wgzero

#! /usr/bin/env bash

TEMPLATEURL="https://raw.githubusercontent.com/finzzz/wgzero/master/template"

GRAY="$(tput setaf 8)"
RED="$(tput setaf 1)"
GREEN="$(tput setaf 2)"
ORANGE="$(tput setaf 3)"
CYAN="$(tput setaf 6)"
NC="$(tput sgr0)"

Run(){
    IsRoot
    CheckPackages "wg iptables curl qrencode jq"
    EnableIPForward

    WG_INTERFACE="$3"
    [ "$3" == "" ] && WG_INTERFACE="wg0"
    case "$1" in
    "install")
        # wgzero install
        Install ;;
    "uninstall")
        # wgzero uninstall <wg_interface>
        ReadInput "Uninstall $2" "y/N"
        if [ "$VAL" == "y" ]; then
            wg-quick down "$2"
            rm -rf "/etc/wireguard/$2.conf"
        fi
        ;;
    "import")
        # wgzero import wg0.conf
        WG_INTERFACE=$(basename "$2" .conf)
        cp "$2" /etc/wireguard/
        wg-quick up "$WG_INTERFACE"
        systemctl enable wg-quick@"$WG_INTERFACE"

        Print "Done, make sure $(ReadConfig ListenPort "$WG")/UDP is open\\n" "red"
        ;;
    "list")
        # wgzero list <wg_interface>
        WG_INTERFACE="$2"
        [ "$2" == "" ] && WG_INTERFACE="wg0"
        Client "list" "$WG_INTERFACE" ;;
    "add")
        # wgzero add <client_name> <wg_interface=wg0>
        Add "$2" "$WG_INTERFACE" ;;
    "del")
        # wgzero delete <client_name> <wg_interface=wg0>
        Client "delete" "$2" "$WG_INTERFACE" ;;
    "enable")
        # wgzero enable <client_name> <wg_interface=wg0>
        Client "enable" "$2" "$WG_INTERFACE" ;;
    "disable")
        # wgzero disable <client_name> <wg_interface=wg0>
        Client "disable" "$2" "$WG_INTERFACE" ;;
    "show")
        # wgzero show <client_name> <wg_interface=wg0>
        Client show "$2" "$WG_INTERFACE" ;;
    "qr")
        # wgzero qr <client_name> <wg_interface=wg0>
        Client show "$2" "$WG_INTERFACE" | qrencode -t ansiutf8 ;;
    "postup")
        # wgzero postup <wg_interface>
        WG_INTERFACE="$2"
        INTERFACE=$(ReadConfig Interface "$WG_INTERFACE")
        TYPE=$(ReadConfig Type "$WG_INTERFACE")

        iptables -t nat -A POSTROUTING -o "$INTERFACE" -j MASQUERADE
        if [ "$TYPE" == "nat" ]; then
            ip6tables -t nat -A POSTROUTING -o "$INTERFACE" -j MASQUERADE
        elif [ "$TYPE" == "fr" ]; then
            ip6tables -A FORWARD -i "$WG_INTERFACE" -j ACCEPT
        fi
        ;;
    "postdown")
        # wgzero postdown <wg_interface>
        WG_INTERFACE="$2"
        INTERFACE=$(ReadConfig Interface "$WG_INTERFACE")
        TYPE=$(ReadConfig Type "$WG_INTERFACE")

        iptables -t nat -D POSTROUTING -o "$INTERFACE" -j MASQUERADE
        if [ "$TYPE" == "nat" ]; then
            ip6tables -t nat -D POSTROUTING -o "$INTERFACE" -j MASQUERADE
        elif [ "$TYPE" == "fr" ]; then
            ip6tables -D FORWARD -i "$WG_INTERFACE" -j ACCEPT
        fi
        ;;
    *)
        Print "Unknown command\\n" "red" ;;
    esac
}

### PRECHECKS ###
IsRoot(){
    if [[ ! "$EUID" -eq 0 ]]; then
        Print "Must be run as root\\n" "red" && exit
    fi
}

CheckPackages(){
    for i in $1; do 
        if [[ ! $(command -v "$i") ]]; then
            Print "$i: command not found, please check required packages.\\n" "red" && exit
        fi
    done
}

EnableIPForward(){
    sed -i 's/\#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf
    echo 1 > /proc/sys/net/ipv4/ip_forward
    
    # IPv6
    sed -i 's/\#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=1/' /etc/sysctl.conf
    echo 1 > /proc/sys/net/ipv6/conf/all/forwarding
    
