projekte/edgeguard-native
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(wg): Push-Routes (Client-Routes) für WireGuard-Server-Interfaces

Browse Source 
Neues Feld 'client_routes' auf wireguard_interfaces: der Operator
trägt dort kommagetrennte Netzwerke ein (z. B. 10.0.10.0/24 für ein
LAN hinter der Box). Der Peer-Config-Download fügt diese automatisch
als zusätzliche AllowedIPs in den [Peer]-Block der Client-Config ein.

Bisher wurde nur das Server-Tunnel-Subnetz (ifc.address_cidr) als
AllowedIPs exportiert — Peers konnten so keine anderen Netze über
den Tunnel erreichen ohne die Config manuell anzupassen.

Migration: 0026_wg_client_routes.sql

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Debian
2026-05-21 13:09:51 +02:00
parent 1f0d05019e
commit bc5d81d966
9 changed files with 46 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
internal/database/migrations/0026_wg_client_routes.sql Normal file
View File

@@ -0,0 +1,6 @@
-- +goose Up
ALTER TABLE wireguard_interfaces
ADD COLUMN IF NOT EXISTS client_routes TEXT;
-- +goose Down
ALTER TABLE wireguard_interfaces DROP COLUMN IF EXISTS client_routes;

18
internal/handlers/wireguard.go
View File

@@ -173,6 +173,7 @@ type ifaceCreateReq struct {
AllowedIPs *string `json:"allowed_ips,omitempty"`
PersistentKeepalive *int `json:"persistent_keepalive,omitempty"`
MTU *int `json:"mtu,omitempty"`
ClientRoutes *string `json:"client_routes,omitempty"`
Role string `json:"role"`
Active bool `json:"active"`
Description *string `json:"description,omitempty"`
@@ -222,6 +223,7 @@ func (h *WireguardHandler) CreateIface(c *gin.Context) {
PeerEndpoint: req.PeerEndpoint, PeerPublicKey: req.PeerPublicKey,
PeerPSKEnc: encPSK, AllowedIPs: req.AllowedIPs,
PersistentKeepalive: req.PersistentKeepalive, MTU: req.MTU,
ClientRoutes: req.ClientRoutes,
Role: req.Role, Active: req.Active, Description: req.Description,
}
if ifc.Role == "" {
@@ -311,6 +313,7 @@ func (h *WireguardHandler) UpdateIface(c *gin.Context) {
PeerEndpoint: req.PeerEndpoint, PeerPublicKey: req.PeerPublicKey,
PeerPSKEnc: encPSK, AllowedIPs: req.AllowedIPs,
PersistentKeepalive: req.PersistentKeepalive, MTU: req.MTU,
ClientRoutes: req.ClientRoutes,
Role: req.Role, Active: req.Active, Description: req.Description,
}
if ifc.Role == "" {
@@ -645,12 +648,15 @@ func (h *WireguardHandler) peerConfigText(ctx context.Context, peerID int64) (st
}
fmt.Fprintf(&b, "PresharedKey = %s\n", string(psk))
}
// AllowedIPs on the client side is "everything that should go
// through the tunnel". For a server hosting an internal LAN
// this is typically 10.x/8 or the server's address range. We
// default to the iface address (so the client can at least
// reach the gateway) — operator can edit downloaded conf.
fmt.Fprintf(&b, "AllowedIPs = %s\n", ifc.AddressCIDR)
// AllowedIPs on the client side: the server's tunnel subnet
// (so peers can reach each other + the gateway) plus any
// additional "push routes" the operator configured on the
// server interface (e.g. 10.0.10.0/24 for a LAN behind the box).
clientAllowedIPs := ifc.AddressCIDR
if ifc.ClientRoutes != nil && strings.TrimSpace(*ifc.ClientRoutes) != "" {
clientAllowedIPs += ", " + strings.TrimSpace(*ifc.ClientRoutes)
}
fmt.Fprintf(&b, "AllowedIPs = %s\n", clientAllowedIPs)
// Endpoint — the operator's public host:port that peers dial.
// We don't know this here (could be a CNAME or behind a load
// balancer); leave a placeholder the operator must fill in.

