pavel.muhortov/wireguard-management
1
0
Fork 0
generated from pavel.muhortov/template-bash
Code Issues Pull Requests Projects Releases Wiki Activity

Compare commits

base: pavel.muhortov:ec2defdec5555242d766ade1e81b4feff21734c9
Branches Tags
pavel.muhortov:master
..
compare: pavel.muhortov:acfbeeee5d7c6f56428de4c3fdcb5fbeab6448de
Branches Tags
pavel.muhortov:master

No commits in common. "ec2defdec5555242d766ade1e81b4feff21734c9" and "acfbeeee5d7c6f56428de4c3fdcb5fbeab6448de" have entirely different histories.
ec2defdec5 ... acfbeeee5d

3 changed files with 85 additions and 67 deletions
Show Stats Expand all files Collapse all files

79
README.md
View File

@ -76,35 +76,17 @@ ____
| POSITION | PARAMETERS | DESCRIPTION | DEFAULT | | POSITION | PARAMETERS | DESCRIPTION | DEFAULT |
|-----------|--------------|------------------------|---------------| |-----------|--------------|------------------------|---------------|
| 1 |**\<ifname\>**|wireguard interface name|**REQUIRED**| | 1 |**add\|del**|add or delete client config|**REQUIRED**|
| 2 |**add\|del**|add or delete client config|**REQUIRED**| | 2 |**\<username\>**|client username|**REQUIRED**|
| 3 |**\<username\>**|client username|**REQUIRED**| | 3 |**\<address\>**|client ip address|**REQUIRED**|
| 4 |**\<address\>**|client ip address|**REQUIRED**| | 4 |**[-f]**,**[--force]**|service will restart after add\|del username||
| 5 |**[-f]**,**[--force]**|service will restart after add\|del username||
Example usage: Example usage:
```bash
# create client config template
sudo tee /etc/wireguard/client.conf.default > /dev/null <<'EOF'
[Interface]
Address = clientaddr/32
PrivateKey = clientprivkey
DNS = 1.1.1.1,8.8.8.8 # edit this line!
[Peer]
PublicKey = serverpublkey
AllowedIPs = 10.0.0.0/8,192.168.0.0/16 # edit this line!
Endpoint = server.public.address:51820 # edit this line!
PersistentKeepalive = 5
EOF
```
```bash ```bash
# download # download
sudo wget https://git.hmp.today/pavel.muhortov/wireguard-management/raw/branch/master/wg-client-management.sh -O /etc/wireguard/wg-client-management.sh sudo wget https://git.hmp.today/pavel.muhortov/wireguard-management/raw/branch/master/wg-client-management.sh -O /etc/wireguard/wg-client-management.sh
sudo chmod +x /etc/wireguard/wg-client-management.sh sudo chmod +x /etc/wireguard/wg-client-management.sh
# create log directory
sudo mkdir /var/log/wireguard
``` ```
```bash ```bash
@ -114,12 +96,12 @@ ln -s /etc/wireguard/wg-client-management.sh ./wg
```bash ```bash
# create client # create client
sudo ./wg wg0 add username address sudo ./wg add username address
``` ```
```bash ```bash
# delete client and restart service # delete client and restart service
sudo ./wg wg0 del username address -f sudo ./wg del username address -f
``` ```
```bash ```bash
@ -129,6 +111,55 @@ tail -f /var/log/wireguard/wg.log
____ ____
## `wg-connect-handling`.sh
**Description:**
> Handling client connection and preparing stats for monitoring.
**Dependencies:**
>
> * privileged rights
> * [jq](https://github.com/stedolan/jq) (tested version 1.6 on [Debian GNU/Linux 11](http://ftp.debian.org/debian/dists/bullseye/))
> * [grepcidr](https://github.com/ryantig/grepcidr) (tested version 2.0 on [Debian GNU/Linux 11](http://ftp.debian.org/debian/dists/bullseye/))
> * [Python 3](https://www.python.org/downloads/) (tested version 3.9.5 on [Debian GNU/Linux 11](http://ftp.debian.org/debian/dists/bullseye/))
> * existing [/usr/local/bin/sendmail.py](https://git.hmp.today/pavel.muhortov/utils#sendmail-py)
> * [bash](https://www.gnu.org/software/bash/) (tested versions: 5.1.4 on [Debian GNU/Linux 11](http://ftp.debian.org/debian/dists/bullseye/), 5.0.17 on [Ubuntu 20](https://wiki.ubuntu.com/FocalFossa/ReleaseNotes), 4.2.46 on [CentOS 7](https://wiki.centos.org/Manuals/ReleaseNotes/CentOS7.2009))
| POSITION | PARAMETERS | DESCRIPTION | DEFAULT |
|-----------|--------------|------------------------|---------------|
| 1 |**</path/to/dir>**|root path for counter, names, log|**REQUIRED**|
| 2 |**[mail]**|send email notification||
| 3 |**[geo]**|check client address geolocation||
Example usage:
```bash
# download
sudo wget https://git.hmp.today/pavel.muhortov/wireguard-management/raw/branch/master/wg-connect-handling.sh -O /etc/wireguard/wg-connect-handling.sh
sudo chmod +x /etc/wireguard/wg-connect-handling.sh
```
```bash
# create root path for counter, names, log
sudo mkdir /var/log/wireguard
sudo chown -R root:root /var/log/wireguard
sudo chmod -R 755 /var/log/wireguard
```
```bash
# sudo crontab -e
* * * * * bash /etc/wireguard/wg-connect-handling.sh /var/log/wireguard mail geo
```
```bash
# check counter and names
watch cat /var/log/wireguard/wg-counts.log
# check journal
tail -f /var/log/wireguard/wg-connect-handling.log
```
____
## `wg-heavy@wg1`.service ## `wg-heavy@wg1`.service
**Description:** **Description:**

