refactor to support CIDR and legacy notation

for WG_DEFAULT_ADDRESS

README.md

@@ -90,8 +90,7 @@ These options can be configured by setting environment variables using `-e KEY="
 | `WG_PORT` | `51820` | `12345` | The public UDP port of your VPN server. WireGuard will always listen on 51820 inside the Docker container. |
 | `WG_MTU` | `null` | `1420` | The MTU the clients will use. Server uses default WG MTU. |
 | `WG_PERSISTENT_KEEPALIVE` | `0` | `25` | Value in seconds to keep the "connection" open. If this value is 0, then connections won't be kept alive. |
-| `WG_DEFAULT_ADDRESS` | `10.8.0.x` | `10.6.0.x` | Clients IP address range. |
+| `WG_DEFAULT_ADDRESS` | `10.8.0.1/24` | `10.6.0.x` | Clients IP address range. (For Legacy reasons x in last place is supported (e.g. 10.8.0.x)) |
-| `WG_DEFAULT_ADDRESS_RANGE` | `24` | `28` | CIDR notation block of range. Default equals `10.8.0.1/24` |
 | `WG_DEFAULT_DNS` | `1.1.1.1` | `8.8.8.8, 8.8.4.4` | DNS server clients will use. If set to blank value, clients will not use any DNS. |
 | `WG_ALLOWED_IPS` | `0.0.0.0/0, ::/0` | `192.168.15.0/24, 10.0.1.0/24` | Allowed IPs clients will use. |
 | `WG_PRE_UP` | `...` | - | See [config.js](https://github.com/wg-easy/wg-easy/blob/master/src/config.js#L19) for the default value. |

docker-compose.yml

@@ -15,8 +15,7 @@ services:
       # Optional:
       # - PASSWORD=foobar123
       # - WG_PORT=51820
-      # - WG_DEFAULT_ADDRESS=10.8.0.x
+      # - WG_DEFAULT_ADDRESS=10.8.0.1/24
-      # - WG_DEFAULT_ADDRESS_RANGE=24
       # - WG_DEFAULT_DNS=1.1.1.1
       # - WG_MTU=1420
       # - WG_ALLOWED_IPS=192.168.15.0/24, 10.0.1.0/24

src/config.js

@@ -4,6 +4,26 @@ const ip = require('ip');
 
 const { release } = require('./package.json');
 
+function parseDefaultAddress(defaultAddress) {
+  // Set the default full address with subnet if it's not provided
+  const defaultFullAddress = defaultAddress || '10.8.0.1/24';
+
+  // Check if the address ends with '.x', if so, replace with '.1/24'
+  const addressWithSubnet = defaultFullAddress.endsWith('.x')
+    ? defaultFullAddress.replace('.x', '.1/24')
+    : defaultFullAddress;
+
+  const [ipAddress, subnetRange] = addressWithSubnet.split('/');
+
+  return {
+    ipAddress,
+    subnetRange: subnetRange || '24', // Default subnet range to 24 if not provided
+  };
+}
+
+// Use the function to parse the environment variable or default to '10.8.0.1/24'
+const { ipAddress, subnetRange } = parseDefaultAddress(process.env.WG_DEFAULT_ADDRESS);
+
 module.exports.RELEASE = release;
 module.exports.PORT = process.env.PORT || 51821;
 module.exports.WEBUI_HOST = process.env.WEBUI_HOST || '0.0.0.0';
@@ -14,14 +34,14 @@ module.exports.WG_HOST = process.env.WG_HOST;
 module.exports.WG_PORT = process.env.WG_PORT || 51820;
 module.exports.WG_MTU = process.env.WG_MTU || null;
 module.exports.WG_PERSISTENT_KEEPALIVE = process.env.WG_PERSISTENT_KEEPALIVE || 0;
-module.exports.WG_DEFAULT_ADDRESS = process.env.WG_DEFAULT_ADDRESS || '10.8.0.x';
+module.exports.WG_DEFAULT_ADDRESS = ipAddress;
-module.exports.WG_DEFAULT_ADDRESS_RANGE = process.env.WG_DEFAULT_ADDRESS_RANGE || 24;
+module.exports.WG_DEFAULT_ADDRESS_RANGE = subnetRange;
 module.exports.WG_DEFAULT_DNS = typeof process.env.WG_DEFAULT_DNS === 'string'
   ? process.env.WG_DEFAULT_DNS
   : '1.1.1.1';
 module.exports.WG_ALLOWED_IPS = process.env.WG_ALLOWED_IPS || '0.0.0.0/0, ::/0';
 
