diff --git a/README.md b/README.md index 84de40e..2737416 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ is given two files to download: a wireguard config with his private key (and add to load into his VPN software, and a "fragment", which is a `[Peer]` section that he must send to the server administrator. -AT NO POINT IS ANY EXTERNAL SERVER CONTACTED. KEYS NEVER LEAVE THE USER'S COMPUTER UNTIL +AT THIS POINT NO EXTERNAL SERVER IS CONTACTED. KEYS NEVER LEAVE THE USER'S COMPUTER UNTIL THEY EXPLICITLY SEND THE FRAGMENT TO THE SEVER ADMIN. Compared to other online key generators out there, this one does not require you to @@ -39,6 +39,12 @@ trust me (the author) or the person running the webserver. Alternatively, you could host the site yourself. +## OPNsense bridge + +Additionally, there's an interface to OPNsense instances. These get contacted to get back a free IP address inside the given tunnel realm, get a wireguard server list and finally push the generated config to the OPNsense. AT THIS POINT, A SERVER IS CONTACTED, but only the one You gave inside the field "OPNsense URL". THERE IS NO OTHER SERVER CONTACTED BY THIS PROJECT. +To make this work, You have to put or link the file `opnsensebridge.py` into your `cgi-bin` directory (i.e. `/usr/lib/cgi-bin`) and make it executable. It must be accessible and executable from `/cgi-bin/opnsensebridge.py`. Also You might need the apache cgi module which You can enable with `a2enmod cgid`. +This funtion is in a beta state, errors might not get caught, things can happen... + ## Single-file version A single-file version with embedded scripts is available under the "single-file" @@ -64,7 +70,7 @@ no special knowledge required.. The VPN admin fills in the form fields and clicks "save", which generates a URL with the parameters saved inside the query string. Upon opening this URL the form will -be pre-filled. +be pre-filled. It's strongly advised not to save with filled out OPNsense credentials - they will appear openly in the resulting URL. The admin sends the URL to users, which generate the keys and send the "Server Fragment" back to the admin. An email address can optionally be specified, diff --git a/index.html b/index.html index ebc9496..fc622c5 100644 --- a/index.html +++ b/index.html @@ -5,77 +5,175 @@
Note: for maximum security, close all other browser tabs and all programs before generating the configuration files
- +You must keep the client configuration for yourself and send the - server fragment to the VPN server administrator
- Download Client ConfigurationNote: for maximum security, reboot your computer after you are done
The parameters are usually set by the server administrator and can be saved in URL's query string. Only the - client address and name need to be changed per client. The client name is optional and serves to uniquely - label the config fragments sent to the server.
-Filling in "Admin Email" will enable a mailto link.
-If this webpage is not used in private mode, the contents of the client config will be stored in the - browser's history as the download location of the file.
-There are no guarantees that javascript crypto is safe from side-channel attacks and there is no secure - wipe function, that's why it is recommended to close all other tabs before and reboot the machine after.
-NO WARRANTY EXPRESSED OR IMPLIED!!!!
+The parameters are usually set by the server administrator and can be saved in URL's query string. Only + the + client address and name need to be changed per client. The client name is optional and serves to + uniquely + label the config fragments sent to the server.
+Filling in "Admin Email" will enable a mailto link.
+If this webpage is not used in private mode, the contents of the client config will be stored in the + browser's history as the download location of the file.
+There are no guarantees that javascript crypto is safe from side-channel attacks and there is no secure + wipe function, that's why it is recommended to close all other tabs before and reboot the machine after. +
+NO WARRANTY EXPRESSED OR IMPLIED!!!!
This tool © 2022 Juan I Carrano; Keygen code © 2015-2020 Jason A. Donenfeld.
- This project is not associated with WireGuard®. "WireGuard" and the "WireGuard" logo are registered trademarks of Jason A. Donenfeld.
- GitHub Repository
+ This project is not associated with WireGuard®. "WireGuard" and the "WireGuard" logo are registered
+ trademarks of Jason A. Donenfeld.
+ GitHub Repository
| t |