Add support for WireGuard.

conf/default_ports.conf

@@ -35,6 +35,7 @@ standard_telnet_port=23
 standard_tftp_udp_port=69
 standard_timeserver_port=37
 standard_vpn_port=1194
+standard_wg_port=51820
 standard_whois_port=43
 standard_xymon_port=1984
 

conf/interfaces_ipv4.conf.sample

@@ -22,9 +22,17 @@ ext_if_static_3=""
 ext_ifs_static="$ext_if_static_1 $ext_if_static_2 $ext_if_static_3"
 
 # - VPN Interfaces
+# -
 # -    (blank separated list)
+# -
 vpn_ifs="tun+"
 
+# - WireGuard Interfaces
+# -
+# -    (blank separated list)
+# -
+wg_ifs="wg+"
+
 # - Local Interfaces
 local_if_1=""
 local_if_2=""

conf/interfaces_ipv6.conf.sample

@@ -26,9 +26,17 @@ ext_if_static_3=""
 ext_ifs_static="$ext_if_static_1 $ext_if_static_2 $ext_if_static_3"
 
 # - VPN Interfaces
+# -
 # -    (blank separated list)
+# -
 vpn_ifs="tun+"
 
+# - WireGuard Interfaces
+# -
+# -    (blank separated list)
+# -
+wg_ifs="wg+"
+
 # - Local Interfaces
 local_if_1=""
 local_if_2=""

conf/main_ipv4.conf.sample

@@ -536,6 +536,36 @@ declare -A vpn_server_dmz_arr
 vpn_local_net_ports="1194"
 
 
+# ======
+# - WireGuard Service
+# ======
+
+# - WireGuard Service on Gateway?
+# -
+local_wg_service=true
+wg_gw_ports="$standard_wg_port"
+
+# - WireGuard Services DMZ (reachable also from WAN)
+# -
+# - wg_server_dmz_arr=[<ip-address>]=<dsl-device>
+# -
+# - Note:
+# -    Each extern interface can have only one thuch service
+# -
+# -   wg_server_dmz_arr[192.168.10.1]=$ext_if_dsl_2
+# -   wg_server_dmz_arr[192.168.10.13]=$ext_if_dsl_1
+# -
+# - Multiple settins of this parameter is possible
+# -
+declare -A wg_server_dmz_arr
+
+# - Local WireGuard Ports
+# -
+# - Blank separated list
+# -
+wg_local_net_ports="$standard_wg_port"
+
+
 # ======
 # - DHCP Service
 # ======
@@ -1530,6 +1560,10 @@ allow_samba_requests_out=true
 
 allow_vpn_out=true
 vpn_out_ports="1194 1195 1196"
+# WireGuard
+#
+allow_wg_out=true
+wg_out_ports="$standard_wg_port"
 
 allow_cisco_vpn_out=true
 cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"

conf/main_ipv6.conf.sample

@@ -521,6 +521,36 @@ declare -A vpn_server_dmz_arr
 vpn_local_net_ports="1194"
 
 
+# ======
+# - WireGuard Service
+# ======
+
+# - WireGuard Service on Gateway?
+# -
+local_wg_service=true
+wg_gw_ports="$standard_wg_port"
+
+# - WireGuard Services DMZ (reachable also from WAN)
+# -
+# - wg_server_dmz_arr=[<ip-address>]=<dsl-device>
+# -
+# - Note:
+# -    Each extern interface can have only one thuch service
+# -
+# -   wg_server_dmz_arr[2001:6f8:107e:63::20]=$ext_if_dsl_2
+# -   wg_server_dmz_arr[2001:6f8:107e:63::40]=$ext_if_dsl_1
+# -
+# - Multiple settins of this parameter is possible
+# -
+declare -A wg_server_dmz_arr
+
+# - Local WireGuard Ports
+# -
+# - Blank separated list
+# -
+wg_local_net_ports="$standard_wg_port"
+
+
 # ======
 # - DHCP Service
 # ======
@@ -1445,6 +1475,10 @@ allow_samba_requests_out=true
 
 allow_vpn_out=true
 vpn_out_ports="1194 1195 1196"
+# WireGuard
+#
+allow_wg_out=true
+wg_out_ports="$standard_wg_port"
 
 allow_cisco_vpn_out=true
 cisco_vpn_out_ports="$standard_isakmp_port $standard_ipsec_nat_t"

conf/post_decalrations.conf

@@ -542,6 +542,25 @@ for _port in $vpn_out_ports ; do
    vpn_out_port_arr+=("$_port")
 done
 
+# ---
+# - WireGuard Ports
+# ---
+declare -a wg_gw_port_arr
+for _port in $wg_gw_ports ; do
+   wg_gw_port_arr+=("$_port")
+done
+declare -a wg_local_net_port_arr
+for _port in $wg_local_net_ports ; do
+   wg_local_net_port_arr+=("$_port")
+done
+declare -a wg_out_port_arr
+if [[ -z "$wg_out_ports" ]] ; then
+   wg_out_ports="$standard_wg_port"
+fi
+for _port in $wg_out_ports ; do
+   wg_out_port_arr+=("$_port")
+done
+
 # ---
 # - Rsync Out Ports
 # --

ip6t-firewall-gateway

@@ -808,6 +808,21 @@ done
 echo_done
 
 
+# ---
+# - Permit all traffic through WireGuard lines
+# ---
+echononl "\tPermit all traffic through WireGuard lines.."
+for _wg_if in ${wg_if_arr[@]} ; do
+   $ip6t -A INPUT -i $_wg_if -m conntrack --ctstate NEW -j ACCEPT
+   if $kernel_forward_between_interfaces ; then
+      for _local_dev in ${local_if_arr[@]} ; do
+         $ip6t -A FORWARD -i $_wg_if -o $_local_dev -m conntrack --ctstate NEW -j ACCEPT
+      done
+   fi
+done
+echo_done
+
+
 
