diff --git a/README.md b/README.md index 4ae696eba..0abae3c9f 100644 --- a/README.md +++ b/README.md @@ -66,7 +66,8 @@ net/tayga -- Tayga NAT64 net/udpbroadcastrelay -- Control ubpbroadcastrelay processes net/upnp -- Universal Plug and Play Service net/vnstat -- Network traffic monitor -net/wireguard -- WireGuard VPN service +net/wireguard -- WireGuard VPN service kernel implementation +net/wireguard-go -- WireGuard VPN service Go implementation (pending removal) net/wol -- Wake on LAN Service net/zerotier -- Virtual Networks That Just Work net-mgmt/collectd -- Collect system and application performance metrics periodically diff --git a/net/wireguard-go/Makefile b/net/wireguard-go/Makefile new file mode 100644 index 000000000..4215a2f19 --- /dev/null +++ b/net/wireguard-go/Makefile @@ -0,0 +1,10 @@ +PLUGIN_NAME= wireguard-go +PLUGIN_VERSION= 1.13 +PLUGIN_REVISION= 7 +PLUGIN_COMMENT= WireGuard VPN service Go implementation +PLUGIN_CONFLICTS= wireguard +PLUGIN_OBSOLETE= yes +PLUGIN_DEPENDS= wireguard-go wireguard-tools +PLUGIN_MAINTAINER= m.muenz@gmail.com + +.include "../../Mk/plugins.mk" diff --git a/net/wireguard-go/pkg-descr b/net/wireguard-go/pkg-descr new file mode 100644 index 000000000..5d84964c9 --- /dev/null +++ b/net/wireguard-go/pkg-descr @@ -0,0 +1,78 @@ +WireGuard® is an extremely simple yet fast and modern VPN +that utilizes state-of-the-art cryptography. It aims to be +faster, simpler, leaner, and more useful than IPSec, while +avoiding the massive headache. It intends to be considerably +more performant than OpenVPN. WireGuard is designed as a +general purpose VPN for running on embedded interfaces and +super computers alike, fit for many different circumstances. +Initially released for the Linux kernel, it is now +cross-platform and widely deployable. It is currently under +heavy development, but already it might be regarded as the +most secure, easiest to use, and simplest VPN solution in +the industry. + +WWW: https://www.wireguard.com/ + +Changelog +--------- + +1.13 + +* Reworked widget and assorted cleanups (contributed by Patrik Kernstock) +* Improve widget public key overlapping (contributed by Victor Haggqvist) + +1.12 + +* Adjust validation for naming local instance and endpoints + +1.11 + +* Add script for renewal of Wireguard DNS-based entries for stale connections (#2956) +* Trim whitespace around new public and private keys in config (#2982) + +1.10 + +* Remove instance limit + +1.9 + +* Rename interface label in filter rules (#2577) + +1.8 + +* Empty port in Endpoint is allowed + +1.7 + +* Make tunnel address (wg interface address) optional + +1.6 + +* Move DNS setting to advanced +* Make listen port optional + +1.5 + +* Allow synchronization of config + +1.4 + +* Add IPv6 gateway support (contributed by Alexander Korinek) + +1.3 + +* Client/peer name validation to use HostnameField + +1.2 + +* Dashboard widget (contributed by D. Domig) + +1.1 + +* Allow adding interface route for PBR + +1.0 + +* Support for most features like S2S, Roadwarrior +* DNS, MTU, PSK +* Allow to disable setting routes for PBR diff --git a/net/wireguard-go/src/etc/inc/plugins.inc.d/wireguard.inc b/net/wireguard-go/src/etc/inc/plugins.inc.d/wireguard.inc new file mode 100644 index 000000000..cc1e49ee8 --- /dev/null +++ b/net/wireguard-go/src/etc/inc/plugins.inc.d/wireguard.inc @@ -0,0 +1,102 @@ + + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +function wireguard_enabled() +{ + $model = new \OPNsense\Wireguard\General(); + return (string)$model->enabled == '1'; +} + +function wireguard_services() +{ + $services = []; + + if (!wireguard_enabled()) { + return $services; + } + + $service = [ + 'description' => gettext('WireGuard VPN'), + 'configd' => [ + 'restart' => ['wireguard restart'], + 'start' => ['wireguard start'], + 'stop' => ['wireguard stop'], + ], + 'name' => 'wireguard-go', + ]; + + if (file_exists('/boot/modules/if_wg.ko') || file_exists('/boot/kernel/if_wg.ko')) { + $service['name'] = 'wireguard'; + $service['nocheck'] = true; + } + + $services[] = $service; + + return $services; +} + +function wireguard_interfaces() +{ + $interfaces = []; + + if (!wireguard_enabled()) { + return $interfaces; + } + + $interfaces['wireguard'] = [ + 'descr' => gettext('WireGuard (Group)'), + 'if' => 'wireguard', + 'virtual' => true, + 'enable' => true, + 'type' => 'group', + 'networks' => [], + ]; + + return $interfaces; +} + +function wireguard_xmlrpc_sync() +{ + $result = []; + + $result['id'] = 'wireguard'; + $result['section'] = 'OPNsense.wireguard'; + $result['description'] = gettext('WireGuard'); + $result['services'] = ['wireguard-go']; + + if (file_exists('/boot/modules/if_wg.ko') || file_exists('/boot/kernel/if_wg.ko')) { + $result['services'] = ['wireguard']; + } + + return [$result]; +} + +function wireguard_devices() +{ + return [['pattern' => '^wg', 'volatile' => true]]; +} diff --git a/net/wireguard-go/src/etc/rc.syshook.d/start/50-wireguard b/net/wireguard-go/src/etc/rc.syshook.d/start/50-wireguard new file mode 100755 index 000000000..78ab22804 --- /dev/null +++ b/net/wireguard-go/src/etc/rc.syshook.d/start/50-wireguard @@ -0,0 +1,4 @@ +#!