daily autocommit

.etckeeper

@@ -498,6 +498,9 @@ maybe chmod 0644 'paxctld.conf'
 maybe chmod 0755 'perl'
 maybe chmod 0755 'perl/Net'
 maybe chmod 0644 'perl/Net/libnet.cfg'
+maybe chmod 0755 'pivpn'
+maybe chmod 0755 'pivpn/wireguard'
+maybe chmod 0644 'pivpn/wireguard/setupVars.conf'
 maybe chmod 0755 'polkit-1'
 maybe chmod 0700 'polkit-1/localauthority'
 maybe chmod 0755 'polkit-1/localauthority.conf.d'
@@ -673,6 +676,15 @@ maybe chmod 0755 'vim'
 maybe chmod 0644 'vim/vimrc'
 maybe chmod 0644 'vim/vimrc.tiny'
 maybe chmod 0644 'wgetrc'
+maybe chmod 0700 'wireguard'
+maybe chmod 0755 'wireguard/configs'
+maybe chmod 0644 'wireguard/configs/clients.txt'
+maybe chmod 0755 'wireguard/keys'
+maybe chmod 0644 'wireguard/keys/server_priv'
+maybe chmod 0644 'wireguard/keys/server_pub'
+maybe chmod 0644 'wireguard/wg0.conf'
+maybe chmod 0600 'wireguard_2021-12-01-113917.tar.gz'
+maybe chmod 0600 'wireguard_2021-12-01-114912.tar.gz'
 maybe chmod 0755 'wpa_supplicant'
 maybe chmod 0755 'wpa_supplicant/action_wpa.sh'
 maybe chmod 0644 'wpa_supplicant/functions.sh'

bash_completion.d/pivpn

@@ -0,0 +1 @@
+/usr/local/src/pivpn/scripts/wireguard/bash-completion

iptables/rules.v4

@@ -1,4 +1,4 @@
-# Generated by iptables-save v1.8.7 on Wed Dec  1 11:37:42 2021
+# Generated by iptables-save v1.8.7 on Wed Dec  1 11:49:13 2021
 *filter
 :INPUT ACCEPT [0:0]
 :FORWARD DROP [0:0]
@@ -8,6 +8,8 @@
 :DOCKER-ISOLATION-STAGE-1 - [0:0]
 :DOCKER-ISOLATION-STAGE-2 - [0:0]
 :DOCKER-USER - [0:0]
+-A FORWARD -d 10.6.0.0/24 -i eth0 -o wg0 -m conntrack --ctstate RELATED,ESTABLISHED -m comment --comment wireguard-forward-rule -j ACCEPT
+-A FORWARD -s 10.6.0.0/24 -i wg0 -o eth0 -m comment --comment wireguard-forward-rule -j ACCEPT
 -A FORWARD -j DOCKER-USER
 -A FORWARD -j DOCKER-INGRESS
 -A FORWARD -j DOCKER-ISOLATION-STAGE-1
@@ -19,6 +21,10 @@
 -A FORWARD -o docker_gwbridge -j DOCKER
 -A FORWARD -i docker_gwbridge ! -o docker_gwbridge -j ACCEPT
 -A FORWARD -i docker_gwbridge -o docker_gwbridge -j DROP
+-A DOCKER-INGRESS -p tcp -m tcp --dport 8443 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8443 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m tcp --dport 8080 -j ACCEPT
+-A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 8080 -j ACCEPT
 -A DOCKER-INGRESS -p tcp -m tcp --dport 3001 -j ACCEPT
 -A DOCKER-INGRESS -p tcp -m state --state RELATED,ESTABLISHED -m tcp --sport 3001 -j ACCEPT
 -A DOCKER-INGRESS -p tcp -m tcp --dport 8090 -j ACCEPT
@@ -44,8 +50,8 @@
 -A DOCKER-ISOLATION-STAGE-2 -j RETURN
 -A DOCKER-USER -j RETURN
 COMMIT
-# Completed on Wed Dec  1 11:37:42 2021
-# Generated by iptables-save v1.8.7 on Wed Dec  1 11:37:42 2021
+# Completed on Wed Dec  1 11:49:13 2021
+# Generated by iptables-save v1.8.7 on Wed Dec  1 11:49:13 2021
 *nat
 :PREROUTING ACCEPT [0:0]
 :INPUT ACCEPT [0:0]
@@ -57,11 +63,14 @@ COMMIT
 -A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
 -A OUTPUT -m addrtype --dst-type LOCAL -j DOCKER-INGRESS
 -A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
+-A POSTROUTING -s 10.6.0.0/24 -o eth0 -m comment --comment wireguard-nat-rule -j MASQUERADE
 -A POSTROUTING -o docker_gwbridge -m addrtype --src-type LOCAL -j MASQUERADE
 -A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
 -A POSTROUTING -s 172.18.0.0/16 ! -o docker_gwbridge -j MASQUERADE
 -A DOCKER -i docker0 -j RETURN
 -A DOCKER -i docker_gwbridge -j RETURN
+-A DOCKER-INGRESS -p tcp -m tcp --dport 8443 -j DNAT --to-destination 172.18.0.2:8443
+-A DOCKER-INGRESS -p tcp -m tcp --dport 8080 -j DNAT --to-destination 172.18.0.2:8080
 -A DOCKER-INGRESS -p tcp -m tcp --dport 3001 -j DNAT --to-destination 172.18.0.2:3001
 -A DOCKER-INGRESS -p tcp -m tcp --dport 8090 -j DNAT --to-destination 172.18.0.2:8090
 -A DOCKER-INGRESS -p tcp -m tcp --dport 8086 -j DNAT --to-destination 172.18.0.2:8086
@@ -72,4 +81,4 @@ COMMIT
 -A DOCKER-INGRESS -p tcp -m tcp --dport 8000 -j DNAT --to-destination 172.18.0.2:8000
 -A DOCKER-INGRESS -j RETURN
 COMMIT
-# Completed on Wed Dec  1 11:37:42 2021
+# Completed on Wed Dec  1 11:49:13 2021

