steps-19-wireguard

#! /usr/bin/env sh

# SPDX-License-Identifier: BlueOak-1.0.0
# SPDX-FileCopyrightText: 2023 Saulius Krasuckas <saulius2_at_ar-fi_point_lt> | sskras

# Set up WireGuard server peer.
# Via: https://www.digitalocean.com/community/tutorials/how-to-set-up-wireguard-on-ubuntu-20-04

set -e
set -x


# Step 1: choosing the essential WG parameters

#WG_ADDR="10.8.0.1/24"
 WG_ADDR="10.255.8.1/24"

#WG_PORT=51876
 WG_PORT=51820


# Step 2: installing the package

sudo apt update
sudo apt install    ufw         # Missing on some installations (like Proxmox)
sudo apt install -y wireguard   # Runs DKMS installer

wg genkey | sudo tee /etc/wireguard/private.key
sudo chmod go= /etc/wireguard/private.key

sudo cat /etc/wireguard/private.key | wg pubkey | sudo tee /etc/wireguard/public.key


# Step 3: creating WG configuration

cat << \
---------------------------------------------------------------------- |
[Interface]
PrivateKey = $(sudo cat /etc/wireguard/private.key)
Address = ${WG_ADDR}
ListenPort = ${WG_PORT}
SaveConfig = true
----------------------------------------------------------------------
sudo tee /etc/wireguard/wg0.conf


# Step 4: ensuring IP packets are forwarded between interfaces

cat << \
---------------------------------------------------------------------- |
net.ipv4.ip_forward = 1
----------------------------------------------------------------------
sudo tee /etc/sysctl.d/11-ip_forward.conf | sudo sysctl -p-


# Step 5: configuring firewall

UPLINK_DEV=$(ip route list default | awk '{ for (i=1; i<=NF; i++) if ($i == "dev") print $(i+1) }')

cat << \
----------------------------------------------------------------------- |

PostUp = ufw route allow in on wg0 out on ${UPLINK_DEV}
PostUp = iptables -t nat -I POSTROUTING -o ${UPLINK_DEV} -j MASQUERADE

PreDown = ufw route delete allow in on wg0 out on ${UPLINK_DEV}
PreDown = iptables -t nat -D POSTROUTING -o ${UPLINK_DEV} -j MASQUERADE
-----------------------------------------------------------------------
sudo tee -a /etc/wireguard/wg0.conf

# TODO: Does ufw necessary need to be present?  Maybe this block should be optional:

sudo ufw allow ${WG_PORT}/udp
sudo ufw allow OpenSSH
# Via: https://gist.github.com/rdroro/9988478#ufw
# Allow Proxmox web-UI:
sudo ufw allow 8006/tcp
# TODO: What about all other potentially listening ports?
# Explicitely enable fwd via ufw too:
sudo ufw default allow FORWARD
sudo ufw disable
sudo ufw enable
sudo ufw status verbose


# Step 6: starting WG service

sudo systemctl enable wg-quick@wg0
# TODO: this fails on OpenVZ (insmod not supported)
sudo systemctl start wg-quick@wg0
     systemctl status wg-quick@wg0
# TODO: Detect the error or the conditions and stop / rollback the changes.