Initial migration
This commit is contained in:
parent
1f823e556e
commit
163ccbd03f
17 changed files with 1369 additions and 0 deletions
35
README.md
Normal file
35
README.md
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
\ \ /_) ___| |
|
||||
\ \ \ / | __| _ \ | _` | __| _ \
|
||||
\ \ \ / | | __/ | | ( | | __/
|
||||
\_/\_/ _|_| \___|\____|\__,_|\__|\___|
|
||||
|
||||
|
||||
Wireguard based VPN server endpoint with LDAP support
|
||||
|
||||
Tested on Debian 12 bookworm
|
||||
|
||||
# Server Commands
|
||||
|
||||
./init.sh - setup system services (wireguard, unbound, iptables, sysctl)
|
||||
|
||||
./peer_add.sh - define new peer for a new remote device. generates config and QR code inside /etc/wireguard/clients
|
||||
|
||||
./peer_del.sh - delete a peer and salvage its ip address back to the ip pool
|
||||
|
||||
./peer_addall.sh - recreates wireguard state using existing clients in /etc/wireguard/clients dir
|
||||
|
||||
./peer_mail.sh - send the generated profile to the client and remove the sensitive data from server
|
||||
|
||||
# Server Tools
|
||||
|
||||
./gen-ip-database.sh - generate an ip pool for wireguard peers
|
||||
|
||||
./wgstats.sh - show peer stats similar based on wg show all dump
|
||||
|
||||
./wgldap.sh - tail the log of the wgldapsync service
|
||||
|
||||
# Client Side Tools
|
||||
|
||||
./client-tools/wg-rapid - modified wireguard client based on wg-quick that works with systemd-resolv
|
||||
|
||||
./client-tools/startvpn.desktop - shortcut for wg-rapid. update the parameter with peer filename
|
||||
8
client-tools/startvpn.desktop
Executable file
8
client-tools/startvpn.desktop
Executable file
|
|
@ -0,0 +1,8 @@
|
|||
[Desktop Entry]
|
||||
Name=startvpn
|
||||
Exec=/usr/local/bin/wg-rapid profile
|
||||
Comment=
|
||||
Terminal=true
|
||||
Icon=network-vpn
|
||||
Type=Application
|
||||
Name[en_US]=startvpn
|
||||
400
client-tools/wg-rapid
Executable file
400
client-tools/wg-rapid
Executable file
|
|
@ -0,0 +1,400 @@
|
|||
#!/bin/bash
|
||||
# SPDX-License-Identifier: GPL-2.0
|
||||
#
|
||||
# Copyright (C) 2015-2020 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
|
||||
# Copyright (C) 2021-2022 Daniel afx <daniel@deflax.net>
|
||||
#
|
||||
|
||||
#set -e -o pipefail
|
||||
shopt -s extglob
|
||||
export LC_ALL=C
|
||||
|
||||
SELF="$(readlink -f "${BASH_SOURCE[0]}")"
|
||||
export PATH="${SELF%/*}:$PATH"
|
||||
|
||||
WG_CONFIG=""
|
||||
|
||||
CONFIG_FILE=""
|
||||
PROGRAM="${0##*/}"
|
||||
ARGS=( "$@" )
|
||||
|
||||
EXTERNAL_NETWORK_TEST_IP="1.1.1.1"
|
||||
|
||||
cmd_usage() {
|
||||
cat >&2 <<-_EOF
|
||||
Usage: $PROGRAM [ CONFIG_NAME ]
|
||||
|
||||
CONFIG_NAME is the name of a configuration file, which is also the interface
|
||||
name followed by \`.conf'. It should be a configuration found at
|
||||
/etc/wireguard/INTERFACE.conf. It is to be readable by wg(8)'s \`setconf'
|
||||
sub-command, with the exception of the following additions
|
||||
to the [Interface] section, which are handled by $PROGRAM:
|
||||
|
||||
- Address: may be specified one or more times and contains one or more
|
||||
IP addresses (with an optional CIDR mask) to be set for the interface.
|
||||
- DNS: an optional DNS server to use while the device is up.
|
||||
- MTU: an optional MTU for the interface; if unspecified, auto-calculated.
|
||||
- Table: an optional routing table to which routes will be added; if
|
||||
unspecified or \`auto', the default table is used. If \`off', no routes
|
||||
are added.
|
||||
- PreUp, PostUp, PreDown, PostDown: script snippets which will be executed
|
||||
by bash(1) at the corresponding phases of the link, most commonly used
|
||||
to configure DNS. The string \`%i' is expanded to INTERFACE.
|
||||
|
||||
If for some reason the interface is already up, you could use:
|
||||
$PROGRAM [ CONFIG_NAME ] down
|
||||
_EOF
|
||||
}
|
||||
|
||||
# Helper Functions
|
||||
auto_su() {
|
||||
[[ $UID == 0 ]] || exec sudo -p "$PROGRAM must be run as root. Please enter the password for %u to continue: " -- "$BASH" -- "$SELF" "${ARGS[@]}"
|
||||
}
|
||||
|
||||
say() {
|
||||
echo " ] $*"
|
||||
}
|
||||
|
||||
die() {
|
||||
echo "!] $*" >&2
|
||||
exit 1
|
||||
}
|
||||
|
||||
cmd() {
|
||||
echo "#] $*" >&2
|
||||
"$@"
|
||||
}
|
||||
|
||||
execute_hooks() {
|
||||
local hook
|
||||
for hook in "$@"; do
|
||||
hook="${hook//%i/$INTERFACE}"
|
||||
echo "#] $hook" >&2
|
||||
(eval "$hook")
|
||||
done
|
||||
}
|
||||
|
||||
parse_options() {
|
||||
INTERFACE=""
|
||||
ADDRESSES=( )
|
||||
MTU=""
|
||||
DNS=( )
|
||||
DNS_SEARCH=( )
|
||||
TABLE=""
|
||||
PRE_UP=( )
|
||||
POST_UP=( )
|
||||
PRE_DOWN=( )
|
||||
POST_DOWN=( )
|
||||
local interface_section=0 line key value stripped v
|
||||
CONFIG_FILE="$1"
|
||||
[[ $CONFIG_FILE =~ ^[a-zA-Z0-9_=+.-]{1,15}$ ]] && CONFIG_FILE="/etc/wireguard/$CONFIG_FILE.conf"
|
||||
[[ -e $CONFIG_FILE ]] || die "\`$CONFIG_FILE' does not exist"
|
||||
[[ $CONFIG_FILE =~ (^|/)([a-zA-Z0-9_=+.-]{1,15})\.conf$ ]] || die "The config file must be a valid interface name, followed by .conf"
|
||||
CONFIG_FILE="$(readlink -f "$CONFIG_FILE")"
|
||||
((($(stat -c '0%#a' "$CONFIG_FILE") & $(stat -c '0%#a' "${CONFIG_FILE%/*}") & 0007) == 0)) || echo "Warning: \`$CONFIG_FILE' is world accessible" >&2
|
||||
INTERFACE="${BASH_REMATCH[2]}"
|
||||
shopt -s nocasematch
|
||||
while read -r line || [[ -n $line ]]; do
|
||||
stripped="${line%%\#*}"
|
||||
key="${stripped%%=*}"; key="${key##*([[:space:]])}"; key="${key%%*([[:space:]])}"
|
||||
value="${stripped#*=}"; value="${value##*([[:space:]])}"; value="${value%%*([[:space:]])}"
|
||||
[[ $key == "["* ]] && interface_section=0
|
||||
[[ $key == "[Interface]" ]] && interface_section=1
|
||||
if [[ $interface_section -eq 1 ]]; then
|
||||
case "$key" in
|
||||
Address) ADDRESSES+=( ${value//,/ } ); continue ;;
|
||||
MTU) MTU="$value"; continue ;;
|
||||
DNS) for v in ${value//,/ }; do
|
||||
[[ $v =~ (^[0-9.]+$)|(^.*:.*$) ]] && DNS+=( $v ) || DNS_SEARCH+=( $v )
|
||||
done; continue ;;
|
||||
Table) TABLE="$value"; continue ;;
|
||||
PreUp) PRE_UP+=( "$value" ); continue ;;
|
||||
PreDown) PRE_DOWN+=( "$value" ); continue ;;
|
||||
PostUp) POST_UP+=( "$value" ); continue ;;
|
||||
PostDown) POST_DOWN+=( "$value" ); continue ;;
|
||||
esac
|
||||
fi
|
||||
WG_CONFIG+="$line"$'\n'
|
||||
done < "$CONFIG_FILE"
|
||||
shopt -u nocasematch
|
||||
}
|
||||
|
||||
set_config() {
|
||||
cmd wg setconf "$INTERFACE" <(echo "$WG_CONFIG")
|
||||
}
|
||||
|
||||
# Setup Interface and Address
|
||||
add_if() {
|
||||
local ret
|
||||
if ! cmd ip link add "$INTERFACE" type wireguard; then
|
||||
ret=$?