 # ---
 # - Telefon Systems
@@ -1949,6 +1964,91 @@ else
 fi
 
 
+# ---
+# - WireGuard Service only out
+# ---
+
+echononl "\t\tWireGuard Service only out"
+
+if $allow_wg_out && [[ ${#wg_out_port_arr[@]} -gt 0 ]]; then
+   for _dev in ${ext_if_arr[@]} ; do
+      for _port in ${wg_out_port_arr[@]} ; do
+         $ip6t -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         if $kernel_forward_between_interfaces && ! $permit_local_net_to_inet ; then
+            $ip6t -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         fi
+      done
+   done
+
+   for _wg_if in ${wg_if_arr[@]} ; do
+      $ip6t -A OUTPUT -o $_wg_if -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_forward_between_interfaces ; then
+         $ip6t -A FORWARD -o $_wg_if -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - WireGuard Service Gateway
+# ---
+
+echononl "\t\tWireGuard Service Gateway"
+
+if $local_wg_service ; then
+
+   # - Cconnection establishment
+   # -
+   for _port in ${wg_gw_port_arr[@]} ; do
+      $ip6t -A INPUT -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+   done
+   echo_done
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - WireGuard Service DMZ
+# ---
+
+echononl "\t\tWireGuard Service DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#wg_server_dmz_arr[@]} -gt 0 ]] && $kernel_forward_between_interfaces ; then
+   for _ip in ${!wg_server_dmz_arr[@]} ; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${wg_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      for _port in ${wg_local_net_port_arr[@]} ; do
+         $ip6t -A FORWARD -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+      done
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
 # ---
 # - HTTP(S) OUT
 # ---

ipt-firewall-gateway

@@ -1393,6 +1393,21 @@ done
 echo_done
 
 
+# ---
+# - Permit all traffic through WireGuard lines
+# ---
+echononl "\tPermit all traffic through WireGuard lines.."
+for _wg_if in ${wg_if_arr[@]} ; do
+   $ipt -A INPUT -i $_wg_if -m conntrack --ctstate NEW -j ACCEPT
+   if $kernel_activate_forwarding ; then
+      for _local_dev in ${local_if_arr[@]} ; do
+         $ipt -A FORWARD -i $_wg_if -o $_local_dev -m conntrack --ctstate NEW -j ACCEPT
+      done
+   fi
+done
+echo_done
+
+
 
 # ---
 # - Telefon Systems
@@ -2651,6 +2666,97 @@ else
 fi
 
 
+# ---
+# - WireGuard Service only out
+# ---
+
+echononl "\t\tWireGuard Service only out"
+
+if $allow_wg_out && [[ ${#wg_out_port_arr[@]} -gt 0 ]]; then
+   for _dev in ${ext_if_arr[@]} ; do
+      for _port in ${wg_out_port_arr[@]} ; do
+         $ipt -A OUTPUT -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         if $kernel_activate_forwarding && ! $permit_local_net_to_inet ; then
+            $ipt -A FORWARD -o $_dev -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+         fi
+      done
+   done
+
+   for _wg_if in ${wg_if_arr[@]} ; do
+      $ipt -A OUTPUT -o $_wg_if -m conntrack --ctstate NEW -j ACCEPT
+      if $kernel_activate_forwarding ; then
+         $ipt -A FORWARD -o $_wg_if -m conntrack --ctstate NEW -j ACCEPT
+      fi
+   done
+   echo_done
+else
+   echo_skipped
+fi
+
+
+# ---
+# - WireGuard Service Gateway
+# ---
+
+echononl "\t\tWireGuard Service Gateway"
+
+if $local_wg_service ; then
+
+   # - Cconnection establishment
+   # -
+   for _port in ${wg_gw_port_arr[@]} ; do
+      $ipt -A INPUT -p udp --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+   done
+   echo_done
+
+else
+   echo_skipped
+fi
+
+
+# ---
+# - WireGuard Service DMZ
+# ---
+
+echononl "\t\tWireGuard Service DMZ"
+unset no_if_for_ip_arr
+declare -a no_if_for_ip_arr
+
+if [[ ${#wg_server_dmz_arr[@]} -gt 0 ]] && $kernel_activate_forwarding ; then
+   for _ip in ${!wg_server_dmz_arr[@]} ; do
+
+      # - Skip if no interface is given
+      # -
+      if [[ -z "${wg_server_dmz_arr[$_ip]}" ]] ; then
+         no_if_for_ip_arr+=("$_ip")
+         continue
+      fi
+
+      for _port in ${wg_local_net_port_arr[@]} ; do
+         $ipt -A FORWARD -p udp -d $_ip --dport $_port -m conntrack --ctstate NEW -j ACCEPT
+
+         # - Nat if interface is on a dsl line
+         # -
+         if containsElement "${wg_server_dmz_arr[$_ip]}" "${nat_device_arr[@]}" ; then
+            $ipt -t nat -A PREROUTING -i ${wg_server_dmz_arr[$_ip]} -p udp --dport $_port -j DNAT --to $_ip:$_port
+         fi
+      done
+   done
+
+   if [[ ${#no_if_for_ip_arr[@]} -gt 0 ]] ; then
+      echo_warning
+      for _ip in ${no_if_for_ip_arr[@]} ; do
+         warn "No Interface given for ip '$_ip'"
+      done
+   else
+      echo_done
+   fi
+
+else
+   echo_skipped
+fi
+
+
 # ---
 # - HTTP(S) OUT
 # ---