Instalare Wireguard si Squid cu Adguard

=====================

In cadrul acestui tutorial vom seta un server VPN Wireguard, un server PROXY Squid si un server DNS Adguard.
La aceste servere va veti conecta de pe PC-ul cu windows sau linux sau direct pe telefonul cu android, f posibil sa mearga si pe iphone, nu am, nu am cum sa testez.
Serverul adguard va avea niste filtre care vor bloca reclamele de pe orice site, mai putin youtube, pt youtube avem alta solutie aici

In locatia unde instalezi ce se va explica aici (cu docker) trebuie sa ai ip public si un DNS. Ex: example.com
Se forwardeaza din router (sau security group daca e vps in cloud) porturile catre linuxul unde vor rula serviciile:
De asemeni pt configurare adguard de la zero veti avea nevoie si de 3000. Voi explica mai jos ca puteti folosi adguard-ul meu gata configurat si nu mai este nevoie.
Ca sa functioneze acest setup, va trebui ca pe VPS-ul unde puneti aceste servicii sa schimbati DNS-ul linuxului cu adguard si ca sa fie functional veti avea nevoie de asemeni si de dnsmasq, este obligatoriu.
Eu am pus aceasta solutie pe un server free de la oracle cloud care din pacate este cu arm64 dar e testat si functional. Evident ca merge si pe orice linux x86_64
Pe ubuntu trebuie oprit systemd-resolved.service si dezactivat insa nu de la inceput si cam pe orice linux procedura este similara:

Eu am pus totul cu root, recomandat este sa se foloseasca totusi un user separat.
Se da allow din firewall pe masina la aceste porturi (iptables, ufw, depinde ce ai).
Exemplu basic iptables pt custom ports exista aici

In /root creati urmatoarele 5 foldere:
In fiecare folder va exista un fisier start.sh cu drepturi execute si fisierele si subfoldere aditionale.
Se instaleaza docker pe linuxul respectiv, e mai simplu asa, ce este de explicat aici va fi integral docker:
(deci daca ai ubuntu/debian pachetul este docker.io, daca ai fedora/centos exista repo special pt docker-ce)


O sa luam cele 5 foldere pe rand:

DNSmasq

Va duceti in folder prima data si ramaneti acolo.
In acest folder veti avea nevoie de dnsmasq.conf care se creeaza automat ruland acest fisier:
il puteti crea cu numele generare_conf.sh:
Il faceti executabil ca dealtfel toate fisierele .sh ce vor urma cu chmod +x generare_conf.sh si il rulati din folderul respectiv adica /root/dnsmasq cu ./generare_conf.sh
Imediat dupa ce l-ati rulat o sa vedeti ca s-a creat fisierul dnsmasq.conf care la mine ca exemplu arata asa:
Ce face generare_conf.sh, pai citeste numele interfetelor pe care le aveti cu niste conditii si IP-urile care trebuie si le aranjeaza in asa fel in fisierul dnsmasq.conf astfel incat serverul dnsmasq sa il citeasca corect.

Dupa ce ati oprit serviciul systemd-resolved (am scris mai sus), trebuie sa puneti o singura data in /etc/resolv.conf:
Fisierul start.sh care apeleaza si generarea dnsmasq.conf de mai sus:
Din folderul /root/dnsmasq porniti containerul cu ./start.sh si ulterior verificati daca a pornit containerul, loguri samd.

Creare retea docker

- Pt urmatoarele 3 containere va trebui creata o retea docker speciala care va fi folosita de adguard, squid si wg-easy: O mica mentiune, aceste 3 containere folosesc docker network "retea" creeata aici iar dnsmasq si nginx folosesc docker network host!!

Adguard

Va duceti in folder prima data si ramaneti acolo.
Creati 2 subfoldere confdir si workdir si apoi start.sh Ca sa instalati si sa configurati adguard trebuie sa accesati prima data serverul pe portul 3000 dupa care pe 8080 pt toate setarile care nu sunt putine insa trebuie sa acceptati din firewall portul 3000, sa accesati si sa configurati manual mai intai.
Pt a evita treaba asta o sa pun o arhiva cu toate folderele inclusiv adguard cu tot ce contine, cu ce upstream DNS folosesc eu, setari, filtre, DNS custom samd si administrarea se va face pe 8080, ma rog, prin intermediul nginx care se va explica mai jos.
Daca vreti sa folositi cum am setat eu va logati cu user: adguard si parola1234.
Din folderul /root/adguard porniti containerul cu ./start.sh si ulterior verificati daca a pornit containerul, loguri samd.

Inainte de a trece mai departe, avand in vedere ca deja dnsmasq si adguard ruleaza si este configurat indiferent de metoda, ar trebui sa va rezolve DNS-ul pe host, verificati orice site cu nslookup, ping etc.

Squid

Va duceti in folder prima data si ramaneti acolo.
O sa gasiti toate fisierele in arhiva pe langa start.sh: squid.conf si password. Squid se poate restrictiona sa functioneze pe baza de trusted IP insa in situatia aceasta este mai bine pe baza de htpasswd. Aici va puteti genera continutul fisierului password cu user si parola criptata.
Va sfatuiesc sa folositi o parola cu multe caractere, caractere speciale, cifre etc

Fisierul de configurare squid.conf care nu necesita nicio modificare decat port daca il rulati cu network host (recomandat pt o performanta mult mai buna):
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network acl localnet src 172.16.0.0/12 # RFC1918 possible internal network acl localnet src 192.168.0.0/16 # RFC1918 possible internal network acl localnet src fc00::/7 # RFC 4193 local private network range acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines acl SSL_ports port 443 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/password auth_param basic realm my-proxy-name acl authenticated proxy_auth REQUIRED http_access deny !Safe_ports # Deny CONNECT to other than secure SSL ports http_access deny CONNECT !SSL_ports # Only allow cachemgr access from localhost http_access allow all manager http_access deny manager # We strongly recommend the following be uncommented to protect innocent # web applications running on the proxy server who think the only # one who can access services on "localhost" is a local user http_access deny to_localhost # # INSERT YOUR OWN RULE(S) HERE TO ALLOW ACCESS FROM YOUR CLIENTS # # And finally deny all other access to this proxy http_access allow authenticated # Squid normally listens to port 3128 #http_port 3128 http_port 19504 #port custom pt varianta cu network host # Uncomment and adjust the following to add a disk cache directory. cache_dir null /tmp #Default: # access_log daemon:/var/log/squid/access.log squid access_log none # cache_log /var/log/squid/cache.log cache_log /dev/null # Leave coredumps in the first cache dir coredump_dir /var/spool/squid # store_id_bypass on cache deny all refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern (Release|Packages(.gz)*)$ 0 20% 2880 refresh_pattern . 0 20% 4320 #some protection from squid irc request_header_access Via deny all request_header_access X-Forwarded-For deny all reply_header_access Via deny all reply_header_access X-Forwarded-For deny all #icp_port 3130 forwarded_for off

Creati start.sh Din folderul /root/squid porniti containerul cu ./start.sh si ulterior verificati daca a pornit containerul, loguri samd.

Creare forward pe host

Inainte de a porni wirequard (wg-easy) pe host trebuie activat port forward la nivel de kernel:
Verificare:

Wireguard

Va duceti in folderul wg-easy prima data si ramaneti acolo.
Creati aici subfolderul care se va numi tot wg-easy cu mkdir wg-easy
Creati start.sh Din acelasi folder /root/wg-easy porniti containerul cu ./start.sh si ulterior verificati daca a pornit containerul, loguri samd.

