diff --git a/src/wgsh/wg-post-down.sh.bak b/src/wgsh/backup/wg-post-down.sh.bak similarity index 100% rename from src/wgsh/wg-post-down.sh.bak rename to src/wgsh/backup/wg-post-down.sh.bak diff --git a/src/wgsh/wg-post-up.sh b/src/wgsh/backup/wg-post-up.sh similarity index 86% rename from src/wgsh/wg-post-up.sh rename to src/wgsh/backup/wg-post-up.sh index ac315750..b883b257 100644 --- a/src/wgsh/wg-post-up.sh +++ b/src/wgsh/backup/wg-post-up.sh @@ -11,5 +11,6 @@ WG_PORT="51820" # WG udp port $IPT -t nat -I POSTROUTING 1 -s $SUB_NET -o $WG_FACE -j MASQUERADE $IPT -I FORWARD 1 -i $WG_FACE -o wg0 -j ACCEPT #for internet $IPT -I FORWARD 1 -i wg0 -o $WG_FACE -j ACCEPT #for internet +ip rule add from 10.254.1.209/32 table main # for ssh access wg set wg0 fwmark 51820 set -e \ No newline at end of file diff --git a/src/wgsh/wg-pre-down.sh b/src/wgsh/backup/wg-pre-down.sh similarity index 100% rename from src/wgsh/wg-pre-down.sh rename to src/wgsh/backup/wg-pre-down.sh diff --git a/src/wgsh/wg-pre-up.sh b/src/wgsh/backup/wg-pre-up.sh similarity index 100% rename from src/wgsh/wg-pre-up.sh rename to src/wgsh/backup/wg-pre-up.sh diff --git a/src/wgsh/backup/wg0-post-up.sh b/src/wgsh/backup/wg0-post-up.sh new file mode 100644 index 00000000..f9f89b66 --- /dev/null +++ b/src/wgsh/backup/wg0-post-up.sh @@ -0,0 +1,28 @@ +#!/bin/bash +set +e + +IPT="/sbin/iptables" +IPT6="/sbin/ip6tables" + +IN_FACE="enp0s3" # NIC connected to the internet +WG_FACE="wg0" # WG NIC +SUB_NET="10.250.1.0/24" # WG IPv4 sub/net aka CIDR +# SUB_NET_6="" # Change this according +WG_PORT="51820" # WG udp port +# WG_TABLE='10' + +## IPv4 ## working with single tunnel +$IPT -I INPUT 1 -p udp --dport $WG_PORT -j ACCEPT # for incoming connection +$IPT -I INPUT 1 -p tcp --dport 51821 -j ACCEPT # for webui +$IPT -t nat -I POSTROUTING 1 -s $SUB_NET -o $IN_FACE -j MASQUERADE +$IPT -I FORWARD 1 -i $WG_FACE -j ACCEPT #for internet +$IPT -I FORWARD 1 -o $WG_FACE -j ACCEPT #for internet +# wg set wg0 fwmark 51820 + +## IPv6 (Uncomment) ## +# $IPT6 -t nat -I POSTROUTING 1 -s $SUB_NET_6 -o $IN_FACE -j MASQUERADE +# $IPT6 -I INPUT 1 -i $WG_FACE -j ACCEPT +# $IPT6 -I FORWARD 1 -i $IN_FACE -o $WG_FACE -j ACCEPT +# $IPT6 -I FORWARD 1 -i $WG_FACE -o $IN_FACE -j ACCEPT + +set -e \ No newline at end of file diff --git a/src/wgsh/backup/wg0-pre-down.sh b/src/wgsh/backup/wg0-pre-down.sh new file mode 100644 index 00000000..6d5a174c --- /dev/null +++ b/src/wgsh/backup/wg0-pre-down.sh @@ -0,0 +1,33 @@ +#!/bin/bash +set +e + +IPT="/sbin/iptables" +IPT6="/sbin/ip6tables" + +IN_FACE="enp0s3" # NIC connected to the internet +WG_FACE="wg0" # WG NIC +SUB_NET="10.250.1.0/24" # WG IPv4 sub/net aka CIDR +#SUB_NET_6="fd42:42:42::/64" # WG IPv6 sub/net +WG_PORT="61820" # WG udp port +WG_TABLE='10' + +# IPv4 rules # +$IPT -D INPUT -p udp --dport $WG_PORT -j ACCEPT # for incoming connection +$IPT -D INPUT -p tcp --dport 51821 -j ACCEPT # for webui +$IPT -t nat -D POSTROUTING -s $SUB_NET -o $IN_FACE -j MASQUERADE +$IPT -D FORWARD -i $WG_FACE -j ACCEPT #for internet +$IPT -D FORWARD -o $WG_FACE -j ACCEPT #for internet + +# $IPT -t nat -D POSTROUTING -s $SUB_NET -o $IN_FACE -j MASQUERADE +# $IPT -D FORWARD -i $IN_FACE -o $WG_FACE -j ACCEPT +# $IPT -D FORWARD -i $WG_FACE -o $IN_FACE -j ACCEPT +# $IPT -D INPUT -i $IN_FACE -p udp --dport $WG_PORT -j ACCEPT +# ip rule del from all lookup $WG_TABLE pref 10 + +# IPv6 rules (uncomment) # +# $IPT6 -t nat -D POSTROUTING -s $SUB_NET_6 -o $IN_FACE -j MASQUERADE +# $IPT6 -D INPUT -i $WG_FACE -j ACCEPT +# $IPT6 -D FORWARD -i $IN_FACE -o $WG_FACE -j ACCEPT +# $IPT6 -D FORWARD -i $WG_FACE -o $IN_FACE -j ACCEPT + +set -e \ No newline at end of file diff --git a/src/wgsh/test.sh b/src/wgsh/test.sh new file mode 100644 index 00000000..a3eab281 --- /dev/null +++ b/src/wgsh/test.sh @@ -0,0 +1,28 @@ +sudo iptables -A INPUT -i ens3 -m comment --comment \"Accept input from tunnel adapter\" -j ACCEPT + +sudo iptables -A OUTPUT -s 10.210.0.0/24 -d 10.210.0.0/24 -j ACCEPT + +#qbittorrent container public ip +sudo docker exec -it qbittorrent curl ipinfo.io/ip + +sudo ip rule del not fwmark 51820 table 51820 + +sudo ip rule add from 10.210.0.0/24 table 51820 + +sudo ip route add 10.210.0.0/24 dev wireguard table 51820 + +sudo ip route add 10.250.1.0/24 dev wg0 table 51820 + + +#For daily server +sudo ip rule add from 10.250.0.7/32 table 51820 +sudo ip rule del from 10.250.0.7/32 table 51820 + +sudo ip route del 10.250.0.0/24 dev docker_daily table 51820 + +sudo ip route del 10.250.1.0/24 dev wg0 table 51820 + +sudo ip route add 10.254.1.29/32 dev enp0s3 table 51820 + +PostUp = /home/ubuntu/wg-easy/src/wgsh/wg1-post-up.sh +PreDown = /home/ubuntu/wg-easy/src/wgsh/wg1-pre-down.sh \ No newline at end of file diff --git a/src/wgsh/wg0-post-up.sh b/src/wgsh/wg0-post-up.sh index f9f89b66..1bf5460e 100644 --- a/src/wgsh/wg0-post-up.sh +++ b/src/wgsh/wg0-post-up.sh @@ -17,6 +17,9 @@ $IPT -I INPUT 1 -p tcp --dport 51821 -j ACCEPT # for webui $IPT -t nat -I POSTROUTING 1 -s $SUB_NET -o $IN_FACE -j MASQUERADE $IPT -I FORWARD 1 -i $WG_FACE -j ACCEPT #for internet $IPT -I FORWARD 1 -o $WG_FACE -j ACCEPT #for internet + +systemctl start mount-mypi.service + # wg set wg0 fwmark 51820 ## IPv6 (Uncomment) ## diff --git a/src/wgsh/wg1-post-up.sh b/src/wgsh/wg1-post-up.sh new file mode 100644 index 00000000..d7e72f06 --- /dev/null +++ b/src/wgsh/wg1-post-up.sh @@ -0,0 +1,10 @@ +#!/bin/bash +set +e + +ip rule del not fwmark 51820 table 51820 + +ip route add 10.250.0.0/24 dev docker_daily table 51820 + +ip route add 10.250.1.0/24 dev wg0 table 51820 + +set -e \ No newline at end of file diff --git a/src/wgsh/wg1-pre-down.sh b/src/wgsh/wg1-pre-down.sh new file mode 100644 index 00000000..498902ad --- /dev/null +++ b/src/wgsh/wg1-pre-down.sh @@ -0,0 +1,8 @@ +#!/bin/bash +set +e + +ip route del 10.250.0.0/24 dev docker_daily table 51820 + +ip route del 10.250.1.0/24 dev wg0 table 51820 + +set -e \ No newline at end of file