wg_server

#!/bin/sh
# shellcheck disable=SC2039,SC2155,SC2124
VERSION="v4.17.1"
#============================================================================================ © 2021-2022 Martineau v4.17.1
#

# Maintainer: Martineau
# Last Updated Date: 01-Jul-2022
#
# Description:
#
# Acknowledgement:
#
# Contributors: odkrys,ZebMcKayhan,Torson,chongnt,Bearnet

# shellcheck disable=SC2034,SC2120
ANSIColours() {

    local ACTION=$1

    cRESET=
    aBOLD=;aDIM=;aUNDER=;aBLINK=;aREVERSE=
    aBOLDr=;aDIMr=;aUNDERr=;aBLINKr=;aREVERSEr=

    cBLA=;cRED=;cGRE=;cYEL=;cBLU=;cMAG=;cCYA=;cGRA=;cFGRESET=
    cBGRA=;cBRED=;cBGRE=;cBYEL=;cBBLU=;cBMAG=;cBCYA=;cBWHT=
    cWRED=;cWGRE=;cWYEL=;cWBLU=;cWMAG=;cWCYA=;cWGRA=
    cYBLU=
    cRED_=;cGRE_=

    if [ "$ACTION" != "disable" ];then
        cRESET="\e[0m";
        aBOLD="\e[1m";aDIM="\e[2m";aUNDER="\e[4m";aBLINK="\e[5m";aREVERSE="\e[7m"
        aBOLDr="\e[21m";aDIMr="\e[22m";aUNDERr="\e[24m";aBLINKr="\e[25m";aREVERSEr="\e[27m"
        cBLA="\e[30m";cRED="\e[31m";cGRE="\e[32m";cYEL="\e[33m";cBLU="\e[34m";cMAG="\e[35m";cCYA="\e[36m";cGRA="\e[37m";cFGRESET="\e[39m"
        cBGRA="\e[90m";cBRED="\e[91m";cBGRE="\e[92m";cBYEL="\e[93m";cBBLU="\e[94m";cBMAG="\e[95m";cBCYA="\e[96m";cBWHT="\e[97m"
        aBOLD="\e[1m";aDIM="\e[2m";aUNDER="\e[4m";aBLINK="\e[5m";aREVERSE="\e[7m"

        cWRED="\e[41m";cWGRE="\e[42m";cWYEL="\e[43m";cWBLU="\e[44m";cWMAG="\e[45m";cWCYA="\e[46m";cWGRA="\e[47m"
        cYBLU="\e[93;48;5;21m"
        cRED_="\e[41m";cGRE_="\e[42m"
    fi

    xHOME="\e[H";xERASE="\e[2J";xERASEDOWN="\e[J";xERASEUP="\e[1J";xCSRPOS="\e[s";xPOSCSR="\e[u";xERASEEOL="\e[K";xQUERYCSRPOS="\e[6n"
    xGoto="\e[Line;Columnf"
}
Is_IPv4() {
        grep -oE '^([0-9]{1,3}\.){3}[0-9]{1,3}$'                    # IPv4 format
}
Is_IPv4_CIDR () {
        grep -oE '^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$'         # IPv4 CIDR range notation
}
Is_IPv6() {
    # Note this matches compression anywhere in the address, though it won't match the loopback address ::1
    grep -oE '([A-Fa-f0-9]{1,4}::?){1,7}[A-Fa-f0-9]{1,4}'       # IPv6 format -very crude
}
Is_Private_IPv6 () {
    grep -oE "(::1$)|([fF][cCdD])"
}
Get_WAN_IF_Name () {

    # echo $([ -n "$(nvram get wan0_pppoe_ifname)" ] && echo $(nvram get wan0_pppoe_ifname) || echo $(nvram get wan0_ifname))
    #   nvram get wan0_gw_ifname
    #   nvram get wan0_proto

    local IF_NAME=$(ip route | awk '/^default/{print $NF}')     # Should ALWAYS be 100% reliable ?

    local IF_NAME=$(nvram get wan0_ifname)                      # ...but use the NVRAM e.g. DHCP/Static ?

    # Usually this is probably valid for both eth0/ppp0e ?
    if [ "$(nvram get wan0_gw_ifname)" != "$IF_NAME" ];then
        local IF_NAME=$(nvram get wan0_gw_ifname)
    fi

    if [ ! -z "$(nvram get wan0_pppoe_ifname)" ];then
        local IF_NAME="$(nvram get wan0_pppoe_ifname)"          # PPPoE
    fi

    echo $IF_NAME
}
Firewall_delete() {

    iptables -t mangle -D PREROUTING -i $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'server'" 2>/dev/null
    iptables -t mangle -D FORWARD -o $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'server'" 2>/dev/null
    iptables -t mangle -D FORWARD -i $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'server'" 2>/dev/null
    iptables -t mangle -D FORWARD -o $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'server'" 2>/dev/null

    iptables -D INPUT -p udp --dport $wgport -j ACCEPT -m comment --comment "WireGuard 'server'" 2>/dev/null
    iptables -D INPUT -i $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'" 2>/dev/null
    iptables -D FORWARD -i $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'" 2>/dev/null
    iptables -D FORWARD -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'" 2>/dev/null
    iptables -D FORWARD -i br0 -o $VPN_ID -j ACCEPT -m comment --comment "LAN to WireGuard 'server clients'" 2>/dev/null
    iptables -D OUTPUT -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'" 2>/dev/null
    iptables -t nat -D PREROUTING -p udp --dport $wgport -j ACCEPT -m comment --comment "WireGuard 'server'" 2>/dev/null

