-
-
Save pashazz/c0d4ce30e732c6409da710ceced071eb to your computer and use it in GitHub Desktop.
WireGuard configuration
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
[Interface] | |
PrivateKey = <REDACTED> | |
Address = 10.14.0.3/32 | |
[Peer] | |
PublicKey = <REDACTED> | |
AllowedIPs = 0.0.0.0/0 | |
Endpoint = <REDACTED>:51820 | |
PersistentKeepalive = 25 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
config defaults | |
option input 'ACCEPT' | |
option output 'ACCEPT' | |
option forward 'REJECT' | |
option synflood_protect '1' | |
config zone | |
option name 'lan' | |
option input 'ACCEPT' | |
option output 'ACCEPT' | |
option forward 'ACCEPT' | |
list network 'lan' | |
list network 'WireGuard0' | |
option masq '1' | |
config zone | |
option name 'wan' | |
list network 'wan' | |
list network 'wan6' | |
option output 'ACCEPT' | |
option masq '1' | |
option mtu_fix '1' | |
option input 'ACCEPT' | |
option forward 'ACCEPT' | |
config forwarding | |
option src 'lan' | |
option dest 'wan' | |
config rule | |
option name 'Allow-DHCP-Renew' | |
option src 'wan' | |
option proto 'udp' | |
option dest_port '68' | |
option target 'ACCEPT' | |
option family 'ipv4' | |
config rule | |
option name 'Allow-Ping' | |
option src 'wan' | |
option proto 'icmp' | |
option icmp_type 'echo-request' | |
option family 'ipv4' | |
option target 'ACCEPT' | |
config rule | |
option name 'Allow-IGMP' | |
option src 'wan' | |
option proto 'igmp' | |
option family 'ipv4' | |
option target 'ACCEPT' | |
config rule | |
option name 'Allow-DHCPv6' | |
option src 'wan' | |
option proto 'udp' | |
option dest_port '546' | |
option family 'ipv6' | |
option target 'ACCEPT' | |
config rule | |
option name 'Allow-MLD' | |
option src 'wan' | |
option proto 'icmp' | |
option src_ip 'fe80::/10' | |
list icmp_type '130/0' | |
list icmp_type '131/0' | |
list icmp_type '132/0' | |
list icmp_type '143/0' | |
option family 'ipv6' | |
option target 'ACCEPT' | |
config rule | |
option name 'Allow-ICMPv6-Input' | |
option src 'wan' | |
option proto 'icmp' | |
list icmp_type 'echo-request' | |
list icmp_type 'echo-reply' | |
list icmp_type 'destination-unreachable' | |
list icmp_type 'packet-too-big' | |
list icmp_type 'time-exceeded' | |
list icmp_type 'bad-header' | |
list icmp_type 'unknown-header-type' | |
list icmp_type 'router-solicitation' | |
list icmp_type 'neighbour-solicitation' | |
list icmp_type 'router-advertisement' | |
list icmp_type 'neighbour-advertisement' | |
option limit '1000/sec' | |
option family 'ipv6' | |
option target 'ACCEPT' | |
config rule | |
option name 'Allow-ICMPv6-Forward' | |
option src 'wan' | |
option dest '*' | |
option proto 'icmp' | |
list icmp_type 'echo-request' | |
list icmp_type 'echo-reply' | |
list icmp_type 'destination-unreachable' | |
list icmp_type 'packet-too-big' | |
list icmp_type 'time-exceeded' | |
list icmp_type 'bad-header' | |
list icmp_type 'unknown-header-type' | |
option limit '1000/sec' | |
option family 'ipv6' | |
option target 'ACCEPT' | |
config rule | |
option name 'Allow-IPSec-ESP' | |
option src 'wan' | |
option dest 'lan' | |
option proto 'esp' | |
option target 'ACCEPT' | |
config rule | |
option name 'Allow-ISAKMP' | |
option src 'wan' | |
option dest 'lan' | |
option dest_port '500' | |
option proto 'udp' | |
option target 'ACCEPT' | |
config forwarding | |
option dest 'lan' | |
config forwarding | |
option dest 'wan' | |
config forwarding | |
option dest 'lan' | |
config forwarding | |
option dest 'wan' | |
config rule | |
option name 'WG-Input' | |
list proto 'udp' | |
option src 'wan' | |
option dest_port '51820' | |
option target 'ACCEPT' | |
config forwarding | |
option src 'wan' | |
option dest 'lan' |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
config interface 'loopback' | |
option device 'lo' | |
option proto 'static' | |
option ipaddr '127.0.0.1' | |
option netmask '255.0.0.0' | |
... | |
config interface 'lan' | |
option device 'br-lan' | |
option proto 'static' | |
option ipaddr '192.168.1.1' | |
option netmask '255.255.255.0' | |
option ip6assign '60' | |
config interface 'wan' | |
option device 'eth0.2' | |
option proto 'dhcp' | |
config interface 'wan6' | |
option device 'eth0.2' | |
option proto 'dhcpv6' | |
config switch | |
option name 'switch0' | |
option reset '1' | |
option enable_vlan '1' | |
config switch_vlan | |
option device 'switch0' | |
option vlan '1' | |
option ports '2 3 4 5 0t' | |
config switch_vlan | |
option device 'switch0' | |
option vlan '2' | |
option ports '1 6t' | |
config interface 'WireGuard0' | |
option proto 'wireguard' | |
option private_key '<REDACTED>' | |
option listen_port '51820' | |
option peerdns '0' | |
option delegate '0' | |
list addresses '10.14.0.1/24' | |
list dns '10.14.0.1' | |
config wireguard_WireGuard0 | |
option public_key '<REDACTED>' | |
option private_key '<REDACTED>' | |
option persistent_keepalive '25' | |
list allowed_ips '10.14.0.3/32' | |
option route_allowed_ips '1' |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment