diff --git a/getdomains-install.sh b/getdomains-install.sh index 23f1bc0..7a9bdb8 100755 --- a/getdomains-install.sh +++ b/getdomains-install.sh @@ -13,6 +13,12 @@ cat << EOF > /etc/hotplug.d/iface/30-vpnroute #!/bin/sh ip route add table vpn default dev wg0 +EOF + elif [ "$TUNNEL" == awg ]; then +cat << EOF > /etc/hotplug.d/iface/30-vpnroute +#!/bin/sh + +ip route add table vpn default dev awg0 EOF elif [ "$TUNNEL" == singbox ] || [ "$TUNNEL" == ovpn ] || [ "$TUNNEL" == tun2socks ]; then cat << EOF > /etc/hotplug.d/iface/30-vpnroute @@ -46,7 +52,8 @@ add_tunnel() { echo "3) Sing-box" echo "4) tun2socks" echo "5) wgForYoutube" - echo "6) Skip this step" + echo "6) Amnezia WireGuard" + echo "7) Skip this step" while true; do read -r -p '' TUNNEL @@ -77,7 +84,12 @@ add_tunnel() { break ;; - 6) + 6) + TUNNEL=awg + break + ;; + + 7) echo "Skip" TUNNEL=0 break @@ -218,6 +230,100 @@ EOF add_internal_wg fi + if [ "$TUNNEL" == 'awg' ]; then + printf "\033[32;1mConfigure Amnezia WireGuard\033[0m\n" + if opkg list-installed | grep -q amneziawg-tools; then + echo "amneziawg-tools already installed" + else + echo "Please, install amneziawg-tools and run the script again" + exit 1 + fi + + if opkg list-installed | grep -q kmod-amneziawg; then + echo "kmod-amneziawg already installed" + else + echo "Please, install kmod-amneziawg and run the script again" + exit 1 + fi + + if opkg list-installed | grep -q luci-app-amneziawg; then + echo "luci-app-amneziawg already installed" + else + echo "Please, install kmod-amneziawg and run the script again" + exit 1 + fi + + route_vpn + + read -r -p "Enter the private key (from [Interface]):"$'\n' AWG_PRIVATE_KEY + + while true; do + read -r -p "Enter internal IP address with subnet, example 192.168.100.5/24 (from [Interface]):"$'\n' AWG_IP + if echo "$AWG_IP" | egrep -oq '^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]+$'; then + break + else + echo "This IP is not valid. Please repeat" + fi + done + + read -r -p "Enter DNS servers separated by comma (from [Interface]):"$'\n' AWG_DNS + + read -r -p "Enter Jc value (from [Interface]):"$'\n' AWG_JC + read -r -p "Enter Jmin value (from [Interface]):"$'\n' AWG_JMIN + read -r -p "Enter Jmax value (from [Interface]):"$'\n' AWG_JMAX + read -r -p "Enter S1 value (from [Interface]):"$'\n' AWG_S1 + read -r -p "Enter S2 value (from [Interface]):"$'\n' AWG_S2 + read -r -p "Enter H1 value (from [Interface]):"$'\n' AWG_H1 + read -r -p "Enter H2 value (from [Interface]):"$'\n' AWG_H2 + read -r -p "Enter H3 value (from [Interface]):"$'\n' AWG_H3 + read -r -p "Enter H4 value (from [Interface]):"$'\n' AWG_H4 + + read -r -p "Enter the public key (from [Peer]):"$'\n' AWG_PUBLIC_KEY + read -r -p "If use PresharedKey, Enter this (from [Peer]). If your don't use leave blank:"$'\n' AWG_PRESHARED_KEY + read -r -p "Enter Endpoint host without port (Domain or IP) (from [Peer]):"$'\n' AWG_ENDPOINT + + read -r -p "Enter Endpoint host port (from [Peer]) [51820]:"$'\n' AWG_ENDPOINT_PORT + AWG_ENDPOINT_PORT=${AWG_ENDPOINT_PORT:-51820} + if [ "$AWG_ENDPOINT_PORT" = '51820' ]; then + echo $AWG_ENDPOINT_PORT + fi + + uci set network.awg0=interface + uci set network.awg0.proto='amneziawg' + uci set network.awg0.private_key=$AWG_PRIVATE_KEY + uci set network.awg0.listen_port='51820' + uci set network.awg0.addresses=$AWG_IP + + for DNS in $(echo $AWG_DNS | tr ',' ' '); do + uci add_list network.awg0.dns=$DNS + done + + uci set network.awg0.awg_jc=$AWG_JC + uci set network.awg0.awg_jmin=$AWG_JMIN + uci set network.awg0.awg_jmax=$AWG_JMAX + uci set network.awg0.awg_s1=$AWG_S1 + uci set network.awg0.awg_s2=$AWG_S2 + uci set network.awg0.awg_h1=$AWG_H1 + uci set network.awg0.awg_h2=$AWG_H2 + uci set network.awg0.awg_h3=$AWG_H3 + uci set network.awg0.awg_h4=$AWG_H4 + + if ! uci show network | grep -q amneziawg_awg0; then + uci add network amneziawg_awg0 + fi + + uci set network.@amneziawg_awg0[0]=amneziawg_awg0 + uci set network.@amneziawg_awg0[0].name='awg0_client' + uci set network.@amneziawg_awg0[0].public_key=$AWG_PUBLIC_KEY + uci set network.@amneziawg_awg0[0].preshared_key=$AWG_PRESHARED_KEY + uci set network.@amneziawg_awg0[0].route_allowed_ips='0' + uci set network.@amneziawg_awg0[0].persistent_keepalive='25' + uci set network.@amneziawg_awg0[0].endpoint_host=$AWG_ENDPOINT + uci set network.@amneziawg_awg0[0].allowed_ips='0.0.0.0/0' + uci set network.@amneziawg_awg0[0].endpoint_port=$AWG_ENDPOINT_PORT + uci commit + fi + } dnsmasqfull() { @@ -265,14 +371,25 @@ add_zone() { while uci -q delete firewall.@zone[$zone_wg_id]; do :; done fi + zone_awg_id=$(uci show firewall | grep -E '@zone.*awg0' | awk -F '[][{}]' '{print $2}' | head -n 1) + if [ "$zone_awg_id" == 0 ] || [ "$zone_awg_id" == 1 ]; then + printf "\033[32;1mawg0 zone has an identifier of 0 or 1. That's not ok. Fix your firewall. lan and wan zones should have identifiers 0 and 1. \033[0m\n" + exit 1 + fi + if [ ! -z "$zone_awg_id" ]; then + while uci -q delete firewall.@zone[$zone_awg_id]; do :; done + fi + uci add firewall zone uci set firewall.@zone[-1].name="$TUNNEL" if [ "$TUNNEL" == wg ]; then uci set firewall.@zone[-1].network='wg0' + elif [ "$TUNNEL" == awg ]; then + uci set firewall.@zone[-1].network='awg0' elif [ "$TUNNEL" == singbox ] || [ "$TUNNEL" == ovpn ] || [ "$TUNNEL" == tun2socks ]; then uci set firewall.@zone[-1].device='tun0' fi - if [ "$TUNNEL" == wg ] || [ "$TUNNEL" == ovpn ] || [ "$TUNNEL" == tun2socks ]; then + if [ "$TUNNEL" == wg ] || [ "$TUNNEL" == awg ] || [ "$TUNNEL" == ovpn ] || [ "$TUNNEL" == tun2socks ]; then uci set firewall.@zone[-1].forward='REJECT' uci set firewall.@zone[-1].output='ACCEPT' uci set firewall.@zone[-1].input='REJECT' @@ -299,6 +416,11 @@ add_zone() { remove_forwarding fi + if [[ $TUNNEL != "awg" ]]; then + forward_id=$(uci show firewall | grep -E "@forwarding.*dest='awg'" | awk -F '[][{}]' '{print $2}' | head -n 1) + remove_forwarding + fi + if [[ $TUNNEL != "ovpn" ]]; then forward_id=$(uci show firewall | grep -E "@forwarding.*dest='ovpn'" | awk -F '[][{}]' '{print $2}' | head -n 1) remove_forwarding