Wireguard este dificil de setat fara aceasta interfata web (wg-easy) care are in spate nodejs din ce am citit, este f profesional facut, totul intr-un singur container.
Dupa ce o sa accesati mai jos in browser interfata wg-easy veti observa in subfolderul wg-easy fisierele de configurare.
Ca si curiozitate puteti observa de asemeni si cum este setat iptables in container, este nevoie de forward si postrouting pt a primi IP-ul pe partea de client:
$ docker exec -it wg-easy bash f35e32f2ea10:/app# iptables -L -nv Chain INPUT (policy ACCEPT 1492 packets, 294K bytes) pkts bytes target prot opt in out source destination 216K 165M ACCEPT 17 -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:51820 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 185K 148M ACCEPT 0 -- wg0 * 0.0.0.0/0 0.0.0.0/0 194K 285M ACCEPT 0 -- * wg0 0.0.0.0/0 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 267K packets, 305M bytes) pkts bytes target prot opt in out source destination f35e32f2ea10:/app# iptables -L -nv -t nat Chain PREROUTING (policy ACCEPT 3167 packets, 540K bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 260 packets, 20084 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 11 packets, 2008 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 11 packets, 2008 bytes) pkts bytes target prot opt in out source destination 2904 516K MASQUERADE 0 -- * eth0 10.8.0.0/24 0.0.0.0/0
Configurarea wireguard pe host fara acest wg-easy este destul de complicata si ar fi necesitat foarte multe explicatii mai ales pe parte de firewall, generare si imperechere a keylor de criptate server/client samd. Solutia wg-easy este exceptionala, repet.
Nota* Din pacate aceasta solutie cu docker dpdv performanta pierde pana la 50% din viteza up/down comparativ cu wireguard instalat nativ.
wg-easy se poate instala si nativ insa necesita sa instalezi si nodejs. Se bazeaza de asemeni pe wireguard instalat nativ insa nu am testat, totul se face pe host.
-------------------------------------------------------------------------------------------------------------------------------------------------

Alternativa server wireguard fara docker, mai rapida cu pana la ~ 50% cu management ce ruleaza docker

Pe o conexiune gigabit unde la speedtest am la download in jur de 900, 950 mbps, cu wg-easy(docker) am cam 450 mbps iar cu solutia urmatoare chiar depasesc 750 mbps la download.


Asigurati-va ca este oprit containerul wg-easy si ca nu porneste accidental, foarte important!

Se instaleaza wireguard pe linuxul respectiv, deci trebuie sa fie functional, initial fara niciun fisier de configurare dar sa fie instalat.
Obligatoriu trebuie iptables, este mai sus un link catre un exemplu.