|
||||
[[ -e /sys/module/wireguard ]] || ! command -v "${WG_QUICK_USERSPACE_IMPLEMENTATION:-wireguard-go}" >/dev/null && exit $ret
|
||||
echo "!] Missing WireGuard kernel module. Falling back to slow userspace implementation." >&2
|
||||
cmd "${WG_QUICK_USERSPACE_IMPLEMENTATION:-wireguard-go}" "$INTERFACE"
|
||||
fi
|
||||
}
|
||||
|
||||
del_if() {
|
||||
local table
|
||||
#[[ $HAVE_SET_DNS -eq 0 ]] || unset_dns
|
||||
#[[ $HAVE_SET_FIREWALL -eq 0 ]] || remove_firewall
|
||||
if [[ -z $TABLE || $TABLE == auto ]] && get_fwmark table && [[ $(wg show "$INTERFACE" allowed-ips) =~ /0(\ |$'\n'|$) ]]; then
|
||||
while [[ $(ip -4 rule show 2>/dev/null) == *"lookup $table"* ]]; do
|
||||
cmd ip -4 rule delete table $table
|
||||
done
|
||||
while [[ $(ip -4 rule show 2>/dev/null) == *"from all lookup main suppress_prefixlength 0"* ]]; do
|
||||
cmd ip -4 rule delete table main suppress_prefixlength 0
|
||||
done
|
||||
while [[ $(ip -6 rule show 2>/dev/null) == *"lookup $table"* ]]; do
|
||||
cmd ip -6 rule delete table $table
|
||||
done
|
||||
while [[ $(ip -6 rule show 2>/dev/null) == *"from all lookup main suppress_prefixlength 0"* ]]; do
|
||||
cmd ip -6 rule delete table main suppress_prefixlength 0
|
||||
done
|
||||
fi
|
||||
cmd ip link delete dev "$INTERFACE"
|
||||
}
|
||||
|
||||
add_addr() {
|
||||
local proto=-4
|
||||
[[ $1 == *:* ]] && proto=-6
|
||||
cmd ip $proto address add "$1" dev "$INTERFACE"
|
||||
}
|
||||
|
||||
set_mtu_up() {
|
||||
local mtu=0 endpoint output
|
||||
if [[ -n $MTU ]]; then
|
||||
cmd ip link set mtu "$MTU" up dev "$INTERFACE"
|
||||
return
|
||||
fi
|
||||
while read -r _ endpoint; do
|
||||
[[ $endpoint =~ ^\[?([a-z0-9:.]+)\]?:[0-9]+$ ]] || continue
|
||||
output="$(ip route get "${BASH_REMATCH[1]}" || true)"
|
||||
[[ ( $output =~ mtu\ ([0-9]+) || ( $output =~ dev\ ([^ ]+) && $(ip link show dev "${BASH_REMATCH[1]}") =~ mtu\ ([0-9]+) ) ) && ${BASH_REMATCH[1]} -gt $mtu ]] && mtu="${BASH_REMATCH[1]}"
|
||||
done < <(wg show "$INTERFACE" endpoints)
|
||||
if [[ $mtu -eq 0 ]]; then
|
||||
read -r output < <(ip route show default || true) || true
|
||||
[[ ( $output =~ mtu\ ([0-9]+) || ( $output =~ dev\ ([^ ]+) && $(ip link show dev "${BASH_REMATCH[1]}") =~ mtu\ ([0-9]+) ) ) && ${BASH_REMATCH[1]} -gt $mtu ]] && mtu="${BASH_REMATCH[1]}"
|
||||
fi
|
||||
[[ $mtu -gt 0 ]] || mtu=1500
|
||||
cmd ip link set mtu $(( mtu - 80 )) up dev "$INTERFACE"
|
||||
}
|
||||
|
||||
# Checks the active internet connection interface
|
||||
transport_interface() {
|
||||
local netiface
|
||||
netiface=$(ip route get ${EXTERNAL_NETWORK_TEST_IP} | grep -Po '(?<=dev\s)\w+' | cut -f1 -d ' ')
|
||||
if [ -z ${netiface} ]; then
|
||||
die "Unable to reach ${EXTERNAL_NETWORK_TEST_IP}. Check the Internet connection"
|
||||
exit 1
|
||||
else
|
||||
echo "${netiface}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Setup DNS
|
||||
HAVE_SET_DNS=0
|
||||
set_dns() {
|
||||
[[ ${#DNS[@]} -gt 0 ]] || return 0
|
||||
#{ printf 'nameserver %s\n' "${DNS[@]}"
|
||||
# [[ ${#DNS_SEARCH[@]} -eq 0 ]] || printf 'search %s\n' "${DNS_SEARCH[*]}"
|
||||
#} | cmd resolvconf -a "$(resolvconf_iface_prefix)$INTERFACE" -m 0 -x
|
||||
cmd resolvectl dns ${INTERFACE} "${DNS[@]}"
|
||||
cmd resolvectl domain ${INTERFACE} "~."
|
||||
cmd resolvectl domain $(transport_interface) "lan"
|
||||
HAVE_SET_DNS=1
|
||||
}
|
||||
|
||||
unset_dns() {
|
||||
[[ ${#DNS[@]} -gt 0 ]] || return 0
|
||||
cmd resolvectl domain $(transport_interface) "lan"
|
||||
cmd resolvectl domain $(transport_interface) "~."
|
||||
|
||||
}
|
||||
|
||||
# Setup Routes and Firewall
|
||||
add_route() {
|
||||
local proto=-4
|
||||
[[ $1 == *:* ]] && proto=-6
|
||||
[[ $TABLE != off ]] || return 0
|
||||
|
||||
if [[ -n $TABLE && $TABLE != auto ]]; then
|
||||
cmd ip $proto route add "$1" dev "$INTERFACE" table "$TABLE"
|
||||
elif [[ $1 == */0 ]]; then
|
||||
add_default "$1"
|
||||
else
|
||||
[[ -n $(ip $proto route show dev "$INTERFACE" match "$1" 2>/dev/null) ]] || cmd ip $proto route add "$1" dev "$INTERFACE"
|
||||
fi
|
||||
}
|
||||
|
||||
get_fwmark() {
|
||||
local fwmark
|
||||
fwmark="$(wg show "$INTERFACE" fwmark)" || return 1
|
||||
[[ -n $fwmark && $fwmark != off ]] || return 1
|
||||
printf -v "$1" "%d" "$fwmark"
|
||||
return 0
|
||||
}
|
||||
|
||||
HAVE_SET_FIREWALL=0
|
||||
add_default() {
|
||||
local table line
|
||||
if ! get_fwmark table; then
|
||||
table=51820
|
||||
while [[ -n $(ip -4 route show table $table 2>/dev/null) || -n $(ip -6 route show table $table 2>/dev/null) ]]; do
|
||||
((table++))
|
||||
done
|
||||
cmd wg set "$INTERFACE" fwmark $table
|
||||
fi
|
||||
local proto=-4 iptables=iptables pf=ip
|
||||
[[ $1 == *:* ]] && proto=-6 iptables=ip6tables pf=ip6
|
||||
cmd ip $proto route add "$1" dev "$INTERFACE" table $table
|
||||
cmd ip $proto rule add not fwmark $table table $table
|
||||
cmd ip $proto rule add table main suppress_prefixlength 0
|
||||
|
||||
local marker="-m comment --comment \"wg-quick(8) rule for $INTERFACE\"" restore=$'*raw\n' nftable="wg-quick-$INTERFACE" nftcmd
|
||||
printf -v nftcmd '%sadd table %s %s\n' "$nftcmd" "$pf" "$nftable"
|
||||
printf -v nftcmd '%sadd chain %s %s preraw { type filter hook prerouting priority -300; }\n' "$nftcmd" "$pf" "$nftable"
|
||||
printf -v nftcmd '%sadd chain %s %s premangle { type filter hook prerouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
|
||||
printf -v nftcmd '%sadd chain %s %s postmangle { type filter hook postrouting priority -150; }\n' "$nftcmd" "$pf" "$nftable"
|
||||
while read -r line; do
|
||||
[[ $line =~ .*inet6?\ ([0-9a-f:.]+)/[0-9]+.* ]] || continue
|
||||
printf -v restore '%s-I PREROUTING ! -i %s -d %s -m addrtype ! --src-type LOCAL -j DROP %s\n' "$restore" "$INTERFACE" "${BASH_REMATCH[1]}" "$marker"
|
||||
printf -v nftcmd '%sadd rule %s %s preraw iifname != "%s" %s daddr %s fib saddr type != local drop\n' "$nftcmd" "$pf" "$nftable" "$INTERFACE" "$pf" "${BASH_REMATCH[1]}"
|
||||
done < <(ip -o $proto addr show dev "$INTERFACE" 2>/dev/null)
|
||||
printf -v restore '%sCOMMIT\n*mangle\n-I POSTROUTING -m mark --mark %d -p udp -j CONNMARK --save-mark %s\n-I PREROUTING -p udp -j CONNMARK --restore-mark %s\nCOMMIT\n' "$restore" $table "$marker" "$marker"
|
||||
printf -v nftcmd '%sadd rule %s %s postmangle meta l4proto udp mark %d ct mark set mark \n' "$nftcmd" "$pf" "$nftable" $table
|
||||
printf -v nftcmd '%sadd rule %s %s premangle meta l4proto udp meta mark set ct mark \n' "$nftcmd" "$pf" "$nftable"
|
||||
[[ $proto == -4 ]] && cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1
|
||||
if type -p nft >/dev/null; then
