p17o
4f0974fcf1
Updated ping commands to explicitly use IPv4 and adjusted file permission checks with sudo. Changed the forward address prompt to specify IPv4 and modified the binary download process to fetch and install the latest .deb release URL automatically.
946 lines
32 KiB
Bash
946 lines
32 KiB
Bash
#!/bin/bash
|
|
# Nym QUIC Bridge Deployment Helper Script
|
|
# This script provides network configuration and troubleshooting tools for Nym QUIC bridges
|
|
|
|
network_device=$(ip route show default | awk '/default/ {print $5}')
|
|
wg_tunnel_interface="nymwg"
|
|
|
|
BRIDGE_CONFIG_DIR="/opt/nym-bridge"
|
|
BRIDGE_KEYS_DIR="$BRIDGE_CONFIG_DIR/keys"
|
|
BRIDGE_CONFIG="$BRIDGE_CONFIG_DIR/bridges.toml"
|
|
CLIENT_PARAMS="$BRIDGE_CONFIG_DIR/client_bridge_params.json"
|
|
BRIDGE_BINARY="/usr/local/bin/nym-bridge"
|
|
|
|
|
|
if ! dpkg -s iptables-persistent >/dev/null 2>&1; then
|
|
echo "Installing iptables-persistent..."
|
|
sudo apt-get update
|
|
sudo apt-get install -y iptables-persistent
|
|
else
|
|
echo "iptables-persistent is already installed."
|
|
fi
|
|
|
|
fetch_and_display_ipv6() {
|
|
ipv6_address=$(ip -6 addr show "$network_device" scope global | grep inet6 | awk '{print $2}')
|
|
if [[ -z "$ipv6_address" ]]; then
|
|
echo "No global IPv6 address found on $network_device."
|
|
else
|
|
echo "IPv6 address on $network_device: $ipv6_address"
|
|
fi
|
|
}
|
|
|
|
fetch_wg_ipv6_address() {
|
|
ipv6_global_address=$(ip -6 addr show "$wg_tunnel_interface" scope global | grep inet6 | awk '{print $2}' | head -n 1)
|
|
|
|
if [[ -z "$ipv6_global_address" ]]; then
|
|
echo "No globally routable IPv6 address found on $wg_tunnel_interface. Please configure IPv6 or check your network settings."
|
|
exit 1
|
|
else
|
|
echo "Using IPv6 address: $ipv6_global_address"
|
|
fi
|
|
}
|
|
|
|
adjust_ip_forwarding() {
|
|
ipv6_forwarding_setting="net.ipv6.conf.all.forwarding=1"
|
|
ipv4_forwarding_setting="net.ipv4.ip_forward=1"
|
|
|
|
# Remove duplicate entries for these settings from the file
|
|
sudo sed -i "/^net.ipv6.conf.all.forwarding=/d" /etc/sysctl.conf
|
|
sudo sed -i "/^net.ipv4.ip_forward=/d" /etc/sysctl.conf
|
|
|
|
echo "$ipv6_forwarding_setting" | sudo tee -a /etc/sysctl.conf
|
|
echo "$ipv4_forwarding_setting" | sudo tee -a /etc/sysctl.conf
|
|
|
|
sudo sysctl -p /etc/sysctl.conf
|
|
|
|
echo "IP forwarding enabled for IPv4 and IPv6."
|
|
}
|
|
|
|
apply_bridge_iptables_rules() {
|
|
echo "Applying iptables rules for QUIC bridge ($wg_tunnel_interface)..."
|
|
sleep 1
|
|
|
|
# INPUT rules - allow incoming connections TO the bridge from WireGuard clients
|
|
# CRITICAL: This allows mobile clients to reach the bandwidth controller at 10.1.0.1:51830
|
|
sudo iptables -I INPUT -i "$wg_tunnel_interface" -j ACCEPT
|
|
sudo ip6tables -I INPUT -i "$wg_tunnel_interface" -j ACCEPT
|
|
|
|
# NAT rules - for outbound traffic masquerading
|
|
sudo iptables -t nat -A POSTROUTING -o "$network_device" -j MASQUERADE
|
|
sudo ip6tables -t nat -A POSTROUTING -o "$network_device" -j MASQUERADE
|
|
|
|
# FORWARD rules - allow traffic through the bridge
|
|
sudo iptables -A FORWARD -i "$wg_tunnel_interface" -o "$network_device" -j ACCEPT
|
|
sudo iptables -A FORWARD -i "$network_device" -o "$wg_tunnel_interface" -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
sudo ip6tables -A FORWARD -i "$wg_tunnel_interface" -o "$network_device" -j ACCEPT
|
|
sudo ip6tables -A FORWARD -i "$network_device" -o "$wg_tunnel_interface" -m state --state RELATED,ESTABLISHED -j ACCEPT
|
|
|
|
# Save rules
|
|
sudo iptables-save | sudo tee /etc/iptables/rules.v4
|
|
sudo ip6tables-save | sudo tee /etc/iptables/rules.v6
|
|
|
|
echo "Iptables rules applied successfully for QUIC bridge (including INPUT rules for bandwidth controller)."
|
|
}
|
|
|
|
check_bridge_iptables() {
|
|
echo "Inspecting iptables rules for QUIC bridge ($wg_tunnel_interface)..."
