genwg

genwg is a wireguard and isc bind9 configuration generator with faketcp support and system resolver awareness.

features

• wireguard "server" and "client" peer configuration generation.
• allowing peers to utilize faketcp via udp2raw. (linux and android only)
• android support for upd2raw without wg-quick's PreUp/PreDown hooks which do not exist in the android implementation.
• generation of local plug and play bind9 A and PTR zones that reference the client peers for querying a list of all clients via dig axfr .local_zone @<ip.of.server.iface> and for seamless DNS resoluton via resolv.conf search.
• allowing clients to incorporate the server's recursive DNS resolver into their local bind9 instance so that they get to keep their local zones while forwarding the root zone requests to the wireguard server to prevent leaks. (linux only)
• yaml dump of the state after execution.

as Termux and alike do not have udp2raw packaged, you can find a build script and a prebuilt aarch64 elf binary.

installation

git clone --depth=1 https://github.com/gottaeat/genwg
cd genwg/
pip install .

configuration

specification

servers

WARNING: if the same v4 that resides within extra_allowed of a server exist in the extra_allowed of the client, this network will not be added to that client's network, and when dumping back the yaml, this v4 will be removed from the server's extra_allowed.

WARNING 2: as the static routes installed for faketcp wrapped tunnels, setting the endpoint to an FQDN is not possible.

named

udp2raw

clients

WARNING: doing wireguard over faketcp on android may require root privileges depending on your device firmware.

example

servers:
- name:  wg0
  ip: 1.1.1.1
  port: 51820
  net: 10.0.0.0/24
  mtu: 1420
  named:
    hostname: debian12
    conf_dir: /etc/bind
  extra_address:
    - 192.168.1.2/32
  clients:
    - name: myrouter
      append_extra: true
      extra_allowed:
        - 192.168.1.0/24
    - name: mylinuxdesktop
      bind: true
      root_zone_file: /var/named/zone/root-nov6
    - name: myphone

- name: wg0raw
  ip: 1.1.1.1
  port: 51821
  net: 10.0.1.0/24
  mtu: 1340
  extra_allowed:
    - 10.0.0.0/24
  named:
    hostname: debian12raw
    conf_dir: /etc/bind
  udp2raw:
    port: 6666
  clients:
  - name: corponetlaptop
    bind: true
    root_zone_file: /var/named/zone/root-nov6
    udp2raw_log_path: /var/log/udp2raw.log
  - name: myphone
    udp2raw_log_path: ./udp2raw.log
    android: true
    wgquick_path: /system/xbin/wg-quick
    udp2raw_path: /data/data/com.termux/files/home/udp2raw

- name: wg0guest
  ip: 1.1.1.1
  port: 51822
  net: 10.0.2.0/24
  mtu: 1420
  clients:
    - name: johnguest

usage

genwg -c /path/to/genwg.yml