Add --killswitch option

When used, a killswitch is added using iptables. Fix #24
NilsIrl · Sep 13, 2020 · 18fa687 · 18fa687
1 parent d444437
commit 18fa687
Showing 1 changed file with 19 additions and 1 deletion.
diff --git a/src/main.rs b/src/main.rs
@@ -320,6 +320,12 @@ fn app() -> clap::App<'static, 'static> {
                                 .takes_value(true)
                                 .conflicts_with("port")
                                 .long("hop"),
+                        )
+                        .arg(
+                            Arg::with_name("killswitch")
+                                .help("Enables a kill switch.")
+                                .long("killswitch")
+                                .takes_value(false),
                         ),
                 )
                 .setting(AppSettings::SubcommandRequiredElseHelp),
@@ -613,7 +619,7 @@ fn main() {
                             "[Interface]
 PrivateKey = {}
 Address = {}
-DNS = {}
+DNS = {}{}
 
 [Peer]
 PublicKey = {}
@@ -622,6 +628,18 @@ Endpoint = {}:{}\n",
                             privkey_base64,
                             address,
                             IPV4_GATEWAY,
+                            if save_m.is_present("killswitch") {
+                                "\nPostUp = iptables -I OUTPUT ! -o %i -m mark ! --mark $(wg show \
+                                 %i fwmark) -m addrtype ! --dst-type LOCAL -j REJECT && ip6tables \
+                                 -I OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m \
+                                 addrtype ! --dst-type LOCAL -j REJECT
+PreDown = iptables -D OUTPUT ! -o %i -m mark ! --mark $(wg show %i fwmark) -m addrtype ! \
+                                 --dst-type LOCAL -j REJECT && ip6tables -D OUTPUT ! -o %i -m mark \
+                                 ! --mark $(wg show %i fwmark) -m addrtype ! --dst-type LOCAL -j \
+                                 REJECT"
+                            } else {
+                                ""
+                            },
                             server.public_key,
                             allowed_ips,
                             ip,