wg_client

#!/bin/sh
    # shellcheck disable=SC2039,SC2155,SC2124,SC2046
VERSION="v4.17.9"
#============================================================================================ © 2021-2022 Martineau v4.17.9
#

# Maintainer: Martineau
# Last Updated Date: 01-Jul-2022
#
# Description:
#
# Acknowledgement:
#
# Contributors: odkrys,ZebMcKayhan,Torson,The Chief,archiel

Parse() {
    #
    #   Parse       "Word1,Word2|Word3" ",|" VAR1 VAR2 REST
    #               (Effectivley executes VAR1="Word1";VAR2="Word2";REST="Word3")

    local TEXT IFS

    TEXT="$1"
    IFS="$2"
    shift 2
    read -r -- "$@" <<EOF
$TEXT
EOF
}
# shellcheck disable=SC2034,SC2120
ANSIColours() {

    local ACTION=$1

    cRESET=
    aBOLD=;aDIM=;aUNDER=;aBLINK=;aREVERSE=
    aBOLDr=;aDIMr=;aUNDERr=;aBLINKr=;aREVERSEr=

    cBLA=;cRED=;cGRE=;cYEL=;cBLU=;cMAG=;cCYA=;cGRA=;cFGRESET=
    cBGRA=;cBRED=;cBGRE=;cBYEL=;cBBLU=;cBMAG=;cBCYA=;cBWHT=
    cWRED=;cWGRE=;cWYEL=;cWBLU=;cWMAG=;cWCYA=;cWGRA=
    cYBLU=
    cRED_=;cGRE_=

    if [ "$ACTION" != "disable" ];then
        cRESET="\e[0m";
        aBOLD="\e[1m";aDIM="\e[2m";aUNDER="\e[4m";aBLINK="\e[5m";aREVERSE="\e[7m"
        aBOLDr="\e[21m";aDIMr="\e[22m";aUNDERr="\e[24m";aBLINKr="\e[25m";aREVERSEr="\e[27m"
        cBLA="\e[30m";cRED="\e[31m";cGRE="\e[32m";cYEL="\e[33m";cBLU="\e[34m";cMAG="\e[35m";cCYA="\e[36m";cGRA="\e[37m";cFGRESET="\e[39m"
        cBGRA="\e[90m";cBRED="\e[91m";cBGRE="\e[92m";cBYEL="\e[93m";cBBLU="\e[94m";cBMAG="\e[95m";cBCYA="\e[96m";cBWHT="\e[97m"
        aBOLD="\e[1m";aDIM="\e[2m";aUNDER="\e[4m";aBLINK="\e[5m";aREVERSE="\e[7m"

        cWRED="\e[41m";cWGRE="\e[42m";cWYEL="\e[43m";cWBLU="\e[44m";cWMAG="\e[45m";cWCYA="\e[46m";cWGRA="\e[47m"
        cYBLU="\e[93;48;5;21m"
        cRED_="\e[41m";cGRE_="\e[42m"
    fi

    xHOME="\e[H";xERASE="\e[2J";xERASEDOWN="\e[J";xERASEUP="\e[1J";xCSRPOS="\e[s";xPOSCSR="\e[u";xERASEEOL="\e[K";xQUERYCSRPOS="\e[6n"
    xGoto="\e[Line;Columnf"
}
Is_HND() {
    # Use the following at the command line otherwise 'return X' makes the SSH session terminate!
    #[ -n "$(/bin/uname -m | grep "aarch64")" ] && echo Y || echo N
    [ -n "$(/bin/uname -m | grep "aarch64")" ] && { echo Y; return 0; } || { echo N; return 1; }     # v4.14.6
}
Is_AX() {
    # Kernel is '4.1.52+' (i.e. isn't '2.6.36*') and it isn't HND
    # Use the following at the command line otherwise 'return X' makes the SSH session terminate!
    # [ -n "(/bin/uname -r | grep "^4")" ] && [ -z "$(/bin/uname -m | grep "aarch64")" ] && echo Y || echo N
    [ -n "$(/bin/uname -r | grep "^4")" ] && [ -z "$(/bin/uname -m | grep "aarch64")" ] && { echo Y; return 0; } || { echo N; return 1; }     # v4.14.6
}
Is_IPv4 () {
        grep -oE '^([0-9]{1,3}\.){3}[0-9]{1,3}$'                    # IPv4 format
}
Is_IPv4_CIDR () {
        grep -oE '^([0-9]{1,3}\.){3}[0-9]{1,3}/(3[012]|[12]?[0-9])$'    # IPv4 CIDR range notation
}
Is_IPv6() {
    # Note this matches compression anywhere in the address, though it won't match the loopback address ::1
    grep -oE '([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}'       # IPv6 format -very crude
}
Get_WAN_IF_Name() {

    # echo $([ -n "$(nvram get wan0_pppoe_ifname)" ] && echo $(nvram get wan0_pppoe_ifname) || echo $(nvram get wan0_ifname))
    #   nvram get wan0_gw_ifname
    #   nvram get wan0_proto

    local IF_NAME=$(ip route | awk '/^default/{print $NF}')     # Should ALWAYS be 100% reliable ?

    local IF_NAME=$(nvram get wan0_ifname)                      # ...but use the NVRAM e.g. DHCP/Static ?

    # Usually this is probably valid for both eth0/ppp0e ?
    if [ "$(nvram get wan0_gw_ifname)" != "$IF_NAME" ];then
        local IF_NAME=$(nvram get wan0_gw_ifname)
    fi

    if [ ! -z "$(nvram get wan0_pppoe_ifname)" ];then
        local IF_NAME="$(nvram get wan0_pppoe_ifname)"          # PPPoE
    fi

    echo $IF_NAME

}
Firewall_delete() {

    iptables -t mangle -D FORWARD -o $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'client'" 2>/dev/null
    iptables -t mangle -D FORWARD -i $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'client'" 2>/dev/null
    iptables -t mangle -D FORWARD -o $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'client'" 2>/dev/null
    iptables -t mangle -D PREROUTING -i $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'client'" 2>/dev/null

    ip6tables -t filter -D FORWARD -i br0 -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'client'" 2>/dev/null    # v4.14.6 @ZebMcKayhan

    #if [ $FIRMWARE -ge 38601 ];then         # Guest #1 SSID VLANs SNB @ZebMcKayhan
            iptables -t filter -D FORWARD -i br1 -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard Guest_VLAN" 2>/dev/null
            iptables -t filter -D FORWARD -i br2 -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard Guest_VLAN" 2>/dev/null
            iptables -t nat -D POSTROUTING -s $(nvram get lan_ipaddr)/16 -o $VPN_ID -j MASQUERADE -m comment --comment "WireGuard 'client'" 2>/dev/null
            iptables -t nat -D PREROUTING -s $(nvram get lan_ipaddr)/16 -o $VPN_ID -j MASQUERADE -m comment --comment "WireGuard 'client'" 2>/dev/null
    #else
            iptables -t nat -D POSTROUTING -s $(nvram get lan_ipaddr)/24 -o $VPN_ID -j MASQUERADE -m comment --comment "WireGuard 'client'" 2>/dev/null
    #fi

    iptables -t nat -D PREROUTING -p tcp -m tcp --dport 53 -j WGDNS${VPN_NUM} -m comment --comment "WireGuard 'client${VPN_NUM} DNS'" 2>/dev/null
    iptables -t nat -D PREROUTING -p udp -m udp --dport 53 -j WGDNS${VPN_NUM} -m comment --comment "WireGuard 'client${VPN_NUM} DNS'" 2>/dev/null
    iptables -t nat -F WGDNS${VPN_NUM}  2>/dev/null         # v4.14.8 @ZebMcKayhan
    iptables -t nat -X WGDNS${VPN_NUM}  2>/dev/null         # v4.14.8 @ZebMcKayhan

    if [ "$USE_IPV6" == "Y" ];then       # v4.08
        ip6tables -t mangle -D FORWARD -o $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'client'" 2>/dev/null
        ip6tables -t mangle -D FORWARD -i $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'client'" 2>/dev/null
        ip6tables -t mangle -D FORWARD -o $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'client'" 2>/dev/null
        ip6tables -D FORWARD -i br0 -o $VPN_ID -j ACCEPT -m comment --comment "LAN to WireGuard 'client'" 2>/dev/null       # v4.14.10
        ip6tables -t mangle -D PREROUTING -i $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'client'" 2>/dev/null

        ip6tables -t filter -D FORWARD -i br0 -o $VPN_ID -j ACCEPT -m comment --comment "LAN to WireGuard 'client'" 2>/dev/null # v4.14.6 @ZebMcKayhan

    #if [ $FIRMWARE -ge 38601 ];then         # Guest #1 SSID VLANs SNB @ZebMcKayhan
            ip6tables -t filter -D FORWARD -i br1 -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard Guest_VLAN" 2>/dev/null
            ip6tables -t filter -D FORWARD -i br2 -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard Guest_VLAN" 2>/dev/null
            [ -n "$(nvram get ipv6_rtr_addr)" ] && ip6tables -t nat -D PREROUTING -s $(nvram get ipv6_rtr_addr)/64 -o $VPN_ID -j MASQUERADE -m comment --comment "WireGuard 'client'" 2>/dev/null
    #else
            [ -n "$(nvram get ipv6_rtr_addr)" ] && ip6tables -t nat -D POSTROUTING -s $(nvram get ipv6_rtr_addr)/64 -o $VPN_ID -j MASQUERADE -m comment --comment "WireGuard 'client'" 2>/dev/null
    #fi

