Skip to content

Network Detection

The script auto-detects the server's network configuration during installation.

Public IP Detection

resolvePublicIPv4()

Tries four methods to detect the server's public IPv4 address (5-second timeout each):

  1. https://api.seeip.org
  2. https://ifconfig.me
  3. https://api.ipify.org
  4. DNS query: dig +short myip.opendns.com @resolver1.opendns.com

resolvePublicIPv6()

Same approach for IPv6:

  1. https://api6.seeip.org
  2. https://ifconfig.me (over IPv6)
  3. https://api64.ipify.org
  4. DNS query to Google

Both functions retry up to 2 times on connection failure.

Server IP Detection — detect_server_ips()

Uses ip addr to find locally bound addresses:

# IPv4 — first global-scope address
ip -4 addr | sed -ne 's|^.* inet \([^/]*\)/.* scope global.*$|\1|p' | head -1

# IPv6 — first global-scope address
ip -6 addr | sed -ne 's|^.* inet6 \([^/]*\)/.* scope global.*$|\1|p' | head -1

Sets the IP variable based on ENDPOINT_TYPE (4 or 6).

NAT Detection

During interactive installation (installQuestions()), the script compares:

  • Local IP — from ip addr (private, e.g., 10.0.2.15)
  • Public IP — from external services (e.g., 203.0.113.1)

If they differ, the server is behind NAT. The script prompts for the public IP or hostname to use as the client endpoint.

For IPv6, it also detects link-local addresses (fe80::) and warns that they cannot be used as endpoints.

Network Configuration — prepare_network_config()

After all settings are collected, this function calculates derived values:

Variable Calculation Example
VPN_GATEWAY_IPV4 Subnet with last octet .1 10.8.0.0 → 10.8.0.1
VPN_GATEWAY_IPV6 Subnet with ::1 appended fd42:42:42:42:: → fd42:42:42:42::1
IPV6_SUPPORT Copy of CLIENT_IPV6 For backward compatibility

Interface Detection

During installOpenVPN(), the script detects the default network interface:

ip route | grep default | head -1 | awk '{print $5}'

This NIC variable is used for firewall NAT/masquerade rules to know which interface to masquerade outgoing VPN traffic through.

Local Network Detection

When the interactive installer's access policy step enables local network access, detect_private_local_networks() suggests candidate server-side networks — see Network & DNS — Server-Side Network Access. Non-interactive installs never call this function; each network must be passed explicitly via --local-network.

detect_private_local_networks(detect_ipv4, detect_ipv6)

For each enabled address family, the function reads directly connected unicast routes (ip -4/-6 -o route show type unicast, skipping routes with a via gateway) and keeps a route if:

  1. It is a private network — is_private_ipv4_network() (RFC1918) or is_private_ipv6_network() (ULA, fc00::/7).
  2. For IPv4, the route's outbound interface does not also carry a public IPv4 address (interface_has_public_ipv4()) — this excludes a provider's private-addressed public interface (e.g. 10.x addresses used for NAT gateways on some clouds).
  3. It does not overlap the configured VPN subnet (ipv4_cidrs_overlap() / ipv6_cidrs_overlap()).

Matching, de-duplicated networks are returned as a comma-separated list (IPv4 and IPv6 together when both families are requested).

interface_has_public_ipv4(interface)

Checks every global-scope IPv4 address on an interface (ip -4 -o address show dev <interface> scope global) and returns true as soon as one address is not a private (RFC1918) /32. Used by detect_private_local_networks() to avoid suggesting a private-looking route that shares an interface with a public IP.