mirror of
https://github.com/angristan/wireguard-install.git
synced 2024-10-31 18:52:31 +00:00
Add optional client isolation
This commit is contained in:
parent
39caf2fcf6
commit
f7b12f5a3b
@ -160,6 +160,10 @@ function installQuestions() {
|
||||
fi
|
||||
done
|
||||
|
||||
until [[ ${ISOLATE_CLIENTS} =~ y|n ]]; do
|
||||
read -rp "Do you want to isolate clients from each other? [y/n]: " -e -i "n" ISOLATE_CLIENTS
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo "Okay, that was all I needed. We are ready to setup your WireGuard server now."
|
||||
echo "You will be able to generate a client at the end of the installation."
|
||||
@ -236,20 +240,43 @@ PrivateKey = ${SERVER_PRIV_KEY}" >"/etc/wireguard/${SERVER_WG_NIC}.conf"
|
||||
if pgrep firewalld; then
|
||||
FIREWALLD_IPV4_ADDRESS=$(echo "${SERVER_WG_IPV4}" | cut -d"." -f1-3)".0"
|
||||
FIREWALLD_IPV6_ADDRESS=$(echo "${SERVER_WG_IPV6}" | sed 's/:[^:]*$/:0/')
|
||||
echo "PostUp = firewall-cmd --add-port ${SERVER_PORT}/udp && firewall-cmd --add-rich-rule='rule family=ipv4 source address=${FIREWALLD_IPV4_ADDRESS}/24 masquerade' && firewall-cmd --add-rich-rule='rule family=ipv6 source address=${FIREWALLD_IPV6_ADDRESS}/24 masquerade'
|
||||
PostDown = firewall-cmd --remove-port ${SERVER_PORT}/udp && firewall-cmd --remove-rich-rule='rule family=ipv4 source address=${FIREWALLD_IPV4_ADDRESS}/24 masquerade' && firewall-cmd --remove-rich-rule='rule family=ipv6 source address=${FIREWALLD_IPV6_ADDRESS}/24 masquerade'" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
|
||||
echo "PostUp = firewall-cmd --add-port ${SERVER_PORT}/udp && firewall-cmd --add-rich-rule='rule family=ipv4 source address=${FIREWALLD_IPV4_ADDRESS}/24 masquerade' && firewall-cmd --add-rich-rule='rule family=ipv6 source address=${FIREWALLD_IPV6_ADDRESS}/24 masquerade'" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
|
||||
|
||||
if [[ $ISOLATE_CLIENTS == 'y' ]]; then
|
||||
echo "PostUp = iptables -I FORWARD -i ${SERVER_WG_NIC} -o ${SERVER_WG_NIC} -j REJECT
|
||||
PostUp = ip6tables -I FORWARD -i ${SERVER_WG_NIC} -o ${SERVER_WG_NIC} -j REJECT" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
|
||||
fi
|
||||
|
||||
echo "PostDown = firewall-cmd --remove-port ${SERVER_PORT}/udp && firewall-cmd --remove-rich-rule='rule family=ipv4 source address=${FIREWALLD_IPV4_ADDRESS}/24 masquerade' && firewall-cmd --remove-rich-rule='rule family=ipv6 source address=${FIREWALLD_IPV6_ADDRESS}/24 masquerade'" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
|
||||
|
||||
if [[ $ISOLATE_CLIENTS == 'y' ]]; then
|
||||
echo "PostDown = iptables -D FORWARD -i ${SERVER_WG_NIC} -o ${SERVER_WG_NIC} -j REJECT
|
||||
PostDown = ip6tables -D FORWARD -i ${SERVER_WG_NIC} -o ${SERVER_WG_NIC} -j REJECT" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
|
||||
fi
|
||||
else
|
||||
echo "PostUp = iptables -I INPUT -p udp --dport ${SERVER_PORT} -j ACCEPT
|
||||
PostUp = iptables -I FORWARD -i ${SERVER_PUB_NIC} -o ${SERVER_WG_NIC} -j ACCEPT
|
||||
PostUp = iptables -I FORWARD -i ${SERVER_WG_NIC} -j ACCEPT
|
||||
PostUp = iptables -t nat -A POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE
|
||||
PostUp = ip6tables -I FORWARD -i ${SERVER_WG_NIC} -j ACCEPT
|
||||
PostUp = iptables -t nat -A POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
|
||||
|
||||
if [[ $ISOLATE_CLIENTS == 'y' ]]; then
|
||||
echo "PostUp = iptables -I FORWARD -i ${SERVER_WG_NIC} -o ${SERVER_WG_NIC} -j REJECT
|
||||
PostUp = ip6tables -I FORWARD -i ${SERVER_WG_NIC} -o ${SERVER_WG_NIC} -j REJECT" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
|
||||
fi
|
||||
|
||||
echo "PostUp = ip6tables -I FORWARD -i ${SERVER_WG_NIC} -j ACCEPT
|
||||
PostUp = ip6tables -t nat -A POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE
|
||||
PostDown = iptables -D INPUT -p udp --dport ${SERVER_PORT} -j ACCEPT
|
||||
PostDown = iptables -D FORWARD -i ${SERVER_PUB_NIC} -o ${SERVER_WG_NIC} -j ACCEPT
|
||||
PostDown = iptables -D FORWARD -i ${SERVER_WG_NIC} -j ACCEPT
|
||||
PostDown = iptables -t nat -D POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE
|
||||
PostDown = ip6tables -D FORWARD -i ${SERVER_WG_NIC} -j ACCEPT
|
||||
PostDown = iptables -t nat -D POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
|
||||
|
||||
if [[ $ISOLATE_CLIENTS == 'y' ]]; then
|
||||
echo "PostDown = iptables -D FORWARD -i ${SERVER_WG_NIC} -o ${SERVER_WG_NIC} -j REJECT
|
||||
PostDown = ip6tables -D FORWARD -i ${SERVER_WG_NIC} -o ${SERVER_WG_NIC} -j REJECT" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
|
||||
fi
|
||||
|
||||
echo "PostDown = ip6tables -D FORWARD -i ${SERVER_WG_NIC} -j ACCEPT
|
||||
PostDown = ip6tables -t nat -D POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
|
||||
fi
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user