projekte/edgeguard-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(wg): Push-Routes (Client-Routes) für WireGuard-Server-Interfaces

Browse Source 
Neues Feld 'client_routes' auf wireguard_interfaces: der Operator
trägt dort kommagetrennte Netzwerke ein (z. B. 10.0.10.0/24 für ein
LAN hinter der Box). Der Peer-Config-Download fügt diese automatisch
als zusätzliche AllowedIPs in den [Peer]-Block der Client-Config ein.

Bisher wurde nur das Server-Tunnel-Subnetz (ifc.address_cidr) als
AllowedIPs exportiert — Peers konnten so keine anderen Netze über
den Tunnel erreichen ohne die Config manuell anzupassen.

Migration: 0026_wg_client_routes.sql

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
2026-05-21 13:09:51 +02:00
parent 1f0d05019e
commit bc5d81d966
9 changed files with 46 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
VERSION
View File

@@ -1 +1 @@
1.1.52
1.1.53

6
internal/database/migrations/0026_wg_client_routes.sql Normal file
View File

@@ -0,0 +1,6 @@
-- +goose Up
ALTER TABLE wireguard_interfaces
ADD COLUMN IF NOT EXISTS client_routes TEXT;
-- +goose Down
ALTER TABLE wireguard_interfaces DROP COLUMN IF EXISTS client_routes;

18
internal/handlers/wireguard.go
View File

@@ -173,6 +173,7 @@ type ifaceCreateReq struct {
AllowedIPs *string `json:"allowed_ips,omitempty"`
PersistentKeepalive *int `json:"persistent_keepalive,omitempty"`
MTU *int `json:"mtu,omitempty"`
ClientRoutes *string `json:"client_routes,omitempty"`
Role string `json:"role"`
Active bool `json:"active"`
Description *string `json:"description,omitempty"`
@@ -222,6 +223,7 @@ func (h *WireguardHandler) CreateIface(c *gin.Context) {
PeerEndpoint: req.PeerEndpoint, PeerPublicKey: req.PeerPublicKey,
PeerPSKEnc: encPSK, AllowedIPs: req.AllowedIPs,
PersistentKeepalive: req.PersistentKeepalive, MTU: req.MTU,
ClientRoutes: req.ClientRoutes,
Role: req.Role, Active: req.Active, Description: req.Description,
}
if ifc.Role == "" {
@@ -311,6 +313,7 @@ func (h *WireguardHandler) UpdateIface(c *gin.Context) {
PeerEndpoint: req.PeerEndpoint, PeerPublicKey: req.PeerPublicKey,
PeerPSKEnc: encPSK, AllowedIPs: req.AllowedIPs,
PersistentKeepalive: req.PersistentKeepalive, MTU: req.MTU,
ClientRoutes: req.ClientRoutes,
Role: req.Role, Active: req.Active, Description: req.Description,
}
if ifc.Role == "" {
@@ -645,12 +648,15 @@ func (h *WireguardHandler) peerConfigText(ctx context.Context, peerID int64) (st
}
fmt.Fprintf(&b, "PresharedKey = %s\n", string(psk))
}
// AllowedIPs on the client side is "everything that should go
// through the tunnel". For a server hosting an internal LAN
// this is typically 10.x/8 or the server's address range. We
// default to the iface address (so the client can at least
// reach the gateway) — operator can edit downloaded conf.
fmt.Fprintf(&b, "AllowedIPs = %s\n", ifc.AddressCIDR)
// AllowedIPs on the client side: the server's tunnel subnet
// (so peers can reach each other + the gateway) plus any
// additional "push routes" the operator configured on the
// server interface (e.g. 10.0.10.0/24 for a LAN behind the box).
clientAllowedIPs := ifc.AddressCIDR
if ifc.ClientRoutes != nil && strings.TrimSpace(*ifc.ClientRoutes) != "" {
clientAllowedIPs += ", " + strings.TrimSpace(*ifc.ClientRoutes)
}
fmt.Fprintf(&b, "AllowedIPs = %s\n", clientAllowedIPs)
// Endpoint — the operator's public host:port that peers dial.
// We don't know this here (could be a CNAME or behind a load
// balancer); leave a placeholder the operator must fill in.

1
internal/models/wireguard.go
View File

@@ -18,6 +18,7 @@ type WireguardInterface struct {
AllowedIPs *string `gorm:"column:allowed_ips" json:"allowed_ips,omitempty"`
PersistentKeepalive *int `gorm:"column:persistent_keepalive" json:"persistent_keepalive,omitempty"`
MTU *int `gorm:"column:mtu" json:"mtu,omitempty"`
ClientRoutes *string `gorm:"column:client_routes" json:"client_routes,omitempty"`
Role string `gorm:"column:role" json:"role"`
Active bool `gorm:"column:active" json:"active"`
Description *string `gorm:"column:description" json:"description,omitempty"`

