Merge pull request #1 from joelheaps/master

Use unique /64 ULA prefix by default

README.md

@@ -86,7 +86,7 @@ These options can be configured by setting environment variables using `-e KEY="
 | `WG_MTU` | `null` | `1420` | The MTU the clients will use. Server uses default WG MTU. |
 | `WG_PERSISTENT_KEEPALIVE` | `0` | `25` | Value in seconds to keep the "connection" open. |
 | `WG_DEFAULT_ADDRESS` | `10.8.0.x` | `10.6.0.x` | Clients IP address range. |
-| `WG_DEFAULT_ADDRESS6` | `fd00::cafe:x` | `fd00::42:x` | Clients IPv6 address range. Has to be a valid IPv6 ULA address. |
+| `WG_DEFAULT_ADDRESS6` | `fdcc:ad94:bacf:61a4::cafe:x` | `fdcc:ad94:bacf:61a4::42:x` | Clients IPv6 address range. Has to be a valid IPv6 ULA address. |
 | `WG_DEFAULT_DNS` | `1.1.1.1` | `8.8.8.8, 8.8.4.4` | DNS server clients will use. |
 | `WG_DEFAULT_DNS6` | `2606:4700:4700::1111` | `2606:4700:4700::1001, 2606:4700:4700::1111` | DNSv6 server clients will use. |
 | `WG_ALLOWED_IPS` | `0.0.0.0/0, ::/0` | `192.168.15.0/24, 10.0.1.0/24` | Allowed IPs clients will use. |

docker-compose.yml

@@ -11,7 +11,7 @@ services:
       # - PASSWORD=foobar123
       # - WG_PORT=51820
       # - WG_DEFAULT_ADDRESS=10.8.0.x
-      # - WG_DEFAULT_ADDRESS6=fd00::cafe:x
+      # - WG_DEFAULT_ADDRESS6=fdcc:ad94:bacf:61a4::cafe:x
       # - WG_DEFAULT_DNS=1.0.0.1
       # - WG_DEFAULT_DNS6=2606:4700:4700::1001
       # - WG_MTU=1420
@@ -22,7 +22,7 @@ services:
     networks:
       wg:
         ipv4_address: 10.42.42.42
-        ipv6_address: fd00::2a
+        ipv6_address: fdcc:ad94:bacf:61a3::2a
     volumes:
       - .:/etc/wireguard
     ports:
@@ -47,4 +47,4 @@ networks:
       driver: default
       config:
         - subnet: 10.42.42.0/24
-        - subnet: fd00::0/112
+        - subnet: fdcc:ad94:bacf:61a3::/64

src/config.js

@@ -11,7 +11,7 @@ module.exports.WG_PORT = process.env.WG_PORT || 51820;
 module.exports.WG_MTU = process.env.WG_MTU || null;
 module.exports.WG_PERSISTENT_KEEPALIVE = process.env.WG_PERSISTENT_KEEPALIVE || 0;
 module.exports.WG_DEFAULT_ADDRESS = process.env.WG_DEFAULT_ADDRESS || '10.8.0.x';
-module.exports.WG_DEFAULT_ADDRESS6 = process.env.WG_DEFAULT_ADDRESS6 || 'fd00::cafe:x';
+module.exports.WG_DEFAULT_ADDRESS6 = process.env.WG_DEFAULT_ADDRESS6 || 'fdcc:ad94:bacf:61a4::cafe:x';
 module.exports.WG_DEFAULT_DNS = typeof process.env.WG_DEFAULT_DNS === 'string'
   ? process.env.WG_DEFAULT_DNS
   : '1.1.1.1';
@@ -25,11 +25,10 @@ iptables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS.replace('x
 iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT;
 iptables -A FORWARD -i wg0 -j ACCEPT;
 iptables -A FORWARD -o wg0 -j ACCEPT;
-ip6tables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS6.replace('x', '0')}/120 -o eth0 -j MASQUERADE;
+ip6tables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS6.replace('x', '0')}/64 -o eth0 -j MASQUERADE;
 ip6tables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT;
 ip6tables -A FORWARD -i wg0 -j ACCEPT;
 ip6tables -A FORWARD -o wg0 -j ACCEPT;
 `.split('\n').join(' ');
 
-
 module.exports.WG_POST_DOWN = process.env.WG_POST_DOWN || '';

src/lib/WireGuard.js

@@ -206,7 +206,7 @@ AllowedIPs = ${client.address}/32, ${client.address6}/128`;
     return `
 [Interface]
 PrivateKey = ${client.privateKey}
-Address = ${client.address}/24, ${client.address6}/120
+Address = ${client.address}/24, ${client.address6}/64
 ${isDnsSet ? `DNS = ${dnsServers}` : ''}
 ${WG_MTU ? `MTU = ${WG_MTU}` : ''}