324 lines
7.3 KiB
Bash
324 lines
7.3 KiB
Bash
#!/bin/sh
|
|
. /lib/functions.sh
|
|
|
|
log() {
|
|
logger -t "Wireguard Start" "$@"
|
|
}
|
|
|
|
WG=$1
|
|
|
|
chk_zone() {
|
|
local config=$1
|
|
|
|
config_get src $config src
|
|
config_get dest $config dest
|
|
if [ $src = "lan" -a $dest = "wan" ]; then
|
|
uci set firewall."$config".dest="wg"
|
|
uci commit firewall
|
|
fi
|
|
}
|
|
|
|
do_dns() {
|
|
cdns=$1
|
|
local ifce=$2
|
|
ldns=$(uci -q get network.wg$ifce.dns)
|
|
ex=$(echo "$ldns" | grep "$cdns")
|
|
if [ -z $ex ]; then
|
|
log "Add DNS $cdns to WG$ifce"
|
|
uci add_list network.wg$ifce.dns="$cdns"
|
|
uci commit network
|
|
/etc/init.d/network reload
|
|
fi
|
|
}
|
|
|
|
do_port() {
|
|
PORT=$1
|
|
udp=$2
|
|
# look for rule for this port
|
|
INB="inbound"$PORT$udp
|
|
RULE=$(uci -q get firewall.$INB)
|
|
if [ -z $RULE ]; then
|
|
uci set firewall.$INB=rule
|
|
uci set firewall.$INB.name=$INB
|
|
uci set firewall.$INB.target=ACCEPT
|
|
uci set firewall.$INB.src=*
|
|
uci set firewall.$INB.proto=$udp
|
|
uci set firewall.$INB.dest_port=$PORT
|
|
uci commit firewall
|
|
/etc/init.d/firewall reload
|
|
fi
|
|
}
|
|
|
|
do_delete() {
|
|
local config=$1
|
|
|
|
uci delete network.$1
|
|
}
|
|
|
|
create_speer() {
|
|
local config=$1
|
|
|
|
uci set network.$config="wireguard_wg1"
|
|
|
|
config_get persistent_keepalive $config persistent_keepalive
|
|
uci set network.$config.persistent_keepalive="$persistent_keepalive"
|
|
config_get route_allowed_ips $config route_allowed_ips
|
|
uci set network.$config.route_allowed_ips="$route_allowed_ips"
|
|
config_get publickey $config publickey
|
|
uci set network.$config.public_key="$publickey"
|
|
usepre=$(uci -q get wireguard.$WG.usepre)
|
|
log "$usepre"
|
|
if [ $usepre = "1" ]; then
|
|
presharedkey=$(uci -q get wireguard.$WG.presharedkey)
|
|
log "$presharedkey"
|
|
uci set network.$config.preshared_key="$presharedkey"
|
|
fi
|
|
config_get allowed_ips $config allowed_ips
|
|
allowed_ips=$allowed_ips","
|
|
ips=$(echo $allowed_ips | cut -d, -f1)
|
|
i=1
|
|
while [ ! -z $ips ]
|
|
do
|
|
uci add_list network.$config.allowed_ips="$ips"
|
|
i=$((i+1))
|
|
ips=$(echo $allowed_ips | cut -d, -f$i)
|
|
done
|
|
|
|
}
|
|
|
|
create_cpeer() {
|
|
local config=$1
|
|
local ifce=$2
|
|
|
|
uci set network.$config="wireguard_wg$ifce"
|
|
|
|
publickey=$(uci -q get wireguard."$config".publickey)
|
|
uci set network.$config.public_key="$publickey"
|
|
presharedkey=$(uci -q get wireguard."$WG".presharedkey)
|
|
if [ ! -z $presharedkey ]; then
|
|
uci set network.$config.preshared_key="$presharedkey"
|
|
fi
|
|
persistent_keepalive=$(uci -q get wireguard."$config".persistent_keepalive)
|
|
if [ -z $persistent_keepalive ]; then
|
|
persistent_keepalive=25
|
|
fi
|
|
uci set network.$config.persistent_keepalive="$persistent_keepalive"