    /usr/sbin/sysctl -p -q
}
###

### UTILS ###
Print(){
    case "$2" in
    "red")
        echo -en "${RED}$1${NC}";;
    "cyan")
        echo -en "${CYAN}$1${NC}";;
    "orange")
        echo -en "${ORANGE}$1${NC}";;
    "gray")
        echo -en "${GRAY}$1${NC}";;
    *)
        echo -en "${GREEN}$1${NC}";;
    esac
}
######

### INSTALL ###
GenerateConfig(){
    # GenerateConfig wg0
    CFG="/etc/wireguard/$1.conf"
    if [ -f "$CFG" ]; then
        ReadInput "Config file $CFG already exists, do you want to overwrite" "y/N"
        if [ "$VAL" == "y" ]; then
            wg-quick down "$1"
            rm "$CFG"
            ip link del "$1" 2>/dev/null
        else
            exit
        fi
    fi
    
    curl -so "$CFG" "$TEMPLATEURL/wg0.conf"
    sed -i "s/WG_INTERFACE/$1/g" "$CFG"
    chmod 600 "$CFG"
}

SetInterface(){
    # SetInterface wg0
    INTERFACES=$(ip -json l | jq -r '.[]|.ifname' | grep -v 'lo\|wg')
    DEFAULT=$(echo "$INTERFACES" | head -1)

    Print "Available interfaces :\\n" "cyan" && echo "$INTERFACES"
    WriteConfig "Interface" "$DEFAULT" "$1"
}

Install(){
    ReadInput "Wireguard Interface Name" "wg0" && WG="$VAL"
    GenerateConfig "$WG"
    SetInterface "$WG"
    WriteConfig "Endpoint" "$(curl -s ip.me)" "$WG"
    WriteConfig "ListenPort" "$(shuf -n 1 -i 10000-65535)" "$WG"
    WriteConfig "Address" "10.10.0.1/24" "$WG"
    WriteConfig "MTU" "1420" "$WG"
    WriteConfig "Client MTU" "1384" "$WG"
    WriteConfig "DNS" "unset" "$WG"
    WriteConfig "KeepAlive" "unset" "$WG"

    # Generate Private Key
    PRIVKEY=$(/usr/bin/wg genkey)
    ReadInput "Specify private key" "none"
    [ "$VAL" != "none" ] && PRIVKEY="$VAL"
    sed -i "s|PrivateKey =.*|PrivateKey = $PRIVKEY|g" "/etc/wireguard/$WG.conf"

    TYPE="v4"
    ReadInput "Enable IPv6" "y/N"
    if [ "$VAL" == "y" ]; then
        TYPE="nat"
        WriteConfig "IPv6 Prefix" "fd00::" "$WG"
        WriteConfig "IPv6 Subnet" "64" "$WG"

        Interface=$(ReadConfig 'Interface' "$WG")
        IPv6Prefix=$(ReadConfig 'IPv6 Prefix' "$WG")
        IPv6Subnet=$(ReadConfig 'IPv6 Subnet' "$WG")

        Print "External routing: \\n" "orange"
        Print "[1] NAT\\n" "cyan"
        Print "[2] Full Routing\\n" "cyan"
        ReadInput "Selection" "1"

        if [ "$VAL" == "2" ]; then
            TYPE="fr" 

            ReadInput "Configure ndppd" "y/N"
            if [ "$VAL" == "y" ]; then
                CheckPackages ndppd

                curl -so /etc/ndppd.conf "$TEMPLATEURL/ndppd.conf"

                sed -i -e "s/IFACE/$Interface/g" /etc/ndppd.conf
                sed -i -e "s/PREFIX/$IPv6Prefix/g" /etc/ndppd.conf
                
                systemctl enable ndppd.service
                systemctl restart ndppd.service
            fi
        fi

        SetClientIPv6 "$IPv6Prefix" "$IPv6Subnet"
        sed -i "s|Address =.*|&, $VAL|g" "/etc/wireguard/$WG.conf"
    fi
    
    sed -i "s/Type =.*/TYPE = $TYPE/g" "/etc/wireguard/$WG.conf"

    wg-quick up "$WG" 2>/dev/null
    systemctl enable wg-quick@"$WG"

    Print "Done, make sure $(ReadConfig ListenPort "$WG")/UDP is open\\n" "red"
}
######

### SERVER CONFIG ###
ReadInput(){
    read -rp "${ORANGE}$1 [$2]: ${NC}" VAL
    VAL=${VAL:-"$2"}
}

ReadConfig(){
    # ReadConfig section wg0
    SECTION=$(grep -n "## SERVER ##" "/etc/wireguard/$2.conf" | cut -d ":" -f 1)
    sed -n "1,$SECTION p" "/etc/wireguard/$2.conf" | grep -i "$1 = " | cut -d "=" -f 2- | tr -d " "
}