|
|
echo "---------------------------------------"
|
|
echo "IPv4 INPUT rules (for bandwidth controller):"
|
|
iptables -L INPUT -v -n | grep -E "$wg_tunnel_interface|Chain INPUT" | head -20
|
|
echo "---------------------------------------"
|
|
echo "IPv4 FORWARD rules:"
|
|
iptables -L FORWARD -v -n | awk -v dev="$wg_tunnel_interface" '/^Chain FORWARD/ || $0 ~ dev || $0 ~ "ufw-reject-forward"'
|
|
echo "---------------------------------------"
|
|
echo "IPv6 INPUT rules (for bandwidth controller):"
|
|
ip6tables -L INPUT -v -n | grep -E "$wg_tunnel_interface|Chain INPUT" | head -20
|
|
echo "---------------------------------------"
|
|
echo "IPv6 FORWARD rules:"
|
|
ip6tables -L FORWARD -v -n | awk -v dev="$wg_tunnel_interface" '/^Chain FORWARD/ || $0 ~ dev || $0 ~ "ufw6-reject-forward"'
|
|
}
|
|
|
|
remove_duplicate_bridge_rules() {
|
|
local script_name=$(basename "$0")
|
|
|
|
echo "Removing duplicate iptables rules for $wg_tunnel_interface..."
|
|
|
|
iptables-save | grep "$wg_tunnel_interface" | while read -r line; do
|
|
sudo iptables -D ${line#-A } 2>/dev/null || echo "Failed to delete rule: $line"
|
|
done
|
|
|
|
ip6tables-save | grep "$wg_tunnel_interface" | while read -r line; do
|
|
sudo ip6tables -D ${line#-A } 2>/dev/null || echo "Failed to delete rule: $line"
|
|
done
|
|
|
|
echo "Duplicates removed for $wg_tunnel_interface."
|
|
echo "!!IMPORTANT!! You need to now reapply the iptables rules."
|
|
echo "Run: ./$script_name apply_bridge_iptables_rules"
|
|
}
|
|
|
|
configure_dns_and_icmp() {
|
|
echo "Allowing ICMP (ping)..."
|
|
sudo iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
|
|
sudo iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
|
|
sudo ip6tables -A INPUT -p ipv6-icmp -j ACCEPT
|
|
sudo ip6tables -A OUTPUT -p ipv6-icmp -j ACCEPT
|
|
|
|
echo "Allowing DNS over UDP (port 53)..."
|
|
sudo iptables -A INPUT -p udp --dport 53 -j ACCEPT
|
|
sudo ip6tables -A INPUT -p udp --dport 53 -j ACCEPT
|
|
|
|
echo "Allowing DNS over TCP (port 53)..."
|
|
sudo iptables -A INPUT -p tcp --dport 53 -j ACCEPT
|
|
sudo ip6tables -A INPUT -p tcp --dport 53 -j ACCEPT
|
|
|
|
echo "Saving iptables rules..."
|
|
sudo iptables-save | sudo tee /etc/iptables/rules.v4
|
|
sudo ip6tables-save | sudo tee /etc/iptables/rules.v6
|
|
|
|
echo "DNS and ICMP configuration completed."
|
|
}
|
|
|
|
check_ipv6_ipv4_forwarding() {
|
|
result_ipv4=$(cat /proc/sys/net/ipv4/ip_forward)
|
|
result_ipv6=$(cat /proc/sys/net/ipv6/conf/all/forwarding)
|
|
echo "IPv4 forwarding is $([ "$result_ipv4" == "1" ] && echo "enabled" || echo "not enabled")."
|
|
echo "IPv6 forwarding is $([ "$result_ipv6" == "1" ] && echo "enabled" || echo "not enabled")."
|
|
}
|
|
|
|
check_ip_routing() {
|
|
echo "IPv4 routing table:"
|
|
ip route
|
|
echo "---------------------------------------"
|
|
echo "IPv6 routing table:"
|
|
ip -6 route
|
|
}
|
|
|
|
perform_pings() {
|
|
echo "Performing IPv4 ping to google.com..."
|
|
ping -4 -c 4 google.com
|
|
echo "---------------------------------------"
|
|
echo "Performing IPv6 ping to google.com..."
|
|
ping6 -c 4 google.com
|
|
}
|
|
|
|
test_bridge_connectivity() {
|
|
local green="\033[0;32m"
|
|
local reset="\033[0m"
|
|
local red="\033[0;31m"
|
|
local yellow="\033[0;33m"
|
|
|
|
sleep 1
|
|
echo
|
|
echo -e "${yellow}Testing QUIC bridge connectivity on $wg_tunnel_interface...${reset}"
|
|
echo -e "${yellow}If these tests succeed, it confirms the bridge can reach the outside world via IPv4 and IPv6.${reset}"
|
|
echo -e "${yellow}However, external clients may experience different connectivity to your bridge.${reset}"
|
|
|
|
ipv4_address=$(ip addr show "$wg_tunnel_interface" | awk '/inet / {print $2}' | cut -d'/' -f1)
|
|
ipv6_address=$(ip addr show "$wg_tunnel_interface" | awk '/inet6 / && $2 !~ /^fe80/ {print $2}' | cut -d'/' -f1)
|
|
|
|
if [[ -z "$ipv4_address" && -z "$ipv6_address" ]]; then
|
|
echo -e "${red}No IP address found on $wg_tunnel_interface. Unable to test connectivity.${reset}"
|
|
echo -e "${red}Please verify your bridge configuration and ensure the interface is up.${reset}"
|
|
return 1
|
|
fi
|
|
|
|
if [[ -n "$ipv4_address" ]]; then
|
|
echo
|
|
echo -e "------------------------------------"
|
|
echo -e "Detected IPv4 address: $ipv4_address"
|
|
echo -e "Testing IPv4 connectivity..."
