devops/wireguard-vpn
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity
Files
main
wireguard-vpn/build.bat
T
datadunia b5c9b180dc feat: migrate policy firewall from iptables/ipset to nftables 
- Rewrite wg-policy-lib.sh: replace ipset functions with nft helpers, add backup_nftables()
- Rewrite wg-policy-engine.sh: generate nft ruleset file, atomic load via nft -f, rollback support
- Simplify wg-policy-cleanup.sh: single nft delete table inet wg_policy
- Update wg-policy-ctl: nft commands for rules/ipset/stats/backup
- Rebuild install.sh: nftables dependency, WireGuard pre-check, PostUp/PostDown auto-integration
- Update build.sh/build.bat: match install.sh changes
- Update README.md: nftables prerequisites and references
2026-06-21 15:02:48 +07:00

181 lines
9.2 KiB
Batchfile
Raw Permalink Blame History

@echo off
setlocal enabledelayedexpansion
set INSTALL_SCRIPT=install.sh
echo Building %INSTALL_SCRIPT%...
> "%INSTALL_SCRIPT%" echo #!/bin/bash
>> "%INSTALL_SCRIPT%" echo # WireGuard Policy Firewall Installer/Uninstaller
>> "%INSTALL_SCRIPT%" echo # This file is auto-generated. Do not edit directly. Run build.sh or build.bat instead.
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo set -euo pipefail
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo if [[ $EUID -ne 0 ]]; then
>> "%INSTALL_SCRIPT%" echo echo "This script must be run as root."
>> "%INSTALL_SCRIPT%" echo exit 1
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo if ! command -v wg ^&>/dev/null; then
>> "%INSTALL_SCRIPT%" echo echo "[ERROR] WireGuard is not installed."
>> "%INSTALL_SCRIPT%" echo echo " Debian/Ubuntu: apt install wireguard"
>> "%INSTALL_SCRIPT%" echo echo " RHEL/CentOS: dnf install wireguard-tools"
>> "%INSTALL_SCRIPT%" echo echo " Arch: pacman -S wireguard-tools"
>> "%INSTALL_SCRIPT%" echo exit 1
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo if [[ ! -f /etc/wireguard/wg0.conf ]]; then
>> "%INSTALL_SCRIPT%" echo echo "[WARN] WireGuard config not found: /etc/wireguard/wg0.conf"
>> "%INSTALL_SCRIPT%" echo echo " PostUp/PostDown hooks will not be added automatically."
>> "%INSTALL_SCRIPT%" echo echo " Create your wg0.conf first, then re-install."
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo WG_CONF="/etc/wireguard/wg0.conf"
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo install_hooks^(^) {
>> "%INSTALL_SCRIPT%" echo if [[ ! -f "$WG_CONF" ]]; then
>> "%INSTALL_SCRIPT%" echo return 0
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo if grep -q "wg-sync-policy.sh" "$WG_CONF" 2^>/dev/null; then
>> "%INSTALL_SCRIPT%" echo echo "[OK] PostUp/PostDown hooks already present in $WG_CONF"
>> "%INSTALL_SCRIPT%" echo return 0
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Adding PostUp/PostDown hooks to $WG_CONF..."
