simono41/docker-wireguard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Simplify entrypoint.sh

Browse source
This commit is contained in:
Jordan Potter 2023-09-29 10:08:04 -07:00
parent 74c3645405
commit 326b11022f
1 changed files with 26 additions and 33 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

59
entrypoint.sh
View file

@ -1,65 +1,58 @@
#!/bin/bash #!/bin/ash
set -e set -e
default_route_ip=$(ip route | grep default | awk '{print $3}') default_route_ip=$(ip route | grep default | awk '{print $3}')
if [[ -z "$default_route_ip" ]]; then if [[ -z "$default_route_ip" ]]; then
echo "No default route configured" >&2 echo "No default route configured" >&2
exit 1 exit 1
fi fi
configs=`find /etc/wireguard -type f -printf "%f\n"` configs=`find /etc/wireguard -type f -printf "%f\n"`
if [[ -z "$configs" ]]; then if [[ -z "$configs" ]]; then
echo "No configuration files found in /etc/wireguard" >&2 echo "No configuration file found in /etc/wireguard" >&2
exit 1 exit 1
fi fi
config=`echo $configs | head -n 1` config=`echo $configs | head -n 1`
interface="${config%.*}" interface="${config%.*}"
if [[ "$(cat /proc/sys/net/ipv4/conf/all/src_valid_mark)" != "1" ]]; then if [[ "$(cat /proc/sys/net/ipv4/conf/all/src_valid_mark)" != "1" ]]; then
echo "sysctl net.ipv4.conf.all.src_valid_mark=1 is not set" >&2 echo "sysctl net.ipv4.conf.all.src_valid_mark=1 is not set" >&2
exit 1 exit 1
fi fi
# The net.ipv4.conf.all.src_valid_mark sysctl is set when running the Docker container, so don't have WireGuard also set it # The net.ipv4.conf.all.src_valid_mark sysctl is set when running the container, so don't have WireGuard also set it
sed -i "s:sysctl -q net.ipv4.conf.all.src_valid_mark=1:echo Skipping setting net.ipv4.conf.all.src_valid_mark:" /usr/bin/wg-quick sed -i "s:sysctl -q net.ipv4.conf.all.src_valid_mark=1:echo Skipping setting net.ipv4.conf.all.src_valid_mark:" /usr/bin/wg-quick
# Start WireGuard
wg-quick up $interface wg-quick up $interface
# IPv4 kill switch: traffic must be either (1) to the WireGuard interface, (2) marked as a WireGuard packet, (3) to a local address, or (4) to the Docker network # IPv4 kill switch: traffic must be either (1) to the WireGuard interface, (2) marked as a WireGuard packet, (3) to a local address, or (4) to the container network
docker_network="$(ip -o addr show dev eth0 | awk '$3 == "inet" {print $4}')" container_ipv4_network="$(ip -o addr show dev eth0 | awk '$3 == "inet" {print $4}')"
docker_network_rule=$([ ! -z "$docker_network" ] && echo "! -d $docker_network" || echo "") container_ipv4_network_rule=$([ ! -z "$container_ipv4_network" ] && echo "! -d $container_ipv4_network" || echo "")
iptables -I OUTPUT ! -o $interface -m mark ! --mark $(wg show $interface fwmark) -m addrtype ! --dst-type LOCAL $docker_network_rule -j REJECT iptables -I OUTPUT ! -o $interface -m mark ! --mark $(wg show $interface fwmark) -m addrtype ! --dst-type LOCAL $container_ipv4_network_rule -j REJECT
# IPv6 kill switch: traffic must be either (1) to the WireGuard interface, (2) marked as a WireGuard packet, (3) to a local address, or (4) to the Docker network # IPv6 kill switch: traffic must be either (1) to the WireGuard interface, (2) marked as a WireGuard packet, (3) to a local address, or (4) to the container network
docker6_network="$(ip -o addr show dev eth0 | awk '$3 == "inet6" {print $4}')" container_ipv6_network="$(ip -o addr show dev eth0 | awk '$3 == "inet6" {print $4}')"
if [[ "$docker6_network" ]]; then if [[ "$container_ipv6_network" ]]; then
docker6_network_rule=$([ ! -z "$docker6_network" ] && echo "! -d $docker6_network" || echo "") container_ipv6_network_rule=$([ ! -z "$container_ipv6_network" ] && echo "! -d $container_ipv6_network" || echo "")
ip6tables -I OUTPUT ! -o $interface -m mark ! --mark $(wg show $interface fwmark) -m addrtype ! --dst-type LOCAL $docker6_network_rule -j REJECT ip6tables -I OUTPUT ! -o $interface -m mark ! --mark $(wg show $interface fwmark) -m addrtype ! --dst-type LOCAL $container_ipv6_network_rule -j REJECT
else else
echo "Skipping IPv6 kill switch setup since IPv6 interface was not found" >&2 echo "IPv6 interface not found, skipping IPv6 kill switch" >&2
fi
# Support LOCAL_NETWORK environment variable, which was replaced by LOCAL_SUBNETS
if [[ -z "$LOCAL_SUBNETS" && "$LOCAL_NETWORK" ]]; then
LOCAL_SUBNETS=$LOCAL_NETWORK
fi
# Support LOCAL_SUBNET environment variable, which was replaced by LOCAL_SUBNETS (plural)
if [[ -z "$LOCAL_SUBNETS" && "$LOCAL_SUBNET" ]]; then
LOCAL_SUBNETS=$LOCAL_SUBNET
fi fi
# Allow traffic to local subnets
for local_subnet in ${LOCAL_SUBNETS//,/$IFS} for local_subnet in ${LOCAL_SUBNETS//,/$IFS}
do do
echo "Allowing traffic to local subnet ${local_subnet}" >&2 echo "Allowing traffic to local subnet ${local_subnet}" >&2
ip route add $local_subnet via $default_route_ip ip route add $local_subnet via $default_route_ip
iptables -I OUTPUT -d $local_subnet -j ACCEPT iptables -I OUTPUT -d $local_subnet -j ACCEPT
done done
shutdown () { shutdown () {
wg-quick down $interface wg-quick down $interface
exit 0 exit 0
} }
trap shutdown SIGTERM SIGINT SIGQUIT trap shutdown SIGTERM SIGINT SIGQUIT