22
internal/services/wireguard/interfaces.go
View File

@@ -21,7 +21,7 @@ func NewInterfacesRepo(pool *pgxpool.Pool) *InterfacesRepo { return &InterfacesR
const ifaceBaseSelect = `
SELECT id, name, mode, address_cidr, listen_port, public_key, private_key_enc,
peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
mtu, role, active, description, created_at, updated_at
mtu, client_routes, role, active, description, created_at, updated_at
FROM wireguard_interfaces
`
@@ -59,14 +59,14 @@ func (r *InterfacesRepo) Create(ctx context.Context, i models.WireguardInterface
INSERT INTO wireguard_interfaces (
name, mode, address_cidr, listen_port, public_key, private_key_enc,
peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
mtu, role, active, description
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)
mtu, client_routes, role, active, description
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)
RETURNING id, name, mode, address_cidr, listen_port, public_key, private_key_enc,
peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
mtu, role, active, description, created_at, updated_at`,
mtu, client_routes, role, active, description, created_at, updated_at`,
i.Name, i.Mode, i.AddressCIDR, i.ListenPort, i.PublicKey, i.PrivateKeyEnc,
i.PeerEndpoint, i.PeerPublicKey, i.PeerPSKEnc, i.AllowedIPs, i.PersistentKeepalive,
i.MTU, i.Role, i.Active, i.Description)
i.MTU, i.ClientRoutes, i.Role, i.Active, i.Description)
return scanIface(row)
}
@@ -75,15 +75,15 @@ func (r *InterfacesRepo) Update(ctx context.Context, id int64, i models.Wireguar
UPDATE wireguard_interfaces SET
name = $1, mode = $2, address_cidr = $3, listen_port = $4, public_key = $5,
private_key_enc = $6, peer_endpoint = $7, peer_public_key = $8, peer_psk_enc = $9,
allowed_ips = $10, persistent_keepalive = $11, mtu = $12, role = $13,
active = $14, description = $15, updated_at = NOW()
WHERE id = $16
allowed_ips = $10, persistent_keepalive = $11, mtu = $12, client_routes = $13,
role = $14, active = $15, description = $16, updated_at = NOW()
WHERE id = $17
RETURNING id, name, mode, address_cidr, listen_port, public_key, private_key_enc,
peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
mtu, role, active, description, created_at, updated_at`,
mtu, client_routes, role, active, description, created_at, updated_at`,
i.Name, i.Mode, i.AddressCIDR, i.ListenPort, i.PublicKey, i.PrivateKeyEnc,
i.PeerEndpoint, i.PeerPublicKey, i.PeerPSKEnc, i.AllowedIPs, i.PersistentKeepalive,
i.MTU, i.Role, i.Active, i.Description, id)
i.MTU, i.ClientRoutes, i.Role, i.Active, i.Description, id)
out, err := scanIface(row)
if err != nil {
if errors.Is(err, pgx.ErrNoRows) {
@@ -110,7 +110,7 @@ func scanIface(row interface{ Scan(...any) error }) (*models.WireguardInterface,
if err := row.Scan(
&i.ID, &i.Name, &i.Mode, &i.AddressCIDR, &i.ListenPort, &i.PublicKey, &i.PrivateKeyEnc,
&i.PeerEndpoint, &i.PeerPublicKey, &i.PeerPSKEnc, &i.AllowedIPs, &i.PersistentKeepalive,
&i.MTU, &i.Role, &i.Active, &i.Description, &i.CreatedAt, &i.UpdatedAt,
&i.MTU, &i.ClientRoutes, &i.Role, &i.Active, &i.Description, &i.CreatedAt, &i.UpdatedAt,
); err != nil {
return nil, err
}

4
management-ui/src/i18n/locales/de/common.json
View File

@@ -625,7 +625,9 @@
"generateExtra": "Wenn an: Server erzeugt ein neues Curve25519-Keypair beim Speichern.",
"generateOn": "Server generiert",
"generateOff": "Manuell paste",
"editKeyWarning": "Achtung: neue Schlüssel = bestehende Peer-Configs ungültig. Nur ändern wenn explizit gewollt."
"editKeyWarning": "Achtung: neue Schlüssel = bestehende Peer-Configs ungültig. Nur ändern wenn explizit gewollt.",
"clientRoutes": "Push-Routes (Client)",
"clientRoutesExtra": "Zusätzliche Netzwerke die der Peer über den Tunnel erreichen soll, z. B. 10.0.10.0/24 für ein LAN hinter der Box. Kommagetrennt. Wird automatisch in den Peer-Config-Download eingetragen."
},
"peers": {
"button": "Peers",

4
management-ui/src/i18n/locales/en/common.json
View File

@@ -625,7 +625,9 @@
"generateExtra": "If on: server generates a fresh Curve25519 keypair on save.",
"generateOn": "Server-generated",
"generateOff": "Manual paste",
"editKeyWarning": "Warning: new keys invalidate all existing peer configs. Only change if intentional."
"editKeyWarning": "Warning: new keys invalidate all existing peer configs. Only change if intentional.",
"clientRoutes": "Push routes (client)",
"clientRoutesExtra": "Extra networks the peer should reach through the tunnel, e.g. 10.0.10.0/24 for a LAN behind the box. Comma-separated. Automatically included in the peer config download."
},
"peers": {
"button": "Peers",

8
management-ui/src/pages/Wireguard/Servers.tsx
View File

@@ -25,6 +25,7 @@ interface ServerForm {
address_cidr: string
listen_port: number
mtu?: number
client_routes?: string
role: string
active: boolean
description?: string
@@ -153,6 +154,7 @@ export default function ServersTab() {
address_cidr: row.address_cidr,
listen_port: row.listen_port ?? 51820,
mtu: row.mtu ?? undefined,
client_routes: row.client_routes ?? undefined,
role: row.role,
active: row.active,
description: row.description ?? undefined,
@@ -263,6 +265,12 @@ export default function ServersTab() {
</Form.Item>
</Col>
</Row>
<Form.Item
label={t('wg.iface.clientRoutes')} name="client_routes"
extra={t('wg.iface.clientRoutesExtra')}
>
<Input placeholder="10.0.10.0/24, 192.168.1.0/24" />
</Form.Item>
<Form.Item label={t('wg.iface.description')} name="description">
<Input.TextArea rows={2} />
</Form.Item>

1
management-ui/src/pages/Wireguard/types.ts
View File

@@ -12,6 +12,7 @@ export interface WGInterface {
allowed_ips?: string | null
persistent_keepalive?: number | null
mtu?: number | null
client_routes?: string | null
role: string
active: boolean
description?: string | null