Reply to thread

Message

[QUOTE=&quot;root, post: 31, member: 1&quot;]Hello! This is a script to install wireguard on a nat server. (nat servers are those servers that do not have a statistical ip4, they give you 10.10.10.4 and using the calculator you will find out your statistical 94.0.0.0 for example.)I don't think it's necessary to comment every line. But the script works! If you need an explanation for each line of code, write in the comments. I will definitely do it. Copy and paste into a new .sh file. And run ./*.shNote: If your nat server does NOT disable tun/tap after automatic restart. Comment out the following 8 lines after this line &quot;#&quot;[ICODE]# Activation Tun Net in systemd[/ICODE]Здравствуйте! Это скрипт для установки wireguard на сервер nat. (nat сервера это те сервера у которых нет статистического ip4, вам выдают 10.10.10.4 и с помощью калькулятора вы узнаете свой статистический 94.0.0.0 например.)&nbsp; Я думаю, не нужно комментировать каждую строчку. Но скрипт работает! Если Вам нужно обьяснение каждой строчки кода, напишите в комментарии. Я обязательно сделаю. Скопируйте и вставьте в новый .sh файл. И запустите ./*.shПримечание: Если у Вашего nat сервера после автоматического рестарта НЕ отключается tun/tap. Закомментируйте после этой строчки следующие 8 строк &quot;#&quot;[ICODE]# Activation Tun Net in systemd[/ICODE]¡Hola! Este es un script para instalar wireguard en un servidor nat. (Los servidores nat son aquellos servidores que no tienen una ip4 estadística, te dan 10.10.10.4 y usando la calculadora encontrarás tu estadística 94.0.0.0 por ejemplo.)No creo que sea necesario comentar cada línea. ¡Pero el guión funciona! Si necesita una explicación para cada línea de código, escriba en los comentarios. Definitivamente lo haré. Copie y pegue en un nuevo archivo .sh. Y ejecuta ./*.shNota: si su servidor nat NO deshabilita tun/tap después del reinicio automático. Comente las siguientes 8 líneas después de esta línea &quot;#&quot;[ICODE]# Activación Tun Net en systemd[/ICODE]Всiм привiт! Це скрипт для встановлення wireguard на сервер nat. (nat сервера це ті сервери, у яких немає статистичного ip4, вам видають 10.10.10.4 і за допомогою калькулятора ви дізнаєтеся свій статистичний 94.0.0.0 наприклад.)Я думаю, не потрібно коментувати кожен рядок. Але скрипт працює! Якщо Вам потрібне пояснення кожного рядка коду, напишіть у коментарі. Я неодмінно зроблю. Скопіюйте та вставте в новий .sh файл. І запустіть ./*.shПримітка: Якщо у nat сервера після автоматичного рестарту НЕ відключається tun/tap. Закоментуйте після цього рядка наступні 8 рядків &quot;#&quot;[ICODE]# Activation Tun Net in systemd[/ICODE]<a href="https://archive.ander.services/linux/deb/11/vpn/wg/nat-wg-in.sh">Source code</a>[CODE=bash]wget https://archive.ander.services/linux/deb/11/vpn/wg/nat-wg-in.sh ; chmod 777 nat-wg-in.sh ; ./nat-wg-in.shwget https://archive.ander.services/linux/deb/11/vpn/wg/nat-wg-in.x ; chmod 777 nat-wg-in.x ; ./nat-wg-in.x[/CODE][CODE=bash]#!/bin/bash# Secure WireGuard server installer# Developers: inquisitor_4 &amp;&amp; gastipatis# License: BSDRED='\033[0;31m'ORANGE='\033[0;33m'NC='\033[0m'function isRoot() {&nbsp; &nbsp; if [ &quot;${EUID}&quot; -ne 0 ]; then&nbsp; &nbsp; &nbsp; &nbsp; echo &quot;You need to run this script as root&quot;&nbsp; &nbsp; &nbsp; &nbsp; exit 1&nbsp; &nbsp; fi}function initialCheck() {&nbsp; &nbsp; isRoot}function installQuestions() {&nbsp; &nbsp; echo &quot;Welcome to the WireGuard installer!&quot;&nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; echo &quot;Developers: inquisitor_4 &amp;&amp; gastipatis&quot;&nbsp; &nbsp; echo &quot;Telegram: @anderservices&quot;&nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; echo &quot;I need to ask you a few questions before starting the setup.&quot;&nbsp; &nbsp; echo &quot;You can leave the default options and just press enter if you are ok with them.&quot;&nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; # Detect public IPv4 or IPv6 address and pre-fill for the user&nbsp; &nbsp; SERVER_PUB_IP=$(ip -4 addr | sed -ne 's|^.* inet $[^/]*$/.* scope global.*$|\1|p' | awk '{print $1}' | head -1)&nbsp; &nbsp; if [[ -z ${SERVER_PUB_IP} ]]; then&nbsp; &nbsp; &nbsp; &nbsp; # Detect public IPv6 address&nbsp; &nbsp; &nbsp; &nbsp; SERVER_PUB_IP=$(ip -6 addr | sed -ne 's|^.* inet6 $[^/]*$/.* scope global.*$|\1|p' | head -1)&nbsp; &nbsp; fi&nbsp; &nbsp; read -rp &quot;IPv4 or IPv6 public address: &quot; -e -i &quot;${SERVER_PUB_IP}&quot; SERVER_PUB_IP&nbsp; &nbsp; # Detect public interface and pre-fill for the user&nbsp; &nbsp; SERVER_NIC=&quot;$(ip -4 route ls | grep default | grep -Po '(?