    local LOCALIPS=${SUBNET//,/ }                               # v4.16.4 v4.11
    for THIS in $LOCALIPS                                       # v4.11
        do                                                      # v4.11
            if [ -z "$(echo "$THIS" | grep -F ":")" ] ;then     # v4.11
                iptables -t nat -D POSTROUTING -s $THIS -o wg1+ -j MASQUERADE -m comment --comment "WireGuard 'server'"  2>/dev/null  # v1.11
                iptables -t nat -D POSTROUTING -s $THIS -o br0 -j MASQUERADE -m comment --comment "WireGuard 'server clients to LAN'" 2>/dev/null # v4.14.2
            fi
        done

    if [ "$(nvram get ipv6_service)" != "disabled" ];then
        ip6tables -t mangle -D PREROUTING -i $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'server'" 2>/dev/null
        ip6tables -t mangle -D FORWARD -o $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'server'" 2>/dev/null
        ip6tables -t mangle -D FORWARD -i $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'server'" 2>/dev/null
        ip6tables -t mangle -D FORWARD -o $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'server'" 2>/dev/null

        ip6tables -D INPUT -p udp --dport $wgport -j ACCEPT -m comment --comment "WireGuard 'server'" 2>/dev/null
        ip6tables -D INPUT -i $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'" 2>/dev/null
        ip6tables -D FORWARD -i $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'" 2>/dev/null
        ip6tables -D FORWARD -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'" 2>/dev/null
        ip6tables -D FORWARD -i br0 -o $VPN_ID -j ACCEPT -m comment --comment "LAN to WireGuard 'server clients'" 2>/dev/null
        ip6tables -D OUTPUT -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'" 2>/dev/null
        ip6tables -t nat -D PREROUTING -p udp --dport $wgport -j ACCEPT -m comment --comment "WireGuard 'server'" 2>/dev/null   # v4.14.1

        local LOCALIPS=${SUBNET//,/ }                               # v4.16.4 v4.11
        for THIS in $LOCALIPS                                       # v4.11
            do                                                      # v4.11
                if [ -n "$(echo "$THIS" | grep -F ":")" ] ;then     # v4.11
                    ip6tables -t nat -D POSTROUTING -s $THIS -o wg1+ -j MASQUERADE -m comment --comment "WireGuard 'server'"  2>/dev/null # v4.14.1
                    ip6tables -t nat -D POSTROUTING -s $THIS -o br0 -j MASQUERADE -m comment --comment "WireGuard 'server clients to LAN'"  2>/dev/null  # v4.14.1
                fi
            done
    fi
}
Manage_Passthru() {

    local PASSTHRU_CLIENTS=$(sqlite3 $SQL_DATABASE "SELECT client FROM passthru where server='$WG_INTERFACE';" | sort | uniq | tr '\n' ' ')
    local VPN_ID=           # v4.13 Fix @chongnt

    local ACTION="add"
    [ -n "$1" ] && ACTION=$1        # "del" or "add"

    if [ -n "$PASSTHRU_CLIENTS" ];then

        local IP_ADDR=$(sqlite3 $SQL_DATABASE "SELECT subnet FROM servers where peer='$WG_INTERFACE';")

        for VPN_ID in $PASSTHRU_CLIENTS     # wg11 wg14
            do
                local VPN_NUM=${VPN_ID#"${VPN_ID%?}"}
                local TABLE=12$VPN_NUM
                [ "$VPN_ID" == "wan" ] && TABLE="main"

                if [ "$ACTION" == "add" ];then
                    if [ "$VPN_ID" != "wan" ];then
                        # Ensure target WireGuard 'client' peer routing policy table contains WireGuard 'server' peer IP/network in the passthru tunnel @chongnt
                        while read ROUTE; do
                            cmd ip route $ACTION $ROUTE table $TABLE 2>/dev/null && FLUSH="Y"
                        done << EOR
$(ip route | grep "$WG_INTERFACE")
EOR
                        if [ "$USE_IPV6" == "Y" ];then                  # v4.16.9
                            # Ensure target WireGuard 'client' peer IPv6 routing policy table contains WireGuard 'server' peer IP/network in the passthru tunnel @chongnt
                            while read ROUTE; do
                                cmd ip -6 route $ACTION $ROUTE table $TABLE 2>/dev/null && FLUSH="Y"
                            done << EOR
$(ip -6 route | grep "$WG_INTERFACE")
EOR
                        fi
                    fi