/bin/sh + +# start again to fix problems with failed name resolution (no need to restart) +configctl -dq wireguard start diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ClientController.php b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ClientController.php new file mode 100644 index 000000000..ae7d84660 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ClientController.php @@ -0,0 +1,70 @@ + + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + * + */ + +namespace OPNsense\Wireguard\Api; + +use OPNsense\Base\ApiMutableModelControllerBase; + +class ClientController extends ApiMutableModelControllerBase +{ + protected static $internalModelName = 'client'; + protected static $internalModelClass = '\OPNsense\Wireguard\Client'; + + public function searchClientAction() + { + return $this->searchBase('clients.client', array("enabled", "name", "pubkey", "tunneladdress", "serveraddress", "serverport")); + } + + public function getClientAction($uuid = null) + { + $this->sessionClose(); + return $this->getBase('client', 'clients.client', $uuid); + } + + public function addClientAction() + { + return $this->addBase('client', 'clients.client'); + } + + public function delClientAction($uuid) + { + return $this->delBase('clients.client', $uuid); + } + + public function setClientAction($uuid) + { + return $this->setBase('client', 'clients.client', $uuid); + } + + public function toggleClientAction($uuid) + { + return $this->toggleBase('clients.client', $uuid); + } +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/GeneralController.php b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/GeneralController.php new file mode 100644 index 000000000..1aca5548d --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/GeneralController.php @@ -0,0 +1,138 @@ + + * Copyright (C) 2022 Patrik Kernstock + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + * + */ + +namespace OPNsense\Wireguard\Api; + +use OPNsense\Base\ApiMutableModelControllerBase; +use OPNsense\Core\Config; +use OPNsense\Core\Backend; + +class GeneralController extends ApiMutableModelControllerBase +{ + protected static $internalModelClass = '\OPNsense\Wireguard\General'; + protected static $internalModelName = 'general'; + + public function getStatusAction() + { + // get wireguard configuration + $config = Config::getInstance()->object(); + $config = $config->OPNsense->wireguard; + + // craft peers array + $peers = []; + $peers_uuid_pubkey = []; + // enabled, name, pubkey + foreach ($config->client->clients->client as $client) { + $peerUuid = (string)$client->attributes()['uuid']; + $peers_uuid_pubkey[$peerUuid] = (string) $client->pubkey; + $peers[$peerUuid] = [ + "name" => (string) $client->name, + "enabled" => (int) $client->enabled, + "publicKey" => (string) $client->pubkey, + ]; + } + + // prepare and initialize the server array + $status = []; + $peer_pubkey_reference = []; + foreach ($config->server->servers->server as $server) { + if ($server->enabled != "1") { + continue; + } + + // build basic server array + $interface = "wg" . $server->instance; + $status[$interface] = [ + "instance" => (int) $server->instance, + "interface" => (string) $interface, + "enabled" => (int) $server->enabled, + "name" => (string) $server->name, + "peers" => [], + ]; + + // parse and add peers with initial values to array + if (strlen($server->peers) > 0) { + // there is at least one peer defined + $serverPeers = explode(",", (string) $server->peers); + // iteriate over each peer uuid + foreach ($serverPeers as $peerUuid) { + // skipping removed peer that is still referenced in server + if (!isset($peers[$peerUuid])) { + continue; + } + // remember interface and pubkey <> peer-uuid reference for referencing handshake logic below + $peer_pubkey_reference[$interface][$peers_uuid_pubkey[$peerUuid]] = $peerUuid; + // merge peer info and initial values for handshake data + $status[$interface]["peers"][$peerUuid] = array_merge( + $peers[$peerUuid], + [ + "lastHandshake" => "0000-00-00 00:00:00+00:00", + ] + ); + } + } + } + + // Get latest handshakes by running CLI command locally + $data = (new Backend())->configdRun("wireguard showhandshake"); + + // parse and set handshake to status datastructure + $data = trim($data); + if (strlen($data) !== 0) { + $wgHandshakes = explode("\n", $data); + foreach ($wgHandshakes as $handshake) { + $item = explode("\t", trim($handshake)); + + // set interface name and publickey + $interface = trim($item[0]); + $pubkey = trim($item[1]); + + // calculate handshake time based on local timezone + $epoch = $item[2]; + if ($epoch > 0) { + $dt = new \DateTime("@$epoch"); + $dt->setTimezone(new \DateTimeZone(date_default_timezone_get())); + $latest = $dt->format("Y-m-d H:i:sP"); + + // set handshake + $peerUuid = $peer_pubkey_reference[$interface][$pubkey]; + if (!empty($peerUuid)) { + $status[$interface]["peers"][$peerUuid]["lastHandshake"] = $latest; + } + } + } + } + + return [ + "items" => $status + ]; + } +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServerController.php b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServerController.php new file mode 100644 index 000000000..5bf57767a --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServerController.php @@ -0,0 +1,108 @@ + + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +namespace OPNsense\Wireguard\Api; + +use OPNsense\Base\ApiMutableModelControllerBase; +use OPNsense\Core\Backend; + +class ServerController extends ApiMutableModelControllerBase +{ + protected static $internalModelName = 'server'; + protected static $internalModelClass = '\OPNsense\Wireguard\Server'; + + public function searchServerAction() + { + $search = $this->searchBase('servers.server', array("enabled", "instance", "peers", "name", "networks", "pubkey", "port", "tunneladdress")); + // prepend "wg" to all instance IDs to use as interface name + foreach ($search["rows"] as $key => $server) { + $search["rows"][$key]["interface"] = "wg" . $server["instance"]; + } + return $search; + } + + public function getServerAction($uuid = null) + { + $this->sessionClose(); + return $this->getBase('server', 'servers.server', $uuid); + } + + public function addServerAction($uuid = null) + { + if ($this->request->isPost() && $this->request->hasPost("server")) { + if ($uuid != null) { + $node = $this->getModel()->getNodeByReference('servers.server.' . $uuid); + } else { + $node = $this->getModel()->servers->server->Add(); + } + $node->setNodes($this->request->getPost("server")); + if (empty((string)$node->pubkey) && empty((string)$node->privkey)) { + // generate new keypair + $backend = new Backend(); + $keyspriv = $backend->configdpRun("wireguard genkey", 'private'); + $keyspub = $backend->configdpRun("wireguard genkey", 'public'); + $node->privkey = trim($keyspriv); + $node->pubkey = trim($keyspub); + } + return $this->validateAndSave($node, 'server'); + } + return array("result" => "failed"); + } + + public function delServerAction($uuid) + { + return $this->delBase('servers.server', $uuid); + } + + public function setServerAction($uuid = null) + { + if ($this->request->isPost() && $this->request->hasPost("server")) { + if ($uuid != null) { + $node = $this->getModel()->getNodeByReference('servers.server.' . $uuid); + } else { + $node = $this->getModel()->servers->server->Add(); + } + $node->setNodes($this->request->getPost("server")); + if (empty((string)$node->pubkey) && empty((string)$node->privkey)) { + // generate new keypair + $backend = new Backend(); + $keyspriv = $backend->configdpRun("wireguard genkey", 'private'); + $keyspub = $backend->configdpRun("wireguard genkey", 'public'); + $node->privkey = trim($keyspriv); + $node->pubkey = trim($keyspub); + } + return $this->validateAndSave($node, 'server'); + } + return array("result" => "failed"); + } + + public function toggleServerAction($uuid) + { + return $this->toggleBase('servers.server', $uuid); + } +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServiceController.php b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServiceController.php new file mode 100644 index 000000000..627911beb --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/Api/ServiceController.php @@ -0,0 +1,76 @@ + + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + */ + +namespace OPNsense\Wireguard\Api; + +use OPNsense\Base\ApiMutableServiceControllerBase; +use OPNsense\Core\Backend; +use OPNsense\Wireguard\General; + +/** + * Class ServiceController + * @package OPNsense\Wireguard + */ +class ServiceController extends ApiMutableServiceControllerBase +{ + protected static $internalServiceClass = '\OPNsense\Wireguard\General'; + protected static $internalServiceTemplate = 'OPNsense/Wireguard'; + protected static $internalServiceEnabled = 'enabled'; + protected static $internalServiceName = 'wireguard'; + + /** + * hook group interface registration on reconfigure + * @return bool + */ + protected function invokeInterfaceRegistration() + { + return true; + } + + /** + * show wireguard config + * @return array + */ + public function showconfAction() + { + $backend = new Backend(); + $response = $backend->configdRun("wireguard showconf"); + return array("response" => $response); + } + + /** + * show wireguard handshakes + * @return array + */ + public function showhandshakeAction() + { + $backend = new Backend(); + $response = $backend->configdRun("wireguard showhandshake"); + return array("response" => $response); + } +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/GeneralController.php b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/GeneralController.php new file mode 100644 index 000000000..404fce682 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/GeneralController.php @@ -0,0 +1,40 @@ + + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +namespace OPNsense\Wireguard; + +class GeneralController extends \OPNsense\Base\IndexController +{ + public function indexAction() + { + $this->view->generalForm = $this->getForm("general"); + $this->view->formDialogEditWireguardClient = $this->getForm("dialogEditWireguardClient"); + $this->view->formDialogEditWireguardServer = $this->getForm("dialogEditWireguardServer"); + $this->view->pick('OPNsense/Wireguard/general'); + } +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardClient.xml b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardClient.xml new file mode 100644 index 000000000..231e9c692 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardClient.xml @@ -0,0 +1,52 @@ +
+ + client.enabled + + checkbox + This will enable or disable the client config. + + + client.name + + text + Set the name for this instance. + + + client.pubkey + + text + Public key of this instance. + + + client.psk + + text + Shared secret (PSK) for this peer. You can generate a key using "wg genpsk" on a client with WireGuard installed. + + + client.tunneladdress + + + select_multiple + true + List of addresses allowed to pass trough the tunnel adapter. Please use CIDR notation like 10.0.0.1/24. + + + client.serveraddress + + text + Set public IP address the endpoint listens to. + + + client.serverport + + text + Set port the endpoint listens to. + + + client.keepalive + + text + Set persistent keepalive interval in seconds. + +
diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardServer.xml b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardServer.xml new file mode 100644 index 000000000..eff1f9504 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/dialogEditWireguardServer.xml @@ -0,0 +1,82 @@ +
+ + server.enabled + + checkbox + This will enable or disable the server config. + + + server.name + + text + Set the name for this instance. + + + server.instance + + info + This is the instance number to give the wg interface a unique name (wgX). + + + server.pubkey + + text + Public key of this instance. You can specify your own one, or a key will be generated after saving. + + + server.privkey + + text + Private key of this instance. You can specify your own one, or a key will be generated after saving. Please keep this key safe. + + + server.port + + text + Optionally set a fixed port for this instance to listen on. The standard port range starts at 51820. + + + server.mtu + + text + true + Set the interface MTU for this interface. Leaving empty uses the MTU from main interface which is fine for most setups. + + + server.dns + + select_multiple + + true + true + Set the interface specific DNS server. + + + server.tunneladdress + + + select_multiple + true + List of addresses to configure on the tunnel adapter. Please use CIDR notation like 10.0.0.1/24. + + + server.peers + + select_multiple + true + List of peers for this server. + + + server.disableroutes + + checkbox + This will prevent installing routes. Usually you only enable this to do own routing decisions via a local gateway and gateway rules. + + + server.gateway + + text + true + Set the gateway IP here when using Disable Routes feature. You also have to add this as a gateway in OPNsense. + +
diff --git a/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/general.xml b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/general.xml new file mode 100644 index 000000000..7a74ebf81 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/controllers/OPNsense/Wireguard/forms/general.xml @@ -0,0 +1,8 @@ +