|
|
echo
|
|
|
|
if ping -4 -c 1 -I "$ipv4_address" google.com >/dev/null 2>&1; then
|
|
echo -e "${green}IPv4 connectivity is working. Fetching test data...${reset}"
|
|
joke=$(curl -s -H "Accept: application/json" --interface "$ipv4_address" https://icanhazdadjoke.com/ | jq -r .joke)
|
|
[[ -n "$joke" && "$joke" != "null" ]] && echo -e "${green}IPv4 test joke: $joke${reset}" || echo -e "${red}Failed to fetch test data via IPv4.${reset}"
|
|
else
|
|
echo -e "${red}IPv4 connectivity is not working for $wg_tunnel_interface. Verify your routing and NAT settings.${reset}"
|
|
fi
|
|
else
|
|
echo -e "${yellow}No IPv4 address found on $wg_tunnel_interface. Skipping IPv4 test.${reset}"
|
|
fi
|
|
|
|
if [[ -n "$ipv6_address" ]]; then
|
|
echo
|
|
echo -e "------------------------------------"
|
|
echo -e "Detected IPv6 address: $ipv6_address"
|
|
echo -e "Testing IPv6 connectivity..."
|
|
echo
|
|
|
|
if ping6 -c 1 -I "$ipv6_address" google.com >/dev/null 2>&1; then
|
|
echo -e "${green}IPv6 connectivity is working. Fetching test data...${reset}"
|
|
joke=$(curl -s -H "Accept: application/json" --interface "$ipv6_address" https://icanhazdadjoke.com/ | jq -r .joke)
|
|
[[ -n "$joke" && "$joke" != "null" ]] && echo -e "${green}IPv6 test joke: $joke${reset}" || echo -e "${red}Failed to fetch test data via IPv6.${reset}"
|
|
else
|
|
echo -e "${red}IPv6 connectivity is not working for $wg_tunnel_interface. Verify your routing and NAT settings.${reset}"
|
|
fi
|
|
else
|
|
echo -e "${yellow}No IPv6 address found on $wg_tunnel_interface. Skipping IPv6 test.${reset}"
|
|
fi
|
|
|
|
echo -e "${green}Connectivity testing completed for $wg_tunnel_interface.${reset}"
|
|
echo -e "------------------------------------"
|
|
|
|
sleep 2
|
|
echo
|
|
echo
|
|
echo -e "${yellow}### Bridge Connectivity Testing Recommendations ###${reset}"
|
|
echo -e "${yellow}- Test UDP connectivity on port 51822 (used for Nym QUIC/WireGuard)${reset}"
|
|
echo -e "${yellow} From another machine: echo 'test message' | nc -u <your-ip-address> 51822${reset}"
|
|
echo -e "${yellow}- Test bandwidth controller access on port 51830:${reset}"
|
|
echo -e "${yellow} From inside the WireGuard tunnel: curl http://10.1.0.1:51830${reset}"
|
|
echo -e "${yellow}- If connectivity issues persist, check port forwarding and firewall rules${reset}"
|
|
echo
|
|
}
|
|
|
|
check_bridge_service_status() {
|
|
echo "Checking nym-bridge service status..."
|
|
systemctl status nym-bridge.service --no-pager
|
|
echo "---------------------------------------"
|
|
echo "Checking nym-node service status..."
|
|
systemctl status nym-node.service --no-pager
|
|
}
|
|
|
|
show_bridge_logs() {
|
|
local lines=${1:-50}
|
|
echo "Showing last $lines lines of nym-bridge logs..."
|
|
journalctl -u nym-bridge.service -n "$lines" --no-pager
|
|
}
|
|
|
|
check_bridge_installation() {
|
|
local green="\033[0;32m"
|
|
local reset="\033[0m"
|
|
local red="\033[0;31m"
|
|
local yellow="\033[0;33m"
|
|
|
|
echo -e "${yellow}=== Nym QUIC Bridge Installation Status ===${reset}"
|
|
echo ""
|
|
|
|
# Check binary
|
|
if [[ -f "$BRIDGE_BINARY" ]]; then
|
|
echo -e "${green}✓ Bridge binary found: $BRIDGE_BINARY${reset}"
|
|
bridge_version=$($BRIDGE_BINARY --version 2>/dev/null | head -1 || echo "Unable to determine version")
|
|
echo " Version: $bridge_version"
|
|
else
|
|
echo -e "${red}✗ Bridge binary not found at $BRIDGE_BINARY${reset}"
|
|
fi
|
|
echo ""
|
|
|
|
# Check configuration directory
|
|
if [[ -d "$BRIDGE_CONFIG_DIR" ]]; then
|
|
echo -e "${green}✓ Configuration directory exists: $BRIDGE_CONFIG_DIR${reset}"
|
|
else
|
|
echo -e "${red}✗ Configuration directory not found: $BRIDGE_CONFIG_DIR${reset}"
|
|
fi
|
|
echo ""
|
|
|
|
# Check keys directory
|
|
if [[ -d "$BRIDGE_KEYS_DIR" ]]; then
|
|
echo -e "${green}✓ Keys directory exists: $BRIDGE_KEYS_DIR${reset}"
|
|
key_count=$(sudo bash -c "ls -1 \"$BRIDGE_KEYS_DIR\"/*.pem" 2>/dev/null | wc -l)
|
|
echo " Keys found: $key_count"
|
|
else
|
|
echo -e "${red}✗ Keys directory not found: $BRIDGE_KEYS_DIR${reset}"