        [ -z "$(nvram get ipv6_rtr_addr)" ] && ip6tables -t nat -D POSTROUTING -o $VPN_ID -j MASQUERADE -m comment --comment "WireGuard 'client'" 2>/dev/null   # v4.19.9

        ip6tables -t nat -D PREROUTING -p tcp -m tcp --dport 53 -j WGDNS${VPN_NUM} -m comment --comment "WireGuard 'client${VPN_NUM} DNS'" 2>/dev/null
        ip6tables -t nat -D PREROUTING -p udp -m udp --dport 53 -j WGDNS${VPN_NUM} -m comment --comment "WireGuard 'client${VPN_NUM} DNS'" 2>/dev/null
        ip6tables -t nat -F WGDNS${VPN_NUM} 2>/dev/null         # v4.14.8 @ZebMcKayhan
        ip6tables -t nat -X WGDNS${VPN_NUM} 2>/dev/null         # v4.14.8 @ZebMcKayhan

    fi

}
# Adapted from RMerlin's 'vpnrouting.sh'
create_client_list(){

    local PEERDNS_LIST=${PEER_DNS_LIST//,/ } # v4.17.8 v4.14.8 @ZebMcKayhan

    # v4.09 Use new 'policy' table layout
    [ $(sqlite3 $SQL_DATABASE "SELECT COUNT(peer) FROM policy WHERE peer='$WG_INTERFACE';") -eq 0 ] && { logger -t "wg_manager-${MODE}${VPN_NAME}" "Warning: No Selective Routing rules found";return 1; }
    sqlite3 $SQL_DATABASE "SELECT iface,srcip,dstip FROM policy WHERE peer='$WG_INTERFACE' ORDER BY iface DESC;" | while read RULE

    do
        [ -z "$RULE" ] && continue
        local TARGET_ROUTE=$(echo $RULE | awk -F '|' '{print $1}')
        if [ "$TARGET_ROUTE" = "WAN" ]
        then
            local TARGET_LOOKUP="main"
            #WAN_PRIO=$((WAN_PRIO+1))
            local RULE_PRIO=$WAN_PRIO
            local TARGET_NAME="WAN"
        else
            local TARGET_LOOKUP=$VPN_TBL
            #VPN_PRIO=$((VPN_PRIO+1))
            local RULE_PRIO=$VPN_PRIO
            local TARGET_NAME="VPN 'client' Peer $VPN_UNIT"
        fi
        local VPN_IP=$(echo $RULE | awk -F '|' '{print $2}')
        if [ "$VPN_IP" != "Any" ] && [ -n "$VPN_IP" ]           # v4.09
        then
            local SRCC="from"
            local SRCA="$VPN_IP"
        else
            local SRCC=""
            local SRCA=""
        fi
        local DST_IP=$(echo $RULE | awk -F '|' '{print $3}')
        if [ "$DST_IP" != "Any" ] && [ -n "$DST_IP" ]           # v4.09
        then
            local DSTC="to"
            local DSTA="$DST_IP"
        else
            local DSTC=""
            local DSTA=""
        fi

        if [ -n "$SRCC" ] || [ -n "$DSTC" ]
        then
            if [ -z "$(echo "$SRCA" | grep ":")" ] && [ -z "$(echo "$DSTA" | grep ":")" ];then      # v4.13 IPv4 ONLY
                ip rule add $SRCC $SRCA $DSTC $DSTA table $TARGET_LOOKUP priority $RULE_PRIO
            fi
            if [ "$USE_IPV6" == "Y" ];then                                                          # v 4.13 v4.08
                if [ -n "$(echo "$SRCA" | grep ":")" ] || [ -n "$(echo "$DSTA" | grep ":")" ];then
                    ip -6 rule add $SRCC $SRCA $DSTC $DSTA table $TARGET_LOOKUP priority $RULE_PRIO # v4.13 IPv6 ONLY
                fi
            fi

            echo -en $cBCYA
            [ "$DSTC" == "to" ] && DSTC="to "
            logger -t "wg_manager-${MODE}${VPN_NAME}" "Adding WireGuard 'client' Peer route ${SRCA}${DSTC}$DSTA through $TARGET_NAME"
            echo -en $cRESET

            if [ -n "$PEERDNS_LIST" ] && [ "$TARGET_LOOKUP" != "main" ] && [ "$VPN_IP" != "Any" ];then  # v4.17.9 @ZebMcKayhan

                for PEER_DNS in $PEERDNS_LIST                   # v4.14.8 @ZebMcKayhan
                    do
                        if [ -z "$(echo "$PEER_DNS" | grep -F ":")" ] && [ -z "$(echo "$VPN_IP" | grep -F ":")" ];then          # v4.14.8 v4.13
                            cmd iptables -t nat -A WGDNS$VPN_NUM -s ${VPN_IP} -j DNAT --to-destination $PEER_DNS -m comment --comment "WireGuard 'client${VPN_NUM} DNS'"     # v4.05
                        fi
                        if [ "$USE_IPV6" == "Y" ] && [ -n "$(echo "$PEER_DNS" | grep -F ":")" ] && [ -n "$(echo "$VPN_IP" | grep -F ":")" ];then    # v4.14.8 v4.13
                            # For the following to work @ZebMcKayhan uses 'opkg install xtables-addons_legacy'
                            #
                            cmd ip6tables -t nat -A WGDNS$VPN_NUM -s ${VPN_IP} -j DNAT --to-destination $PEER_DNS -m comment --comment "WireGuard 'client${VPN_NUM} DNS'"
                        fi
                    done
            fi
        fi
    done
}
purge_client_list(){
    IP_LIST=$(ip rule show | cut -d ":" -f 1)
    for PRIO in $IP_LIST
    do
        if [ "$PRIO" -ge "$START_PRIO" ] && [ "$PRIO" -le "$END_PRIO" ]
        then
            cmd ip rule del prio $PRIO
            [ "$USE_IPV6" == "Y" ] && cmd ip -6 rule del prio $PRIO         # v4.14.8 @ZebMcKayhan
            #echo -en $cBCYA"\t"
            logger -t "wg_manager-${MODE}${VPN_NAME}" "Removing WireGuard® 'client' Peer rule $PRIO from routing policy"
            echo -en $cRESET
        fi
    done
    }
Manage_Passthru(){

    local SERVER_DEVICEPEERS=$(sqlite3 $SQL_DATABASE "SELECT server,ip_subnet FROM passthru where client='$WG_INTERFACE';" | tr '\n' ' ')

    local PASSTHRU_SERVER=
    local PASSTHRU=

    local ACTION="add"
    [ -n "$1" ] && ACTION=$1        # "del" or "add"

    if [ -n "$SERVER_DEVICEPEERS" ];then

        unset DONE;while [ -z ${DONE+x} ];do ip    rule del prio 998${VPN_NUM} 2>/dev/null;[ $? -gt 0 ] && DONE=1;done  # v4.17.1 v4.16.19
        unset DONE;while [ -z ${DONE+x} ];do ip -6 rule del prio 998${VPN_NUM} 2>/dev/null;[ $? -gt 0 ] && DONE=1;done  # v4.17.1 v4.16.19

        for ITEM in $SERVER_DEVICEPEERS     # wg21|all or wg22|SGS8 or wg21|10.0.0.0/27
            do
                Parse "$ITEM" "|" PASSTHRU_SERVER PASSTHRU

                if [ "$PASSTHRU" == "all" ];then
                    # Use 'server' peer clients subnet
                    local IP_ADDR=$(sqlite3 $SQL_DATABASE "SELECT subnet FROM servers where peer='$PASSTHRU_SERVER';")
                    local TYPE="Subnet"
                else
                    local IP_ADDR=$(sqlite3 $SQL_DATABASE "SELECT ip FROM devices where name='$PASSTHRU';" 2> /dev/null)
                    [ -z "$IP_ADDR" ] && local IP_ADDR=$PASSTHRU
                    local TYPE="I/P"

                    local DESC=$(sqlite3 $SQL_DATABASE "SELECT tag FROM clients where peer='$PASSTHRU';")               # v4.16.16
                    if [ -z "$DESC" ] && [ -f ${CONFIG_DIR}${PASSTHRU}.conf ];then                                      # v4.16.17 @archiel
                        local DESC=$(grep -FB1 "[Interface]" ${CONFIG_DIR}${PASSTHRU}.conf | grep -vF "[Interface]")    # v4.16.16
                        local DESC=$(printf "%s" "$DESC" | sed 's/^[ \t]*//;s/[ \t]*$//')                               # v4.16.16
                    fi
                    [ -z "$DESC" ] && local DESC="# $PASSTHRU"                                                          # v4.16.16
                fi

                if [ -n "$IP_ADDR" ];then
                    for PASSTHRU_IP in $(echo "$IP_ADDR" | tr ',' ' ')
                        do
                            if [ "$PASSTHRU_ONLY" != "Y" ];then         # Called from wg_manager ?
                                iptables  -t nat -D POSTROUTING -s  $IP_ADDR -o wg1$VPN_NUM -j MASQUERADE 2> /dev/null  # v4.16.14
                                ip6tables -t nat -D POSTROUTING -s  $IP_ADDR -o wg1$VPN_NUM -j MASQUERADE 2> /dev/null  # v4.16.14
                            fi
                        done

                    if [ "$PASSTHRU_ONLY" == "Y" ];then
                        logger -t "wg_manager-${MODE}${VPN_NAME}" "'server' peer ($PASSTHRU_SERVER) RPDB" "'pass-thru': $WG_INTERFACE rules removed"
                        local FLUSH="Y"     # Force
                    fi

                    if [ "$ACTION" != "del" ];then
                        for PASSTHRU_IP in $(echo "$IP_ADDR" | tr ',' ' ')                                          # v4.16.14
                            do
                                if [ "$USE_IPV6" == "Y" ] && [ -n "$(echo "$PASSTHRU_IP" | grep -F ":")" ];then     # v4.16.14
                                    cmd ip -6 rule $ACTION from $PASSTHRU_IP table 12$VPN_NUM prio 998$VPN_NUM          # v4.16.15
                                    cmd ip6tables -t nat -I POSTROUTING -s $PASSTHRU_IP -o wg1$VPN_NUM -j MASQUERADE    # v4.16.15
                                    DASH6="-6 "     # v4.16.15 v4.16.14
                                else
                                    if [ -n "$(echo "$PASSTHRU_IP" | Is_IPv4_CIDR)" ] || [ -n "$(echo "$PASSTHRU_IP" | Is_IPv4)" ];then # v4.16.14
                                        cmd ip rule $ACTION from $PASSTHRU_IP table 12$VPN_NUM prio 998$VPN_NUM         # v4.16.14
                                        cmd iptables -t nat -I POSTROUTING -s  $PASSTHRU_IP -o wg1$VPN_NUM -j MASQUERADE    # v4.16.15
                                    fi
                                fi
                                logger -t "wg_manager-${MODE}${VPN_NAME}" "'server' peer ($PASSTHRU_SERVER) RPDB" "'$TYPE pass-thru': 'ip ${DASH6}rule $ACTION from $PASSTHRU_IP table 12$VPN_NUM' $DESC"    # # v4.16.16 v4.16.14
                                DASH6=                                                                                      # v4.16.14
                            done
                    fi

                    if [ "$ACTION" == "add" ];then
                        # Ensure target WireGuard 'client' peer routing policy table contains WireGuard 'server' peer IP/network in the passthru tunnel @chongnt
                        if [ -n "$(wg show interfaces | grep "$PASSTHRU_SERVER")" ];then

                            while read ROUTE; do
                               ip route $ACTION $ROUTE table 12$VPN_NUM 2>/dev/null
                               local FLUSH="Y"
                            done << EOR
$(ip route | grep "$PASSTHRU_SERVER")
EOR

                        fi
                        if [ "$USE_IPV6" == "Y" ];then                                          # v4.16.7
                            if [ -n "$(wg show interfaces | grep "$PASSTHRU_SERVER")" ];then