Se editeaza fisierul gen.sh in mai multe locuri, fisierul arata asa dupa modificari:
#!/bin/sh # easy-wg-quick - Creates WireGuard configuration for hub and peers with ease # Copyright (C) 2019-2023 Krzysztof Burghardt <krzysztof@burghardt.pl> # # # License # ------- # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 as # published by the Free Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License along # with this program; if not, write to the Free Software Foundation, Inc., # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. # # You are encouraged to send comments, improvements or suggestions to # me at krzysztof@burghardt.pl # # For updates visit https://github.com/burghardt/easy-wg-quick check_if_wg_is_installed() { wg show interfaces > /dev/null 2>&1 || { echo 'Unable to use "wg" command. Are WireGuard tools installed?' printf 'Read https://github.com/burghardt/easy-wg-quick#prerequisites\n' exit 1 } } detect_ext_net_if() { if test "$(uname -s)" = "FreeBSD" || test "$(uname -s)" = "Darwin"; then route get default | awk '$1 == "interface:" { print $2 }' elif test "$(uname -s)" = "Linux"; then ip route sh | awk '$1 == "default" && $2 == "via" { print $5; exit }' fi } create_ext_net_if() { echo "No extnetif.txt... creating one!" detect_ext_net_if > extnetif.txt test -s extnetif.txt || { echo 'Unable to detect external interface name.' echo 'Set it manually in extnetif.txt file and start script again.' exit 1 } } get_ext_net_if() { cat extnetif.txt } detect_ext_net_ip() { if test "$(uname -s)" = "FreeBSD"; then ifconfig "$1" | awk '$1 == "inet" { print $2 }' elif test "$(uname -s)" = "Darwin"; then ip addr sh "$1" | grep 'inet ' | xargs | awk -F'[ /]' '{ print $2 }' elif test "$(uname -s)" = "Linux"; then ip addr sh "$1" | grep 'inet ' | xargs | awk -F'[ /]' '{ print $2 }' fi } create_ext_net_ip() { echo "No extnetip.txt... creating one!" #detect_ext_net_ip "$1" > extnetip.txt curl -4 ifconfig.co/ip > extnetip.txt test -s extnetip.txt || { echo 'Unable to detect external interface IP address.' echo 'Set it manually in extnetip.txt file and start script again.' exit 1 } } get_ext_net_ip() { cat extnetip.txt } create_client_allowedips() { echo "No intnetallowedips.txt... creating one!" echo "0.0.0.0/0, ::/0" > intnetallowedips.txt } get_client_allowedips() { cat intnetallowedips.txt } detect_fw_type() { if test "$(uname -s)" = "FreeBSD" || test "$(uname -s)" = "Darwin"; then echo "pf" elif test "$(uname -s)" = "Linux"; then echo "iptables" fi } create_fw_type() { echo "No fwtype.txt... creating one!" detect_fw_type > fwtype.txt test -s fwtype.txt || { echo 'Unable to detect firewall type.' echo 'Set it manually in fwtype.txt file and start script again.' exit 1 } } get_fw_type() { cat fwtype.txt } detect_sysctl_type() { if test "$(uname -s)" = "FreeBSD" || test "$(uname -s)" = "Darwin"; then echo "freebsd" elif test "$(uname -s)" = "Linux"; then echo "linux" fi } create_sysctl_type() { echo "No sysctltype.txt... creating one!" detect_sysctl_type > sysctltype.txt test -s sysctltype.txt || { echo 'Unable to detect sysctl type.' echo 'Set it manually in sysctltype.txt file and start script again.' exit 1 } } get_sysctl_type() { cat sysctltype.txt } check_if_ipv6_is_available() { if test -f forceipv6.txt; then echo 'File forceipv6.txt exists. Enabling IPv6 in tunnels!' return 0 elif test "$(uname -s)" = "FreeBSD" || test "$(uname -s)" = "Darwin"; then IPV6ADR=$(ifconfig "$1" | awk '$1 == "inet6" { print $2 }' | grep -v "%$1$") test -n "$IPV6ADR" && { echo 'Looks like you have IPv6 available. Enabling IPv6 in tunnels!' return 0 } elif test "$(uname -s)" = "Linux"; then ip -6 addr | grep -i 'scope global' > /dev/null 2>&1 && { echo 'Looks like you have IPv6 available. Enabling IPv6 in tunnels!' return 0 } else echo 'Unsupported operating system. Unable to detect IPv6 availability.' fi return 1 } update_seq_no() { echo "$1" > seqno.txt } create_seq_no() { echo "No seqno.txt... creating one!" update_seq_no 10 } get_seq_no() { SEQNO=$(cat seqno.txt) NEXT=$((SEQNO + 1)) update_seq_no "$NEXT" echo "$SEQNO" } create_port_no() { echo "No portno.txt... creating one!" #(shuf -i 1025-65535 -n 1 || jot -r 1 1025 65535) > .txt 2> /dev/null echo "51820" > portno.txt 2> /dev/null test -s portno.txt || { echo 'Unable to assign random port for WireGuard.' echo 'Set it manually in portno.txt file and start script again.' exit 1 } } get_port_no() { cat portno.txt } create_int_net_dns() { echo "No intnetdns.txt... creating one!" echo "10.88.188.1" > intnetdns.txt } get_int_net_dns() { cat intnetdns.txt } create_int_net_address() { echo "No intnetaddress.txt... creating one!" RNDNET1="$( (shuf -i 1-250 -n 1 || jot -r 1 1 250) 2> /dev/null)" RNDNET2="$( (shuf -i 1-250 -n 1 || jot -r 1 1 250) 2> /dev/null)" #echo "10.${RNDNET1:-127}.${RNDNET2:-0}." > intnetaddress.txt echo "10.88.188." > intnetaddress.txt } get_int_net_address() { cat intnetaddress.txt } create_int_net_mtu() { echo "No intnetmtu.txt... creating one!" echo "1280" > intnetmtu.txt } get_int_net_mtu() { cat intnetmtu.txt } create_int_net_mask() { echo "No intnetmask.txt... creating one!" echo "/24" > intnetmask.txt } get_int_net_mask() { cat intnetmask.txt } create_int_net6_dns() { echo "No intnet6dns.txt... creating one!" echo "2606:4700:4700::1111" > intnet6dns.txt } get_int_net6_dns() { cat intnet6dns.txt } create_int_net6_address() { echo "No intnet6address.txt... creating one!" RNDGLB1="$( (shuf -i 11-99 -n 1 || jot -r 1 11 99) 2> /dev/null)" RNDGLB2="$( (shuf -i 1111-9999 -n 1 || jot -r 1 1111 9999) 2> /dev/null)" RNDGLB3="$( (shuf -i 1111-9999 -n 1 || jot -r 1 1111 9999) 2> /dev/null)" RNDSUBN="$( (shuf -i 1111-9999 -n 1 || jot -r 1 1111 9999) 2> /dev/null)" echo "fd${RNDGLB1:-fc}:${RNDGLB2:-2965}:${RNDGLB3:-0503}:${RNDSUBN:-e2ae}::" > intnet6address.txt } get_int_net6_address() { cat intnet6address.txt } create_int_net6_mask() { echo "No intnet6mask.txt... creating one!" echo "/64" > intnet6mask.txt } get_int_net6_mask() { cat intnet6mask.txt } create_ipv6_mode() { echo "No ipv6mode.txt... creating one!" echo "masquerade" > ipv6mode.txt } get_ipv6_mode() { cat ipv6mode.txt } create_hub_key() { echo "No wghub.key... creating one!" wg genkey > wghub.key } create_iptables_rules() { main_eth="$(ip link show | grep -E 'eth[0-9]+|ens[0-9]+|enp[0-9]+'| grep -v veth|awk -F ': ' '{print $2}')" cat << EOF PostUp = iptables -I FORWARD -i wghub -j ACCEPT;iptables -t nat -I POSTROUTING -s 10.88.188.0/24 -o $main_eth -j MASQUERADE; PostDown = iptables -D FORWARD -i wghub -j ACCEPT;iptables -t nat -D POSTROUTING -s 10.88.188.0/24 -o $main_eth -j MASQUERADE; EOF } create_firewalld_rules() { cat << EOF PostUp = firewall-cmd --zone=public --add-port $EXT_NET_PORT/udp PostUp = firewall-cmd --zone=public --add-masquerade PostUp = firewall-cmd --zone=public --add-rich-rule='rule tcp-mss-clamp value=pmtu' PostDown = firewall-cmd --zone=public --remove-port $EXT_NET_PORT/udp PostDown = firewall-cmd --zone=public --remove-masquerade PostDown = firewall-cmd --zone=public --remove-rich-rule='rule tcp-mss-clamp value=pmtu' EOF } create_ufw_rules() { cat << EOF PostUp = ufw allow $EXT_NET_PORT/udp PostUp = ufw route allow in on %i out on $EXT_NET_IF PostUp = ufw route allow in on %i out on %i PostUp = iptables -t nat -A POSTROUTING -o $EXT_NET_IF -j MASQUERADE PostUp = iptables -t mangle -A POSTROUTING -o $EXT_NET_IF -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu $($NET6 && echo "PostUp = ip6tables -t mangle -A POSTROUTING -o $EXT_NET_IF -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu") PostDown = ufw delete allow $EXT_NET_PORT/udp PostDown = ufw route delete allow in on %i out on $EXT_NET_IF PostDown = ufw route delete allow in on %i out on %i PostDown = iptables -t nat -D POSTROUTING -o $EXT_NET_IF -j MASQUERADE PostDown = iptables -t mangle -D POSTROUTING -o $EXT_NET_IF -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu $($NET6 && echo "PostDown = ip6tables -t mangle -D POSTROUTING -o $EXT_NET_IF -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu") EOF if $NET6 && test "$NET6MODE" = "masquerade"; then cat << EOF PostUp = ip6tables -t nat -A POSTROUTING -o $EXT_NET_IF -j MASQUERADE PostDown = ip6tables -t nat -D POSTROUTING -o $EXT_NET_IF -j MASQUERADE EOF fi } create_sysctl_linux_rules() { cat << EOF PostUp = sysctl -q -w net.ipv4.ip_forward=1 PostDown = sysctl -q -w net.ipv4.ip_forward=0 EOF if $NET6 && test "$NET6MODE" = "proxy_ndp"; then cat << EOF PostUp = sysctl -q -w net.ipv6.conf.all.proxy_ndp=1 PostDown = sysctl -q -w net.ipv6.conf.all.proxy_ndp=0 EOF fi } create_pf_rules() { cat << EOF PostUp = printf 'nat on $EXT_NET_IF from %i:network to any -> ($EXT_NET_IF)\\npass all\\n' | pfctl -f - PostUp = pfctl -e PostDown = pfctl -d PostDown = printf '' | pfctl -f - EOF } create_sysctl_freebsd_rules() { cat << EOF PostUp = sysctl net.inet.ip.forwarding=1 PostUp = sysctl net.inet6.ip6.forwarding=1 PostDown = sysctl net.inet.ip.forwarding=0 PostDown = sysctl net.inet6.ip6.forwarding=0 EOF } create_hub_conf() { echo "No wghub.conf... creating one!" cat > wghub.conf << EOF # Hub configuration created on $(hostname) on $(date) [Interface] Address = $INT_NET_HUB_IP$INT_NET_MASK$($NET6 && echo ", $INT_NET6_HUB_IP$INT_NET6_MASK") ListenPort = $EXT_NET_PORT PrivateKey = $(cat wghub.key) SaveConfig = false MTU = $INT_NET_MTU EOF if test "$FW_TYPE" = "iptables"; then create_iptables_rules >> wghub.conf elif test "$FW_TYPE" = "nft"; then create_nft_rules >> wghub.conf elif test "$FW_TYPE" = "firewalld"; then create_firewalld_rules >> wghub.conf elif test "$FW_TYPE" = "ufw"; then create_ufw_rules >> wghub.conf elif test "$FW_TYPE" = "pf"; then create_pf_rules >> wghub.conf elif test "$FW_TYPE" = "custom"; then echo '# Custom PostUp / PostDown commands from commands.txt' >> wghub.conf cat commands.txt >> wghub.conf elif test "$FW_TYPE" = "none"; then echo '# Firewall PostUp / PostDown commands disabled with "none" set in fwtype.txt' >> wghub.conf fi if test "$SYSCTL_TYPE" = "linux"; then create_sysctl_linux_rules >> wghub.conf elif test "$SYSCTL_TYPE" = "freebsd"; then create_sysctl_freebsd_rules >> wghub.conf elif test "$SYSCTL_TYPE" = "none"; then echo '# Sysctl PostUp / PostDown commands disabled with "none" set in sysctltype.txt' >> wghub.conf fi echo "WireGuard hub address is $EXT_NET_IP:$EXT_NET_PORT on $EXT_NET_IF." echo "Note: customize [Interface] section of wghub.conf if required!" } ip2int() { { IFS=. read -r a b c d; } << EOF $1 EOF echo $(((((((a << 8) | b) << 8) | c) << 8) | d)) } int2ip() { ui32=$1 ip="" # shellcheck disable=SC2034 for n in 1 2 3 4; do ip=$((ui32 & 0xff))${ip:+.}$ip ui32=$((ui32 >> 8)) done echo "$ip" } create_new_client_ip() { { IFS=/ read -r ip netmask; } << EOF $1 EOF seqno=$2 bitmask=$((0xffffffff << (32 - netmask))) addr=$(($(ip2int "$ip") + (seqno & ~bitmask))) echo "$(int2ip "$addr")/$netmask" } create_new_client_conf_wg_quick() { SEQNO="$1" CONF_NAME="$2" echo "No wgclient_$CONF_NAME.conf... creating one!" cat > "wgclient_$CONF_NAME.conf" << EOF # $SEQNO: $CONF_NAME > wgclient_$CONF_NAME.conf [Interface] Address = $(create_new_client_ip "${INT_NET_ADDRESS}0$INT_NET_MASK" "$SEQNO")$($NET6 && echo ", $INT_NET6_ADDRESS$SEQNO$INT_NET6_MASK") DNS = $INT_NET_DNS$($NET6 && echo ", $INT_NET6_DNS") PrivateKey = $(wg genkey | tee "wgclient_$CONF_NAME.key") MTU = $INT_NET_MTU [Peer] PublicKey = $(wg pubkey < wghub.key) PresharedKey = $(wg genpsk | tee "wgclient_$CONF_NAME.psk") AllowedIPs = $INT_NET_CLINET_ALLOWEDIPS Endpoint = $EXT_NET_IP:$EXT_NET_PORT PersistentKeepalive = 25 EOF } allowedips_to_uci_list() { ALLOWEDIPS="$1" for IPRANGE in $(echo "$ALLOWEDIPS" | tr "," " "); do echo " list allowed_ips '$IPRANGE'" done } create_new_client_conf_uci() { SEQNO="$1" CONF_NAME="$2" echo "No wgclient_$CONF_NAME.uci.txt... creating one!" cat > "wgclient_$CONF_NAME.uci.txt" << EOF # $SEQNO: $CONF_NAME > wgclient_$CONF_NAME.uci.txt config interface 'wg0' option proto 'wireguard' list addresses '$(create_new_client_ip "${INT_NET_ADDRESS}0$INT_NET_MASK" "$SEQNO")' $($NET6 && echo " list addresses '$INT_NET6_ADDRESS$SEQNO$INT_NET6_MASK'") list dns '$INT_NET_DNS' $($NET6 && echo " list dns '$INT_NET6_DNS'") option private_key '$(cat "wgclient_$CONF_NAME.key")' option mtu '$INT_NET_MTU' config wireguard_wg0 $(allowedips_to_uci_list "$INT_NET_CLINET_ALLOWEDIPS") option route_allowed_ips '1' option endpoint_host '$EXT_NET_IP' option endpoint_port '$EXT_NET_PORT' option persistent_keepalive '25' option public_key '$(wg pubkey < wghub.key)' option preshared_key '$(cat "wgclient_$CONF_NAME.psk")' EOF } create_new_client_conf() { create_new_client_conf_wg_quick "$SEQNO" "$CONF_NAME" create_new_client_conf_uci "$SEQNO" "$CONF_NAME" } add_client_to_hub_conf() { SEQNO="$1" CONF_NAME="$2" printf "Updating wghub.conf..." cat >> wghub.conf << EOF # $SEQNO: $CONF_NAME > wgclient_$CONF_NAME.conf [Peer] PublicKey = $(wg pubkey < "wgclient_$CONF_NAME.key") PresharedKey = $(cat "wgclient_$CONF_NAME.psk") AllowedIPs = $INT_NET_ADDRESS$SEQNO$INT_NET_ADDRESS_MASK$($NET6 && echo ", $INT_NET6_ADDRESS$1$INT_NET6_ADDRESS_MASK") EOF if $NET6 && test "$NET6MODE" = "proxy_ndp"; then NEIGHADD="PostUp = ip -6 neigh add proxy $INT_NET6_ADDRESS$1 dev $EXT_NET_IF" NEIGHDEL="PostDown = ip -6 neigh del proxy $INT_NET6_ADDRESS$1 dev $EXT_NET_IF" sed -i.bak "s/.*net.ipv6.conf.all.proxy_ndp=0.*/&\n$NEIGHADD\n$NEIGHDEL/" wghub.conf fi echo " done!" cat << EOF Important: Deploy updated wghub.conf configuration to WireGuard with wg-quick: sudo wg-quick down ./wghub.conf # if already configured sudo wg-quick up ./wghub.conf sudo wg show # to check status EOF } print_client_conf() { echo "-----BEGIN CONFIG-----" cat "wgclient_$1.conf" echo "-----END CONFIG-----" } print_client_qrcode() { chmod 644 wgclient_$1.conf #qrencode -t ansiutf8 < "wgclient_$1.conf" | tee "wgclient_$1.qrcode.txt" qrencode -t png -o "wgclient_$1.qrcode.png" -r "wgclient_$1.conf" chmod 644 wgclient_$1.qrcode.png echo "Scan QR code with your phone or use \"wgclient_$1.conf\" file." } remove_temporary_client_key_file() { rm -f "wgclient_$1.key" } check_conf_name_is_available() { FILENAME="wgclient_$1.conf" if test -e "$FILENAME"; then printf '\nUnable to store configuration with chosen name: "%s" already exists.\n' "$FILENAME" return 1 fi return 0 } print_conf_name_help() { cat << EOF Note: passing argument to script creates client configuration with supplied name to help remembering which config was for which device. If you didn't pass any argument you can still rename created file manually with command: mv -vi wgclient_$1.conf wgclient_name.conf EOF } create_new_client() { SEQNO="$1" CONF_NAME="$2" create_new_client_conf "$SEQNO" "$CONF_NAME" # if qrencode -V > /dev/null 2>&1; then print_client_qrcode "$CONF_NAME" # else print_client_conf "$CONF_NAME" # fi add_client_to_hub_conf "$SEQNO" "$CONF_NAME" remove_temporary_client_key_file "$CONF_NAME" } write_initial_configuration() { test -f extnetif.txt || create_ext_net_if EXT_NET_IF="$(get_ext_net_if)" test -f extnetip.txt || create_ext_net_ip "$EXT_NET_IF" EXT_NET_IP="$(get_ext_net_ip)" test -f intnetmtu.txt || create_int_net_mtu INT_NET_MTU="$(get_int_net_mtu)" if test "$INT_NET_MTU" -lt 1280 || test "$INT_NET_MTU" -gt 1420; then echo 'MTU should be set between 1280 and 1420 bytes.' echo 'Set it manually in intnetmtu.txt file and start script again.' exit 1 fi test -f intnetmask.txt || create_int_net_mask INT_NET_MASK="$(get_int_net_mask)" test -f intnetdns.txt || create_int_net_dns INT_NET_DNS="$(get_int_net_dns)" test -f intnetaddress.txt || create_int_net_address INT_NET_ADDRESS="$(get_int_net_address)" INT_NET_ADDRESS_MASK="/32" INT_NET_HUB_IP="${INT_NET_ADDRESS}1" test -f intnetallowedips.txt || create_client_allowedips INT_NET_CLINET_ALLOWEDIPS="$(get_client_allowedips)" test -f fwtype.txt || create_fw_type FW_TYPE="$(get_fw_type)" test -f sysctltype.txt || create_sysctl_type SYSCTL_TYPE="$(get_sysctl_type)" NET6=false check_if_ipv6_is_available "$EXT_NET_IF" && { NET6=true test -f ipv6mode.txt || create_ipv6_mode NET6MODE="$(get_ipv6_mode)" test -f intnet6mask.txt || create_int_net6_mask INT_NET6_MASK="$(get_int_net6_mask)" test -f intnet6dns.txt || create_int_net6_dns INT_NET6_DNS="$(get_int_net6_dns)" test -f intnet6address.txt || create_int_net6_address INT_NET6_ADDRESS="$(get_int_net6_address)" INT_NET6_ADDRESS_MASK="/128" INT_NET6_HUB_IP="${INT_NET6_ADDRESS}1" } check_if_wg_is_installed test -f seqno.txt || create_seq_no SEQNO="$(get_seq_no)" test -f portno.txt || create_port_no EXT_NET_PORT="$(get_port_no)" test -f wghub.key || create_hub_key } print_usage() { echo "Usage: $0 [client_name] - create new clinet with optional [client_name]" echo " $0 --init - create initial configuration without any clients" echo " $0 --clear - clear the configuration and start over" exit 1 } main() { umask 077 if test "$#" -ge 2; then print_usage fi case "$1" in "-h" | "--help") print_usage ;; "-i" | "--init") write_initial_configuration echo "Check the contents of the *.txt files and adjust them to your needs." echo "Run the script again without --init to continue, or remove these files to start over." exit 0 ;; "-c" | "--clear") echo "To start over, manually remove all *.bak *.conf *.key *.psk *.txt files." echo "This script removes nothing." exit 1 ;; *) CONF_NAME="$1" ;; esac write_initial_configuration if test ! -f wghub.conf; then # shellcheck disable=SC2154 if test -z "$BATS_VERSION"; then echo "The default configuration is written to text files (*.txt)." echo "If you want to check or change anything, press Ctrl+C for 10 seconds." sleep 10 fi create_hub_conf fi if test -z "$CONF_NAME"; then CONF_NAME="$SEQNO" print_conf_name_help "$SEQNO" fi if check_conf_name_is_available "$CONF_NAME"; then create_new_client "$SEQNO" "$CONF_NAME" fi } main "$@" ls -alt|grep wgclient|head -4|awk '{print $NF}'|xargs -I {} chmod 644 {} source included.sh chmod 644 wghub.conf #/bin/bash -c 'exec /usr/bin/wg syncconf wghub <(exec /usr/bin/wg-quick strip wghub)'
Se ruleaza gen.sh si genereaza toate fisierele necesare si totodata se creeaza si primul client (client1) dupa care se restarteaza serverul:
Listati cu ls sa vedeti ca a creat niste fisiere, nu voi explica ce face fiecare, doar pt client1 sunt 3 fisiere la numar.

