[PATCH] wg-quick: linux: check iptables existance prior trying restore

[PATCH] wg-quick: linux: check iptables existance prior trying restore

[Athanasios Oikonomou]

This commit is adding a check for iptables existance prior restoring iptables rules.
Testing the existable of iptables already applied in remove_firewall.
https://git.zx2c4.com/wireguard-tools/tree/src/wg-quick/linux.bash?id=13f4ac4cb74b5a833fa7f825ba785b1e5774e84f#n197

Without fix applied wg-quick fails.

$ wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.100.0.2/32 dev wg0
[#] ip -6 address add fd08:4711::2/128 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a wg0 -m 0 -x
[#] wg set wg0 fwmark 51820
[#] ip -6 route add ::/0 dev wg0 table 51820
[#] ip -6 rule add not fwmark 51820 table 51820
[#] ip -6 rule add table main suppress_prefixlength 0
[#] ip6tables-restore -n
/usr/bin/wg-quick: line 32: ip6tables-restore: command not found
[#] resolvconf -d wg0 -f
[#] ip -6 rule delete table 51820
[#] ip -6 rule delete table main suppress_prefixlength 0
[#] ip link delete dev wg0

With fix applied wg-quick works.

wg-quick up wg0
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.100.0.2/32 dev wg0
[#] ip -6 address add fd08:4711::2/128 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] resolvconf -a wg0 -m 0 -x
[#] wg set wg0 fwmark 51820
[#] ip -6 route add ::/0 dev wg0 table 51820
[#] ip -6 rule add not fwmark 51820 table 51820
[#] ip -6 rule add table main suppress_prefixlength 0
[#] ip -4 route add 0.0.0.0/0 dev wg0 table 51820
[#] ip -4 rule add not fwmark 51820 table 51820
[#] ip -4 rule add table main suppress_prefixlength 0
[#] sysctl -q net.ipv4.conf.all.src_valid_mark=1

Signed-off-by: Athanasios Oikonomou <athoik@gmail.com>
---
 src/wg-quick/linux.bash | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/wg-quick/linux.bash b/src/wg-quick/linux.bash
index 4193ce5..0d85840 100755
--- a/src/wg-quick/linux.bash
+++ b/src/wg-quick/linux.bash
@@ -240,7 +240,7 @@ add_default() {
 	[[ $proto == -4 ]] && cmd sysctl -q net.ipv4.conf.all.src_valid_mark=1
 	if type -p nft >/dev/null; then
 		cmd nft -f <(echo -n "$nftcmd")
-	else
+	elif type -p iptables >/dev/null; then
 		echo -n "$restore" | cmd $iptables-restore -n
 	fi
 	HAVE_SET_FIREWALL=1
-- 
2.20.1