|
|
fi
|
|
echo ""
|
|
|
|
# Check configuration files
|
|
if [[ -f "$BRIDGE_CONFIG" ]]; then
|
|
echo -e "${green}✓ Bridge config found: $BRIDGE_CONFIG${reset}"
|
|
else
|
|
echo -e "${red}✗ Bridge config not found: $BRIDGE_CONFIG${reset}"
|
|
fi
|
|
|
|
if [[ -f "$CLIENT_PARAMS" ]]; then
|
|
echo -e "${green}✓ Client params found: $CLIENT_PARAMS${reset}"
|
|
else
|
|
echo -e "${red}✗ Client params not found: $CLIENT_PARAMS${reset}"
|
|
fi
|
|
echo ""
|
|
|
|
# Check services
|
|
echo -e "${yellow}Service Status:${reset}"
|
|
if systemctl is-active --quiet nym-bridge.service; then
|
|
echo -e "${green}✓ nym-bridge service is running${reset}"
|
|
else
|
|
echo -e "${red}✗ nym-bridge service is not running${reset}"
|
|
fi
|
|
|
|
if systemctl is-active --quiet nym-node.service; then
|
|
echo -e "${green}✓ nym-node service is running${reset}"
|
|
else
|
|
echo -e "${red}✗ nym-node service is not running${reset}"
|
|
fi
|
|
echo ""
|
|
}
|
|
|
|
show_bridge_config() {
|
|
echo "=== Bridge Configuration ==="
|
|
echo ""
|
|
|
|
if [[ -f "$BRIDGE_CONFIG" ]]; then
|
|
echo "Bridge config ($BRIDGE_CONFIG):"
|
|
echo "---------------------------------------"
|
|
cat "$BRIDGE_CONFIG"
|
|
echo ""
|
|
else
|
|
echo "Bridge config not found at $BRIDGE_CONFIG"
|
|
fi
|
|
|
|
if [[ -f "$CLIENT_PARAMS" ]]; then
|
|
echo "Client parameters ($CLIENT_PARAMS):"
|
|
echo "---------------------------------------"
|
|
cat "$CLIENT_PARAMS"
|
|
echo ""
|
|
else
|
|
echo "Client parameters not found at $CLIENT_PARAMS"
|
|
fi
|
|
}
|
|
|
|
show_bridge_keys() {
|
|
local green="\033[0;32m"
|
|
local reset="\033[0m"
|
|
local red="\033[0;31m"
|
|
local yellow="\033[0;33m"
|
|
|
|
echo -e "${yellow}=== Bridge Keys Information ===${reset}"
|
|
echo ""
|
|
|
|
if [[ ! -d "$BRIDGE_KEYS_DIR" ]]; then
|
|
echo -e "${red}Keys directory not found: $BRIDGE_KEYS_DIR${reset}"
|
|
return 1
|
|
fi
|
|
|
|
echo "Keys directory: $BRIDGE_KEYS_DIR"
|
|
echo "---------------------------------------"
|
|
|
|
# List all key files
|
|
if ls -1 "$BRIDGE_KEYS_DIR"/*.pem >/dev/null 2>&1; then
|
|
for key_file in "$BRIDGE_KEYS_DIR"/*.pem; do
|
|
key_name=$(basename "$key_file")
|
|
echo -e "${green}Key file: $key_name${reset}"
|
|
|
|
# If it's a public key, show the content
|
|
if [[ "$key_name" == *"_bridge_identity.pem" ]]; then
|
|
echo " Type: ED25519 Bridge Identity (Private)"
|
|
echo " Path: $key_file"
|
|
|
|
# Extract and show public key
|
|
if command -v openssl >/dev/null 2>&1; then
|
|
echo -e "${yellow} Public key (base64):${reset}"
|
|
openssl pkey -in "$key_file" -pubout 2>/dev/null | grep -v "\---" | base64 -d | tail -c 32 | base64
|
|
fi
|
|
fi
|
|
echo ""
|
|
done
|
|
else
|
|
echo -e "${red}No key files found in $BRIDGE_KEYS_DIR${reset}"
|
|
fi
|
|
}
|
|
|
|
show_bridge_info() {
|
|
local green="\033[0;32m"
|
|
local reset="\033[0m"
|
|
local yellow="\033[0;33m"
|
|
|
|
echo -e "${yellow}=== Nym QUIC Bridge Information ===${reset}"
|
|
echo ""
|
|
|
|
# Network interfaces
|
|
echo -e "${yellow}Network Configuration:${reset}"
|
|
echo "Primary network device: $network_device"
|
|
echo "WireGuard interface: $wg_tunnel_interface"
|
|
|
|
# Show IP addresses
|
|
echo ""
|
|
echo "IPv4 addresses:"
|
|
ip -4 addr show | grep inet | awk '{print " " $2 " on " $NF}'
|
|
|
|
echo ""
|
|
echo "IPv6 addresses:"
|
|
ip -6 addr show scope global | grep inet6 | awk '{print " " $2 " on " $NF}'
|
|
|
|
echo ""
|
|
echo -e "${yellow}Bridge Paths:${reset}"
|
|
echo "Configuration: $BRIDGE_CONFIG_DIR"
|
|
echo "Keys: $BRIDGE_KEYS_DIR"
|
|
echo "Binary: $BRIDGE_BINARY"
|
|
|
|
echo ""
|
|
echo -e "${yellow}Important Commands:${reset}"
|
|
echo " Check bridge status: systemctl status nym-bridge"
|
|
echo " Check nym-node status: systemctl status nym-node"
|
|
echo " View bridge logs: journalctl -u nym-bridge -f"
|
|
echo " View nym-node logs: journalctl -u nym-node -f"
|
|
echo ""
|
|
}
|
|
|
|
verify_bridge_prerequisites() {
|
|
local green="\033[0;32m"
|
|
local reset="\033[0m"
|
|
local red="\033[0;31m"