WriteConfig(){
    # WriteConfig section default_val wg0
    ReadInput "$1" "$2"
    sed -i "s|$1 =.*|$1 = $VAL|g" "/etc/wireguard/$3.conf"
}
######

### Client Config ###
PrintIPs() {
    # PrintIPs 10.0.0.0/24
    BASE=${1%/*}
    MASKSIZE=${1#*/}

    [ "$MASKSIZE" -lt 8 ] && { echo "Max range is /8."; exit 1; }

    MASK=$(( 0xFFFFFFFF << (32 - "$MASKSIZE") ))

    IFS=. read -r a b c d <<< "$BASE"

    IP=$(( (b << 16) + (c << 8) + d ))

    IPSTART=$(( IP & MASK ))
    IPEND=$(( (IPSTART | ~MASK ) & 0x7FFFFFFF ))

    seq "$IPSTART" "$IPEND" | while read -r i; do
        LAST=$(( i & 0x00FF ))
        if [ $LAST -ne 0 ] && [ $LAST -ne 255 ]; then
            echo "$a.$(( (i & 0xFF0000) >> 16 )).$(( (i & 0xFF00) >> 8 )).$LAST"
        fi
    done
}

SetClientIPv4(){
    # SetClientIPv4 wg0
    SUBNET=$(ReadConfig Address "$1" | cut -d "," -f 1)
    if grep -qi ":" <<< "$SUBNET"; then
        SUBNET=$(ReadConfig Address "$1" | cut -d "," -f 2)
    fi

    for i in $(PrintIPs "$SUBNET"); do
        DEFAULT="$i"
        grep -q "$i" "/etc/wireguard/$1.conf" || break
    done

    ReadInput "Choose client IPv4" "$DEFAULT"
}

SetClientIPv6(){
    # SetClientIPv6 prefix subnet
    VAL="$1$(head -c 2 /dev/random | od -A n -t x2 | tr -d ' ')/$2"
}

WriteClientConfig(){
    # WriteClientConfig section value file uncomment
    sed -i "s|$1 =.*|$1 = $2|g" "$3"

    if [ "$4" == "uncomment" ];then
        sed -i "s|^# $1|$1|g" "$3"
    fi
}

ReadClientConfig(){
    # ReadClientConfig section blocks
    grep -i "$1" "$2" | cut -d '=' -f 2- | tr -d ' '
}
######

Add(){
    [[ "$1" == "" ]] && exit # must specify client name
    ALIAS="$1"
    WG="$2"
    
    if grep -qi "$ALIAS" "/etc/wireguard/$WG.conf" ; then
        Print "Client already exists\\n" "red" && exit
    fi

    PRIVKEY="$(wg genkey)"
    TMP=$(mktemp)
    curl -so "$TMP" "$TEMPLATEURL/peer.conf"
    WriteClientConfig Alias "$ALIAS" "$TMP"
    WriteClientConfig PrivateKey "$PRIVKEY" "$TMP"
    WriteClientConfig PublicKey "$(wg pubkey <<< "$PRIVKEY")" "$TMP"

    SetClientIPv4 "$WG" && WriteClientConfig AllowedIPs "$VAL/32" "$TMP"

    if [ "$(ReadConfig Type "$WG")" != "v4" ]; then
        IPv6Prefix=$(ReadConfig 'IPv6 Prefix' "$WG")
        SetClientIPv6 "$IPv6Prefix" "128"
        ReadInput "Choose client IPv6" "$VAL"
        sed -i "s|AllowedIPs =.*|&,$VAL|g" "$TMP"
    fi

    ReadInput "Generate Pre-Shared Key?" "y/N"
    if [ "$VAL" == "y" ]; then
        WriteClientConfig PreSharedKey "$(wg genpsk)" "$TMP" uncomment
    fi

    cat "$TMP" 
    ReadInput "Add the following client?" "Y/n"
    if [ "$VAL" == "n" ]; then
        rm -rf "$TMP" && exit
    fi

    cat "$TMP" >> "/etc/wireguard/$WG.conf" && rm -rf "$TMP"
    wg syncconf "$WG" <(wg-quick strip "$WG")
}

