From: Athanasios Oikonomou <athoik@gmail.com>
To: wireguard@lists.zx2c4.com
Cc: Athanasios Oikonomou <athoik@gmail.com>
Subject: [PATCH] wg-quick: linux: check iptables existance prior trying restore
Date: Sun, 4 Feb 2024 12:10:29 +0200 [thread overview]
Message-ID: <20240204101029.1805-1-athoik@gmail.com> (raw)
This commit is adding a check for iptables existance prior restoring iptables rules.
Testing the existable of iptables already applied in remove_firewall.
https://git.zx2c4.com/wireguard-tools/tree/src/wg-quick/linux.bash?id=13f4ac4cb74b5a833fa7f825ba785b1e5774e84f#n197
Without fix applied wg-quick fails.
$ wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.100.0.2/32 dev wg0
[#] ip -6 address add fd08:4711::2/128 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a wg0 -m 0 -x
[#] wg set wg0 fwmark 51820
[#] ip -6 route add ::/0 dev wg0 table 51820
[#] ip -6 rule add not fwmark 51820 table 51820
[#] ip -6 rule add table main suppress_prefixlength 0
[#] ip6tables-restore -n
/usr/bin/wg-quick: line 32: ip6tables-restore: command not found
[#] resolvconf -d wg0 -f
[#] ip -6 rule delete table 51820
[#] ip -6 rule delete table main suppress_prefixlength 0
[#] ip link delete dev wg0
With fix applied wg-quick works.
wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.100.0.2/32 dev wg0
[#] ip -6 address add fd08:4711::2/128 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a wg0 -m 0 -x
[#] wg set wg0 fwmark 51820
[#] ip -6 route add ::/0 dev wg0 table 51820
[#] ip -6 rule add not fwmark 51820 table 51820
[#] ip -6 rule add table main suppress_prefixlength 0
[#] ip -4 route add 0.0.0.0/0 dev wg0 table 51820
[#] ip -4 rule add not fwmark 51820 table 51820
[#] ip -4 rule add table main suppress_prefixlength 0
[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1
Signed-off-by: Athanasios Oikonomou <athoik@gmail.com>
---
src/wg-quick/linux.bash | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/src/wg-quick/linux.bash b/src/wg-quick/linux.bash
index 4193ce5..0d85840 100755
--- a/src/wg-quick/linux.bash
+++ b/src/wg-quick/linux.bash
@@ -240,7 +240,7 @@ add_default() {
[[ $proto == -4 ]] && cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1
if type -p nft >/dev/null; then
cmd nft -f <(echo -n "$nftcmd")
- else
+ elif type -p iptables >/dev/null; then
echo -n "$restore" | cmd $iptables-restore -n
fi
HAVE_SET_FIREWALL=1
--
2.20.1
reply other threads:[~2024-11-18 12:35 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240204101029.1805-1-athoik@gmail.com \
--to=athoik@gmail.com \
--cc=wireguard@lists.zx2c4.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).