&lt;=dev )(\S+)' | head -1)&quot;&nbsp; &nbsp; until [[ ${SERVER_PUB_NIC} =~ ^[a-zA-Z0-9_]+$ ]]; do&nbsp; &nbsp; &nbsp; &nbsp; read -rp &quot;Public interface: &quot; -e -i &quot;${SERVER_NIC}&quot; SERVER_PUB_NIC&nbsp; &nbsp; done&nbsp; &nbsp; until [[ ${SERVER_WG_NIC} =~ ^[a-zA-Z0-9_]+$ &amp;&amp; ${#SERVER_WG_NIC} -lt 16 ]]; do&nbsp; &nbsp; &nbsp; &nbsp; read -rp &quot;WireGuard interface name: &quot; -e -i wg0 SERVER_WG_NIC&nbsp; &nbsp; done&nbsp; &nbsp; until [[ ${SERVER_WG_IPV4} =~ ^([0-9]{1,3}\.){3} ]]; do&nbsp; &nbsp; &nbsp; &nbsp; read -rp &quot;Server's WireGuard IPv4: &quot; -e -i 10.66.66.1 SERVER_WG_IPV4&nbsp; &nbsp; done&nbsp; &nbsp; until [[ ${SERVER_WG_IPV6} =~ ^([a-f0-9]{1,4}:){3,4}: ]]; do&nbsp; &nbsp; &nbsp; &nbsp; read -rp &quot;Server's WireGuard IPv6: &quot; -e -i fd42:42:42::1 SERVER_WG_IPV6&nbsp; &nbsp; done&nbsp; &nbsp; # Generate random number within private ports range&nbsp; &nbsp; RANDOM_PORT=$(shuf -i49152-65535 -n1)&nbsp; &nbsp; until [[ ${SERVER_PORT} =~ ^[0-9]+$ ]] &amp;&amp; [ &quot;${SERVER_PORT}&quot; -ge 1 ] &amp;&amp; [ &quot;${SERVER_PORT}&quot; -le 65535 ]; do&nbsp; &nbsp; &nbsp; &nbsp; read -rp &quot;Server's WireGuard port [1-65535]: &quot; -e -i &quot;${RANDOM_PORT}&quot; SERVER_PORT&nbsp; &nbsp; done&nbsp; &nbsp; # Adguard DNS by default&nbsp; &nbsp; until [[ ${CLIENT_DNS_1} =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ ]]; do&nbsp; &nbsp; &nbsp; &nbsp; read -rp &quot;First DNS resolver to use for the clients: &quot; -e -i 94.140.14.14 CLIENT_DNS_1&nbsp; &nbsp; done&nbsp; &nbsp; until [[ ${CLIENT_DNS_2} =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ ]]; do&nbsp; &nbsp; &nbsp; &nbsp; read -rp &quot;Second DNS resolver to use for the clients (optional): &quot; -e -i 94.140.15.15 CLIENT_DNS_2&nbsp; &nbsp; &nbsp; &nbsp; if [[ ${CLIENT_DNS_2} == &quot;&quot; ]]; then&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CLIENT_DNS_2=&quot;${CLIENT_DNS_1}&quot;&nbsp; &nbsp; &nbsp; &nbsp; fi&nbsp; &nbsp; done&nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; echo &quot;Okay, that was all I needed. We are ready to setup your WireGuard server now.&quot;&nbsp; &nbsp; echo &quot;You will be able to generate a client at the end of the installation.&quot;&nbsp; &nbsp; read -n1 -r -p &quot;Press any key to continue...&quot;}function installWireGuard() {&nbsp; &nbsp; # Run setup questions first&nbsp; &nbsp; installQuestions&nbsp; &nbsp; # install tun/net&nbsp; &nbsp; mkdir -p /dev/net&nbsp; &nbsp; mknod /dev/net/tun c 10 200&nbsp; &nbsp; chmod 600 /dev/net/tun&nbsp; &nbsp; # Install module&nbsp; &nbsp; echo &quot;deb http://deb.debian.org/debian buster-backports main&quot; &gt;/etc/apt/sources.list.d/backports.list&nbsp; &nbsp; apt update &amp;&amp; apt upgrade -y&nbsp; &nbsp; apt install -y wget gcc make git&nbsp; &nbsp; apt install -y libelf-dev build-essential pkg-config&nbsp; &nbsp; apt install -y systemd iptables resolvconf&nbsp; &nbsp; apt install -y qrencode htop&nbsp; &nbsp; apt-get install -y -t buster-backports&nbsp; &nbsp; # Activation Tun Net in systemd&nbsp; &nbsp; cd /opt &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; wget http://archive.ander.services/linux/deb/10/vpn/wg/wgt/wgt.x ; chmod 777 wgt.x&nbsp; &nbsp; cd /etc/systemd/system &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; wget http://archive.ander.services/linux/deb/10/vpn/wg/wgt/wgt.service ; chmod 777 wgt.service&nbsp; &nbsp; systemctl daemon-reload&nbsp; &nbsp; systemctl enable wgt&nbsp; &nbsp; systemctl restart wgt&nbsp; &nbsp; cd&nbsp; &nbsp; ## Next make part&nbsp; &nbsp; CURRENT_DIR=$PWD&nbsp; &nbsp; # install wireguard-tools&nbsp; &nbsp; cd /opt &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; git clone https://github.com/WireGuard/wireguard-tools.git&nbsp; &nbsp; cd /opt/wireguard-tools/src &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; make &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; WITH_SYSTEMDUNITS=yes WITH_WGQUICK=yes make install&nbsp; &nbsp; # install go&nbsp; &nbsp; cd /opt &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; wget -qO- https://go.dev/dl/go1.18.3.linux-amd64.tar.gz | tar xz &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; ln -s /opt/go/bin/go&nbsp; &nbsp; /usr/local/bin/go &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; ln -s /opt/go/bin/gofmt /usr/local/bin/gofmt&nbsp; &nbsp; # install wireguard-go&nbsp; &nbsp; cd /opt &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; mkdir -p wireguard-go &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; wget -qO- https://git.zx2c4.com/wireguard-go/snapshot/wireguard-go-0.0.20220316.tar.xz \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; | tar xJ --strip-components=1 -C wireguard-go &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; sed -i -e '/MaxSegmentSize/s/=.*\/\//= 1700 \/\//g' \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; -e '/PreallocatedBuffersPerPool/s/=.