2024-01-08 14:07:20 -05:00
|
|
|
#!/bin/sh
|
|
|
|
|
2024-01-29 10:49:54 -05:00
|
|
|
# SPDX-FileCopyrightText: 2023 - 2024 Benjamin Grande M. S. <ben.grande.b@gmail.com>
|
2024-01-08 14:07:20 -05:00
|
|
|
#
|
|
|
|
# SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
|
|
|
|
set -eu
|
|
|
|
|
2024-06-19 09:08:03 -04:00
|
|
|
wg_conf="/etc/wireguard/wireguard.conf"
|
2024-01-08 14:07:20 -05:00
|
|
|
nft_conf="/var/run/wireguard/dnat.nft"
|
|
|
|
|
2024-06-19 09:08:03 -04:00
|
|
|
mkdir -p "${nft_conf%/*}"
|
2024-01-08 14:07:20 -05:00
|
|
|
rm -f "${nft_conf}"
|
|
|
|
touch "${nft_conf}"
|
|
|
|
|
|
|
|
set_nft(){
|
|
|
|
echo "${*}" | tee -a "${nft_conf}" >/dev/null
|
|
|
|
}
|
|
|
|
|
|
|
|
set_nft_dnat(){
|
|
|
|
ipv="${1}" # empty(4), 6
|
|
|
|
proto="${2}" # tcp, udp
|
|
|
|
dns_host="${3}"
|
2024-07-09 11:42:07 -04:00
|
|
|
rule_prefix="insert rule ip${ipv} qubes custom-dnat iifgroup 2 ${proto}"
|
|
|
|
rule_suffix="dport 53 dnat to ${dns_host}"
|
|
|
|
set_nft "${rule_prefix} ${rule_suffix}"
|
2024-01-08 14:07:20 -05:00
|
|
|
}
|
|
|
|
|
|
|
|
dns="$(grep -s "^\s*DNS\s*=\s*\S\+" "${wg_conf}" | sed "s/.*=//;s/ //g")"
|
2024-06-19 09:08:03 -04:00
|
|
|
|
|
|
|
if test -z "${dns}"; then
|
|
|
|
set_nft "insert rule ip qubes custom-dnat drop"
|
|
|
|
set_nft "insert rule ip6 qubes custom-dnat drop"
|
|
|
|
exit
|
|
|
|
fi
|
|
|
|
|
2024-01-08 14:07:20 -05:00
|
|
|
dns_primary="$(echo "${dns}" | cut -d "," -f 1)"
|
|
|
|
dns_secondary="$(echo "${dns}" | cut -d "," -f 2)"
|
|
|
|
|
|
|
|
dns_primary_ipv=""
|
|
|
|
if echo "${dns_primary}" | grep -qF ":"; then
|
|
|
|
dns_primary_ipv=6
|
|
|
|
fi
|
|
|
|
|
|
|
|
dns_secondary_ipv=""
|
|
|
|
if echo "${dns_secondary}" | grep -qF ":"; then
|
|
|
|
dns_secondary_ipv=6
|
|
|
|
fi
|
|
|
|
|
|
|
|
if test -n "${dns}"; then
|
|
|
|
set_nft_dnat "${dns_primary_ipv}" udp "${dns_primary}"
|
|
|
|
set_nft_dnat "${dns_primary_ipv}" tcp "${dns_primary}"
|
|
|
|
if echo "${dns}" | grep -qF ","; then
|
|
|
|
set_nft_dnat "${dns_secondary_ipv}" udp "${dns_secondary}"
|
|
|
|
set_nft_dnat "${dns_secondary_ipv}" tcp "${dns_secondary}"
|
|
|
|
fi
|
|
|
|
fi
|
2024-07-05 06:02:40 -04:00
|
|
|
|
|
|
|
ln -sf /run/resolvconf/resolv.conf /etc/resolv.conf
|