From 6a82dbb688f348cf7d4a12ff7d3d0727c05a3694 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?H=C3=A9ctor=20Molinero=20Fern=C3=A1ndez?= Date: Mon, 27 Jan 2020 20:01:21 +0100 Subject: [PATCH] Open WireGuard port in wg0.conf --- rootfs/etc/wireguard/wg0.conf | 22 ++++++++++++++-------- start-qemu.sh | 2 +- wireguard.pkr.hcl | 3 +-- 3 files changed, 16 insertions(+), 11 deletions(-) diff --git a/rootfs/etc/wireguard/wg0.conf b/rootfs/etc/wireguard/wg0.conf index 7ce1e6a..1856e7b 100644 --- a/rootfs/etc/wireguard/wg0.conf +++ b/rootfs/etc/wireguard/wg0.conf @@ -6,13 +6,24 @@ PostUp = [ -e '/etc/wireguard/%i-privatekey' ] || (umask 077 && wg genkey > '/et PostUp = [ -e '/etc/wireguard/%i-publickey' ] || (umask 022 && wg pubkey < '/etc/wireguard/%i-privatekey' > '/etc/wireguard/%i-publickey') PostUp = wg set '%i' private-key '/etc/wireguard/%i-privatekey' # Load peers -PostUp = [ -e '/etc/wireguard/%i-peers.conf' ] && wg addconf '%i' '/etc/wireguard/%i-peers.conf' -# Store the internet-facing interface in a file for later use -PostUp = ip route show default | awk '/^default/{print $5}' > '/etc/wireguard/%i-iface' +PostUp = [ -e '/etc/wireguard/%i-peers.conf' ] || (umask 022 && touch '/etc/wireguard/%i-peers.conf') +PostUp = wg addconf '%i' '/etc/wireguard/%i-peers.conf' # Enable IPv4/IPv6 forwarding PostUp = grep -Fxq '1' /proc/sys/net/ipv4/ip_forward || printf 1 > /proc/sys/net/ipv4/ip_forward PostUp = grep -Fxq '1' /proc/sys/net/ipv6/conf/all/forwarding || printf 1 > /proc/sys/net/ipv6/conf/all/forwarding PostUp = grep -Fxq '1' /proc/sys/net/ipv6/conf/default/forwarding || printf 1 > /proc/sys/net/ipv6/conf/default/forwarding +# Store the internet-facing interface in a file for later use +PostUp = ip route show default | awk '/^default/{print $5}' > '/etc/wireguard/%i-iface' +# Allow access WireGuard via port 51820/UDP on the internet-facing interface +PostUp = iptables -A INPUT -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 51820 -j ACCEPT +PostUp = ip6tables -A INPUT -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 51820 -j ACCEPT +PostDown = iptables -D INPUT -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 51820 -j ACCEPT +PostDown = ip6tables -D INPUT -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 51820 -j ACCEPT +# Allow access WireGuard via port 53/UDP on the internet-facing interface (to circumvent some firewalls) +PostUp = iptables -t nat -A PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820 +PostUp = ip6tables -t nat -A PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820 +PostDown = iptables -t nat -D PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820 +PostDown = ip6tables -t nat -D PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820 # Allow packet forwarding on the WireGuard interface PostUp = iptables -A FORWARD -i '%i' -j ACCEPT && iptables -t nat -A POSTROUTING -o "$(cat '/etc/wireguard/%i-iface')" -j MASQUERADE PostUp = ip6tables -A FORWARD -i '%i' -j ACCEPT && ip6tables -t nat -A POSTROUTING -o "$(cat '/etc/wireguard/%i-iface')" -j MASQUERADE @@ -23,8 +34,3 @@ PostUp = iptables -A INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && iptables - PostUp = ip6tables -A INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && ip6tables -A INPUT -i '%i' -p udp --dport 53 -j ACCEPT PostDown = iptables -D INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && iptables -D INPUT -i '%i' -p udp --dport 53 -j ACCEPT PostDown = ip6tables -D INPUT -i '%i' -p tcp --dport 53 -j ACCEPT && ip6tables -D INPUT -i '%i' -p udp --dport 53 -j ACCEPT -# Allow access WireGuard via port 53/UDP (to circumvent some firewalls) -PostUp = iptables -t nat -A PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820 -PostUp = ip6tables -t nat -A PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820 -PostDown = iptables -t nat -D PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820 -PostDown = ip6tables -t nat -D PREROUTING -i "$(cat '/etc/wireguard/%i-iface')" -p udp --dport 53 -j REDIRECT --to-port 51820 diff --git a/start-qemu.sh b/start-qemu.sh index 89348b5..e65e958 100755 --- a/start-qemu.sh +++ b/start-qemu.sh @@ -29,6 +29,6 @@ kvm \ -smp 1 -m 512 \ -nographic -serial mon:stdio \ -device e1000,netdev=n0 \ - -netdev user,id=n0,hostfwd=tcp::2222-:22,hostfwd=udp::5353-:53 \ + -netdev user,id=n0,hostfwd=tcp::2222-:22,hostfwd=udp::51820-:51820 \ -drive file="${SNAPSHOT_DISK:?}",if=virtio,format=qcow2 \ -drive file="${USERDATA_DISK:?}",if=virtio,format=raw diff --git a/wireguard.pkr.hcl b/wireguard.pkr.hcl index 8bc3fe2..1bbd967 100644 --- a/wireguard.pkr.hcl +++ b/wireguard.pkr.hcl @@ -107,8 +107,7 @@ build { "ufw --force enable", "ufw default deny incoming", "ufw default allow outgoing", - "ufw allow from any to any port 22 proto tcp", - "ufw allow from any to any port 51820 proto udp" + "ufw allow from any to any port 22 proto tcp" ] }