*\/\//= 1024 \/\//g' \&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; /opt/wireguard-go/device/queueconstants_default.go &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; cd /opt/wireguard-go/ &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; make &amp;&amp; \&nbsp; &nbsp; &nbsp; &nbsp; ln -s /opt/wireguard-go/wireguard-go /usr/local/bin/wireguard-go&nbsp; &nbsp; # Make sure the directory exists (this does not seem the be the case on fedora)&nbsp; &nbsp; mkdir /etc/wireguard &gt;/dev/null 2&gt;&amp;1&nbsp; &nbsp; chmod 600 -R /etc/wireguard/&nbsp; &nbsp; SERVER_PRIV_KEY=$(wg genkey)&nbsp; &nbsp; SERVER_PUB_KEY=$(echo &quot;${SERVER_PRIV_KEY}&quot; | wg pubkey)&nbsp; &nbsp; # Save WireGuard settings&nbsp; &nbsp; echo &quot;SERVER_PUB_IP=${SERVER_PUB_IP}SERVER_PUB_NIC=${SERVER_PUB_NIC}SERVER_WG_NIC=${SERVER_WG_NIC}SERVER_WG_IPV4=${SERVER_WG_IPV4}SERVER_WG_IPV6=${SERVER_WG_IPV6}SERVER_PORT=${SERVER_PORT}SERVER_PRIV_KEY=${SERVER_PRIV_KEY}SERVER_PUB_KEY=${SERVER_PUB_KEY}CLIENT_DNS_1=${CLIENT_DNS_1}CLIENT_DNS_2=${CLIENT_DNS_2}&quot; &gt;/etc/wireguard/params&nbsp; &nbsp; # Add server interface&nbsp; &nbsp; echo &quot;[Interface]Address = ${SERVER_WG_IPV4}/24,${SERVER_WG_IPV6}/64ListenPort = ${SERVER_PORT}PrivateKey = ${SERVER_PRIV_KEY}&quot; &gt;&quot;/etc/wireguard/${SERVER_WG_NIC}.conf&quot;&nbsp; &nbsp; if pgrep firewalld; then&nbsp; &nbsp; &nbsp; &nbsp; FIREWALLD_IPV4_ADDRESS=$(echo &quot;${SERVER_WG_IPV4}&quot; | cut -d&quot;.&quot; -f1-3)&quot;.0&quot;&nbsp; &nbsp; &nbsp; &nbsp; FIREWALLD_IPV6_ADDRESS=$(echo &quot;${SERVER_WG_IPV6}&quot; | sed 's/:[^:]*$/:0/')&nbsp; &nbsp; &nbsp; &nbsp; echo &quot;PostUp = firewall-cmd --add-port ${SERVER_PORT}/udp &amp;&amp; firewall-cmd --add-rich-rule='rule family=ipv4 source address=${FIREWALLD_IPV4_ADDRESS}/24 masquerade' &amp;&amp; firewall-cmd --add-rich-rule='rule family=ipv6 source address=${FIREWALLD_IPV6_ADDRESS}/24 masquerade'PostDown = firewall-cmd --remove-port ${SERVER_PORT}/udp &amp;&amp; firewall-cmd --remove-rich-rule='rule family=ipv4 source address=${FIREWALLD_IPV4_ADDRESS}/24 masquerade' &amp;&amp; firewall-cmd --remove-rich-rule='rule family=ipv6 source address=${FIREWALLD_IPV6_ADDRESS}/24 masquerade'&quot; &gt;&gt;&quot;/etc/wireguard/${SERVER_WG_NIC}.conf&quot;&nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; echo &quot;PostUp = iptables -A FORWARD -i ${SERVER_PUB_NIC} -o ${SERVER_WG_NIC} -j ACCEPT; iptables -A FORWARD -i ${SERVER_WG_NIC} -j ACCEPT; iptables -t nat -A POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE; ip6tables -A FORWARD -i ${SERVER_WG_NIC} -j ACCEPT; ip6tables -t nat -A POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADEPostDown = iptables -D FORWARD -i ${SERVER_PUB_NIC} -o ${SERVER_WG_NIC} -j ACCEPT; iptables -D FORWARD -i ${SERVER_WG_NIC} -j ACCEPT; iptables -t nat -D POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE; ip6tables -D FORWARD -i ${SERVER_WG_NIC} -j ACCEPT; ip6tables -t nat -D POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE&quot; &gt;&gt;&quot;/etc/wireguard/${SERVER_WG_NIC}.conf&quot;&nbsp; &nbsp; fi&nbsp; &nbsp; # Enable routing on the server&nbsp; &nbsp; echo &quot;net.ipv4.ip_forward = 1net.ipv6.conf.all.forwarding = 1&quot; &gt;/etc/sysctl.d/wg.conf&nbsp; &nbsp; sysctl --system&nbsp; &nbsp; systemctl start &quot;wg-quick@${SERVER_WG_NIC}&quot;&nbsp; &nbsp; systemctl enable &quot;wg-quick@${SERVER_WG_NIC}&quot;&nbsp; &nbsp; newClient&nbsp; &nbsp; echo &quot;If you want to add more clients, you simply need to run this script another time!&quot;&nbsp; &nbsp; # Check if WireGuard is running&nbsp; &nbsp; systemctl is-active --quiet &quot;wg-quick@${SERVER_WG_NIC}&quot;&nbsp; &nbsp; WG_RUNNING=$?&nbsp; &nbsp; # WireGuard might not work if we updated the kernel. Tell the user to reboot&nbsp; &nbsp; if [[ ${WG_RUNNING} -ne 0 ]]; then&nbsp; &nbsp; &nbsp; &nbsp; echo -e &quot;\n${RED}WARNING: WireGuard does not seem to be running.${NC}&quot;&nbsp; &nbsp; &nbsp; &nbsp; echo -e &quot;${ORANGE}You can check if WireGuard is running with: systemctl status wg-quick@${SERVER_WG_NIC}${NC}&quot;&nbsp; &nbsp; &nbsp; &nbsp; echo -e &quot;${ORANGE}If you get something like \&quot;Cannot find device ${SERVER_WG_NIC}\&quot;, please reboot!${NC}&quot;&nbsp; &nbsp; fi}function newClient() {&nbsp; &nbsp; ENDPOINT=&quot;${SERVER_PUB_IP}:${SERVER_PORT}&quot;&nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; echo &quot;Tell me a name for the client.&quot;&nbsp; &nbsp; echo &quot;The name must consist of alphanumeric character. It may also include an underscore or a dash and can't exceed 15 chars.&quot;&nbsp; &nbsp; until [[ ${CLIENT_NAME} =~ ^[a-zA-Z0-9_-]+$ &amp;&amp; ${CLIENT_EXISTS} == '0' &amp;&amp; ${#CLIENT_NAME} -lt 16 ]]; do&nbsp; &nbsp; &nbsp; &nbsp; read -rp &quot;Client name: &quot; -e CLIENT_NAME&nbsp; &nbsp; &nbsp; &nbsp; CLIENT_EXISTS=$(grep -c -E &quot;^### Client ${CLIENT_NAME}\$&quot; &quot;/etc/wireguard/${SERVER_WG_NIC}.conf&quot;)&nbsp; &nbsp; &nbsp; &nbsp; if [[ ${CLIENT_EXISTS} == '1' ]]; then&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo &quot;A client with the specified name was already created, please choose another name.&quot;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; &nbsp; &nbsp; fi&nbsp; &nbsp; done&nbsp; &nbsp; for DOT_IP in {2..254}; do&nbsp; &nbsp; &nbsp; &nbsp; DOT_EXISTS=$(grep -c &quot;${SERVER_WG_IPV4::-1}${DOT_IP}&quot; &quot;/etc/wireguard/${SERVER_WG_NIC}.conf&quot;)&nbsp; &nbsp; &nbsp; &nbsp; if [[ ${DOT_EXISTS} == '0' ]]; then&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; break&nbsp; &nbsp; &nbsp; &nbsp; fi&nbsp; &nbsp; done&nbsp; &nbsp; if [[ ${DOT_EXISTS} == '1' ]]; then&nbsp; &nbsp; &nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; &nbsp; &nbsp; echo &quot;The subnet configured supports only 253 clients.