Skip to content

Aegis-VPN v3.0.0

Latest
Latest

Choose a tag to compare

View all tags
@rabindra789 rabindra789 released this 21 Feb 14:27
· 31 commits to main since this release
v3.0.0
5d24cbb
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's New

This is a major version release — the largest update since the project started.

Bug Fixes

  • add_client.sh — Fixed undefined $CLIENT_IP variable that silently wrote broken peer entries
  • add_client.sh — Fixed IP collision bug when re-adding clients after deletion (replaced ls | grep -c with lock file + counter)
  • manage_clients.sh — Fixed destructive sed regex that could corrupt wg0.conf on client removal (rewritten with awk)
  • setup.sh — Fixed typo /etc/systl.conf → /etc/sysctl.conf (IP forwarding was not persisting across reboots)

New Features

Server-Side Key Rotation (aegis-vpn rotate-server)

Resolves #5. Rotates the WireGuard server private key with minimal client disruption:

  • Swaps the kernel-level key in-place via wg set — interface stays up, no firewall flush
  • Clients lose ~1 handshake cycle (~5 s), then reconnect automatically
  • All client configs updated atomically before any reconnection attempt
  • Full audit record (old key, new key, timestamp, client count)
  • --qr flag re-displays QR codes for all clients after rotation

Client Key Rotation (aegis-vpn rotate <client>)

Regenerates a single client's keys without changing their IP, DNS, or tunnel mode. New QR code displayed automatically.

Status Dashboard (aegis-vpn status)

Shows WireGuard service state, uptime, and per-peer bandwidth (sent/received) via wg show transfer.

Backup & Restore (aegis-vpn backup / aegis-vpn restore <file>)

Creates a timestamped tarball of /etc/wireguard/ and clients/. Restore stops WireGuard, extracts, and restarts cleanly.

Config Validation (aegis-vpn check)

Validates wg0.conf integrity: checks key formats, detects orphaned peers (in server config but no client file), and detects orphaned client files (no matching server peer).

DNS Selection

When adding a client, choose your DNS resolver: Cloudflare, Google, Quad9, or custom.

Split Tunneling

When adding a client, choose between full tunnel (0.0.0.0/0) or VPN-only subnet routing.

Log Rotation

Logs auto-rotate at 10 MB, keeping 3 rotations.

Hardening

  • New scripts/lib.sh shared library — eliminates duplicated constants across all scripts
  • Auto-detect network interface via ip route (removes hardcoded enX0)
  • set -euo pipefail across all scripts
  • Input validation on client names ([a-zA-Z0-9_-], max 32 chars)
  • Atomic lock file prevents IP allocation race conditions

CLI / UX

  • 13-option interactive menu with live peer count in header
  • Color output: green = online, red = offline, yellow = warning
  • Live dashboard reads wg show data (replaces log file parsing)
  • Table-format list with Name / IPv4 / IPv6 / Status / Last Handshake
  • Spinners for long operations
  • aegis-vpn --help, aegis-vpn version

New Files

File Description
scripts/lib.sh Shared constants, colors, utility functions
scripts/rotate_server.sh Server key rotation
scripts/rotate_client.sh Client key rotation
scripts/backup_restore.sh Backup and restore
scripts/validate.sh Config integrity validation

Upgrade from v1.x

No migration needed — existing clients/*.conf and /etc/wireguard/wg0.conf remain compatible.
Run aegis-vpn check after upgrading to verify config integrity.

Assets 2
Loading
0 Join discussion