Skip to content

Commit 6b9010b

Browse files
author
nymers
committed
tunnel-manager: add support for IPv6 uplink detection
1 parent 0b58b6f commit 6b9010b

File tree

1 file changed

+38
-27
lines changed

1 file changed

+38
-27
lines changed

‎scripts/nym-node-setup/network-tunnel-manager.sh‎

Lines changed: 38 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,7 @@ detect_uplink_interface() {
103103

104104
# uplink device detection, can be overridden
105105
NETWORK_DEVICE="${NETWORK_DEVICE:-}"
106+
NETWORK_DEVICE_IPV6="${NETWORK_DEVICE_IPV6:-$NETWORK_DEVICE}"
106107
if [[ -z "$NETWORK_DEVICE" ]]; then
107108
NETWORK_DEVICE="$(detect_uplink_interface "ip -o route show default")"
108109
fi
@@ -113,6 +114,15 @@ if [[ -z "$NETWORK_DEVICE" ]]; then
113114
error "cannot determine uplink interface. set NETWORK_DEVICE or UPLINK_DEV"
114115
exit 1
115116
fi
117+
if [[ -z "$NETWORK_DEVICE_IPV6" ]]; then
118+
NETWORK_DEVICE_IPV6=$(detect_uplink_interface "ip -6 -o route show default")
119+
fi
120+
if [[ -z "$NETWORK_DEVICE_IPV6" ]]; then
121+
NETWORK_DEVICE_IPV6=$(detect_uplink_interface "ip -6 -o route show default table all")
122+
fi
123+
if [[ -z "$NETWORK_DEVICE_IPV6" ]]; then
124+
NETWORK_DEVICE_IPV6="$NETWORK_DEVICE"
125+
fi
116126

117127
###############################################################################
118128
# shared helpers
@@ -194,11 +204,11 @@ fetch_ipv6_address() {
194204

195205
fetch_and_display_ipv6() {
196206
local ipv6_address
197-
ipv6_address=$(ip -6 addr show "$NETWORK_DEVICE" scope global | awk '/inet6/ {print $2}')
207+
ipv6_address=$(ip -6 addr show "$NETWORK_DEVICE_IPV6" scope global | awk '/inet6/ {print $2}')
198208
if [[ -z "$ipv6_address" ]]; then
199-
error "no global ipv6 address found on $NETWORK_DEVICE"
209+
error "no global ipv6 address found on $NETWORK_DEVICE_IPV6"
200210
else
201-
ok "ipv6 address on $NETWORK_DEVICE: $ipv6_address"
211+
ok "ipv6 address on $NETWORK_DEVICE_IPV6: $ipv6_address"
202212
fi
203213
}
204214

@@ -343,7 +353,7 @@ remove_duplicate_rules() {
343353

344354
apply_iptables_rules() {
345355
local interface=$1
346-
info "applying iptables rules for $interface using uplink $NETWORK_DEVICE"
356+
info "applying iptables rules for $interface using uplink (v4:$NETWORK_DEVICE, v6:$NETWORK_DEVICE_IPV6)"
347357
sleep 1
348358

349359
# ipv4 nat and forwarding
@@ -357,14 +367,14 @@ apply_iptables_rules() {
357367
iptables -I FORWARD 2 -i "$NETWORK_DEVICE" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT
358368

359369
# ipv6 nat and forwarding
360-
ip6tables -t nat -C POSTROUTING -o "$NETWORK_DEVICE" -j MASQUERADE 2>/dev/null || \
361-
ip6tables -t nat -A POSTROUTING -o "$NETWORK_DEVICE" -j MASQUERADE
370+
ip6tables -t nat -C POSTROUTING -o "$NETWORK_DEVICE_IPV6" -j MASQUERADE 2>/dev/null || \
371+
ip6tables -t nat -A POSTROUTING -o "$NETWORK_DEVICE_IPV6" -j MASQUERADE
362372

