Ubuntu/Debian compatibility ?

[Enissay]

Before I start messing with my system installing all dependencies and such, is the script compatible with both Ubuntu/Debian ?

I have been looking for a decent management script and google lead me here <3

[gene-git]

Hi - should be completely fine - it's pure python - ( python versions 3.9 or newer) - so as long your python satisfies that then it should be completely fine.

The dependencies are listed in README. You can test it by cloning the repo and running from there. Easy way to try it out.

Aside from some convenience python modules, it uses wireguard tools and nftables - both are needed to run vpn anyway (or iptables if thats your thing) with or without wg-tool.

Feel free to tag me if I can help.

[Enissay]

Thank you for the fast reply.

I installed the dependencies using pip, now I am confused how to set things up... From the readme, I am not sure where to run this (already cloned the project, it has no dist folder):

    rm -f dist/*
    poetry build --format wheel
    ./scripts/do-install /

[gene-git]

testing:
You can run out of the cloned repo for testing by running wg-tool.py - try ./wg-tool.py -h

build and installing:

1. poetry build creates a python wheel (which holds all the code) and saves it in ./dist/xxx.whl
   the install script would then install to destination directory prefix (/ above) - the code would then be installed in something like /usr/lib/python3.10/site-packages/wg_tool .
   a sym link would also be installed in /usr/bin/wg-tool pointing to the installed module wg-tool.py.

once its installed and available in /usr/bin then it would be in your path.

let me know how it goes.

[gene-git]

to keep the repo clean probably better to create a test directory and run in there.
mkdir ../test
cd ../test
ln -s ../wg_tool/wg-tool.py wg-tool
./wg-tool -h

[gene-git]

be nice if someone made a .deb package for wg_tool

[Enissay]

A docker image would be better given all the dependencies I think...

[gene-git]

good idea on docker ... i forgot to answer your question fully- you run poetry build in the top level of repo - and ditto for installer script which takes one arg which is the destination prefix. Those to things (build/install) are normally done by the package builder tool.

packages take care of the dependencies - so installing a package makes it simple too.

[Enissay]

I broke my system as I feared... I only had python 3.8 and meant to add 3.10... There was some conflict which was suggested to run apt purge python3 (dumb me)...

I've been trying to fix it for the last hour in vain... I will try again tomorrow as I am useless after midnight... A docker package is certainly the way to go xD

[gene-git]

geez so sorry - thats really annoying - :(

[gene-git]

hope you can things back to normal

[gene-git]

the only need for 3.9 is using match() instead of if else ... there are a few places but it would be possible to make a version without match() statements I would think.

[gene-git]

again - so sorry

[Enissay]

Really, no worries... It probably will be less hassle installing the system from scratch (it's a remote server), it will just need some extra configs (FW, SSH, some other custom packages, ...)...

I just hope it is worth it :P as I am still in the "testing phase" xD

[gene-git]

remote machine ... ug .. thats a lot of work.

[gene-git]

would be doable to make copies of the 2 files using match() and change them to use if else - those quite likely would work okay with python 3.8.

[gene-git]

The correct fix is to change your server config

config/server/server.conf

and change the /usr/bin/nft to /usr/sbin/nft
that will fix it permanently for you.

Wow - tis late there!!!

[gene-git]

also please try instead of wg show:
sudo wg-tool -rrpt

[gene-git]

If no traffic then (assuming vpn server itself has internet / local access) - the nftables config is likely not right for your setup

[gene-git]

I will push the python3 change and the pip option fix to gh repo -

[gene-git]

Can you check the postup script to be sure you have the right network settings - the default script should work as long as your vpn server has internet access - but it does need to be edited for your own network,.

thanks

[gene-git]

Still on my todo list - create requirements file.

Please Let me know if you got the postup script working. Thanks!

[gene-git]

requirements.txt added in commit 7a548d2

[Enissay]

Please Let me know if you got the postup script working. Thanks!

Sadly not. Sorry for my disappearance but I am on holidays (since over a week actually)... I'll be back home later this week and will dig deeper to find a fix

[gene-git]

Sorry to hear that - happy to help where I can. I assume vpn server has internet access so when the vpn clients get nat'ed their traffic should get to internet as well (and would appear to come from vpn server of course). Have wonderful rest of holidays and very merry christmas !

[gene-git]

May be worth double checking that the network settings look right in your postup nftables script.

[Enissay]

No worries, last time I checked, server had internet and handshake was successful, yet no internet on the client...
I admit some of the options I just winged (I was not sure)... When back, I will try again from scratch which will allow me also to try all the changes you generously implemented... I will get back with questions to set things right...

[gene-git]

ok that sounds good - have fun day :)

[gene-git]

(it really does sound like the postup script is worth looking over)

[gene-git]

one more thought occurred to me - please make sure ip forwarding is turned on
sysctl -w net.ipv4.ip_forward=1
and add line to /etc/sysctl.d/systctl.conf (or whatever name you prefer for file) :
net.ipv4.ip_forward = 1

[gene-git]

Hi any updates from your side?

[Enissay]

Oh, sadly not. I got distracted since with other tasks :<
I am planning however to dive in again this month still. I will revisit and update..

[gene-git]

Understand - life can certainly keep you busy, especially with the unexpected!
Happy to help if I can.