|
||||
cmd nft -f <(echo -n "$nftcmd")
|
||||
else
|
||||
echo -n "$restore" | cmd $iptables-restore -n
|
||||
fi
|
||||
HAVE_SET_FIREWALL=1
|
||||
return 0
|
||||
}
|
||||
|
||||
remove_firewall() {
|
||||
if type -p nft >/dev/null; then
|
||||
local table nftcmd
|
||||
while read -r table; do
|
||||
[[ $table == *" wg-quick-$INTERFACE" ]] && printf -v nftcmd '%sdelete %s\n' "$nftcmd" "$table"
|
||||
done < <(nft list tables 2>/dev/null)
|
||||
[[ -z $nftcmd ]] || cmd nft -f <(echo -n "$nftcmd")
|
||||
fi
|
||||
if type -p iptables >/dev/null; then
|
||||
local line iptables found restore
|
||||
for iptables in iptables ip6tables; do
|
||||
restore="" found=0
|
||||
while read -r line; do
|
||||
[[ $line == "*"* || $line == COMMIT || $line == "-A "*"-m comment --comment \"wg-quick(8) rule for $INTERFACE\""* ]] || continue
|
||||
[[ $line == "-A"* ]] && found=1
|
||||
printf -v restore '%s%s\n' "$restore" "${line/#-A/-D}"
|
||||
done < <($iptables-save 2>/dev/null)
|
||||
[[ $found -ne 1 ]] || echo -n "$restore" | cmd $iptables-restore -n
|
||||
done
|
||||
fi
|
||||
}
|
||||
|
||||
# Up/Down Functions
|
||||
cmd_up() {
|
||||
local i
|
||||
#[[ -z $(ip link show dev "$INTERFACE" 2>/dev/null) ]] || die "\`$INTERFACE' already exists"
|
||||
[[ -z $(ip link show dev "$INTERFACE" 2>/dev/null) ]] || cmd_down
|
||||
trap 'del_if; exit' INT TERM EXIT
|
||||
say "Starting UP the ${INTERFACE} interface ..."
|
||||
execute_hooks "${PRE_UP[@]}"
|
||||
add_if
|
||||
set_config
|
||||
for i in "${ADDRESSES[@]}"; do
|
||||
add_addr "$i"
|
||||
done
|
||||
set_mtu_up
|
||||
set_dns
|
||||
for i in $(while read -r _ i; do for i in $i; do [[ $i =~ ^[0-9a-z:.]+/[0-9]+$ ]] && echo "$i"; done; done < <(wg show "$INTERFACE" allowed-ips) | sort -nr -k 2 -t /); do
|
||||
add_route "$i"
|
||||
done
|
||||
execute_hooks "${POST_UP[@]}"
|
||||
trap - INT TERM EXIT
|
||||
sleep 3
|
||||
}
|
||||
|
||||
cmd_down() {
|
||||
say "Bringing DOWN the ${INTERFACE} interface ..."
|
||||
[[ " $(wg show interfaces) " == *" $INTERFACE "* ]] || die "$INTERFACE is not a WireGuard interface"
|
||||
execute_hooks "${PRE_DOWN[@]}"
|
||||
del_if
|
||||
[[ $HAVE_SET_DNS -eq 0 ]] || unset_dns
|
||||
[[ $HAVE_SET_FIREWALL -eq 0 ]] || remove_firewall
|
||||
#unset_dns || true
|
||||
#remove_firewall || true
|
||||
execute_hooks "${POST_DOWN[@]}"
|
||||
sleep 1
|
||||
}
|
||||
|
||||
# Main
|
||||
if [[ $# -eq 0 ]]; then
|
||||
cmd_usage
|
||||
exit 1
|
||||
elif [[ $# -eq 1 ]]; then
|
||||
auto_su
|
||||
parse_options "$1"
|
||||
cmd_up
|
||||
while true; do
|
||||
clear
|
||||
say "wg-rapid by afx. ver.2204"
|
||||
echo " "
|
||||
say "[q] to stop the VPN connection."
|
||||
say "[d] or close the terminal window to keep the VPN connection setup configured"
|
||||
say "[o] forward all networking through the VPN tunnel"
|
||||
say "[p] forward the predefined routes only through the VPN tunnel"
|
||||
echo " "
|
||||
wg show
|
||||
echo " "
|
||||
read -t 1 -N 1 input
|
||||
if [[ $input = "q" ]] || [[ $input = "Q" ]]; then
|
||||
echo
|
||||
break
|
||||
fi
|
||||
if [[ $input = "d" ]] || [[ $input = "D" ]]; then
|
||||
echo
|
||||
say "$PROGRAM detached."
|
||||
exit 0
|
||||
fi
|
||||
if [[ $input = "p" ]] || [[ $input = "P" ]]; then
|
||||
cmd_down
|
||||
LINE_ROUTE_LOCAL=`grep -n 'Route only vpn trafic through vpn' /etc/wireguard/$1.conf | cut -d ':' -f 1`
|
||||
((LINE_ROUTE_LOCAL=LINE_ROUTE_LOCAL+1))
|
||||
LINE_ROUTE_ALL=`grep -n 'Route ALL traffic through vpn' /etc/wireguard/$1.conf | cut -d ':' -f 1`
|
||||
((LINE_ROUTE_ALL=LINE_ROUTE_ALL+1))
|
||||
sed -i "${LINE_ROUTE_LOCAL} s/^##*//" /etc/wireguard/$1.conf
|
||||
sed -i "${LINE_ROUTE_ALL} s/^/#/" /etc/wireguard/$1.conf
|
||||
parse_options "$1"
|
||||
cmd_up
|
||||
fi
|
||||
if [[ $input = "o" ]] || [[ $input = "O" ]]; then
|
||||
cmd_down
|
||||
sleep 1
|
||||
LINE_ROUTE_LOCAL=`grep -n 'Route only vpn trafic through vpn' /etc/wireguard/$1.conf | cut -d ':' -f 1`
|
||||
((LINE_ROUTE_LOCAL=LINE_ROUTE_LOCAL+1))
|
||||
LINE_ROUTE_ALL=`grep -n 'Route ALL traffic through vpn' /etc/wireguard/$1.conf | cut -d ':' -f 1`
|
||||
((LINE_ROUTE_ALL=LINE_ROUTE_ALL+1))
|
||||
sed -i "${LINE_ROUTE_LOCAL} s/^/#/" /etc/wireguard/$1.conf
|
||||
sed -i "${LINE_ROUTE_ALL} s/^##*//" /etc/wireguard/$1.conf
|
||||
parse_options "$1"
|
||||
cmd_up
|
||||
fi
|
||||
done
|
||||
cmd_down
|
||||
elif [[ $# -eq 2 ]]; then
|
||||
auto_su
|
||||
parse_options "$1"
|
||||
if [ "$2" == "down" ]; then
|
||||
cmd_down
|
||||
exit 0
|
||||
else
|
||||
say "$PROGRAM [ CONFIG_NAME ] [ down ]"
|
||||
fi
|
||||
fi
|
||||
|
||||
exit 0
|
||||
15
config.dist
Normal file
15
config.dist
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
public_ifname=ens3
|
||||
ip_db=/etc/wireguard/ipdb.pool
|
||||
server_endpoint_address=wire.example.com
|
||||
net_prefix=69
|
||||
allowed_routes="10.15.0.0/16, 192.168.0.0/24"
|
||||
monitor_host=10.15.0.15
|
||||
email_origin=wire.example.com
|
||||
email_host=email-smtp.eu-west-1.amazonaws.com
|
||||
email_user=AUSER
|
||||
email_pass=APASS
|
||||
email_destination=admin@domain
|
||||
ldap_server=ldap://idm.example.com
|
||||
ldap_login=cn=admin
|
||||
ldap_password=PASS
|
||||
ldap_basedn=dc=admin,dc=com
|
||||
44
gen-ip-database.sh
Executable file
44
gen-ip-database.sh
Executable file
|
|
@ -0,0 +1,44 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
source config
|
||||
|
||||
check_root() {
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
printf %b\\n "] Please run the script as root."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
gen_cidr() {
|
||||
base=${1%/*}
|
||||
masksize=${1#*/}
|
||||
|
||||
[ $masksize -lt 8 ] && { echo "] Max range is /8."; exit 1;}
|
||||
|
||||
mask=$(( 0xFFFFFFFF << (32 - $masksize) ))
|
||||
|
||||
IFS=. read a b c d <<< $base
|
||||
|
||||
ip=$(( ($b << 16) + ($c << 8) + $d ))
|
||||
|
||||
ipstart=$(( $ip & $mask ))
|
||||
ipend=$(( ($ipstart | ~$mask ) & 0x7FFFFFFF ))
|
||||
|
||||
seq $ipstart $ipend | while read i; do
|
||||
echo $a.$(( ($i & 0xFF0000) >> 16 )).$(( ($i & 0xFF00) >> 8 )).$(( $i & 0x00FF ))
|
||||
done
|
||||
}
|
||||
|
||||
check_root
|
||||
|
||||
# This generates all host address for our vpn subnet but skips the following:
|
||||
# - vpn server address, which ends with .0.1
|
||||
# - the network address and the broadcast address
|
||||
# - all host addresses in between that looks like /24 net and mask, they should work but they are
|
||||
# misleading in that regard, and we do have enough addresses already
|
||||
if [ -f $ip_db ]; then
|
||||
echo "] IP pool exists at $ip_db. Remove it first."