                    for PASSTHRU_IP in $(echo "$IP_ADDR" | tr ',' ' ')                              # v4.16.11
                        do
                            [ -z "$(echo "$PASSTHRU_IP"  | grep -F ":")" ] && cmd ip rule $ACTION from $PASSTHRU_IP table $TABLE prio 998$VPN_NUM     # v4.16.11 v4.14 v4.13 Fix @chongnt
                            if [ "$USE_IPV6" == "Y" ] && [ -n "$(echo "$PASSTHRU_IP"  | grep -F ":")" ];then    # v4.16.11
                                cmd ip -6 rule $ACTION from $PASSTHRU_IP table $TABLE prio 998$VPN_NUM          # v4.16.11 v4.16.9
                                DASH6="-6 "                                                                     # v4.16.11
                            fi
                            logger -t "wg_manager-${MODE}${VPN_NAME}" "'client' peer ($PASSTHRU_CLIENTS) RPDB" "'pass-thru': 'ip ${DASH6}rule $ACTION from $PASSTHRU_IP table $TABLE'"
                            DASH6=                                                                              # v4.16.11
                        done
                else
                    ip rule $ACTION from $IP_ADDR table $TABLE prio 998$VPN_NUM 2>/dev/null     # v4.14
                    [ "$USE_IPV6" == "Y" ] && ip -6 rule $ACTION from $IP_ADDR table $TABLE prio 998$VPN_NUM 2>/dev/null    # v4.16.9
                fi
            done

            if [ "$FLUSH" == "Y" ];then
                #ip route show cache
                cmd ip route flush cache
                if [ "$USE_IPV6" == "Y" ];then
                    #ip -6 route show cache
                    # The following ALWAYS issues
                    #   'Failed to send flush request: No such process', so try it anyway, a reboot will fix it!
                    [ "$SHOWCMDS" == "Y" ] && echo -e "[?] ip -6 route flush cache $cBRED>>>>'Failed to send flush request: No such process'$cRESET.....ALWAYS FAILS!!!!"
                    ip -6 route flush cache 2>/dev/null              # v4.16.7
                fi
            #else
                #logger -st "wg_manager-${MODE}${VPN_NAME}" "Warning 'server' peer ($PASSTHRU_SERVER) route not found - is it UP? FLUSH="$FLUSH
            fi
    fi
}
Process_Pre_Post_Commands() {
    # v4.14.1
    while read LINE; do
            local CMDTYPE=$1
            local CMD="$(echo "$LINE" | sed "s/\%wan/$WAN_IF/g;s/\%net/$SUBNET_PREFIX4/g;s/\%lan/$LAN_PREFIX/g;s/\%pos/$POS/g;s/\%p/$LISTEN_PORT/g;s/\%i/$WG_INTERFACE/g")"    # v4.14.4 v4.14.1
            if [ -n "$CMD" ];then
                logger -t "wg_manager-${MODE}${VPN_NAME}" "Executing $CMDTYPE: '$CMD'"
                [ "$SHOWCMDS" == "Y" ] && echo -e "[>] ${CMDTYPE}" >&2
                if [ -n "$(echo "$CMDTYPE" | grep "Up")" ];then             # v4.4.4
                    cmd $CMD
                else
                    $CMD 2>/dev/null                                        # v4.4.4
                fi

            fi
    done << EOR
$(grep -E "^${1}" ${CONFIG_DIR}${WG_INTERFACE}.conf | tr ';' '\n' | sed 's/^.*=//')
EOR

}
Firewall_Rule_Exists() {

    local CMD="$@"
    local RULE_EXISTS="N"

    local CHECK_DUPLICATE=$(echo "$CMD" | sed 's/-[IA]/-C/')
    if [ -z "$(echo "$CMD" | grep -Fo "comment" )" ];then
        $CHECK_DUPLICATE -m comment --comment "WireGuard 'server'" 2>/dev/null
        RC=$?
        [ $RC -eq 0 ] && local RULE_EXISTS="Y"
    fi
    if [ "$RULE_EXISTS" == "N" ];then
        $CHECK_DUPLICATE 2>/dev/null
        RC=$?
        [ $RC -eq 0 ] && local RULE_EXISTS="Y"
    fi

    echo "$RULE_EXISTS"
}
cmd() {

    local CMD=$(echo "$@" | awk '{print $1}')

    [ "$SHOWCMDS" == "Y" ] && echo "[#] $*" >&2     # v4.15.1

    case $CMD in
        *tables*)
            if [ "$(Firewall_Rule_Exists "$@")" == "Y" ];then
                #logger -t "wg_manager-${MODE}${VPN_NAME}" "..........duplicate; skipped!"
                # shellcheck disable=SC2034
                DEBUG_DUPLICATE="======================================================= $@"
                return
            fi
        ;;
    esac

    "$@"
}
#For verbose debugging, uncomment the following two lines, and uncomment the last line of this script
#set -x
#(

Main() { true; }            # Syntax that is Atom Shellchecker compatible!