|
|
local yellow="\033[0;33m"
|
|
|
|
echo -e "${yellow}=== Verifying Bridge Prerequisites ===${reset}"
|
|
echo ""
|
|
|
|
local all_good=true
|
|
|
|
# Check IP forwarding
|
|
ipv4_forward=$(cat /proc/sys/net/ipv4/ip_forward)
|
|
ipv6_forward=$(cat /proc/sys/net/ipv6/conf/all/forwarding)
|
|
|
|
if [[ "$ipv4_forward" == "1" ]]; then
|
|
echo -e "${green}✓ IPv4 forwarding enabled${reset}"
|
|
else
|
|
echo -e "${red}✗ IPv4 forwarding disabled${reset}"
|
|
echo " Fix: Run 'nym-bridge-helper adjust_ip_forwarding'"
|
|
all_good=false
|
|
fi
|
|
|
|
if [[ "$ipv6_forward" == "1" ]]; then
|
|
echo -e "${green}✓ IPv6 forwarding enabled${reset}"
|
|
else
|
|
echo -e "${red}✗ IPv6 forwarding disabled${reset}"
|
|
echo " Fix: Run 'nym-bridge-helper adjust_ip_forwarding'"
|
|
all_good=false
|
|
fi
|
|
|
|
# Check iptables-persistent
|
|
if dpkg -s iptables-persistent >/dev/null 2>&1; then
|
|
echo -e "${green}✓ iptables-persistent installed${reset}"
|
|
else
|
|
echo -e "${red}✗ iptables-persistent not installed${reset}"
|
|
echo " Fix: This script will auto-install on first run"
|
|
all_good=false
|
|
fi
|
|
|
|
# Check required packages
|
|
for pkg in openssl jq curl wg; do
|
|
if command -v "$pkg" >/dev/null 2>&1; then
|
|
echo -e "${green}✓ $pkg installed${reset}"
|
|
else
|
|
echo -e "${red}✗ $pkg not installed${reset}"
|
|
if [[ "$pkg" == "wg" ]]; then
|
|
echo " Install: sudo apt install wireguard-tools"
|
|
fi
|
|
all_good=false
|
|
fi
|
|
done
|
|
|
|
echo ""
|
|
if [[ "$all_good" == true ]]; then
|
|
echo -e "${green}All prerequisites satisfied!${reset}"
|
|
else
|
|
echo -e "${yellow}Some prerequisites need attention. See above for fixes.${reset}"
|
|
fi
|
|
echo ""
|
|
}
|
|
|
|
generate_bridge_keys() {
|
|
local green="\033[0;32m"
|
|
local reset="\033[0m"
|
|
local red="\033[0;31m"
|
|
local yellow="\033[0;33m"
|
|
|
|
echo -e "${yellow}=== Generating Bridge Keys ===${reset}"
|
|
echo ""
|
|
|
|
# Create directories
|
|
sudo mkdir -p "$BRIDGE_CONFIG_DIR"
|
|
sudo mkdir -p "$BRIDGE_KEYS_DIR"
|
|
sudo chmod 700 "$BRIDGE_KEYS_DIR"
|
|
|
|
# Generate ED25519 private key
|
|
local key_file="$BRIDGE_KEYS_DIR/ed25519_bridge_identity.pem"
|
|
|
|
if sudo test -f "$key_file"; then
|
|
echo -e "${yellow}Warning: Key file already exists at $key_file${reset}"
|
|
read -p "Overwrite existing key? (yes/no): " confirm
|
|
if [[ "$confirm" != "yes" ]]; then
|
|
echo "Aborted. Keeping existing key."
|
|
return 1
|
|
fi
|
|
fi
|
|
|
|
echo "Generating ED25519 key..."
|
|
sudo openssl genpkey -algorithm ED25519 -out "$key_file"
|
|
sudo chmod 600 "$key_file"
|
|
|
|
echo -e "${green}✓ Bridge key generated at $key_file${reset}"
|
|
|
|
# Extract and display public key
|
|
echo ""
|
|
echo "Extracting public key..."
|
|
pubkey=$(sudo openssl pkey -in "$key_file" -pubout 2>/dev/null | grep -v "\---" | base64 -d | tail -c 32 | base64)
|
|
echo -e "${green}Public key (base64): $pubkey${reset}"
|
|
|
|
echo ""
|
|
echo -e "${yellow}Next steps:${reset}"
|
|
echo "1. Run 'nym-bridge-helper create_client_params' to generate client parameters"
|
|
echo "2. Run 'nym-bridge-helper create_bridge_config' to create bridge configuration"
|
|
}
|
|
|
|
create_client_params() {
|
|
local green="\033[0;32m"
|
|
local reset="\033[0m"
|
|
local red="\033[0;31m"
|
|
local yellow="\033[0;33m"
|
|
|
|
echo -e "${yellow}=== Creating Client Bridge Parameters ===${reset}"
|
|
echo ""
|
|
|
|
# Check if key exists
|
|
local key_file="$BRIDGE_KEYS_DIR/ed25519_bridge_identity.pem"
|
|
if ! sudo test -f "$key_file"; then
|
|
echo -e "${red}Error: Bridge key not found at $key_file${reset}"
|
|
echo "Run 'nym-bridge-helper generate_bridge_keys' first"
|
|
return 1
|
|
fi
|
|
|
|
# Get forward address
|
|
read -p "Enter forward address (e.g., <IPv4>:51822, can be found by running 'curl -4 https://ifconfig.co/ip'): " forward_addr
|
|
if [[ -z "$forward_addr" ]]; then
|
|
echo -e "${red}Error: Forward address is required${reset}"
|
|
return 1
|
|
fi
|
|
|
|
# Extract public key
|
|
echo "Extracting public key..."
