#!/bin/bash

# Be sure to allow port 51280 ingress
# Working on Ubuntu 20.04
# You need to press enter after the script pauses
# my bash is weak

set -e

sudo apt update
sudo apt install -y linux-headers-$(uname -r)
sudo apt install -y wireguard wireguard-dkms wireguard-tools

sudo sysctl -w net.ipv4.ip_forward=1
#sudo sysctl -w net.ipv4.conf.all.src_valid_mark=1

serverPrivateKey=$(wg genkey)
serverPublicKey=$(echo ${serverPrivateKey} | wg pubkey)
psk=$(wg genpsk)
clientPrivateKey=$(wg genkey)
clientPublicKey=$(echo ${clientPrivateKey} | wg pubkey)

cat | sudo tee /etc/wireguard/wg0.conf > /dev/null << EOF
# Server
[Interface]
PrivateKey = ${serverPrivateKey}
Address = 10.8.0.1/24
ListenPort = 51820

PostUp   = iptables -I FORWARD -i %i -j ACCEPT; iptables -I FORWARD -o %i -j ACCEPT; iptables -t nat -I POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

# Client: ${clientname} (${clientId})
[Peer]
PublicKey = ${clientPublicKey}
PresharedKey = ${psk}
AllowedIPs = 10.8.0.2/32

EOF



wg-quick up wg0



cat << EOF
# Client
[Interface]
PrivateKey = ${clientPrivateKey}
Address = 10.8.0.2/24

[Peer]
PublicKey = ${serverPublicKey}
PresharedKey = ${psk}
AllowedIPs = 0.0.0.0/0, ::0
Endpoint = $(curl icanhazip.com):51820

EOF