                                while read ROUTE; do
                                   ip -6 route $ACTION $ROUTE table 12$VPN_NUM 2>/dev/null      # v4.16.7
                                   local FLUSH="Y"
                                done << EOR
$(ip -6 route | grep "$PASSTHRU_SERVER")
EOR

                            fi
                        fi
                    fi
                fi
            done

            if [ "$FLUSH" == "Y" ];then
                #ip route show cache
                cmd ip route flush cache
                if [ "$USE_IPV6" == "Y" ];then
                    #ip -6 route show cache
                    # The following ALWAYS issues
                    #   'Failed to send flush request: No such process', so try it anyway, a reboot will fix it!
                    [ "$SHOWCMDS" == "Y" ] && echo -e "[?] ip -6 route flush cache $cBRED>>>>'Failed to send flush request: No such process'$cRESET.....ALWAYS FAILS!!!!"
                    ip -6 route flush cache 2>/dev/null              # v4.16.7
                fi
            else
                [ "$ACTION" != "del" ] && logger -t "wg_manager-${MODE}${VPN_NAME}" "Warning 'server' peer ($PASSTHRU_SERVER) route not found - is it UP? FLUSH="$FLUSH
            fi
    fi
}
Process_Pre_Post_Commands() {
    # v4.14.1
    while read LINE; do
            local CMDTYPE=$1
            #   %p   - Listen Port                      ONLY recognised by Martineau's WireGuard Manager/wg-quick2
            #   %wan - WAN Interface                    ONLY recognised by Martineau's WireGuard Manager/wg-quick2
            #   %net - Network Tunnel Subnet            ONLY recognised by Martineau's WireGuard Manager/wg-quick2
            #   %lan - LAN Subnet                       ONLY recognised by Martineau's WireGuard Manager/wg-quick2
            #   %pos - Firewall insert point            ONLY recognised by Martineau's WireGuard Manager/wg-quick2
            #   %num - Peer instance e.g. 1             ONLY recognised by Martineau's WireGuard Manager/wg-quick2
            local CMD="$(echo "$LINE" | sed "s/\%wan/$WAN_IF/g;s/\%net/$SUBNET_PREFIX4/g;s/\%lan/$LAN_SUBNET/g;s/\%pos/$POS/g;s/\%num/$VPN_NUM/g;s/\%p/$LISTEN_PORT/g;s/\%i/$WG_INTERFACE/g")"    # v4.17.5 v4.16.3 v4.14.1
            if [ -n "$CMD" ];then
                logger -t "wg_manager-${MODE}${VPN_NAME}" "Executing $CMDTYPE: '$CMD'"   # v4.17
                [ "$SHOWCMDS" == "Y" ] && echo -e "[>] ${CMDTYPE}" >&2
                if [ -n "$(echo "$CMDTYPE" | grep "Up")" ];then             # v4.4.4
                    cmd $CMD                                            # v4.15.2
                else
                    $CMD 2>/dev/null                                        # v4.4.4
                fi
            fi
    done << EOR
$(grep -E "^${1}" ${CONFIG_DIR}${WG_INTERFACE}.conf | tr ';' '\n' | sed 's/^.*=//')
EOR

}
Firewall_Rule_Exists() {
    # v4.15.3
    local CMD="$@"
    local RULE_EXISTS="N"

    local CHECK_DUPLICATE=$(echo "$CMD" | sed 's/-[IA]/-C/')
    if [ -z "$(echo "$CMD" | grep -Fo "comment" )" ];then
        $CHECK_DUPLICATE -m comment --comment "WireGuard 'client'" 2>/dev/null      # v4.15.2
        RC=$?
        [ $RC -eq 0 ] && local RULE_EXISTS="Y"
    fi
    if [ "$RULE_EXISTS" == "N" ];then
        $CHECK_DUPLICATE 2>/dev/null                                                # v4.15.2
        RC=$?
        [ $RC -eq 0 ] && local RULE_EXISTS="Y"
    fi

    echo "$RULE_EXISTS"
}
cmd() {

    local TAG="#"
    local CMD=$(echo "$@" | awk '{print $1}')
    local THIS="$@"                                     # v4.16.9
    if [ "$CMD" == ">>" ];then                          # v4.16.9
        local TAG=">>"                                  # v4.16.9
        local THIS="$(echo "$@" | awk '{$1=""}1')"      # v4.16.9
        local THIS="$(echo "$THIS" | awk '{$1=$1};1')"  # v4.16.9
    fi
    # shellcheck disable=SC2145
    [ "$SHOWCMDS" == "Y" ] && echo "[$TAG] $@" >&2     # v4.16.9 v4.15.1

    case $CMD in                                                # v4.15.2
        *tables*)                                               # v4.15.2
            if [ "$(Firewall_Rule_Exists "$@")" == "Y" ];then   # v4.15.2
                #logger -t "wg_manager-${MODE}${VPN_NAME}" "..........duplicate; skipped!"
                # shellcheck disable=SC2034
                DEBUG_DUPLICATE="======================================================= $@"
                return
            fi
        ;;
    esac

    #[ "$TAG" == ">>" ] && $THIS || $@  # v4.16.9
    "$@"
}
Manage_IPV6_PRIO() {

    # add | {get vpn_num}

    local ACTION=$1
    local VPN_NUM=$2

    if [ "$ACTION" == "add" ];then
        local CNT=$(ip -6 rule | grep -E "^998.:" | wc -l)
        local IPV6PRIO=$((9989 - $CNT))
    else
        local IPV6PRIO=$(ip -6 rule | grep -E "from all lookup 12$VPN_NUM$"| awk '{print $1}' | sed 's/://')
    fi

    echo "$IPV6PRIO"
}
#=============================================Main=============================================================

#For verbose debugging, uncomment the following two lines, and uncomment the last line of this script
#set -x
#(

# shellcheck disable=SC2068
Main() { true; } # Syntax that is Atom Shellchecker compatible!

CONFIG_DIR="/opt/etc/wireguard.d/"                 # Conform to "standards"         # v1.05 @elorimer
INSTALL_DIR="/jffs/addons/wireguard/"
SQL_DATABASE="/opt/etc/wireguard.d/WireGuard.db"        # v1.08

FIRMWARE=$(echo $(nvram get buildno) | awk 'BEGIN { FS = "." } {printf("%03d%02d",$1,$2)}')

WAN_IF=$(Get_WAN_IF_Name)

if [ -f ${INSTALL_DIR}WireguardVPN.conf ] && [ -z "$(grep -E "^NOCOLOR|^NOCOLOUR" ${INSTALL_DIR}WireguardVPN.conf)" ];then     # v4.15.3
    ANSIColours
fi

modprobe xt_set
modprobe xt_comment

VPN_ID=$1
[ -z "$1" ] && VPN_ID="wg0"
[ "${VPN_ID:0:3}" == "wg1" ] && { MODE="client"; TXT="to"; } || { MODE="server"; TXT="Hosted at"; }
VPN_NUM=${VPN_ID#"${VPN_ID%?}"}    # i.e. 'client' Peer prio '99x[0|1]' where the RPDB rules for 'client' Peers 'wg11'-wg15' are '991x-995x'

WG_INTERFACE=$VPN_ID

[ -n "$(echo "$VPN_NUM" | grep -oE '^[0-9]+$')" ] && VPN_NAME=$VPN_ID || VPN_NAME=$WG_INTERFACE # v4.10

LAN_ADDR=$(nvram get lan_ipaddr)                                # v4.05
LAN_SUBNET=${LAN_ADDR%.*}                                       # v4.05

IPV6_SERVICE=$(nvram get ipv6_service)
if [ "$IPV6_SERVICE" != "disabled" ];then       # v4.1
    case $IPV6_SERVICE in
        native|ipv6pt|dhcp6|6to4|6in4|6rd)
            # ip -6 addr | grep "scope global"
            USE_IPV6="Y"; IPV6_TXT="(IPv6) "    # 4.08
            LAN_SUBNET_IPV6=$(nvram get ipv6_prefix)        # v4.14.6
            LAN_ADDR_IPV6=$(nvram get ipv6_rtr_addr)        # v4.14.6
        ;;
        other)
            :
        ;;
        spoof|simulate)
            USE_IPV6="Y"; IPV6_TXT="(IPv6) Simulate "   # v4.14
        ;;
    esac
fi

# Override IPv6 ?
if [ -f /jffs/addons/wireguard/WireguardVPN.conf ] && [ -n "$(grep -E "^NOIPV6" /jffs/addons/wireguard/WireguardVPN.conf)" ];then    # v4.12
    USE_IPV6="N"; IPV6_TXT=
    logger -t "wg_manager-${MODE}${VPN_NAME}" "'NOIPV6' directive found ('WireguardVPN.conf')- IPv6 configuration forced to IPv4"    # v4.12
fi

WAN_IPV4=$(ip -4 addr | sed -ne 's|^.* inet  \([^/]*\)/.* scope global.*$|\1|p' | awk '{print $1}' | head -1)           # v4.14.6
[ "$USE_IPV6" == "Y" ] && WAN_IPV6=$(ip -6 addr | sed -ne 's|^.* inet6 \([^/]*\)/.* scope global.*$|\1|p' | head -1)    # v4.14.6

[ -n "$(echo "$@" | grep "force")" ] && FORCE="force"

[ -n "$(echo "$@" | grep "debug")" ] && SHOWCMDS="Y"                        # v4.14.7
# Is this a standard 'client' Peer interface 'wg11-wg15'                    # v1.03
if [ -z "$(echo "$VPN_ID" |  grep -oE "^wg[0-2]")" ];then      # v4.02 v1.03
    # Non-standard so identfy if it's a 'client' or 'server' Peer
    if [ -f ${CONFIG_DIR}${VPN_ID}.conf ];then                                  # v1.03
        if [ -n "$(grep -E "^Endpoint" ${CONFIG_DIR}${VPN_ID}.conf)" ];then     # v1.03
            MODE="client"
            TXT="to"
            SOCKET="$(awk '/^Endpoint/ {print $3}' ${CONFIG_DIR}${VPN_ID}.conf)"                    # v1.03
            LOCALIP="$(awk -F "[ :]" '/^Endpoint/ {print $3}' ${CONFIG_DIR}${VPN_ID}.conf)"     # v1.03
        else
            echo -e $cBRED"\a\n\t***ERROR: WireGuard '$MODE' not supported by $0!\n"$cRESET
            exit 87
        fi
    fi
fi

[ -n "$(echo "$@" | grep "policy")" ] && POLICY_MODE="in Policy Mode " || POLICY_MODE=

