Merge pull request #2 from drew2a/add-dns-forwarding

Add dns forwarding

wg-genconf.sh

@@ -21,7 +21,6 @@ Address = 10.0.0.1/24
 SaveConfig = true
 ListenPort = 51820
 PrivateKey = ${server_private_key}
-
 PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
 PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
 EOL
@@ -44,7 +43,7 @@ do
 PrivateKey = ${client_private_key}
 ListenPort = 51820
 Address = ${client_ip}
-DNS = 8.8.8.8
+DNS = 10.0.0.1
 
 [Peer]
 PublicKey = ${server_public_key}

wg-ububtu-server-up.sh

@@ -1,5 +1,4 @@
 #!/usr/bin/env bash
-
 # usage:
 #     wg-ubuntu-server-up.sh [<number_of_clients>]
 
@@ -8,15 +7,14 @@ clients_count=${1:-10}
 mkdir -p "$HOME/wireguard"
 mkdir -p "/etc/wireguard"
 
-echo --------------------------install linux headers and enable IPv4 forwarding
+echo ------------------------------------------------------install linux headers
 sudo apt install -y linux-headers-"$(uname -r)"
-sysctl net.ipv4.ip_forward=1
-echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-sysctl.conf
 
 echo ---------------------------------------------------------install wireguard
 sudo add-apt-repository -y ppa:wireguard/wireguard
-sudo apt update
+sudo apt update && sudo apt upgrade -y
 sudo apt install -y wireguard
+sudo modprobe wireguard
 
 echo ----------------------------------------------------------install qrencode
 sudo apt install -y qrencode
@@ -32,9 +30,93 @@ echo ----------------------generate configurations for "${clients_count}" client
 echo -----------------------------------move server\'s config to /etc/wireguard/
 mv -v ./wg0.conf \
       /etc/wireguard/
+chown -v root:root /etc/wireguard/wg0.conf
+chmod -v 600 /etc/wireguard/wg0.conf
 
 echo ------------------------------------------------------------- run wireguard
 wg-quick up wg0
 systemctl enable wg-quick@wg0
 
-wg show
+echo ------------------------------------------------------enable IPv4 forwarding
+sysctl net.ipv4.ip_forward=1
+echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-sysctl.conf
+
+echo ---------------------------------------------------configure firewall rules
+
+sudo iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+sudo iptables -A FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+sudo iptables -A INPUT -p udp -m udp --dport 55000 -m conntrack --ctstate NEW -j ACCEPT
+sudo iptables -A INPUT -s 10.0.0.0/24 -p tcp -m tcp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+sudo iptables -A INPUT -s 10.0.0.0/24 -p udp -m udp --dport 53 -m conntrack --ctstate NEW -j ACCEPT
+
+# make firewall changes persistent
+echo iptables-persistent iptables-persistent/autosave_v4 boolean true | sudo debconf-set-selections
+echo iptables-persistent iptables-persistent/autosave_v6 boolean true | sudo debconf-set-selections
+
+sudo apt install -y iptables-persistent
+
+sudo systemctl enable netfilter-persistent
+sudo netfilter-persistent save
+
+echo ---------------------------------------------install and configure unbound
+sudo apt install -y unbound unbound-host
+
+curl -o /var/lib/unbound/root.hints https://www.internic.net/domain/named.cache
+echo 'curl -o /var/lib/unbound/root.hints https://www.internic.net/domain/named.cache' > /etc/cron.monthly/curl_root_hints.sh
+chmod +x /etc/cron.monthly/curl_root_hints.sh
+
+
+cat > /etc/unbound/unbound.conf << ENDOFFILE
+server:
+    num-threads: 4
+    # enable logs
+    verbosity: 1
+    # list of root DNS servers
+    root-hints: "/var/lib/unbound/root.hints"
+    # use the root server's key for DNSSEC
+    auto-trust-anchor-file: "/var/lib/unbound/root.key"
+    # respond to DNS requests on all interfaces
+    interface: 0.0.0.0
+    max-udp-size: 3072
+    # IPs authorised to access the DNS Server
+    access-control: 0.0.0.0/0                 refuse
+    access-control: 127.0.0.1                 allow
+    access-control: 10.0.0.0/24             allow
+    # not allowed to be returned for public Internet  names
+    private-address: 10.0.0.0/24
+    #hide DNS Server info
+    hide-identity: yes
+    hide-version: yes
+    # limit DNS fraud and use DNSSEC
+    harden-glue: yes
+    harden-dnssec-stripped: yes
+    harden-referral-path: yes
+    # add an unwanted reply threshold to clean the cache and avoid, when possible, DNS poisoning
+    unwanted-reply-threshold: 10000000
+    # have the validator print validation failures to the log
+    val-log-level: 1
+    # minimum lifetime of cache entries in seconds
+    cache-min-ttl: 1800
+    # maximum lifetime of cached entries in seconds
+    cache-max-ttl: 14400
+    prefetch: yes
+    prefetch-key: yes
+ENDOFFILE
+
+# give root ownership of the Unbound config
+sudo chown -R unbound:unbound /var/lib/unbound
+
+# disable systemd-resolved
+sudo systemctl stop systemd-resolved
+sudo systemctl disable systemd-resolved
+
+# enable Unbound in place of systemd-resovled
+sudo systemctl enable unbound
+sudo systemctl start unbound
+
+# show wg
+wg show
+
+# reboot to make changes effective
+echo all done, reboot...
+reboot