devops/wireguard-vpn
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

feat: migrate policy firewall from iptables/ipset to nftables

Browse Source 
- Rewrite wg-policy-lib.sh: replace ipset functions with nft helpers, add backup_nftables()
- Rewrite wg-policy-engine.sh: generate nft ruleset file, atomic load via nft -f, rollback support
- Simplify wg-policy-cleanup.sh: single nft delete table inet wg_policy
- Update wg-policy-ctl: nft commands for rules/ipset/stats/backup
- Rebuild install.sh: nftables dependency, WireGuard pre-check, PostUp/PostDown auto-integration
- Update build.sh/build.bat: match install.sh changes
- Update README.md: nftables prerequisites and references
This commit is contained in:
datadunia
2026-06-21 15:02:48 +07:00
parent eb525879f1
commit b5c9b180dc
8 changed files with 705 additions and 821 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+8 -10
View File
@@ -2,7 +2,7 @@
A complete WireGuard management solution combining two powerful components:
1. **WireGuard Dynamic Policy Firewall** - A lightweight, robust iptables/ipset policy engine that restricts and controls WireGuard peer traffic directly from `wg0.conf` using custom `#Access` comments.
1. **WireGuard Dynamic Policy Firewall** - A lightweight, robust nftables policy engine that restricts and controls WireGuard peer traffic directly from `wg0.conf` using custom `#Access` comments.
2. **WGRplane** - A Go-native control plane application with Vue 3 frontend, providing a modern web dashboard for WireGuard management with real-time monitoring, peer CRUD, and hybrid firewall enforcement.
---
@@ -31,7 +31,7 @@ A complete WireGuard management solution combining two powerful components:
1. **`wg0.conf`**: The standard WireGuard configuration. Contains standard `[Peer]` configs alongside a custom `#Access` tag.
2. **`wg-sync-policy.sh`**: Safely parses `wg0.conf` and generates a structured `/etc/wireguard/policy.json` atomically.
3. **`wg-policy-engine.sh`**: Reads `policy.json` to generate robust rules, applying `iptables` and `ipset` directly to the system.
3. **`wg-policy-engine.sh`**: Reads `policy.json` to generate robust rules, applying nftables directly to the system.
4. **Watcher Daemon**: Monitors `wg0.conf` for changes via `inotifywait` and triggers the pipeline seamlessly when updates are made.
---
@@ -70,9 +70,7 @@ build.bat
|---------|----------|---------|
| `jq` | **Yes** | `apt install jq` |
| `inotify-tools` | **Yes** (for watcher daemon) | `apt install inotify-tools` |
| `ipset` | Optional | `apt install ipset` |
If `ipset` is not installed, the engine will automatically fall back to per-rule `iptables` whitelist entries. This works fine for small deployments. For large numbers of clients/targets, `ipset` is recommended for O(1) lookup performance.
| `nftables` | **Yes** | `apt install nftables` |
---
@@ -129,7 +127,7 @@ WireGuard uses `AllowedIPs` for Cryptokey Routing (deciding which tunnel interfa
## 🛠 `wg-policy-ctl` CLI Usage
You don't need to manually interact with `iptables` or `.json` files. Use the `wg-policy-ctl` wrapper.
You don't need to manually interact with `nft` or `.json` files. Use the `wg-policy-ctl` wrapper.
```bash
# View the health of the firewall engine and active locks
@@ -138,10 +136,10 @@ wg-policy-ctl status
# View the raw, parsed JSON policy
wg-policy-ctl policy
# Inspect active iptables rules
# Inspect active nftables rules
wg-policy-ctl rules
# Check memory sets mapping IP targets (ipset)
# Check nftables set contents
wg-policy-ctl ipset
# Manually re-sync rules immediately
@@ -278,7 +276,7 @@ Peers without any rules are isolated from other peers and the internet by defaul
| **Scheduling** | robfig/cron v3 |
| **QR Code** | skip2/go-qrcode |
| **Email** | jordan-wright/email (SMTP) |
| **Firewall** | Bash, iptables, ipset, nftables, inotify-tools, jq |
| **Firewall** | Bash, nftables, inotify-tools, jq |
| **Container** | Docker (multi-stage build), docker-compose |
---
@@ -403,7 +401,7 @@ On first run, it generates a default configuration file at `~/.config/wgrplane/c
│ ├── frontend/ # Vue 3 SPA (TypeScript, TailwindCSS)
│ └── docs/ # Swagger documentation
├── wg-sync-policy.sh # Parse wg0.conf → policy.json
├── wg-policy-engine.sh # Apply policy.json → iptables/ipset
├── wg-policy-engine.sh # Apply policy.json → nftables
├── wg-sync-watch.sh # inotifywait watcher daemon
├── wg-policy-ctl # CLI wrapper for policy management
├── wg-policy-cleanup.sh # Cleanup script for PostDown