# Read the database to set the Annotation Description and LOCAL peer endpoint etc.
if [ "$MODE" == "client" ];then                         # v1.03
    if [ -z "$LOCALIP" ];then
       LOCALIP=$(sqlite3 $SQL_DATABASE "SELECT subnet FROM clients where peer='$WG_INTERFACE';")
       [ -z "$LOCALIP" ] && { echo -e $cBRED"\a\n\t***ERROR: WireGuard '$MODE' doesn't have a LOCAL IP Address! - try 'peer $WG_INTERFACE ip=xxx.xxx.xxx.xxx/32'?\n"$cRESET ; exit 87 ; }   # v4.13
       #export LocalIP=$LOCALIP
    fi

    PEER_DNS_LIST=$(sqlite3 $SQL_DATABASE "SELECT dns FROM clients where peer='$WG_INTERFACE';")        # V4.16 v4.05

    [ -z "$SOCKET" ] && SOCKET=$(sqlite3 $SQL_DATABASE "SELECT socket FROM clients where peer='$WG_INTERFACE';")
    if [ -n "$(echo "$VPN_NUM" | grep -oE '^[0-9]+$')" ]; then      # v4.09
        START_PRIO=99${VPN_NUM}0
        END_PRIO=99${VPN_NUM}9
        WAN_PRIO=99${VPN_NUM}0
        VPN_PRIO=99${VPN_NUM}1
        VPN_TBL=12$VPN_NUM
        VPN_UNIT=$VPN_ID
    else                            # v4.10
        START_PRIO=99999
        END_PRIO=99999
        VPN_PRIO=99999
        WAN_PRIO=99999
    fi
else
    SOCKET=$(nvram get wan_gateway)":"$(awk '/Listen/ {print $3}' ${CONFIG_DIR}${VPN_ID}.conf)      # v1.03
fi

DESC=$(sqlite3 $SQL_DATABASE "SELECT tag FROM clients where peer='$WG_INTERFACE';")
[ -z "$DESC" ] && DESC=$(grep -FB1 "[Interface]" ${CONFIG_DIR}${WG_INTERFACE}.conf | grep -vF "[Interface]")    # v4.14
DESC=$(printf "%s" "$DESC" | sed 's/^[ \t]*//;s/[ \t]*$//')
[ -z "$DESC" ] && DESC="# Unidentified"

# Called from wg_manager? in response to 'peer wg2X passthru [add|del]'
if [ "$2" == "passthru_rules" ];then
    PASSTHRU_ONLY="Y"
    Manage_Passthru $3
    exit 0
fi

if [ "$1" != "disable" ] && [ "$2" != "disable" ];then

    Firewall_delete

    if [ -n "$LOCALIP" ] || [ "$MODE" == "client" ];then                                # v1.03
        logger -t "wg_manager-${MODE}${VPN_NAME}" "Initialising WireGuard® VPN $MODE Peer ($VPN_ID) ${POLICY_MODE}${TXT} $SOCKET ($DESC)"
        echo -e $cBCYA"\twg_manager-${MODE}${VPN_NAME}: Initialising WireGuard® VPN '$MODE' Peer (${cBMAG}$VPN_ID${cBCYA}) ${POLICY_MODE}${TXT} $SOCKET (${cBMAG}$DESC${cBCYA}) ${cBWHT}DNS=$PEER_DNS_LIST"$cRESET        # v4.16

        if [ -n "$PEER_DNS_LIST" ];then            # v4.16 v4.05
            if [ -n "$(echo "$VPN_NUM" | grep -oE '^[0-9]+$')" ]; then      # v4.09
                cmd iptables -t nat -N WGDNS${VPN_NUM}                      # v4.05
                [ $? -gt 0 ] && { echo -e $cBRED"\a\n\t"; logger -st "wg_manager-${MODE}${VPN_NAME}" "***ERROR Failed to create -t nat WGDNS${VPN_NUM}."; echo -e $cRESET; exit 99; }
                if [ "$USE_IPV6" == "Y" ];then                              # v4.11
                    cmd ip6tables -t nat -N WGDNS${VPN_NUM}                     # v4.11
                fi
                [ $? -gt 0 ] && { echo -e $cBRED"\a\n\t"; logger -st "wg_manager-${MODE}${VPN_NAME}" "***ERROR IPv6 Failed to create -t nat WGDNS${VPN_NUM}."; echo -e $cRESET; exit 99; }
            else
                cmd iptables -t nat -N WGDNS${VPN_NUM}                 # v4.09
                [ $? -gt 0 ] && { echo -e $cBRED"\a\n\t"; logger -st "wg_manager-${MODE}${VPN_NAME}" "***ERROR Failed to create -t nat WGDNS${VPN_NUM}."; echo -e $cRESET; exit 99; }
                if [ "$USE_IPV6" == "Y" ];then                     # v4.11
                    cmd ip6tables -t nat -N WGDNS${VPN_NUM}            # v4.11
                fi
                [ $? -gt 0 ] && { echo -e $cBRED"\a\n\t"; logger -st "wg_manager-${MODE}${VPN_NAME}" "***ERROR IPv6 Failed to create -t nat WGDNS${WG_INTERFACE}."; echo -e $cRESET; exit 99; }
            fi
        fi

        ip link del dev $VPN_ID 2>/dev/null
        cmd ip link add dev $VPN_ID type wireguard

        # v4.17.4 now allows .conf to contain comments in directives e.g. Unraid generates
        #         'AllowedIPs=0.0.0.0/0     # ALL Traffic'
        # so strip them and delete completely empty lines from the .conf executed by wg
        grep -vE "^#" ${CONFIG_DIR}$VPN_ID.conf | sed '/^[Dd][Nn][Ss]/d; /^MTU/d; /^Address/d; /^PreU/d; /^PreD/d; /^Post/d; /^Table/d; /^SaveC/d; /^FWmark/d; s/#.*$//g; /^\s*$/d' > /tmp/$VPN_ID.$$   # v4.17.5 @johndoe85 v4.17.4 @endiz v4.16.2

        [ "$SHOWCMDS" == "Y" ] && echo -e "[#] wg setconf $VPN_ID /tmp/$VPN_ID.$$ #(${CONFIG_DIR}$VPN_ID.conf)"    # v4.16.2 v4.14.13

        echo -en ${cWRED}                                                                        # v4.14.13
        wg setconf $VPN_ID /tmp/$VPN_ID.$$                                                      # v4.16.2 v4.14.13
        if [ $? -ne 0 ];then
            # Syntax ERROR?                                                                     # v4.14.13
            # e.g. Endpoint DDNS not valid/resolved?
            echo -en $cRESET
            cmd ip link del dev $VPN_ID                                                         # v4.14.13
            [ "$USE_IPV6" == "Y" ] && cmd ip -6 link del dev $VPN_ID
            logger -t "wg_manager-${MODE}${VPN_NAME}" "***ERROR Initialisation ABORTED"
            echo -e ${cRESET}$cBRED"\a\n\t***ERROR Initialisation ABORTED - 'wg setconf $VPN_ID /tmp/$VPN_ID.$$ (${CONFIG_DIR}$VPN_ID.conf)' FAILED\n"$cRESET

            echo -en $cRESET
            exit 1                                                                              # v4.14.13
        fi
        echo -en $cRESET        # v4.16.6

        #  Suppress the message if a domain is supplied i.e.'Error: any valid prefix is expected rather than "'xxx.com"

        # v4.12 Assign both IPv4 and IPv6 IPs to interface as required
        LOCALIPS=${LOCALIP//,/ }     # v4.16.3 v4.11
        for LOCALIP in $LOCALIPS
            do
                if [ "$USE_IPV6" == "Y" ] && [ -n "$(echo "$LOCALIP" | grep -F ":")" ];then     # v4.12
                    cmd ip -6 address add dev $VPN_ID $LOCALIP     # v4.02D
                else
                    if [ -n "$(echo "$LOCALIP" | Is_IPv4_CIDR)" ] || [ -n "$(echo "$LOCALIP" | Is_IPv4)" ];then
                        cmd ip address add dev $VPN_ID $LOCALIP # v4.02
                        SUBNET_PREFIX4=${LOCALIP%.*}                    # v4.16.3
                    fi
                fi
            done

        cmd ip link set up dev $VPN_ID                                  # v4.14.12
        [ "$USE_IPV6" == "Y" ] && cmd ip -6 link set up dev $VPN_ID     # v4.14.12

        # WireGuard should set the MTU correctly without explicitly having to issue 'ifconfig $VPN_ID mtu $MTU' ????
        MTU=$(sqlite3 $SQL_DATABASE "SELECT mtu FROM clients where peer='$WG_INTERFACE';")          # v4.09
        # Fibre MTU 1500 then 1440 (- 60) for IPv4 and 1420 (-80) for IPv6 <<=== Default 1420???
        # PPoE  MTU 1492 then 1432 (- 60) for IPv4 and 1412 (-80) for IPv6
        # Lowest value is 1280 for IPv6
        # 1380 is common in some cases?
        if [ -z "$MTU" ] || [ "$MTU" == "Auto" ];then                                                               # v4.17.2
            if [ "$SHOWCMDS" == "Y" ];then                                                                          # v4.17.2
                echo -e "[ ] Auto $(ifconfig $VPN_ID | awk '/MTU:/ { print $(NF-1)}') determined by WireGuard®"     # v4.17.2 v4.09 v1.02
            fi
        else
            # WireGuard ISP provided or overridden/supplied by user. e.g. TorGuard pushes MTU=1292
            cmd ifconfig $VPN_ID mtu $MTU
        fi

        cmd ifconfig $VPN_ID txqueuelen 1000

        TIMESTAMP=$(date +%s)
        sqlite3 $SQL_DATABASE "INSERT into session values('$WG_INTERFACE','Start','$TIMESTAMP');"   # v1.08
        sqlite3 $SQL_DATABASE "INSERT into traffic values('$WG_INTERFACE','$TIMESTAMP','0','0','0','0');"

        if [ -z "$(iptables-save | grep WGM_ACL)" ];then    # v4.16.3
            cmd iptables -N WGM_ACL_F 2>/dev/null           # v4.16.3
            cmd iptables -I FORWARD "$(($(iptables -nvL FORWARD --line -t filter | grep -Em 1 ".*\*.*\*.*state.*ESTABLISHED" | cut -d' ' -f1)+1))" -i wg+ -j WGM_ACL_F -m comment --comment "Wireguard ACL" # v4.16.3
        fi

        POS=$(($(iptables -nvL FORWARD --line -t filter | grep -Em 1 ".*WGM_ACL_F" | cut -d' ' -f1)+1)) # v4.16.3

