ec301d17d7f6d276b04938e1a4d95649353c4c9d
12
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Bernd StorathandGitHub
|
ec301d17d7 |
chore: Improve schema (#2676)
* improve * fix drizzle kit |
||
|
|
ac547bbf7c |
feat: oauth integration (#2659)
* feat: add Google OAuth login support (#2625) * 🔧 Add login via google * 🔧 Update code style and docs * Add fix for db migrate * 🔧 Update docker-compose * 🔧 Fix sqlite" * 🔧 Update docker-compose * ⚰️ Remove environments * 🔧 Fix: remove ensureGoogleIdColumn workaround from sqlite.ts * 🔧 Remove space * move oauth section * add openid client * wip make oauth more generic * properly allow multiple providers * fix type import * github login flow * adjust github logo with theme * move docs to own page * nullable password, prevent timing attack this prevents timing attacks by always checking hash even if there is none prevents using basic auth if 2fa is enabled * support generic oidc * add ability to set password for oidc users this allows oidc users to add password login cant be removed after * move password login route move password login route from /api/session to /api/auth/password align with oauth * unique index on oauth * link/unlink logic * improve docs * support allowed domains * support auto register * refactoring * disable pw auth * move 2fa to its own page * 2fa for oauth, rework 2fa system * fix design, fix link Closes #2650 * add auto launch * improve docs * improvements --------- Co-authored-by: Daniel Molenda <dm@fotc.com> |
||
|
|
47f81dd66a |
Feature/client firewall filtering (#2418)
* Add per-client firewall filtering Implement server-side firewall rules to restrict client network access, allowing administrators to enforce security policies that cannot be bypassed by clients modifying their local configuration. This feature addresses the limitation where "Allowed IPs" only controls client-side routing but doesn't prevent clients from accessing networks they shouldn't reach. The firewall rules are enforced on the server using iptables/ip6tables and provide true access control. Features: - Opt-in via "Enable Per-Client Firewall" toggle in admin interface - Per-client "Firewall Allowed IPs" field for granular control - Support for IPs, CIDRs, and port-based filtering - Protocol specification: TCP, UDP, or both (default) - IPv4 and IPv6 dual-stack support - Falls back to client's allowedIps when firewallIps is empty - Clean separation of routing (allowedIps) from security (firewallIps) Supported formats: - 10.10.0.3 (single IP) - 10.10.0.0/24 (CIDR range) - 192.168.1.5:443 (IP with port, both TCP+UDP) - 192.168.1.5:443/tcp (IP with specific protocol) - [2001:db8::1]:443 (IPv6 with port) Implementation: - New database columns: firewall_enabled (interfaces), firewall_ips (clients) - Migration 0003_add_firewall_filtering for schema updates - firewall.ts utility for iptables chain management (WG_CLIENTS chain) - Integration into WireGuard.ts for automatic rule application - UI components with conditional rendering based on firewall toggle Technical details: - Uses custom WG_CLIENTS iptables chain for isolation - Rebuild strategy: flush and recreate all rules on config save - Mutex protection via rebuildInProgress/rebuildQueued flags - Graceful cleanup when firewall is disabled - No new dependencies (uses existing is-ip, is-cidr packages) * added Comprehensive documentation in README and docs/ for firewall filtering * validate firewall IPs * check for iptables before enabling the firewall and inform the user if it is missing * updated firewall docs * fix imports * remove extra import * Document all allowed IP/cidr/port/proto combinations that are allowed and check on save * add note on firewall being experimental and how to opt a single client out of the firewall. * cleanup more imports * add tests * Fix firewall IPv6 validation and test expectations Updated validation to correctly handle plain and bracketed IPv6 addresses, and fixed test to expect string from schema instead of object. * added comments to firewall rules and updated tests * fix auto-import * fix typescript errors * recreate sql migrations and rebase * improve tests, typechecking, documentation * fix formatting, fix types * improve type * added note for including host's IP in client firewall * updated language to include cidr and protocol options * another language update * refer to docs for firewall allowed IPs --------- Co-authored-by: Bernd Storath <999999bst@gmail.com> |
||
|
|
a469ac6897 |
AmneziaWG 2.0: support for H1-H4 ranges (#2480)
* AmneziaWG 2.0: support for H1-H4 ranges ## Changes: ``` - [+] Added support for H1-H4 ranges - [!] Fixed interface fields order (H1-H4 goes before I1-I5) ``` ## Known issues: ``` - [!] no check for unique/overlap of H1-H4 values on settings apply: settings will be applied but wg interface will crash with "Invalid argument" error ``` * AmneziaWG 2.0: support for H1-H4 ranges ## Changes: ``` - [+] Added support for H1-H4 ranges - [!] Fixed interface fields order (H1-H4 goes before I1-I5) ``` ## Known issues: ``` - [!] no check for unique/overlap of H1-H4 values on settings apply: settings will be applied but wg interface will crash with "Invalid argument" error ``` * AmneziaWG 2.0: support for H1-H4 ranges ## Changes: ``` - [+] Added support for H1-H4 ranges - [!] Fixed interface fields order (H1-H4 goes before I1-I5) ``` ## Known issues: ``` - [!] no check for unique/overlap of H1-H4 values on settings apply: settings will be applied but wg interface will crash with "Invalid argument" error ``` * Update types.ts Lint fixes --------- Co-authored-by: CthulhuVRN <alexander@ptitsyn.info> |
||
|
|
6a282e6ab9 |
AmneziaWG 2.0 (#2226)
* feat!: awg * feat: add description to fields, add I5 * fix: awg i18n * fix: types * minor fixes * Remove TODO comment from types.ts Removed TODO comment for more validation. --------- Co-authored-by: Bernd Storath <999999bst@gmail.com> |
||
|
Bernd Storath
|
8c395ec275 | fix pre-release | ||
|
Bernd StorathandGitHub
|
e92ee0464e |
Feat: Server Endpoint (#1785)
* add server endpoint to client * be able to update endpoint over api |
||
|
Bernd StorathandGitHub
|
32b73b850a |
Feat: 2fa (#1783)
* preplan otp, better qrcode library * add 2fa as feature * add totp generation * working totp lifecycle * don't allow disabled user to log in not a security issue as permission handler would fail anyway * require 2fa on login if enabled * update packages * fix typo * remove console.logs |
||
|
Bernd StorathandGitHub
|
159a51cff4 |
Feat: Global config override (#1720)
* be able to change dns. implement global override * link donate to readme * implement global config for allowed ips * change translations, fix generation * improve docs |
||
|
Bernd StorathandGitHub
|
e5fb6ff3a6 |
Fix: OneTimeLinks (#1719)
* fix otls * one otl per client * revert some code * revert some more code, add comments * adjust migration |
||
|
|
fcb5049dab |
Add PreUp, PostUp, PreDown, PostDown for client (#1714)
* Fix create client popup background is not white * Fix no Add button when client Allowed Ips or Server Allowed Ips is empty * Add preUp preDown postUp postDown for client * Add description of hooks for client config * Move hooks's label text into 'hooks' in en.json --------- Co-authored-by: yanghuanglin <yanghuanglin@qq.com> Co-authored-by: Bernd Storath <999999bst@gmail.com> |
||
|
|
9b29d72991 |
Version 15.0.0-beta.1: Rewrite in Nuxt and Typescript, Move to UI (#1333)
* Add Nuxt, ESM, Typescript (#1244)
* wip: add nuxt
* basic implementation
* add changes from
|