Skip to content

Interactive Menu

Installation Questions — installQuestions()

When running ./openvpn-install.sh interactive on a fresh system, the script walks through a step-by-step questionnaire.

Question Flow

graph TD
    A[Detect server IPs] --> B[Select endpoint type: IPv4 or IPv6]
    B --> C[Confirm/enter endpoint address]
    C --> D[Select client IP stack: v4 / v6 / dual]
    D --> E[Configure IPv4 subnet]
    E --> F[Configure IPv6 subnet if enabled]
    F --> AP[Access policy: internet routing, client-to-client, local networks]
    AP --> G[Select port: 1194 / custom / random]
    G --> H[Select protocol: UDP / TCP]
    H --> I{Internet routing enabled?}
    I -->|Yes| I2[Select DNS provider]
    I -->|No| I3[Skip DNS]
    I2 --> J[Multi-client support?]
    I3 --> J
    J --> K[Configure MTU]
    K --> L[Select auth mode: PKI / Fingerprint]
    L --> M{Customize encryption?}
    M -->|Yes| N[Cipher, cert type, TLS version, HMAC, control channel]
    M -->|No| O[Use defaults]
    N --> P[Press any key to continue]
    O --> P

Access Policy Step

Before choosing a port, the installer asks what VPN clients should be allowed to access — see Network & DNS — Access Policy:

  1. Route client internet traffic through the VPN? (default: yes)
  2. Allow VPN clients to access each other? (default: no)
  3. Allow VPN clients to access the server's local network? (default: no) — if yes, the installer suggests directly connected private networks (see Network Detection — Local Network Detection) as an editable, comma-separated list of CIDRs, which is re-validated until every entry is a valid network.

If internet routing is disabled, the DNS provider question is skipped entirely — no DNS is pushed in split-tunnel mode.

NAT Detection

During endpoint configuration, the script compares the local IP (from ip addr) with the public IP (from external services). If they differ, the server is behind NAT and the user is prompted to enter the public IP or a hostname.

Encryption Customization

If the user chooses to customize encryption, the script presents menus for:

Setting Options
Data cipher AES-128-GCM, AES-256-GCM, CHACHA20-POLY1305, etc.
Certificate type ECDSA or RSA
ECDSA curve prime256v1, secp384r1, secp521r1
RSA key size 2048, 3072, 4096
TLS version 1.2, 1.3
TLS 1.3 suites All, AES-256 only, AES-128 only, ChaCha20 only
Key exchange All, X25519 only, NIST only
HMAC SHA256, SHA384, SHA512
Control channel tls-crypt-v2, tls-crypt, tls-auth

Management Menu — manageMenu()

When running ./openvpn-install.sh interactive on a system where OpenVPN is already installed:

OpenVPN is already installed.

What do you want to do?
  1) Add a new user
  2) List client certificates
  3) Revoke existing user
  4) Renew certificate
  5) Remove OpenVPN
  6) List connected clients
  7) Exit

Each option calls the corresponding function:

Option Function
1 newClient()
2 listClients()
3 revokeClient()
4 renewMenu()
5 removeOpenVPN()
6 listConnectedClients()

Renewal Submenu — renewMenu()

Certificate Renewal

  1) Renew a client certificate
  2) Renew the server certificate (expires in 3648 days)
  3) Back to main menu

select_from_array()

Displays an array as a numbered menu and returns the selected value:

Select an option:
  1) Option A
  2) Option B
  3) Option C
Selection [1]: _

select_with_labels()

Displays custom labels while returning underlying values:

Select protocol:
  1) UDP (faster, recommended)
  2) TCP (use when UDP is blocked)
Selection [1]: _

prompt_yes_no()

Y/N prompt with a configurable default:

Enable IPv6 support? [y/N]: _

prompt_validated()

Repeating prompt that calls a validator function until valid input is provided.

Automation

The MENU_OPTION environment variable can pre-select a menu option:

MENU_OPTION=1 ./openvpn-install.sh interactive

Similarly, all interactive prompts can be bypassed by setting the corresponding environment variables before running the script.