        # v4.14 Process 'PreUp' commands
        Process_Pre_Post_Commands "PreUp"

        # User Exit @Torson
        if [ -f ${INSTALL_DIR}Scripts/${VPN_ID}-route-up.sh ];then
            logger -t "wg_manager-${MODE}${VPN_NAME}" "Executing Event:${VPN_ID}-route-up.sh"
            [ "$SHOWCMDS" == "Y" ] && echo -e "[+] ${VPN_ID}-route-up.sh"
            sh ${INSTALL_DIR}Scripts/${VPN_ID}-route-up.sh
        fi
        host="$(wg show $VPN_ID endpoints | sed -n 's/.*\t\(.*\):.*/\1/p')"
        if [ -n "$(echo "$host" | Is_IPv4)" ];then          # v4.08
            #cmd ip route add $(ip route get $host | sed '/ via [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}/{s/^\(.* via [0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\).*/\1/}' | head -n 1)
           if [ $(ip route show $host | wc -l) -eq 0 ];then                             # v4.16.10
                cmd ip route add $(ip -o route get $host  | awk '{print $1" "$2" "$3}')
           fi
        else
            hostipv6="$(wg show $VPN_ID endpoints | grep -oE "\[.*\]" | tr -d '[]')"
            cmd ip -6 route add ::/0 dev $VPN_ID table 12$VPN_NUM prio 999$VPN_NUM
            if [ $(ip -6 route show $hostipv6 | wc -l) -eq 0 ];then                                 # v4.16.11
                cmd ip -6 route add $(ip -6 -o route get $hostipv6  | awk '{print $1" "$2" "$3}')   # v4.16.10
            fi
        fi

        # If there is ALREADY an ACTIVE WireGuard VPN Client, then tough! - make this one the default!!!!
        if [ -z "$POLICY_MODE" ];then
            if [ "$(wg show interfaces | grep -E "wg[0-1]" | wc -w)" -gt 1 ];then
                for THIS in $(wg show interfaces | grep -E "wg[0-1]")
                    do
                        ip route del 0/1   dev $THIS  2>/dev/null
                        ip route del 128/1 dev $THIS  2>/dev/null
                        if [ "$USE_IPV6" == "Y" ];then
                            ip -6 route del 0::/1    dev $THIS 2>/dev/null      # v4.16
                            ip -6 route del 8000::/1 dev $THIS 2>/dev/null      # v4.16
                        fi
                    done
            fi
            # 0.0.0.0/0 Default
            if [ -n "$(awk '/^AllowedIPs/ {print $0}' ${CONFIG_DIR}${VPN_ID}.conf | grep -oF "0.0.0.0/0")" ] || [ -n "$(awk '/^AllowedIPs/ {print $3}' ${CONFIG_DIR}${VPN_ID}.conf | grep -oF "::0/0")" ];then  # v4.14
                if [ "$(awk '/^AllowedIPs/ {print $0}' ${CONFIG_DIR}${VPN_ID}.conf | grep -oF "0.0.0.0/0")" == "0.0.0.0/0" ];then   # v4.14
                    if [ -z "$(ip route show 0/1 | grep "dev $VPN_ID")" ];then  # v4.16.11
                        cmd ip route add 0/1   dev $VPN_ID
                        cmd ip route add 128/1 dev $VPN_ID
                    fi
                fi

                if [ "$USE_IPV6" == "Y" ];then
                    #cmd ip -6 route add 0::/1    dev $VPN_ID table 12$VPN_NUM
                    #cmd ip -6 route add 8000::/1 dev $VPN_ID table 12$VPN_NUM
                    if [ "$(awk '/^AllowedIPs/ {print $0}' ${CONFIG_DIR}${VPN_ID}.conf | grep -oF "::0/0")" == "::0/0" ];then   # v4.14
                        #IPV6PRIO=$(Manage_IPV6_PRIO "add")                                          # v4.16
                        #cmd ip -6 rule add from all table 12$VPN_NUM prio $IPV6PRIO                 # v4.16
                        if [ -z "$(ip -6 route show ::/1 | grep "dev $VPN_ID")" ];then  # v4.16.11
                            cmd ip -6 route add 0::/1    dev $VPN_ID
                            cmd ip -6 route add 8000::/1 dev $VPN_ID
                        fi
                    fi
                fi
            else
                for ALLOWIP in $(awk '/^AllowedIPs/ {$1="";$2="";print $0}' ${CONFIG_DIR}${VPN_ID}.conf | tr ',' ' ')
                    do
                        if [ "$USE_IPV6" == "Y" ] && [ -n "$(echo "$ALLOWIP" | grep -F ":")" ];then     # v4.12
                            cmd ip -6 route add $ALLOWIP dev $VPN_ID
                        else
                            if [ -n "$(echo "$ALLOWIP" | Is_IPv4_CIDR)" ] || [ -n "$(echo "$ALLOWIP" | Is_IPv4)" ];then
                                cmd ip route add $ALLOWIP dev $VPN_ID
                            fi
                        fi
                    done
            fi

            # Could be anything really....  e.g. 0.0.0.0/0,::0/0
            #if [ -n "$(awk '/^AllowedIPs/ {print $0}' ${CONFIG_DIR}${VPN_ID}.conf | grep -oF "0.0.0.0/0")" ] || [ -n "$(awk '/^AllowedIPs/ {print $3}' ${CONFIG_DIR}${VPN_ID}.conf | grep -oF "::0/0")" ];then
                if [ -n "$PEER_DNS_LIST" ];then                                             # V4.16
                    for PEER_DNS in $(echo "$PEER_DNS_LIST" | tr ',' ' ')                   # v4.16
                        do
                            if [ -n "$(echo "$VPN_NUM" | grep -oE '^[0-9]+$')" ]; then      # v4.09
                                if [ -n "$(echo "${LAN_SUBNET}.0/24" | Is_IPv4_CIDR)" ];then
                                    if [ -z "$(echo "$PEER_DNS" | grep -F ":")" ];then      # v4.16 @archiel
                                        cmd iptables -t nat -A WGDNS$VPN_NUM -s ${LAN_SUBNET}.0/24 -j DNAT --to-destination $PEER_DNS -m comment --comment "WireGuard 'client${VPN_NUM} DNS'" # v4.05
                                    fi
                                fi
                                if [ "$USE_IPV6" == "Y" ] && [ -n "$(echo "$PEER_DNS" | grep -F ":")" ];then
                                    #   ipv6_service=dhcp6
                                    #   ipv6_prefix=2a02:c7f:xxxx:yyyy::
                                    #   ipv6_prefix_length=56
                                    #   ipv6_rtr_addr=2a02:c7f:xxxx:yyyy::1
                                    if [ -n "$(nvram get ipv6_rtr_addr)" ];then
                                        cmd ip6tables -t nat -A WGDNS$VPN_NUM -s $(nvram get ipv6_prefix)/$(nvram get ipv6_prefix_length)  -j DNAT --to-destination $PEER_DNS -m comment --comment "WireGuard 'client${VPN_NUM} DNS'"
                                    else
                                        cmd ip6tables -t nat -A WGDNS$VPN_NUM -j DNAT --to-destination $PEER_DNS -m comment --comment "WireGuard 'client${VPN_NUM} DNS'"
                                    fi
                                fi
                            else
                                [ -z "$(echo "$PEER_DNS" | grep -F ":")" ] && cmd iptables -t nat -A WGDNS$WG_INTERFACE -s ${LAN_SUBNET}.0/24 -j DNAT --to-destination $PEER_DNS -m comment --comment "WireGuard 'client${WG_INTERFACE} DNS'" # v4.09
                            fi
                        done
                fi
            #fi
        else
            # [ -z "$(ip -6 route show dev $VPN_ID match ::/0" 2>/dev/null) ] && ip -6 route add "::/0" dev "$VPN_ID" prio 999$VPN_NUM
            #cmd ip -6 route add ::/0 dev $VPN_ID table 12$VPN_NUM
            #cmd ip -6 route add default dev $VPN_ID metric 1 pref medium table 12$VPN_NUM   # v4.16
            #cmd ip -6 route add 0::/1 dev $VPN_ID table 12$VPN_NUM
            #cmd ip -6 route add 8000::/1 dev $VPN_ID table 12$VPN_NUM
            #ip rule add from $(nvram get lan_ipaddr | cut -d"." -f1-3).0/24 table 12$VPN_NUM prio 99$VPN_NUM"9"
            if [ -n "$(echo "$VPN_NUM" | grep -oE '^[0-9]+$')" ]; then      # v4.09
                VPN_IP_LIST=$(sqlite3 $SQL_DATABASE "SELECT * FROM policy WHERE peer='$WG_INTERFACE';")
                create_client_list
            else
                echo -e "\a\n\t";logger -st "wg_manager-{$MODE}${VPN_NAME}" "Policy mode not supported for non 'wg1*' prefix '$MODE' Peer '$WG_INTERFACE'"
                echo -e
            fi

            # IPSets ?
            if [ -n "$(sqlite3 $SQL_DATABASE "SELECT ipset FROM ipset WHERE peer='${WG_INTERFACE}';")" ];then

                IPSETS=$(sqlite3 $SQL_DATABASE "SELECT ipset FROM ipset WHERE peer='${WG_INTERFACE}';" | tr '\n' ' ')
                for IPSET in $IPSETS
                    do
                        ipset list $IPSET -n >/dev/null 2>&1;if [ $? -eq 0 ]; then

                            IPSET_FAMILY=$(ipset list $IPSET | awk '/^Header/ {print $3}')
                            [ "$IPSET_FAMILY" == "inet6" ] && IPV_TEXT="IPv6" || IPV_TEXT="IPv4"

                            DSTSRC=$(sqlite3 $SQL_DATABASE "SELECT dstsrc FROM ipset WHERE ipset='$IPSET' AND peer='${WG_INTERFACE}';")
                            FWMARK=$(sqlite3 $SQL_DATABASE "SELECT fwmark FROM ipset WHERE ipset='$IPSET' AND peer='${WG_INTERFACE}';")

                            TAG_MARK=$(sqlite3 /opt/etc/wireguard.d/WireGuard.db "select fwmark from fwmark where peer='${WG_INTERFACE}';") # v4.12                                                                                                             # v4.12
                            ip rule del from 0/0 fwmark $TAG_MARK"/"$TAG_MARK table 12$VPN_NUM prio 999$VPN_NUM 2>/dev/null                 # v4.12
                            cmd ip rule add from 0/0 fwmark $TAG_MARK"/"$TAG_MARK table 12$VPN_NUM prio 999$VPN_NUM                             # v4.12
                            echo 0 >/proc/sys/net/ipv4/conf/$WG_INTERFACE/rp_filter                                                         # v4.12
                            if [ "$USE_IPV6" == "Y" ];then
                                ip -6 rule del from ::/0 fwmark $TAG_MARK"/"$TAG_MARK table 12$VPN_NUM prio 999$VPN_NUM 2>/dev/null          # v4.13
                                cmd ip -6 rule add from ::/0 fwmark $TAG_MARK"/"$TAG_MARK table 12$VPN_NUM prio 999$VPN_NUM                      # v4.13
                            fi