SQL_DATABASE="/opt/etc/wireguard.d/WireGuard.db"        # v1.13
CONFIG_DIR="/opt/etc/wireguard.d/"                 # Conform to "standards"         # v1.08 @elorimer
INSTALL_DIR="/jffs/addons/wireguard/"

LANIPADDR=$(nvram get lan_ipaddr)
LAN_PREFIX=${LANIPADDR%.*}
POS=$(($(iptables -nvL FORWARD --line -t filter | grep -Em 1 ".*\*.*\*.*state.*ESTABLISHED" | cut -d' ' -f1)+1))

VPN_ID=$1
[ -z "$1" ] && VPN_ID="wg21"

VPN_NAME=$VPN_ID

if [ -f ${INSTALL_DIR}WireguardVPN.conf ] && [ -z "$(grep -E "^NOCOLOR|^NOCOLOUR" ${INSTALL_DIR}WireguardVPN.conf)" ];then     # v4.15.4
    ANSIColours
fi

[ ! -f ${CONFIG_DIR}${VPN_ID}.conf ] && { echo -e $cBRED"\a\n\t***ERROR $cBWHT'${CONFIG_DIR}${VPN_ID}.conf'$cBRED not found"; exit 99 ;}    # v4.16.6

modprobe xt_set
modprobe xt_comment                                                                 # v1.13 Hotfix

[ -n "$(echo "$@" | grep "debug")" ] && SHOWCMDS="Y"                        # v4.14.4

[ -n "$(echo "$@" | grep "wg-quick")" ] && EXECUTE="wg-quick"               # v4.14.5

WG_INTERFACE=$VPN_ID
VPN_NUM=${VPN_ID#"${VPN_ID%?}"}                     # v4.02

WAN_IF=$(Get_WAN_IF_Name)

wgport=$(awk '/^Listen/ {print $3}' ${CONFIG_DIR}${VPN_ID}.conf)        # v4.14.4
SUBNET=$(sqlite3 $SQL_DATABASE "SELECT subnet FROM servers where peer='$WG_INTERFACE';") # v1.09 @here1310

SOCKET=$(nvram get wan0_gateway)":"$wgport          # v4.04

DESC=$(sqlite3 $SQL_DATABASE "SELECT tag FROM servers where peer='$WG_INTERFACE';")
DESC=$(printf "%s" "$DESC" | sed 's/^[ \t]*//;s/[ \t]*$//')

[ -z "$DESC" ] && DESC="# Unidentified"

IPV6_SERVICE=$(nvram get ipv6_service)          # v4.14.1
if [ "$IPV6_SERVICE" != "disabled" ];then       # v4.1
    case $IPV6_SERVICE in
        native|ipv6pt|dhcp6|6to4|6in4|6rd)
            # ip -6 addr | grep "scope global"
            USE_IPV6="Y"; IPV6_TXT="(IPv6) "    # 4.08
            LAN_SUBNET_IPV6=$(nvram get ipv6_prefix)        # v4.14.6
            LAN_ADDR_IPV6=$(nvram get ipv6_rtr_addr)        # v4.14.6
        ;;
        other)
            :
        ;;
        spoof|simulate)
            USE_IPV6="Y"; IPV6_TXT="(IPv6) Simulate "   # v4.14
        ;;
    esac
fi

# Override IPv6 ?
if [ -f /jffs/addons/wireguard/WireguardVPN.conf ] && [ -n "$(grep -E "^NOIPV6" /jffs/addons/wireguard/WireguardVPN.conf)" ];then    # v4.12
    USE_IPV6="N"; IPV6_TXT=
    logger -t "wg_manager-${MODE}${VPN_NAME}" "'NOIPV6' directive found ('WireguardVPN.conf')- IPv6 configuration forced to IPv4"    # v4.12
fi

WAN_IPV4=$(ip -4 addr | sed -ne 's|^.* inet  \([^/]*\)/.* scope global.*$|\1|p' | awk '{print $1}' | head -1)           # v4.14.1
[ "$USE_IPV6" == "Y" ] && { WAN_IPV6=$(ip -6 addr | sed -ne 's|^.* inet6 \([^/]*\)/.* scope global.*$|\1|p' | head -1); IPV6_TXT=$IPV6_TXT"[$WAN_IPV6] ";  }  # v4.14.1

if [ "$USE_IPV6" != "Y" ];then
    # CIDR ?
    if [ -z "$(echo "$SUBNET" | Is_IPv4_CIDR)" ];then
        SUBNET_PREFIX=${SUBNET%.*}
        SUBNET=$SUBNET_PREFIX".0/24"
        IPV6_TXT=                       # v4.16.1
    fi
fi

LISTEN_PORT=$(awk '/^ListenPort/ {print $3}' ${CONFIG_DIR}${WG_INTERFACE}.conf)

ADDRESS_TXT=                                                    # v4.16.1
for THIS in ${SUBNET//,/ }                                      # v4.16.4 v4.16.1
    do                                                          # v4.16.1
        IP=${THIS%/*}
        [ -n "$(echo "$IP" | grep -F ":")" ] && IP="[$IP]" || SUBNET_PREFIX4=${IP%.*}     # v4.16.4
        [ -n "$ADDRESS_TXT" ] && ADDRESS_TXT=${ADDRESS_TXT}","${IP} || ADDRESS_TXT=${IP}    # v4.16.1
    done

