mirror/wireguard-install
1
0
Fork 0
mirror of https://github.com/angristan/wireguard-install.git synced 2024-11-24 05:56:02 +03:00
Code Issues Projects Releases Wiki Activity

style(script) format with shfmt

Browse Source
This commit is contained in:
Stanislas Lange 2020-04-28 15:03:21 +02:00
parent 5b1ec52ac2
commit efa9e5031a
1 changed files with 112 additions and 110 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
wireguard-install.sh
View File

@ -1,11 +1,10 @@
#!/bin/bash #!/bin/bash
function addClient () { function addClient() {
# Load params # Load params
source /etc/wireguard/params source /etc/wireguard/params
if [[ $SERVER_PUB_IP =~ .*:.* ]] if [[ $SERVER_PUB_IP =~ .*:.* ]]; then
then
echo "IPv6 Detected" echo "IPv6 Detected"
ENDPOINT="[$SERVER_PUB_IP]:$SERVER_PORT" ENDPOINT="[$SERVER_PUB_IP]:$SERVER_PORT"
else else
@ -26,7 +25,10 @@ function addClient () {
CLIENT_DNS_2="176.103.130.131" CLIENT_DNS_2="176.103.130.131"
read -rp "Second DNS resolver to use for the client: " -e -i "$CLIENT_DNS_2" CLIENT_DNS_2 read -rp "Second DNS resolver to use for the client: " -e -i "$CLIENT_DNS_2" CLIENT_DNS_2
CLIENT_NAME=$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 10 ; echo '') CLIENT_NAME=$(
head /dev/urandom | tr -dc A-Za-z0-9 | head -c 10
echo ''
)
# Generate key pair for the client # Generate key pair for the client
CLIENT_PRIV_KEY=$(wg genkey) CLIENT_PRIV_KEY=$(wg genkey)
@ -43,19 +45,19 @@ DNS = $CLIENT_DNS_1,$CLIENT_DNS_2
PublicKey = $SERVER_PUB_KEY PublicKey = $SERVER_PUB_KEY
PresharedKey = $CLIENT_PRE_SHARED_KEY PresharedKey = $CLIENT_PRE_SHARED_KEY
Endpoint = $ENDPOINT Endpoint = $ENDPOINT
AllowedIPs = 0.0.0.0/0,::/0" >> "$HOME/$SERVER_WG_NIC-client-$CLIENT_NAME.conf" AllowedIPs = 0.0.0.0/0,::/0" >>"$HOME/$SERVER_WG_NIC-client-$CLIENT_NAME.conf"
# Add the client as a peer to the server # Add the client as a peer to the server
echo -e "\n[Peer] echo -e "\n[Peer]
PublicKey = $CLIENT_PUB_KEY PublicKey = $CLIENT_PUB_KEY
PresharedKey = $CLIENT_PRE_SHARED_KEY PresharedKey = $CLIENT_PRE_SHARED_KEY
AllowedIPs = $CLIENT_WG_IPV4/32,$CLIENT_WG_IPV6/128" >> "/etc/wireguard/$SERVER_WG_NIC.conf" AllowedIPs = $CLIENT_WG_IPV4/32,$CLIENT_WG_IPV6/128" >>"/etc/wireguard/$SERVER_WG_NIC.conf"
systemctl restart "wg-quick@$SERVER_WG_NIC" systemctl restart "wg-quick@$SERVER_WG_NIC"
echo -e "\nHere is your client config file as a QR Code:" echo -e "\nHere is your client config file as a QR Code:"
qrencode -t ansiutf8 -l L < "$HOME/$SERVER_WG_NIC-client-$CLIENT_NAME.conf" qrencode -t ansiutf8 -l L <"$HOME/$SERVER_WG_NIC-client-$CLIENT_NAME.conf"
echo "It is also available in $HOME/$SERVER_WG_NIC-client-$CLIENT_NAME.conf" echo "It is also available in $HOME/$SERVER_WG_NIC-client-$CLIENT_NAME.conf"
} }
@ -79,7 +81,7 @@ if [ "$(systemd-detect-virt)" == "lxc" ]; then
exit exit
fi fi
if [[ $1 == "add-client" ]];then if [[ $1 == "add-client" ]]; then
if [[ -e /etc/wireguard ]]; then if [[ -e /etc/wireguard ]]; then
addClient addClient
exit 0 exit 0
@ -130,37 +132,37 @@ SERVER_PORT=$(shuf -i49152-65535 -n1)
read -rp "Server's WireGuard port: " -e -i "$SERVER_PORT" SERVER_PORT read -rp "Server's WireGuard port: " -e -i "$SERVER_PORT" SERVER_PORT
# Install WireGuard tools and module # Install WireGuard tools and module
if [[ "$OS" = 'ubuntu' ]]; then if [[ $OS == 'ubuntu' ]]; then
apt-get install -y software-properties-common apt-get install -y software-properties-common
add-apt-repository -y ppa:wireguard/wireguard add-apt-repository -y ppa:wireguard/wireguard
apt-get update apt-get update
apt-get install -y "linux-headers-$(uname -r)" apt-get install -y "linux-headers-$(uname -r)"