363-
ip6tables -C FORWARD -i "$interface" -o "$NETWORK_DEVICE" -j ACCEPT 2>/dev/null || \
364-
ip6tables -I FORWARD 1 -i "$interface" -o "$NETWORK_DEVICE" -j ACCEPT
373+
ip6tables -C FORWARD -i "$interface" -o "$NETWORK_DEVICE_IPV6" -j ACCEPT 2>/dev/null || \
374+
ip6tables -I FORWARD 1 -i "$interface" -o "$NETWORK_DEVICE_IPV6" -j ACCEPT
365375

366-
ip6tables -C FORWARD -i "$NETWORK_DEVICE" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \
367-
ip6tables -I FORWARD 2 -i "$NETWORK_DEVICE" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT
376+
ip6tables -C FORWARD -i "$NETWORK_DEVICE_IPV6" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null || \
377+
ip6tables -I FORWARD 2 -i "$NETWORK_DEVICE_IPV6" -o "$interface" -m state --state RELATED,ESTABLISHED -j ACCEPT
368378

369379
save_iptables_rules
370380
}
@@ -543,19 +553,19 @@ create_nym_chain() {
543553
iptables -I FORWARD 1 -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j "$NYM_CHAIN"
544554
fi
545555

546-
if ! ip6tables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j "$NYM_CHAIN" 2>/dev/null; then
547-
ip6tables -I FORWARD 1 -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j "$NYM_CHAIN"
556+
if ! ip6tables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_IPV6" -j "$NYM_CHAIN" 2>/dev/null; then
557+
ip6tables -I FORWARD 1 -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_IPV6" -j "$NYM_CHAIN"
548558
fi
549559
}
550560

551561
setup_nat_rules() {
552-
info "setting up nat and forwarding rules for $WG_INTERFACE via $NETWORK_DEVICE"
562+
info "setting up nat and forwarding rules for $WG_INTERFACE via (v4:$NETWORK_DEVICE, v6:$NETWORK_DEVICE_IPV6)"
553563

554564
if ! iptables -t nat -C POSTROUTING -o "$NETWORK_DEVICE" -j MASQUERADE 2>/dev/null; then
555565
iptables -t nat -A POSTROUTING -o "$NETWORK_DEVICE" -j MASQUERADE
556566
fi
557-
if ! ip6tables -t nat -C POSTROUTING -o "$NETWORK_DEVICE" -j MASQUERADE 2>/dev/null; then
558-
ip6tables -t nat -A POSTROUTING -o "$NETWORK_DEVICE" -j MASQUERADE
567+
if ! ip6tables -t nat -C POSTROUTING -o "$NETWORK_DEVICE_IPV6" -j MASQUERADE 2>/dev/null; then
568+
ip6tables -t nat -A POSTROUTING -o "$NETWORK_DEVICE_IPV6" -j MASQUERADE
559569
fi
560570

561571
if ! iptables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j ACCEPT 2>/dev/null; then
@@ -565,11 +575,12 @@ setup_nat_rules() {
565575
iptables -I FORWARD 2 -i "$NETWORK_DEVICE" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT
566576
fi
567577

568-
if ! ip6tables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j ACCEPT 2>/dev/null; then
569-
ip6tables -I FORWARD 1 -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j ACCEPT
578+
if ! ip6tables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_IPV6" -j ACCEPT 2>/dev/null; then
579+
ip6tables -I FORWARD 1 -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_IPV6" -j ACCEPT
570580
fi
571-
if ! ip6tables -C FORWARD -i "$NETWORK_DEVICE" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; then
572-
ip6tables -I FORWARD 2 -i "$NETWORK_DEVICE" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT
581+
582+
if ! ip6tables -C FORWARD -i "$NETWORK_DEVICE_IPV6" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null; then
583+
ip6tables -I FORWARD 2 -i "$NETWORK_DEVICE_IPV6" -o "$WG_INTERFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT
573584
fi
574585
}
575586

