From a97142bb97ee0070a146f52b1d2caf48de52ff9b Mon Sep 17 00:00:00 2001 From: Emile Nijssen Date: Mon, 10 Jan 2022 23:11:34 -0800 Subject: [PATCH] add WG_POST_UP, WG_POST_DOWN --- src/config.js | 9 +++++++++ src/lib/WireGuard.js | 19 ++++++++++++------- 2 files changed, 21 insertions(+), 7 deletions(-) diff --git a/src/config.js b/src/config.js index 9811c90..a08aab3 100644 --- a/src/config.js +++ b/src/config.js @@ -15,3 +15,12 @@ module.exports.WG_DEFAULT_DNS = typeof process.env.WG_DEFAULT_DNS === 'string' ? process.env.WG_DEFAULT_DNS : '1.1.1.1'; module.exports.WG_ALLOWED_IPS = process.env.WG_ALLOWED_IPS || '0.0.0.0/0, ::/0'; + +module.exports.WG_POST_UP = process.env.WG_POST_UP || ` +iptables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE; +iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; +iptables -A FORWARD -i wg0 -j ACCEPT; +iptables -A FORWARD -o wg0 -j ACCEPT; +`.split('\n').join(' '); + +module.exports.WG_POST_DOWN = process.env.WG_POST_DOWN || ''; diff --git a/src/lib/WireGuard.js b/src/lib/WireGuard.js index 816d50a..032854f 100644 --- a/src/lib/WireGuard.js +++ b/src/lib/WireGuard.js @@ -19,6 +19,8 @@ const { WG_DEFAULT_ADDRESS, WG_PERSISTENT_KEEPALIVE, WG_ALLOWED_IPS, + WG_POST_UP, + WG_POST_DOWN, } = require('../config'); module.exports = class WireGuard { @@ -63,10 +65,10 @@ module.exports = class WireGuard { throw err; }); - await Util.exec(`iptables -t nat -A POSTROUTING -s ${WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE`); - await Util.exec('iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT'); - await Util.exec('iptables -A FORWARD -i wg0 -j ACCEPT'); - await Util.exec('iptables -A FORWARD -o wg0 -j ACCEPT'); + // await Util.exec(`iptables -t nat -A POSTROUTING -s ${WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE`); + // await Util.exec('iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT'); + // await Util.exec('iptables -A FORWARD -i wg0 -j ACCEPT'); + // await Util.exec('iptables -A FORWARD -o wg0 -j ACCEPT'); await this.__syncConfig(); return config; @@ -91,7 +93,10 @@ module.exports = class WireGuard { [Interface] PrivateKey = ${config.server.privateKey} Address = ${config.server.address}/24 -ListenPort = 51820`; +ListenPort = 51820 +PostUp = ${WG_POST_UP} +PostDown = ${WG_POST_DOWN} +`; for (const [clientId, client] of Object.entries(config.clients)) { if (!client.enabled) continue; @@ -105,7 +110,7 @@ PresharedKey = ${client.preSharedKey} AllowedIPs = ${client.address}/32`; } - debug('Saving config...'); + debug('Config saving...'); await fs.writeFile(path.join(WG_PATH, 'wg0.json'), JSON.stringify(config, false, 2), { mode: 0o660, }); @@ -116,7 +121,7 @@ AllowedIPs = ${client.address}/32`; } async __syncConfig() { - debug('Syncing config...'); + debug('Config syncing...'); await Util.exec('wg syncconf wg0 <(wg-quick strip wg0)'); debug('Config synced.'); }