&quot;&nbsp; &nbsp; &nbsp; &nbsp; exit 1&nbsp; &nbsp; fi&nbsp; &nbsp; BASE_IP=$(echo &quot;$SERVER_WG_IPV4&quot; | awk -F '.' '{ print $1&quot;.&quot;$2&quot;.&quot;$3 }')&nbsp; &nbsp; until [[ ${IPV4_EXISTS} == '0' ]]; do&nbsp; &nbsp; &nbsp; &nbsp; read -rp &quot;Client's WireGuard IPv4: ${BASE_IP}.&quot; -e -i &quot;${DOT_IP}&quot; DOT_IP&nbsp; &nbsp; &nbsp; &nbsp; CLIENT_WG_IPV4=&quot;${BASE_IP}.${DOT_IP}&quot;&nbsp; &nbsp; &nbsp; &nbsp; IPV4_EXISTS=$(grep -c &quot;$CLIENT_WG_IPV4/24&quot; &quot;/etc/wireguard/${SERVER_WG_NIC}.conf&quot;)&nbsp; &nbsp; &nbsp; &nbsp; if [[ ${IPV4_EXISTS} == '1' ]]; then&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo &quot;A client with the specified IPv4 was already created, please choose another IPv4.&quot;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; &nbsp; &nbsp; fi&nbsp; &nbsp; done&nbsp; &nbsp; BASE_IP=$(echo &quot;$SERVER_WG_IPV6&quot; | awk -F '::' '{ print $1 }')&nbsp; &nbsp; until [[ ${IPV6_EXISTS} == '0' ]]; do&nbsp; &nbsp; &nbsp; &nbsp; read -rp &quot;Client's WireGuard IPv6: ${BASE_IP}::&quot; -e -i &quot;${DOT_IP}&quot; DOT_IP&nbsp; &nbsp; &nbsp; &nbsp; CLIENT_WG_IPV6=&quot;${BASE_IP}::${DOT_IP}&quot;&nbsp; &nbsp; &nbsp; &nbsp; IPV6_EXISTS=$(grep -c &quot;${CLIENT_WG_IPV6}/64&quot; &quot;/etc/wireguard/${SERVER_WG_NIC}.conf&quot;)&nbsp; &nbsp; &nbsp; &nbsp; if [[ ${IPV6_EXISTS} == '1' ]]; then&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo &quot;A client with the specified IPv6 was already created, please choose another IPv6.&quot;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; &nbsp; &nbsp; fi&nbsp; &nbsp; done&nbsp; &nbsp; # Generate key pair for the client&nbsp; &nbsp; CLIENT_PRIV_KEY=$(wg genkey)&nbsp; &nbsp; CLIENT_PUB_KEY=$(echo &quot;${CLIENT_PRIV_KEY}&quot; | wg pubkey)&nbsp; &nbsp; CLIENT_PRE_SHARED_KEY=$(wg genpsk)&nbsp; &nbsp; # Home directory of the user, where the client configuration will be written&nbsp; &nbsp; if [ -e &quot;/home/${CLIENT_NAME}&quot; ]; then&nbsp; &nbsp; &nbsp; &nbsp; # if $1 is a user name&nbsp; &nbsp; &nbsp; &nbsp; HOME_DIR=&quot;/home/${CLIENT_NAME}&quot;&nbsp; &nbsp; elif [ &quot;${SUDO_USER}&quot; ]; then&nbsp; &nbsp; &nbsp; &nbsp; # if not, use SUDO_USER&nbsp; &nbsp; &nbsp; &nbsp; if [ &quot;${SUDO_USER}&quot; == &quot;root&quot; ]; then&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; # If running sudo as root&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; HOME_DIR=&quot;/root&quot;&nbsp; &nbsp; &nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; HOME_DIR=&quot;/home/${SUDO_USER}&quot;&nbsp; &nbsp; &nbsp; &nbsp; fi&nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; # if not SUDO_USER, use /root&nbsp; &nbsp; &nbsp; &nbsp; HOME_DIR=&quot;/root&quot;&nbsp; &nbsp; fi&nbsp; &nbsp; # Create client file and add the server as a peer&nbsp; &nbsp; echo &quot;[Interface]PrivateKey = ${CLIENT_PRIV_KEY}Address = ${CLIENT_WG_IPV4}/32,${CLIENT_WG_IPV6}/128DNS = ${CLIENT_DNS_1},${CLIENT_DNS_2}[Peer]PublicKey = ${SERVER_PUB_KEY}PresharedKey = ${CLIENT_PRE_SHARED_KEY}Endpoint = ${ENDPOINT}AllowedIPs = 0.0.0.0/0,::/0&quot; &gt;&gt;&quot;${HOME_DIR}/${SERVER_WG_NIC}-client-${CLIENT_NAME}.conf&quot;&nbsp; &nbsp; # Add the client as a peer to the server&nbsp; &nbsp; echo -e &quot;\n### Client ${CLIENT_NAME}[Peer]PublicKey = ${CLIENT_PUB_KEY}PresharedKey = ${CLIENT_PRE_SHARED_KEY}AllowedIPs = ${CLIENT_WG_IPV4}/32,${CLIENT_WG_IPV6}/128&quot; &gt;&gt;&quot;/etc/wireguard/${SERVER_WG_NIC}.conf&quot;&nbsp; &nbsp; wg syncconf &quot;${SERVER_WG_NIC}&quot; &lt;(wg-quick strip &quot;${SERVER_WG_NIC}&quot;)&nbsp; &nbsp; echo -e &quot;\nHere is your client config file as a QR Code:&quot;&nbsp; &nbsp; qrencode -t ansiutf8 -l L &lt;&quot;${HOME_DIR}/${SERVER_WG_NIC}-client-${CLIENT_NAME}.conf&quot;&nbsp; &nbsp; echo &quot;It is also available in ${HOME_DIR}/${SERVER_WG_NIC}-client-${CLIENT_NAME}.conf&quot;}function revokeClient() {&nbsp; &nbsp; NUMBER_OF_CLIENTS=$(grep -c -E &quot;^### Client&quot; &quot;/etc/wireguard/${SERVER_WG_NIC}.conf&quot;)&nbsp; &nbsp; if [[ ${NUMBER_OF_CLIENTS} == '0' ]]; then&nbsp; &nbsp; &nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; &nbsp; &nbsp; echo &quot;You have no existing clients!&quot;&nbsp; &nbsp; &nbsp; &nbsp; exit 1&nbsp; &nbsp; fi&nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; echo &quot;Select the existing client you want to revoke&quot;&nbsp; &nbsp; grep -E &quot;^### Client&quot; &quot;/etc/wireguard/${SERVER_WG_NIC}.conf&quot; | cut -d ' ' -f 3 | nl -s ') '&nbsp; &nbsp; until [[ ${CLIENT_NUMBER} -ge 1 &amp;&amp; ${CLIENT_NUMBER} -le ${NUMBER_OF_CLIENTS} ]]; do&nbsp; &nbsp; &nbsp; &nbsp; if [[ ${CLIENT_NUMBER} == '1' ]]; then&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; read -rp &quot;Select one client [1]: &quot; CLIENT_NUMBER&nbsp; &nbsp; &nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; read -rp &quot;Select one client [1-${NUMBER_OF_CLIENTS}]: &quot; CLIENT_NUMBER&nbsp; &nbsp; &nbsp; &nbsp; fi&nbsp; &nbsp; done&nbsp; &nbsp; # match the selected number to a client name&nbsp; &nbsp; CLIENT_NAME=$(grep -E &quot;^### Client&quot; &quot;/etc/wireguard/${SERVER_WG_NIC}.conf&quot; | cut -d ' ' -f 3 | sed -n &quot;${CLIENT_NUMBER}&quot;p)&nbsp; &nbsp; # remove [Peer] block matching $CLIENT_NAME&nbsp; &nbsp; sed -i &quot;/^### Client ${CLIENT_NAME}\$/,/^$/d&quot; &quot;/etc/wireguard/${SERVER_WG_NIC}.conf&quot;&nbsp; &nbsp; # remove generated client file&nbsp; &nbsp; rm -f &quot;${HOME}/${SERVER_WG_NIC}-client-${CLIENT_NAME}.conf&quot;&nbsp; &nbsp; # restart wireguard to apply changes&nbsp; &nbsp; wg syncconf &quot;${SERVER_WG_NIC}&quot; &lt;(wg-quick strip &quot;${SERVER_WG_NIC}&quot;)}function uninstallWg() {&nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; read -rp &quot;Do you really want to remove WireGuard? [y/n]: &quot; -e -i n REMOVE&nbsp; &nbsp; if [[ $REMOVE == 'y' ]]; then&nbsp; &nbsp; &nbsp; &nbsp; apt-get autoremove --purge -y wireguard qrencode&nbsp; &nbsp; &nbsp; &nbsp; checkOS&nbsp; &nbsp; &nbsp; &nbsp; systemctl stop &quot;wg-quick@${SERVER_WG_NIC}&quot;&nbsp; &nbsp; &nbsp; &nbsp; systemctl disable &quot;wg-quick@${SERVER_WG_NIC}&quot;&nbsp; &nbsp; &nbsp; &nbsp; rm -rf /etc/wireguard&nbsp; &nbsp; &nbsp; &nbsp; rm -f /etc/sysctl.d/wg.conf&nbsp; &nbsp; &nbsp; &nbsp; # Reload sysctl&nbsp; &nbsp; &nbsp; &nbsp; sysctl --system&nbsp; &nbsp; &nbsp; &nbsp; # Check if WireGuard is running&nbsp; &nbsp; &nbsp; &nbsp; systemctl is-active --quiet &quot;wg-quick@${SERVER_WG_NIC}&quot;&nbsp; &nbsp; &nbsp; &nbsp; WG_RUNNING=$?&nbsp; &nbsp; &nbsp; &nbsp; if [[ ${WG_RUNNING} -eq 0 ]]; then&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo &quot;WireGuard failed to uninstall properly.&quot;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit 1&nbsp; &nbsp; &nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; echo &quot;WireGuard uninstalled successfully.&quot;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; exit 0&nbsp; &nbsp; &nbsp; &nbsp; fi&nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; &nbsp; &nbsp; echo &quot;Removal aborted!&quot;&nbsp; &nbsp; fi}function manageMenu() {&nbsp; &nbsp; echo &quot;Welcome to WireGuard-install!&quot;&nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; echo &quot;It looks like WireGuard is already installed.&quot;&nbsp; &nbsp; echo &quot;&quot;&nbsp; &nbsp; echo &quot;What do you want to do?&quot;&nbsp; &nbsp; echo &quot;&nbsp;&nbsp; 1) Add a new user&quot;&nbsp; &nbsp; echo &quot;&nbsp;&nbsp; 2) Revoke existing user&quot;&nbsp; &nbsp; echo &quot;&nbsp;&nbsp; 3) Uninstall WireGuard&quot;&nbsp; &nbsp; echo &quot;&nbsp;&nbsp; 4) Exit&quot;&nbsp; &nbsp; until [[ ${MENU_OPTION} =~ ^[1-4]$ ]]; do&nbsp; &nbsp; &nbsp; &nbsp; read -rp &quot;Select an option [1-4]: &quot; MENU_OPTION&nbsp; &nbsp; done&nbsp; &nbsp; case &quot;${MENU_OPTION}&quot; in&nbsp; &nbsp; 1)&nbsp; &nbsp; &nbsp; &nbsp; newClient&nbsp; &nbsp; &nbsp; &nbsp; ;;&nbsp; &nbsp; 2)&nbsp; &nbsp; &nbsp; &nbsp; revokeClient&nbsp; &nbsp; &nbsp; &nbsp; ;;&nbsp; &nbsp; 3)&nbsp; &nbsp; &nbsp; &nbsp; uninstallWg&nbsp; &nbsp; &nbsp; &nbsp; ;;&nbsp; &nbsp; 4)&nbsp; &nbsp; &nbsp; &nbsp; exit 0&nbsp; &nbsp; &nbsp; &nbsp; ;;&nbsp; &nbsp; esac}# Check for root, virt, OS...initialCheck# Check if WireGuard is already installed and load paramsif [[ -e /etc/wireguard/params ]]; then&nbsp; &nbsp; source /etc/wireguard/params&nbsp; &nbsp; manageMenuelse&nbsp; &nbsp; installWireGuardfi[/CODE][/QUOTE]

[QUOTE="root, post: 31, member: 1"] [SIZE=5][COLOR=rgb(235, 107, 86)]Hello! This is a script to install wireguard on a nat server. (nat servers are those servers that do not have a statistical ip4, they give you 10.10.10.4 and using the calculator you will find out your statistical 94.0.0.0 for example.) I don't think it's necessary to comment every line. But the script works! If you need an explanation for each line of code, write in the comments. I will definitely do it. Copy and paste into a new .sh file. And run ./*.sh Note: If your nat server does NOT disable tun/tap after automatic restart. Comment out the following 8 lines after this line "#"[/COLOR][/SIZE] [COLOR=rgb(235, 107, 86)][SIZE=5][ICODE]# Activation Tun Net in systemd[/ICODE][/SIZE][/COLOR] [SIZE=5][COLOR=rgb(247, 218, 100)]Здравствуйте! Это скрипт для установки wireguard на сервер nat. (nat сервера это те сервера у которых нет статистического ip4, вам выдают 10.10.10.4 и с помощью калькулятора вы узнаете свой статистический 94.0.0.0 например.) Я думаю, не нужно комментировать каждую строчку. Но скрипт работает! Если Вам нужно обьяснение каждой строчки кода, напишите в комментарии. Я обязательно сделаю. Скопируйте и вставьте в новый .sh файл. И запустите ./*.sh Примечание: Если у Вашего nat сервера после автоматического рестарта НЕ отключается tun/tap. Закомментируйте