|
|
pubkey=$(sudo openssl pkey -in "$key_file" -pubout 2>/dev/null | grep -v "\---" | base64 -d | tail -c 32 | base64)
|
|
|
|
# Create client params JSON
|
|
echo "Creating client parameters file..."
|
|
sudo tee "$CLIENT_PARAMS" > /dev/null <<EOF
|
|
{
|
|
"ed25519_bridge_identity": "$pubkey",
|
|
"forward_address": "$forward_addr",
|
|
"endpoint": {
|
|
"Quic": {
|
|
"host": "$forward_addr"
|
|
}
|
|
}
|
|
}
|
|
EOF
|
|
|
|
sudo chmod 644 "$CLIENT_PARAMS"
|
|
|
|
echo -e "${green}✓ Client parameters created at $CLIENT_PARAMS${reset}"
|
|
echo ""
|
|
echo "Content:"
|
|
cat "$CLIENT_PARAMS"
|
|
}
|
|
|
|
create_bridge_config() {
|
|
local green="\033[0;32m"
|
|
local reset="\033[0m"
|
|
local red="\033[0;31m"
|
|
local yellow="\033[0;33m"
|
|
|
|
echo -e "${yellow}=== Creating Bridge Configuration ===${reset}"
|
|
echo ""
|
|
|
|
# Get configuration parameters
|
|
read -p "Enter listening address (press enter for default: 0.0.0.0): " listen_addr
|
|
listen_addr=${listen_addr:-0.0.0.0}
|
|
|
|
read -p "Enter listening port (press enter for default: 51822): " listen_port
|
|
listen_port=${listen_port:-51822}
|
|
|
|
read -p "Enter tunnel device name (press enter for default: nymwg): " tunnel_dev
|
|
tunnel_dev=${tunnel_dev:-nymwg}
|
|
|
|
read -p "Enter tunnel IPv4 address (press enter for default: 10.1.0.1/24): " tunnel_ipv4
|
|
tunnel_ipv4=${tunnel_ipv4:-10.1.0.1/24}
|
|
|
|
read -p "Enter tunnel IPv6 address (optional, can be found by running 'curl -6 https://ifconfig.co/ip', press enter to skip): " tunnel_ipv6
|
|
|
|
read -p "Enter WireGuard private key (or press enter to generate): " wg_privkey
|
|
if [[ -z "$wg_privkey" ]]; then
|
|
echo "Generating WireGuard private key..."
|
|
wg_privkey=$(wg genkey)
|
|
wg_pubkey=$(echo "$wg_privkey" | wg pubkey)
|
|
echo -e "${green}Generated WireGuard public key: $wg_pubkey${reset}"
|
|
fi
|
|
|
|
# Create bridges.toml
|
|
echo "Creating bridge configuration..."
|
|
sudo tee "$BRIDGE_CONFIG" > /dev/null <<EOF
|
|
# Nym QUIC Bridge Configuration
|
|
|
|
[[bridges]]
|
|
# Listening address and port for the bridge
|
|
listening_address = "$listen_addr:$listen_port"
|
|
|
|
# WireGuard tunnel configuration
|
|
tunnel_device_name = "$tunnel_dev"
|
|
tunnel_device_address = "$tunnel_ipv4"
|
|
EOF
|
|
|
|
if [[ -n "$tunnel_ipv6" ]]; then
|
|
echo "tunnel_device_ipv6_address = \"$tunnel_ipv6\"" | sudo tee -a "$BRIDGE_CONFIG" > /dev/null
|
|
fi
|
|
|
|
sudo tee -a "$BRIDGE_CONFIG" > /dev/null <<EOF
|
|
|
|
# Bridge identity key
|
|
bridge_identity_private_key_file = "$BRIDGE_KEYS_DIR/ed25519_bridge_identity.pem"
|
|
|
|
# WireGuard private key
|
|
wireguard_private_key = "$wg_privkey"
|
|
|
|
# Additional settings
|
|
bandwidth_controller_port = 51830
|
|
EOF
|
|
|
|
sudo chmod 644 "$BRIDGE_CONFIG"
|
|
|
|
echo -e "${green}✓ Bridge configuration created at $BRIDGE_CONFIG${reset}"
|
|
echo ""
|
|
echo "Configuration preview:"
|
|
cat "$BRIDGE_CONFIG"
|
|
}
|
|
|
|
create_bridge_service() {
|
|
local green="\033[0;32m"
|
|
local reset="\033[0m"
|
|
local red="\033[0;31m"
|
|
local yellow="\033[0;33m"
|
|
|
|
echo -e "${yellow}=== Creating nym-bridge systemd Service ===${reset}"
|
|
echo ""
|
|
|
|
# Check if bridge binary exists
|
|
if [[ ! -f "$BRIDGE_BINARY" ]]; then
|
|
echo -e "${red}Error: Bridge binary not found at $BRIDGE_BINARY${reset}"
|
|
echo "Please install the nym-bridge binary first"
|
|
return 1
|
|
fi
|
|
|
|
# Check if config exists
|
|
if [[ ! -f "$BRIDGE_CONFIG" ]]; then
|
|
echo -e "${red}Error: Bridge config not found at $BRIDGE_CONFIG${reset}"
|
|
echo "Run 'nym-bridge-helper create_bridge_config' first"
|
|
return 1
|
|
fi
|
|
|
|
# Create systemd service file
|
|
local service_file="/etc/systemd/system/nym-bridge.service"
|
|
|
|
echo "Creating systemd service file..."
