#!/usr/bin/env python3 # # Copyright (C) 2021-2023 VyOS maintainers and contributors # # This program is free software; you can redistribute it and/or modify # it under the terms of the GNU General Public License version 2 or later as # published by the Free Software Foundation. # # This program is distributed in the hope that it will be useful, # but WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the # GNU General Public License for more details. # # You should have received a copy of the GNU General Public License # along with this program. If not, see <http://www.gnu.org/licenses/>. import argparse import os from jinja2 import Template from ipaddress import ip_interface from vyos.ifconfig import Section from vyos.template import is_ipv4 from vyos.template import is_ipv6 from vyos.utils.process import cmd from vyos.utils.process import popen if os.geteuid() != 0: exit("You need to have root privileges to run this script.\nPlease try again, this time using 'sudo'. Exiting.") server_config = """WireGuard client configuration for interface: {{ interface }} To enable this configuration on a VyOS router you can use the following commands: === VyOS (server) configurtation === {% for addr in address if address is defined %} set interfaces wireguard {{ interface }} peer {{ name }} allowed-ips '{{ addr }}' {% endfor %} set interfaces wireguard {{ interface }} peer {{ name }} public-key '{{ pubkey }}' === RoadWarrior (client) configuration === """ client_config = """ [Interface] PrivateKey = {{ privkey }} {% if address is defined and address|length > 0 %} Address = {{ address | join(', ')}} {% endif %} DNS = 1.1.1.1 [Peer] PublicKey = {{ system_pubkey }} Endpoint = {{ server }}:{{ port }} AllowedIPs = 0.0.0.0/0, ::/0 """ if __name__ == '__main__': parser = argparse.ArgumentParser() parser.add_argument("-n", "--name", type=str, help='WireGuard peer name', required=True) parser.add_argument("-i", "--interface", type=str, help='WireGuard interface the client is connecting to', required=True) parser.add_argument("-s", "--server", type=str, help='WireGuard server IPv4/IPv6 address or FQDN', required=True) parser.add_argument("-a", "--address", type=str, help='WireGuard client IPv4/IPv6 address', action='append') args = parser.parse_args() interface = args.interface if interface not in Section.interfaces('wireguard'): exit(f'WireGuard interface "{interface}" does not exist!') wg_pubkey = cmd(f'wg show {interface} | grep "public key"').split(':')[-1].lstrip() wg_port = cmd(f'wg show {interface} | grep "listening port"').split(':')[-1].lstrip() # Generate WireGuard private key privkey,_ = popen('wg genkey') # Generate public key portion from given private key pubkey,_ = popen('wg pubkey', input=privkey) config = { 'name' : args.name, 'interface' : interface, 'system_pubkey' : wg_pubkey, 'privkey': privkey, 'pubkey' : pubkey, 'server' : args.server, 'port' : wg_port, 'address' : [], } if args.address: v4_addr = 0 v6_addr = 0 for tmp in args.address: try: ip = str(ip_interface(tmp).ip) if is_ipv4(tmp): config['address'].append(f'{ip}/32') v4_addr += 1 elif is_ipv6(tmp): config['address'].append(f'{ip}/128') v6_addr += 1 except: print(tmp) exit('Client IP address invalid!') if (v4_addr > 1) or (v6_addr > 1): exit('Client can only have one IPv4 and one IPv6 address.') # Clear out terminal first print('\x1b[2J\x1b[H') server = Template(server_config, trim_blocks=True).render(config) print(server) client = Template(client_config, trim_blocks=True).render(config) print(client) qrcode,err = popen('qrencode -t ansiutf8', input=client) print(qrcode)