n0mad1k/CoM-ghost_protocol
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix WireGuard service start failure

Browse Source 
- ip6tables nat commands now redirect stderr to /dev/null so missing
  ip6table_nat module doesn't fail PostUp and kill the service
- Pre-load ip6table_nat kernel module (ignore_errors for minimal kernels)
- Collapse PostUp/PostDown to single-line semicolon-chained commands
  (avoids any heredoc whitespace or multi-line parsing issues)
- Remove comments from inside wg0.conf config body

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
n0mad1k
2026-03-09 16:14:56 -04:00
parent 20bcecbcec
commit 0d9da7f7f2
1 changed files with 10 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
phantom/playbooks/vpn/tasks/configure.yml
+10 -32
View File
@@ -19,45 +19,26 @@
args:
creates: /etc/wireguard/clients/client1_private.key
- name: Ensure ip6tables nat module is available
modprobe:
name: ip6table_nat
state: present
ignore_errors: true
- name: Build WireGuard server config
shell: |
SERVER_PRIVKEY=$(cat /etc/wireguard/server_private.key)
IFACE={{ primary_interface.stdout | trim }}
SUBNET="{{ wg_subnet }}"
cat > /etc/wireguard/wg0.conf << 'WGEOF'
cat > /etc/wireguard/wg0.conf << EOF
[Interface]
WGEOF
# Write dynamic values separately to avoid heredoc variable issues
cat >> /etc/wireguard/wg0.conf << EOF
Address = {{ wg_subnet | regex_replace('/\\d+$', '') | regex_replace('\\.[0-9]+$', '.1/24') }}
ListenPort = {{ wg_port }}
PrivateKey = ${SERVER_PRIVKEY}
SaveConfig = false
# IPv4: forward VPN traffic to internet, masquerade source
PostUp = iptables -A FORWARD -i wg0 -o ${IFACE} -j ACCEPT
PostUp = iptables -A FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
PostUp = iptables -t nat -A POSTROUTING -o ${IFACE} -s {{ wg_subnet }} -j MASQUERADE
# IPv6: same rules to prevent leaks
PostUp = ip6tables -A FORWARD -i wg0 -o ${IFACE} -j ACCEPT
PostUp = ip6tables -A FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
PostUp = ip6tables -t nat -A POSTROUTING -o ${IFACE} -j MASQUERADE
# Block VPN clients from accessing server-local services (except DNS if local)
PostUp = iptables -I INPUT -i wg0 -p tcp --dport 22 -j DROP
PostUp = iptables -I INPUT -i wg0 -p tcp --dport 80 -j DROP
PostUp = iptables -I INPUT -i wg0 -p tcp --dport 443 -j DROP
PostDown = iptables -D FORWARD -i wg0 -o ${IFACE} -j ACCEPT
PostDown = iptables -D FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
PostDown = iptables -t nat -D POSTROUTING -o ${IFACE} -s {{ wg_subnet }} -j MASQUERADE
PostDown = ip6tables -D FORWARD -i wg0 -o ${IFACE} -j ACCEPT
PostDown = ip6tables -D FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT
PostDown = ip6tables -t nat -D POSTROUTING -o ${IFACE} -j MASQUERADE
PostDown = iptables -D INPUT -i wg0 -p tcp --dport 22 -j DROP
PostDown = iptables -D INPUT -i wg0 -p tcp --dport 80 -j DROP
PostDown = iptables -D INPUT -i wg0 -p tcp --dport 443 -j DROP
PostUp = iptables -A FORWARD -i wg0 -o ${IFACE} -j ACCEPT; iptables -A FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -A POSTROUTING -o ${IFACE} -s ${SUBNET} -j MASQUERADE; ip6tables -A FORWARD -i wg0 -o ${IFACE} -j ACCEPT 2>/dev/null; ip6tables -A FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; ip6tables -t nat -A POSTROUTING -o ${IFACE} -j MASQUERADE 2>/dev/null; iptables -I INPUT -i wg0 -p tcp --dport 22 -j DROP; iptables -I INPUT -i wg0 -p tcp --dport 80 -j DROP; iptables -I INPUT -i wg0 -p tcp --dport 443 -j DROP
PostDown = iptables -D FORWARD -i wg0 -o ${IFACE} -j ACCEPT; iptables -D FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT; iptables -t nat -D POSTROUTING -o ${IFACE} -s ${SUBNET} -j MASQUERADE; ip6tables -D FORWARD -i wg0 -o ${IFACE} -j ACCEPT 2>/dev/null; ip6tables -D FORWARD -i ${IFACE} -o wg0 -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; ip6tables -t nat -D POSTROUTING -o ${IFACE} -j MASQUERADE 2>/dev/null; iptables -D INPUT -i wg0 -p tcp --dport 22 -j DROP; iptables -D INPUT -i wg0 -p tcp --dport 80 -j DROP; iptables -D INPUT -i wg0 -p tcp --dport 443 -j DROP
EOF
for i in $(seq 1 {{ wg_clients }}); do
@@ -66,11 +47,9 @@
cat >> /etc/wireguard/wg0.conf << EOF
[Peer]
# Client ${i}
PublicKey = ${CLIENT_PUBKEY}
PresharedKey = ${CLIENT_PSK}
AllowedIPs = {{ wg_subnet | regex_replace('/\\d+$', '') | regex_replace('\\.[0-9]+$', '') }}.$(( i + 1 ))/32
EOF
done
@@ -102,7 +81,6 @@
PersistentKeepalive = 25
EOF
# Generate QR code
qrencode -t ansiutf8 < /etc/wireguard/clients/client${i}.conf > /etc/wireguard/clients/client${i}_qr.txt 2>/dev/null || true
done
args: