#!/bin/bash
cat <<EOF
#########################################################################
#       Setup OpenVPN + Xor patch to bypass Advanced Firewall           # 
#       Bypass China, Iran and Pakistan Internet Censorship             #
#       Credits: halczy             Coded by : Khav                      #
#########################################################################             
EOF
#http://lowendtalk.com/discussion/21539/tutorial-build-your-ultimate-scrambled-vpn
#Download forget to download scrabled version of openvpn to be able to connect
#http://scramblevpn.wordpress.com/2013/09/28/build-patched-windows-openvpn-client/
#Checking swap
if [[ -n $(/sbin/swapon -s | grep -q /dev) ]]; then
    :
else
#Create and activate a 512MB swap file
    {
    dd if=/dev/zero of=/swapfile1 bs=1024 count=524288
	mkswap /swapfile1
	chown root:root /swapfile1
	chmod 0600 /swapfile1
	swapon /swapfile1
	echo "/swapfile1 swap swap defaults 0 0" >> /etc/sysctl.conf
	swapoff -a
	swapon -a
	} &> /dev/null
fi
#
rpm --import http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-6
rpm --import http://mirror.centos.org/centos/RPM-GPG-KEY-CentOS-5
yum -y -q install redhat-lsb-core
#Setting Up Repositories
os=$(lsb_release -si) #CentOS
echo  "Setting Up EPEL  Repository"
if [ $os == "CentOS" ]; then
{
rpm --quiet --import https://fedoraproject.org/static/0608B895.txt
#Fetch and install latest epel repo
cat <<EOM >/etc/yum.repos.d/epel-bootstrap.repo
[epel]
name=Bootstrap EPEL
mirrorlist=http://mirrors.fedoraproject.org/mirrorlist?repo=epel-\$releasever&arch=\$basearch
failovermethod=priority
enabled=0
gpgcheck=1
EOM

yum --enablerepo=epel -y -q install epel-release
rm -f /etc/yum.repos.d/epel-bootstrap.repo 
#
sed  '/\[epel\]/,/enabled=0/ { s/enabled=0/enabled=1/ }' /etc/yum.repos.d/epel.repo
} &> /dev/null
fi
#Time to install and configure Yum Priorities
{
yum clean all
yum history new
yum -q -y install yum-priorities
sed  -e '/\[base\]/,/gpgcheck=1/{/gpgcheck=1/{a\priority=10' -e ':a;n;ba}}' /etc/yum.repos.d/CentOS-Base.repo
sed  -e '/\[updates\]/,/gpgcheck=1/{/gpgcheck=1/{a\priority=10' -e ':a;n;ba}}' /etc/yum.repos.d/CentOS-Base.repo
sed  -e '/\[updates\]/,/gpgcheck=1/{/gpgcheck=1/{a\priority=10' -e ':a;n;ba}}' /etc/yum.repos.d/CentOS-Base.repo
sed  -e '/\[extras\]/,/gpgcheck=1/{/gpgcheck=1/{a\priority=10' -e ':a;n;ba}}' /etc/yum.repos.d/CentOS-Base.repo
sed  -e '/\[centosplus\]/,/gpgcheck=1/{/gpgcheck=1/{a\priority=20' -e ':a;n;ba}}' /etc/yum.repos.d/CentOS-Base.repo
sed  -e '/\[epel\]/,/gpgcheck=1/{/gpgcheck=1/{a\priority=65' -e ':a;n;ba}}' /etc/yum.repos.d/epel.repo
#Updating system
echo "Updating System"; 
yum -y -q install yum-utils
package-cleanup --cleandupes > /dev/null
yum -y -q upgrade 
yum -y -q update
} &> /dev/null
echo "Server Softwares and Kernel Updated...." 
#Installing some commonly used tools
echo "Installing useful tools{nano , wget, make}"
{
yum -y -q install nano
yum -y -q install wget
yum -y -q install make 
yum -y -q install dmidecode
} 2>&1 | grep -v "already installed and latest version"
#Starting VPN setup 
echo "Starting OpenVPN Setup"
{
yum  -y -q install autoconf.noarch automake file gcc libtool patch quilt git make rpm-build zlib-devel pam-devel openssl-devel lzo-devel
wget http://swupdate.openvpn.org/community/releases/openvpn-2.3.2.zip
unzip openvpn-2.3.2.zip
wget https://github.com/clayface/openvpn_xorpatch/archive/master.zip
unzip master.zip
} &> /dev/null
echo "Applying Xor Patch"
cp openvpn_xorpatch-master/openvpn_xor.patch openvpn-2.3.2/
cd openvpn-2.3.2
git apply --check openvpn_xor.patch
git apply openvpn_xor.patch
cd ..
mv ./openvpn-2.3.2/ /etc/openvpn
cd /etc/openvpn/
echo "Compiling latest OpenVPN"
{
autoreconf -i -v -f
./configure --prefix=/usr
make
make install
} &> /dev/null
#Making openvpn start on boot
{
wget https://dl.dropboxusercontent.com/u/83358635/Filehost/VPN/openvpn -O /etc/rc.d/init.d/openvpn
chmod +x /etc/rc.d/init.d/openvpn
chkconfig --add openvpn
chkconfig openvpn on
} &> /dev/null
#Downloading Easy RSA package to create keys and certificates
echo "Setting Up Keys and Certificates"
{
wget  http://build.openvpn.net/downloads/releases/easy-rsa-2.2.0_master.tar.gz
tar zxvf easy-rsa-2.2.0_master.tar.gz
cp -R easy-rsa-2.2.0_master/easy-rsa/ /etc/openvpn/
chown -R root /etc/openvpn/easy-rsa/
cd /etc/openvpn/easy-rsa/2.0/
source vars
} &> /dev/null
./clean-all
./build-ca
./build-key-server server
./build-dh
./build-key client
{
cd /etc/openvpn/easy-rsa/2.0/keys
cp ca.crt ca.key dh1024.pem server.crt server.key /etc/openvpn
mkdir /root/client-files
cp ca.crt client.crt client.key /root/client-files
openvpn --genkey --secret /etc/openvpn/ta.key
cp /etc/openvpn/ta.key /root/client-files
ipaddr=$(/sbin/ifconfig|grep inet|head -1|sed 's/\:/ /'|awk '{print $3}')
keyword=$(cat /dev/urandom | tr -dc 'a-zA-Z0-9' | fold -w 20 | head -n 1)
cat > /root/client-files/scrambled-client.ovpn <<EOL
client
dev tun
scramble obfuscate ${keyword}
proto udp
remote ${ipaddr} 443
resolv-retry infinite
nobind
persist-key
persist-tun
ca ca.crt
cert client.crt
key client.key
tls-auth ta.key 1
ns-cert-type server
cipher AES-256-CBC
comp-lzo
verb 3
fast-io
script-security 2
EOL

