diff --git a/.etckeeper b/.etckeeper index abe69a06..b183b1c4 100755 --- a/.etckeeper +++ b/.etckeeper @@ -498,6 +498,9 @@ maybe chmod 0644 'paxctld.conf' maybe chmod 0755 'perl' maybe chmod 0755 'perl/Net' maybe chmod 0644 'perl/Net/libnet.cfg' +maybe chmod 0755 'pivpn' +maybe chmod 0755 'pivpn/wireguard' +maybe chmod 0644 'pivpn/wireguard/setupVars.conf' maybe chmod 0755 'polkit-1' maybe chmod 0700 'polkit-1/localauthority' maybe chmod 0755 'polkit-1/localauthority.conf.d' @@ -673,6 +676,15 @@ maybe chmod 0755 'vim' maybe chmod 0644 'vim/vimrc' maybe chmod 0644 'vim/vimrc.tiny' maybe chmod 0644 'wgetrc' +maybe chmod 0700 'wireguard' +maybe chmod 0755 'wireguard/configs' +maybe chmod 0644 'wireguard/configs/clients.txt' +maybe chmod 0755 'wireguard/keys' +maybe chmod 0644 'wireguard/keys/server_priv' +maybe chmod 0644 'wireguard/keys/server_pub' +maybe chmod 0644 'wireguard/wg0.conf' +maybe chmod 0600 'wireguard_2021-12-01-113917.tar.gz' +maybe chmod 0600 'wireguard_2021-12-01-114912.tar.gz' maybe chmod 0755 'wpa_supplicant' maybe chmod 0755 'wpa_supplicant/action_wpa.sh' maybe chmod 0644 'wpa_supplicant/functions.sh' diff --git a/bash_completion.d/pivpn b/bash_completion.d/pivpn new file mode 120000 index 00000000..f1d988b2 --- /dev/null +++ b/bash_completion.d/pivpn @@ -0,0 +1 @@ +/usr/local/src/pivpn/scripts/wireguard/bash-completion \ No newline at end of file diff --git a/iptables/rules.v4 b/iptables/rules.v4 index 9bb5c35e..9cc8032c 100644 --- a/iptables/rules.v4 +++ b/iptables/rules.v4 @@ -1,4 +1,4 @@ -# Generated by iptables-save v1.8.7 on Wed Dec 1 11:37:42 2021 +# Generated by iptables-save v1.8.7 on Wed Dec 1 11:49:13 2021 *filter :INPUT ACCEPT [0:0] :FORWARD DROP [0:0] @@ -8,6 +8,8 @@ :DOCKER-ISOLATION-STAGE-1 - [0:0] :DOCKER-ISOLATION-STAGE-2 - [0:0] :DOCKER-USER - [0:0] +-A FORWARD -d 10.6.0.0/24 -i eth0 -o wg0 -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment wireguard-forward-rule -j ACCEPT +-A FORWARD -s 10.6.0.0/24 -i wg0 -o eth0 -m comment --comment wireguard-forward-rule -j ACCEPT -A FORWARD -j DOCKER-USER -A FORWARD -j DOCKER-INGRESS -A FORWARD -j DOCKER-ISOLATION-STAGE-1 @@ -19,6 +21,10 @@ -A FORWARD -o docker_gwbridge -j DOCKER -A FORWARD -i docker_gwbridge ! -o docker_gwbridge -j ACCEPT -A FORWARD -i docker_gwbridge -o docker_gwbridge -j DROP +-A DOCKER-INGRESS -p tcp -m tcp --dport 8443 -j ACCEPT +-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8443 -j ACCEPT +-A DOCKER-INGRESS -p tcp -m tcp --dport 8080 -j ACCEPT +-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8080 -j ACCEPT -A DOCKER-INGRESS -p tcp -m tcp --dport 3001 -j ACCEPT -A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 3001 -j ACCEPT -A DOCKER-INGRESS -p tcp -m tcp --dport 8090 -j ACCEPT @@ -44,8 +50,8 @@ -A DOCKER-ISOLATION-STAGE-2 -j RETURN -A DOCKER-USER -j RETURN COMMIT -# Completed on Wed Dec 1 11:37:42 2021 -# Generated by iptables-save v1.8.7 on Wed Dec 1 11:37:42 2021 +# Completed on Wed Dec 1 11:49:13 2021 +# Generated by iptables-save v1.8.7 on Wed Dec 1 11:49:13 2021 *nat :PREROUTING ACCEPT [0:0] :INPUT ACCEPT [0:0] @@ -57,11 +63,14 @@ COMMIT -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER -A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER-INGRESS -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER +-A POSTROUTING -s 10.6.0.0/24 -o eth0 -m comment --comment wireguard-nat-rule -j MASQUERADE -A POSTROUTING -o docker_gwbridge -m addrtype --src-type LOCAL -j MASQUERADE -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE -A POSTROUTING -s 172.18.0.0/16 ! -o docker_gwbridge -j MASQUERADE -A DOCKER -i docker0 -j RETURN -A DOCKER -i docker_gwbridge -j RETURN +-A DOCKER-INGRESS -p tcp -m tcp --dport 8443 -j DNAT --to-destination 172.18.0.2:8443 +-A DOCKER-INGRESS -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.18.0.2:8080 -A DOCKER-INGRESS -p tcp -m tcp --dport 3001 -j DNAT --to-destination 172.18.0.2:3001 -A DOCKER-INGRESS -p tcp -m tcp --dport 8090 -j DNAT --to-destination 172.18.0.2:8090 -A DOCKER-INGRESS -p tcp -m tcp --dport 8086 -j DNAT --to-destination 172.18.0.2:8086 @@ -72,4 +81,4 @@ COMMIT -A DOCKER-INGRESS -p tcp -m tcp --dport 8000 -j DNAT --to-destination 172.18.0.2:8000 -A DOCKER-INGRESS -j RETURN COMMIT -# Completed on Wed Dec 1 11:37:42 2021 +# Completed on Wed Dec 1 11:49:13 2021 diff --git a/pivpn/wireguard/setupVars.conf b/pivpn/wireguard/setupVars.conf new file mode 100644 index 00000000..ba32ad54 --- /dev/null +++ b/pivpn/wireguard/setupVars.conf @@ -0,0 +1,24 @@ +PLAT=Raspbian +OSCN=bullseye +USING_UFW=0 +IPv4dev=eth0 +dhcpReserv= +IPv4addr=192.168.0.123/24 +IPv4gw=192.168.0.1 +install_user=pi +install_home=/home/pi +VPN=wireguard +pivpnPORT=51830 +pivpnDNS1=192.168.0.28 +pivpnDNS2=192.168.0.1 +pivpnHOST=realm.mynetgear.com +INPUT_CHAIN_EDITED=0 +FORWARD_CHAIN_EDITED=1 +pivpnPROTO=udp +pivpnMTU=1420 +pivpnDEV=wg0 +pivpnNET=10.6.0.0 +subnetClass=24 +ALLOWED_IPS="192.168.0.0/24" +UNATTUPG=0 +INSTALLED_PACKAGES=(dnsutils bsdmainutils iptables-persistent wireguard-tools qrencode) diff --git a/resolv.conf b/resolv.conf index 2cc6dead..710377c3 100644 --- a/resolv.conf +++ b/resolv.conf @@ -1,4 +1,3 @@ # Generated by resolvconf -domain realm.local nameserver 192.168.0.28 nameserver 192.168.0.1 diff --git a/sysctl.conf b/sysctl.conf index eb96ed53..1fa03b90 100644 --- a/sysctl.conf +++ b/sysctl.conf @@ -25,7 +25,7 @@ #net.ipv4.tcp_syncookies=1 # Uncomment the next line to enable packet forwarding for IPv4 -#net.ipv4.ip_forward=1 +net.ipv4.ip_forward=1 # Uncomment the next line to enable packet forwarding for IPv6 # Enabling this option disables Stateless Address Autoconfiguration diff --git a/systemd/system/multi-user.target.wants/wg-quick@wg0.service b/systemd/system/multi-user.target.wants/wg-quick@wg0.service new file mode 120000 index 00000000..cc7f7aad --- /dev/null +++ b/systemd/system/multi-user.target.wants/wg-quick@wg0.service @@ -0,0 +1 @@ +/lib/systemd/system/wg-quick@.service \ No newline at end of file diff --git a/unbound/unbound.conf.d/resolvconf_resolvers.conf b/unbound/unbound.conf.d/resolvconf_resolvers.conf index a3864ee5..36869812 100644 --- a/unbound/unbound.conf.d/resolvconf_resolvers.conf +++ b/unbound/unbound.conf.d/resolvconf_resolvers.conf @@ -1,10 +1,5 @@ # Generated by resolvconf -forward-zone: - name: "realm.local" - forward-addr: 192.168.0.28 - forward-addr: 192.168.0.1 - forward-zone: name: "." forward-addr: 192.168.0.28 diff --git a/wireguard/configs/clients.txt b/wireguard/configs/clients.txt new file mode 100644 index 00000000..e69de29b diff --git a/wireguard/keys/server_priv b/wireguard/keys/server_priv new file mode 100644 index 00000000..21f74ed0 --- /dev/null +++ b/wireguard/keys/server_priv @@ -0,0 +1 @@ +OP8QzwFLDVsahB1GIZrJ4hu8c05ksIYWfoWp5JYXPmQ= diff --git a/wireguard/keys/server_pub b/wireguard/keys/server_pub new file mode 100644 index 00000000..06585d2d --- /dev/null +++ b/wireguard/keys/server_pub @@ -0,0 +1 @@ +nbafplgT7X28EhjTRGSV2tZNr5J+rPSMEUdZcZq6SWA= diff --git a/wireguard/wg0.conf b/wireguard/wg0.conf new file mode 100644 index 00000000..e1fe0367 --- /dev/null +++ b/wireguard/wg0.conf @@ -0,0 +1,5 @@ +[Interface] +PrivateKey = OP8QzwFLDVsahB1GIZrJ4hu8c05ksIYWfoWp5JYXPmQ= +Address = 10.6.0.1/24 +MTU = 1420 +ListenPort = 51830 diff --git a/wireguard_2021-12-01-113917.tar.gz b/wireguard_2021-12-01-113917.tar.gz new file mode 100644 index 00000000..7a148397 Binary files /dev/null and b/wireguard_2021-12-01-113917.tar.gz differ diff --git a/wireguard_2021-12-01-114912.tar.gz b/wireguard_2021-12-01-114912.tar.gz new file mode 100644 index 00000000..fa9e5a64 Binary files /dev/null and b/wireguard_2021-12-01-114912.tar.gz differ