working with daily selective route

src/wgsh/wg-post-up.sh → src/wgsh/backup/wg-post-up.sh

@@ -11,5 +11,6 @@ WG_PORT="51820"                  # WG udp port
 $IPT -t nat -I POSTROUTING 1 -s $SUB_NET -o $WG_FACE -j MASQUERADE
 $IPT -I FORWARD 1 -i $WG_FACE -o wg0 -j ACCEPT   #for internet
 $IPT -I FORWARD 1 -i wg0 -o $WG_FACE -j ACCEPT   #for internet
+ip rule add from 10.254.1.209/32 table main     # for ssh access
 wg set wg0 fwmark 51820
 set -e

src/wgsh/backup/wg0-post-up.sh

@@ -0,0 +1,28 @@
+#!/bin/bash
+set +e
+
+IPT="/sbin/iptables"
+IPT6="/sbin/ip6tables"
+
+IN_FACE="enp0s3"                   # NIC connected to the internet
+WG_FACE="wg0"                    # WG NIC
+SUB_NET="10.250.1.0/24"          # WG IPv4 sub/net aka CIDR
+# SUB_NET_6=""                     # Change this according 
+WG_PORT="51820"                  # WG udp port
+# WG_TABLE='10'
+
+## IPv4 ## working with single tunnel
+$IPT -I INPUT 1 -p udp --dport $WG_PORT -j ACCEPT   # for incoming connection
+$IPT -I INPUT 1 -p tcp --dport 51821 -j ACCEPT      # for webui
+$IPT -t nat -I POSTROUTING 1 -s $SUB_NET -o $IN_FACE -j MASQUERADE
+$IPT -I FORWARD 1 -i $WG_FACE -j ACCEPT   #for internet
+$IPT -I FORWARD 1 -o $WG_FACE -j ACCEPT   #for internet
+# wg set wg0 fwmark 51820
+
+## IPv6 (Uncomment) ##
+# $IPT6 -t nat -I POSTROUTING 1 -s $SUB_NET_6 -o $IN_FACE -j MASQUERADE
+# $IPT6 -I INPUT 1 -i $WG_FACE -j ACCEPT
+# $IPT6 -I FORWARD 1 -i $IN_FACE -o $WG_FACE -j ACCEPT
+# $IPT6 -I FORWARD 1 -i $WG_FACE -o $IN_FACE -j ACCEPT
+
+set -e

src/wgsh/backup/wg0-pre-down.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+set +e
+
+IPT="/sbin/iptables"
+IPT6="/sbin/ip6tables"
+
+IN_FACE="enp0s3"                   # NIC connected to the internet
+WG_FACE="wg0"                    # WG NIC
+SUB_NET="10.250.1.0/24"          # WG IPv4 sub/net aka CIDR
+#SUB_NET_6="fd42:42:42::/64"      # WG IPv6 sub/net
+WG_PORT="61820"                  # WG udp port
+WG_TABLE='10'
+
+# IPv4 rules #
+$IPT -D INPUT -p udp --dport $WG_PORT -j ACCEPT   # for incoming connection
+$IPT -D INPUT -p tcp --dport 51821 -j ACCEPT      # for webui
+$IPT -t nat -D POSTROUTING -s $SUB_NET -o $IN_FACE -j MASQUERADE
+$IPT -D FORWARD -i $WG_FACE -j ACCEPT   #for internet
+$IPT -D FORWARD -o $WG_FACE -j ACCEPT   #for internet
+
+# $IPT -t nat -D POSTROUTING -s $SUB_NET -o $IN_FACE -j MASQUERADE
+# $IPT -D FORWARD -i $IN_FACE -o $WG_FACE -j ACCEPT
+# $IPT -D FORWARD -i $WG_FACE -o $IN_FACE -j ACCEPT
+# $IPT -D INPUT -i $IN_FACE -p udp --dport $WG_PORT -j ACCEPT
+# ip rule del from all lookup $WG_TABLE pref 10
+
+# IPv6 rules (uncomment) #
+# $IPT6 -t nat -D POSTROUTING -s $SUB_NET_6 -o $IN_FACE -j MASQUERADE
+# $IPT6 -D INPUT -i $WG_FACE -j ACCEPT
+# $IPT6 -D FORWARD -i $IN_FACE -o $WG_FACE -j ACCEPT
+# $IPT6 -D FORWARD -i $WG_FACE -o $IN_FACE -j ACCEPT
+
+set -e

src/wgsh/test.sh

@@ -0,0 +1,28 @@
+sudo iptables -A INPUT -i ens3 -m comment --comment \"Accept input from tunnel adapter\" -j ACCEPT
+
+sudo iptables -A OUTPUT -s 10.210.0.0/24 -d 10.210.0.0/24 -j ACCEPT
+
+#qbittorrent container public ip
+sudo docker exec -it qbittorrent curl ipinfo.io/ip
+
+sudo ip rule del not fwmark 51820 table 51820
+
+sudo ip rule add from 10.210.0.0/24 table 51820
+
+sudo ip route add 10.210.0.0/24 dev wireguard table 51820
+
+sudo ip route add 10.250.1.0/24 dev wg0 table 51820
+
+
+#For daily server
+sudo ip rule add from 10.250.0.7/32 table 51820
+sudo ip rule del from 10.250.0.7/32 table 51820
+
+sudo ip route del 10.250.0.0/24 dev docker_daily table 51820
+
+sudo ip route del 10.250.1.0/24 dev wg0 table 51820
+
+sudo ip route add 10.254.1.29/32 dev enp0s3 table 51820
+
+PostUp = /home/ubuntu/wg-easy/src/wgsh/wg1-post-up.sh
+PreDown = /home/ubuntu/wg-easy/src/wgsh/wg1-pre-down.sh

src/wgsh/wg0-post-up.sh

@@ -17,6 +17,9 @@ $IPT -I INPUT 1 -p tcp --dport 51821 -j ACCEPT      # for webui
 $IPT -t nat -I POSTROUTING 1 -s $SUB_NET -o $IN_FACE -j MASQUERADE
 $IPT -I FORWARD 1 -i $WG_FACE -j ACCEPT   #for internet
 $IPT -I FORWARD 1 -o $WG_FACE -j ACCEPT   #for internet
+
+systemctl start mount-mypi.service
+
 # wg set wg0 fwmark 51820
 
 ## IPv6 (Uncomment) ##

src/wgsh/wg1-post-up.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+set +e
+
+ip rule del not fwmark 51820 table 51820
+
+ip route add 10.250.0.0/24 dev docker_daily table 51820
+
+ip route add 10.250.1.0/24 dev wg0 table 51820
+
+set -e

src/wgsh/wg1-pre-down.sh

@@ -0,0 +1,8 @@
+#!/bin/bash
+set +e
+
+ip route del 10.250.0.0/24 dev docker_daily table 51820
+
+ip route del 10.250.1.0/24 dev wg0 table 51820
+
+set -e