helper.sh
Auto
English
English 日本語 简体中文 繁體中文

Network server installer

install_openvpn_server_centos.sh

Targets LAN 192.168.30.0/24 via gateway 192.168.30.1 and expects source IP 192.168.30.110, but only warns if that IP differs. It overwrites server configuration and authentication helpers; do not treat it as a portable VPN installer.

One-liner

curl -fL 'https://www.helper.sh/install_openvpn_server_centos.sh' -o './install_openvpn_server_centos.sh'

This command downloads the bundled file only; it does not run it. Inspect the saved source and compare its version before deciding whether to execute it.

Check the file you downloaded

Compare a saved file with the exact bytes bundled in this page’s build. The file stays in this tab; this tool does not upload or persist it. Maximum 2 MiB.

Expected SHA-256
c5f37a87d68ccbcf392d02635c53ef6caab68f3777bf96feae652e517743fa6b

Bundled byte count: 11039

Save checksum file

Save the script and checksum in the same directory. On Linux with GNU Coreutils, the command below checks the saved bytes only; it does not run the script. Keep the original filename for this command.

sha256sum --check './install_openvpn_server_centos.sh.sha256'

No comparison yet.

The checksum and script come from the same site, not an independent signature. A match does not prove safety, authenticity of upstream dependencies, or suitability for your host. Mutable remote dependencies need separate review.

Read validation and limitations

Requirements

  • CentOS 7, root, yum/EPEL, systemd, TUN support and a reviewed LAN topology.
  • Positional inputs: VPN network (default 10.6.6.0, fixed /24), optional DNS IP, optional domain. No dry-run.

Best for

  • Understand or maintain the matching inherited LAN deployment before migration.

Highlights

  • Writes /etc/openvpn/server/server.conf and /etc/openvpn/server.conf, check_user.sh, userpass.txt, CCD and /usr/local/bin/ovpn-user and ovpn-check. PKI is reused only when all four expected assets exist.
  • Enables firewalld, UDP 1194, masquerade/direct forwarding and SNAT; enables IPv4 forwarding in /etc/sysctl.conf; restarts openvpn@server. Local management listens at 127.0.0.1:7505.

Recommended procedure

  1. Read-only before changes: ip -4 route get 192.168.30.1; systemctl cat openvpn@server; sysctl net.ipv4.ip_forward; firewall-cmd --list-all.
  2. After an independently authorized change, inspect systemctl status openvpn@server --no-pager, ss -lunp and journalctl -u openvpn@server -n 100 --no-pager. Protect logs and credentials.
  3. ovpn-check prints service/listener/routes/client evidence; it does not prove every client can reach the LAN. Inspect failed checks before rerunning. Client profiles and authorized end-to-end tests are separate work.

Safety notes

  • CentOS 7 is end-of-life. No VPN or firewall changes were executed for this review.
  • verify-client-cert none selects password-based client authentication; userpass.txt stores secrets. Generated server/CA keys use nopass. Review trust and file access explicitly.
  • No automatic backup or rollback of overwritten configuration. Preserve existing PKI/config, users and firewall policy independently before any run.