+ + general.enabled + + checkbox + This will activate WireGuard and start all enabled instances. + +
diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/ACL/ACL.xml b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/ACL/ACL.xml new file mode 100644 index 000000000..21012db80 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/ACL/ACL.xml @@ -0,0 +1,9 @@ + + + VPN: Wireguard + + ui/wireguard/* + api/wireguard/* + + + diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.php b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.php new file mode 100644 index 000000000..b069a766d --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.php @@ -0,0 +1,31 @@ + + All rights reserved. + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +namespace OPNsense\Wireguard; + +use OPNsense\Base\BaseModel; + +class Client extends BaseModel +{ +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.xml b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.xml new file mode 100644 index 000000000..69527a433 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Client.xml @@ -0,0 +1,47 @@ + + //OPNsense/wireguard/client + Wireguard Client configuration + 0.0.7 + + + + + 1 + Y + + + + Y + /^([0-9a-zA-Z._\-]){1,64}$/u + Should be a string between 1 and 64 characters. Allowed characters are alphanumeric characters, dash and underscores. + + + Y + Should be a base64-encoded 32 byte string. + + + N + Should be a base64-encoded 32 byte string. + + + + , + Y + Y + + + N + + + N + + + 1 + 86400 + Please specify a value between 1 and 86400. + N + + + + + diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.php b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.php new file mode 100644 index 000000000..6caf9eaba --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.php @@ -0,0 +1,35 @@ + + All rights reserved. + + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +namespace OPNsense\Wireguard; + +use OPNsense\Base\BaseModel; + +class General extends BaseModel +{ +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.xml b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.xml new file mode 100644 index 000000000..432fd654c --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/General.xml @@ -0,0 +1,11 @@ + + //OPNsense/wireguard/general + WireGuard configuration + 0.0.1 + + + 0 + Y + + + diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Menu/Menu.xml b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Menu/Menu.xml new file mode 100644 index 000000000..a2934e1b0 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Menu/Menu.xml @@ -0,0 +1,5 @@ + + + + + diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.php b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.php new file mode 100644 index 000000000..8fccdd577 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.php @@ -0,0 +1,31 @@ + + All rights reserved. + Redistribution and use in source and binary forms, with or without + modification, are permitted provided that the following conditions are met: + 1. Redistributions of source code must retain the above copyright notice, + this list of conditions and the following disclaimer. + 2. Redistributions in binary form must reproduce the above copyright + notice, this list of conditions and the following disclaimer in the + documentation and/or other materials provided with the distribution. + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + POSSIBILITY OF SUCH DAMAGE. +*/ + +namespace OPNsense\Wireguard; + +use OPNsense\Base\BaseModel; + +class Server extends BaseModel +{ +} diff --git a/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.xml b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.xml new file mode 100644 index 000000000..476091d23 --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/models/OPNsense/Wireguard/Server.xml @@ -0,0 +1,77 @@ + + //OPNsense/wireguard/server + Wireguard Server configuration + 0.0.4 + + + + + 1 + Y + + + + Y + /^([0-9a-zA-Z._\-]){1,64}$/u + Should be a string between 1 and 64 characters. Allowed characters are alphanumeric characters, dash and underscores. + + + Y + + + N + + + N + + + N + + + 1 + 9300 + N + + + N + /^([a-fA-F0-9\.:\[\]]*?,)*([a-fA-F0-9\.:\[\]]*)$/ + Please use valid IPv4 or IPv6 addresses. + + + + , + N + Y + + + 0 + Y + + + You have to enable Disable Routes option. + DependConstraint + + gateway + + + + + + N + + + + + + Y + N + Choose an Peer. + + + + + diff --git a/net/wireguard-go/src/opnsense/mvc/app/views/OPNsense/Wireguard/general.volt b/net/wireguard-go/src/opnsense/mvc/app/views/OPNsense/Wireguard/general.volt