apt-get install -y wireguard iptables resolvconf qrencode apt-get install -y wireguard iptables resolvconf qrencode
elif [[ "$OS" = 'debian' ]]; then elif [[ $OS == 'debian' ]]; then
echo "deb http://deb.debian.org/debian/ unstable main" > /etc/apt/sources.list.d/unstable.list echo "deb http://deb.debian.org/debian/ unstable main" >/etc/apt/sources.list.d/unstable.list
printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' > /etc/apt/preferences.d/limit-unstable printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' >/etc/apt/preferences.d/limit-unstable
apt update apt update
apt-get install -y "linux-headers-$(uname -r)" apt-get install -y "linux-headers-$(uname -r)"
apt-get install -y wireguard iptables resolvconf qrencode apt-get install -y wireguard iptables resolvconf qrencode
apt-get install -y bc # mitigate https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956869 apt-get install -y bc # mitigate https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=956869
elif [[ "$OS" = 'fedora' ]]; then elif [[ $OS == 'fedora' ]]; then
if [[ "$VERSION_ID" -lt 32 ]]; then if [[ $VERSION_ID -lt 32 ]]; then
dnf install -y dnf-plugins-core dnf install -y dnf-plugins-core
dnf copr enable -y jdoss/wireguard dnf copr enable -y jdoss/wireguard
dnf install -y wireguard-dkms dnf install -y wireguard-dkms
fi fi
dnf install -y wireguard-tools iptables qrencode dnf install -y wireguard-tools iptables qrencode
elif [[ "$OS" = 'centos' ]]; then elif [[ $OS == 'centos' ]]; then
curl -Lo /etc/yum.repos.d/wireguard.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo curl -Lo /etc/yum.repos.d/wireguard.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
yum -y install epel-release yum -y install epel-release
yum -y install wireguard-dkms wireguard-tools iptables qrencode yum -y install wireguard-dkms wireguard-tools iptables qrencode
elif [[ "$OS" = 'arch' ]]; then elif [[ $OS == 'arch' ]]; then
pacman -S --noconfirm linux-headers pacman -S --noconfirm linux-headers
pacman -S --noconfirm wireguard-tools iptables wireguard-arch qrencode pacman -S --noconfirm wireguard-tools iptables wireguard-arch qrencode
fi fi
# Make sure the directory exists (this does not seem the be the case on fedora) # Make sure the directory exists (this does not seem the be the case on fedora)
mkdir /etc/wireguard > /dev/null 2>&1 mkdir /etc/wireguard >/dev/null 2>&1
chmod 600 -R /etc/wireguard/ chmod 600 -R /etc/wireguard/
@ -175,7 +177,7 @@ SERVER_WG_IPV4=$SERVER_WG_IPV4
SERVER_WG_IPV6=$SERVER_WG_IPV6 SERVER_WG_IPV6=$SERVER_WG_IPV6
SERVER_PORT=$SERVER_PORT SERVER_PORT=$SERVER_PORT
SERVER_PRIV_KEY=$SERVER_PRIV_KEY SERVER_PRIV_KEY=$SERVER_PRIV_KEY
SERVER_PUB_KEY=$SERVER_PUB_KEY" > /etc/wireguard/params SERVER_PUB_KEY=$SERVER_PUB_KEY" >/etc/wireguard/params
source /etc/wireguard/params source /etc/wireguard/params
@ -183,21 +185,21 @@ source /etc/wireguard/params
echo "[Interface] echo "[Interface]
Address = $SERVER_WG_IPV4/24,$SERVER_WG_IPV6/64 Address = $SERVER_WG_IPV4/24,$SERVER_WG_IPV6/64
ListenPort = $SERVER_PORT ListenPort = $SERVER_PORT
PrivateKey = $SERVER_PRIV_KEY" > "/etc/wireguard/$SERVER_WG_NIC.conf" PrivateKey = $SERVER_PRIV_KEY" >"/etc/wireguard/$SERVER_WG_NIC.conf"
if [ -x "$(command -v firewall-cmd)" ]; then if [ -x "$(command -v firewall-cmd)" ]; then
FIREWALLD_IPV4_ADDRESS=$(echo "$SERVER_WG_IPV4" | cut -d"." -f1-3)".0" FIREWALLD_IPV4_ADDRESS=$(echo "$SERVER_WG_IPV4" | cut -d"." -f1-3)".0"
FIREWALLD_IPV6_ADDRESS=$(echo "$SERVER_WG_IPV6" | sed 's/:[^:]*$/:0/') FIREWALLD_IPV6_ADDRESS=$(echo "$SERVER_WG_IPV6" | sed 's/:[^:]*$/:0/')