41
wg-client-management.sh
View File

@ -113,7 +113,7 @@ createcert() {
wg genkey | tee "/etc/wireguard/pki/${clientname}-private.key" | wg pubkey > "/etc/wireguard/pki/${clientname}-public.key" wg genkey | tee "/etc/wireguard/pki/${clientname}-private.key" | wg pubkey > "/etc/wireguard/pki/${clientname}-public.key"
clientpublkey=$(cat "/etc/wireguard/pki/${clientname}-public.key") clientpublkey=$(cat "/etc/wireguard/pki/${clientname}-public.key")
clientprivkey=$(cat "/etc/wireguard/pki/${clientname}-private.key") clientprivkey=$(cat "/etc/wireguard/pki/${clientname}-private.key")
wg set "${iface_name}" peer "${clientpublkey}" \ wg set wg0 peer "${clientpublkey}" \
allowed-ips "${clientaddr}/32" \ allowed-ips "${clientaddr}/32" \
persistent-keepalive 5 persistent-keepalive 5
{ {
@ -121,8 +121,8 @@ createcert() {
echo -e " PublicKey = ${clientpublkey}" echo -e " PublicKey = ${clientpublkey}"
echo -e " AllowedIPs = ${clientaddr}/32" echo -e " AllowedIPs = ${clientaddr}/32"
echo -e " PersistentKeepalive = 5" echo -e " PersistentKeepalive = 5"
} >> "${servercfgname}" } >> ${servercfgname}
ip -4 route add "${clientaddr}/32" dev "${iface_name}" ip -4 route add "${clientaddr}/32" dev wg0
} }
####################################### #######################################
@ -173,19 +173,19 @@ END
deletecert() { deletecert() {
clientpublkey=$(cat "/etc/wireguard/pki/${clientname}-public.key") clientpublkey=$(cat "/etc/wireguard/pki/${clientname}-public.key")
clientprivkey=$(cat "/etc/wireguard/pki/${clientname}-private.key") clientprivkey=$(cat "/etc/wireguard/pki/${clientname}-private.key")
wg set "${iface_name}" peer "${clientpublkey}" remove wg set wg0 peer "${clientpublkey}" remove
rm -f "/etc/wireguard/pki/${clientname}-public.key" rm -f "/etc/wireguard/pki/${clientname}-public.key"
rm -f "/etc/wireguard/pki/${clientname}-private.key" rm -f "/etc/wireguard/pki/${clientname}-private.key"
# PublicKey = # PublicKey =
s2=$(grep -n "${clientpublkey}" "${servercfgname}" | cut -d":" -f1) s2=$(grep -n "${clientpublkey}" ${servercfgname} | cut -d":" -f1)
# [Peer] # [Peer]
s1=$(( s2 - 1 )) s1=$(( s2 - 1 ))
# AllowedIPs = # AllowedIPs =
s3=$(( s2 + 1 )) s3=$(( s2 + 1 ))
# PersistentKeepalive = # PersistentKeepalive =
s4=$(( s2 + 2 )) s4=$(( s2 + 2 ))
sed -i "${s1}d;${s2}d;${s3}d;${s4}d" "${servercfgname}" sed -i "${s1}d;${s2}d;${s3}d;${s4}d" ${servercfgname}
ip -4 route del "${clientaddr}/32" dev "${iface_name}" ip -4 route del "${clientaddr}/32" dev wg0
} }
####################################### #######################################
@ -214,10 +214,9 @@ deleteinfo() {
# VARIABLES: # VARIABLES:
# #
iface_name=$1 clienttodo=$1
clienttodo=$2 clientname=$2
clientname=$3 clientaddr=$3
clientaddr=$4
resetforce=0 resetforce=0
for argument in "${@}"; do for argument in "${@}"; do
@ -245,7 +244,7 @@ fi
if checkroot; then if checkroot; then
serverpublkey=$(cat /etc/wireguard/pki/server-public.key) serverpublkey=$(cat /etc/wireguard/pki/server-public.key)
servercfgname="/etc/wireguard/${iface_name}.conf" servercfgname="/etc/wireguard/wg0.conf"
clientpublkey='' clientpublkey=''
clientprivkey='' clientprivkey=''
clientconfdef="/etc/wireguard/client.conf.default" clientconfdef="/etc/wireguard/client.conf.default"
@ -255,7 +254,7 @@ if checkroot; then
[ -n "${clientname}" ] && \ [ -n "${clientname}" ] && \
grepcidr "0.0.0.0/0" <(echo "${clientaddr}") >/dev/null; then grepcidr "0.0.0.0/0" <(echo "${clientaddr}") >/dev/null; then
if [ -f "/etc/wireguard/${clientname}.conf" ] || \ if [ -f "/etc/wireguard/${clientname}.conf" ] || \
grep -q -w "${clientaddr}/32" "${servercfgname}"; then grep -q -w "${clientaddr}/32" ${servercfgname}; then
execerror "wireguard config exist or address used, exit" execerror "wireguard config exist or address used, exit"
else else
createcert && addtologs "created certificate for ${clientname}" createcert && addtologs "created certificate for ${clientname}"
@ -264,8 +263,8 @@ if checkroot; then
startsendmail startsendmail
fi fi
if [ "${resetforce}" -eq 1 ];then if [ "${resetforce}" -eq 1 ];then
addtologs "restarting wg-quick@${iface_name}..." addtologs "restarting wg-quick@wg0..."
systemctl restart "wg-quick@${iface_name}" systemctl restart wg-quick@wg0
fi fi
elif [ "${clienttodo}" == "del" ] && \ elif [ "${clienttodo}" == "del" ] && \
[ -n "${clientname}" ] && \ [ -n "${clientname}" ] && \
@ -276,16 +275,16 @@ if checkroot; then
if [ -f "/etc/wireguard/${clientname}.png" ]; then if [ -f "/etc/wireguard/${clientname}.png" ]; then
deleteinfo && addtologs "deleted info file for ${clientname}" deleteinfo && addtologs "deleted info file for ${clientname}"
fi fi
if grep -q -w "${clientaddr}/32" "${servercfgname}"; then if grep -q -w "${clientaddr}/32" ${servercfgname}; then
deletecert && addtologs "deleted certificate for ${clientname}" deletecert && addtologs "deleted certificate for ${clientname}"
fi fi
if [ "${resetforce}" -eq 1 ];then if [ "${resetforce}" -eq 1 ];then
addtologs "restarting wg-quick@${iface_name}..." addtologs "restarting wg-quick@wg0..."
systemctl "restart wg-quick@${iface_name}" systemctl restart wg-quick@wg0
fi fi
else else
printf "%s\n" "Usage example: $0 'wg0' 'add' 'username(surname)' 'address(ww.xx.yy.zz) -f'" printf "%s\n" "Usage example: $0 'add' 'username(surname)' 'address(ww.xx.yy.zz) -f'"
printf "%s\n" "Usage example: $0 'wg0' 'del' 'username(surname)' 'address(ww.xx.yy.zz)'" printf "%s\n" "Usage example: $0 'del' 'username(surname)' 'address(ww.xx.yy.zz)'"
fi fi
else else
execerror "Restart this as root!" execerror "Restart this as root!"