In momentul asta wireguard ar trebui sa fie deja pornit si se verifica ca s-a ridicat:
Nota* In Adguard se trece si IP-ul 10.88.188.1 la lista de IP-uri permise.
De asemeni in dnsmasq.conf (docker) trebuie refacut dnsmasq.conf:
-se adauga interface=wghub si jos la listen-address se pune si 10.88.188.1
si apoi se restarteaza containerul dnsmasq


Pt generarea urmatorilor clienti. de ex client2 sau cum vreti sa il denumiti ca sa stiti cine il foloseste: Cu comanda asta se genereaza cele 3 fisiere pt client2, adauga automat index nou in fisierul seqno.txt si de asemeni adauga noul client(peer) in server wghub.conf. Comanda nu mai modifica/adauga nimic altceva!

Ca sa stergeti un client (peer) rulati acest script si va sterge peer-ul din wghub.conf si sterge cele 3 fisiere client.
Fisierul il aveti dedesubt si il rulati cu: Daca ati scris gresit numele clientului scriptul de opreste, nu are sens sa restarteze wireguard degeaba.
#!/bin/bash # Check if filename and search string are provided #if [ $# -ne 2 ]; then # echo "Usage: $0 <filename> <search_string>" # exit 1 #fi log=wglog.log if [ $# -ne 1 ]; then echo "Usage: $0 <search_string>" exit 1 fi #filename="$1" filename="wghub.conf" #search_string="$2" search_string="$1" # Check if file exists if [ ! -f "$filename" ]; then echo "File '$filename' does not exist." exit 1 fi # Check if string exists if grep -qw "$search_string" wghub.conf; then echo string is in file at least once else echo string $search_string not present in file exit 1 fi # Create a temporary file temp_file=$(mktemp) || exit 1 # Read the file line by line while IFS= read -r line; do # Check if the line contains the search string if [[ "$line" == *"$search_string"* ]]; then # Skip the current line and the following 3 lines for (( i = 0; i < 5; i++ )); do read -r done else # Write the line to the temporary file echo "$line" >> "$temp_file" fi done < "$filename" # Overwrite the original file with the temporary file mv "$temp_file" "$filename" echo "Lines containing '$search_string' and the following 3 lines have been removed from '$filename'." rm -f wgclient_$search_string.* source included.sh chmod 644 wghub.conf chmod 777 seqno.txt #/bin/bash -c 'exec /usr/bin/wg syncconf wghub <(exec /usr/bin/wg-quick strip wghub)'
Observam ca exista si un fisier inclus included.sh, acest fisier mai verifica inca o data seqno.txt si elimina liniile goale inutile din fisierul wghub.conf care mai apar la rularea gen.sh sau del.sh:
#!/bin/bash #chech and adjust seqno for the last part of IP aidi=$(cat wghub.conf | grep "#" | tail -1 | awk '{print $2}' | cut -d ":" -f 1) aidi=$((aidi + 1)) echo $aidi seq=$(cat seqno.txt) if [[ "$aidi" != "$seq" ]]; then echo $aidi > seqno.txt echo "seqno.txt updated!" fi # Specify the file to check file="wghub.conf" # Temporary file to store the modified content temp_file="$(mktemp)" # Set a flag to indicate if the previous line was empty previous_empty=false # Read the file line by line while IFS= read -r line; do # Check if the line is empty if [ -z "$line" ]; then # If the previous line was also empty, skip this line if $previous_empty; then continue fi # Set the flag to indicate an empty line previous_empty=true else # If the previous line was empty, reset the flag if $previous_empty; then previous_empty=false fi fi # Append the line to the temporary file echo "$line" >> "$temp_file" done < "$file" # Replace the original file with the modified content if ! cmp -s "$file" "$temp_file"; then mv "$temp_file" "$file" else rm "$temp_file" fi chown 82:82 $file fi

Cam atat, scripturile functioneaza daca se face administrarea ssh insa scopul este sa facem management web ca sa nu intram ssh de fiecare data.
Ca sa fie clar, toate fisierele trebuie sa fie in /root/easy-wg-quick: del.sh, gen.sh, included.sh, index.php, qrcode.png, wireguard.png plus ce se genereaza ulterior. Doar primele 3 va trebuie daca ramaneti la ssh!