|
||||
exit 1
|
||||
else
|
||||
gen_cidr 10.${net_prefix}.0.0/20 | grep -v \\.0$ | grep -v .255$ | grep -v \\.0\\.1$ > $ip_db
|
||||
fi
|
||||
257
init.sh
Executable file
257
init.sh
Executable file
|
|
@ -0,0 +1,257 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
source config
|
||||
|
||||
check_root() {
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
printf %b\\n "] Please run the script as root."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Welcome
|
||||
echo ""
|
||||
cat README.md
|
||||
echo ""
|
||||
|
||||
check_root
|
||||
|
||||
# enable IPv4 forwarding
|
||||
sed -i 's/\#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/g' /etc/sysctl.conf
|
||||
|
||||
# negate the need to reboot after the above change
|
||||
sysctl -p
|
||||
|
||||
# update/upgrade server and refresh repo
|
||||
apt update -y && apt upgrade -y && apt autoremove -y
|
||||
|
||||
# remove the default firewall
|
||||
ufw disable
|
||||
apt remove --purge ufw -y
|
||||
apt install iptables netfilter-persistent -y
|
||||
|
||||
# install fail2ban
|
||||
apt install fail2ban -y
|
||||
|
||||
# install python-ldap
|
||||
apt install python3-dev python3-pip python3-ldap -y
|
||||
|
||||
# install wireguard
|
||||
systemctl stop wg-quick@wg0.service
|
||||
systemctl disable wg-quick@wg0.service
|
||||
apt install wireguard -y
|
||||
apt install qrencode -y
|
||||
|
||||
# install jq
|
||||
apt install jq -y
|
||||
|
||||
# install curl
|
||||
apt install curl -y
|
||||
|
||||
# create Wireguard interface config
|
||||
bash -c "cat > /etc/wireguard/wg0.conf" << ENDOFFILE
|
||||
[Interface]
|
||||
PrivateKey = server_private_key
|
||||
Address = 10.net_prefix.0.1/20
|
||||
ListenPort = 550net_prefix
|
||||
|
||||
PostUp = iptables -A FORWARD -i ${public_ifname} -o wg0 -j ACCEPT; iptables -A FORWARD -i wg0 -o ${public_ifname} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -A POSTROUTING -o ${public_ifname} -j MASQUERADE
|
||||
PostDown = iptables -D FORWARD -i ${public_ifname} -o wg0 -j ACCEPT; iptables -D FORWARD -i wg0 -o ${public_ifname} -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -D POSTROUTING -o ${public_ifname} -j MASQUERADE
|
||||
SaveConfig = true
|
||||
ENDOFFILE
|
||||
|
||||
cat << EOF | bash
|
||||
cd /etc/wireguard/
|
||||
umask 077
|
||||
[ ! -f server_private.key ] && wg genkey | tee server_private.key | wg pubkey > server_public.key
|
||||
EOF
|
||||
sed -i "s/net_prefix/${net_prefix}/g" /etc/wireguard/wg0.conf
|
||||
sed -i "s/server_private_key/$(sed 's:/:\\/:g' /etc/wireguard/server_private.key)/" /etc/wireguard/wg0.conf
|
||||
|
||||
# make root owner of the Wireguard config file
|
||||
chown -v root:root /etc/wireguard/wg0.conf
|
||||
chmod -v 600 /etc/wireguard/wg0.conf
|
||||
|
||||
# make Wireguard interface start at boot
|
||||
systemctl enable wg-quick@wg0.service
|
||||
|
||||
|
||||
# flush all chains
|
||||
iptables -P INPUT ACCEPT
|
||||
iptables -P FORWARD ACCEPT
|
||||
iptables -P OUTPUT ACCEPT
|
||||
iptables -t nat -F
|
||||
iptables -t mangle -F
|
||||
iptables -F
|
||||
# delete all chains
|
||||
iptables -X
|
||||
|
||||
# configure the firewall and make it persistent
|
||||
DEBIAN_FRONTEND=noninteractive apt install iptables-persistent -y
|
||||
systemctl enable netfilter-persistent
|
||||
iptables -P INPUT DROP
|
||||
iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
|
||||
iptables -A INPUT -p all -s localhost -j ACCEPT
|
||||
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
|
||||
iptables -A INPUT -p tcp --dport 655 -j ACCEPT
|
||||
iptables -A INPUT -p udp --dport 655 -j ACCEPT
|
||||
iptables -A INPUT -p tcp -s ${monitor_host} --dport 10050 -j ACCEPT
|
||||
iptables -A INPUT -p udp --dport 550${net_prefix} -j ACCEPT
|
||||
iptables -A INPUT -p all -i wg0 -j ACCEPT
|
||||
iptables -P FORWARD ACCEPT
|
||||
iptables -A FORWARD -i wg0 -o wg0 -j REJECT
|
||||
iptables -P OUTPUT ACCEPT
|
||||
netfilter-persistent save
|
||||
|
||||
# install Unbound DNS
|
||||
systemctl stop unbound.service
|
||||
systemctl disable unbound.service
|
||||
apt install unbound unbound-host -y
|
||||
|
||||
# download list of DNS root servers
|
||||
curl -o /var/lib/unbound/root.hints https://www.internic.net/domain/named.cache
|
||||
|
||||
# create unbound log file
|
||||
mkdir -p /var/log/unbound
|
||||
chown unbound:unbound /var/log/unbound/
|
||||
touch /var/log/unbound/unbound.log
|
||||
chown unbound:unbound /var/log/unbound/unbound.log
|
||||
|
||||
echo "/var/log/unbound/unbound.log rw," > /etc/apparmor.d/local/usr.sbin.unbound
|
||||
apparmor_parser -r /etc/apparmor.d/usr.sbin.unbound
|
||||
|
||||
# create custom conf
|
||||
touch /etc/unbound/custom.conf
|
||||
chown unbound:unbound /etc/unbound/custom.conf
|
||||
|
||||
# create Unbound config file
|
||||
bash -c "cat > /etc/unbound/unbound.conf" << ENDOFFILE
|
||||
server:
|
||||
num-threads: 4
|
||||
|
||||
# enable logs
|
||||
verbosity: 1
|
||||
logfile: /var/log/unbound/unbound.log
|
||||
chroot: ""
|
||||
log-queries: yes
|
||||
|
||||
# list of root DNS servers
|
||||
root-hints: "/var/lib/unbound/root.hints"
|
||||
|
||||
# use the root server's key for DNSSEC
|
||||
auto-trust-anchor-file: "/var/lib/unbound/root.key"
|
||||
|
||||
# respond to DNS requests on all interfaces
|
||||
interface: 0.0.0.0
|
||||
max-udp-size: 3072
|
||||
|
||||
# IPs authorised to access the DNS Server
|
||||
access-control: 0.0.0.0/0 refuse
|
||||
access-control: 127.0.0.1 allow
|
||||
access-control: 10.net_prefix.0.0/20 allow
|
||||
|
||||
# not allowed to be returned for public Internet names
|
||||
private-address: 10.net_prefix.0.0/20
|
||||
|
||||
#hide DNS Server info
|
||||
hide-identity: yes
|
||||
hide-version: yes
|
||||
|
||||
# limit DNS fraud and use DNSSEC
|
||||
harden-glue: yes
|
||||
harden-dnssec-stripped: yes
|
||||
harden-referral-path: yes
|
||||
|
||||
# add an unwanted reply threshold to clean the cache and avoid, when possible, DNS poisoning
|
||||
unwanted-reply-threshold: 10000000
|
||||
|
||||
# have the validator print validation failures to the log
|
||||
val-log-level: 1
|
||||
|
||||
# minimum lifetime of cache entries in seconds
|
||||
cache-min-ttl: 1800
|
||||
|
||||
# maximum lifetime of cached entries in seconds
|
||||
cache-max-ttl: 14400
|
||||
prefetch: yes
|
||||
prefetch-key: yes
|
||||
|
||||
# additional entries
|
||||
include: /etc/unbound/custom.conf
|
||||
ENDOFFILE
|
||||
|
||||
sed -i "s/net_prefix/${net_prefix}/g" /etc/unbound/unbound.conf
|
||||
|
||||
# give root ownership of the Unbound config
|
||||
chown -R unbound:unbound /var/lib/unbound
|
||||
|
||||
# enable Unbound in place of systemd-resovled
|
||||
systemctl enable unbound-resolvconf
|
||||
systemctl enable unbound
|
||||
systemctl start unbound
|
||||
|
||||
# disable systemd-resolved
|
||||
systemctl stop systemd-resolved
|
||||
systemctl disable systemd-resolved
|
||||
unlink /etc/resolv.conf
|
||||
bash -c "cat > /etc/resolv.conf" << ENDOFFILE
|
||||
nameserver 127.0.0.1
|
||||
ENDOFFILE
|
||||
|
||||
# Initial database generation
|
||||
bash -c "./gen-ip-database.sh"
|
||||
|
||||
#provide scripts in /usr/local/bin
|
||||
__dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
cp -v ${__dir}/wgstats.sh /usr/local/bin/
|
||||
cp -v ${__dir}/wgldap.sh /usr/local/bin/
|
||||
|
||||
#install Postfix mailserver
|
||||
if [ $email_origin == "wire.example.com" ]; then
|
||||
echo "] WARN: Mailing is disabled!"