wget https://dl.dropboxusercontent.com/u/83358635/Filehost/VPN/merge.sh -O /root/client-files/merge.sh
cd /root/client-files/
chmod +x /root/client-files/merge.sh
sh /root/client-files/merge.sh
chown root /root/client-files/scrambled-client.ovpn
cat > /etc/openvpn/server.conf <<EOL
port 443
proto udp
dev tun
scramble obfuscate ${keyword}
ca /etc/openvpn/ca.crt
cert /etc/openvpn/server.crt
key /etc/openvpn/server.key
tls-auth /etc/openvpn/ta.key 0
dh /etc/openvpn/dh1024.pem
server 10.8.0.0 255.255.255.0
cipher AES-256-CBC
comp-lzo
persist-key
persist-tun
user nobody        # If server fails to start, please change this to an existing user
group openvpn    # If server fails to start, please change this to an existing group
status openvpn-status.log
verb 3
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
EOL

#Adding openvpn group
/usr/sbin/groupadd openvpn
#
#Enable IP packet forwarding so that our VPN traffic can pass through.
sed -i 's/net.ipv4.ip_forward = 0/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf
sysctl -p
#
#Installing imvirt(needed to find virtualization on server)
yum -y -q install virt-what
virt=$(virt-what)
#
#Flushing IPtables and adding proper rules
iptables -F
if [[ $virt = *kvm* ]] || [[ $virt = *xen* ]] ; then
  iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE
elif [[ $virt = *openvz* ]]  ; then
  iptables -t nat -A POSTROUTING -o venet0 -j SNAT --to-source $ipaddr
fi
chkconfig --levels 235 iptables on
service iptables save
service openvpn restart
} &> /dev/null
cat > /root/details.txt <<EOF
#########################################
#Scrambled OpenVpn Server Setup Complete#             
#########################################
Download cilent config: /root/client-files/scrambled-client.ovpn
Save the scrambled-client.ovpn in the config folder of your OpenVPN installation 
Don't forget to patch your OpenVPN installation
http://scramblevpn.wordpress.com/2013/09/28/build-patched-windows-openvpn-client/
EOF
cat /root/details.txt