Pt management web este relativ complicat de setat, o sa incerc sa explic aici cum am reusit:
Dupa ce este pus si php-ul (vedeti mai jos cum) testati din browser adaugarea unui peer si ar trebui sa va genereze 3 fisiere noi si sa modifice si continutul fisierului wghub.conf
Din cauza containerului php, fisierele se creaza cu alt owner, in cazul meu 82 (pt ca userul www-data din container are uid 82) si ca atare tot folderul /root/easy-wg-quick trebuie sa aiba chown 82:82 cu tot cu fisierele din interior. Puteti crea manual pe host www-data cu id 82 sau daca exista deja doar ii schimbati id cu usermod si o sa va arate frumos fisierele cu www-data insa sincer nu ajuta la nimic.
Acelasi folder /root/easy-wg-quick are chmod 777, din pacate nu merge altfel. Deci la un ls in folder, totul trebuie sa fie cu 82 (user si group) sau www-data daca ati facut ce am scris si de asemeni toate fisierele trebuie sa aiba chmod 644 cel putin.
Fisierul seqno.txt trebuie sa aiba 777 iar cele sh 755 (execute) altfel nu merge nimic. Pe alocuri se mai strica permisiunile si am pus niste comenzi chmod si chown prin scripturile sh.
Daca sunt indeplinite toate conditiile puteti genera si sterge clienti din pagina web, adica pe partea de fisiere e totul ok insa din browser nu se poate da restart la wireguard ca sa le mai si ia in considerare. Comanda de restart este inclusa in gen.sh si del.sh dar merge numai daca scriptul este executat din consola, nu din php! Tot din cauza userului www-data, in momentul in care ajunge sa execute comanda wg-quick down/up, (wireguard-tools si sudo de asemeni instalate in container) nu are cum sa execute pe host din lipsa de drepturi.
Am incercat tot felul de workaround-uri inclusiv sa schimb uid in container din 82 in 1000, nu are niciun efect.
Culmea este ca in container functioneaza comanda wg-quick, nu mai da nici o eroare in loguri dar totusi nu restarteaza.
Intr-un final am renuntat, posibil sa se poata faca insa probabil s-ar crea niste gauride securitate dupa cum am citit, nu prea avea rost si pe cale de consecinta am comentat comanda de reload wg de la sfarsitul scripturilor gen.sh si del.sh, nu isi mai are rostul.

Asadar pt restart wireguard ca sa se ia in considerare modificarile fisierelor facute din browser, aveti doua metode:
Metoda 1. cro.sh pe care il puneti pe host direct in /root/ nu in subfolderul easy-wg-quick care ruleaza in crontab la 2 minute si verifica cand s-a modificat ultima data wghub.conf. Daca e mai nou de 1.99 min (aprox 119 secunde) atunci da restart la wireguard, daca nu, nu pt ca nu are sens:


Crontab-ul:

Metoda 2. Cream in systemd un serviciu wgui.service si un fisier path wgui.path cu care se monitorizeaza fisierul wghub.conf si da restart wireguard cand acesta s-a modificat. Nu sunt mare fan systemd, e prima data cand am testat scenariul asta:
$ nano /etc/systemd/system/wgui.service [Unit] Description=Restart-WireGuard After=network.target [Service] Type=oneshot ExecStart=/root/easy-wg-quick/restartwg.sh [Install] RequiredBy=wgui.path $ nano /etc/systemd/system/wgui.path [Unit] Description=Watch /root/easy-wg-quick/wghub.conf for changes [Path] PathModified=/root/easy-wg-quick/wghub.conf [Install] WantedBy=multi-user.target
Nu dati enable la serviciul asta wgui pt ca va porni la reboot si o sa dea eroare pt ca el se astepta ca interfata wghub sa fie up.
Trebuie sa dati si un systemctl daemon-reload dupa ce creati astea 2 fisiere systemd:

De asemeni mai trebuie inca un fisier sa zicem /root/easy-wg-quick/restartwg.sh apelat de wgui.service care e la fel ca si fisierul cro.sh dar fara niciun fel de conditie:
Nu sunt fan systemd, serviciul wireguardului nu il manage-uiesc cu systemctl, nu merge niciodata cum trebuie insa artificul cu acest wgui isi face treaba.
Nu garantez ca va functiona din prima, trebuie monitorizate logurile de la containerul php in caz ca nu merge ceva, am facut asa de multe incercari si modificari incat nu stiu daca e totul acoperit aici, din pacate le-am bajbait si eu intr-un mare fel pana a iesit...
A doua metoda modifica instant, practic este un fel de reload, face fix acelasi lucru.
Singurul avantaj e ca face instant insa necesita un serviciu aditional, chestie de gust.
Aceasta solutie de deasupra are management web docker (nginx+php) facut de mine si wireguard instalat nativ pe host.

Nginx

Va duceti in folderul nginx prima data si ramaneti acolo.
Aici creati subfolderul conf.d in care veti avea 2 fisiere: adguard.conf si wg.conf. Creati de asemeni si subfolder cert.
Aceste 2 vhosturi vor folosi certificate LetEncrypt care se genereaza cu mai multe metode, puteti cauta exemplu aici
Indiferent de metoda, se vor genera 2 fisiere, recomand sa fie certificat wildcard pt ca aveti nevoie de 2 inregistrari:
Creati vhost-urile care arata cam asa:
$ nano /root/nginx/conf.d/wg.conf server { listen 443 ssl; server_name wireguard.example.com; ssl_certificate /etc/ssl/fullchain.pem; ssl_certificate_key /etc/ssl/privkey.pem; #auth_basic "Private Property"; #auth_basic_user_file /etc/nginx/parole/.htpasswd; location / { proxy_pass http://localhost:51821; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 600; } } $ nano /root/nginx/conf.d/adguard.conf server { listen 443 ssl; server_name adguard.example.com; ssl_certificate /etc/ssl/fullchain.pem; ssl_certificate_key /etc/ssl/privkey.pem; #auth_basic "Private Property"; #auth_basic_user_file /etc/nginx/parole/.htpasswd; location / { proxy_pass http://localhost:8080; proxy_set_header Host $http_host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_read_timeout 600; } }
In cazul in care folositi wireguard instalat nativ pe baza solutiei prezentate mai sus, vhostul pt wg se schimba si va functiona in tandem cu un alt container php:
$ nano /root/nginx/conf.d/wg.conf server { listen 443 ssl; server_name wireguard.example.com; ssl_certificate /etc/ssl/fullchain.pem; ssl_certificate_key /etc/ssl/privkey.pem; #aici trebuie sa generati htpasswd pt autentificare auth_basic "Private Property"; auth_basic_user_file /etc/nginx/.htpasswd; root /usr/share/nginx/html; client_max_body_size 12m; index index.php index.html index.htm; location / { autoindex on; client_max_body_size 20M; #create_full_put_path on; } location ~ \.php$ { include fastcgi_params; fastcgi_pass 10.0.0.112:9001; #aici trebuie pus ip fastcgi_index index.php; fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name; } }

Dupa ce aveti vhost-urile si certificatele puse in foldere, creati start.sh
Din acelasi folder /root/nginx porniti containerul cu ./start.sh si ulterior verificati daca a pornit containerul, loguri samd.

-Deschideti in browser https://adguard.example.com si revizuiti setarile, adaugati custom DNS, adaugati alte liste etc
Am specificat mai sus cum si am pus si credentialele. Vreti de la zero sa configurati, aveti mai sus explicatii.
Trebuie sa aveti mare atentie la Settings/DNS Settings la sectiunea Allowed clients unde trebuie sa adaugati ip-ul de pe VPS si clasa "retea": 192.168.11.0/28! sau 10.88.188.0/24 pt wg nativ si eventual si clasa network default 172.17.0.0/26 daca mai sunt si alte containere pe masina si vreti sa aiba resolver Adguard-ul.
-Deschideti in browser https://wireguard.example.com si creati clienti pt utilizare pe android (QR code) sau pe PC (download config file)
-Pt varianta wireguard instalata nativ veti deschide acelasi https://wireguard.example.com dar ca sa functioneze veti avea nevoie si de un container php:

PHP (pt varianta wireguard fara docker)

Se build-uieste imaginea php cu pachete aditionale, in principiu wireguard-tools si sudo nu cred ca mai sunt necesare, restul insa trebuie.