pivpn/wireguard/setupVars.conf

@@ -0,0 +1,24 @@
+PLAT=Raspbian
+OSCN=bullseye
+USING_UFW=0
+IPv4dev=eth0
+dhcpReserv=
+IPv4addr=192.168.0.123/24
+IPv4gw=192.168.0.1
+install_user=pi
+install_home=/home/pi
+VPN=wireguard
+pivpnPORT=51830
+pivpnDNS1=192.168.0.28
+pivpnDNS2=192.168.0.1
+pivpnHOST=realm.mynetgear.com
+INPUT_CHAIN_EDITED=0
+FORWARD_CHAIN_EDITED=1
+pivpnPROTO=udp
+pivpnMTU=1420
+pivpnDEV=wg0
+pivpnNET=10.6.0.0
+subnetClass=24
+ALLOWED_IPS="192.168.0.0/24"
+UNATTUPG=0
+INSTALLED_PACKAGES=(dnsutils bsdmainutils iptables-persistent wireguard-tools qrencode)

resolv.conf

@@ -1,4 +1,3 @@
 # Generated by resolvconf
-domain realm.local
 nameserver 192.168.0.28
 nameserver 192.168.0.1

sysctl.conf

@@ -25,7 +25,7 @@
 #net.ipv4.tcp_syncookies=1
 
 # Uncomment the next line to enable packet forwarding for IPv4
-#net.ipv4.ip_forward=1
+net.ipv4.ip_forward=1
 
 # Uncomment the next line to enable packet forwarding for IPv6
 #  Enabling this option disables Stateless Address Autoconfiguration

systemd/system/multi-user.target.wants/wg-quick@wg0.service

@@ -0,0 +1 @@
+/lib/systemd/system/wg-quick@.service

unbound/unbound.conf.d/resolvconf_resolvers.conf

@@ -1,10 +1,5 @@
 # Generated by resolvconf
 
-forward-zone:
-	name: "realm.local"
-	forward-addr: 192.168.0.28
-	forward-addr: 192.168.0.1
-
 forward-zone:
 	name: "."
 	forward-addr: 192.168.0.28

wireguard/keys/server_priv

@@ -0,0 +1 @@
+OP8QzwFLDVsahB1GIZrJ4hu8c05ksIYWfoWp5JYXPmQ=

wireguard/keys/server_pub

@@ -0,0 +1 @@
+nbafplgT7X28EhjTRGSV2tZNr5J+rPSMEUdZcZq6SWA=

wireguard/wg0.conf

@@ -0,0 +1,5 @@
+[Interface]
+PrivateKey = OP8QzwFLDVsahB1GIZrJ4hu8c05ksIYWfoWp5JYXPmQ=
+Address = 10.6.0.1/24
+MTU = 1420
+ListenPort = 51830