WireGuard server with an embedded admin console

Go backend that drives kernel WireGuard over netlink (wireguard-go as the fallback), nftables NAT with MSS clamping, forwarding and buffer sysctls, SQLite for peers, users, sessions, traffic history and the audit log. React console: dashboard with live rates and usage history, peer management with QR codes and .conf downloads, disconnect, session reset, key rotation, expiry, client-supplied keys, settings, users with admin and viewer roles, two-factor authentication with recovery codes, audit log. Docker image on Alpine with compose files for bridged and host networking, CI and GHCR publish workflows, performance notes.
2026-09-12 19:56:08 -07:00
commit 6c006e1d4d
72 changed files with 11675 additions and 0 deletions
@@ -0,0 +1,53 @@
+package netcfg
+
+import (
+	"net/netip"
+	"strings"
+	"testing"
+)
+
+func TestRuleset(t *testing.T) {
+	r := Rules{
+		Iface:         "wg0",
+		Egress:        "eth0",
+		ListenPort:    51820,
+		Subnets:       []netip.Prefix{netip.MustParsePrefix("10.8.0.0/24"), netip.MustParsePrefix("fd42::/64")},
+		PeerIsolation: true,
+		ClampMSS:      true,
+	}
+	out := Ruleset(r)
+	for _, want := range []string{
+		"table inet wgx {",
+		"udp dport 51820 accept",
+		`iifname "wg0" oifname "wg0" drop`,
+		`tcp option maxseg size set rt mtu`,
+		`ip saddr 10.8.0.0/24 oifname "eth0" masquerade`,
+		`ip6 saddr fd42::/64 oifname "eth0" masquerade`,
+		`oifname "wg0" ct state related,established accept`,
+	} {
+		if !strings.Contains(out, want) {
+			t.Errorf("ruleset missing %q:\n%s", want, out)
+		}
+	}
+	// Without an egress, masquerade on anything that is not the tunnel.
+	r.Egress = ""
+	r.PeerIsolation = false
+	out = Ruleset(r)
+	if !strings.Contains(out, `oifname != "wg0" masquerade`) {
+		t.Errorf("expected wildcard masquerade:\n%s", out)
+	}
+	if strings.Contains(out, "peer isolation") {
+		t.Error("isolation rule present when off")
+	}
+}
+
+func TestWanted(t *testing.T) {
+	v4 := Wanted(false)
+	v6 := Wanted(true)
+	if len(v6) != len(v4)+1 {
+		t.Fatal("ipv6 forwarding not added")
+	}
+	if v4[0].Key != "net.ipv4.ip_forward" || !v4[0].Required {
+		t.Fatal("ip_forward must be first and required")
+	}
+}