ADDRESS_TXT=$ADDRESS_TXT":"$LISTEN_PORT                         # v4.16.1

if [ "$2" != "disable" ];then

    logger -t "wg_manager-server${VPN_NAME}" "Initialising WireGuard® VPN ${IPV6_TXT}'Server' Peer ($VPN_ID) on $ADDRESS_TXT"       # v4.16.1 @ZebMcKayhan
    echo -e $cBCYA"\twg_manager-server${VPN_NAME}: Initialising WireGuard® VPN ${IPV6_TXT}'Server' Peer (${cBMAG}${VPN_ID}${cBCYA}) on $ADDRESS_TXT (${cBMAG}${DESC}${cBCYA})"$cRESET   # v4.16.1 @ZebMcKayhan

    ip link del dev $VPN_ID 2>/dev/null
    cmd ip link add dev $VPN_ID type wireguard
    if [ "$USE_IPV6" == "Y" ];then              # v4.05
        ip -6 link del dev $VPN_ID 2>/dev/null
        cmd ip -6 link add dev $VPN_ID type wireguard
    fi

    cmd wg set $VPN_ID fwmark $wgport

    grep -v "#" ${CONFIG_DIR}$VPN_ID.conf | sed '/^DNS/d; /^MTU/d; /^Address/d; /^PreU/d; /^PreD/d; /^Post/d; /^Table/d; /^SaveC/d; /^FWmark/d' > /tmp/$VPN_ID.$$   # v4.16.2
    [ "$SHOWCMDS" == "Y" ] && echo -e "[#] wg setconf $VPN_ID /tmp/$VPN_ID.$$ #(${CONFIG_DIR}$VPN_ID.conf)"    # v.4.16.3 v4.14.5

    echo -en ${cWRED}
    wg setconf $VPN_ID /tmp/$VPN_ID.$$                                                      # v4.16.2
    if [ $? -ne 0 ];then                                                                    # v4.14.5
        # Syntax ERROR?
        # e.g. Endpoint DDNS not valid/resolved?
        echo -en $cRESET
        cmd ip link del dev $VPN_ID                                                         # v4.14.5
        [ "$USE_IPV6" == "Y" ] && cmd ip -6 link del dev $VPN_ID
        logger -t "wg_manager-server${VPN_NAME}" "***ERROR Initialisation ABORTED"         # v4.14.5
        echo -e ${cRESET}$cBRED"\a\n\t***ERROR Initialisation ABORTED - 'wg setconf $VPN_ID /tmp/$VPN_ID.$$ (${CONFIG_DIR}$VPN_ID.conf)' FAILED\n"$cRESET

        echo -en $cRESET
        exit 1                                                                              # v4.14.5
    fi

    echo -en $cRESET

    # v4.14 Process 'PreUp' commands
    Process_Pre_Post_Commands "PreUp"   # v4.14.1

    cmd ip link set up dev $VPN_ID
    if [ "$USE_IPV6" == "Y" ] && [ -n "$(echo "$SUBNET" | grep ":")" ];then         # v4.05
        cmd ip -6 link set up dev $VPN_ID
    fi

    # v4.12 Assign both IPv4 and IPv6 IPs to interface as required
    LOCALIPS=$(echo "$SUBNET" | tr ',' ' ')

    for LOCALIP in $LOCALIPS                                                                # v4.10
        do
            if [ "$USE_IPV6" == "Y" ] && [ -n "$(echo "$LOCALIP" | grep -F ":")" ];then     # v4.10
                # Assumed Private IPv6 but user may have created 'server' Peer with non-Private IPv6?   # v4.16.1
                cmd ip -6 address add dev $VPN_ID $LOCALIP                                  # v4.10
            else
                if [ -n "$(echo "$LOCALIP" | Is_IPv4_CIDR)" ] || [ -n "$(echo "$LOCALIP" | Is_IPv4)" ];then
                    cmd ip address add dev $VPN_ID $LOCALIP                                 # v4.10
                fi
            fi
        done

    #MTU=$(awk '/^#?MTU/ {print $3}' ${CONFIG_DIR}${VPN_ID}.conf)            # v4.15.7 @Bearnet
    MTU=$(awk '/^MTU/ {print $3}' ${CONFIG_DIR}${VPN_ID}.conf)            # v4.16.1 v4.15.7 @Bearnet
    if [ -z "$MTU" ];then
        cmd ifconfig $VPN_ID mtu 1420                           # v4.15.5
    else
        cmd ifconfig $VPN_ID mtu $MTU                           # v4.15.5 v1.02
        sed -i 's/^MTU/#MTU/' ${CONFIG_DIR}${VPN_ID}.conf
    fi

    TIMESTAMP=$(date +%s)
    sqlite3 $SQL_DATABASE "INSERT into session values('$WG_INTERFACE','Start','$TIMESTAMP');"   # v1.13
    # Site-to-Site identify remote site peer
    # Extract '# Cabin LAN'
    if [ "$(sqlite3 $SQL_DATABASE "SELECT auto FROM servers WHERE peer='$WG_INTERFACE';")" == "S" ];then    # v4.15.1
        SITE2SITE_PEER=$(awk '/^#.*LAN/ {print $2}' ${CONFIG_DIR}${WG_INTERFACE}.conf )                     # v4.15.1
        sqlite3 $SQL_DATABASE "INSERT into traffic values('$SITE2SITE_PEER','$TIMESTAMP','*','*','*','*');" # v4.15.1