-module.exports.WG_SUBNET = ip.subnet(module.exports.WG_DEFAULT_ADDRESS.replace('x', '1'), `255.255.255.${256 - 2 ** (32 - module.exports.WG_DEFAULT_ADDRESS_RANGE)}`);
+module.exports.WG_SUBNET = ip.subnet(module.exports.WG_DEFAULT_ADDRESS, `255.255.255.${256 - 2 ** (32 - module.exports.WG_DEFAULT_ADDRESS_RANGE)}`);
 module.exports.WG_SERVER_ADDRESS = module.exports.WG_SUBNET.firstAddress;
 module.exports.WG_CLIENT_FIRST_ADDRESS = ip.toLong(module.exports.WG_SERVER_ADDRESS) + 1;
 module.exports.WG_CLIENT_LAST_ADDRESS = ip.toLong(module.exports.WG_SUBNET.lastAddress) - 1; // Exclude the broadcast address

src/lib/Util.js

@@ -4,19 +4,6 @@ const childProcess = require('child_process');
 
 module.exports = class Util {
 
-  static isValidIPv4(str) {
-    const blocks = str.split('.');
-    if (blocks.length !== 4) return false;
-
-    for (let value of blocks) {
-      value = parseInt(value, 10);
-      if (Number.isNaN(value)) return false;
-      if (value < 0 || value > 255) return false;
-    }
-
-    return true;
-  }
-
   static promisify(fn) {
     // eslint-disable-next-line func-names
     return function(req, res) {

src/lib/WireGuard.js

@@ -73,7 +73,7 @@ module.exports = class WireGuard {
 
           throw err;
         });
-        // await Util.exec(`iptables -t nat -A POSTROUTING -s ${WG_DEFAULT_ADDRESS.replace('x', '0')}/24 -o ' + WG_DEVICE + ' -j MASQUERADE`);
+        // await Util.exec(`iptables -t nat -A POSTROUTING -s ${WG_SERVER_ADDRESS/${WG_DEFAULT_ADDRESS_RANGE} -o ' + WG_DEVICE + ' -j MASQUERADE`);
         // await Util.exec('iptables -A INPUT -p udp -m udp --dport 51820 -j ACCEPT');
         // await Util.exec('iptables -A FORWARD -i wg0 -j ACCEPT');
         // await Util.exec('iptables -A FORWARD -o wg0 -j ACCEPT');
@@ -315,7 +315,7 @@ Endpoint = ${WG_HOST}:${WG_PORT}`;
   async updateClientAddress({ clientId, address }) {
     const client = await this.getClient({ clientId });
 
-    if (!Util.isValidIPv4(address)) {
+    if (!ip.isV4Format(address)) {
       throw new ServerError(`Invalid Address: ${address}`, 400);
     }
 

wg-easy.service

@@ -5,8 +5,7 @@ After=network-online.target nss-lookup.target
 [Service]
 Environment="WG_HOST=raspberrypi.local" # Change this to your host's public address or static public ip.
 Environment="PASSWORD=REPLACEME" # When set, requires a password when logging in to the Web UI, to disable add a hashtag
-#Environment="WG_DEFAULT_ADDRESS=10.0.8.x" #Clients IP address range.
+#Environment="WG_DEFAULT_ADDRESS=10.0.8.1/24" #Clients IP address range.
-#Environment="WG_DEFAULT_ADDRESS_RANGE=24" #Clients IP address range block.
 #Environment="WG_DEFAULT_DNS=10.0.8.1, 1.1.1.1" #DNS server clients will use. If set to blank value, clients will not use any DNS.
 #Environment="WG_ALLOWED_IPS=0.0.0.0/0,::/0" #Allowed IPs clients will use.
 #Environment="WG_DEVICE=ens1" #Ethernet device the wireguard traffic should be forwarded through.