Add PostUp / PreDown rules to Wireguard configs to restrict traffic to the tunnel

_.md

# python3 /home/me/postup_predown.py /etc/wireguard/*.conf
sudo bash -c 'python3 /home/me/postup_predown.py /etc/wireguard/*.conf'

postup_predown.py

import configparser, sys

for path in sys.argv[1:]:
    conf = configparser.RawConfigParser()
    conf.optionxform = str
    conf.read(path)
    conf['Interface']['PostUp'] = 'iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT'
    conf['Interface']['PreDown']= 'iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show  %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark ! --mark $(wg show  %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT'

    with open(path, 'w') as out:
        conf.write(out)