generated from pavel.muhortov/template-bash
Compare commits
No commits in common. "ec2defdec5555242d766ade1e81b4feff21734c9" and "acfbeeee5d7c6f56428de4c3fdcb5fbeab6448de" have entirely different histories.
ec2defdec5
...
acfbeeee5d
79
README.md
79
README.md
|
|
@ -76,35 +76,17 @@ ____
|
|||
|
||||
| POSITION | PARAMETERS | DESCRIPTION | DEFAULT |
|
||||
|-----------|--------------|------------------------|---------------|
|
||||
| 1 |**\<ifname\>**|wireguard interface name|**REQUIRED**|
|
||||
| 2 |**add\|del**|add or delete client config|**REQUIRED**|
|
||||
| 3 |**\<username\>**|client username|**REQUIRED**|
|
||||
| 4 |**\<address\>**|client ip address|**REQUIRED**|
|
||||
| 5 |**[-f]**,**[--force]**|service will restart after add\|del username||
|
||||
| 1 |**add\|del**|add or delete client config|**REQUIRED**|
|
||||
| 2 |**\<username\>**|client username|**REQUIRED**|
|
||||
| 3 |**\<address\>**|client ip address|**REQUIRED**|
|
||||
| 4 |**[-f]**,**[--force]**|service will restart after add\|del username||
|
||||
|
||||
Example usage:
|
||||
|
||||
```bash
|
||||
# create client config template
|
||||
sudo tee /etc/wireguard/client.conf.default > /dev/null <<'EOF'
|
||||
[Interface]
|
||||
Address = clientaddr/32
|
||||
PrivateKey = clientprivkey
|
||||
DNS = 1.1.1.1,8.8.8.8 # edit this line!
|
||||
[Peer]
|
||||
PublicKey = serverpublkey
|
||||
AllowedIPs = 10.0.0.0/8,192.168.0.0/16 # edit this line!
|
||||
Endpoint = server.public.address:51820 # edit this line!
|
||||
PersistentKeepalive = 5
|
||||
EOF
|
||||
```
|
||||
|
||||
```bash
|
||||
# download
|
||||
sudo wget https://git.hmp.today/pavel.muhortov/wireguard-management/raw/branch/master/wg-client-management.sh -O /etc/wireguard/wg-client-management.sh
|
||||
sudo chmod +x /etc/wireguard/wg-client-management.sh
|
||||
# create log directory
|
||||
sudo mkdir /var/log/wireguard
|
||||
```
|
||||
|
||||
```bash
|
||||
|
|
@ -114,12 +96,12 @@ ln -s /etc/wireguard/wg-client-management.sh ./wg
|
|||
|
||||
```bash
|
||||
# create client
|
||||
sudo ./wg wg0 add username address
|
||||
sudo ./wg add username address
|
||||
```
|
||||
|
||||
```bash
|
||||
# delete client and restart service
|
||||
sudo ./wg wg0 del username address -f
|
||||
sudo ./wg del username address -f
|
||||
```
|
||||
|
||||
```bash
|
||||
|
|
@ -129,6 +111,55 @@ tail -f /var/log/wireguard/wg.log
|
|||
|
||||
____
|
||||
|
||||
## `wg-connect-handling`.sh
|
||||
|
||||
**Description:**
|
||||
> Handling client connection and preparing stats for monitoring.
