From 5d0d6c378fda978a36e9e80a04891b8eb62a169f Mon Sep 17 00:00:00 2001 From: Joel Heaps Date: Fri, 28 Jan 2022 11:49:42 -0600 Subject: [PATCH 1/6] Change compose version to 2.4 to allow enable_ipv6 --- docker-compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docker-compose.yml b/docker-compose.yml index 4b1f53fd..7a3f5dd3 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -1,4 +1,4 @@ -version: "3.8" +version: "2.4" services: wg-easy: From 40b330728fe9be9911a9df08eeaf824eece58d32 Mon Sep 17 00:00:00 2001 From: Joel Heaps Date: Fri, 28 Jan 2022 11:58:36 -0600 Subject: [PATCH 2/6] Check kernel modules before enabling IPv6 NAT --- src/config.js | 35 +++++++++++++++++++++++++---------- 1 file changed, 25 insertions(+), 10 deletions(-) diff --git a/src/config.js b/src/config.js index 628815dc..5f4ea7a2 100644 --- a/src/config.js +++ b/src/config.js @@ -1,6 +1,7 @@ 'use strict'; const { release } = require('./package.json'); +const childProcess = require('child_process'); module.exports.RELEASE = release; module.exports.PORT = process.env.PORT || 51821; @@ -20,15 +21,29 @@ module.exports.WG_DEFAULT_DNS6 = typeof process.env.WG_DEFAULT_DNS6 === 'string' : '2606:4700:4700::1111'; module.exports.WG_ALLOWED_IPS = process.env.WG_ALLOWED_IPS || '0.0.0.0/0, ::/0'; -module.exports.WG_POST_UP = process.env.WG_POST_UP || ` -iptables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE; -iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; -iptables -A FORWARD -i wg0 -j ACCEPT; -iptables -A FORWARD -o wg0 -j ACCEPT; -ip6tables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS6.replace('x', '0')}/64 -o eth0 -j MASQUERADE; -ip6tables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; -ip6tables -A FORWARD -i wg0 -j ACCEPT; -ip6tables -A FORWARD -o wg0 -j ACCEPT; -`.split('\n').join(' '); +// Set WG_POST_UP to allow IPv6 NAT and forwarding only if the required kernel module is available +const modules = childProcess.execSync('lsmod', { + shell: 'bash', +}) + +if (modules.includes("ip6table_nat")) { + module.exports.WG_POST_UP = process.env.WG_POST_UP || ` + iptables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE; + iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; + iptables -A FORWARD -i wg0 -j ACCEPT; + iptables -A FORWARD -o wg0 -j ACCEPT; + ip6tables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS6.replace('x', '0')}/64 -o eth0 -j MASQUERADE; + ip6tables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; + ip6tables -A FORWARD -i wg0 -j ACCEPT; + ip6tables -A FORWARD -o wg0 -j ACCEPT; + `.split('\n').join(' '); +} else { + module.exports.WG_POST_UP = process.env.WG_POST_UP || ` + iptables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE; + iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; + iptables -A FORWARD -i wg0 -j ACCEPT; + iptables -A FORWARD -o wg0 -j ACCEPT; + `.split('\n').join(' '); +} module.exports.WG_POST_DOWN = process.env.WG_POST_DOWN || ''; From 6b3633c5ad8486813ee3cec4cb3bf7ff6bed979b Mon Sep 17 00:00:00 2001 From: Joel Heaps Date: Fri, 28 Jan 2022 12:10:50 -0600 Subject: [PATCH 3/6] Revert "Switch to randomly generated ULA and /64 prefix" (Keeping PRs separate) --- README.md | 2 +- docker-compose.yml | 6 +++--- src/config.js | 7 ++++--- src/lib/WireGuard.js | 2 +- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index a681ff57..fa9b7444 100644 --- a/README.md +++ b/README.md @@ -86,7 +86,7 @@ These options can be configured by setting environment variables using `-e KEY=" | `WG_MTU` | `null` | `1420` | The MTU the clients will use. Server uses default WG MTU. | | `WG_PERSISTENT_KEEPALIVE` | `0` | `25` | Value in seconds to keep the "connection" open. | | `WG_DEFAULT_ADDRESS` | `10.8.0.x` | `10.6.0.x` | Clients IP address range. | -| `WG_DEFAULT_ADDRESS6` | `fdcc:ad94:bacf:61a4::cafe:x` | `fdcc:ad94:bacf:61a4::42:x` | Clients IPv6 address range. Has to be a valid IPv6 ULA address. | +| `WG_DEFAULT_ADDRESS6` | `fd00::cafe:x` | `fd00::42:x` | Clients IPv6 address range. Has to be a valid IPv6 ULA address. | | `WG_DEFAULT_DNS` | `1.1.1.1` | `8.8.8.8, 8.8.4.4` | DNS server clients will use. | | `WG_DEFAULT_DNS6` | `2606:4700:4700::1111` | `2606:4700:4700::1001, 2606:4700:4700::1111` | DNSv6 server clients will use. | | `WG_ALLOWED_IPS` | `0.0.0.0/0, ::/0` | `192.168.15.0/24, 10.0.1.0/24` | Allowed IPs clients will use. | diff --git a/docker-compose.yml b/docker-compose.yml index 7a3f5dd3..7aed71e3 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -11,7 +11,7 @@ services: # - PASSWORD=foobar123 # - WG_PORT=51820 # - WG_DEFAULT_ADDRESS=10.8.0.x - # - WG_DEFAULT_ADDRESS6=fdcc:ad94:bacf:61a4::cafe:x + # - WG_DEFAULT_ADDRESS6=fd00::cafe:x # - WG_DEFAULT_DNS=1.0.0.1 # - WG_DEFAULT_DNS6=2606:4700:4700::1001 # - WG_MTU=1420 @@ -22,7 +22,7 @@ services: networks: wg: ipv4_address: 10.42.42.42 - ipv6_address: fdcc:ad94:bacf:61a4::2a + ipv6_address: fd00::2a volumes: - .:/etc/wireguard ports: @@ -47,4 +47,4 @@ networks: driver: default config: - subnet: 10.42.42.0/24 - - subnet: fdcc:ad94:bacf:61a4::/64 + - subnet: fd00::0/112 diff --git a/src/config.js b/src/config.js index 5f4ea7a2..379333aa 100644 --- a/src/config.js +++ b/src/config.js @@ -12,13 +12,13 @@ module.exports.WG_PORT = process.env.WG_PORT || 51820; module.exports.WG_MTU = process.env.WG_MTU || null; module.exports.WG_PERSISTENT_KEEPALIVE = process.env.WG_PERSISTENT_KEEPALIVE || 0; module.exports.WG_DEFAULT_ADDRESS = process.env.WG_DEFAULT_ADDRESS || '10.8.0.x'; -module.exports.WG_DEFAULT_ADDRESS6 = process.env.WG_DEFAULT_ADDRESS6 || 'fdcc:ad94:bacf:61a4::cafe:x'; +module.exports.WG_DEFAULT_ADDRESS6 = process.env.WG_DEFAULT_ADDRESS6 || 'fd00::cafe:x'; module.exports.WG_DEFAULT_DNS = typeof process.env.WG_DEFAULT_DNS === 'string' ? process.env.WG_DEFAULT_DNS : '1.1.1.1'; module.exports.WG_DEFAULT_DNS6 = typeof process.env.WG_DEFAULT_DNS6 === 'string' - ? process.env.WG_DEFAULT_DNS6 - : '2606:4700:4700::1111'; + ? process.env.WG_DEFAULT_DNS6 + : '2606:4700:4700::1111'; module.exports.WG_ALLOWED_IPS = process.env.WG_ALLOWED_IPS || '0.0.0.0/0, ::/0'; // Set WG_POST_UP to allow IPv6 NAT and forwarding only if the required kernel module is available @@ -46,4 +46,5 @@ if (modules.includes("ip6table_nat")) { `.split('\n').join(' '); } + module.exports.WG_POST_DOWN = process.env.WG_POST_DOWN || ''; diff --git a/src/lib/WireGuard.js b/src/lib/WireGuard.js index 26e91bdb..d97a4d04 100644 --- a/src/lib/WireGuard.js +++ b/src/lib/WireGuard.js @@ -206,7 +206,7 @@ AllowedIPs = ${client.address}/32, ${client.address6}/128`; return ` [Interface] PrivateKey = ${client.privateKey} -Address = ${client.address}/24, ${client.address6}/64 +Address = ${client.address}/24, ${client.address6}/120 ${isDnsSet ? `DNS = ${dnsServers}` : ''} ${WG_MTU ? `MTU = ${WG_MTU}` : ''} From 33aba0793dd99210574fa3a709c378d70ee3d0d8 Mon Sep 17 00:00:00 2001 From: Joel Heaps <13434824+joelheaps@users.noreply.github.com> Date: Fri, 28 Jan 2022 16:01:01 -0600 Subject: [PATCH 4/6] Eliminate redundant config in src/config.js Co-authored-by: crazyracer98 <8631139+crazyracer98@users.noreply.github.com> --- src/config.js | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/src/config.js b/src/config.js index 379333aa..404e9d26 100644 --- a/src/config.js +++ b/src/config.js @@ -26,24 +26,22 @@ const modules = childProcess.execSync('lsmod', { shell: 'bash', }) -if (modules.includes("ip6table_nat")) { - module.exports.WG_POST_UP = process.env.WG_POST_UP || ` +module.exports.WG_POST_UP = process.env.WG_POST_UP +if (!!process.env.WG_POST_UP) { + module.exports.WG_POST_UP = ` iptables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE; iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; iptables -A FORWARD -i wg0 -j ACCEPT; - iptables -A FORWARD -o wg0 -j ACCEPT; - ip6tables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS6.replace('x', '0')}/64 -o eth0 -j MASQUERADE; + iptables -A FORWARD -o wg0 -j ACCEPT;` + + if (modules.includes("ip6table_nat")) { + module.exports.WG_POST_UP += `ip6tables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS6.replace('x', '0')}/64 -o eth0 -j MASQUERADE; ip6tables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; ip6tables -A FORWARD -i wg0 -j ACCEPT; - ip6tables -A FORWARD -o wg0 -j ACCEPT; - `.split('\n').join(' '); -} else { - module.exports.WG_POST_UP = process.env.WG_POST_UP || ` - iptables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE; - iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; - iptables -A FORWARD -i wg0 -j ACCEPT; - iptables -A FORWARD -o wg0 -j ACCEPT; - `.split('\n').join(' '); + ip6tables -A FORWARD -o wg0 -j ACCEPT;` + } + + module.exports.WG_POST_UP = module.exports.WG_POST_UP.split('\n').join(' '); } From 05941cbda5c4134b3ecbe237688856630d660f67 Mon Sep 17 00:00:00 2001 From: Joel Heaps <13434824+joelheaps@users.noreply.github.com> Date: Fri, 28 Jan 2022 20:50:21 -0600 Subject: [PATCH 5/6] Update src/config.js Co-authored-by: crazyracer98 <8631139+crazyracer98@users.noreply.github.com> --- src/config.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/config.js b/src/config.js index 404e9d26..41131558 100644 --- a/src/config.js +++ b/src/config.js @@ -27,7 +27,7 @@ const modules = childProcess.execSync('lsmod', { }) module.exports.WG_POST_UP = process.env.WG_POST_UP -if (!!process.env.WG_POST_UP) { +if (!process.env.WG_POST_UP) { module.exports.WG_POST_UP = ` iptables -t nat -A POSTROUTING -s ${module.exports.WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o eth0 -j MASQUERADE; iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT; From 1efce4efce701ebace3a6e4e3ed97098befa495e Mon Sep 17 00:00:00 2001 From: crazyracer98 <8631139+crazyracer98@users.noreply.github.com> Date: Sat, 29 Jan 2022 13:34:14 +0100 Subject: [PATCH 6/6] fix IPv6 addresses and ranges --- README.md | 2 +- docker-compose.yml | 2 +- src/config.js | 6 +++--- src/lib/WireGuard.js | 2 +- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index fa9b7444..a681ff57 100644 --- a/README.md +++ b/README.md @@ -86,7 +86,7 @@ These options can be configured by setting environment variables using `-e KEY=" | `WG_MTU` | `null` | `1420` | The MTU the clients will use. Server uses default WG MTU. | | `WG_PERSISTENT_KEEPALIVE` | `0` | `25` | Value in seconds to keep the "connection" open. | | `WG_DEFAULT_ADDRESS` | `10.8.0.x` | `10.6.0.x` | Clients IP address range. | -| `WG_DEFAULT_ADDRESS6` | `fd00::cafe:x` | `fd00::42:x` | Clients IPv6 address range. Has to be a valid IPv6 ULA address. | +| `WG_DEFAULT_ADDRESS6` | `fdcc:ad94:bacf:61a4::cafe:x` | `fdcc:ad94:bacf:61a4::42:x` | Clients IPv6 address range. Has to be a valid IPv6 ULA address. | | `WG_DEFAULT_DNS` | `1.1.1.1` | `8.8.8.8, 8.8.4.4` | DNS server clients will use. | | `WG_DEFAULT_DNS6` | `2606:4700:4700::1111` | `2606:4700:4700::1001, 2606:4700:4700::1111` | DNSv6 server clients will use. | | `WG_ALLOWED_IPS` | `0.0.0.0/0, ::/0` | `192.168.15.0/24, 10.0.1.0/24` | Allowed IPs clients will use. | diff --git a/docker-compose.yml b/docker-compose.yml index 86f07109..4ccd6590 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -11,7 +11,7 @@ services: # - PASSWORD=foobar123 # - WG_PORT=51820 # - WG_DEFAULT_ADDRESS=10.8.0.x - # - WG_DEFAULT_ADDRESS6=fd00::cafe:x + # - WG_DEFAULT_ADDRESS6=fdcc:ad94:bacf:61a4::cafe:x # - WG_DEFAULT_DNS=1.0.0.1 # - WG_DEFAULT_DNS6=2606:4700:4700::1001 # - WG_MTU=1420 diff --git a/src/config.js b/src/config.js index 41131558..ed628aa8 100644 --- a/src/config.js +++ b/src/config.js @@ -12,13 +12,13 @@ module.exports.WG_PORT = process.env.WG_PORT || 51820; module.exports.WG_MTU = process.env.WG_MTU || null; module.exports.WG_PERSISTENT_KEEPALIVE = process.env.WG_PERSISTENT_KEEPALIVE || 0; module.exports.WG_DEFAULT_ADDRESS = process.env.WG_DEFAULT_ADDRESS || '10.8.0.x'; -module.exports.WG_DEFAULT_ADDRESS6 = process.env.WG_DEFAULT_ADDRESS6 || 'fd00::cafe:x'; +module.exports.WG_DEFAULT_ADDRESS6 = process.env.WG_DEFAULT_ADDRESS6 || 'fdcc:ad94:bacf:61a4::cafe:x'; module.exports.WG_DEFAULT_DNS = typeof process.env.WG_DEFAULT_DNS === 'string' ? process.env.WG_DEFAULT_DNS : '1.1.1.1'; module.exports.WG_DEFAULT_DNS6 = typeof process.env.WG_DEFAULT_DNS6 === 'string' - ? process.env.WG_DEFAULT_DNS6 - : '2606:4700:4700::1111'; + ? process.env.WG_DEFAULT_DNS6 + : '2606:4700:4700::1111'; module.exports.WG_ALLOWED_IPS = process.env.WG_ALLOWED_IPS || '0.0.0.0/0, ::/0'; // Set WG_POST_UP to allow IPv6 NAT and forwarding only if the required kernel module is available diff --git a/src/lib/WireGuard.js b/src/lib/WireGuard.js index d97a4d04..26e91bdb 100644 --- a/src/lib/WireGuard.js +++ b/src/lib/WireGuard.js @@ -206,7 +206,7 @@ AllowedIPs = ${client.address}/32, ${client.address6}/128`; return ` [Interface] PrivateKey = ${client.privateKey} -Address = ${client.address}/24, ${client.address6}/120 +Address = ${client.address}/24, ${client.address6}/64 ${isDnsSet ? `DNS = ${dnsServers}` : ''} ${WG_MTU ? `MTU = ${WG_MTU}` : ''}