phase4_windscribe.sh

#!/usr/bin/env bash
# ─────────────────────────────────────────────────────────────
#  PHASE 4 — Windscribe outbounds
#    WG  : parse the Windscribe WireGuard .conf -> Xray wireguard outbound (mtu 1380)
#    OVPN: Xray can't speak OpenVPN, so run an OpenVPN client tunnel and route a
#          'freedom' outbound through it via source-based policy routing.
#
#  SSH-SAFE: the OpenVPN client is forced 'route-nopull', so it does NOT hijack the
#  host default route. Only traffic sourced from the tun IP is sent through it
#  (ip rule from <tun_ip> table 200), which is exactly what Xray's sendThrough does.
# ─────────────────────────────────────────────────────────────
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" >/dev/null 2>&1 && pwd)"
# shellcheck source=lib/common.sh
. "${SCRIPT_DIR}/lib/common.sh"

banner "PHASE 4 — Windscribe outbounds"
require_root
load_env

MANAGER="$(manager_cmd)"

WG_CONF="${WINDSCRIBE_WG_CONFIG:-SKIP}"
OVPN_CONF="${WINDSCRIBE_OVPN_CONFIG:-SKIP}"

if [ "${WG_CONF}" = "SKIP" ] && [ "${OVPN_CONF}" = "SKIP" ]; then
  warn "Both WINDSCRIBE_WG_CONFIG and WINDSCRIBE_OVPN_CONFIG are SKIP — nothing to do."
  echo "  Next:  sudo ./phase5_manager_finalize.sh"
  exit 0
fi

# ── Windscribe WireGuard ───────────────────────────────────────
if [ "${WG_CONF}" != "SKIP" ]; then
  banner "Windscribe WireGuard"
  [ -f "${WG_CONF}" ] || die "WINDSCRIBE_WG_CONFIG points to a missing file: ${WG_CONF}"
  info "Parsing ${WG_CONF} and adding it as a Windscribe WG outbound (mtu 1380)."
  confirm "Add the Windscribe WireGuard outbound now?"
  "${MANAGER}" add-windscribe-wg --config "${WG_CONF}" \
    || die "Adding the Windscribe WireGuard outbound failed (see error above)."
fi

# ── Windscribe OpenVPN (transparent tunnel + policy route) ─────
if [ "${OVPN_CONF}" != "SKIP" ]; then
  banner "Windscribe OpenVPN"
  [ -f "${OVPN_CONF}" ] || die "WINDSCRIBE_OVPN_CONFIG points to a missing file: ${OVPN_CONF}"
  require_env WINDSCRIBE_USERNAME WINDSCRIBE_PASSWORD
  require_cmd openvpn
  require_cmd ip

  DST="/etc/openvpn/windscribe.conf"
  AUTH="/etc/openvpn/windscribe-auth.txt"
  UP="/etc/openvpn/windscribe-route-up.sh"
  DOWN="/etc/openvpn/windscribe-route-down.sh"
  TABLE=200

  info "This will:"
  echo "    - install the OpenVPN client config to ${DST} (route-nopull => no host hijack)"
  echo "    - write credentials to ${AUTH} (mode 600)"
  echo "    - start+enable openvpn@windscribe and add a policy route (table ${TABLE})"
  echo "    - add a 'freedom' outbound 'ovpn-windscribe' bound to the tun IP"
  confirm "Set up the Windscribe OpenVPN tunnel now?"

  install -d -m 0755 /etc/openvpn
  backup_file "${DST}"
  cp -a "${OVPN_CONF}" "${DST}"

  # credentials (never on a command line)
  write_secret "${AUTH}" "$(printf '%s\n%s\n' "${WINDSCRIBE_USERNAME}" "${WINDSCRIBE_PASSWORD}")"
  chmod 600 "${AUTH}"