        # What if the Remote Site-to-Site Peer acquires a new IP address after the initial handshake?
        # (NOTE: Mullvad Endpoints seem to be IPv4 address rather than DDNS name)
        # Need a monitor that refreshes the Remote DDNS IP if the handshake is dormant.
        # Use
        #      "wg show WG_INTERFACE latest-handshakes"
        #      if [ latest handshake is > than say 135 ]; then force resolution of DDNS name to it's current IP Address
        #         "wg set WG_INTERFACE peer $PUB_KEY endpoint SiteA_DDNS:51820"
        #      fi
        #
        # see /jffs/addons/wireguard/wg_ChkEndpointDDNS.sh
        ENDPOINTS=$(awk '/^Endpoint/ {print $3}' ${CONFIG_DIR}${WG_INTERFACE}.conf | tr '\n' ' ')           # v4.15.8
        DDNS_FOUND=0
        for ENDPOINT in $ENDPOINTS
            do
                [ "$(echo "$ENDPOINT" | tr ":" " " | wc -w)" -gt 2 ] && continue                              # v4.15.8
                # So not IPv6...
                DDNS=$(echo "$ENDPOINT" | awk -F ":" '{print $1}')                                          # v4.15.8
                if [ -z "$(echo "$DDNS" | Is_IPv4_CIDR)" ] && [ -z "$(echo "$DDNS" | Is_IPv4)" ];then       # v4.15.8
                    DDNS_FOUND=1    # NOT IPv4 so must be DDNS so monitor it                                # v4.15.8
                    break
                fi
            done

        if [ $DDNS_FOUND -eq 1 ];then                                                                       # v4.15.3
            cru a WireGuard_ChkDDNS${WG_INTERFACE} "*/5 * * * * ${INSTALL_DIR}wg_ChkEndpointDDNS.sh $WG_INTERFACE"  # v4.15.3
            logger -t "wg_manager-server${VPN_NAME}" "Endpoint DDNS refresh monitor started - cru #WireGuard_ChkDDNS${WG_INTERFACE}#."
        fi
    fi

    cmd ifconfig $VPN_ID txqueuelen 1000

    Firewall_delete

    if [ "$EXECUTE" != "wg-quick" ];then

        cmd ip route add default dev $VPN_ID table 2${VPN_NUM}"0"       # v4.03
        # shellcheck disable=SC2046
        cmd ip rule add fwmark $(printf "%#07x\n" "2${VPN_NUM}0") table 2${VPN_NUM}"0" prio 98${VPN_NUM}0   # v4.03
        if [ "$USE_IPV6" == "Y" ];then                              # v4.05
            cmd ip -6 route add default dev $VPN_ID table 2${VPN_NUM}"0"    # v4.03
            # shellcheck disable=SC2046
            cmd ip -6 rule add fwmark $(printf "%#07x\n" "2${VPN_NUM}0") table 2${VPN_NUM}"0" prio 98${VPN_NUM}0   # v4.03
        fi

        #Manage_Passthru "add"

        if [ -f /jffs/addons/wireguard/WireguardVPN.conf ] && [ -z "$(grep -E "^NOTCPMSS" /jffs/addons/wireguard/WireguardVPN.conf)" ];then    # v4.12
            cmd iptables -t mangle -I FORWARD -o $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'server'"
            cmd iptables -t mangle -I FORWARD -i $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'server'"
        else
            logger -t "wg_manager-${MODE}${VPN_NAME}" "'NOTCPMSS' directive found ('WireguardVPN.conf') -t mangle FORWARD chain TCP '-j TCPMSS --clamp-mss-to-pmtu' NOT configured"    # v4.12
        fi
        if [ -f /jffs/addons/wireguard/WireguardVPN.conf ] && [ -z "$(grep -E "^NOSETXMARK" /jffs/addons/wireguard/WireguardVPN.conf)" ];then    # v4.12
            cmd iptables -t mangle -I FORWARD -o $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'server'"
            cmd iptables -t mangle -I PREROUTING -i $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'server'"
        else
            logger -t "wg_manager-${MODE}${VPN_NAME}" "'NOSETXMARK' directive found ('WireguardVPN.conf') -t mangle FORWARD/PREROUTING chain'-j MARK --set-xmark 0x01/0x7' NOT configured"    # v4.12
        fi

        cmd iptables -I INPUT -p udp --dport $wgport -j ACCEPT -m comment --comment "WireGuard 'server'"
        cmd iptables -I INPUT -i $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'"
        #cmd iptables -I FORWARD -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'"

        if [ -z "$(iptables-save | grep WGM_ACL)" ];then    # v4.16
            cmd iptables -N WGM_ACL_F 2>/dev/null           # v4.16
            cmd iptables -I FORWARD "$(($(iptables -nvL FORWARD --line -t filter | grep -Em 1 ".*\*.*\*.*state.*ESTABLISHED" | cut -d' ' -f1)+1))" -i wg+ -j WGM_ACL_F -m comment --comment "Wireguard ACL"        # v4.16
        fi

