devops/wireguard-vpn
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

docs: sync markdown documentation with new AllowedIPs parsing logic

Browse Source
This commit is contained in:
datadunia
2026-04-29 15:45:20 +07:00
parent 4127731b45
commit 89546d31c3
4 changed files with 101 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.opencode/01.wireguard-policy-firewall.md
+14 -11
View File
@@ -13,7 +13,7 @@ Berikut adalah versi yang sudah diperbaiki dan ditingkatkan secara menyeluruh be
| **LOG setelah ACCEPT** | `LOG` ditempatkan di akhir chain setelah `ACCEPT`, sehingga tidak pernah match | Dipindah: `LOG` ditempatkan sebelum `ACCEPT` final, atau gunakan target `LOG` + return |
| **Race condition lock** | `flock` di subshell `while read` pipe bisa kehilangan lock | Lock dipindah ke main shell, subshell hanya baca |
| **No rollback** | Jika `policy-engine` gagal di tengah, rule setengah jadi | Ditambahkan atomic swap dengan backup chain |
| **No IP validation** | IP dari `#Access` langsung dipakai tanpa validasi | Ditambahkan regex IPv4/IPv6 validation |
| **No IP validation** | Target IP langsung dipakai tanpa validasi | Ditambahkan regex IPv4/IPv6 validation |
---
@@ -426,7 +426,7 @@ main() {
echo '{"clients":{}}' > "$tmp_policy"
# Parse peers from wg0.conf
# AWK extracts IP and #Access comment per [Peer] block
# AWK extracts client IP and target IPs from AllowedIPs per [Peer] block
local parse_errors=0
awk '
@@ -438,12 +438,18 @@ main() {
split($i,a," = ")
gsub(/ /,"",a[2])
split(a[2],b,",")
# First IP is the client IP
split(b[1],c,"/")
ip=c[1]
}
if($i ~ /^#Access/) {
sub(/^#Access[ \t]+/, "", $i)
access=$i
# The rest of the IPs are access targets
access_arr=""
for(j=2;j<=length(b);j++) {
if(access_arr=="") access_arr = b[j]
else access_arr = access_arr "," b[j]
}
access = access_arr
}
}
if(ip!="" && ip!="0.0.0.0" && ip!="::") {
@@ -1011,18 +1017,15 @@ PostDown = /usr/local/bin/wg-policy-cleanup.sh
[Peer]
PublicKey = <client1-pubkey>
AllowedIPs = 10.0.0.2/32
#Access 192.168.1.10/32;192.168.12.0/24,192.168.12.2/32
AllowedIPs = 10.0.0.2/32, 192.168.1.10/32, 192.168.12.0/24, 192.168.12.2/32
[Peer]
PublicKey = <client2-pubkey>
AllowedIPs = 10.0.0.3/32
#Access 10.0.0.1/32
AllowedIPs = 10.0.0.3/32, 10.0.0.1/32
[Peer]
PublicKey = <client3-pubkey>
AllowedIPs = 10.0.0.4/32
#Access
```
---