                            # Differentiate between IPSETs containing IPv4 or IPv6 IPs
                            if [ "$IPSET_FAMILY" = "inet6" ];then   # IPv6
                                ADD_IPV6_RULE="Y"                   # v4.16
                            else
                                # Presumed IPv4
                                ADD_IPV4_RULE="Y"                   # v4.16
                            fi

                            # IPSets containing MACs can only be 'src'; and should be applied to both IPv4 and IPv6 firewall?
                            #   hash:mac
                            #   hash:ip,mac

                            # NOTE: Preferable to actually explicitly define both an IPv4 and IPV6 IPSet?
                            if [ -n "$(ipset list $IPSET | grep -E "hash:mac|hash:ip,mac")" ];then      # v4.16 @ZebMcKayhan
                                DSTSRC="src"
                                ADD_IPV4_RULE="Y"                                       # v4.16 @ZebMcKayhan
                                ADD_IPV6_RULE="Y"                                       # v4.16 @ZebMcKayhan
                                IPV_TEXT="IPv4/IPv6"                                    # v4.16
                            fi

                            if [ "$ADD_IPV4_RULE" == "Y" ] || [ "$ADD_IPV6_RULE" == "Y" ];then
                                if [ "$ADD_IPV4_RULE" == "Y" ] && [ "$IPSET_FAMILY" != "inet6" ];then
                                    iptables -t mangle -D PREROUTING -m set --match-set $IPSET $DSTSRC -j MARK --set-mark ${FWMARK}/${FWMARK} -m comment --comment "WireGuard 'client'" 2>/dev/null # v4.12
                                    cmd iptables -t mangle -A PREROUTING -m set --match-set $IPSET $DSTSRC -j MARK --set-mark ${FWMARK}/${FWMARK} -m comment --comment "WireGuard 'client'"             # v4.12
                                fi

                                if [ "$ADD_IPV6_RULE" == "Y" ] && [ "$USE_IPV6" == "Y" ];then
                                    ip6tables -t mangle -D PREROUTING -m set --match-set $IPSET $DSTSRC -j MARK --set-mark ${FWMARK}/${FWMARK} -m comment --comment "WireGuard 'client'" 2>/dev/null    # v4.12
                                    cmd ip6tables -t mangle -A PREROUTING -m set --match-set $IPSET $DSTSRC -j MARK --set-mark ${FWMARK}/${FWMARK} -m comment --comment "WireGuard 'client'"                # v4.12
                                fi

                                logger -t "wg_manager-${MODE}${VPN_NAME}" "Adding $IPV_TEXT IPSet '$IPSET' route through VPN 'client' Peer" $WG_INTERFACE
                            else
                                logger -t "wg_manager-${MODE}${VPN_NAME}" "***ERROR IPSet '$IPSET' unknown IPv4/IPv6 type for routing through VPN 'client' Peer "$WG_INTERFACE
                                # shellcheck disable=SC2027
                                echo -e $cBRED"\a\n\t***ERROR IPSet '$IPSET' unidentified IPv4/IPv6 type for routing through VPN 'client' Peer "$WG_INTERFACE"\n"$cRESET
                            fi
                        else
                            logger -t "wg_manager-${MODE}${VPN_NAME}" "***ERROR IPSet '$IPSET' does NOT EXIST! for routing through VPN 'client' Peer "$WG_INTERFACE
                        fi

                        ADD_IPV4_RULE=
                        ADD_IPV6_RULE=
                    done
            fi

        fi

        #if [ -n "$(awk '/^AllowedIPs/ {print $0}' ${CONFIG_DIR}${VPN_ID}.conf | grep -oF "0.0.0.0/0")" ] || [ -n "$(awk '/^AllowedIPs/ {print $3}' ${CONFIG_DIR}${VPN_ID}.conf | grep -oF "::0/0")" ];then  # v4.14
            #if [ -n "$(awk '/^AllowedIPs/ {print $0}' ${CONFIG_DIR}${VPN_ID}.conf | grep -oF "0.0.0.0/0")" ];then
                cmd ip route add 0/1   dev $VPN_ID table 12$VPN_NUM
                cmd ip route add 128/1 dev $VPN_ID table 12$VPN_NUM
            #fi
            if [ "$USE_IPV6" == "Y" ];then                                              # v4.08
                #if [ -n "$(awk '/^AllowedIPs/ {print $3}' ${CONFIG_DIR}${VPN_ID}.conf | grep -oF "::0/0")" ];then
                    cmd ip -6 route add 0::/1 dev $VPN_ID table 12$VPN_NUM
                    cmd ip -6 route add 8000::/1 dev $VPN_ID table 12$VPN_NUM
                #fi
            fi
        #fi

        ip route show table main dev $(nvram get lan_ifname) | while read ROUTE
            do
                if [ -n "$(echo "$VPN_NUM" | grep -oE '^[0-9]+$')" ]; then      # v4.09
                    cmd ip route add table 12$VPN_NUM $ROUTE dev $(nvram get lan_ifname)
                else
                    cmd ip route add table 120 $ROUTE dev $(nvram get lan_ifname)    # v4.10
                fi
            done

        if [ "$USE_IPV6" == "Y" ];then

            #cmd ip -6 route add $(echo $LOCALIP | sed 's/::/|/' | cut -d"|" -f1)::0/64 dev $VPN_ID  proto kernel  scope link  src $LOCALIP      # v4.11
            ip -6 route show table main dev $(nvram get lan_ifname) | while read ROUTE
                do
                    if [ -n "$(echo "$VPN_NUM" | grep -oE '^[0-9]+$')" ]; then      # v4.10
                        [ -z "$(echo "$ROUTE" | grep "expires")" ] && cmd ip -6 route add table 12$VPN_NUM $ROUTE dev $(nvram get lan_ifname)
                    else
                        cmd ip -6 route add table 120 dev $(nvram get lan_ifname)
                    fi
                done
        fi

        # PASSTHRU ?
        Manage_Passthru

        # User Exit @ZebMcKayhan
        if [ -f ${INSTALL_DIR}Scripts/${VPN_ID}-up.sh ];then
            logger -t "wg_manager-${MODE}${VPN_NAME}" "Executing Event:${VPN_ID}-up.sh"
            [ "$SHOWCMDS" == "Y" ] && echo -e "[+] ${VPN_ID}-up.sh"
            sh ${INSTALL_DIR}Scripts/${VPN_ID}-up.sh  # v4.08
        fi

        if [ -f /jffs/addons/wireguard/WireguardVPN.conf ] && [ -z "$(grep -E "^NOTCPMSS" /jffs/addons/wireguard/WireguardVPN.conf)" ];then    # v4.12
            cmd iptables -t mangle -I FORWARD -o $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'client'"
            cmd iptables -t mangle -I FORWARD -i $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'client'"
        else
            logger -t "wg_manager-${MODE}${VPN_NAME}" "'NOTCPMSS' directive found ('WireguardVPN.conf') -t mangle FORWARD chain TCP '-j TCPMSS --clamp-mss-to-pmtu' NOT configured"    # v4.12
        fi
        if [ -f /jffs/addons/wireguard/WireguardVPN.conf ] && [ -z "$(grep -E "^NOSETXMARK" /jffs/addons/wireguard/WireguardVPN.conf)" ];then    # v4.12
            cmd iptables -t mangle -I FORWARD -o $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'client'"
            cmd iptables -t mangle -I PREROUTING -i $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'client'"
        else
            logger -t "wg_manager-${MODE}${VPN_NAME}" "'NOSETXMARK' directive found ('WireguardVPN.conf') -t mangle FORWARD/PREROUTING chain'-j MARK --set-xmark 0x01/0x7' NOT configured"    # v4.12
        fi

        if [ $FIRMWARE -ge 38601 ]  && [ -n "$(brctl show | grep -E "\.50[1-2]")" ];then         # Allow Guest #1 SSID VLANs SNB @ZebMcKayhan
            cmd iptables -t filter -I FORWARD -i br1 -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard Guest_VLAN"
            cmd iptables -t filter -I FORWARD -i br2 -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard Guest_VLAN"
            cmd iptables -t nat -I POSTROUTING -s $(nvram get lan_ipaddr)/16 -o $VPN_ID -j MASQUERADE -m comment --comment "WireGuard 'client'"
        else
            cmd iptables -t nat -I POSTROUTING -s $(nvram get lan_ipaddr)/24 -o $VPN_ID -j MASQUERADE -m comment --comment "WireGuard 'client'"
        fi

        if [ -n "$PEER_DNS_LIST" ];then
            if [ -n "$(echo "$VPN_NUM" | grep -oE '^[0-9]+$')" ]; then      # v4.10
                cmd iptables -t nat -I PREROUTING -p tcp -m tcp --dport 53 -j WGDNS${VPN_NUM} -m comment --comment "WireGuard 'client${VPN_NUM} DNS'"
                cmd iptables -t nat -I PREROUTING -p udp -m udp --dport 53 -j WGDNS${VPN_NUM} -m comment --comment "WireGuard 'client${VPN_NUM} DNS'"
            else
                cmd iptables -t nat -I PREROUTING -p tcp -m tcp --dport 53 -j WGDNS${WG_INTERFACE} -m comment --comment "WireGuard 'client${WG_INTERFACE} DNS'"
                cmd iptables -t nat -I PREROUTING -p udp -m udp --dport 53 -j WGDNS${WG_INTERFACE} -m comment --comment "WireGuard 'client${WG_INTERFACE} DNS'"
            fi
        fi

        if [ "$USE_IPV6" == "Y" ];then
            if [ -f /jffs/addons/wireguard/WireguardVPN.conf ] && [ -z "$(grep -E "^NOTCPMSS" /jffs/addons/wireguard/WireguardVPN.conf)" ];then    # v4.12
                cmd ip6tables -t mangle -I FORWARD -o $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'client'"
                cmd ip6tables -t mangle -I FORWARD -i $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'client'"
            else
                logger -t "wg_manager-${MODE}${VPN_NAME}" "'NOTCPMSS' directive found ('WireguardVPN.conf') IPv6 -t mangle FORWARD chain TCP '-j TCPMSS --clamp-mss-to-pmtu' NOT configured"    # v4.12
            fi
            if [ -f /jffs/addons/wireguard/WireguardVPN.conf ] && [ -z "$(grep -E "^NOSETXMARK" /jffs/addons/wireguard/WireguardVPN.conf)" ];then    # v4.12
                cmd ip6tables -t mangle -I FORWARD -o $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'client'"
                cmd ip6tables -t mangle -I PREROUTING -i $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'client'"
            else
                logger -t "wg_manager-${MODE}${VPN_NAME}" "'NOSETXMARK' directive found ('WireguardVPN.conf') IPv6 -t mangle FORWARD/PREROUTING chain'-j MARK --set-xmark 0x01/0x7' NOT configured"    # v4.12
            fi

