* fix(ui):Error pops up when enabling disabled client
Action is prevented and a clear message is displayed in Web UI
* fix formatting
* fix type issue
* fix formatting
---------
Co-authored-by: Bernd Storath <[email protected]>
* Add per-client firewall filtering
Implement server-side firewall rules to restrict client network access,
allowing administrators to enforce security policies that cannot be
bypassed by clients modifying their local configuration.
This feature addresses the limitation where "Allowed IPs" only controls
client-side routing but doesn't prevent clients from accessing networks
they shouldn't reach. The firewall rules are enforced on the server
using iptables/ip6tables and provide true access control.
Features:
- Opt-in via "Enable Per-Client Firewall" toggle in admin interface
- Per-client "Firewall Allowed IPs" field for granular control
- Support for IPs, CIDRs, and port-based filtering
- Protocol specification: TCP, UDP, or both (default)
- IPv4 and IPv6 dual-stack support
- Falls back to client's allowedIps when firewallIps is empty
- Clean separation of routing (allowedIps) from security (firewallIps)
Supported formats:
- 10.10.0.3 (single IP)
- 10.10.0.0/24 (CIDR range)
- 192.168.1.5:443 (IP with port, both TCP+UDP)
- 192.168.1.5:443/tcp (IP with specific protocol)
- [2001:db8::1]:443 (IPv6 with port)
Implementation:
- New database columns: firewall_enabled (interfaces), firewall_ips (clients)
- Migration 0003_add_firewall_filtering for schema updates
- firewall.ts utility for iptables chain management (WG_CLIENTS chain)
- Integration into WireGuard.ts for automatic rule application
- UI components with conditional rendering based on firewall toggle
Technical details:
- Uses custom WG_CLIENTS iptables chain for isolation
- Rebuild strategy: flush and recreate all rules on config save
- Mutex protection via rebuildInProgress/rebuildQueued flags
- Graceful cleanup when firewall is disabled
- No new dependencies (uses existing is-ip, is-cidr packages)
* added Comprehensive documentation in README and docs/ for firewall
filtering
* validate firewall IPs
* check for iptables before enabling the firewall and inform the user if
it is missing
* updated firewall docs
* fix imports
* remove extra import
* Document all allowed IP/cidr/port/proto combinations that are allowed
and check on save
* add note on firewall being experimental and how to opt a single client
out of the firewall.
* cleanup more imports
* add tests
* Fix firewall IPv6 validation and test expectations
Updated validation to correctly handle plain and bracketed IPv6 addresses, and fixed test to expect string from schema instead of object.
* added comments to firewall rules and updated tests
* fix auto-import
* fix typescript errors
* recreate sql migrations and rebase
* improve tests, typechecking, documentation
* fix formatting, fix types
* improve type
* added note for including host's IP in client firewall
* updated language to include cidr and protocol options
* another language update
* refer to docs for firewall allowed IPs
---------
Co-authored-by: Bernd Storath <[email protected]>
* AmneziaWG 2.0: support for H1-H4 ranges
## Changes:
```
- [+] Added support for H1-H4 ranges
- [!] Fixed interface fields order (H1-H4 goes before I1-I5)
```
## Known issues:
```
- [!] no check for unique/overlap of H1-H4 values on settings apply:
settings will be applied but wg interface will crash with "Invalid argument" error
```
* AmneziaWG 2.0: support for H1-H4 ranges
## Changes:
```
- [+] Added support for H1-H4 ranges
- [!] Fixed interface fields order (H1-H4 goes before I1-I5)
```
## Known issues:
```
- [!] no check for unique/overlap of H1-H4 values on settings apply:
settings will be applied but wg interface will crash with "Invalid argument" error
```
* AmneziaWG 2.0: support for H1-H4 ranges
## Changes:
```
- [+] Added support for H1-H4 ranges
- [!] Fixed interface fields order (H1-H4 goes before I1-I5)
```
## Known issues:
```
- [!] no check for unique/overlap of H1-H4 values on settings apply:
settings will be applied but wg interface will crash with "Invalid argument" error
```
* Update types.ts
Lint fixes
---------
Co-authored-by: CthulhuVRN <[email protected]>
* feat: Add search client based on #1978
* moved the filtering to the DB level using zod and tidied up some imports.
* minor fix
* minor fix
* fix typo
---------
Co-authored-by: Bernd Storath <[email protected]>
* Add INIT_ALLOWED_IPS env var
Implement INIT_ALLOWED_IPS env var like the INIT_DNS to preset the global Allowed IPs field.
* Docs: Add INIT_ALLOWED_IPS var to unattended setup table
* Make UserConfigService.update param partial
Update UserConfigService.update() to accept any subset of the updatable fields.
Remove the unnecessary userConfig object from DBService.initialSetup()
* formatting fix
* format on linux
On windows prettier get confused by global conf... common windows things
* preplan otp, better qrcode library
* add 2fa as feature
* add totp generation
* working totp lifecycle
* don't allow disabled user to log in
not a security issue as permission handler would fail anyway
* require 2fa on login
if enabled
* update packages
* fix typo
* remove console.logs
* initial support for initial setup
* improve setup
* improve mobile view
* move base admin route
* admin panel mobile view
* set initial host and port
* add docs
* properly setup everything, use for dev env
* change userconfig and interface port on setup, note users afterwards
* be able to change dns. implement global override
* link donate to readme
* implement global config for allowed ips
* change translations, fix generation
* improve docs
Bernd Storath
Felipe Cordova Huenupil
Evgeniy
Ian Foster
CthulhuVRN
thebigpotatoe
Alexander Chepurnoy
Bernd Storath
Badri Isiani
YuWorm
Németh Bálint
Pokydko Oleksandr