Creati folderul /root/php daca nu este creat si intrati in el: FROM php:8.2-fpm-alpine WORKDIR /usr/share/nginx/html RUN apk add --update --no-cache bash libgd libpng-dev libjpeg-turbo-dev freetype-dev icu-dev wireguard-tools sudo libqrencode libqrencode-tools RUN docker-php-ext-install -j$(nproc) gd RUN docker-php-ext-install -j$(nproc) opcache RUN sed -i 's/9000/9001/' /usr/local/etc/php-fpm.d/zz-docker.conf RUN sed -i 's/9000/9001/' /usr/local/etc/php-fpm.d/www.conf RUN sed -i 's/9000/9001/' /usr/local/etc/php-fpm.d/www.conf.default RUN sed -i 's/9000/9001/' /usr/local/etc/php-fpm.d/docker.conf
Ramanem in folderul /root/php si cream start.sh

Fisierul index.php care se va folosi trebuie pus in /root/easy-wg-quick unde sunt toate fisierele wireguard, php de acolo citeste:
<head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>WireGuard Hub Management</title> <link rel="icon" href="favicon.ico" type="image/x-icon"> </head> <style> body { font-family: Arial, sans-serif; background-color: #f9f9f9; margin: 0; padding: 0; min-height: 100vh; /* Keep min-height to ensure full viewport height */ overflow-y: auto; /* Enable vertical scrolling */ } .container { display: flex; flex-direction: column; justify-content: center; align-items: center; min-height: 100vh; /* Adjust height as needed */ width: 80%; padding: 20px; background-color: #fff; border-radius: 8px; box-shadow: 0px 0px 10px 0px rgba(0,0,0,0.1); margin: 20px auto; /* Simplify margin to center the container */ } .column { width: 100%; } h2 { color: #ff0000; } p { margin-bottom: 10px; } input[type="text"], input[type="submit"] { padding: 8px; margin-right: 10px; } a { color: #ff0000; } </style> <body> <?php error_reporting(E_ERROR | E_PARSE); // Read wghub.conf $confContent = file_get_contents("wghub.conf"); // Function display peers function displayPeers($confContent) { $lines = explode("\n", $confContent); $peerName = ""; $peerIP = ""; foreach ($lines as $line) { // Extracting peer and IP if (preg_match('/# (\d+): (\S+) >/', $line, $matches)) { $peerID = $matches[1]; $peerName = $matches[2]; } // Extracting IP from "AllowedIPs" if (strpos($line, "AllowedIPs") !== false) { preg_match('/= (\S+)/', $line, $matches); if (isset($matches[1])) { $peerIP = $matches[1]; } } // Display peers if ($peerName !== "" && $peerIP !== "") { //echo "<p>ID: $peerID | Name: <b>$peerName</b> | IP: $peerIP | <a href=\"index.php?action=remove&peer=" . urlencode($peerName) . "\">Remove</a> | <a href=\"wgclient_$peerName.conf\">Download</a></p>"; $dld=$_SERVER['SERVER_HOST']."/download.png"; echo "<p>ID: $peerID | Name: <b>$peerName</b> | IP: $peerIP| <a href=\"index.php?action=remove&peer=" . urlencode($peerName) . "\">Remove</a> |</p>"; $qrCodeFile = "wgclient_$peerName.qrcode.png"; // $qrCodeContent = file_get_contents($qrCodeFile); $linkpoza=$_SERVER['SERVER_HOST']."/qrcode.png"; if ($linkpoza !='')print ("<a href=\"wgclient_$peerName.qrcode.png\"><img width=20px src=$linkpoza></a>__"); // Assume $peerName contains the unique part of the filename $fisier = 'wgclient_' . $peerName . '.conf'; // Real filename on server $fisimplu = str_replace('wgclient_', '', $fisier); // Filename to be used for download // Generate the download link for the real file, but remove the 'wgclient_' part for the download filename print('<a href="download.php?file=' . urlencode($fisier) . '"><img src="' . $dld . '" /></a>'); //$deafisat = "/bin/sh cat " . $qrCodeFile; // Reset for the next peer $peerName = ""; $peerIP = ""; } } } // Display peers ?><div class="container"> <div class="column"><?php //echo "<h1>Wireguard </h1> "; $linkwg=$_SERVER['SERVER_HOST']."/wireguard.png"; print ("<img src=$linkwg>"."<img src=vapor.png>"); echo '<br>'; echo "<h2>Existing Peers:</h2>"; displayPeers($confContent); echo ('<br><br>'); echo "<h2>Monitoring (kind of):</h2>"; //echo nl2br(shell_exec('cat mon3.txt')); $fff = file_get_contents('mon3.txt'); // Use regular expression to match and replace the client names with bold tags $formatfff = preg_replace('/Client: (\w+),/', 'Client: <b>$1</b>,', $fff); $formatggg = preg_replace('/Endpoint: ([0-9.]+):(\d+),/', 'Endpoint: <a target="_blank" href="https://db-ip.com/$1">$1</a>:$2,', $formatfff); //echo ('<br>'); echo nl2br($formatggg); // Form add new peer //echo "<div class='column'>"; echo "<h2>Add New Peer:</h2>"; echo "<form action=\"index.php\" method=\"post\">"; echo "<input type=\"hidden\" name=\"action\" value=\"add\">"; echo "<label for=\"peerName\">Peer Name:</label>"; echo "<input type=\"text\" id=\"peerName\" name=\"peerName\">"; echo "<input type=\"submit\" value=\"Add New Peer\">"; echo "</form>"; echo "</div></div></body></html>"; // Check delete if ($_SERVER["REQUEST_METHOD"] == "GET" && isset($_GET["action"]) && $_GET["action"] == "remove" && isset($_GET["peer"])) { $peerToRemove = $_GET["peer"]; // Show confirmation before proceeding with the deletion echo "<script> var confirmDelete = confirm('Are you sure you want to delete this peer?'); if (confirmDelete) { // Proceed with the deletion if user confirms window.location.href = window.location.href.split('?')[0] + '?action=confirm_remove&peer=' + '" . $peerToRemove . "'; } else { // Redirect back to the same page if user cancels window.location.href = window.location.href.split('?')[0]; } </script>"; exit; } if ($_SERVER["REQUEST_METHOD"] == "GET" && isset($_GET["action"]) && $_GET["action"] == "confirm_remove" && isset($_GET["peer"])) { $peerToRemove = $_GET["peer"]; // Execute the deletion script echo shell_exec("/bin/bash ./del.sh $peerToRemove 2>/dev/null >/dev/null &"); echo shell_exec("/bin/bash chmod 644 wghub.conf 2>/dev/null >/dev/null &"); // Use JavaScript to refresh the page after deletion echo "<script> setTimeout(function() { window.location.href = window.location.href.split('?')[0]; }, 2000); </script>"; exit; } // Check add if ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST["action"]) && $_POST["action"] == "add" && isset($_POST["peerName"])) { $peerName = $_POST["peerName"]; echo "Peer de adaugat: ".$peerName; echo "<h2>Adding New Peer: $peerName</h2>"; //echo "<p>Executing command: $addCommand</p>"; // Execute script //echo shell_exec($addCommand); echo shell_exec("/bin/bash ./gen.sh $peerName 2>/dev/null >/dev/null &"); // Use JavaScript to refresh the page after creation echo "<script> setTimeout(function() { window.location.href = window.location.href.split('?')[0]; }, 2000); </script>"; exit; } ?>
Acest php apeleaza scripturile bash gen.sh si del.sh pt a crea si sterge clienti(peers) direct din pagina web.
Pt download exista si un fisier separat download.php ca sa puteti descarca peername.conf curat:
<?php // Get the filename from the URL query parameter $file = isset($_GET['file']) ? $_GET['file'] : ''; if (file_exists($file)) { // Remove 'wgclient_' prefix for the download filename $fileNameWithoutPrefix = str_replace('wgclient_', '', basename($file)); // Set headers for downloading the file with the modified name header('Content-Description: File Transfer'); header('Content-Type: application/octet-stream'); header('Content-Disposition: attachment; filename="' . $fileNameWithoutPrefix . '"'); header('Content-Length: ' . filesize($file)); // Clear output buffer and send the file ob_clean(); flush(); // Read the file and send to the browser readfile($file); exit; } else { echo 'File not found.'; } ?>
index.php trebuie sa aiba chown 82 sau www-data daca exista!

