https://github.com/pranavdarshan/nasguard-v6
A lightweight and secure NAS solution for IPv6-only servers, powered by WireGuard VPN and Samba. nasguard-v6 was built to solve the challenge of having only a public static IPv6 and no public IPv4, enabling access from IPv4-only clients through an encrypted VPN tunnel.
https://github.com/pranavdarshan/nasguard-v6
debian-12 ipv6-only nas network-attached-storage samba vpn wireguard wireguard-tunnel
Last synced: 3 months ago
JSON representation
A lightweight and secure NAS solution for IPv6-only servers, powered by WireGuard VPN and Samba. nasguard-v6 was built to solve the challenge of having only a public static IPv6 and no public IPv4, enabling access from IPv4-only clients through an encrypted VPN tunnel.
- Host: GitHub
- URL: https://github.com/pranavdarshan/nasguard-v6
- Owner: PranavDarshan
- Created: 2025-07-14T16:57:29.000Z (3 months ago)
- Default Branch: main
- Last Pushed: 2025-07-14T17:58:42.000Z (3 months ago)
- Last Synced: 2025-07-14T22:34:38.973Z (3 months ago)
- Topics: debian-12, ipv6-only, nas, network-attached-storage, samba, vpn, wireguard, wireguard-tunnel
- Language: Shell
- Homepage:
- Size: 228 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# NASGuard-v6
> A lightweight, IPv6-only NAS with secure WireGuard VPN access. Built on Debian 12 (32-bit) for older hardware with public static IPv6. Samba is used for file sharing over the private VPN.
---
## 🔧 Features
* Secure IPv6 NAS with no public IPv4
* WireGuard VPN to bridge IPv4-only clients
* Samba file sharing
* Full firewall and routing config
* Designed for low-spec machines (e.g. old laptops)
---
## 📦 Prerequisites
* [Debian 12](https://www.debian.org/download) (i386 / 32-bit) Server installed
* Public Static IPv6 address
* Internal-only IPv4
---
## 🛠️ Setup Guide
### 1. Clone this Repo
```bash
git https://github.com/PranavDarshan/NASguard-v6
cd NASguard-v6
```
### 2. Setup WireGuard VPN
#### a. Generate keys
```bash
chmod +x generate-key.sh
./generate-key.sh client1
```
Keys will be saved in `keys/` folder.
#### b. Configure Routing
```bash
sudo bash iptables.sh
sudo netfilter-persistent save
```
Ensure `wg0` forwards traffic properly (already configured in `iptables.sh`).
#### After IP tables are set up, you should get something like this.
#### c. Start WireGuard on Boot
```bash
sudo cp start-wireguard.sh /etc/init.d/
sudo chmod +x /etc/init.d/start-wireguard.sh
sudo update-rc.d start-wireguard.sh defaults
```
To stop manually:
```bash
sudo bash stop-wireguard.sh
```
---
#### Once wireguard is started, you can see the output as:
### 3. Setup Samba
#### a. Configure share
```bash
cd samba
chmod +x samba-setup.sh
./samba-setup.sh
```
This creates:
* User `smbuser`
* Share at `/srv/samba/secure`
#### b. Access via VPN
Once VPN is up from a client, access share using:
```
\\10.0.0.1\SecureShare
```
Use credentials created via `samba-setup.sh`
---
## 🧪 Testing
* Use `ping 10.0.0.1` from client
* `sudo wg` on server to check VPN handshakes
* `smbclient //10.0.0.1/SecureShare -U smbuser` for Samba test
---
## 🔐 Security Notes
* All services are only accessible via VPN
* IPv6 traffic is isolated from the WAN
* Strong firewall rules included
---
## 🙋♂️ Why This Project?
This setup was created due to lack of publicly available static IPv4, while IPv6 was available. It's an attempt to use old hardware effectively and securely for modern personal cloud storage.
---
## 📮 Suggestions?
Open a GitHub issue or pull request!