devops/wireguard-vpn
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

fix: make ipset optional, fix ExecStartPre, add prerequisites to README

Browse Source
This commit is contained in:
datadunia
2026-04-30 20:57:42 +07:00
parent 9e635f2d4f
commit 93b781b17c
4 changed files with 121 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+35 -1
View File
@@ -35,6 +35,18 @@ chmod +x /usr/local/bin/wg-*.sh /usr/local/bin/wg-policy-ctl
---
## 📦 Prerequisites
| Package | Required | Install |
|---------|----------|---------|
| `jq` | **Yes** | `apt install jq` |
| `inotify-tools` | **Yes** (for watcher daemon) | `apt install inotify-tools` |
| `ipset` | Optional | `apt install ipset` |
If `ipset` is not installed, the engine will automatically fall back to per-rule `iptables` whitelist entries. This works fine for small deployments. For large numbers of clients/targets, `ipset` is recommended for O(1) lookup performance.
---
## ⚙️ Integrasi ke `wg0.conf`
To integrate the engine, you need to append hooks into your `wg0.conf` interface block, and declare the `#Access` tags under each peer.
@@ -49,9 +61,15 @@ ListenPort = 51820
PrivateKey = <SERVER_PRIVATE_KEY>
# PostUp: sync policy + apply engine
# default PostUp
iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;
# modification
PostUp = /usr/local/bin/wg-sync-policy.sh && /usr/local/bin/wg-policy-engine.sh
# PostDown: safe cleanup
# default PostUp
iptables -D FORWARD -i wg0 -j ACCEPT; iptables -D FORWARD -o wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;
# modification
PostDown = /usr/local/bin/wg-policy-cleanup.sh
```
@@ -117,7 +135,23 @@ wg-policy-ctl validate
If you are using the daemon mode to auto-sync changes instantly upon editing `wg0.conf` (without needing to run `wg-policy-ctl reload` or restarting the interface).
Enable the systemd services:
### 1. File Installation
Place the three provided systemd unit files into `/etc/systemd/system/`.
| Systemd File | Location | Description |
|--------------|----------|-------------|
| `wg-policy.service` | `/etc/systemd/system/wg-policy.service` | The main daemon that runs `wg-sync-watch.sh` |
| `wg-policy-health.timer` | `/etc/systemd/system/wg-policy-health.timer` | Triggers the health check every 5 minutes |
| `wg-policy-health.service`| `/etc/systemd/system/wg-policy-health.service`| Executes the actual health check logic |
```bash
# Example copy command
cp wg-policy.service wg-policy-health.timer wg-policy-health.service /etc/systemd/system/
```
### 2. Enable & Start Services
After copying the files, reload systemd to recognize them, then enable and start the services.
```bash
systemctl daemon-reload
systemctl enable wg-policy.service