Moduletrace/wireguard-ui
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix host private key read and peer AllowedIPs in wireguard host setup

Browse Source
This commit is contained in:
tben
2026-09-13 07:26:33 +01:00
parent 94dfcf6e43
commit 0ecac621c5
1 changed files with 79 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/functions/backend/setup/setup-wireguard-host.ts
+79 -74
View File
@@ -58,81 +58,86 @@ export default async function setupWireguardHost({
};
}
const HOST_PUBLIC_KEY = host?.id
? host.public_key
: execSync(
`cat ${path.join(WIREGUARD_HOST_CONFIG_DIR, WIREGUARD_PUBLIC_KEY_FILE_NAME)}`,
);
const HOST_PRIVATE_KEY = host?.id
? host.public_key
: execSync(
`cat ${path.join(WIREGUARD_HOST_CONFIG_DIR, WIREGUARD_PRIVATE_KEY_FILE_NAME)}`,
);
let sh = ``;
const POST_UP_PATH = path.join(WGUI_LIB_IP_TABLES_DIR, `${host_id}-up.sh`);
const POST_DOWN_PATH = path.join(
WGUI_LIB_IP_TABLES_DIR,
`${host_id}-down.sh`,
);
sh += `cat > ${POST_UP_PATH} << EOF\n`;
sh += `#!/bin/bash\n\n`;
sh += `# Allow WireGuard traffic to/from the server itself\n`;
sh += `iptables -I INPUT 1 -i wg${host_id} -j ACCEPT\n`;
sh += `iptables -I OUTPUT 1 -o wg${host_id} -j ACCEPT\n`;
sh += `\n`;
sh += `# Allow WireGuard traffic to be forwarded (insert above Docker rules)\n`;
sh += `iptables -I FORWARD 1 -i wg${host_id} -j ACCEPT\n`;
sh += `iptables -I FORWARD 1 -o wg${host_id} -j ACCEPT\n`;
sh += `\n`;
sh += `iptables -t nat -A POSTROUTING -o ${TARGET_INTERFACE} -j MASQUERADE\n`;
sh += `EOF\n`;
sh += `\n`;
sh += `cat > ${POST_DOWN_PATH} << EOF\n`;
sh += `#!/bin/bash\n\n`;
sh += `# Remove WireGuard INPUT/OUTPUT rules\n`;
sh += `iptables -D INPUT -i wg${host_id} -j ACCEPT\n`;
sh += `iptables -D OUTPUT -o wg${host_id} -j ACCEPT\n`;
sh += `\n`;
sh += `# Remove FORWARD rules\n`;
sh += `iptables -D FORWARD -i wg${host_id} -j ACCEPT\n`;
sh += `iptables -D FORWARD -o wg${host_id} -j ACCEPT\n`;
sh += `\n`;
sh += `iptables -t nat -D POSTROUTING -o ${TARGET_INTERFACE} -j MASQUERADE\n`;
sh += `EOF\n`;
sh += `\n`;
sh += `cat > wg${host_id}.conf << EOF\n`;
sh += `[Interface]\n`;
sh += `Address = ${HOST_WG_IP}/24\n`;
sh += `ListenPort = 51820\n`;
sh += `PrivateKey = ${HOST_PRIVATE_KEY}\n`;
sh += `PostUp = ${POST_UP_PATH}\n`;
sh += `PostDown = ${POST_DOWN_PATH}\n`;
sh += `\n`;
if (clients[0]) {
for (let i = 0; i < clients.length; i++) {
const client = clients[i];
if (!client?.id || !client.public_key || !client.private_key)
continue;
sh += `[Peer]\n`;
sh += `PublicKey = ${client.public_key}\n`;
sh += `\n`;
}
}
sh += `EOF\n`;
sh += `\n`;
try {
const HOST_PUBLIC_KEY = host?.id
? host.public_key
: execSync(
`cat ${path.join(WIREGUARD_HOST_CONFIG_DIR, WIREGUARD_PUBLIC_KEY_FILE_NAME)}`,
);
const HOST_PRIVATE_KEY = host?.private_key
? host.private_key
: execSync(
`cat ${path.join(WIREGUARD_HOST_CONFIG_DIR, WIREGUARD_PRIVATE_KEY_FILE_NAME)}`,
);
let sh = ``;
const POST_UP_PATH = path.join(
WGUI_LIB_IP_TABLES_DIR,
`${host_id}-up.sh`,
);
const POST_DOWN_PATH = path.join(
WGUI_LIB_IP_TABLES_DIR,
`${host_id}-down.sh`,
);
sh += `cd ${WIREGUARD_HOST_CONFIG_DIR}\n`;
sh += `cat > ${POST_UP_PATH} << EOF\n`;
sh += `#!/bin/bash\n\n`;
sh += `# Allow WireGuard traffic to/from the server itself\n`;
sh += `iptables -I INPUT 1 -i wg${host_id} -j ACCEPT\n`;
sh += `iptables -I OUTPUT 1 -o wg${host_id} -j ACCEPT\n`;
sh += `\n`;
sh += `# Allow WireGuard traffic to be forwarded (insert above Docker rules)\n`;
sh += `iptables -I FORWARD 1 -i wg${host_id} -j ACCEPT\n`;
sh += `iptables -I FORWARD 1 -o wg${host_id} -j ACCEPT\n`;
sh += `\n`;
sh += `iptables -t nat -A POSTROUTING -o ${TARGET_INTERFACE} -j MASQUERADE\n`;
sh += `EOF\n`;
sh += `\n`;
sh += `cat > ${POST_DOWN_PATH} << EOF\n`;
sh += `#!/bin/bash\n\n`;
sh += `# Remove WireGuard INPUT/OUTPUT rules\n`;
sh += `iptables -D INPUT -i wg${host_id} -j ACCEPT\n`;
sh += `iptables -D OUTPUT -o wg${host_id} -j ACCEPT\n`;
sh += `\n`;
sh += `# Remove FORWARD rules\n`;
sh += `iptables -D FORWARD -i wg${host_id} -j ACCEPT\n`;
sh += `iptables -D FORWARD -o wg${host_id} -j ACCEPT\n`;
sh += `\n`;
sh += `iptables -t nat -D POSTROUTING -o ${TARGET_INTERFACE} -j MASQUERADE\n`;
sh += `EOF\n`;
sh += `\n`;
sh += `cat > wg${host_id}.conf << EOF\n`;
sh += `[Interface]\n`;
sh += `Address = ${HOST_WG_IP}/24\n`;
sh += `ListenPort = 51820\n`;
sh += `PrivateKey = ${HOST_PRIVATE_KEY}\n`;
sh += `PostUp = ${POST_UP_PATH}\n`;
sh += `PostDown = ${POST_DOWN_PATH}\n`;
sh += `\n`;
if (clients[0]) {
for (let i = 0; i < clients.length; i++) {
const client = clients[i];
if (!client?.id || !client.public_key) continue;
sh += `[Peer]\n`;
sh += `PublicKey = ${client.public_key}\n`;
sh += `AllowedIPs = ${client.allowed_ips}\n`;
sh += `\n`;
}
}
sh += `EOF\n`;
sh += `\n`;
const exec = execSync(sh, { encoding: "utf-8" });
} catch (error: any) {
return {