root/wireguard-admin
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Advanced networking: per-peer site subnets (site-to-site), per-peer client routes, peer isolation option, client setup guide

Browse Source 
Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
This commit is contained in:
lofyer
2026-07-04 08:21:17 +08:00
co-authored by factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>
parent d10e9fa346
commit 192960ad3e
12 changed files with 176 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
entrypoint.sh
+8
View File
@@ -7,6 +7,14 @@ OUT_IFACE="$(ip route show default | awk '/default/ {print $5; exit}')"
iptables -t nat -C POSTROUTING -s "$WG_SUBNET" -o "$OUT_IFACE" -j MASQUERADE 2>/dev/null \
|| iptables -t nat -A POSTROUTING -s "$WG_SUBNET" -o "$OUT_IFACE" -j MASQUERADE
# Peer isolation: block peer-to-peer traffic inside the wg subnet.
if [ "${WG_PEER_ISOLATION:-false}" = "true" ]; then
iptables -C FORWARD -i "$WG_INTERFACE" -o "$WG_INTERFACE" -j DROP 2>/dev/null \
|| iptables -I FORWARD 1 -i "$WG_INTERFACE" -o "$WG_INTERFACE" -j DROP
else
iptables -D FORWARD -i "$WG_INTERFACE" -o "$WG_INTERFACE" -j DROP 2>/dev/null || true
fi
iptables -C FORWARD -i "$WG_INTERFACE" -j ACCEPT 2>/dev/null \
|| iptables -A FORWARD -i "$WG_INTERFACE" -j ACCEPT
iptables -C FORWARD -o "$WG_INTERFACE" -j ACCEPT 2>/dev/null \