после этой строчки следующие 8 строк "#" [ICODE]# Activation Tun Net in systemd[/ICODE][/COLOR][/SIZE] [COLOR=rgb(97, 189, 109)][SIZE=5]¡Hola! Este es un script para instalar wireguard en un servidor nat. (Los servidores nat son aquellos servidores que no tienen una ip4 estadística, te dan 10.10.10.4 y usando la calculadora encontrarás tu estadística 94.0.0.0 por ejemplo.) No creo que sea necesario comentar cada línea. ¡Pero el guión funciona! Si necesita una explicación para cada línea de código, escriba en los comentarios. Definitivamente lo haré. Copie y pegue en un nuevo archivo .sh. Y ejecuta ./*.sh Nota: si su servidor nat NO deshabilita tun/tap después del reinicio automático. Comente las siguientes 8 líneas después de esta línea "#" [ICODE]# Activación Tun Net en systemd[/ICODE][/SIZE][/COLOR] [COLOR=rgb(84, 172, 210)][SIZE=5]Всiм привiт! Це скрипт для встановлення wireguard на сервер nat. (nat сервера це ті сервери, у яких немає статистичного ip4, вам видають 10.10.10.4 і за допомогою калькулятора ви дізнаєтеся свій статистичний 94.0.0.0 наприклад.) Я думаю, не потрібно коментувати кожен рядок. Але скрипт працює! Якщо Вам потрібне пояснення кожного рядка коду, напишіть у коментарі. Я неодмінно зроблю. Скопіюйте та вставте в новий .sh файл. І запустіть ./*.sh Примітка: Якщо у nat сервера після автоматичного рестарту НЕ відключається tun/tap. Закоментуйте після цього рядка наступні 8 рядків "#" [ICODE]# Activation Tun Net in systemd[/ICODE][/SIZE][/COLOR] [URL='https://archive.ander.services/linux/deb/11/vpn/wg/nat-wg-in.sh']Source code[/URL] [CODE=bash]wget https://archive.ander.services/linux/deb/11/vpn/wg/nat-wg-in.sh ; chmod 777 nat-wg-in.sh ; ./nat-wg-in.sh wget https://archive.ander.services/linux/deb/11/vpn/wg/nat-wg-in.x ; chmod 777 nat-wg-in.x ; ./nat-wg-in.x[/CODE] [COLOR=rgb(209, 213, 216)][CODE=bash]#!/bin/bash # Secure WireGuard server installer # Developers: inquisitor_4 && gastipatis # License: BSD RED='\033[0;31m' ORANGE='\033[0;33m' NC='\033[0m' function isRoot() { if [ "${EUID}" -ne 0 ]; then echo "You need to run this script as root" exit 1 fi } function initialCheck() { isRoot } function installQuestions() { echo "Welcome to the WireGuard installer!" echo "" echo "Developers: inquisitor_4 && gastipatis" echo "Telegram: @anderservices" echo "" echo "I need to ask you a few questions before starting the setup." echo "You can leave the default options and just press enter if you are ok with them." echo "" # Detect public IPv4 or IPv6 address and pre-fill for the user SERVER_PUB_IP=$(ip -4 addr | sed -ne 's|^.* inet $[^/]*$/.* scope global.*$|\1|p' | awk '{print $1}' | head -1) if [[ -z ${SERVER_PUB_IP} ]]; then # Detect public IPv6 address SERVER_PUB_IP=$(ip -6 addr | sed -ne 's|^.* inet6 $[^/]*$/.* scope global.*$|\1|p' | head -1) fi read -rp "IPv4 or IPv6 public address: " -e -i "${SERVER_PUB_IP}" SERVER_PUB_IP # Detect public interface and pre-fill for the user SERVER_NIC="$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1)" until [[ ${SERVER_PUB_NIC} =~ ^[a-zA-Z0-9_]+$ ]]; do read -rp "Public interface: " -e -i "${SERVER_NIC}" SERVER_PUB_NIC done until [[ ${SERVER_WG_NIC} =~ ^[a-zA-Z0-9_]+$ && ${#SERVER_WG_NIC} -lt 16 ]]; do read -rp "WireGuard interface name: " -e -i wg0 SERVER_WG_NIC done until [[ ${SERVER_WG_IPV4} =~ ^([0-9]{1,3}\.){3} ]]; do read -rp "Server's WireGuard IPv4: " -e -i 10.66.66.1 SERVER_WG_IPV4 done until [[ ${SERVER_WG_IPV6} =~ ^([a-f0-9]{1,4}:){3,4}: ]]; do read -rp "Server's WireGuard IPv6: " -e -i fd42:42:42::1 SERVER_WG_IPV6 done # Generate random number within private ports range RANDOM_PORT=$(shuf -i49152-65535 -n1) until [[ ${SERVER_PORT} =~ ^[0-9]+$ ]] && [ "${SERVER_PORT}" -ge 1 ] && [ "${SERVER_PORT}" -le 65535 ]; do read -rp "Server's WireGuard port [1-65535]: " -e -i "${RANDOM_PORT}" SERVER_PORT done # Adguard DNS by default until [[ ${CLIENT_DNS_1} =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ ]]; do read -rp "First DNS resolver to use for the clients: " -e -i 94.140.14.14 CLIENT_DNS_1 done until [[ ${CLIENT_DNS_2} =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ ]]; do read -rp "Second DNS resolver to use for the clients (optional): " -e -i 94.140.15.15 CLIENT_DNS_2 if [[ ${CLIENT_DNS_2} == "" ]]; then CLIENT_DNS_2="${CLIENT_DNS_1}" fi done echo "" echo "Okay, that was all I needed. We are ready to setup your WireGuard server now." echo "You will be able to generate a client at the end of the installation." read -n1 -r -p "Press any key to continue..." } function installWireGuard() { # Run setup questions first installQuestions # install tun/net mkdir -p /dev/net mknod /dev/net/tun c 10 200 chmod 600 /dev/net/tun # Install module echo "deb http://deb.debian.org/debian buster-backports main" >/etc/apt/sources.list.d/backports.list apt update && apt upgrade -y apt install -y wget gcc make git apt install -y libelf-dev build-essential pkg-config apt install -y systemd iptables resolvconf apt install -y qrencode htop apt-get install -y -t buster-backports # Activation Tun Net in systemd cd /opt && \ wget http://archive.ander.services/linux/deb/10/vpn/wg/wgt/wgt.x ; chmod 777 wgt.x cd /etc/systemd/system && \ wget http://archive.ander.services/linux/deb/10/vpn/wg/wgt/wgt.service ; chmod 777 wgt.service systemctl daemon-reload systemctl enable wgt systemctl restart wgt cd ## Next make part CURRENT_DIR=$PWD # install wireguard-tools cd /opt && \ git clone https://github.com/WireGuard/wireguard-tools.git cd /opt/wireguard-tools/src && \ make && \ WITH_SYSTEMDUNITS=yes WITH_WGQUICK=yes make install # install go cd /opt && \ wget -qO- https://go.dev/dl/go1.18.3.linux-amd64.tar.gz | tar xz && \ ln -s /opt/go/bin/go /usr/local/bin/go && \ ln -s /opt/go/bin/gofmt /usr/local/bin/gofmt # install wireguard-go cd /opt && \ mkdir -p wireguard-go && \ wget -qO- https://git.zx2c4.com/wireguard-go/snapshot/wireguard-go-0.0.20220316.tar.xz \ | tar xJ --strip-components=1 -C wireguard-go && \ sed -i -e '/MaxSegmentSize/s/=.*\/\//= 1700 \/\//g' \ -e '/PreallocatedBuffersPerPool/s/=.*\/\//= 1024 \/\//g' \ /opt/wireguard-go/device/queueconstants_default.go && \ cd /opt/wireguard-go/ && \ make && \ ln -s /opt/wireguard-go/wireguard-go /usr/local/bin/wireguard-go # Make sure the directory exists (this does not seem the be the case on fedora) mkdir /etc/wireguard >/dev/null 2>&1 chmod 600 -R /etc/wireguard/ SERVER_PRIV_KEY=$(wg genkey) SERVER_PUB_KEY=$(echo "${SERVER_PRIV_KEY}" | wg pubkey) # Save WireGuard settings echo "SERVER_PUB_IP=${SERVER_PUB_IP} SERVER_PUB_NIC=${SERVER_PUB_NIC} SERVER_WG_NIC=${SERVER_WG_NIC} SERVER_WG_IPV4=${SERVER_WG_IPV4} SERVER_WG_IPV6=${SERVER_WG_IPV6} SERVER_PORT=${SERVER_PORT} SERVER_PRIV_KEY=${SERVER_PRIV_KEY} SERVER_PUB_KEY=${SERVER_PUB_KEY} CLIENT_DNS_1=${CLIENT_DNS_1} CLIENT_DNS_2=${CLIENT_DNS_2}" >/etc/wireguard/params # Add server interface echo "[Interface] Address = ${SERVER_WG_IPV4}/24,${SERVER_WG_IPV6}/64 ListenPort = ${SERVER_PORT} PrivateKey = ${SERVER_PRIV_KEY}" >"/etc/wireguard/${SERVER_WG_NIC}.conf" if pgrep firewalld; then FIREWALLD_IPV4_ADDRESS=$(echo "${SERVER_WG_IPV4}" | cut -d"." -f1-3)".0" FIREWALLD_IPV6_ADDRESS=$(echo "${SERVER_WG_IPV6}" | sed 's/:[^:]*$/:0/') echo "PostUp = firewall-cmd --add-port ${SERVER_PORT}/udp && firewall-cmd --add-rich-rule='rule family=ipv4 source address=${FIREWALLD_IPV4_ADDRESS}/24 masquerade' && firewall-cmd --add-rich-rule='rule family=ipv6 source address=${FIREWALLD_IPV6_ADDRESS}/24 masquerade' PostDown = firewall-cmd --remove-port ${SERVER_PORT}/udp && firewall-cmd --remove-rich-rule='rule family=ipv4 source address=${FIREWALLD_IPV4_ADDRESS}/24 masquerade' && firewall-cmd --remove-rich-rule='rule family=ipv6 source address=${FIREWALLD_IPV6_ADDRESS}/24 masquerade'" >>"/etc/wireguard/${SERVER_WG_NIC}.conf" else echo "PostUp = iptables -A FORWARD -i ${SERVER_PUB_NIC} -o ${SERVER_WG_NIC} -j ACCEPT; iptables -A FORWARD -i ${SERVER_WG_NIC} -j ACCEPT; iptables -t nat -A POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE; ip6tables -A FORWARD -i ${SERVER_WG_NIC} -j ACCEPT; ip6tables -t nat -A POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE PostDown = iptables -D FORWARD -i ${SERVER_PUB_NIC} -o ${SERVER_WG_NIC} -j ACCEPT; iptables -D FORWARD -i ${SERVER_WG_NIC} -j ACCEPT; iptables -t nat -D POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE; ip6tables -D FORWARD -i ${SERVER_WG_NIC} -j ACCEPT; ip6tables -t nat -D POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE" >>"/etc/wireguard/${SERVER_WG_NIC}.conf" fi # Enable routing on the server echo "net.ipv4.ip_forward = 1 net.ipv6.conf.all.forwarding = 1" >/etc/sysctl.d/wg.conf sysctl --system systemctl start "wg-quick@${SERVER_WG_NIC}" systemctl enable "wg-quick@${SERVER_WG_NIC}" newClient echo "If you want to add more clients, you simply need to run this script another time!" # Check if WireGuard is running systemctl is-active --quiet "wg-quick@${SERVER_WG_NIC}" WG_RUNNING=$? # WireGuard might not work if we updated the kernel. Tell the user to reboot if [[ ${WG_RUNNING} -ne 0 ]]; then echo -e "\n${RED}WARNING: WireGuard does not seem to be running.${NC}" echo -e "${ORANGE}You can check if WireGuard is running with: systemctl status wg-quick@${SERVER_WG_NIC}${NC}" echo -e "${ORANGE}If you get something like \"Cannot find device ${SERVER_WG_NIC}\", please reboot!${NC}" fi } function newClient() { ENDPOINT="${SERVER_PUB_IP}:${SERVER_PORT}" echo "" echo "Tell me a name for the client." echo "The name must consist of alphanumeric character. It may also include an underscore or a dash and can't exceed 15 chars." until [[ ${CLIENT_NAME} =~ ^[a-zA-Z0-9_-]+$ && ${CLIENT_EXISTS} == '0' && ${#CLIENT_NAME} -lt 16 ]]; do read -rp "Client name: " -e CLIENT_NAME CLIENT_EXISTS=$(grep -c -E "^### Client ${CLIENT_NAME}\$" "/etc/wireguard/${SERVER_WG_NIC}.conf") if [[ ${CLIENT_EXISTS} == '1' ]]; then echo "" echo "A client with the specified name was already created, please choose another name." echo "" fi done for DOT_IP in {2..254}; do DOT_EXISTS=$(grep -c "${SERVER_WG_IPV4::-1}${DOT_IP}" "/etc/wireguard/${SERVER_WG_NIC}.conf") if [[ ${DOT_EXISTS} == '0' ]]; then break fi done if [[ ${DOT_EXISTS} == '1' ]]; then echo "" echo "The subnet configured supports only 253 clients." exit 1 fi BASE_IP=$(echo "$SERVER_WG_IPV4" | awk -F '.' '{ print $1"."