32
wg-heavy@wg1.service
View File

@ -1,13 +1,13 @@
#! /bin/sh #! /bin/sh
# chkconfig: 2345 20 80 # chkconfig: 2345 20 80
### BEGIN INIT INFO ### BEGIN INIT INFO
# Provides: wireguard # Provides: wireguard
# Required-Start: $all # Required-Start: $all
# Required-Stop: # Required-Stop:
# Default-Start: 2 3 4 5 # Default-Start: 2 3 4 5
# Default-Stop: # Default-Stop:
# Short-Description: Launch Wireguard without creating route table # Short-Description: Launch Wireguard without creating route table
### END INIT INFO ### END INIT INFO
wifname=$(basename -s .service "$0" | cut -d'@' -f2) wifname=$(basename -s .service "$0" | cut -d'@' -f2)
@ -41,15 +41,7 @@ stop() {
rm -f "/etc/wireguard/${wifname}.key" rm -f "/etc/wireguard/${wifname}.key"
} }
status() { case "$1" in
if ip a grep -q -w "${wifname}"; then
ip a | grep -w "${wifname}"
else
echo "${wifname} down"
fi
}
case "$1" in
start) start)
start start
;; ;;
@ -58,14 +50,10 @@ case "$1" in
;; ;;
restart) restart)
stop stop
sleep 1
start start
;; ;;
status)
status
;;
*) *)
echo "Usage: $0 {start|stop|restart|status}" echo "Usage: $0 {start|stop|restart}"
esac esac
exit 0 exit 0