|
||||
|
||||
**Dependencies:**
|
||||
>
|
||||
> * privileged rights
|
||||
> * [jq](https://github.com/stedolan/jq) (tested version 1.6 on [Debian GNU/Linux 11](http://ftp.debian.org/debian/dists/bullseye/))
|
||||
> * [grepcidr](https://github.com/ryantig/grepcidr) (tested version 2.0 on [Debian GNU/Linux 11](http://ftp.debian.org/debian/dists/bullseye/))
|
||||
> * [Python 3](https://www.python.org/downloads/) (tested version 3.9.5 on [Debian GNU/Linux 11](http://ftp.debian.org/debian/dists/bullseye/))
|
||||
> * existing [/usr/local/bin/sendmail.py](https://git.hmp.today/pavel.muhortov/utils#sendmail-py)
|
||||
> * [bash](https://www.gnu.org/software/bash/) (tested versions: 5.1.4 on [Debian GNU/Linux 11](http://ftp.debian.org/debian/dists/bullseye/), 5.0.17 on [Ubuntu 20](https://wiki.ubuntu.com/FocalFossa/ReleaseNotes), 4.2.46 on [CentOS 7](https://wiki.centos.org/Manuals/ReleaseNotes/CentOS7.2009))
|
||||
|
||||
| POSITION | PARAMETERS | DESCRIPTION | DEFAULT |
|
||||
|-----------|--------------|------------------------|---------------|
|
||||
| 1 |**</path/to/dir>**|root path for counter, names, log|**REQUIRED**|
|
||||
| 2 |**[mail]**|send email notification||
|
||||
| 3 |**[geo]**|check client address geolocation||
|
||||
|
||||
Example usage:
|
||||
|
||||
```bash
|
||||
# download
|
||||
sudo wget https://git.hmp.today/pavel.muhortov/wireguard-management/raw/branch/master/wg-connect-handling.sh -O /etc/wireguard/wg-connect-handling.sh
|
||||
sudo chmod +x /etc/wireguard/wg-connect-handling.sh
|
||||
```
|
||||
|
||||
```bash
|
||||
# create root path for counter, names, log
|
||||
sudo mkdir /var/log/wireguard
|
||||
sudo chown -R root:root /var/log/wireguard
|
||||
sudo chmod -R 755 /var/log/wireguard
|
||||
```
|
||||
|
||||
```bash
|
||||
# sudo crontab -e
|
||||
* * * * * bash /etc/wireguard/wg-connect-handling.sh /var/log/wireguard mail geo
|
||||
```
|
||||
|
||||
```bash
|
||||
# check counter and names
|
||||
watch cat /var/log/wireguard/wg-counts.log
|
||||
# check journal
|
||||
tail -f /var/log/wireguard/wg-connect-handling.log
|
||||
```
|
||||
|
||||
____
|
||||
|
||||
## `wg-heavy@wg1`.service
|
||||
|
||||
**Description:**
|
||||
|
|
|
|||
|
|
@ -113,7 +113,7 @@ createcert() {
|
|||
wg genkey | tee "/etc/wireguard/pki/${clientname}-private.key" | wg pubkey > "/etc/wireguard/pki/${clientname}-public.key"
|
||||
clientpublkey=$(cat "/etc/wireguard/pki/${clientname}-public.key")
|
||||
clientprivkey=$(cat "/etc/wireguard/pki/${clientname}-private.key")
|
||||
wg set "${iface_name}" peer "${clientpublkey}" \
|
||||
wg set wg0 peer "${clientpublkey}" \
|
||||
allowed-ips "${clientaddr}/32" \
|
||||
persistent-keepalive 5
|
||||
{
|
||||
|
|
@ -121,8 +121,8 @@ createcert() {
|
|||
echo -e " PublicKey = ${clientpublkey}"
|
||||
echo -e " AllowedIPs = ${clientaddr}/32"
|
||||
echo -e " PersistentKeepalive = 5"
|
||||
} >> "${servercfgname}"
|
||||
ip -4 route add "${clientaddr}/32" dev "${iface_name}"
|
||||
} >> ${servercfgname}
|
||||
ip -4 route add "${clientaddr}/32" dev wg0
|
||||
}
|
||||
|
||||
#######################################
|
||||
|
|
@ -173,19 +173,19 @@ END
|
|||
deletecert() {
|
||||
clientpublkey=$(cat "/etc/wireguard/pki/${clientname}-public.key")
|
||||
clientprivkey=$(cat "/etc/wireguard/pki/${clientname}-private.key")
|
||||
wg set "${iface_name}" peer "${clientpublkey}" remove
|
||||
wg set wg0 peer "${clientpublkey}" remove
|
||||
rm -f "/etc/wireguard/pki/${clientname}-public.key"
|
||||
rm -f "/etc/wireguard/pki/${clientname}-private.key"
|
||||
# PublicKey =
|
||||
s2=$(grep -n "${clientpublkey}" "${servercfgname}" | cut -d":" -f1)
|
||||
s2=$(grep -n "${clientpublkey}" ${servercfgname} | cut -d":" -f1)
