diff --git a/modules/wireguard/scripts/startup.sh b/modules/wireguard/scripts/startup.sh index a92ce5b..438e949 100644 --- a/modules/wireguard/scripts/startup.sh +++ b/modules/wireguard/scripts/startup.sh @@ -1,79 +1,81 @@ #!/bin/bash wg_main_dir=/etc/wireguard wg_device=wg0 wg_key=/root/private wg_ip_addr='192.168.0.2/24' wg_peer_ip_addr='192.168.0.1/24' wg_peer_public_keys='OolusdBbw6z5JTczY7ED9f+t70q96YnMzXX9Un+wXn0=' wg_peer_end_point='128.178.218.70:51820' wg_allowed_ips='192.168.0.0/24, 128.178.222.16/32' wg_listen_port=51820 wg_add_route='add-nat-routing.sh' wg_del_route='remove-nat-routing.sh' +wg_sysctl=/etc/sysctl.d/10-wireguard.conf gcp_subnet='10.0.0.0/24' kernel_sources=/usr/src/kernels/4.18.0-193.28.1.el8_2.x86_64 ### Install the packages ### yum -y install epel-release yum config-manager --set-enabled PowerTools yum -y copr enable jdoss/wireguard yum -y install wireguard-dkms wireguard-tools yum -y install openldap-clients ### Load (or compile) the kernel module ### modprobe wireguard if [ ${?} -ne 0 ] then dkms autoinstall --kernelsourcedir ${kernel_sources} fi ### Configure the interface ### if [ ! -e ${wg_key} ] then wg genkey > ${wg_key} chmod 400 ${wg_key} fi cat << EOF > ${wg_main_dir}/${wg_device}.conf [Interface] Address = ${wg_ip_addr} ListenPort = ${wg_listen_port} PrivateKey = $(cat ${wg_key}) PostUp = ${wg_main_dir}/${wg_add_route} PostDown = ${wg_main_dir}/${wg_del_route} [Peer] PublicKey = ${wg_peer_public_keys} AllowedIPs = ${wg_allowed_ips} Endpoint = ${wg_peer_end_point} PersistentKeepalive = 20 EOF cat << EOF > ${wg_main_dir}/${wg_add_route} /sbin/iptables -t nat -I POSTROUTING 1 -s ${gcp_subnet} -o ${wg_device} -j MASQUERADE EOF cat << EOF > ${wg_main_dir}/${wg_del_route} /sbin/iptables -t nat -D POSTROUTING -s ${gcp_subnet} -o ${wg_device} -j MASQUERADE EOF -cat << EOF > /etc/sysctl.d/10-wireguard.conf +cat << EOF > ${wg_sysctl} net.ipv4.ip_forward=1 EOF +sysctl -p ${wg_sysctl} chmod 755 ${wg_main_dir}/${wg_add_route} chmod 755 ${wg_main_dir}/${wg_del_route} ### Disable default firewall ### systemctl stop firewalld.service systemctl disable firewalld.service wg-quick down ${wg_device} wg-quick up ${wg_device}