|
||||
else
|
||||
echo "] Setting up mail server $email_origin ..."
|
||||
if [ ! -f /etc/postfix/main.cf ]; then
|
||||
echo "] Mail server config does not exist. Installing..."
|
||||
|
||||
# install postfix
|
||||
echo "postfix postfix/mailname string ${email_origin}" | debconf-set-selections
|
||||
echo "postfix postfix/main_mailer_type string 'Internet Site'" | debconf-set-selections
|
||||
apt install -y postfix mailutils libsasl2-2 ca-certificates libsasl2-modules mutt zip
|
||||
|
||||
# setup mail server for email reports
|
||||
/usr/sbin/postconf -e "relayhost = [${email_host}]:587" \
|
||||
"smtp_sasl_auth_enable = yes" \
|
||||
"smtp_sasl_security_options = noanonymous" \
|
||||
"smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd" \
|
||||
"smtp_use_tls = yes" \
|
||||
"smtp_tls_security_level = encrypt" \
|
||||
"smtp_tls_note_starttls_offer = yes"
|
||||
echo "[${email_host}]:587 ${email_user}:${email_pass}" > /etc/postfix/sasl_passwd
|
||||
/usr/sbin/postmap hash:/etc/postfix/sasl_passwd
|
||||
chown root:root /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
|
||||
chmod 0600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db
|
||||
/usr/sbin/postconf -e "smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt"
|
||||
/usr/sbin/postconf -e "myorigin = ${email_origin}"
|
||||
sleep 2
|
||||
service postfix restart
|
||||
fi
|
||||
fi
|
||||
|
||||
# Setup LDAP sync service
|
||||
if [ $ldap_server == "ldap://idm.example.com" ]; then
|
||||
echo "] WARN: LDAP disabled!"
|
||||
else
|
||||
echo "] Setting up LDAP server $ldap_server"
|
||||
cp -v ${__dir}/wgldapsync.service /etc/systemd/system/wgldapsync.service
|
||||
cp -v ${__dir}/wgldapsync.timer /etc/systemd/system/wgldapsync.timer
|
||||
systemctl daemon-reload
|
||||
systemctl enable wgldapsync.timer
|
||||
systemctl status wgldapsync.service
|
||||
systemctl status wgldapsync.timer
|
||||
fi
|
||||
|
||||
# reboot to make changes effective
|
||||
echo "] System reboot after 30 seconds..."
|
||||
sleep 30
|
||||
reboot
|
||||
171
ldapsync.py
Executable file
171
ldapsync.py
Executable file
|
|
@ -0,0 +1,171 @@
|
|||
#!/usr/bin/python3
|
||||
|
||||
import os
|
||||
import sys
|
||||
import configparser
|
||||
import pprint
|
||||
import socket
|
||||
import ldap
|
||||
import subprocess
|
||||
|
||||
DEBUG = False
|
||||
DEBUG_LDAP = False
|
||||
CONFIG_PATH = "/root/wiregate/"
|
||||
LOCAL_DB_PATH = '/etc/wireguard/clients/'
|
||||
|
||||
# parse config
|
||||
cds = 'wiregate' #ConfigParser dummy section
|
||||
with open(CONFIG_PATH + '/config', 'r') as f:
|
||||
config_string = '[' + cds + ']\n' + f.read()
|
||||
config = configparser.ConfigParser()
|
||||
config.read_string(config_string)
|
||||
|
||||
baseDN = config.get(cds, 'ldap_basedn')
|
||||
LDAP_SERVER = config.get(cds, 'ldap_server')
|
||||
LDAP_LOGIN = config.get(cds, 'ldap_login') + ',' + baseDN
|
||||
LDAP_PASSWORD = config.get(cds, 'ldap_password')
|
||||
|
||||
serverhost = socket.gethostname()
|
||||
searchScope = ldap.SCOPE_SUBTREE
|
||||
|
||||
def LdapQuery(searchFilter, searchAttrs):
|
||||
ldap.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_NEVER)
|
||||
|
||||
if DEBUG_LDAP:
|
||||
print("Connecting to " + LDAP_SERVER)
|
||||
l = ldap.initialize(LDAP_SERVER)
|
||||
try:
|
||||
#l.set_option(ldap.OPT_REFERRALS, 0)
|
||||
#l.set_option(ldap.OPT_PROTOCOL_VERSION, 3)
|
||||
#l.set_option(ldap.OPT_X_TLS, ldap.OPT_X_TLS_DEMAND)
|
||||
#l.set_option(ldap.OPT_X_TLS_DEMAND, True)
|
||||
#l.set_option(ldap.OPT_DEBUG_LEVEL, 255)
|
||||
l.set_option(ldap.OPT_NETWORK_TIMEOUT, 10.0)
|
||||
l.simple_bind_s(LDAP_LOGIN, LDAP_PASSWORD)
|
||||
|
||||
query = {}
|
||||
ldap_result_id = l.search(baseDN, searchScope, searchFilter, searchAttrs)
|
||||
while 1:
|
||||
rType, rData = l.result(ldap_result_id, 0)
|
||||
if (rData == []):
|
||||
break
|
||||
else:
|
||||
if rType == ldap.RES_SEARCH_ENTRY:
|
||||
cn = rData[0][0]
|
||||
data = rData[0][1]
|
||||
|
||||
#Flatten, just for more easy access
|
||||
for (k, v) in data.items():
|
||||
if len(v) == 1:
|
||||
data[k] = v[0]
|
||||
|
||||
#uid = data["uid"]
|
||||
query[cn] = data
|
||||
return query
|
||||
|
||||
except ldap.LDAPError as e:
|
||||
print(e)
|
||||
sys.exit(2)
|
||||
|
||||
finally:
|
||||
if DEBUG_LDAP:
|
||||
print('Server unbind.')