            # v386.4 Firmware is missing 'ip6tables -I FORWARD -i br0 -j ACCEPT'  ?
            POS=$(ip6tables --line -nvL FORWARD | grep -im 1 "drop .*all.*state INVALID" | awk '{print $1}')                 # v4.14.11 v4.14.10
            [ -z "$(ip6tables-save | grep "Fix LAN to ANY by Martineau")" ] && ip6tables -I FORWARD $((POS+1)) -i br0 -j ACCEPT  -m comment --comment "Fix LAN to ANY by Martineau"         # v4.14.10
            ip6tables -I FORWARD $((POS+1)) -i br0 -o $VPN_ID -j ACCEPT -m comment --comment "LAN to WireGuard 'client'"    # v4.14.10 @ZebMcKayhan

            if [ $FIRMWARE -ge 38601 ]  && [ -n "$(brctl show | grep -E "\.50[1-2]")" ];then         # Allow Guest #1 SSID VLANs SNB @ZebMcKayhan
                cmd ip6tables -t filter -I FORWARD -i br1 -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard Guest_VLAN"
                cmd ip6tables -t filter -I FORWARD -i br2 -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard Guest_VLAN"
                [ -n "$(nvram get ipv6_rtr_addr)" ] && cmd ip6tables -t nat -I POSTROUTING -s $(nvram get ipv6_rtr_addr)/64 -o $VPN_ID -j MASQUERADE -m comment --comment "WireGuard 'client'"
            else
                [ -n "$(nvram get ipv6_rtr_addr)" ] && cmd ip6tables -t nat -I POSTROUTING -s $(nvram get ipv6_rtr_addr)/64 -o $VPN_ID -j MASQUERADE -m comment --comment "WireGuard 'client'"
            fi

            [ -z "$(nvram get ipv6_rtr_addr)" ] && cmd ip6tables -t nat -I POSTROUTING -o $VPN_ID -j MASQUERADE -m comment --comment "WireGuard 'client'"

            if [ -n "$PEER_DNS_LIST" ];then
                if [ -n "$(echo "$VPN_NUM" | grep -oE '^[0-9]+$')" ]; then      # v4.10
                    cmd ip6tables -t nat -I PREROUTING -p tcp -m tcp --dport 53 -j WGDNS${VPN_NUM} -m comment --comment "WireGuard 'client${VPN_NUM} DNS'"
                    cmd ip6tables -t nat -I PREROUTING -p udp -m udp --dport 53 -j WGDNS${VPN_NUM} -m comment --comment "WireGuard 'client${VPN_NUM} DNS'"
                else
                    cmd ip6tables -t nat -I PREROUTING -p tcp -m tcp --dport 53 -j WGDNS${WG_INTERFACE} -m comment --comment "WireGuard 'client${WG_INTERFACE} DNS'"
                    cmd ip6tables -t nat -I PREROUTING -p udp -m udp --dport 53 -j WGDNS${WG_INTERFACE} -m comment --comment "WireGuard 'client${WG_INTERFACE} DNS'"
                fi
            fi

        fi

        # Shouldn't fire as I use '-t nat WGDNSx' chain
        # if [ "$wgdns" != "" ] && [ ! -f /tmp/resolv.dnsmasq_backup.$WG_INTERFACE ]; then {
                # cp /tmp/resolv.dnsmasq /tmp/resolv.dnsmasq_backup..$WG_INTERFACE 2>/dev/null
                        # echo "server=$wgdns" > /tmp/resolv.dnsmasq
                        # service restart_dnsmasq
                # }
        # fi

        # v4.14 Process 'PostUp' commands
        Process_Pre_Post_Commands "PostUp"

        if [ -f /jffs/addons/wireguard/WireguardVPN.conf ] && [ -n "$(grep -E "^CHK_ENDPOINT" ${INSTALL_DIR}WireguardVPN.conf)" ];then    # v# v4.14
            #   e.g. the following would use the curl command for ALL interfaces except 'wg14' (TorGuard)
            #        CHK_ENDPOINT = curl -s https://am.i.mullvad.net/connected  , * wg14-
            #        Full feature URL check https://mullvad.net/en/check/  (e.g. Mullvad hijacks DNS requests see https://schnerring.net/blog/use-custom-dns-servers-with-mullvad-and-any-wg_manager-client/)

            CHK_ENDPOINT=$( awk "/^CHK_ENDPOINT.*\*/" ${INSTALL_DIR}WireguardVPN.conf)             # v4.16.12 v4.14
            [ -z "$CHK_ENDPOINT" ] && CHK_ENDPOINT=$( awk "/^CHK_ENDPOINT.*${WG_INTERFACE}/" ${INSTALL_DIR}WireguardVPN.conf)   # v4.16.12

            if [ -n "$CHK_ENDPOINT" ];then              # v4.14
                END_POINT_INTERFACES=$(echo "$CHK_ENDPOINT" | awk -F ',' '{print $2}')

                CMD_ENDPOINT=$(echo "$CHK_ENDPOINT" | tr '=' ',' | awk -F ',' '{print $2}')

                if [ -n "$(echo "$END_POINT_INTERFACES" | grep -F "*")" ] || [ -n "$(echo "$END_POINT_INTERFACES" | grep "$WG_INTERFACE")" ] ;then
                    if [ -z "$(echo "$END_POINT_INTERFACES" | grep "${WG_INTERFACE}-")" ];then
                        CHK_ENDPOINT=$($CMD_ENDPOINT)                        # v4.14
                        echo -en $cBGRE
                        if [ -z "$(echo "$CHK_ENDPOINT" | grep -i "not connected")" ];then    # v4.14
                            echo -en $cBCYA"\t"
                            logger -st "wg_manager-${MODE}${VPN_NAME}" $CHK_ENDPOINT
                            #echo -en $cBGRE"\t"
                        fi
                    else
                       # shellcheck disable=SC2027
                       CMD_ENDPOINT="Endpoint check SKIPPED...Exclusion for '${WG_INTERFACE}' - command='"$CMD_ENDPOINT"'"
                    fi
                fi
            fi
        fi

        # What if the Endpoint Peer acquires a new IP address after the initial handshake?
        #      (NOTE: Mullvad Endpoints seem to ALWAYS be an IPv4 address rather than DDNS name)
        # Need a monitor that refreshes the Endpoint DDNS IP if the handshake is dormant.
        # Use
        #      "wg show WG_INTERFACE latest-handshakes"
        #      if [ latest handshake is > than say 135 ]; then force DDNS resolution of DDNS name to current IP Address
        #         "wg set WG_INTERFACE peer $PUB_KEY endpoint Peer_DDNS:nnnnn"
        #      fi
        #
        # see /jffs/addons/wireguard/wg_ChkEndpointDDNS.sh
        ENDPOINTS=$(awk -F'=' '/^Endpoint/ {print $2}' ${CONFIG_DIR}${WG_INTERFACE}.conf | sed 's/#.*//' | tr '\n' ' ') # v4.17.6 v4.15.3
        DDNS_FOUND=0
        for ENDPOINT in $ENDPOINTS
            do
                [ $(echo "$ENDPOINT" | tr ":" " " | wc -w) -gt 2 ] && continue                              # v4.15.3
                # So not IPv6...
                DDNS=$(echo "$ENDPOINT" | awk -F ":" '{print $1}')                                          # v4.15.3
                if [ -z "$(echo "$DDNS" | Is_IPv4_CIDR)" ] && [ -z "$(echo "$DDNS" | Is_IPv4)" ];then       # v4.15.3
                    DDNS_FOUND=1    # NOT IPv4 so must be DDNS so monitor it                                # v4.15.3
                    break
                fi
            done

        if [ $DDNS_FOUND -eq 1 ];then                                                                       # v4.15.3
            cru a WireGuard_ChkDDNS${WG_INTERFACE} "*/5 * * * * ${INSTALL_DIR}wg_ChkEndpointDDNS.sh $WG_INTERFACE"                      # v4.15.3
            logger -t "wg_manager-${MODE}${VPN_NAME}" "Endpoint DDNS refresh monitor started - cru #WireGuard_ChkDDNS${WG_INTERFACE}#."  # v4.15.3
        fi

        echo -en $cBGRE"\t"
        logger -st "wg_manager-${MODE}${VPN_NAME}" "Initialisation complete."
        echo -en $cRESET
    else
        echo -e "\a\n\t";logger -st "wg_manager-{$MODE}${VPN_NAME}" "Local Peer I/P endpoint ('${INSTALL_DIR}WireguardVPN.conf') not VALID. ABORTing Initialisation.\n"
    fi
else

    [ -n "$(wg show | grep "$VPN_ID")" ] && TERMINATED_TXT="Terminated" || TERMINATED_TXT="Already Terminated; Cleaned-up anyway!"
    # v4.14 Process 'PreDown' commands
    Process_Pre_Post_Commands "PreDown"

    cru d WireGuard_ChkDDNS${WG_INTERFACE}  # v4.15.3

    # User Exit @Torson
    if [ -f ${INSTALL_DIR}Scripts/${VPN_ID}-route-down.sh ];then
        logger -t "wg_manager-${MODE}${VPN_NAME}" "Executing Event:${VPN_ID}-route-down.sh"
        [ "$SHOWCMDS" == "Y" ] && echo -e "[+] ${VPN_ID}-route-down.sh"
        sh ${INSTALL_DIR}Scripts/${VPN_ID}-route-down.sh
    fi

    # If Policy mode, then there was no default route
    if [ -z "$POLICY_MODE" ];then                                   # v4.06
                                      # v4.08
        ip route del 0.0.0.0/1   dev $VPN_ID  2>/dev/null
        ip route del 128.0.0.0/1 dev $VPN_ID  2>/dev/null
        if [ "$USE_IPV6" == "Y" ];then
            ip -6 route del 0::/1    dev $VPN_ID   2>/dev/null      # v4.12
            ip -6 route del 8000::/1 dev $VPN_ID   2>/dev/null      # v4.12
            #cmd ip -6 route del ::/0 dev $VPN_ID 2>/dev/null
            #cmd ip -6 route del default dev $VPN_ID 2>/dev/null
            #IPV6PRIO=$(Manage_IPV6_PRIO "get" "$VPN_NUM")
            #cmd ip -6 rule del prio $IPV6PRIO
        fi

        for ALLOWIP in $(awk '/^AllowedIPs/ {$1="";$2="";print $0}' ${CONFIG_DIR}${VPN_ID}.conf | tr ',' ' ')   # v4.14
            do
                if [ "$USE_IPV6" == "Y" ] && [ -n "$(echo "$ALLOWIP" | grep -F ":")" ];then
                    ip -6 route del $ALLOWIP dev $VPN_ID 2>/dev/null
                else
                    if [ -n "$(echo "$ALLOWIP" | Is_IPv4_CIDR)" ] || [ -n "$(echo "$ALLOWIP" | Is_IPv4)" ];then
                        ip route del $ALLOWIP dev $VPN_ID 2>/dev/null
                    fi
                fi
            done