new file mode 100644 index 000000000..8b0accd2d --- /dev/null +++ b/net/wireguard-go/src/opnsense/mvc/app/views/OPNsense/Wireguard/general.volt @@ -0,0 +1,199 @@ +{# + # OPNsense (c) 2014-2018 by Deciso B.V. + # OPNsense (c) 2018 Michael Muenz + # All rights reserved. + # + # Redistribution and use in source and binary forms, with or without modification, + # are permitted provided that the following conditions are met: + # + # 1. Redistributions of source code must retain the above copyright notice, + # this list of conditions and the following disclaimer. + # + # 2. Redistributions in binary form must reproduce the above copyright notice, + # this list of conditions and the following disclaimer in the documentation + # and/or other materials provided with the distribution. + # + # THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + # INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + # AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + # AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + # OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + # SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + # INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + # CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + # ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + # POSSIBILITY OF SUCH DAMAGE. + #} + + + + +
+
+
+ {{ partial("layout_partials/base_form",['fields':generalForm,'id':'frm_general_settings'])}} +
+
+ +
+
+
+
+ + + + + + + + + + + + + + + + + + + + +
{{ lang._('Enabled') }}{{ lang._('Name') }}{{ lang._('Endpoint Address') }}{{ lang._('Endpoint Port') }}{{ lang._('Allowed IPs') }}{{ lang._('ID') }}{{ lang._('Commands') }}
+ +
+
+
+ +

+
+
+
+ + + + + + + + + + + + + + + + + + + + + +
{{ lang._('Enabled') }}{{ lang._('Name') }}{{ lang._('Interface') }}{{ lang._('Tunnel Address') }}{{ lang._('Port') }}{{ lang._('Endpoints') }}{{ lang._('ID') }}{{ lang._('Commands') }}
+ +
+
+
+ +

+
+
+
+ 

+    

+    

+      

+    

+

+
+{{ partial("layout_partials/base_dialog",['fields':formDialogEditWireguardClient,'id':'dialogEditWireguardClient','label':lang._('Edit Endpoint')])}}
+{{ partial("layout_partials/base_dialog",['fields':formDialogEditWireguardServer,'id':'dialogEditWireguardServer','label':lang._('Edit Local Configuration')])}}
+
+
diff --git a/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/genkey.sh b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/genkey.sh
new file mode 100755
index 000000000..b580bf49d
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/genkey.sh
@@ -0,0 +1,55 @@
+#!/bin/sh
+
+# Copyright (c) 2018 Michael Muenz 
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+#
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+# ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+# FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+# DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+# OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+# HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+# LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+# OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+# SUCH DAMAGE.
+
+TMPDIR="/tmp"
+GENPRIV="/usr/local/bin/wg genkey"
+GENPUB="/usr/local/bin/wg pubkey"
+
+cleanup() {
+	# Delete old files
+	rm -f $TMPDIR/wireguard.*
+}
+
+private() {
+	# Generate a private key and put it to /tmp
+	umask 077 && ${GENPRIV} | tee ${TMPDIR}/wireguard.priv
+}
+
+public() {
+	# Generate a public key and put it to /tmp
+	${GENPUB} < ${TMPDIR}/wireguard.priv | tee ${TMPDIR}/wireguard.pub
+}
+
+case "$1" in
+private)
+	cleanup
+	private
+	;;
+public)
+	public
+	;;
+esac
diff --git a/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/post.sh b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/post.sh
new file mode 100755
index 000000000..375ca3835
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/post.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+if [ -f /etc/rc.conf.d/wireguard ]; then
+	. /etc/rc.conf.d/wireguard
+fi
+
+for interface in ${wireguard_interfaces}; do
+	ifconfig ${interface} group wireguard
+done
+
+/usr/local/etc/rc.routing_configure
diff --git a/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/resolve-dns.bash b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/resolve-dns.bash
new file mode 100755
index 000000000..b7faf881a
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/resolve-dns.bash
@@ -0,0 +1,45 @@
+#!/usr/local/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright (C) 2015-2020 Jason A. Donenfeld . All Rights Reserved.