echo "PostUp = firewall-cmd --add-port $SERVER_PORT/udp && firewall-cmd --add-rich-rule='rule family=ipv4 source address=$FIREWALLD_IPV4_ADDRESS/24 masquerade' && firewall-cmd --add-rich-rule='rule family=ipv6 source address=$FIREWALLD_IPV6_ADDRESS/24 masquerade' echo "PostUp = firewall-cmd --add-port $SERVER_PORT/udp && firewall-cmd --add-rich-rule='rule family=ipv4 source address=$FIREWALLD_IPV4_ADDRESS/24 masquerade' && firewall-cmd --add-rich-rule='rule family=ipv6 source address=$FIREWALLD_IPV6_ADDRESS/24 masquerade'
PostDown = firewall-cmd --remove-port $SERVER_PORT/udp && firewall-cmd --remove-rich-rule='rule family=ipv4 source address=$FIREWALLD_IPV4_ADDRESS/24 masquerade' && firewall-cmd --remove-rich-rule='rule family=ipv6 source address=$FIREWALLD_IPV6_ADDRESS/24 masquerade'" >> "/etc/wireguard/$SERVER_WG_NIC.conf" PostDown = firewall-cmd --remove-port $SERVER_PORT/udp && firewall-cmd --remove-rich-rule='rule family=ipv4 source address=$FIREWALLD_IPV4_ADDRESS/24 masquerade' && firewall-cmd --remove-rich-rule='rule family=ipv6 source address=$FIREWALLD_IPV6_ADDRESS/24 masquerade'" >>"/etc/wireguard/$SERVER_WG_NIC.conf"
else else
echo "PostUp = iptables -A FORWARD -i $SERVER_WG_NIC -j ACCEPT; iptables -t nat -A POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE; ip6tables -A FORWARD -i $SERVER_WG_NIC -j ACCEPT; ip6tables -t nat -A POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE echo "PostUp = iptables -A FORWARD -i $SERVER_WG_NIC -j ACCEPT; iptables -t nat -A POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE; ip6tables -A FORWARD -i $SERVER_WG_NIC -j ACCEPT; ip6tables -t nat -A POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE
PostDown = iptables -D FORWARD -i $SERVER_WG_NIC -j ACCEPT; iptables -t nat -D POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE; ip6tables -D FORWARD -i $SERVER_WG_NIC -j ACCEPT; ip6tables -t nat -D POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE" >> "/etc/wireguard/$SERVER_WG_NIC.conf" PostDown = iptables -D FORWARD -i $SERVER_WG_NIC -j ACCEPT; iptables -t nat -D POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE; ip6tables -D FORWARD -i $SERVER_WG_NIC -j ACCEPT; ip6tables -t nat -D POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE" >>"/etc/wireguard/$SERVER_WG_NIC.conf"
fi fi
# Enable routing on the server # Enable routing on the server
echo "net.ipv4.ip_forward = 1 echo "net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1" > /etc/sysctl.d/wg.conf net.ipv6.conf.all.forwarding = 1" >/etc/sysctl.d/wg.conf
sysctl --system sysctl --system
@ -209,14 +211,14 @@ systemctl is-active --quiet "wg-quick@$SERVER_WG_NIC"
WG_RUNNING=$? WG_RUNNING=$?
# Warn user about kernel version mismatch with headers # Warn user about kernel version mismatch with headers
if [[ "$OS" =~ (fedora|centos) ]] && [[ $WG_RUNNING -ne 0 ]]; then if [[ $OS =~ (fedora|centos) ]] && [[ $WG_RUNNING -ne 0 ]]; then
echo -e "\nWARNING: WireGuard does not seem to be running." echo -e "\nWARNING: WireGuard does not seem to be running."
echo "Due to kernel mismatch issues on $OS, WireGuard might work if your system is out of date." echo "Due to kernel mismatch issues on $OS, WireGuard might work if your system is out of date."
echo "You can check if WireGuard is running with: systemctl status wg-quick@$SERVER_WG_NIC" echo "You can check if WireGuard is running with: systemctl status wg-quick@$SERVER_WG_NIC"
echo "If you get something like \"Cannot find device wg0\", please run:" echo 'If you get something like "Cannot find device wg0", please run:'
if [[ "$OS" = 'fedora' ]]; then if [[ $OS == 'fedora' ]]; then
echo "dnf update -y && reboot" echo "dnf update -y && reboot"
elif [[ "$OS" = 'centos' ]]; then elif [[ $OS == 'centos' ]]; then
echo "yum update -y && reboot" echo "yum update -y && reboot"
fi fi
fi fi