|
||||
l.unbind_s()
|
||||
return 0
|
||||
|
||||
def main():
|
||||
print("] WireGate LDAP sync")
|
||||
|
||||
# query ldap server and gather list of REMOTE peers which belong to cn=<HOSTNAME>,ou=Groups,baseDN
|
||||
ldapGroups = LdapQuery('(|(&(objectClass=groupOfUniqueNames)(cn=' + serverhost + ')))', ['uniqueMember'])
|
||||
|
||||
if ldapGroups == {}:
|
||||
print('] Group ' + serverhost + ' not found')
|
||||
sys.exit(1)
|
||||
|
||||
if ldapGroups != 0:
|
||||
members = ldapGroups['cn=' + serverhost + ',ou=Groups,' + baseDN]['uniqueMember']
|
||||
if not isinstance(members, list):
|
||||
members = [members]
|
||||
print('] Group: ' + serverhost)
|
||||
print('] Remote members: ' + str(len(members)))
|
||||
|
||||
remote_peers = []
|
||||
for member in members:
|
||||
d_member = member.decode('ascii')
|
||||
if DEBUG:
|
||||
print('] Processing ' + str(d_member))
|
||||
|
||||
searchFilterUser='(' + d_member.split(',')[0] + ')'
|
||||
ldapUser = LdapQuery(searchFilterUser, ['mail', 'l'])
|
||||
user = ldapUser[d_member]
|
||||
#get attributes
|
||||
#mail
|
||||
m_mail = str(user['mail'].decode('ascii'))
|
||||
m_domain = m_mail.split('@')[1]
|
||||
m_user = m_mail.split('@')[0]
|
||||
|
||||
m_peername = m_domain + '-' + m_user
|
||||
|
||||
#get additional peers provided with the l attribute
|
||||
if 'l' in user:
|
||||
labels = user['l']
|
||||
if not isinstance(labels, list):
|
||||
labels = [labels]
|
||||
for label in labels:
|
||||
peer = m_peername + '-' + str(label.decode('ascii'))
|
||||
remote_peers.append({ 'mail': m_mail, 'peer': peer })
|
||||
|
||||
#get the parent peer
|
||||
peer = m_peername
|
||||
remote_peers.append({ 'mail': m_mail, 'peer': peer })
|
||||
|
||||
#searchFilterUserSubs='(|(&(objectClass=*)(member=uid=%s,cn=users,ou=Groups,' + baseDN + ')))'
|
||||
user_subscriptions= LdapQuery('(|(&(objectClass=groupOfUniqueNames)(uniqueMember=' + str(d_member) + ')))', ['cn'])
|
||||
if DEBUG:
|
||||
pp = pprint.PrettyPrinter(depth=3)
|
||||
pp.pprint(user_subscriptions)
|
||||
|
||||
print("] Remote peers: " + str(len(remote_peers)))
|
||||
if DEBUG:
|
||||
pp = pprint.PrettyPrinter(depth=3)
|
||||
pp.pprint(remote_peers)
|
||||
|
||||
# query LOCAL peers database
|
||||
local_peers = []
|
||||
for file in os.listdir(LOCAL_DB_PATH):
|
||||
if file.endswith(".info"):
|
||||
try:
|
||||
cds = 'localdata' #ConfigParser dummy section
|
||||
with open(LOCAL_DB_PATH + '/' + file, 'r') as f:
|
||||
data_string = '[' + cds + ']\n' + f.read()
|
||||
local_peer_data = configparser.ConfigParser()
|
||||
local_peer_data.read_string(data_string)
|
||||
local_mail = local_peer_data.get(cds, 'email')
|
||||
local_peer = local_peer_data.get(cds, 'peer')
|
||||
local_peers.append({ 'mail': local_mail, 'peer': local_peer })
|
||||
|
||||
except Exception as e:
|
||||
print(e)
|
||||
sys.exit(2)
|
||||
|
||||
print("] Local peers: " + str(len(local_peers)))
|
||||
if DEBUG:
|
||||
pp = pprint.PrettyPrinter(depth=3)
|
||||
pp.pprint(local_peers)
|
||||
|
||||
# add / enable REMOTE peers if they DO NOT exist in the local database
|
||||
for r_peer in remote_peers:
|
||||
#print('add peer ' + r_peer['peer'] + ' - ' + r_peer['mail'])
|
||||
process = subprocess.Popen([CONFIG_PATH + "peer_add.sh", "-p", r_peer['peer'], "-e", r_peer['mail']])
|
||||
process.wait()
|
||||
|
||||
# disable (do not remove) LOCAL peers which DO NOT exist in the remote database
|
||||
for l_peer in local_peers:
|
||||
if l_peer not in remote_peers:
|
||||
#print('rem peer ' + l_peer['peer'] + ' - ' + l_peer['mail'])
|
||||
process = subprocess.Popen([CONFIG_PATH + "peer_disable.sh", "-p", l_peer['peer']])
|
||||
process.wait()
|
||||
|
||||
if __name__ == "__main__":
|
||||
sys.exit(main())
|
||||
20
mail.md
Normal file
20
mail.md
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
Hello,
|
||||
|
||||
To be able to access the resources on our development infrastructure, you will need to set up a VPN profile.
|
||||
|
||||
To install the necessary client application, please visit the following page to obtain packages for the operating system your device is currently using:
|
||||
|
||||
https://www.wireguard.com/install/
|
||||
|
||||
Please take care of the configuration files and QR images as equivalent to a secure password.
|
||||
|
||||
For Windows, MacOS, Android and iOS simply import profile.conf or profile_alltraffic.conf file using the import tunnel function of the Wireguard software.
|
||||
|
||||
You may choose to import both versions and switch between them, where the `alltraffic` version pushes all network routes through the endpoint, which is useful for example if a third party system requires a whitelisted company address or to switch geographic policy. The tradeoff is the limited bandwidth and delay of the endpoint for every network request, which could affect some resource intensive applications.
|
||||
|
||||
The connected device follows the remote network policy for the routed traffic and DNS requests.
|
||||
|
||||
For Linux you may use the wg-rapid script `sudo cp linux/wg-rapid /usr/local/bin`. Then copy either profile.conf file or the profile_alltraffic.conf version of it as /etc/wireguard/office.conf and start with `wg-rapid office` Please not that the linux script has built-in capability to switch between preselected routes, so it doesn't matter which one of them you choose to copy in this case.
|
||||
|
||||
Using a VPN client is somewhat platform and infrastructure specific, you may always contact #team-sysops for further assistance.
|
||||
|
||||
167
peer_add.sh
Executable file
167
peer_add.sh
Executable file
|
|
@ -0,0 +1,167 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
source config
|
||||
|
||||
check_root() {
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
printf %b\\n "] Please run the script as root."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
usage()
|
||||
{
|
||||
echo "Usage: peer_add.sh -p <peer name> -e <email address>"
|
||||
}
|
||||
|
||||
random_ip_pickup() {
|
||||
# Randomly select an IP and remove it from the pool
|
||||
local ipsleft=`cat ${ip_db} | wc -l`
|
||||
if [[ "${ipsleft}" -eq 0 ]]; then
|
||||
echo "empty"
|
||||
else
|
||||
local random_ip=$(shuf -n 1 ${ip_db})
|
||||
grep -v "${random_ip}$" ${ip_db} > ${ip_db}.tmp
|
||||
mv ${ip_db}.tmp ${ip_db}
|
||||
echo "${random_ip}"
|
||||
fi
|
||||
}
|
||||
|
||||
check_root
|
||||
|
||||
no_args="true"
|
||||
while getopts p:e: option
|
||||
do
|
||||
case $option in
|
||||
(p)
|
||||
name=${OPTARG};;
|
||||
(e)
|
||||
email=${OPTARG};;
|
||||
(*)
|
||||
usage
|
||||
exit;;
|
||||
esac
|
||||
no_args="false"
|
||||
done
|
||||
|
||||
[[ "$no_args" == "true" ]] && { usage; exit 1; }
|
||||
|
||||
# Check if IP pool exist
|
||||
if [ ! -f ${ip_db} ]; then
|
||||
echo "] IP pool does not exists at ${ip_db}. Generate it first."
|
||||
exit 3
|
||||
fi
|
||||
|
||||
# Check if both arguments exist
|
||||
if [ -z ${name} ] || [ -z ${email} ]; then
|
||||
echo "] Not enough arguments"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check if peer config exist
|
||||
if [ -f /etc/wireguard/clients/${name}_public.key ]; then
|
||||
peer_exists_in_wg=$(wg show wg0 dump | grep $(cat /etc/wireguard/clients/${name}_public.key) | wc -l)
|
||||
if [ ! ${peer_exists_in_wg} -eq 0 ]; then
|
||||
#echo "] ${name} already activated"
|
||||
exit 2
|
||||
fi
|
||||
fi
|
||||
|
||||
# Generate wireguard peer keys and config
|
||||
if [ -z ${server_endpoint_address} ]; then
|
||||
server_endpoint_address=$(ip addr show ${public_ifname} | grep -o "inet [0-9]*\.[0-9]*\.[0-9]*\.[0-9]*" | grep -o "[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*")
|
||||
fi
|
||||
|
||||
# Creating clients subdir
|
||||
mkdir -p /etc/wireguard/clients
|
||||
|
||||
if [ ! -f /etc/wireguard/clients/${name}.info ]; then
|
||||
echo "] ${name} config will be generated."