|
|
sudo tee "$service_file" > /dev/null <<EOF
|
|
[Unit]
|
|
Description=Nym QUIC Bridge
|
|
After=network.target nym-node.service
|
|
Wants=nym-node.service
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=root
|
|
ExecStart=$BRIDGE_BINARY --config $BRIDGE_CONFIG
|
|
Restart=on-failure
|
|
RestartSec=10
|
|
StandardOutput=journal
|
|
StandardError=journal
|
|
SyslogIdentifier=nym-bridge
|
|
|
|
# Security settings
|
|
NoNewPrivileges=false
|
|
PrivateTmp=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ReadWritePaths=$BRIDGE_CONFIG_DIR
|
|
|
|
# Network capabilities
|
|
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
|
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
EOF
|
|
|
|
echo -e "${green}✓ Systemd service file created at $service_file${reset}"
|
|
|
|
# Reload systemd
|
|
echo "Reloading systemd daemon..."
|
|
sudo systemctl daemon-reload
|
|
|
|
echo ""
|
|
echo -e "${green}Service created successfully!${reset}"
|
|
echo ""
|
|
echo "To enable and start the service:"
|
|
echo " sudo systemctl enable nym-bridge"
|
|
echo " sudo systemctl start nym-bridge"
|
|
echo ""
|
|
echo "To check status:"
|
|
echo " sudo systemctl status nym-bridge"
|
|
}
|
|
|
|
install_bridge_binary() {
|
|
local green="\033[0;32m"
|
|
local reset="\033[0m"
|
|
local red="\033[0;31m"
|
|
local yellow="\033[0;33m"
|
|
|
|
local deb_arch="amd64"
|
|
local sys_arch=$(dpkg --print-architecture)
|
|
|
|
if [[ "$deb_arch" != "$sys_arch" ]]; then
|
|
echo -e "${red}Error: aborting .deb package installation as this system's arch is not amd64.${reset}"
|
|
echo " Refer to https://github.com/nymtech/nym-bridges for build instructions."
|
|
exit 1
|
|
fi
|
|
|
|
echo -e "${yellow}=== Installing nym-bridge Binary ===${reset}"
|
|
echo ""
|
|
|
|
echo "Retrieving URL to latest release..."
|
|
local binary_url=$(
|
|
curl -s "https://api.github.com/repos/nymtech/nym-bridges/releases/latest" |
|
|
grep "browser_download_url.*amd64.deb" |
|
|
grep -o 'https://[^"]*'
|
|
)
|
|
|
|
echo "Downloading $binary_url ..."
|
|
if curl -L -o "/tmp/$(basename "$binary_url")" "$binary_url"; then
|
|
sudo dpkg -i "/tmp/$(basename "$binary_url")"
|
|
else
|
|
echo -e "${red}✗ Failed to download bridge binary${reset}"
|
|
return 1
|
|
fi
|
|
}
|
|
|
|
full_bridge_setup() {
|
|
local green="\033[0;32m"
|
|
local reset="\033[0m"
|
|
local yellow="\033[0;33m"
|
|
|
|
echo -e "${yellow}========================================${reset}"
|
|
echo -e "${yellow} Nym QUIC Bridge - Full Setup${reset}"
|
|
echo -e "${yellow}========================================${reset}"
|
|
echo ""
|
|
|
|
echo "This will guide you through complete bridge setup"
|
|
echo ""
|
|
|
|
# Step 1: Prerequisites
|
|
echo "Step 1/7: Checking prerequisites..."
|
|
verify_bridge_prerequisites
|
|
read -p "Press Enter to continue..."
|
|
|
|
# Step 2: Install binary
|
|
echo ""
|
|
echo "Step 2/7: Installing bridge binary..."
|
|
install_bridge_binary
|
|
read -p "Press Enter to continue..."
|
|
|
|
# Step 3: Generate keys
|
|
echo ""
|
|
echo "Step 3/7: Generating bridge keys..."
|
|
generate_bridge_keys
|
|
read -p "Press Enter to continue..."
|
|
|
|
# Step 4: Create client params
|
|
echo ""
|
|
echo "Step 4/7: Creating client parameters..."
|
|
create_client_params
|
|
read -p "Press Enter to continue..."
|
|
|
|
# Step 5: Create bridge config
|
|
echo ""
|
|
echo "Step 5/7: Creating bridge configuration..."
|
|
create_bridge_config
|
|
read -p "Press Enter to continue..."
|
|
|
|
# Step 6: Create service
|
|
echo ""
|
|
echo "Step 6/7: Creating systemd service..."
|
|
create_bridge_service
|
|
read -p "Press Enter to continue..."
|
|
|
|
# Step 7: Network setup
|
|
echo ""
|
|
echo "Step 7/7: Configuring network..."
