initial

examples/wireguard/router_wireguard_dnat.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+# Raspberry Pi router (f0xx.org): WAN UDP 45340 → FE (10.7.0.10).
+# Invoked at boot or from iodine_warmup_helper; also: router_wireguard_dnat.sh [start|stop]
+set -euo pipefail
+
+FE_IP="${FE_IP:-10.7.0.10}"
+WG_PORT="${WG_PORT:-45340}"
+WAN_IF="${WAN_IF:-eth0}"
+
+function start() {
+  if iptables -t nat -C PREROUTING -i "$WAN_IF" -p udp --dport "$WG_PORT" -j DNAT --to-destination "${FE_IP}:${WG_PORT}" 2>/dev/null; then
+    echo "Router DNAT already present for udp/${WG_PORT}"
+  else
+    iptables -t nat -A PREROUTING -i "$WAN_IF" -p udp --dport "$WG_PORT" -j DNAT --to-destination "${FE_IP}:${WG_PORT}"
+    echo "Added router PREROUTING udp/${WG_PORT} -> ${FE_IP}:${WG_PORT}"
+  fi
+
+  if iptables -C FORWARD -p udp -d "${FE_IP}" --dport "$WG_PORT" -j ACCEPT 2>/dev/null; then
+    echo "Router FORWARD rule already present"
+  else
+    iptables -A FORWARD -p udp -d "${FE_IP}" --dport "$WG_PORT" -j ACCEPT
+    echo "Added router FORWARD udp -> ${FE_IP}:${WG_PORT}"
+  fi
+}
+
+function stop() {
+  if iptables -t nat -C PREROUTING -i "$WAN_IF" -p udp --dport "$WG_PORT" -j DNAT --to-destination "${FE_IP}:${WG_PORT}" 2>/dev/null; then
+    iptables -t nat -D PREROUTING -i "$WAN_IF" -p udp --dport "$WG_PORT" -j DNAT --to-destination "${FE_IP}:${WG_PORT}"
+    echo "Removed router PREROUTING DNAT udp/${WG_PORT}"
+  else
+    echo "Router DNAT rule not present for udp/${WG_PORT}"
+  fi
+
+  if iptables -C FORWARD -p udp -d "${FE_IP}" --dport "$WG_PORT" -j ACCEPT 2>/dev/null; then
+    iptables -D FORWARD -p udp -d "${FE_IP}" --dport "$WG_PORT" -j ACCEPT
+    echo "Removed router FORWARD udp -> ${FE_IP}:${WG_PORT}"
+  else
+    echo "Router FORWARD rule not present"
+  fi
+}
+
+cmd=$1
+cmd=${cmd:-start}
+[ "$cmd" = "start" ] && start || stop