        # Set the default to the last ACTIVE WireGuard interface where the default route is required.
        # 'wg show interfaces' returns  list of Peers orfered oldest -> latest, so reverse the list so we traverse latest -> oldest
        for WG_IFACE in $(wg show interfaces | grep -E "wg1|wg0" | awk '{do printf "%s"(NF>1?FS:RS),$NF;while(--NF)}')      # v4.07
                do
                    [ "$WG_IFACE" == "$WG_INTERFACE" ] && continue
                    if [ -n "$(awk '/^AllowedIPs/ {print $3}' ${CONFIG_DIR}${WG_IFACE}.conf | grep -oE "0.0.0.0/0|::0/0")" ];then   # v4.07
                        if [ "$(sqlite3 $SQL_DATABASE "SELECT auto FROM clients where peer='$WG_IFACE';")" != "P" ];then
                            if [ -n "$(awk '/^AllowedIPs/ {print $3}' ${CONFIG_DIR}${WG_IFACE}.conf | grep -oE "0.0.0.0/0")" ];then
                                #ip route add 0/1    dev $WG_IFACE 2>/dev/null
                                #ip route add 128/1  dev $WG_IFACE 2>/dev/null
                                if [ -z "$(ip route show 0/1 | grep "dev $WG_IFACE")" ];then    # v4.16.11
                                    cmd ip route add 0/1    dev $WG_IFACE
                                    cmd ip route add 128/1  dev $WG_IFACE
                                fi
                            fi

                            if [ "$USE_IPV6" == "Y" ];then
                                if [ -n "$(awk '/^AllowedIPs/ {print $3}' ${CONFIG_DIR}${WG_IFACE}.conf | grep -oE "::0/0")" ];then
                                    #ip -6 route add 0::/1    dev $WG_IFACE
                                    #ip -6 route add 8000::/1 dev $WG_IFACE
                                    if [ -z "$(ip -6 route show ::/1 | grep "dev $WG_IFACE")" ];then    # v4.16.11
                                        cmd ip -6 route add 0::/1    dev $WG_IFACE
                                        cmd ip -6 route add 8000::/1 dev $WG_IFACE
                                    fi
                                fi
                            fi
                            break
                        fi
                    fi
                done
    fi

    if [ -n "$(wg show | grep "$VPN_ID")" ];then
        host="$(wg show $VPN_ID endpoints | sed -n 's/.*\t\(.*\):.*/\1/p')"
        if [ -n "$(echo "$host" | Is_IPv4)" ];then          # v4.14
            ip route del $host 2>/dev/null                  # v4.14
        else
            hostipv6="$(wg show $VPN_ID endpoints | grep -oE "\[.*\]" | sed 's/\[//g' | sed 's/\]//g')" # v4.14
            ip -6 route del $hostipv6 2>/dev/null                                                          # v4.14

        fi
        cmd ip link del dev $VPN_ID
        [ "$USE_IPV6" == "Y" ] && cmd ip -6 link del dev $VPN_ID 2>/dev/null
    fi

    TIMESTAMP=$(date +%s)
    sqlite3 $SQL_DATABASE "INSERT into session values('$WG_INTERFACE','End','$TIMESTAMP');" # v1.08
    sqlite3 $SQL_DATABASE "INSERT into traffic values('$WG_INTERFACE','$TIMESTAMP','*','*','*','*');"   # 4.12 @ZebMcKayhan

    Firewall_delete

    if [ -n "$(echo "$VPN_NUM" | grep -oE '^[0-9]+$')" ]; then      # v4.10
        ip rule del from $(nvram get lan_ipaddr | cut -d"." -f1-3).0/24 table 12$VPN_NUM prio 992$VPN_NUM   2>/dev/null
        ip route flush table 12$VPN_NUM 2>/dev/null
        unset DONE;while [ -z ${DONE+x} ];do ip rule del prio 99${VPN_NUM}1 2>/dev/null;[ $? -gt 0 ] && DONE=1;done # v4.16.19
        unset DONE;while [ -z ${DONE+x} ];do ip rule del prio 998${VPN_NUM} 2>/dev/null;[ $? -gt 0 ] && DONE=1;done # v4.16.19
        purge_client_list                                           # v4.09

        ip route flush cache
    fi

    if [ "$USE_IPV6" == "Y" ];then
        if [ -n "$(echo "$VPN_NUM" | grep -oE '^[0-9]+$')" ]; then      # v4.10
            ip -6 rule del from $(nvram get ipv6_rtr_addr | sed 's/::/|/' | cut -d"|" -f1)::0/64 table 12$VPN_NUM prio 992$VPN_NUM   2>/dev/null # v4.11
            ip -6 rule del from $(nvram get ipv6_prefix)/$(nvram get ipv6_prefix_length) table 12$VPN_NUM prio 992$VPN_NUM   2>/dev/null
            ip -6 route flush table 12$VPN_NUM 2>/dev/null
            unset DONE;while [ -z ${DONE+x} ];do ip -6 rule del prio 99${VPN_NUM}1 2>/dev/null;[ $? -gt 0 ] && DONE=1;done  # v4.16.18
            unset DONE;while [ -z ${DONE+x} ];do ip -6 rule del prio 998${VPN_NUM} 2>/dev/null;[ $? -gt 0 ] && DONE=1;done  # v4.16.18
            #IPV6PRIO==$(Manage_IPV6_PRIO "get" "$VPN_NUM")  # v4.16
            #ip -6 rule del prio $IPV6PRIO 2>/dev/null       # v4.16
            ip -6 route flush cache 2>/dev/null
        fi
    fi

    IPSETS=$(sqlite3 $SQL_DATABASE "SELECT ipset FROM ipset WHERE peer='${WG_INTERFACE}';" | tr '\n' ' ')
    for IPSET in $IPSETS
        do
            DSTSRC=$(sqlite3 $SQL_DATABASE "SELECT dstsrc FROM ipset WHERE ipset='$IPSET' AND peer='${WG_INTERFACE}';")
            FWMARK=$(sqlite3 $SQL_DATABASE "SELECT fwmark FROM ipset WHERE ipset='$IPSET' AND peer='${WG_INTERFACE}';")
            TAG_MARK=$(sqlite3 /opt/etc/wireguard.d/WireGuard.db "select fwmark from fwmark where peer='${WG_INTERFACE}';") # v4.12                                                                                                             # v4.12
            ip rule del from 0/0 fwmark $TAG_MARK"/"$TAG_MARK table 12$VPN_NUM prio 999$VPN_NUM   2>/dev/null               # v4.12

            iptables -t mangle -D PREROUTING -m set --match-set $IPSET $DSTSRC -j MARK --set-mark ${FWMARK}/${FWMARK} -m comment --comment "WireGuard 'client'" 2>/dev/null # v4.12

            if [ "$USE_IPV6" == "Y" ];then
                ip6tables -t mangle -D PREROUTING -m set --match-set $IPSET $DSTSRC -j MARK --set-mark ${FWMARK}/${FWMARK} -m comment --comment "WireGuard 'client'" 2>/dev/null    # v4.12
            fi
            logger -t "wg_manager-${MODE}${VPN_NAME}" "Removing IPSet '$IPSET' routing through VPN 'client' Peer" $WG_INTERFACE
        done

    # PASSTHRU ?
    Manage_Passthru "del"

    # User Exit @ZebMcKayhan
    if [ -f ${INSTALL_DIR}Scripts/${VPN_ID}-down.sh ];then
        logger -t "wg_manager-${MODE}${VPN_NAME}" "Executing Event:${VPN_ID}-down.sh"
        [ "$SHOWCMDS" == "Y" ] && echo -e "[+] ${VPN_ID}-down.sh"
        sh ${INSTALL_DIR}Scripts/${VPN_ID}-down.sh
    fi

    #mv /tmp/resolv.dnsmasq_backup.$WG_INTERFACE /tmp/resolv.dnsmasq 2>/dev/null
    #service restart_dnsmasq 2>&1 1>/dev/null
                                          # v4.08
        if [ -n "$(echo "$VPN_NUM" | grep -oE '^[0-9]+$')" ]; then      # v4.10
            iptables -t nat -F WGDNS$VPN_NUM 2>/dev/null                # v4.05
            iptables -t nat -X WGDNS$VPN_NUM 2>/dev/null                # v4.05
            if [ "$USE_IPV6" == "Y" ];then
                ip6tables -t nat -F WGDNS$VPN_NUM 2>/dev/null          # v4.13
                ip6tables -t nat -X WGDNS$VPN_NUM  2>/dev/null          # v4.13
            fi
        fi
    # else
        # if [ -n "$(echo "$VPN_NUM" | grep -oE '^[0-9]+$')" ]; then      # v4.10
            # ip6tables -t nat -F WGDNS$VPN_NUM 2>/dev/null               # v4.05
            # ip6tables -t nat -X WGDNS$VPN_NUM 2>/dev/null               # v4.05
        # else
            # ip6tables -t nat -F WGDNS$WG_INTERFACE 2>/dev/null          # v4.10
            # ip6tables -t nat -X WGDNS$WG_INTERFACE 2>/dev/null          # v4.0
        # fi
    #fi

    # v4.14 Process 'PostDown' commands
    Process_Pre_Post_Commands "PostDown"

    rm /tmp/$VPN_ID.* 2>/dev/null

    logger -t "wg_manager-${MODE}${VPN_NAME}" "WireGuard® VPN '$MODE' Peer ($VPN_ID) $TXT $SOCKET ($DESC) $TERMINATED_TXT"
    echo -en ${cRESET}"\n"
    echo -e $cBGRE"\twg_manager-${MODE}${VPN_NAME}: WireGuard® VPN '$MODE' Peer (${cBMAG}$VPN_ID${cBGRE}) $TXT $SOCKET (${cBMAG}$DESC${cBGRE}) ${cRED}$TERMINATED_TXT"${cRESET}

fi


#) 2>&1 | logger -t $(basename $0)"[$$_***DEBUG]"


exit