>> "%INSTALL_SCRIPT%" echo cp "$WG_CONF" "${WG_CONF}.bak.$(date +%%Y%%m%%d%%H%%M%%S)"
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo local peer_line
>> "%INSTALL_SCRIPT%" echo peer_line=$(grep -n '^\[Peer\]' "$WG_CONF" ^| head -1 ^| cut -d: -f1)
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo if [[ -n "$peer_line" ]]; then
>> "%INSTALL_SCRIPT%" echo sed -i "${peer_line}i\\
>> "%INSTALL_SCRIPT%" echo # WireGuard Policy Firewall hooks\\
>> "%INSTALL_SCRIPT%" echo PostUp = /usr/local/bin/wg-sync-policy.sh; /usr/local/bin/wg-policy-engine.sh\\
>> "%INSTALL_SCRIPT%" echo PostDown = /usr/local/bin/wg-policy-cleanup.sh" "$WG_CONF"
>> "%INSTALL_SCRIPT%" echo else
>> "%INSTALL_SCRIPT%" echo {
>> "%INSTALL_SCRIPT%" echo echo ""
>> "%INSTALL_SCRIPT%" echo echo "# WireGuard Policy Firewall hooks"
>> "%INSTALL_SCRIPT%" echo echo "PostUp = /usr/local/bin/wg-sync-policy.sh; /usr/local/bin/wg-policy-engine.sh"
>> "%INSTALL_SCRIPT%" echo echo "PostDown = /usr/local/bin/wg-policy-cleanup.sh"
>> "%INSTALL_SCRIPT%" echo } ^>^> "$WG_CONF"
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "[OK] Hooks added to $WG_CONF"
>> "%INSTALL_SCRIPT%" echo }
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo remove_hooks^(^) {
>> "%INSTALL_SCRIPT%" echo if [[ ! -f "$WG_CONF" ]]; then
>> "%INSTALL_SCRIPT%" echo return 0
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo if ! grep -q "wg-sync-policy.sh" "$WG_CONF" 2^>/dev/null; then
>> "%INSTALL_SCRIPT%" echo return 0
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Removing PostUp/PostDown hooks from $WG_CONF..."
>> "%INSTALL_SCRIPT%" echo cp "$WG_CONF" "${WG_CONF}.bak.$(date +%%Y%%m%%d%%H%%M%%S)"
>> "%INSTALL_SCRIPT%" echo sed -i '/# WireGuard Policy Firewall hooks/d' "$WG_CONF"
>> "%INSTALL_SCRIPT%" echo sed -i '/wg-sync-policy\.sh/d' "$WG_CONF"
>> "%INSTALL_SCRIPT%" echo sed -i '/wg-policy-cleanup\.sh/d' "$WG_CONF"
>> "%INSTALL_SCRIPT%" echo echo "[OK] Hooks removed from $WG_CONF"
>> "%INSTALL_SCRIPT%" echo }
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo install_policy^(^) {
>> "%INSTALL_SCRIPT%" echo echo "Installing WireGuard Policy Firewall..."
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Checking dependencies..."
>> "%INSTALL_SCRIPT%" echo apt-get update -y ^|^| true
>> "%INSTALL_SCRIPT%" echo apt-get install -y jq inotify-tools nftables ^|^| true
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Writing scripts to /usr/local/bin/..."
>> "%INSTALL_SCRIPT%" echo.
call :AppendFile wg-policy-lib.sh /usr/local/bin/wg-policy-lib.sh EOF_WG_POLICY_LIB
call :AppendFile wg-policy-engine.sh /usr/local/bin/wg-policy-engine.sh EOF_WG_POLICY_ENGINE
call :AppendFile wg-policy-cleanup.sh /usr/local/bin/wg-policy-cleanup.sh EOF_WG_POLICY_CLEANUP
call :AppendFile wg-sync-policy.sh /usr/local/bin/wg-sync-policy.sh EOF_WG_SYNC_POLICY
call :AppendFile wg-sync-watch.sh /usr/local/bin/wg-sync-watch.sh EOF_WG_SYNC_WATCH
call :AppendFile wg-policy-ctl /usr/local/bin/wg-policy-ctl EOF_WG_POLICY_CTL
>> "%INSTALL_SCRIPT%" echo echo "Writing systemd units to /etc/systemd/system/..."
>> "%INSTALL_SCRIPT%" echo.
call :AppendFile wg-policy.service /etc/systemd/system/wg-policy.service EOF_WG_POLICY_SERVICE
call :AppendFile wg-policy-health.service /etc/systemd/system/wg-policy-health.service EOF_WG_POLICY_HEALTH_SERVICE
call :AppendFile wg-policy-health.timer /etc/systemd/system/wg-policy-health.timer EOF_WG_POLICY_HEALTH_TIMER
>> "%INSTALL_SCRIPT%" echo chmod +x /usr/local/bin/wg-*.sh /usr/local/bin/wg-policy-ctl
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Reloading systemd daemon..."