|
||||
# [Peer]
|
||||
s1=$(( s2 - 1 ))
|
||||
# AllowedIPs =
|
||||
s3=$(( s2 + 1 ))
|
||||
# PersistentKeepalive =
|
||||
s4=$(( s2 + 2 ))
|
||||
sed -i "${s1}d;${s2}d;${s3}d;${s4}d" "${servercfgname}"
|
||||
ip -4 route del "${clientaddr}/32" dev "${iface_name}"
|
||||
sed -i "${s1}d;${s2}d;${s3}d;${s4}d" ${servercfgname}
|
||||
ip -4 route del "${clientaddr}/32" dev wg0
|
||||
}
|
||||
|
||||
#######################################
|
||||
|
|
@ -214,10 +214,9 @@ deleteinfo() {
|
|||
# VARIABLES:
|
||||
#
|
||||
|
||||
iface_name=$1
|
||||
clienttodo=$2
|
||||
clientname=$3
|
||||
clientaddr=$4
|
||||
clienttodo=$1
|
||||
clientname=$2
|
||||
clientaddr=$3
|
||||
|
||||
resetforce=0
|
||||
for argument in "${@}"; do
|
||||
|
|
@ -245,7 +244,7 @@ fi
|
|||
|
||||
if checkroot; then
|
||||
serverpublkey=$(cat /etc/wireguard/pki/server-public.key)
|
||||
servercfgname="/etc/wireguard/${iface_name}.conf"
|
||||
servercfgname="/etc/wireguard/wg0.conf"
|
||||
clientpublkey=''
|
||||
clientprivkey=''
|
||||
clientconfdef="/etc/wireguard/client.conf.default"
|
||||
|
|
@ -255,7 +254,7 @@ if checkroot; then
|
|||
[ -n "${clientname}" ] && \
|
||||
grepcidr "0.0.0.0/0" <(echo "${clientaddr}") >/dev/null; then
|
||||
if [ -f "/etc/wireguard/${clientname}.conf" ] || \
|
||||
grep -q -w "${clientaddr}/32" "${servercfgname}"; then
|
||||
grep -q -w "${clientaddr}/32" ${servercfgname}; then
|
||||
execerror "wireguard config exist or address used, exit"
|
||||
else
|
||||
createcert && addtologs "created certificate for ${clientname}"
|
||||
|
|
@ -264,8 +263,8 @@ if checkroot; then
|
|||
startsendmail
|
||||
fi
|
||||
if [ "${resetforce}" -eq 1 ];then
|
||||
addtologs "restarting wg-quick@${iface_name}..."
|
||||
systemctl restart "wg-quick@${iface_name}"
|
||||
addtologs "restarting wg-quick@wg0..."
|
||||
systemctl restart wg-quick@wg0
|
||||
fi
|
||||
elif [ "${clienttodo}" == "del" ] && \
|
||||
[ -n "${clientname}" ] && \
|
||||
|
|
@ -276,16 +275,16 @@ if checkroot; then
|
|||
if [ -f "/etc/wireguard/${clientname}.png" ]; then
|
||||
deleteinfo && addtologs "deleted info file for ${clientname}"
|
||||
fi
|
||||
if grep -q -w "${clientaddr}/32" "${servercfgname}"; then
|
||||
if grep -q -w "${clientaddr}/32" ${servercfgname}; then
|
||||
deletecert && addtologs "deleted certificate for ${clientname}"
|
||||
fi
|
||||
if [ "${resetforce}" -eq 1 ];then
|
||||
addtologs "restarting wg-quick@${iface_name}..."
|
||||
systemctl "restart wg-quick@${iface_name}"
|
||||
addtologs "restarting wg-quick@wg0..."
|
||||
systemctl restart wg-quick@wg0
|
||||
fi
|
||||
else
|
||||
printf "%s\n" "Usage example: $0 'wg0' 'add' 'username(surname)' 'address(ww.xx.yy.zz) -f'"
|
||||
printf "%s\n" "Usage example: $0 'wg0' 'del' 'username(surname)' 'address(ww.xx.yy.zz)'"
|
||||
printf "%s\n" "Usage example: $0 'add' 'username(surname)' 'address(ww.xx.yy.zz) -f'"
|
||||
printf "%s\n" "Usage example: $0 'del' 'username(surname)' 'address(ww.xx.yy.zz)'"
|
||||
fi
|
||||
else
|
||||
execerror "Restart this as root!"
|
||||
|
|
|
|||
|
|
@ -41,14 +41,6 @@ stop() {
|
|||
rm -f "/etc/wireguard/${wifname}.key"
|
||||
}
|
||||
|
||||
status() {
|
||||
if ip a grep -q -w "${wifname}"; then
|
||||
ip a | grep -w "${wifname}"
|
||||
else
|
||||
echo "${wifname} down"
|
||||
fi
|
||||
}
|
||||
|
||||
case "$1" in
|
||||
start)
|
||||
start
|
||||
|
|
@ -58,14 +50,10 @@ case "$1" in
|
|||
;;
|
||||
restart)
|
||||
stop
|
||||
sleep 1
|
||||
start
|
||||
;;
|
||||
status)
|
||||
status
|
||||
;;
|
||||
*)
|
||||
echo "Usage: $0 {start|stop|restart|status}"
|
||||
echo "Usage: $0 {start|stop|restart}"
|
||||
esac
|
||||
|
||||
exit 0
|
||||
Loading…
Reference in New Issue
Block a user