kjuulh/wireguard-setup
1
0
Fork 0
Code Issues 1 Pull Requests 1 Projects Releases Wiki Activity

Switched to nftables, modified the default SSH port and removed fail2ban

Browse Source
This commit is contained in:
Héctor Molinero Fernández
2020-06-14 19:49:14 +02:00
parent 1122699107
commit 164b1538f0
7 changed files with 88 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
packer/rootfs/etc/fail2ban/jail.d/sshd.conf
View File

@@ -1,9 +0,0 @@
[sshd]
enabled = true
filter = sshd
banaction = ufw
backend = systemd
maxretry = 5
findtime = 10m
bantime = 10m
ignoreip = 127.0.0.1/8 ::1

74
packer/rootfs/etc/nftables.conf Normal file
View File

@@ -0,0 +1,74 @@
#!/usr/sbin/nft -f
flush ruleset;
table inet filter {
chain input {
type filter hook input priority 0;
policy drop;
# Accept loopback.
iif lo accept;
# Accept traffic originated from us.
ct state { established, related } accept;
# Accept neighbour discovery otherwise IPv6 connectivity breaks.
ip6 nexthdr icmpv6 icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept;
# Accept all ICMP types.
ip protocol icmp accept;
ip6 nexthdr icmpv6 accept;
# Accept SSH traffic.
tcp dport 122 accept;
# Accept WireGuard traffic.
udp dport 51820 accept;
# Accept DNS traffic on the WireGuard interface.
iifname wg0 meta l4proto { tcp, udp } @th,16,16 53 accept;
# Count dropped packets.
counter drop;
}
chain forward {
type filter hook forward priority 0;
policy drop;
# Accept packet forwarding on the WireGuard interface.
iifname wg0 accept;
oifname wg0 ct state { established, related } accept;
# Count dropped packets.
counter drop;
}
chain output {
type filter hook output priority 0;
policy accept;
}
}
table inet nat {
chain prerouting {
type nat hook prerouting priority -100;
policy accept;
# Early drop of invalid packets.
ct state invalid counter drop;
# Accept WireGuard traffic via port 53/UDP (to circumvent some firewalls).
iifname != wg0 udp dport 53 redirect to 51820;
}
chain postrouting {
type nat hook postrouting priority 100;
policy accept;
# Masquerade WireGuard traffic.
oif != lo ip saddr 10.10.10.1/24 masquerade;
oif != lo ip6 saddr fd10:10:10::1/64 masquerade;
}
}

2
packer/rootfs/etc/ssh/sshd_config
View File

@@ -2,7 +2,7 @@ Protocol 2
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key
ListenAddress 0.0.0.0
Port 22
Port 122
UseDNS no
UsePAM yes
X11Forwarding no

3
packer/rootfs/etc/sysctl.d/60-forwarding.conf Normal file
View File

@@ -0,0 +1,3 @@
net.ipv4.ip_forward=1
net.ipv6.conf.all.forwarding=1
net.ipv6.conf.default.forwarding=1

28
packer/rootfs/etc/wireguard/wg0.conf
View File

@@ -8,29 +8,5 @@ PostUp = wg set '%i' private-key '/etc/wireguard/%i-privatekey'
# Load peers
PostUp = [ -e '/etc/wireguard/%i-peers.conf' ] || (umask 022 && touch '/etc/wireguard/%i-peers.conf')
PostUp = wg addconf '%i' '/etc/wireguard/%i-peers.conf'
# Enable IPv4/IPv6 forwarding
PostUp = grep -Fxq 1 /proc/sys/net/ipv4/ip_forward || printf 1 > /proc/sys/net/ipv4/ip_forward
PostUp = grep -Fxq 1 /proc/sys/net/ipv6/conf/all/forwarding || printf 1 > /proc/sys/net/ipv6/conf/all/forwarding
PostUp = grep -Fxq 1 /proc/sys/net/ipv6/conf/default/forwarding || printf 1 > /proc/sys/net/ipv6/conf/default/forwarding
# Store the internet-facing interface in a file for later use
PostUp = ip route show default 0.0.0.0/0 | awk '/^default/{print $5}' > /etc/wireguard/default-iface
# Allow access WireGuard via port 51820/UDP on the internet-facing interface
PostUp = iptables -A INPUT -i "$(cat /etc/wireguard/default-iface)" -p udp --dport 51820 -j ACCEPT
PostUp = ip6tables -A INPUT -i "$(cat /etc/wireguard/default-iface)" -p udp --dport 51820 -j ACCEPT
PostDown = iptables -D INPUT -i "$(cat /etc/wireguard/default-iface)" -p udp --dport 51820 -j ACCEPT
PostDown = ip6tables -D INPUT -i "$(cat /etc/wireguard/default-iface)" -p udp --dport 51820 -j ACCEPT
# Allow access WireGuard via port 53/UDP on the internet-facing interface (to circumvent some firewalls)
PostUp = iptables -t nat -A PREROUTING -i "$(cat /etc/wireguard/default-iface)" -p udp --dport 53 -j REDIRECT --to-port 51820
PostUp = ip6tables -t nat -A PREROUTING -i "$(cat /etc/wireguard/default-iface)" -p udp --dport 53 -j REDIRECT --to-port 51820
PostDown = iptables -t nat -D PREROUTING -i "$(cat /etc/wireguard/default-iface)" -p udp --dport 53 -j REDIRECT --to-port 51820
PostDown = ip6tables -t nat -D PREROUTING -i "$(cat /etc/wireguard/default-iface)" -p udp --dport 53 -j REDIRECT --to-port 51820
# Allow packet forwarding on the WireGuard interface
PostUp = iptables -A FORWARD -i '%i' -j ACCEPT && iptables -t nat -A POSTROUTING -o "$(cat /etc/wireguard/default-iface)" -j MASQUERADE
PostUp = ip6tables -A FORWARD -i '%i' -j ACCEPT && ip6tables -t nat -A POSTROUTING -o "$(cat /etc/wireguard/default-iface)" -j MASQUERADE
PostDown = iptables -D FORWARD -i '%i' -j ACCEPT && iptables -t nat -D POSTROUTING -o "$(cat /etc/wireguard/default-iface)" -j MASQUERADE
PostDown = ip6tables -D FORWARD -i '%i' -j ACCEPT && ip6tables -t nat -D POSTROUTING -o "$(cat /etc/wireguard/default-iface)" -j MASQUERADE
# Allow access to the local DNS server on the WireGuard interface
PostUp = iptables -A INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && iptables -A INPUT -i '%i' -p udp --dport 53 -j ACCEPT
PostUp = ip6tables -A INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && ip6tables -A INPUT -i '%i' -p udp --dport 53 -j ACCEPT
PostDown = iptables -D INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && iptables -D INPUT -i '%i' -p udp --dport 53 -j ACCEPT
PostDown = ip6tables -D INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && ip6tables -D INPUT -i '%i' -p udp --dport 53 -j ACCEPT
# Reload nftables
PostUp = nft -f /etc/nftables.conf