From 10da38da0cfea60b14d14e393e07e7484d5bb53c Mon Sep 17 00:00:00 2001
From: Bob Mottram <bob@freedombone.net>
Date: Tue, 26 Sep 2017 15:51:43 +0100
Subject: [PATCH] vpn on tcp

---
 src/freedombone-app-vpn        | 10 ++++++++--
 src/freedombone-utils-firewall |  6 ++----
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/src/freedombone-app-vpn b/src/freedombone-app-vpn
index 7f7af5ad..7e1ec4dc 100755
--- a/src/freedombone-app-vpn
+++ b/src/freedombone-app-vpn
@@ -122,7 +122,7 @@ function restore_remote_vpn {
 
 function remove_vpn {
     systemctl stop openvpn
-    apt-get -yq remove --purge fastd openvpn easy-rsa
+    apt-get -yq remove --purge fastd openvpn easy-rsa stunnel4
     if [ -d /etc/openvpn ]; then
         rm -rf /etc/openvpn
     fi
@@ -206,6 +206,9 @@ function create_user_vpn_key {
     sed -i 's|key client.key|;key client.key|g' $user_vpn_cert_file
     sed -i 's|tls-auth ta.key|;tls-auth ta.key|g' $user_vpn_cert_file
 
+    sed -i 's|;proto tcp|proto tcp|g' $user_vpn_cert_file
+    sed -i 's|proto udp|;proto udp|g' $user_vpn_cert_file
+
     echo '<ca>' >> $user_vpn_cert_file
     cat /etc/openvpn/ca.crt >> $user_vpn_cert_file
     echo '</ca>' >> $user_vpn_cert_file
@@ -239,7 +242,7 @@ function remove_user_vpn {
 }
 
 function install_vpn {
-    apt-get -yq install fastd openvpn easy-rsa
+    apt-get -yq install fastd openvpn easy-rsa stunnel4
 
     if [ ! -f /usr/share/doc/openvpn/examples/sample-config-files/server.conf.gz ]; then
         echo $'Example openvpn server config not found'
@@ -257,6 +260,9 @@ function install_vpn {
     sed -i 's|;group no.*|group vpn|g' /etc/openvpn/server.conf
     sed -i 's|;max-clients.*|max-clients 2|g' /etc/openvpn/server.conf
 
+    sed -i 's|;proto tcp|proto tcp|g' /etc/openvpn/server.conf
+    sed -i 's|proto udp|;proto udp|g' /etc/openvpn/server.conf
+
     echo 1 > /proc/sys/net/ipv4/ip_forward
     sed -i 's|# net.ipv4.ip_forward|net.ipv4.ip_forward|g' /etc/sysctl.conf
     sed -i 's|#net.ipv4.ip_forward|net.ipv4.ip_forward|g' /etc/sysctl.conf
diff --git a/src/freedombone-utils-firewall b/src/freedombone-utils-firewall
index fa839d69..785ea7fe 100755
--- a/src/freedombone-utils-firewall
+++ b/src/freedombone-utils-firewall
@@ -111,8 +111,7 @@ function enable_ipv6 {
 }
 
 function firewall_disable_vpn {
-    iptables -D INPUT -i ${FIREWALL_EIFACE} -m state --state NEW -p udp --dport 1194 -j ACCEPT
-    iptables -D INPUT -p tcp --dport 1194 -j ACCEPT
+    iptables -D INPUT -i ${FIREWALL_EIFACE} -m state --state NEW -p tcp --dport 1194 -j ACCEPT
     iptables -D INPUT -i tun+ -j ACCEPT
     iptables -D FORWARD -i tun+ -j ACCEPT
     iptables -D FORWARD -i tun+ -o ${FIREWALL_EIFACE} -m state --state RELATED,ESTABLISHED -j ACCEPT
@@ -125,8 +124,7 @@ function firewall_disable_vpn {
 }
 
 function firewall_enable_vpn {
-    iptables -A INPUT -i ${FIREWALL_EIFACE} -m state --state NEW -p udp --dport 1194 -j ACCEPT
-    iptables -A INPUT -p tcp --dport 1194 -j ACCEPT
+    iptables -A INPUT -i ${FIREWALL_EIFACE} -m state --state NEW -p tcp --dport 1194 -j ACCEPT
     iptables -A INPUT -i tun+ -j ACCEPT
     iptables -A FORWARD -i tun+ -j ACCEPT
     iptables -A FORWARD -i tun+ -o ${FIREWALL_EIFACE} -m state --state RELATED,ESTABLISHED -j ACCEPT