|
|
route_allowed_ips=1
|
|
uci set network.$config.route_allowed_ips="$route_allowed_ips"
|
|
|
|
if [ $UDP = 1 ]; then
|
|
endpoint_host="127.0.0.1"
|
|
uci set network.$config.endpoint_host="$endpoint_host"
|
|
sport=$(uci -q get wireguard."$config".port)
|
|
if [ -z $sport ]; then
|
|
sport="54321"
|
|
fi
|
|
uci set network.$config.endpoint_port="$sport"
|
|
else
|
|
endpoint_host=$(uci -q get wireguard."$config".endpoint_host)
|
|
uci set network.$config.endpoint_host="$endpoint_host"
|
|
sport=$(uci -q get wireguard."$config".sport)
|
|
if [ -z $sport ]; then
|
|
sport="51280"
|
|
fi
|
|
uci set network.$config.endpoint_port="$sport"
|
|
fi
|
|
|
|
ips=$(uci -q get wireguard."$config".ips)","
|
|
cips=$(echo $ips | cut -d, -f1)
|
|
i=1
|
|
while [ ! -z $cips ]
|
|
do
|
|
uci add_list network.$config.allowed_ips="$cips"
|
|
i=$((i+1))
|
|
cips=$(echo $ips | cut -d, -f$i)
|
|
done
|
|
}
|
|
|
|
handle_server() {
|
|
config_foreach do_delete wireguard_wg1
|
|
|
|
uci delete network.wg1
|
|
uci set network.wg1="interface"
|
|
uci set network.wg1.proto="wireguard"
|
|
|
|
auto=$(uci -q get wireguard."$WG".auto)
|
|
if [ -z $auto ]; then
|
|
auto="0"
|
|
fi
|
|
uci set network.wg1.auto="$auto"
|
|
|
|
port=$(uci -q get wireguard."$WG".port)
|
|
if [ -z $port ]; then
|
|
port="51280"
|
|
fi
|
|
uci set network.wg1.listen_port="$port"
|
|
do_port $port udp
|
|
|
|
privatekey=$(uci -q get wireguard."$WG".privatekey)
|
|
uci set network.wg1.private_key="$privatekey"
|
|
|
|
ips=$(uci -q get wireguard."$WG".addresses)","
|
|
cips=$(echo $ips | cut -d, -f1)
|
|
i=1
|
|
while [ ! -z $cips ]
|
|
do
|
|
uci add_list network.wg1.addresses="$cips"
|
|
i=$((i+1))
|
|
cips=$(echo $ips | cut -d, -f"$i")
|
|
if [ -z $cips ]; then
|
|
break
|
|
fi
|
|
done
|
|
|
|
config_load wireguard
|
|
config_foreach create_speer custom$WG
|
|
|
|
uci commit network
|
|
}
|
|
|
|
handle_client() {
|
|
ifce=$1
|
|
config_foreach do_delete wireguard_wg$ifce
|
|
|
|
uci delete network.wg$ifce
|
|
uci set network.wg$ifce="interface"
|
|
uci set network.wg$ifce.proto="wireguard"
|
|
|
|
auto=$(uci -q get wireguard."$WG".auto)
|
|
if [ -z $auto ]; then
|
|
auto="0"
|
|
fi
|
|
uci set network.wg$ifce.auto="$auto"
|
|
mtu=$(uci -q get wireguard."$WG".mtu)
|
|
if [ ! -z $mtu ]; then
|
|
uci set network.wg$ifce.mtu="$mtu"
|
|
fi
|
|
dns=$(uci -q get wireguard."$WG".dns)
|
|
if [ ! -z $dns ]; then
|
|
do_dns $dns $ifce
|
|
fi
|
|
port=$(uci -q get wireguard."$WG".port)
|
|
if [ -z $port ]; then
|
|
port="51280"
|
|
fi
|
|
uci set network.wg$ifce.listen_port="$port"
|
|
do_port $port udp
|
|
|
|
privatekey=$(uci -q get wireguard."$WG".privatekey)
|
|
uci set network.wg$ifce.private_key="$privatekey"
|
|
|
|
ips=$(uci -q get wireguard."$WG".addresses)","
|
|
cips=$(echo $ips | cut -d, -f1)