|
||||
peer_address_from_pool=$(random_ip_pickup)
|
||||
if [ ${peer_address_from_pool} = "empty" ]; then
|
||||
echo "] IP Pool is empty"
|
||||
exit 5
|
||||
fi
|
||||
|
||||
bash -c "cat > /etc/wireguard/clients/${name}_wg0.conf" << ENDOFFILE
|
||||
[Interface]
|
||||
PrivateKey = client_private_key
|
||||
Address = selected_peer_address/32
|
||||
DNS = 10.net_prefix.0.1
|
||||
|
||||
[Peer]
|
||||
PublicKey = server_public_key
|
||||
Endpoint = server_endpoint:550net_prefix
|
||||
# Route only vpn trafic through vpn
|
||||
AllowedIPs = 10.net_prefix.0.0/20, allowed_routes
|
||||
# Route ALL traffic through vpn
|
||||
#AllowedIPs = 0.0.0.0/0
|
||||
PersistentKeepalive = 21
|
||||
ENDOFFILE
|
||||
|
||||
bash -c "cat > /etc/wireguard/clients/${name}_alltraffic_wg0.conf" << ENDOFFILE
|
||||
[Interface]
|
||||
PrivateKey = client_private_key
|
||||
Address = selected_peer_address/32
|
||||
DNS = 10.net_prefix.0.1
|
||||
|
||||
[Peer]
|
||||
PublicKey = server_public_key
|
||||
Endpoint = server_endpoint:550net_prefix
|
||||
# Route only vpn trafic through vpn
|
||||
#AllowedIPs = 10.net_prefix.0.0/20, allowed_routes
|
||||
# Route ALL traffic through vpn
|
||||
AllowedIPs = 0.0.0.0/0
|
||||
PersistentKeepalive = 21
|
||||
ENDOFFILE
|
||||
|
||||
cat << EOF | bash
|
||||
cd /etc/wireguard/clients
|
||||
umask 077
|
||||
[ ! -f ${name}_private.key ] && wg genkey | tee ${name}_private.key | wg pubkey > ${name}_public.key
|
||||
EOF
|
||||
|
||||
sed -i "s/net_prefix/${net_prefix}/g" /etc/wireguard/clients/${name}_wg0.conf
|
||||
sed -i "s#allowed_routes#${allowed_routes}#g" /etc/wireguard/clients/${name}_wg0.conf
|
||||
sed -i "s/selected_peer_address/${peer_address_from_pool}/g" /etc/wireguard/clients/${name}_wg0.conf
|
||||
sed -i "s/server_endpoint/${server_endpoint_address}/g" /etc/wireguard/clients/${name}_wg0.conf
|
||||
sed -i "s/server_public_key/$(sed 's:/:\\/:g' /etc/wireguard/server_public.key)/" /etc/wireguard/clients/${name}_wg0.conf
|
||||
sed -i "s/client_private_key/$(sed 's:/:\\/:g' /etc/wireguard/clients/${name}_private.key)/" /etc/wireguard/clients/${name}_wg0.conf
|
||||
|
||||
sed -i "s/net_prefix/${net_prefix}/g" /etc/wireguard/clients/${name}_alltraffic_wg0.conf
|
||||
sed -i "s#allowed_routes#${allowed_routes}#g" /etc/wireguard/clients/${name}_alltraffic_wg0.conf
|
||||
sed -i "s/selected_peer_address/${peer_address_from_pool}/g" /etc/wireguard/clients/${name}_alltraffic_wg0.conf
|
||||
sed -i "s/server_endpoint/${server_endpoint_address}/g" /etc/wireguard/clients/${name}_alltraffic_wg0.conf
|
||||
sed -i "s/server_public_key/$(sed 's:/:\\/:g' /etc/wireguard/server_public.key)/" /etc/wireguard/clients/${name}_alltraffic_wg0.conf
|
||||
sed -i "s/client_private_key/$(sed 's:/:\\/:g' /etc/wireguard/clients/${name}_private.key)/" /etc/wireguard/clients/${name}_alltraffic_wg0.conf
|
||||
qrencode -t PNG -o /etc/wireguard/clients/${name}_alltraffic_qr.png < /etc/wireguard/clients/${name}_alltraffic_wg0.conf
|
||||
|
||||
echo "peer=${name}" > /etc/wireguard/clients/${name}.info
|
||||
echo "email=${email}" >> /etc/wireguard/clients/${name}.info
|
||||
echo "ip=${peer_address_from_pool}" >> /etc/wireguard/clients/${name}.info
|
||||
peer_ip=$(cat /etc/wireguard/clients/${name}.info | grep "^ip=" | cut -d '=' -f 2)
|
||||
|
||||
#send mail with the generated config
|
||||
bash -c "./peer_mail.sh -p ${name}"
|
||||
else
|
||||
echo "] ${name} config already exists."
|
||||
peer_ip=$(cat /etc/wireguard/clients/${name}.info | grep "^ip=" | cut -d '=' -f 2)
|
||||
|
||||
#check if private key was previously disabled
|
||||
if [ -f /etc/wireguard/clients/${name}_public.disabled ]; then
|
||||
echo "] ${name} was previously disabled."
|
||||
mv /etc/wireguard/clients/${name}_public.disabled /etc/wireguard/clients/${name}_public.key
|
||||
fi
|
||||
|
||||
#check if peer ip already exist in the database
|
||||
ip_exists_in_pool=$(grep "${peer_ip}$" ${ip_db} | wc -l)
|
||||
if [ ${ip_exists_in_pool} -eq 1 ]; then
|
||||
echo "] ${peer_ip} exists in pool. Removing to avoid duplicates."
|
||||
grep -v "${peer_ip}$" ${ip_db} > ${ip_db}.tmp
|
||||
mv ${ip_db}.tmp ${ip_db}
|
||||
fi
|
||||
fi
|
||||
|
||||
echo "] ${name} (${email}) config set. Endpoint address is ${server_endpoint_address}. Selected user VPN IP is ${peer_ip}"
|
||||
wg set wg0 peer $(cat /etc/wireguard/clients/${name}_public.key) allowed-ips ${peer_ip}/32 persistent-keepalive 21
|
||||
|
||||
12
peer_addall.sh
Executable file
12
peer_addall.sh
Executable file
|
|
@ -0,0 +1,12 @@
|
|||
#!/bin/bash
|
||||
|
||||
ALLCLIENTS=/etc/wireguard/clients/*.info
|
||||
|
||||
__dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
for client in $ALLCLIENTS; do
|
||||
peer=$(cat ${client} | grep '^peer=' | cut -d '=' -f 2)
|
||||
email=$(cat ${client} | grep '^email=' | cut -d '=' -f 2)
|
||||
echo "] peer_add.sh - peer: $peer - email: $email"
|
||||
bash ${__dir}/peer_add.sh -p ${peer} -e ${email}
|
||||
done
|
||||
62
peer_del.sh
Executable file
62
peer_del.sh
Executable file
|
|
@ -0,0 +1,62 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
source config
|
||||
|
||||
check_root() {
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
printf %b\\n "] Please run the script as root."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
usage()
|
||||
{
|
||||
echo "Usage: peer_del.sh -p <peer name>"
|
||||
}
|
||||
|
||||
check_root
|
||||
|
||||
no_args="true"
|
||||
while getopts p: option
|
||||
do
|
||||
case $option in
|
||||
(p)
|
||||
name=${OPTARG};;
|
||||
(*)
|
||||
usage
|
||||
exit;;
|
||||
esac
|
||||
no_args="false"
|
||||
done
|
||||
|
||||
[[ "$no_args" == "true" ]] && { usage; exit 1; }
|
||||
|
||||
# Check if peer config exist
|
||||
if [ ! -f /etc/wireguard/clients/${name}.info ]; then
|
||||
echo "] Peer ${name} does not exists"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
echo "] Removing wireguard config for ${name}"
|
||||
salvaged_ip=$(cat /etc/wireguard/clients/${name}.info | grep "^ip=" | cut -d '=' -f 2)
|
||||
echo "] Salvaged IP is ${salvaged_ip} and will be returned back to ${ip_db}"
|
||||
echo ${salvaged_ip} >> ${ip_db}
|
||||
|
||||
#check if config is previously disabled
|
||||
if [ -f /etc/wireguard/clients/${name}_public.disabled ]; then
|
||||
echo "] ${name} was previously disabled."