1
internal/models/wireguard.go
View File

@@ -18,6 +18,7 @@ type WireguardInterface struct {
AllowedIPs *string `gorm:"column:allowed_ips" json:"allowed_ips,omitempty"`
PersistentKeepalive *int `gorm:"column:persistent_keepalive" json:"persistent_keepalive,omitempty"`
MTU *int `gorm:"column:mtu" json:"mtu,omitempty"`
ClientRoutes *string `gorm:"column:client_routes" json:"client_routes,omitempty"`
Role string `gorm:"column:role" json:"role"`
Active bool `gorm:"column:active" json:"active"`
Description *string `gorm:"column:description" json:"description,omitempty"`

22
internal/services/wireguard/interfaces.go
View File

@@ -21,7 +21,7 @@ func NewInterfacesRepo(pool *pgxpool.Pool) *InterfacesRepo { return &InterfacesR
const ifaceBaseSelect = `
SELECT id, name, mode, address_cidr, listen_port, public_key, private_key_enc,
peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
mtu, role, active, description, created_at, updated_at
mtu, client_routes, role, active, description, created_at, updated_at
FROM wireguard_interfaces
`
@@ -59,14 +59,14 @@ func (r *InterfacesRepo) Create(ctx context.Context, i models.WireguardInterface
INSERT INTO wireguard_interfaces (
name, mode, address_cidr, listen_port, public_key, private_key_enc,
peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
mtu, role, active, description
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15)
mtu, client_routes, role, active, description
) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16)
RETURNING id, name, mode, address_cidr, listen_port, public_key, private_key_enc,
peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
mtu, role, active, description, created_at, updated_at`,
mtu, client_routes, role, active, description, created_at, updated_at`,
i.Name, i.Mode, i.AddressCIDR, i.ListenPort, i.PublicKey, i.PrivateKeyEnc,
i.PeerEndpoint, i.PeerPublicKey, i.PeerPSKEnc, i.AllowedIPs, i.PersistentKeepalive,
i.MTU, i.Role, i.Active, i.Description)
i.MTU, i.ClientRoutes, i.Role, i.Active, i.Description)
return scanIface(row)
}
@@ -75,15 +75,15 @@ func (r *InterfacesRepo) Update(ctx context.Context, id int64, i models.Wireguar
UPDATE wireguard_interfaces SET
name = $1, mode = $2, address_cidr = $3, listen_port = $4, public_key = $5,
private_key_enc = $6, peer_endpoint = $7, peer_public_key = $8, peer_psk_enc = $9,
allowed_ips = $10, persistent_keepalive = $11, mtu = $12, role = $13,
active = $14, description = $15, updated_at = NOW()
WHERE id = $16
allowed_ips = $10, persistent_keepalive = $11, mtu = $12, client_routes = $13,
role = $14, active = $15, description = $16, updated_at = NOW()
WHERE id = $17
RETURNING id, name, mode, address_cidr, listen_port, public_key, private_key_enc,
peer_endpoint, peer_public_key, peer_psk_enc, allowed_ips, persistent_keepalive,
mtu, role, active, description, created_at, updated_at`,
mtu, client_routes, role, active, description, created_at, updated_at`,
i.Name, i.Mode, i.AddressCIDR, i.ListenPort, i.PublicKey, i.PrivateKeyEnc,
i.PeerEndpoint, i.PeerPublicKey, i.PeerPSKEnc, i.AllowedIPs, i.PersistentKeepalive,
i.MTU, i.Role, i.Active, i.Description, id)
i.MTU, i.ClientRoutes, i.Role, i.Active, i.Description, id)
out, err := scanIface(row)
if err != nil {
if errors.Is(err, pgx.ErrNoRows) {
@@ -110,7 +110,7 @@ func scanIface(row interface{ Scan(...any) error }) (*models.WireguardInterface,
if err := row.Scan(
&i.ID, &i.Name, &i.Mode, &i.AddressCIDR, &i.ListenPort, &i.PublicKey, &i.PrivateKeyEnc,
&i.PeerEndpoint, &i.PeerPublicKey, &i.PeerPSKEnc, &i.AllowedIPs, &i.PersistentKeepalive,
&i.MTU, &i.Role, &i.Active, &i.Description, &i.CreatedAt, &i.UpdatedAt,
&i.MTU, &i.ClientRoutes, &i.Role, &i.Active, &i.Description, &i.CreatedAt, &i.UpdatedAt,
); err != nil {
return nil, err
}