:-openvpn}"
 KEY_COUNTRY="${KEY_COUNTRY:-US}"
 KEY_PROVINCE="${KEY_PROVINCE:-CA}"
 KEY_CITY="${KEY_CITY:-San Francisco}"
-KEY_SIZE="${KEY_SIZE:-2048}"
+KEY_SIZE="${KEY_SIZE:-3072}"
 KEY_EXPIRE="${KEY_EXPIRE:-3650}"
 CA_EXPIRE="${CA_EXPIRE:-3650}"
 
@@ -64,7 +64,7 @@ export EASYRSA_PKI="$EASYRSA/keys"
 export EASYRSA_CERT_EXPIRE="$KEY_EXPIRE"
 export EASYRSA_KEY_SIZE=$KEY_SIZE
 export EASYRSA_DN=cn_only
-export EASYRSA_REQ_COUNTRY="$KEY_COUNTRY"
+export EASYRSA_CA_EXPIRE="$CA_EXPIRE"
 export EASYRSA_REQ_ORG="$KEY_ORG"
 export EASYRSA_REQ_OU="$KEY_OU"
 export EASYRSA_REQ_NAME="$KEY_NAME"
@@ -102,8 +102,7 @@ mkdir -p "$SERVER_CCD"
 
 # generate ca and server keys/certs
 export EASYRSA_BATCH=1
-$EASYRSA/easyrsa init-pki soft-reset
-$EASYRSA/easyrsa gen-dh
+$EASYRSA/easyrsa init-pki
 $EASYRSA/easyrsa --req-cn='server' build-ca nopass
 $EASYRSA/easyrsa gen-req server nopass
 $EASYRSA/easyrsa sign-req server server
@@ -142,7 +141,7 @@ chroot $EASYRSA_PKI/crl.jail
 crl-verify /etc/openvpn/crl.pem
 
 ca $EASYRSA_PKI/ca.crt
-dh $EASYRSA_PKI/dh.pem
+dh none
 tls-auth $EASYRSA_PKI/ta.key 0
 key $EASYRSA_PKI/private/server.key
 cert $EASYRSA_PKI/issued/server.crt
@@ -157,6 +156,25 @@ verb 4
 # important: must not be used on your network
 server $(expand_cidr "$virtual_subnet")
 
-cipher AES-256-GCM
+data-ciphers AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
 auth SHA512
+
+# tell clients when the server restarts or exits - clients reconnect quicker
+# (don't need to wait for keepalive timeout)
+explicit-exit-notify 1
+
+# recommended modern topology puts all clients on a shared subnet - like a
+# normal LAN. OpenVPN v2.7+ default - clients must be v2.0.9+.
+topology subnet
+# legacy topology hands every client its own /30 (4 addresses each). To revert
+# to default v2.6 and earlier behavior comment above line and uncomment below.
+#topology net30
+
+# uncomment and set DNS server IP - e.g. below uses Cloudflare (1.1.1.1).
+# Note by default OpenVPN pushes the server's configured nameserver.
+#push "dhcp-option DNS 1.1.1.1"
+
+# uncomment if all clients support TLSv1.3
+#tls-version-min 1.3
+
 EOF