@@ -772,16 +783,16 @@ clear_exit_policy_rules() {
772783
iptables -F "$NYM_CHAIN" 2>/dev/null || true
773784
ip6tables -F "$NYM_CHAIN" 2>/dev/null || true
774785

775-
iptables -D FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j "$NYM_CHAIN" 2>/dev/null || true
776-
ip6tables -D FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j "$NYM_CHAIN" 2>/dev/null || true
786+
iptables -D FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_" -j "$NYM_CHAIN" 2>/dev/null || true
787+
ip6tables -D FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_IPV6" -j "$NYM_CHAIN" 2>/dev/null || true
777788

778789
iptables -X "$NYM_CHAIN" 2>/dev/null || true
779790
ip6tables -X "$NYM_CHAIN" 2>/dev/null || true
780791
}
781792

782793
show_exit_policy_status() {
783794
info "nym exit policy status"
784-
info "network device: $NETWORK_DEVICE"
795+
info "network device: (v4:$NETWORK_DEVICE, v6:$NETWORK_DEVICE_IPV6)"
785796
info "wireguard interface: $WG_INTERFACE"
786797
echo
787798

@@ -1070,8 +1081,8 @@ test_forward_chain_hook() {
10701081
((failures++))
10711082
fi
10721083

1073-
if ip6tables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE" -j "$NYM_CHAIN" 2>/dev/null; then
1074-
ok "ipv6 forward hook ok: -i $WG_INTERFACE -o $NETWORK_DEVICE -> $NYM_CHAIN"
1084+
if ip6tables -C FORWARD -i "$WG_INTERFACE" -o "$NETWORK_DEVICE_IPV6" -j "$NYM_CHAIN" 2>/dev/null; then
1085+
ok "ipv6 forward hook ok: -i $WG_INTERFACE -o $NETWORK_DEVICE_IPV6 -> $NYM_CHAIN"
10751086
else
10761087
error "ipv6 forward hook missing or wrong"
10771088
((failures++))
@@ -1167,7 +1178,7 @@ nym_tunnel_setup() {
11671178
}
11681179

11691180
exit_policy_install() {
1170-
info "installing nym wireguard exit policy for ${WG_INTERFACE} via ${NETWORK_DEVICE}"
1181+
info "installing nym wireguard exit policy for ${WG_INTERFACE} via (v4:${NETWORK_DEVICE}, v6:${NETWORK_DEVICE_IPV6})"
11711182
exit_policy_install_deps
11721183
adjust_ip_forwarding
11731184
create_nym_chain
@@ -1309,7 +1320,7 @@ tunnel and nat helpers:
13091320
check_nym_wg_tun Inspect forward chain for ${WG_INTERFACE}
13101321
check_nymtun_iptables Inspect forward chain for ${TUNNEL_INTERFACE}
13111322
configure_dns_and_icmp_wg Allow ping and dns ports on this host
1312-
fetch_and_display_ipv6 Show ipv6 on uplink ${NETWORK_DEVICE}
1323+
fetch_and_display_ipv6 Show ipv6 on uplink ${NETWORK_DEVICE_IPV6}
13131324
fetch_ipv6_address_nym_tun Show global ipv6 address on ${TUNNEL_INTERFACE}
13141325
joke_through_the_mixnet Test via ${TUNNEL_INTERFACE} with joke
13151326
joke_through_wg_tunnel Test via ${WG_INTERFACE} with joke
@@ -1327,7 +1338,7 @@ exit policy manager:
13271338
13281339
environment overrides:
13291340
NETWORK_DEVICE Auto-detected uplink (e.g., eth0). Set manually if detection fails.
1330-
TUNNEL_INTERFACE Default: nymtun0. Requires root privileges (sudo) to manage.
1341+
NETWORK_DEVICE_IPV6 Auto-detected uplink for IPv6 (e.g., eth0). Defaults to NETWORK_DEVICE if not set.
13311342
WG_INTERFACE Default: nymwg - Must match your WireGuard interface name.
13321343
13331344
EOF

0 commit comments

Comments
 (0)