Client(){
    if [ "$1" == "list" ]; then
        WG="$2"
    else
        [[ ! "$2" ]] && exit # must specify client name
        ALIAS="$2"
        WG="$3"
        if ! grep -qi "Alias = $ALIAS" "/etc/wireguard/$WG.conf" ; then
            Print "Client doesn't exist\\n" "red" && exit
        fi
    fi

    mapfile -t CLIENTS < <(grep -nE '\[Peer\]$|## CLIENT ##' "/etc/wireguard/$WG.conf" | cut -d ':' -f 1)
    for (( i=0;i<${#CLIENTS[@]}-1;i+=2 )); do 
        START="${CLIENTS[$i]}"
        END="${CLIENTS[(($i+1))]}"
        CLIENT_BLOCK=$(mktemp)
        sed -n "$START,$END p" /etc/wireguard/"$WG".conf > "$CLIENT_BLOCK"

        PUBKEY=$(grep PublicKey "$CLIENT_BLOCK" | cut -d '=' -f 2- | tr -d ' ')
        if [ "$1" == list ]; then
            ALIAS=$(grep Alias "$CLIENT_BLOCK" | cut -d '=' -f 2- | tr -d ' ')
            IP=$(grep AllowedIPs "$CLIENT_BLOCK" | cut -d '=' -f 2- | tr -d ' ')
            if grep -qE "^# \[Peer\]" "$CLIENT_BLOCK"; then
                Print "$ALIAS,$PUBKEY,$IP" "gray" | column -t -s, 2>/dev/null
            else
                Print "$ALIAS,$PUBKEY,$IP" "orange" | column -t -s, 2>/dev/null
            fi
        elif grep -qi "$ALIAS" "$CLIENT_BLOCK" ; then
            case "$1" in
            "show")
                TMP=$(mktemp)
                curl -so "$TMP" "$TEMPLATEURL/client.conf"

                # client
                WriteClientConfig Address "$(ReadClientConfig AllowedIPs "$CLIENT_BLOCK")" "$TMP"
                WriteClientConfig PrivateKey "$(ReadClientConfig PrivateKey "$CLIENT_BLOCK")" "$TMP"
                WriteClientConfig MTU "$(ReadConfig 'Client MTU' "$WG")" "$TMP"
                DNS="$(ReadConfig DNS "$WG")" && [ "$DNS" != "unset" ] && WriteClientConfig DNS "$DNS" "$TMP" uncomment

                # server
                WriteClientConfig PublicKey "$(ReadConfig PrivateKey "$WG" | wg pubkey)" "$TMP" 
                WriteClientConfig Endpoint "$(ReadConfig Endpoint "$WG"):$(ReadConfig ListenPort "$WG")" "$TMP"
                WriteClientConfig AllowedIPs "0.0.0.0/0" "$TMP"
                grep -qi '^# PresharedKey' "$CLIENT_BLOCK" || WriteClientConfig PresharedKey "$(ReadClientConfig PresharedKey "$CLIENT_BLOCK")" "$TMP" uncomment
                KeepAlive=$(ReadConfig KeepAlive "$WG") && [ "$KeepAlive" != "unset" ] && WriteClientConfig PersistentKeepalive "$KeepAlive" "$TMP" uncomment
                TYPE=$(ReadConfig Type "$WG") && [ "$TYPE" != "v4" ] && WriteClientConfig AllowedIPs "0.0.0.0/0,::/0" "$TMP"
                cat "$TMP" && echo "" && rm -rf "$TMP" "$CLIENT_BLOCK" && exit
                ;;
            "delete")
                cat "$CLIENT_BLOCK"
                ReadInput "Remove this client?" "Y/n"
                [ "$VAL" == "n" ] && exit
                sed -i "$START,$END d" "/etc/wireguard/$WG.conf"
                ;;
            "disable")
                if grep -qi '^# \[Peer\]' "$CLIENT_BLOCK"; then
                    Print "Client already disabled\\n" "red" && exit
                fi

                cat "$CLIENT_BLOCK"
                ReadInput "Disable this client?" "Y/n"
                [ "$VAL" == "n" ] && exit
                sed -i -e "$START,$END s|^|# |g" "/etc/wireguard/$WG.conf"
                ;;
            "enable")
                if grep -qi '^\[Peer\]' "$CLIENT_BLOCK"; then
                    Print "Client already enabled\\n" "red" && exit
                fi

                sed -e "$START,$END s|^# ||g" "/etc/wireguard/$WG.conf" | sed -n "$START,$END p"
                ReadInput "Enable this client?" "Y/n"
                [ "$VAL" == "n" ] && exit
                sed -i -e "$START,$END s|^# ||g" "/etc/wireguard/$WG.conf"
                ;;
            esac
            
            wg set "$WG" peer "$PUBKEY" remove
            wg syncconf "$WG" <(wg-quick strip "$WG")
        fi
        rm -rf "$CLIENT_BLOCK"
    done    
}

Run "$@"