        POS=$(($(iptables -nvL FORWARD --line -t filter | grep -Em 1 ".*WGM_ACL_F" | cut -d' ' -f1)+1)) # v4.16.3
        cmd iptables -I FORWARD $POS -i $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'"     # # v4.16.3 v4.15.10 @ZebMcKayhan
        cmd iptables -I FORWARD $POS -i br0 -o $VPN_ID -j ACCEPT -m comment --comment "LAN to WireGuard 'server clients'"    # # v4.16.3 v4.14.1

        cmd iptables -I OUTPUT -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'"
        cmd iptables -t nat -I PREROUTING -p udp --dport $wgport -j ACCEPT -m comment --comment "WireGuard 'server'"

        for THIS in ${SUBNET//,/ }                                  # v4.16.4 v4.15.10
            do
                if [ -z "$(echo "$THIS" | grep -F ":" )" ];then     # v4.15.10
                    cmd iptables -t nat -I POSTROUTING -s $THIS -o br0 -j MASQUERADE -m comment --comment "WireGuard 'server clients to LAN'" # v4.14.2
                else
                    cmd ip6tables -t nat -I POSTROUTING -s $THIS -o br0 -j MASQUERADE -m comment --comment "WireGuard 'server clients to LAN'"  # v4.15.11 @ZebMcKayhan
                fi
            done

        if [ "$USE_IPV6" == "Y" ];then                          # v4.05
            if [ -f /jffs/addons/wireguard/WireguardVPN.conf ] && [ -z "$(grep -E "^NOTCPMSS" /jffs/addons/wireguard/WireguardVPN.conf)" ];then    # v4.12
                cmd ip6tables -t mangle -I FORWARD -o $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'server'"
                cmd ip6tables -t mangle -I FORWARD -i $VPN_ID -p tcp -m tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -m comment --comment "WireGuard 'server'"
            else
                logger -t "wg_manager-${MODE}${VPN_NAME}" "'NOTCPMSS' directive found ('WireguardVPN.conf') IPv6 -t mangle FORWARD chain TCP '-j TCPMSS --clamp-mss-to-pmtu' NOT configured"    # v4.12
            fi
            if [ -f /jffs/addons/wireguard/WireguardVPN.conf ] && [ -z "$(grep -E "^NOSETXMARK" /jffs/addons/wireguard/WireguardVPN.conf)" ];then    # v4.12
                cmd ip6tables -t mangle -I FORWARD -o $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'server'"
                cmd ip6tables -t mangle -I PREROUTING -i $VPN_ID -j MARK --set-xmark 0x01/0x7 -m comment --comment "WireGuard 'server'"
            else
                logger -t "wg_manager-${MODE}${VPN_NAME}" "'NOSETXMARK' directive found ('WireguardVPN.conf') IPv6 -t mangle FORWARD/PREROUTING chain'-j MARK --set-xmark 0x01/0x7' NOT configured"    # v4.12
            fi

            cmd ip6tables -I INPUT -p udp --dport $wgport -j ACCEPT -m comment --comment "WireGuard 'server'"
            cmd ip6tables -I INPUT -i $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'"
            #cmd ip6tables -I FORWARD -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'"
            if [ -z "$(iptables-save | grep WGM_ACL)" ];then    # v4.16.3
                cmd ip6tables -N WGM_ACL_F 2>/dev/null          # v4.16.3
                cmd ip6tables -I FORWARD "$(($(iptables -nvL FORWARD --line -t filter | grep -Em 1 ".*\*.*\*.*state.*ESTABLISHED" | cut -d' ' -f1)+1))" -i wg2+ -j WGM_ACL_F -m comment --comment "Wireguard ACL"   # v4.16.3
            fi

            POS=$(($(ip6tables -nvL FORWARD --line -t filter | grep -Em 1 ".*WGM_ACL_F" | cut -d' ' -f1)+1))    # v4.16.3

            cmd ip6tables -I FORWARD $POS -i $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'"        # # v4.16.3 v4.15.10 @ZebMcKayhan
            cmd ip6tables -I FORWARD $POS -i br0 -o $VPN_ID -j ACCEPT -m comment --comment "LAN to WireGuard 'server clients'"    # v# v4.16.3 4.14.1

            cmd ip6tables -I OUTPUT -o $VPN_ID -j ACCEPT -m comment --comment "WireGuard 'server'"
        fi

    fi

    for ALLOWIP in $(awk '/^AllowedIPs/ {$1="";$2="";print $0}' ${CONFIG_DIR}${VPN_ID}.conf | tr ',' ' ')   # v4.14.1
        do

            if [ "$USE_IPV6" == "Y" ] && [ -n "$(echo "$ALLOWIP" | grep -F ":")" ];then
                cmd ip -6 route add $ALLOWIP dev $VPN_ID
            else
                if [ -n "$(echo "$ALLOWIP" | Is_IPv4_CIDR)" ] || [ -n "$(echo "$ALLOWIP" | Is_IPv4)" ];then
                    #[ "$(echo "$ALLOWIP" | grep -o "^.*\.")" != "$(echo "$SUBNET" | grep -o "^.*\.")" ] && cmd ip route add $ALLOWIP dev $VPN_ID        # v4.15.3
                    cmd ip route add $ALLOWIP dev $VPN_ID        # v4.15.5 v4.15.3
                fi
            fi
        done

    # User Exit @ZebMcKayhan
    if [ -f ${INSTALL_DIR}Scripts/${VPN_ID}-up.sh ];then
        logger -t "wg_manager-server${VPN_NAME}" "Executing ${VPN_ID}-up.sh"
        [ "$SHOWCMDS" == "Y" ] && echo -e "[+] ${VPN_ID}-up.sh"
        sh ${INSTALL_DIR}Scripts/${VPN_ID}-up.sh
    fi

    # v4.14 Process 'PostUp' commands
    Process_Pre_Post_Commands "PostUp"  # v4.14.1

    echo -en ${cRESET}$cBGRE"\t"
    logger -st "wg_manager-server${VPN_NAME}" "Initialisation complete."

    # If there are Passthru devices, ask if the 'client' Peers should be restarted if they are UP?
    PASSTHRU_CLIENTS=$(sqlite3 $SQL_DATABASE "SELECT client FROM passthru where server='$VPN_ID';" | sort | uniq | tr '\n' ' ')

    if [ -n "$PASSTHRU_CLIENTS" ];then
        for WG_INTERFACE in $PASSTHRU_CLIENTS
            do
                # Need to Restart the 'client' Peer if it is UP
                if [ -n "$(wg show interfaces | grep "$WG_INTERFACE")" ];then
                    [ "$(sqlite3 $SQL_DATABASE "SELECT auto FROM clients WHERE peer='$WG_INTERFACE';")" == "P" ] && POLICY="policy" || POLICY=
                    CMD="restart"
                    echo -e $cBWHT"\a\n\tWireGuard 'client' Peer needs to be ${CMD}ed to refresh Passthru rules"
                    echo -e $cBWHT"\tPress$cBRED y$cRESET to$cBRED $CMD 'client' Peer (${cRESET}${WG_INTERFACE}$cBRED) or press$cBGRE [Enter] to SKIP."
                    read -r "ANS"
                    if [ "$ANS" == "y" ];then
                        ${INSTALL_DIR}wg_client $WG_INTERFACE "disable" $POLICY
                        ${INSTALL_DIR}wg_client $WG_INTERFACE $POLICY
                    fi
                fi
            done
    fi

    echo -e $cRESET
else

    # v4.14 Process 'PreDown' commands
    Process_Pre_Post_Commands "PreDown" # v4.14.1

    cru d WireGuard_ChkDDNS${WG_INTERFACE}  # v4.18.8

    for ALLOWIP in $(awk '/^AllowedIPs/ {$1="";$2="";print $0}' ${CONFIG_DIR}${VPN_ID}.conf | tr ',' ' ')   # v4.14.1
        do
            if [ "$USE_IPV6" == "Y" ] && [ -n "$(echo "$ALLOWIP" | grep -F ":")" ];then
                ip -6 route del $ALLOWIP dev $VPN_ID 2>/dev/null
            else
                if [ -n "$(echo "$ALLOWIP" | Is_IPv4_CIDR)" ] || [ -n "$(echo "$ALLOWIP" | Is_IPv4)" ];then
                    ip route del $ALLOWIP dev $VPN_ID 2>/dev/null
                fi
            fi
        done

    ip link del dev $VPN_ID 2>/dev/null

    TIMESTAMP=$(date +%s)
    sqlite3 $SQL_DATABASE "INSERT into session values('$WG_INTERFACE','End','$TIMESTAMP');" # v1.13
    # Site-to-Site identify remote site peer
    # Extract '# Cabin LAN'
    if [ "$(sqlite3 $SQL_DATABASE "SELECT auto FROM servers WHERE peer='$WG_INTERFACE';")" == "S" ];then    # v4.15.1
        SITE2SITE_PEER=$(awk '/^#.*LAN/ {print $2}' ${CONFIG_DIR}${WG_INTERFACE}.conf )                     # v4.15.1
        #sqlite3 $SQL_DATABASE "INSERT into traffic values('$SITE2SITE_PEER','$TIMESTAMP','*','*','*','*');" # v4.15.9 v4.15.1
    fi

    Firewall_delete

    #Manage_Passthru "del"

    ip route flush table 2${VPN_NUM}"0" 2>/dev/null     # v4.03
    ip rule del prio 98${VPN_NUM}0      2>/dev/null     # v4.03
    ip route flush cache 2>/dev/null                    # v4.03

    ip -6 route flush table 2${VPN_NUM}"0" 2>/dev/null     # v4.03
    ip -6 rule del prio 98${VPN_NUM}0      2>/dev/null     # v4.03
    ip -6 route flush cache 2>/dev/null                    # v4.03

    # User Exit @ZebMcKayhan
    if [ -f ${INSTALL_DIR}Scripts/${VPN_ID}-down.sh ];then
        logger -t "wg_manager-server${VPN_NAME}" "Executing ${VPN_ID}-down.sh"
        [ "$SHOWCMDS" == "Y" ] && echo -e "[+] ${VPN_ID}-down.sh"
        sh ${INSTALL_DIR}Scripts/${VPN_ID}-down.sh
    fi

    # v4.14 Process 'PostDown' commands
    Process_Pre_Post_Commands "PostDown"    # v4.14.1

    rm /tmp/$VPN_ID.* 2>/dev/null           # v4.16.3

    logger -t "wg_manager-server${VPN_NAME}" "WireGuard® VPN 'server' Peer ($VPN_ID) on" $ADDRESS_TXT "Terminated"  # v4.16.1
    echo -e ${cRESET}$cBGRE"\twg_manager-server${VPN_NAME}: WireGuard® VPN ${IPV6_TXT}'Server' Peer (${cBMAG}$VPN_ID$cBGRE) on $ADDRESS_TXT (${cBMAG}${DESC}${cBGRE}) ${cBRED}Terminated\n"$cRESET  # 4.16.1

fi



#) 2>&1 | logger -t $(basename $0)"[$$_***DEBUG]"