+
+set -e
+shopt -s nocasematch
+shopt -s extglob
+export LC_ALL=C
+
+for CONFIG_FILE in /usr/local/etc/wireguard/*.conf; do
+
+    [[ $CONFIG_FILE =~ /?([a-zA-Z0-9_=+.-]{1,15})\.conf$ ]]
+    INTERFACE="${BASH_REMATCH[1]}"
+
+    process_peer() {
+        [[ $PEER_SECTION -ne 1 || -z $PUBLIC_KEY || -z $ENDPOINT ]] && return 0
+        [[ $(wg show "$INTERFACE" latest-handshakes) =~ ${PUBLIC_KEY//+/\\+}\	([0-9]+) ]] || return 0
+        (( ($EPOCHSECONDS - ${BASH_REMATCH[1]}) > 135 )) || return 0
+        wg set "$INTERFACE" peer "$PUBLIC_KEY" endpoint "$ENDPOINT"
+        reset_peer_section
+    }
+
+    reset_peer_section() {
+        PEER_SECTION=0
+        PUBLIC_KEY=""
+        ENDPOINT=""
+    }
+
+    reset_peer_section
+    while read -r line || [[ -n $line ]]; do
+        stripped="${line%%\#*}"
+        key="${stripped%%=*}"; key="${key##*([[:space:]])}"; key="${key%%*([[:space:]])}"
+        value="${stripped#*=}"; value="${value##*([[:space:]])}"; value="${value%%*([[:space:]])}"
+        [[ $key == "["* ]] && { process_peer; reset_peer_section; }
+        [[ $key == "[Peer]" ]] && PEER_SECTION=1
+        if [[ $PEER_SECTION -eq 1 ]]; then
+            case "$key" in
+                PublicKey) PUBLIC_KEY="$value"; continue ;;
+                Endpoint) ENDPOINT="$value"; continue ;;
+            esac
+        fi
+    done < "$CONFIG_FILE"
+    process_peer
+done
diff --git a/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/setup.sh b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/setup.sh
new file mode 100755
index 000000000..75ba580c9
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/scripts/OPNsense/Wireguard/setup.sh
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+mkdir -p /var/run/wireguard
+chmod 755 /var/run/wireguard
diff --git a/net/wireguard-go/src/opnsense/service/conf/actions.d/actions_wireguard.conf b/net/wireguard-go/src/opnsense/service/conf/actions.d/actions_wireguard.conf
new file mode 100644
index 000000000..b2b96828f
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/service/conf/actions.d/actions_wireguard.conf
@@ -0,0 +1,43 @@
+[start]
+command:/usr/local/etc/rc.d/wireguard start; /usr/local/opnsense/scripts/OPNsense/Wireguard/post.sh
+parameters:
+type:script
+message:Starting WireGuard
+
+[stop]
+command:/usr/local/etc/rc.d/wireguard stop
+parameters:
+type:script
+message:Stopping WireGuard
+
+[restart]
+command:/usr/local/etc/rc.d/wireguard restart; /usr/local/opnsense/scripts/OPNsense/Wireguard/post.sh
+parameters:
+type:script
+message:Restarting WireGuard
+description: Restart WireGuard
+
+[renew]
+command:/usr/local/opnsense/scripts/OPNsense/Wireguard/resolve-dns.bash
+parameters:
+type:script
+message:Renew DNS for WireGuard
+description:Renew DNS for WireGuard on stale connections
+
+[genkey]
+command:/usr/local/opnsense/scripts/OPNsense/Wireguard/genkey.sh
+parameters: %s
+type:script_output
+message:Generating WireGuard keys
+
+[showconf]
+command:/usr/local/bin/wg show all
+parameters:
+type:script_output
+message:Show WireGuard config
+
+[showhandshake]
+command:/usr/local/bin/wg show all latest-handshakes
+parameters:
+type:script_output
+message:Show WireGuard handshakes
diff --git a/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/+TARGETS b/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/+TARGETS
new file mode 100644
index 000000000..655def7d1
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/+TARGETS
@@ -0,0 +1,2 @@
+wireguard:/etc/rc.conf.d/wireguard
+wireguard-server.conf:/usr/local/etc/wireguard/wg[OPNsense.wireguard.server.servers.server.%.instance].conf
diff --git a/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard b/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard
new file mode 100644
index 000000000..c4c12667a
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard
@@ -0,0 +1,15 @@
+{% if helpers.exists('OPNsense.wireguard.general.enabled') and OPNsense.wireguard.general.enabled == '1' %}
+wireguard_setup="/usr/local/opnsense/scripts/OPNsense/Wireguard/setup.sh"
+wireguard_enable="YES"
+{%   if helpers.exists('OPNsense.wireguard.server.servers.server') %}
+{%   set activeservers=[] %}
+{%     for servers in helpers.toList('OPNsense.wireguard.server.servers.server') %}
+{%       if servers.enabled == '1' %}
+{%       do activeservers.append("wg" + servers.instance) %}
