Skip to content

Instantly share code, notes, and snippets.

@skipperTux

skipperTux/wg-nmcli

Created May 5, 2021
Embed
What would you like to do?
Bash script for managing WireGuard connections using NetworkManager CLI
#!/usr/bin/env bash
set -o nounset
set -o pipefail
#set -o xtrace
# http://www.tldp.org/LDP/abs/html/exitcodes.html
# user-defined exit codes range 64 - 113 (in addition to 0, for success)
readonly SUCCESS=0
readonly E_NO_CONNECTION_PROFILE=64
readonly E_UNKNOWN_CONNECTION_PROFILE=65
readonly E_INVALID_CONNECTION_STATUS=66
# constant variables
readonly YELLOW=`tput setaf 226`
readonly ORANGE=`tput setaf 208`
readonly RED=`tput setaf 196`
readonly RESET=`tput sgr0`
readonly INFO="${YELLOW}INFO:${RESET} "
readonly WARNING="${ORANGE}WARNING:${RESET} "
readonly ERROR="${RED}ERROR:${RESET} "
readonly DQT='"'
readonly WIREGUARD_TYPE='wireguard'
readonly WIREGUARD_CONFIGS='/etc/wireguard'
# variables
connection='up'
autoconnect=false
# https://stackoverflow.com/questions/192249/how-do-i-parse-command-line-arguments-in-bash/39398359#39398359
# As long as there is at least one more argument, keep looping
while [[ $# -gt 0 ]]; do
key="$1"
case "$key" in
# Also a flag type option. Will catch either -i or --import
-i|--import)
connection='import'
;;
# Also a flag type option. Will catch either -rm or --remove
-rm|--remove)
connection='remove'
;;
# Also a flag type option. Will catch either -r or --reload
-r|--reload)
connection='reload'
;;
# This is a flag type option. Will catch either -u or --up
-u|--up)
connection='up'
;;
# Also a flag type option. Will catch either -d or --down
-d|--down)
connection='down'
;;
# This is a flag type option. Will catch either -h or --help
-h|--help)
connection='help'
;;
# Also a flag type option. Will catch either -a or --auto-connect
-a|--auto-connect)
autoconnect=true
;;
# This is an arg value type option. Will catch -ds value or --dns-search value
-ds|--dns-search)
shift # past the key and to the value
dns_search="$1"
;;
# This is an arg=value type option. Will catch -ds=value or --dns-search=value
-ds=*|--dns-search=*)
# No need to shift here since the value is part of the same string
dns_search="${key#*=}"
;;
# This is an arg value type option. Will catch -cn value or --connection-name value
-cn|--connection-name)
shift # past the key and to the value
connection_name="$1"
;;
# This is an arg=value type option. Will catch -cn=value or --connection-name=value
-cn=*|--connection-name=*)
# No need to shift here since the value is part of the same string
connection_name="${key#*=}"
;;
*)
# Do whatever you want with extra argument
echo "Unknown argument '$key'"
connection='help'
;;
esac
# Shift after checking all the cases to get the next option
shift
done
# functions
show_help() {
# display help
echo "Usage: wg-nmcli [COMMAND] [IMPORT-OPTIONS] { CONNECTION-NAME | help }"
echo "Manage WireGuard connections using NetworkManager CLI."
echo
echo "COMMAND"
echo " -i, --import import an external WireGuard configuration as a NetworkManager connection profile"
echo "-rm, --remove delete a WireGuard connection profile"
echo " -r, --reload re-import (remove and import) an external WireGuard configuration"
echo " -u, --up activate a WireGuard connection (default)"
echo " -d, --down deactivate a WireGuard connection"
echo " -h, --help print this help"
echo
echo "IMPORT-OPTIONS"
echo " -a, --auto-connect enable auto-connect for WireGuard connection profile"
echo "-ds, --dns-search[=]ARG Modify 'DNS domain' property of the WireGuard connection profile"
echo " ARG := ${DQT}comma separated list of domains${DQT} (see https://blogs.gnome.org/mcatanzaro/2020/12/17/understanding-systemd-resolved-split-dns-and-vpn-configuration/)"
echo
echo "CONNECTION-NAME"
echo "-cn, --connection-name[=]ARG name of the WireGuard connection profile (mandatory)"
echo " ARG := ${DQT}WireGuard connection profile name${DQT}"
echo
}
connection_status() {
if [ "${connection_name:-}" = "" ]; then
echo "${ERROR}Please provide a WireGuard connection profile name."
exit ${E_NO_CONNECTION_PROFILE}
fi
conn_exists=`nmcli connection show | grep -icP "(${connection_name})(.*)(${WIREGUARD_TYPE})"`
conn_up=`nmcli connection show | grep -icP "(${connection_name})(.*)(${WIREGUARD_TYPE})(\s*)(${connection_name})"`
if [ ${conn_exists} -eq 0 ]; then
if [ "${connection:-}" != "import" ]; then
echo "${ERROR}WireGuard connection profile '${connection_name}' does not exist."
exit ${E_UNKNOWN_CONNECTION_PROFILE}
fi
else
if [ "${connection:-}" = "import" ]; then
connection='reload'
echo "${INFO}WireGuard connection profile '${connection_name}' already exists, reloading."
fi
fi
}
connection_up() {
if [ ${conn_up} -eq 1 ]; then
echo "${WARNING}WireGuard connection '${connection_name}' already active."
exit ${E_INVALID_CONNECTION_STATUS}
fi
nmcli connection up "${connection_name}"
}
connection_down() {
if [ ${conn_up} -eq 0 ]; then
echo "${WARNING}WireGuard connection '${connection_name}' not active."
exit ${E_INVALID_CONNECTION_STATUS}
fi
nmcli connection down "${connection_name}"
}
connection_import() {
sudo nmcli connection import type wireguard file "${WIREGUARD_CONFIGS}/${connection_name}.conf"
if [ "${autoconnect:-}" != "true" ]; then
nmcli connection modify "${connection_name}" autoconnect no
fi
nmcli connection modify "${connection_name}" ipv4.never-default true
if [ "${dns_search:-}" != "" ]; then
nmcli connection modify "${connection_name}" ipv4.dns-search "${dns_search}"
fi
}
connection_remove() {
sudo nmcli connection delete "${connection_name}"
}
connection_reload() {
connection_remove
connection_import
}
# script main
if [ "${connection:-}" = "help" ]; then
show_help
exit ${SUCCESS}
fi
connection_status
case "${connection:-}" in
up)
connection_up
;;
down)
connection_down
;;
import)
connection_import
;;
remove)
connection_remove
;;
reload)
connection_reload
;;
*)
show_help
;;
esac
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment