* feat: add Google OAuth login support (#2625)
* 🔧 Add login via google
* 🔧 Update code style and docs
* Add fix for db migrate
* 🔧 Update docker-compose
* 🔧 Fix sqlite"
* 🔧 Update docker-compose
* ⚰️ Remove environments
* 🔧 Fix: remove ensureGoogleIdColumn workaround from sqlite.ts
* 🔧 Remove space
* move oauth section
* add openid client
* wip make oauth more generic
* properly allow multiple providers
* fix type import
* github login flow
* adjust github logo with theme
* move docs to own page
* nullable password, prevent timing attack
this prevents timing attacks by always checking hash even if there is none
prevents using basic auth if 2fa is enabled
* support generic oidc
* add ability to set password for oidc users
this allows oidc users to add password login
cant be removed after
* move password login route
move password login route from /api/session to /api/auth/password
align with oauth
* unique index on oauth
* link/unlink logic
* improve docs
* support allowed domains
* support auto register
* refactoring
* disable pw auth
* move 2fa to its own page
* 2fa for oauth, rework 2fa system
* fix design, fix link
Closes#2650
* add auto launch
* improve docs
* improvements
---------
Co-authored-by: Daniel Molenda <[email protected]>
* Small code quality improvements
- Fix misleading JSDoc comment in cache.ts
- Mitigate timing-based username enumeration in Basic auth
- Extract duplicated TOTP configuration into private method
- Replace manual peer counter with clients.length in Prometheus metrics
- Simplify isValidPasswordHash return expression
* reset session.ts
this is currently worked on in the dev-oauth branch
* reset password.ts
no need to change
* specify unit for cache function
* remove type assertion
---------
Co-authored-by: Anghios <[email protected]>
Co-authored-by: Bernd Storath <[email protected]>
* Update Chinese (HK) translations for clarity and completion
* Fix spacing
* Update zh-HK.json
Taking reference from zh_TW, making awg clearer
* Remove duplicate 'search' entry in zh-HK.json
* Fix translation typos in zh-HK locale
Replaced "户" with "戶".
* fix(ui):Error pops up when enabling disabled client
Action is prevented and a clear message is displayed in Web UI
* fix formatting
* fix type issue
* fix formatting
---------
Co-authored-by: Bernd Storath <[email protected]>
* i18n(ru): Add firewall and download options
- Updated translation, added and translated all missing values from en.json
* i18n(ru): Minor changes
- Minor edits that don't change the translation
* i18n(ru): Terminology changes
- "Интерфейс" (Interface) has been renamed to "Сетевой интерфейс" (Network Interface) to avoid confusion with the Web UI, which is often referred to simply as "interface" in Russian.
* Add per-client firewall filtering
Implement server-side firewall rules to restrict client network access,
allowing administrators to enforce security policies that cannot be
bypassed by clients modifying their local configuration.
This feature addresses the limitation where "Allowed IPs" only controls
client-side routing but doesn't prevent clients from accessing networks
they shouldn't reach. The firewall rules are enforced on the server
using iptables/ip6tables and provide true access control.
Features:
- Opt-in via "Enable Per-Client Firewall" toggle in admin interface
- Per-client "Firewall Allowed IPs" field for granular control
- Support for IPs, CIDRs, and port-based filtering
- Protocol specification: TCP, UDP, or both (default)
- IPv4 and IPv6 dual-stack support
- Falls back to client's allowedIps when firewallIps is empty
- Clean separation of routing (allowedIps) from security (firewallIps)
Supported formats:
- 10.10.0.3 (single IP)
- 10.10.0.0/24 (CIDR range)
- 192.168.1.5:443 (IP with port, both TCP+UDP)
- 192.168.1.5:443/tcp (IP with specific protocol)
- [2001:db8::1]:443 (IPv6 with port)
Implementation:
- New database columns: firewall_enabled (interfaces), firewall_ips (clients)
- Migration 0003_add_firewall_filtering for schema updates
- firewall.ts utility for iptables chain management (WG_CLIENTS chain)
- Integration into WireGuard.ts for automatic rule application
- UI components with conditional rendering based on firewall toggle
Technical details:
- Uses custom WG_CLIENTS iptables chain for isolation
- Rebuild strategy: flush and recreate all rules on config save
- Mutex protection via rebuildInProgress/rebuildQueued flags
- Graceful cleanup when firewall is disabled
- No new dependencies (uses existing is-ip, is-cidr packages)
* added Comprehensive documentation in README and docs/ for firewall
filtering
* validate firewall IPs
* check for iptables before enabling the firewall and inform the user if
it is missing
* updated firewall docs
* fix imports
* remove extra import
* Document all allowed IP/cidr/port/proto combinations that are allowed
and check on save
* add note on firewall being experimental and how to opt a single client
out of the firewall.
* cleanup more imports
* add tests
* Fix firewall IPv6 validation and test expectations
Updated validation to correctly handle plain and bracketed IPv6 addresses, and fixed test to expect string from schema instead of object.
* added comments to firewall rules and updated tests
* fix auto-import
* fix typescript errors
* recreate sql migrations and rebase
* improve tests, typechecking, documentation
* fix formatting, fix types
* improve type
* added note for including host's IP in client firewall
* updated language to include cidr and protocol options
* another language update
* refer to docs for firewall allowed IPs
---------
Co-authored-by: Bernd Storath <[email protected]>
Bernd Storath
Daeho Ro
Bernd Storath
Néstor
minhducsun2002
Ankit Agarwal
ふぁ
HackingAll
Bernd Storath
Ming Mak
Felipe Cordova Huenupil
Evgeniy
wuys
adi82bdg
Nikolas
Chiahong
Alexis-Loskoutoff
MeCias
Aarón Rosa Díaz
杨黄林
Maksim M.
Stephan Paternotte
Kayhan
Ian Foster