+{%       endif %}
+{%     endfor %}
+{%   endif %}
+wireguard_interfaces="{{ activeservers | join(' ') }}"
+{% else %}
+wireguard_enable="NO"
+{% endif %}
diff --git a/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard-server.conf b/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard-server.conf
new file mode 100644
index 000000000..355ea0815
--- /dev/null
+++ b/net/wireguard-go/src/opnsense/service/templates/OPNsense/Wireguard/wireguard-server.conf
@@ -0,0 +1,53 @@
+{% if helpers.exists('OPNsense.wireguard.general.enabled') and OPNsense.wireguard.general.enabled == '1' %}
+{% if helpers.exists('OPNsense.wireguard.server.servers.server') %}
+{%   for server_list in helpers.toList('OPNsense.wireguard.server.servers.server') %}
+{%     if TARGET_FILTERS['OPNsense.wireguard.server.servers.server.' ~ loop.index0] or TARGET_FILTERS['OPNsense.wireguard.server.servers.server'] %}
+{%       if server_list.enabled == '1' %}
+[Interface]
+PrivateKey = {{ server_list.privkey }}
+{%         if server_list.tunneladdress|default('') != '' %}
+Address = {{ server_list.tunneladdress }}
+{%         endif %}
+{%         if server_list.port|default('') != '' %}
+ListenPort = {{ server_list.port }}
+{%         endif %}
+{%         if server_list.dns|default('') != '' %}
+DNS = {{ server_list.dns }}
+{%         endif %}
+{%         if server_list.mtu|default('') != '' %}
+MTU = {{ server_list.mtu }}
+{%         endif %}
+{%         if server_list.disableroutes == '1' %}
+Table = off
+{%         endif %}
+{%         if server_list.disableroutes == '1' and server_list.gateway|default('') != '' %}
+PostUp = route {{- ' -6' if ':' in server_list.gateway }} add {{ server_list.gateway }} -iface %i
+PostDown = route {{- ' -6' if ':' in server_list.gateway }} del {{ server_list.gateway }} -iface %i
+{%         endif %}
+{%         if server_list.peers|default('') != '' %}
+{%           for peerlist in server_list.peers.split(",") %}
+{%             set peerlist2_data = helpers.getUUID(peerlist) %}
+{%             if peerlist2_data != {} and peerlist2_data.enabled == '1' %}
+
+[Peer]
+# friendly_name = {{ peerlist2_data.name }}
+PublicKey = {{ peerlist2_data.pubkey }}
+{%               if peerlist2_data.psk|default('') != '' %}
+PresharedKey = {{ peerlist2_data.psk }}
+{%               endif %}
+{%               if peerlist2_data.serveraddress|default('') != '' %}
+Endpoint = {{ peerlist2_data.serveraddress }}{% if peerlist2_data.serverport|default('') != '' %}:{{ peerlist2_data.serverport }}{% else %}:51820{% endif %}
+{%               endif %}
+
+AllowedIPs = {{ peerlist2_data.tunneladdress }}
+{%               if peerlist2_data.keepalive|default('') != '' %}
+PersistentKeepalive = {{ peerlist2_data.keepalive }}
+{%               endif %}
+{%             endif %}
+{%           endfor %}
+{%         endif %}
+{%       endif %}
+{%     endif %}
+{%   endfor %}
+{% endif %}
+{% endif %}
diff --git a/net/wireguard-go/src/www/widgets/include/wireguard.inc b/net/wireguard-go/src/www/widgets/include/wireguard.inc
new file mode 100644
index 000000000..b95fc1fa6
--- /dev/null
+++ b/net/wireguard-go/src/www/widgets/include/wireguard.inc
@@ -0,0 +1,4 @@
+
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright notice,
+ *    this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+require_once("guiconfig.inc");
+require_once("widgets/include/wireguard.inc");
+
+$enabled = ($config["OPNsense"]["wireguard"]["general"]["enabled"] === "1" ? true : false);
+
+?>
+
+
+    
+        
+            
+            
+            
+            
+            
+        
+    
+    
+
+    
+    
+        
+    
+    
+
+    
+

+
+
diff --git a/net/wireguard/Makefile b/net/wireguard/Makefile
index 72c6bf897..9d7d9cf08 100644
--- a/net/wireguard/Makefile
+++ b/net/wireguard/Makefile
@@ -1,15 +1,9 @@
 PLUGIN_NAME=		wireguard
 PLUGIN_VERSION=		1.13
 PLUGIN_REVISION=	7
-PLUGIN_COMMENT=		WireGuard VPN service
-PLUGIN_DEPENDS=		wireguard-tools
+PLUGIN_COMMENT=		WireGuard VPN service kernel implementation
+PLUGIN_DEPENDS=		wireguard-kmod wireguard-tools
+PLUGIN_CONFLICTS=	wireguard-go
 PLUGIN_MAINTAINER=	m.muenz@gmail.com
-PLUGIN_VARIANTS=	kmod go
-
-kmod_NAME=		wireguard
-kmod_DEPENDS=		wireguard-kmod
-
-go_NAME=		wireguard-go
-go_DEPENDS=		wireguard-go
 
 .include "../../Mk/plugins.mk"