Se poate introduce si o pseudo monitorizare care afiseaza dedesubt ce peers sunt activi, IP de la care sunt conectati, iata un mic bash care creaza mon3.txt de asemeni apelat de index.php:
Nici nu mai e nevoie de chown, mon3.txt poate ramane si cu root

Se poate updata la 10 secunde de ex dar se complica prea mult partea de cron, la minut este suficient:

Pagina nu are autentificare, e simplu de facut insa nu merita efortul momentan. Securizarea consider ca este suficient facuta din nginx cu htpasswd.
Comparativ cu varianta docker wg-easy ce am facut eu aici e mai minimalist, permite generarea si stergerea clientilor din browser insa are monitorizare precara. Este destul de greu de setat insa avand in vedere sporul de performanta fata de wg-easy(docker) cu peste 50% in unele cazuri,eu cred ca a meritat tot efortul. Ca sa faci monitorizare real time nu ai cum cu php, sau nu stiu eu cum, ai nevoie de ceva syncron sa ruleze in continuu asa cum e facut wg-easy, ai nevoie de nodejs. Clar se poate face si asta insa nu acopera acest tutorial, e suficient si asa cum am facut eu, macar ai link sa verifici IP-ul clientului.
Aveti aici fisierele pt management, ce trebuie pus in /root/wg-quick plus serviciul systemd wgui.


Dupa crearea unui nou client(peer) si scanarea pe telefon, aveti doua metode de restart wireguard ca sa se ia setarile in considerare, ambele functioneaza perfect.
Avand in vedere ca pt monitorizare (daca vreti sa puneti) trebuie cron-ul ala la minut, mai bine va chinuiti cu metoda2 pt restart wireguard, scapati de inca un cron, cum doriti.
Scopul proiectului este sa putem face web management cu docker pt wireguard instalat nativ.

Functionare si Mentenanta

In mod normal un setup cu 5 containere docker se pune cu docker-compose insa eu nu i-am dat de cap. Nu am reusit sa setez docker-compose.yaml sa porneasca in ordine containerele, nu inteleg ce am gresit, indiferent de ce fac nu am DNS nici in squid nici in wireguard deci nu merge nimic.
Am reusit insa in schimb sa fac un mic script bash care se asigura ca este totul in regula si indiferent de situatie porneste totul corect:
#!/bin/bash upSeconds="$(cat /proc/uptime | grep -o '^[0-9]\+')" upMins=$((${upSeconds} / 60)) log=/root/dockere.txt array=(dnsmasq adguard wg-easy squid nginx) verificare () { local my_array=("$@") echo array::::::${my_array[@]} if [[ $(docker inspect -f '{{.State.Running}}' ${my_array[@]}) = "false" && "${upMins}" -gt "2" ]];then docker start ${my_array[@]} > /dev/null 2>&1 sleep 10 if [[ $(docker inspect -f '{{.State.Running}}' ${my_array[@]}) = "true" ]];then date >> $log echo ${my_array[@]} "container started and RUNNING" | tee -a $log else docker stop ${my_array[@]} > /dev/null 2>&1 sleep 2 docker rm ${my_array[@]} > /dev/null 2>&1 sleep 2 date >> $log echo ${my_array[@]} "container stopped and removed" | tee -a $log /root/${my_array[@]}/start.sh date >> $log echo ${my_array[@]} "container started" | tee -a $log fi else date >> $log echo ${my_array[@]} "merge deci nu intervenim" | tee -a $log fi } fldr=$(docker ps -a|awk '{print $NF}'|tail -n+2|tr "\n" ","|sed 's/.$//') #execute for ((i=0; i<${#array[@]}; i++));do echo "====" if [[ "$fldr" == *"${array[$i]}"* ]]; then plm="ok"; else plm="ko"; fi; echo "${array[$i]} : $plm" if [[ "$plm" == "ko" ]];then date >> $log echo "container ${array[$i]} NU exista deci il pornim apeland /root/${array[$i]}/start.sh" | tee -a $log /root/${array[$i]}/start.sh sleep 5 else date >> $log echo "container ${array[$i]} exista dar apelam verificare array[$i]" | tee -a $log verificare "${array[$i]}" fi done
Acest script se poate pune pe linux si in crontab sa ruleze singur o data la o ora sa zicem, cum e ceva in neregula se asigura ca fiecare container este up and running.
Se poate pune si la startup cand se da reboot la masina pt updates, etc. Mare atentie sa scoateti wg-easy din variabila array daca folositi wireguard instalat nativ si sa il inlocuiti cu php!

Aveti aici o arhiva cu toate folderele si fisierele pe care le-am explicat pas cu pas ce face fiecare.

Utilizare clienti

Clientul VPN wireguard se descarca de pe siteul oficial pt windows si linux iar pe telefoanele cu Android se instaleaza gratis din Google Play.
Dupa cum am explicat mai sus, pe PC se foloseste fisier de configurare iar pe Android se adauga conexiunea pe baza de QR code.

Pt cine vrea sa aiba IP schimbat si aceasta protectie doar in browser, Proxy-ul http squid se poate folosi pe baza unor extensii. Cele mai cunoscute sunt FoxyProxy (PC cam orice browser si Android doar cu firefox) iar pe PC se mai poate folosi si Switchy Omega, in opinia mea extensie ceva mai buna.
Si pt wireguard si pt squid puteti folosi direct IP, nu e obligatoriu sa folositi domain (unul din cele 2 de sus), wireguard va da direct configul, pt squid puneti voi manual IP,port 19504 plus user/pass.

Avantajul folosirii acestei solutii pe PC sau pe telefon este ca aveti IP-ul de unde ruleaza serverul (in cazul meu Oracle Cloud Frankfurt Germania) si ca resolver de DNS aveti Adguard pe baza filtrelor puse de voi. In afara de youtube, nu va apare nicio reclama pe niciun site in niciun browser, deci nu veti mai fi nevoiti sa instalati adblockere in browsere.
Foarte important este faptul ca nu veti avea DNS leak, sunt o multime de servicii VPN platite prost setate care va dau IP de nush ce tara dar va da de gol DNS-ul. In cazul nostru pe langa faptul ca nu aveti leak, mai are si acele custom filters pe care le-ati setat in Adguard.
Mai mult, va puteti crea in Adguard inregistrari DNS fake care va merg numai voua, nu sunt publicate in Internet, de la Filters/DNS rewrites.
Un mic detaliu pt cine stie la ce ma refer, cu wireguard nu veti avea nici WebRTC leak, putina lume stie detaliul asta. Sunt unele siteuri care verifica deci pe partea asta squid nu poate ascunde.
Asta e asa un bonus, WebRTC se poate rezolva pe PC in firefox de la about:config media.peerconnection.enabled false iar pe orice browser based on chromium cu extensia asta si in felul asta folositi squid cu incredere, nu va da de gol. De asemeni aveti nevoie de Canvas si de inca o extensie care va protejeaza Geolocation: Vytal cu care puteti face spoof la User agent si la Location Data.
Deci pe langa IP aveti nevoie de protectie la DNS, WebRTC, Canvas fingerprint, Geolocation (timezone) si browser agent.

Happy safe browsing the internet!

Last update 11 Nov 2024.