devops/wireguard-vpn
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

feat: migrate policy firewall from iptables/ipset to nftables

Browse Source 
- Rewrite wg-policy-lib.sh: replace ipset functions with nft helpers, add backup_nftables()
- Rewrite wg-policy-engine.sh: generate nft ruleset file, atomic load via nft -f, rollback support
- Simplify wg-policy-cleanup.sh: single nft delete table inet wg_policy
- Update wg-policy-ctl: nft commands for rules/ipset/stats/backup
- Rebuild install.sh: nftables dependency, WireGuard pre-check, PostUp/PostDown auto-integration
- Update build.sh/build.bat: match install.sh changes
- Update README.md: nftables prerequisites and references
This commit is contained in:
datadunia
2026-06-21 15:02:48 +07:00
parent eb525879f1
commit b5c9b180dc
8 changed files with 705 additions and 821 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build.bat
+72 -2
View File
@@ -16,12 +16,78 @@ echo Building %INSTALL_SCRIPT%...
>> "%INSTALL_SCRIPT%" echo exit 1
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo if ! command -v wg ^&>/dev/null; then
>> "%INSTALL_SCRIPT%" echo echo "[ERROR] WireGuard is not installed."
>> "%INSTALL_SCRIPT%" echo echo " Debian/Ubuntu: apt install wireguard"
>> "%INSTALL_SCRIPT%" echo echo " RHEL/CentOS: dnf install wireguard-tools"
>> "%INSTALL_SCRIPT%" echo echo " Arch: pacman -S wireguard-tools"
>> "%INSTALL_SCRIPT%" echo exit 1
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo if [[ ! -f /etc/wireguard/wg0.conf ]]; then
>> "%INSTALL_SCRIPT%" echo echo "[WARN] WireGuard config not found: /etc/wireguard/wg0.conf"
>> "%INSTALL_SCRIPT%" echo echo " PostUp/PostDown hooks will not be added automatically."
>> "%INSTALL_SCRIPT%" echo echo " Create your wg0.conf first, then re-install."
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo WG_CONF="/etc/wireguard/wg0.conf"
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo install_hooks^(^) {
>> "%INSTALL_SCRIPT%" echo if [[ ! -f "$WG_CONF" ]]; then
>> "%INSTALL_SCRIPT%" echo return 0
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo if grep -q "wg-sync-policy.sh" "$WG_CONF" 2^>/dev/null; then
>> "%INSTALL_SCRIPT%" echo echo "[OK] PostUp/PostDown hooks already present in $WG_CONF"
>> "%INSTALL_SCRIPT%" echo return 0
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Adding PostUp/PostDown hooks to $WG_CONF..."
>> "%INSTALL_SCRIPT%" echo cp "$WG_CONF" "${WG_CONF}.bak.$(date +%%Y%%m%%d%%H%%M%%S)"
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo local peer_line
>> "%INSTALL_SCRIPT%" echo peer_line=$(grep -n '^\[Peer\]' "$WG_CONF" ^| head -1 ^| cut -d: -f1)
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo if [[ -n "$peer_line" ]]; then
>> "%INSTALL_SCRIPT%" echo sed -i "${peer_line}i\\
>> "%INSTALL_SCRIPT%" echo # WireGuard Policy Firewall hooks\\
>> "%INSTALL_SCRIPT%" echo PostUp = /usr/local/bin/wg-sync-policy.sh; /usr/local/bin/wg-policy-engine.sh\\
>> "%INSTALL_SCRIPT%" echo PostDown = /usr/local/bin/wg-policy-cleanup.sh" "$WG_CONF"
>> "%INSTALL_SCRIPT%" echo else
>> "%INSTALL_SCRIPT%" echo {
>> "%INSTALL_SCRIPT%" echo echo ""
>> "%INSTALL_SCRIPT%" echo echo "# WireGuard Policy Firewall hooks"
>> "%INSTALL_SCRIPT%" echo echo "PostUp = /usr/local/bin/wg-sync-policy.sh; /usr/local/bin/wg-policy-engine.sh"
>> "%INSTALL_SCRIPT%" echo echo "PostDown = /usr/local/bin/wg-policy-cleanup.sh"
>> "%INSTALL_SCRIPT%" echo } ^>^> "$WG_CONF"
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "[OK] Hooks added to $WG_CONF"
>> "%INSTALL_SCRIPT%" echo }
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo remove_hooks^(^) {
>> "%INSTALL_SCRIPT%" echo if [[ ! -f "$WG_CONF" ]]; then
>> "%INSTALL_SCRIPT%" echo return 0
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo if ! grep -q "wg-sync-policy.sh" "$WG_CONF" 2^>/dev/null; then
>> "%INSTALL_SCRIPT%" echo return 0
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Removing PostUp/PostDown hooks from $WG_CONF..."
>> "%INSTALL_SCRIPT%" echo cp "$WG_CONF" "${WG_CONF}.bak.$(date +%%Y%%m%%d%%H%%M%%S)"
>> "%INSTALL_SCRIPT%" echo sed -i '/# WireGuard Policy Firewall hooks/d' "$WG_CONF"
>> "%INSTALL_SCRIPT%" echo sed -i '/wg-sync-policy\.sh/d' "$WG_CONF"
>> "%INSTALL_SCRIPT%" echo sed -i '/wg-policy-cleanup\.sh/d' "$WG_CONF"
>> "%INSTALL_SCRIPT%" echo echo "[OK] Hooks removed from $WG_CONF"
>> "%INSTALL_SCRIPT%" echo }
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo install_policy^(^) {
>> "%INSTALL_SCRIPT%" echo echo "Installing WireGuard Policy Firewall..."
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Checking dependencies..."
>> "%INSTALL_SCRIPT%" echo apt-get update -y ^|^| true
>> "%INSTALL_SCRIPT%" echo apt-get install -y jq inotify-tools ipset iptables ^|^| true
>> "%INSTALL_SCRIPT%" echo apt-get install -y jq inotify-tools nftables ^|^| true
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Writing scripts to /usr/local/bin/..."
>> "%INSTALL_SCRIPT%" echo.
@@ -48,7 +114,9 @@ call :AppendFile wg-policy-health.timer /etc/systemd/system/wg-policy-health.tim
>> "%INSTALL_SCRIPT%" echo echo "Enabling and starting services..."
>> "%INSTALL_SCRIPT%" echo systemctl enable --now wg-policy.service
>> "%INSTALL_SCRIPT%" echo systemctl enable --now wg-policy-health.timer
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo install_hooks
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Installation complete!"
>> "%INSTALL_SCRIPT%" echo echo "You can check status with: wg-policy-ctl status"
>> "%INSTALL_SCRIPT%" echo }
@@ -64,6 +132,8 @@ call :AppendFile wg-policy-health.timer /etc/systemd/system/wg-policy-health.tim
>> "%INSTALL_SCRIPT%" echo /usr/local/bin/wg-policy-cleanup.sh ^|^| true
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo remove_hooks
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Removing systemd units..."
>> "%INSTALL_SCRIPT%" echo rm -f /etc/systemd/system/wg-policy.service
>> "%INSTALL_SCRIPT%" echo rm -f /etc/systemd/system/wg-policy-health.service