>> "%INSTALL_SCRIPT%" echo systemctl daemon-reload
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Enabling and starting services..."
>> "%INSTALL_SCRIPT%" echo systemctl enable --now wg-policy.service
>> "%INSTALL_SCRIPT%" echo systemctl enable --now wg-policy-health.timer
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo install_hooks
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Installation complete!"
>> "%INSTALL_SCRIPT%" echo echo "You can check status with: wg-policy-ctl status"
>> "%INSTALL_SCRIPT%" echo }
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo uninstall_policy^(^) {
>> "%INSTALL_SCRIPT%" echo echo "Uninstalling WireGuard Policy Firewall..."
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Stopping and disabling services..."
>> "%INSTALL_SCRIPT%" echo systemctl disable --now wg-policy.service wg-policy-health.timer wg-policy-health.service 2^>/dev/null ^|^| true
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Running cleanup script..."
>> "%INSTALL_SCRIPT%" echo if [ -x /usr/local/bin/wg-policy-cleanup.sh ]; then
>> "%INSTALL_SCRIPT%" echo /usr/local/bin/wg-policy-cleanup.sh ^|^| true
>> "%INSTALL_SCRIPT%" echo fi
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo remove_hooks
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Removing systemd units..."
>> "%INSTALL_SCRIPT%" echo rm -f /etc/systemd/system/wg-policy.service
>> "%INSTALL_SCRIPT%" echo rm -f /etc/systemd/system/wg-policy-health.service
>> "%INSTALL_SCRIPT%" echo rm -f /etc/systemd/system/wg-policy-health.timer
>> "%INSTALL_SCRIPT%" echo systemctl daemon-reload
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Removing scripts from /usr/local/bin/..."
>> "%INSTALL_SCRIPT%" echo rm -f /usr/local/bin/wg-policy-lib.sh
>> "%INSTALL_SCRIPT%" echo rm -f /usr/local/bin/wg-sync-policy.sh
>> "%INSTALL_SCRIPT%" echo rm -f /usr/local/bin/wg-policy-engine.sh
>> "%INSTALL_SCRIPT%" echo rm -f /usr/local/bin/wg-policy-cleanup.sh
>> "%INSTALL_SCRIPT%" echo rm -f /usr/local/bin/wg-sync-watch.sh
>> "%INSTALL_SCRIPT%" echo rm -f /usr/local/bin/wg-policy-ctl
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo echo "Uninstallation complete!"
>> "%INSTALL_SCRIPT%" echo }
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo case "${1:-}" in
>> "%INSTALL_SCRIPT%" echo install^)
>> "%INSTALL_SCRIPT%" echo install_policy
>> "%INSTALL_SCRIPT%" echo ;;
>> "%INSTALL_SCRIPT%" echo uninstall^)
>> "%INSTALL_SCRIPT%" echo uninstall_policy
>> "%INSTALL_SCRIPT%" echo ;;
>> "%INSTALL_SCRIPT%" echo *^)
>> "%INSTALL_SCRIPT%" echo echo "Usage: $0 {install|uninstall}"
>> "%INSTALL_SCRIPT%" echo exit 1
>> "%INSTALL_SCRIPT%" echo ;;
>> "%INSTALL_SCRIPT%" echo esac
echo Done! Generated %INSTALL_SCRIPT% successfully.
goto :eof
:AppendFile
set SRC=%1
set TARGET=%2
set EOF_MARKER=%3
>> "%INSTALL_SCRIPT%" echo cat ^<^< '%EOF_MARKER%' ^> %TARGET%
type "%SRC%" >> "%INSTALL_SCRIPT%"
>> "%INSTALL_SCRIPT%" echo.
>> "%INSTALL_SCRIPT%" echo %EOF_MARKER%
>> "%INSTALL_SCRIPT%" echo.
goto :eof
Reference in New Issue View Git Blame Copy Permalink