|
|
i=1
|
|
while [ ! -z "$cips" ]
|
|
do
|
|
uci add_list network.wg$ifce.addresses="$cips"
|
|
i=$((i+1))
|
|
cips=$(echo "$ips" | cut -d, -f"$i")
|
|
if [ -z "$cips" ]; then
|
|
break
|
|
fi
|
|
done
|
|
uci add_list network.wg$ifce.addresses="::/0"
|
|
|
|
create_cpeer $WG $ifce
|
|
|
|
uci commit network
|
|
}
|
|
|
|
udp_server() {
|
|
local config=$1
|
|
udpport=$(uci -q get wireguard."$WG".udpport)
|
|
if [ -z $udpport ]; then
|
|
udpport="54321"
|
|
fi
|
|
port=$(uci -q get wireguard."$WG".port)
|
|
if [ -z $port ]; then
|
|
port="54321"
|
|
fi
|
|
do_port $udpport tcp
|
|
udptunnel -s -v "0.0.0.0:"$udpport "127.0.0.1:"$port &
|
|
#log "udptunnel -s -v 0.0.0.0:$udpport 127.0.0.1:$port"
|
|
}
|
|
|
|
udp_client() {
|
|
local config=$1
|
|
port=$(uci -q get wireguard."$WG".port)
|
|
if [ -z $port ]; then
|
|
port="54321"
|
|
fi
|
|
endpoint_host=$(uci -q get wireguard.$WG.endpoint_host)
|
|
sport=$(uci -q get wireguard.$WG.sport)
|
|
if [ -z $sport ]; then
|
|
sport="51280"
|
|
fi
|
|
|
|
udptunnel "127.0.0.1:"$port $endpoint_host":"$sport &
|
|
#log "udptunnel 127.0.0.1:$port $endpoint_host:$sport"
|
|
}
|
|
|
|
forward=$(uci -q get wireguard."$WG".forward)
|
|
if [ "$forward" != "0" ]; then
|
|
config_load firewall
|
|
config_foreach chk_zone forwarding
|
|
else
|
|
uci set firewall.wgwforward=forwarding
|
|
uci set firewall.wgwforward.dest="wan"
|
|
uci set firewall.wgwforward.src="wg"
|
|
|
|
uci set firewall.wwgforward=forwarding
|
|
uci set firewall.wwgforward.dest="wg"
|
|
uci set firewall.wwgforward.src="wan"
|
|
|
|
uci set firewall.lwgforward=forwarding
|
|
uci set firewall.lwgforward.dest="wg"
|
|
uci set firewall.lwgforward.src="lan"
|
|
|
|
uci set firewall.wglforward=forwarding
|
|
uci set firewall.wglforward.dest="lan"
|
|
uci set firewall.wglforward.src="wg"
|
|
uci commit firewall
|
|
fi
|
|
etc/init.d/firewall restart
|
|
|
|
config_load network
|
|
SERVE=$(uci -q get wireguard."$WG".client)
|
|
if [ $SERVE = "0" ]; then
|
|
running=$(uci -q get wireguard.settings.server)
|
|
if [ $running = 1 ]; then
|
|
exit 0
|
|
fi
|
|
UDP=$(uci -q get wireguard."$WG".udptunnel)
|
|
if [ $UDP = 1 ]; then
|
|
udp_server $WG
|
|
fi
|
|
handle_server
|
|
uci commit network
|
|
ifup wg1
|
|
sleep 2
|
|
uci set wireguard.settings.server="1"
|
|
else
|
|
running=$(uci -q get wireguard.settings.client)
|
|
log "Client running $running"
|
|
|
|
INTER=$(uci -q get wireguard."$WG".wginter)
|
|
if [ -z "$INTER" ]; then
|
|
INTER=0
|
|
fi
|
|
UDP=$(uci -q get wireguard."$WG".udptunnel)
|
|
if [ $UDP = 1 ]; then
|
|
udp_client $WG
|
|
fi
|
|
handle_client $INTER
|
|
uci commit network
|
|
log "Start Interface"
|
|
ifup wg$INTER
|
|
sleep 2
|
|
uci set wireguard.settings.client="1"
|
|
fi
|
|
|
|
uci set wireguard."$WG".active="1"
|
|
uci commit wireguard
|
|
|