|
||||
mv /etc/wireguard/clients/${name}_public.disabled /etc/wireguard/clients/${name}_public.key
|
||||
fi
|
||||
|
||||
wg set wg0 peer $(cat /etc/wireguard/clients/${name}_public.key) remove
|
||||
rm /etc/wireguard/clients/${name}_public.key
|
||||
rm /etc/wireguard/clients/${name}.info
|
||||
|
||||
# remove additional sensitive info
|
||||
rm -f /etc/wireguard/clients/${name}_wg0.conf
|
||||
rm -f /etc/wireguard/clients/${name}_qr.png
|
||||
rm -f /etc/wireguard/clients/${name}_alltraffic_wg0.conf
|
||||
rm -f /etc/wireguard/clients/${name}_alltraffic_qr.png
|
||||
rm -f /etc/wireguard/clients/${name}_private.key
|
||||
|
||||
exit 0
|
||||
50
peer_disable.sh
Executable file
50
peer_disable.sh
Executable file
|
|
@ -0,0 +1,50 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
source config
|
||||
|
||||
check_root() {
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
printf %b\\n "] Please run the script as root."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
usage()
|
||||
{
|
||||
echo "Usage: peer_disable.sh -p <peer name>"
|
||||
}
|
||||
|
||||
check_root
|
||||
|
||||
no_args="true"
|
||||
while getopts p: option
|
||||
do
|
||||
case $option in
|
||||
(p)
|
||||
name=${OPTARG};;
|
||||
(*)
|
||||
usage
|
||||
exit;;
|
||||
esac
|
||||
no_args="false"
|
||||
done
|
||||
|
||||
[[ "$no_args" == "true" ]] && { usage; exit 1; }
|
||||
|
||||
# Check if peer config exist
|
||||
if [ ! -f /etc/wireguard/clients/${name}.info ]; then
|
||||
echo "] Peer ${name} does not exists"
|
||||
exit 2
|
||||
fi
|
||||
|
||||
#check if config is previously disabled
|
||||
if [ -f /etc/wireguard/clients/${name}_public.disabled ]; then
|
||||
#echo "] ${name} is already disabled."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "] Disable wireguard config for ${name}"
|
||||
wg set wg0 peer $(cat /etc/wireguard/clients/${name}_public.key) remove
|
||||
mv /etc/wireguard/clients/${name}_public.key /etc/wireguard/clients/${name}_public.disabled
|
||||
|
||||
exit 0
|
||||
69
peer_mail.sh
Executable file
69
peer_mail.sh
Executable file
|
|
@ -0,0 +1,69 @@
|
|||
#!/usr/bin/env bash
|
||||
|
||||
source config
|
||||
|
||||
check_root() {
|
||||
if [ "$EUID" -ne 0 ]; then
|
||||
printf %b\\n "] Please run the script as root."
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
usage()
|
||||
{
|
||||
echo "Usage: peer_mail.sh -p <peer name>"
|
||||
}
|
||||
|
||||
check_root
|
||||
|
||||
no_args="true"
|
||||
while getopts p: option
|
||||
do
|
||||
case $option in
|
||||
(p)
|
||||
name=${OPTARG};;
|
||||
(*)
|
||||
usage
|
||||
exit;;
|
||||
esac
|
||||
no_args="false"
|
||||
done
|
||||
|
||||
[[ "$no_args" == "true" ]] && { usage; exit 1; }
|
||||
|
||||
email_client=$(cat /etc/wireguard/clients/${name}.info | grep "^email=" | cut -d '=' -f 2)
|
||||
|
||||
if [ -z ${email_client} ]; then
|
||||
echo "] Peer not found."
|
||||
exit 2
|
||||
fi
|
||||
|
||||
echo "] Sending the profile data to $email_destination"
|
||||
# strip non alphanumeric characters from peer name
|
||||
stname=$(echo ${name} | sed "s/[^[:alnum:]-]//g")
|
||||
|
||||
# fill profile tmp dir with data
|
||||
mkdir payload
|
||||
mkdir payload/mobile
|
||||
cp -v /etc/wireguard/clients/${name}_wg0.conf payload/profile.conf
|
||||
cp -v /etc/wireguard/clients/${name}_alltraffic_wg0.conf payload/profile_alltraffic.conf
|
||||
cp -v /etc/wireguard/clients/${name}_alltraffic_qr.png payload/mobile/profile_alltraffic_QR.png
|
||||
|
||||
mkdir payload/linux
|
||||
cp -v client-tools/wg-rapid payload/linux/wg-rapid
|
||||
cp -v client-tools/startvpn.desktop payload/linux/startvpn.desktop
|
||||
chmod +x payload/linux/startvpn.desktop
|
||||
|
||||
# pack the attachment
|
||||
cd payload
|
||||
zip -r ../payload.zip .
|
||||
cd ..
|
||||
mv payload.zip ${stname}_profile.zip
|
||||
|
||||
# sent the message
|
||||
mutt -s "WireGate VPN for ${email_client}" ${email_destination} -a ${stname}_profile.zip < mail.md
|
||||
#mutt -s "WireGate VPN for ${email_client}" ${email_client} -a ${stname}_profile.zip < mail.md
|
||||
|
||||
rm -f -r -v payload
|
||||
|
||||
exit 0
|
||||
5
wgldap.sh
Executable file
5
wgldap.sh
Executable file
|
|
@ -0,0 +1,5 @@
|
|||
#!/bin/bash
|
||||
|
||||
__dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
journalctl -u wgldapsync -f
|
||||
7
wgldapsync.service
Normal file
7
wgldapsync.service
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
[Unit]
|
||||
Description=WireGate LDAP auto-sync service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
WorkingDirectory=/root/wiregate
|
||||
ExecStart=/usr/bin/python3 /root/wiregate/ldapsync.py
|
||||
9
wgldapsync.timer
Normal file
9
wgldapsync.timer
Normal file
|
|
@ -0,0 +1,9 @@
|
|||
[Unit]
|
||||
Description=WireGate LDAP auto-sync timer
|
||||
|
||||
[Timer]
|
||||
OnUnitActiveSec=30min
|
||||
OnBootSec=30min
|
||||
|
||||
[Install]
|
||||
WantedBy=timers.target
|
||||
38
wgstats.sh
Executable file
38
wgstats.sh
Executable file
|
|
@ -0,0 +1,38 @@
|
|||
#!/bin/bash
|
||||
|
||||
__dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
|
||||
echo "] WireGate plugins:"
|
||||
systemctl list-timers --all | grep 'ACTIVATES\|wgldapsync'
|
||||
echo ""
|
||||
|
||||
echo "] WireGate peers:"
|
||||
tmpfile1=$(mktemp /tmp/wgstats.1.XXXXXX)
|
||||
tmpfile2=$(mktemp /tmp/wgstats.2.XXXXXX)
|
||||
|
||||
ALLPEERS=$(wg show all dump | grep -v off)
|
||||
|
||||
echo "$ALLPEERS" | while IFS= read -r peer ; do
|
||||
peerkey=$(echo "$peer" | cut -d $'\t' -f 2)
|
||||
peerfile=$(basename $(grep -l "${peerkey}" /etc/wireguard/clients/*_public.key))
|
||||
peername=$(echo ${peerfile} | cut -d '_' -f 1)
|
||||
clientip=$(echo "$peer" | cut -d $'\t' -f 4)
|
||||
peerip=$(echo "$peer" | cut -d $'\t' -f 5)
|
||||
peerlatesths=$(echo "$peer" | cut -d $'\t' -f 6)
|
||||
if [ ${peerlatesths} -eq 0 ]; then
|
||||
peerlatesthsfmt="Never"
|
||||
else
|
||||
peerlatesthsfmt=$(date -d@${peerlatesths})
|
||||
fi
|
||||
peerrx=$(echo "$peer" | cut -d $'\t' -f 7 | numfmt --to=iec-i --suffix=B)
|
||||
peertx=$(echo "$peer" | cut -d $'\t' -f 8 | numfmt --to=iec-i --suffix=B)
|
||||
echo "${peerlatesths},$peername,$clientip,$peerip,${peerlatesthsfmt},$peerrx,$peertx" >> $tmpfile1
|
||||
done
|
||||
|
||||
sort -k1 -n -t "," $tmpfile1 | cut -d "," -f 2- > $tmpfile2
|
||||
sed -i '1s/^/Peer,Client Address,Peer Address,Latest Handshake,Data Recieved,Data Sent\n/' $tmpfile2
|
||||
column -e -t -s "," $tmpfile2
|
||||
|
||||
rm $tmpfile1
|
||||
rm $tmpfile2
|
||||
exit 0
|
||||
Loading…
Reference in a new issue