  # route-up / route-down scripts: add a source-based default route via the tun, only for tun-sourced traffic
  cat > "${UP}" <<EOF
#!/usr/bin/env bash
# Added by phase4: route tun-sourced traffic out the Windscribe tunnel without touching host default.
ip rule add from \${ifconfig_local}/32 table ${TABLE} 2>/dev/null || true
ip route replace default dev \${dev} table ${TABLE}
exit 0
EOF
  cat > "${DOWN}" <<EOF
#!/usr/bin/env bash
ip rule del from \${ifconfig_local}/32 table ${TABLE} 2>/dev/null || true
ip route flush table ${TABLE} 2>/dev/null || true
exit 0
EOF
  chmod 0755 "${UP}" "${DOWN}"

  # Normalize the config: point auth at our file, stop it from pulling routes/redirect-gateway,
  # and wire in our route scripts. Strip any conflicting prior directives first.
  sed -i -E '/^[[:space:]]*(auth-user-pass([[:space:]].*)?|route-nopull|redirect-gateway.*|script-security.*|route-up.*|route-pre-down.*)[[:space:]]*$/d' "${DST}"
  {
    echo ""
    echo "# ---- added by phase4_windscribe.sh ----"
    echo "auth-user-pass ${AUTH}"
    echo "route-nopull"
    echo "pull-filter ignore \"redirect-gateway\""
    echo "script-security 2"
    echo "route-up ${UP}"
    echo "route-pre-down ${DOWN}"
  } >> "${DST}"

  log "Starting openvpn@windscribe..."
  systemctl enable openvpn@windscribe >/dev/null 2>&1 || true
  systemctl restart openvpn@windscribe || die "openvpn@windscribe failed to start. Inspect: journalctl -u openvpn@windscribe -n 50"

  # wait for the tun interface to come up and get an IP
  TUN_IFACE=""; TUN_IP=""
  for _ in $(seq 1 25); do
    TUN_IFACE="$(ip -o -4 addr show 2>/dev/null | awk '$2 ~ /^tun/ {print $2; exit}')"
    if [ -n "${TUN_IFACE}" ]; then
      TUN_IP="$(ip -o -4 addr show dev "${TUN_IFACE}" | awk '{print $4}' | cut -d/ -f1)"
      [ -n "${TUN_IP}" ] && break
    fi
    sleep 1
  done
  [ -n "${TUN_IP}" ] || die "OpenVPN started but no tun IP appeared. Check: journalctl -u openvpn@windscribe -n 50"
  log "OpenVPN up: ${TUN_IFACE} has IP ${TUN_IP}"

  # confirm traffic bound to the tun actually exits via Windscribe
  info "Verifying exit IP via ${TUN_IFACE}..."
  EXIT_JSON="$(curl -fsS --interface "${TUN_IFACE}" --max-time 12 https://ipinfo.io/json 2>/dev/null || true)"
  if [ -n "${EXIT_JSON}" ]; then
    log "Exit via ${TUN_IFACE}: $(echo "${EXIT_JSON}" | jq -r '"\(.ip) (\(.country)) \(.org)"')"
  else
    warn "Could not confirm exit IP through ${TUN_IFACE} yet (tunnel may still be settling)."
  fi

  # add the freedom outbound bound to the tun IP
  "${MANAGER}" add-freedom \
    --tag ovpn-windscribe \
    --inbound-tag inbound-windscribe-ovpn \
    --send-through "${TUN_IP}" \
    --iface "${TUN_IFACE}" \
    --provider windscribe \
    --note "OpenVPN via ${TUN_IFACE} (${TUN_IP})" \
    || die "Failed to add the ovpn-windscribe freedom outbound."

  warn "Note: sendThrough is bound to the current tun IP (${TUN_IP}). If Windscribe assigns a"
  warn "different IP after a reconnect, re-run: sudo vpn-panel-manager add-freedom --tag ovpn-windscribe \\"
  warn "      --inbound-tag inbound-windscribe-ovpn --send-through <new tun ip> --iface <tun>"
fi

banner "PHASE 4 COMPLETE — current outbounds"
"${MANAGER}" list
echo
echo "  Next:  sudo ./phase5_manager_finalize.sh"