|
|
adjust_ip_forwarding
|
|
apply_bridge_iptables_rules
|
|
configure_dns_and_icmp
|
|
|
|
echo ""
|
|
echo -e "${green}========================================${reset}"
|
|
echo -e "${green} Bridge Setup Complete!${reset}"
|
|
echo -e "${green}========================================${reset}"
|
|
echo ""
|
|
echo "To start the bridge:"
|
|
echo " sudo systemctl enable nym-bridge"
|
|
echo " sudo systemctl start nym-bridge"
|
|
echo ""
|
|
echo "To check status:"
|
|
echo " nym-bridge-helper check_bridge_service_status"
|
|
}
|
|
|
|
case "$1" in
|
|
fetch_and_display_ipv6)
|
|
fetch_and_display_ipv6
|
|
;;
|
|
fetch_wg_ipv6_address)
|
|
fetch_wg_ipv6_address
|
|
;;
|
|
apply_bridge_iptables_rules)
|
|
apply_bridge_iptables_rules
|
|
;;
|
|
check_bridge_iptables)
|
|
check_bridge_iptables
|
|
;;
|
|
remove_duplicate_bridge_rules)
|
|
remove_duplicate_bridge_rules
|
|
;;
|
|
configure_dns_and_icmp)
|
|
configure_dns_and_icmp
|
|
;;
|
|
adjust_ip_forwarding)
|
|
adjust_ip_forwarding
|
|
;;
|
|
check_ipv6_ipv4_forwarding)
|
|
check_ipv6_ipv4_forwarding
|
|
;;
|
|
check_ip_routing)
|
|
check_ip_routing
|
|
;;
|
|
perform_pings)
|
|
perform_pings
|
|
;;
|
|
test_bridge_connectivity)
|
|
test_bridge_connectivity
|
|
;;
|
|
check_bridge_service_status)
|
|
check_bridge_service_status
|
|
;;
|
|
show_bridge_logs)
|
|
show_bridge_logs "$2"
|
|
;;
|
|
check_bridge_installation)
|
|
check_bridge_installation
|
|
;;
|
|
show_bridge_config)
|
|
show_bridge_config
|
|
;;
|
|
show_bridge_keys)
|
|
show_bridge_keys
|
|
;;
|
|
show_bridge_info)
|
|
show_bridge_info
|
|
;;
|
|
verify_bridge_prerequisites)
|
|
verify_bridge_prerequisites
|
|
;;
|
|
generate_bridge_keys)
|
|
generate_bridge_keys
|
|
;;
|
|
create_client_params)
|
|
create_client_params
|
|
;;
|
|
create_bridge_config)
|
|
create_bridge_config
|
|
;;
|
|
create_bridge_service)
|
|
create_bridge_service
|
|
;;
|
|
install_bridge_binary)
|
|
install_bridge_binary
|
|
;;
|
|
full_bridge_setup)
|
|
full_bridge_setup
|
|
;;
|
|
*)
|
|
echo "Usage: $0 [command] [options]"
|
|
echo ""
|
|
echo "Nym QUIC Bridge Deployment Helper Script"
|
|
echo ""
|
|
echo "Bridge Installation & Configuration:"
|
|
echo " check_bridge_installation - Check bridge installation status"
|
|
echo " show_bridge_config - Display bridge configuration files"
|
|
echo " show_bridge_keys - Display bridge key information"
|
|
echo " show_bridge_info - Show comprehensive bridge information"
|
|
echo " verify_bridge_prerequisites - Verify all prerequisites are met"
|
|
echo ""
|
|
echo "Bridge Setup Commands:"
|
|
echo " install_bridge_binary - Download and install nym-bridge binary"
|
|
echo " generate_bridge_keys - Generate ED25519 bridge identity keys"
|
|
echo " create_client_params - Create client_bridge_params.json"
|
|
echo " create_bridge_config - Create bridges.toml configuration"
|
|
echo " create_bridge_service - Create systemd service file"
|
|
echo " full_bridge_setup - Interactive full bridge setup wizard"
|
|
echo ""
|
|
echo "Network Configuration Commands:"
|
|
echo " adjust_ip_forwarding - Enable IPv4 and IPv6 forwarding"
|
|
echo " apply_bridge_iptables_rules - Apply iptables rules for QUIC bridge (nymwg)"
|
|
echo " configure_dns_and_icmp - Allow ICMP ping tests and configure DNS"
|
|
echo " remove_duplicate_bridge_rules - Remove duplicate iptables rules for nymwg"
|
|
echo ""
|
|
echo "Network Inspection Commands:"
|
|
echo " fetch_and_display_ipv6 - Show IPv6 on default network device"
|
|
echo " fetch_wg_ipv6_address - Fetch IPv6 for nymwg interface"
|
|
echo " check_bridge_iptables - Check iptables rules for nymwg"
|
|
echo " check_ipv6_ipv4_forwarding - Check IPv4 and IPv6 forwarding status"
|
|
echo " check_ip_routing - Display IP routing tables"
|
|
echo ""
|
|
echo "Testing Commands:"
|
|
echo " perform_pings - Test IPv4 and IPv6 connectivity"
|
|
echo " test_bridge_connectivity - Comprehensive bridge connectivity test"
|
|
echo ""
|
|
echo "Service Management Commands:"
|
|
echo " check_bridge_service_status - Check nym-bridge and nym-node service status"
|
|
echo " show_bridge_logs [lines] - Show recent nym-bridge logs (default: 50 lines)"
|
|
echo ""
|
|
echo "Quick Start:"
|
|
echo " 1. Run 'verify_bridge_prerequisites' to check prerequisites"
|
|
echo " 2. Run 'check_bridge_installation' to verify installation"
|
|
echo " 3. Run 'test_bridge_connectivity' to test connectivity"
|
|
echo ""
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
echo "Operation '$1' completed successfully."
|
|
|