From e987bde456038b723f80339cdce15866aa481a2c Mon Sep 17 00:00:00 2001 From: BrainStone Date: Sun, 19 Feb 2023 06:18:18 +0100 Subject: [PATCH] Added option to enforce AllowedIPs --- README.md | 1 + src/config.js | 1 + src/lib/WireGuard.js | 9 ++++++++- 3 files changed, 10 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 6daca1b2..2efc136d 100644 --- a/README.md +++ b/README.md @@ -89,6 +89,7 @@ These options can be configured by setting environment variables using `-e KEY=" | `WG_DEFAULT_ADDRESS` | `10.8.0.x` | `10.6.0.x` | Clients IP address range. | | `WG_DEFAULT_DNS` | `1.1.1.1` | `8.8.8.8, 8.8.4.4` | DNS server clients will use. | | `WG_ALLOWED_IPS` | `0.0.0.0/0, ::/0` | `192.168.15.0/24, 10.0.1.0/24` | Allowed IPs clients will use. | +| `ENFORCE_WG_ALLOWED_IPS` | `false` | `true` | If enabled, we restrict the clients to `WG_ALLOWED_IPS`. As the clients are able to change their allowed IPs, this will prevent them from accessing anything outside what they are supposed to. | | `WG_PRE_UP` | `...` | - | See [config.js](https://github.com/WeeJeWel/wg-easy/blob/master/src/config.js#L19) for the default value. | | `WG_POST_UP` | `...` | `iptables ...` | See [config.js](https://github.com/WeeJeWel/wg-easy/blob/master/src/config.js#L20) for the default value. | | `WG_PRE_DOWN` | `...` | - | See [config.js](https://github.com/WeeJeWel/wg-easy/blob/master/src/config.js#L27) for the default value. | diff --git a/src/config.js b/src/config.js index 28c9fc5a..0d9cb721 100644 --- a/src/config.js +++ b/src/config.js @@ -15,6 +15,7 @@ module.exports.WG_DEFAULT_DNS = typeof process.env.WG_DEFAULT_DNS === 'string' ? process.env.WG_DEFAULT_DNS : '1.1.1.1'; module.exports.WG_ALLOWED_IPS = process.env.WG_ALLOWED_IPS || '0.0.0.0/0, ::/0'; +module.exports.ENFORCE_WG_ALLOWED_IPS = Boolean(process.env.ENFORCE_WG_ALLOWED_IPS || false); module.exports.WG_PRE_UP = process.env.WG_PRE_UP || ''; module.exports.WG_POST_UP = process.env.WG_POST_UP || ` diff --git a/src/lib/WireGuard.js b/src/lib/WireGuard.js index 7886ac91..7433c213 100644 --- a/src/lib/WireGuard.js +++ b/src/lib/WireGuard.js @@ -19,6 +19,7 @@ const { WG_DEFAULT_ADDRESS, WG_PERSISTENT_KEEPALIVE, WG_ALLOWED_IPS, + ENFORCE_WG_ALLOWED_IPS, WG_PRE_UP, WG_POST_UP, WG_PRE_DOWN, @@ -96,7 +97,13 @@ module.exports = class WireGuard { PrivateKey = ${config.server.privateKey} Address = ${config.server.address}/24 ListenPort = 51820 -PreUp = ${WG_PRE_UP} +`; + + if (ENFORCE_WG_ALLOWED_IPS) { + result += `AllowedIPs = ${WG_ALLOWED_IPS}\n`; + } + + result += `PreUp = ${WG_PRE_UP} PostUp = ${WG_POST_UP} PreDown = ${WG_PRE_DOWN} PostDown = ${WG_POST_DOWN}