$2"."$3 }') until [[ ${IPV4_EXISTS} == '0' ]]; do read -rp "Client's WireGuard IPv4: ${BASE_IP}." -e -i "${DOT_IP}" DOT_IP CLIENT_WG_IPV4="${BASE_IP}.${DOT_IP}" IPV4_EXISTS=$(grep -c "$CLIENT_WG_IPV4/24" "/etc/wireguard/${SERVER_WG_NIC}.conf") if [[ ${IPV4_EXISTS} == '1' ]]; then echo "" echo "A client with the specified IPv4 was already created, please choose another IPv4." echo "" fi done BASE_IP=$(echo "$SERVER_WG_IPV6" | awk -F '::' '{ print $1 }') until [[ ${IPV6_EXISTS} == '0' ]]; do read -rp "Client's WireGuard IPv6: ${BASE_IP}::" -e -i "${DOT_IP}" DOT_IP CLIENT_WG_IPV6="${BASE_IP}::${DOT_IP}" IPV6_EXISTS=$(grep -c "${CLIENT_WG_IPV6}/64" "/etc/wireguard/${SERVER_WG_NIC}.conf") if [[ ${IPV6_EXISTS} == '1' ]]; then echo "" echo "A client with the specified IPv6 was already created, please choose another IPv6." echo "" fi done # Generate key pair for the client CLIENT_PRIV_KEY=$(wg genkey) CLIENT_PUB_KEY=$(echo "${CLIENT_PRIV_KEY}" | wg pubkey) CLIENT_PRE_SHARED_KEY=$(wg genpsk) # Home directory of the user, where the client configuration will be written if [ -e "/home/${CLIENT_NAME}" ]; then # if $1 is a user name HOME_DIR="/home/${CLIENT_NAME}" elif [ "${SUDO_USER}" ]; then # if not, use SUDO_USER if [ "${SUDO_USER}" == "root" ]; then # If running sudo as root HOME_DIR="/root" else HOME_DIR="/home/${SUDO_USER}" fi else # if not SUDO_USER, use /root HOME_DIR="/root" fi # Create client file and add the server as a peer echo "[Interface] PrivateKey = ${CLIENT_PRIV_KEY} Address = ${CLIENT_WG_IPV4}/32,${CLIENT_WG_IPV6}/128 DNS = ${CLIENT_DNS_1},${CLIENT_DNS_2} [Peer] PublicKey = ${SERVER_PUB_KEY} PresharedKey = ${CLIENT_PRE_SHARED_KEY} Endpoint = ${ENDPOINT} AllowedIPs = 0.0.0.0/0,::/0" >>"${HOME_DIR}/${SERVER_WG_NIC}-client-${CLIENT_NAME}.conf" # Add the client as a peer to the server echo -e "\n### Client ${CLIENT_NAME} [Peer] PublicKey = ${CLIENT_PUB_KEY} PresharedKey = ${CLIENT_PRE_SHARED_KEY} AllowedIPs = ${CLIENT_WG_IPV4}/32,${CLIENT_WG_IPV6}/128" >>"/etc/wireguard/${SERVER_WG_NIC}.conf" wg syncconf "${SERVER_WG_NIC}" <(wg-quick strip "${SERVER_WG_NIC}") echo -e "\nHere is your client config file as a QR Code:" qrencode -t ansiutf8 -l L <"${HOME_DIR}/${SERVER_WG_NIC}-client-${CLIENT_NAME}.conf" echo "It is also available in ${HOME_DIR}/${SERVER_WG_NIC}-client-${CLIENT_NAME}.conf" } function revokeClient() { NUMBER_OF_CLIENTS=$(grep -c -E "^### Client" "/etc/wireguard/${SERVER_WG_NIC}.conf") if [[ ${NUMBER_OF_CLIENTS} == '0' ]]; then echo "" echo "You have no existing clients!" exit 1 fi echo "" echo "Select the existing client you want to revoke" grep -E "^### Client" "/etc/wireguard/${SERVER_WG_NIC}.conf" | cut -d ' ' -f 3 | nl -s ') ' until [[ ${CLIENT_NUMBER} -ge 1 && ${CLIENT_NUMBER} -le ${NUMBER_OF_CLIENTS} ]]; do if [[ ${CLIENT_NUMBER} == '1' ]]; then read -rp "Select one client [1]: " CLIENT_NUMBER else read -rp "Select one client [1-${NUMBER_OF_CLIENTS}]: " CLIENT_NUMBER fi done # match the selected number to a client name CLIENT_NAME=$(grep -E "^### Client" "/etc/wireguard/${SERVER_WG_NIC}.conf" | cut -d ' ' -f 3 | sed -n "${CLIENT_NUMBER}"p) # remove [Peer] block matching $CLIENT_NAME sed -i "/^### Client ${CLIENT_NAME}\$/,/^$/d" "/etc/wireguard/${SERVER_WG_NIC}.conf" # remove generated client file rm -f "${HOME}/${SERVER_WG_NIC}-client-${CLIENT_NAME}.conf" # restart wireguard to apply changes wg syncconf "${SERVER_WG_NIC}" <(wg-quick strip "${SERVER_WG_NIC}") } function uninstallWg() { echo "" read -rp "Do you really want to remove WireGuard? [y/n]: " -e -i n REMOVE if [[ $REMOVE == 'y' ]]; then apt-get autoremove --purge -y wireguard qrencode checkOS systemctl stop "wg-quick@${SERVER_WG_NIC}" systemctl disable "wg-quick@${SERVER_WG_NIC}" rm -rf /etc/wireguard rm -f /etc/sysctl.d/wg.conf # Reload sysctl sysctl --system # Check if WireGuard is running systemctl is-active --quiet "wg-quick@${SERVER_WG_NIC}" WG_RUNNING=$? if [[ ${WG_RUNNING} -eq 0 ]]; then echo "WireGuard failed to uninstall properly." exit 1 else echo "WireGuard uninstalled successfully." exit 0 fi else echo "" echo "Removal aborted!" fi } function manageMenu() { echo "Welcome to WireGuard-install!" echo "" echo "It looks like WireGuard is already installed." echo "" echo "What do you want to do?" echo " 1) Add a new user" echo " 2) Revoke existing user" echo " 3) Uninstall WireGuard" echo " 4) Exit" until [[ ${MENU_OPTION} =~ ^[1-4]$ ]]; do read -rp "Select an option [1-4]: " MENU_OPTION done case "${MENU_OPTION}" in 1) newClient ;; 2) revokeClient ;; 3) uninstallWg ;; 4) exit 0 ;; esac } # Check for root, virt, OS... initialCheck # Check if WireGuard is already installed and load params if [[ -e /etc/wireguard/params ]]; then source /etc/wireguard/params manageMenu else installWireGuard fi [/CODE][/COLOR] [/QUOTE]

Name