diff --git a/docker-compose.yml b/docker-compose.yml index 34833c98..4ccd6590 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,4 +1,4 @@ -version: "3.8" +version: "2.4" services: wg-easy: diff --git a/src/config.js b/src/config.js index 628815dc..ed628aa8 100644 --- a/src/config.js +++ b/src/config.js @@ -1,6 +1,7 @@ 'use strict'; const { release } = require('./package.json'); +const childProcess = require('child_process'); module.exports.RELEASE = release; module.exports.PORT = process.env.PORT || 51821; @@ -20,15 +21,28 @@ module.exports.WG_DEFAULT_DNS6 = typeof process.env.WG_DEFAULT_DNS6 === 'string' : '2606:4700:4700::1111'; module.exports.WG_ALLOWED_IPS = process.env.WG_ALLOWED_IPS || '0.0.0.0/0, ::/0'; -module.exports.WG_POST_UP = process.env.WG_POST_UP || ` -iptables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE; -iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; -iptables -A FORWARD -i wg0 -j ACCEPT; -iptables -A FORWARD -o wg0 -j ACCEPT; -ip6tables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS6.replace('x', '0')}/64 -o eth0 -j MASQUERADE; -ip6tables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; -ip6tables -A FORWARD -i wg0 -j ACCEPT; -ip6tables -A FORWARD -o wg0 -j ACCEPT; -`.split('\n').join(' '); +// Set WG_POST_UP to allow IPv6 NAT and forwarding only if the required kernel module is available +const modules = childProcess.execSync('lsmod', { + shell: 'bash', +}) + +module.exports.WG_POST_UP = process.env.WG_POST_UP +if (!process.env.WG_POST_UP) { + module.exports.WG_POST_UP = ` + iptables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE; + iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; + iptables -A FORWARD -i wg0 -j ACCEPT; + iptables -A FORWARD -o wg0 -j ACCEPT;` + + if (modules.includes("ip6table_nat")) { + module.exports.WG_POST_UP += `ip6tables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS6.replace('x', '0')}/64 -o eth0 -j MASQUERADE; + ip6tables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; + ip6tables -A FORWARD -i wg0 -j ACCEPT; + ip6tables -A FORWARD -o wg0 -j ACCEPT;` + } + + module.exports.WG_POST_UP = module.exports.WG_POST_UP.split('\n').join(' '); +} + module.exports.WG_POST_DOWN = process.env.WG_POST_DOWN || '';