Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Client script lacks required packages, no flags/interactivity for gateway/ip selection, conflicting default gateway, bug in random port generation #5

Open
dmitridb opened this issue Feb 5, 2024 · 0 comments

Comments

@dmitridb
Copy link
Contributor

dmitridb commented Feb 5, 2024

Firstly the client script is buggy in that it assumes we've got the packages libqrencode and curl installed. It will produce garbage that needs to be cleaned up manually if you run it without the curl package ready to go. Ideally we have output at the end of running wireguard_client.sh which gives us a nice clean QR code ready to be scanned in from the terminal from a client on a phone or whatever you need to do with that.

I introduced a bug in my previous and somewhat lazy solution for random port generation. It has a 1/9999 chance of generating a port which is just the default wireguard port of 51820, and this is obviously not what we want anyone deploying if they're looking for that little bit of security by obscurity. Additionally this script is limited in that if you want to change the VPN's gateway IP or endpoint port, you'll have to edit it yourself, no choice to use flags or any of that to fix these. I've also written some features in to handle this stuff.

In addition, I also noticed the default network allocation for the internal VPN network gateway as 10.0.0.0/24 is much too commonly used on LANs and therefore causes addressing conflicts if you're on wifi anywhere with that same subnet, and I'm allocating 10.0.23.0/24 and 10.0.23.1 as the default gateway as a way to mitigate this issue having yet to encounter such a conflict in years of using that on VPNs I've been setting up and connecting from various wifi access points. If this is an unlucky number to you or something weird like that feel free to change it, I'm happy as long as it isn't commonly used on LANs.

I wrote a solution for these issues which I will test thoroughly today, so look forward to another PR request incoming after I make sure these changes I made are good. I'm also making sure everything from here on in passes shellcheck -x -o all [file] for a little quality control. Since I happen to deploy a bunch of VPNs in my line of work, I'll be doing a bit more on this script to try to bring it to a higher level of quality, including adding the option to generate per-client PSK as well as whatever else I can think of.

This was referenced Feb 6, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant