afify / wireguard-openbsd Goto Github PK

Firstly the client script is buggy in that it assumes we've got the packages libqrencode and curl installed. It will produce garbage that needs to be cleaned up manually if you run it without the curl package ready to go. Ideally we have output at the end of running wireguard_client.sh which gives us a nice clean QR code ready to be scanned in from the terminal from a client on a phone or whatever you need to do with that.

I introduced a bug in my previous and somewhat lazy solution for random port generation. It has a 1/9999 chance of generating a port which is just the default wireguard port of 51820, and this is obviously not what we want anyone deploying if they're looking for that little bit of security by obscurity. Additionally this script is limited in that if you want to change the VPN's gateway IP or endpoint port, you'll have to edit it yourself, no choice to use flags or any of that to fix these. I've also written some features in to handle this stuff.

In addition, I also noticed the default network allocation for the internal VPN network gateway as 10.0.0.0/24 is much too commonly used on LANs and therefore causes addressing conflicts if you're on wifi anywhere with that same subnet, and I'm allocating 10.0.23.0/24 and 10.0.23.1 as the default gateway as a way to mitigate this issue having yet to encounter such a conflict in years of using that on VPNs I've been setting up and connecting from various wifi access points. If this is an unlucky number to you or something weird like that feel free to change it, I'm happy as long as it isn't commonly used on LANs.

I wrote a solution for these issues which I will test thoroughly today, so look forward to another PR request incoming after I make sure these changes I made are good. I'm also making sure everything from here on in passes shellcheck -x -o all [file] for a little quality control. Since I happen to deploy a bunch of VPNs in my line of work, I'll be doing a bit more on this script to try to bring it to a higher level of quality, including adding the option to generate per-client PSK as well as whatever else I can think of.

Hello;

This line doesn't work with OpenBSD's version of "head" - there is no -c switch:

random_digits=$(LC_ALL=C tr -dc 0-9 </dev/urandom | head -c 4)

https://man.openbsd.org/OpenBSD-7.4/head

This -c flag is something which you'll find in the gnu coreutils head but not BSD head:

https://linux.die.net/man/1/head

I will submit a pull request with a simple fix which uses a combination of jot piped through cut which I just tested out, and found to have worked like a charm.