diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..f4d737f
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    assignees:
+      - "angristan"
+    reviewers:
+      - "angristan"
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000..0951108
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,22 @@
+on: [push, pull_request, pull_request_target]
+
+name: Lint
+
+jobs:
+  shellcheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: shellcheck
+        uses: ludeeus/action-shellcheck@1.0.0
+        env:
+          SHELLCHECK_OPTS: -e SC1091,SC1117,SC2001,SC2034
+
+  shfmt:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: shfmt
+        uses: bltavares/actions/shfmt@master
+        env:
+          SHFMT_ARGS: -d
diff --git a/.github/workflows/push.yml b/.github/workflows/push.yml
deleted file mode 100644
index 33edafa..0000000
--- a/.github/workflows/push.yml
+++ /dev/null
@@ -1,13 +0,0 @@
-on: push
-name: ShellCheck
-jobs:
-  shellcheck:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@master
-    - name: shellcheck
-      uses: ludeeus/action-shellcheck@0.0.1
-      env:
-        SHELLCHECK_OPTS: -e SC1091,SC1117,SC2001
-      with:
-        args: wireguard-install.sh
diff --git a/README.md b/README.md
index fb81e47..2f0b6f6 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,8 @@
 # WireGuard installer
 
+![Lint](https://github.com/angristan/wireguard-install/workflows/Lint/badge.svg)
+![visitors](https://visitor-badge.glitch.me/badge?page_id=angristan.wireguard-install)
+
 **This project is a bash script that aims to setup a [WireGuard](https://www.wireguard.com/) VPN on a Linux server, as easily as possible!**
 
 WireGuard is a point-to-point VPN that can be used in different ways. Here, we mean a VPN as in: the client will forward all its traffic trough an encrypted tunnel to the server.
@@ -13,18 +16,12 @@ WireGuard does not fit your environment? Check out [openvpn-install](https://git
 
 Supported distributions:
 
-- Ubuntu
-- Debian
+- Ubuntu >= 16.04
+- Debian 10
 - Fedora
 - CentOS
 - Arch Linux
 
-I recommend these cheap cloud providers for your VPN server:
-
-- [Vultr](https://goo.gl/Xyd1Sc): Worldwide locations, IPv6 support, starting at $3.50/month
-- [PulseHeberg](https://goo.gl/76yqW5): France, unlimited bandwidth, starting at €3/month
-- [Digital Ocean](https://goo.gl/qXrNLK): Worldwide locations, IPv6 support, starting at $5/month
-
 ## Usage
 
 Download and execute the script. Answer the questions asked by the script and it will take care of the rest.
@@ -37,12 +34,13 @@ chmod +x wireguard-install.sh
 
 It will install WireGuard (kernel module and tools) on the server, configure it, create a systemd service and a client configuration file.
 
-To generate more client files, run the following:
+Run the script again to add or remove clients!
 
-```sh
-./wireguard-install.sh add_client
-```
+## Providers
 
-Make sure you choose different IPs for you clients.
+I recommend these cheap cloud providers for your VPN server:
 
-Contributions are welcome!
+- [Vultr](https://goo.gl/Xyd1Sc): Worldwide locations, IPv6 support, starting at \$3.50/month
+- [Hetzner](https://hetzner.cloud/?ref=ywtlvZsjgeDq): Germany and Finland, IPv6, 20 TB of traffic, starting at €3/month
+- [Digital Ocean](https://goo.gl/qXrNLK): Worldwide locations, IPv6 support, starting at \$5/month
+- [PulseHeberg](https://goo.gl/76yqW5): France, unlimited bandwidth, starting at €3/month
diff --git a/wireguard-install.sh b/wireguard-install.sh
index 11ba63c..cd0b5e0 100644
--- a/wireguard-install.sh
+++ b/wireguard-install.sh
@@ -1,223 +1,435 @@
 #!/bin/bash
 
-function addClient () {
-    # Load params
-    source /etc/wireguard/params
+# Secure WireGuard server installer for Debian, Ubuntu, CentOS, Fedora and Arch Linux
+# https://github.com/angristan/wireguard-install
 
-    if [[ $SERVER_PUB_IP =~ .*:.* ]]
-    then
-        echo "IPv6 Detected"
-        ENDPOINT="[$SERVER_PUB_IP]:$SERVER_PORT"
-    else
-        echo "IPv4 Detected"
-        ENDPOINT="$SERVER_PUB_IP:$SERVER_PORT"
-    fi
-
-    CLIENT_WG_IPV4="10.66.66.2"
-    read -rp "Client's WireGuard IPv4 " -e -i "$CLIENT_WG_IPV4" CLIENT_WG_IPV4
-
-    CLIENT_WG_IPV6="fd42:42:42::2"
-    read -rp "Client's WireGuard IPv6 " -e -i "$CLIENT_WG_IPV6" CLIENT_WG_IPV6
-
-    # Adguard DNS by default
-    CLIENT_DNS_1="176.103.130.130"
-    read -rp "First DNS resolver to use for the client: " -e -i "$CLIENT_DNS_1" CLIENT_DNS_1
-
-    CLIENT_DNS_2="176.103.130.131"
-    read -rp "Second DNS resolver to use for the client: " -e -i "$CLIENT_DNS_2" CLIENT_DNS_2
-
-    CLIENT_NAME=$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 10 ; echo '')
-
-    # Generate key pair for the client
-    CLIENT_PRIV_KEY=$(wg genkey)
-    CLIENT_PUB_KEY=$(echo "$CLIENT_PRIV_KEY" | wg pubkey)
-
-    # Create client file and add the server as a peer
-    echo "[Interface]
-PrivateKey = $CLIENT_PRIV_KEY
-Address = $CLIENT_WG_IPV4/24,$CLIENT_WG_IPV6/64
-DNS = $CLIENT_DNS_1,$CLIENT_DNS_2
-
-[Peer]
-PublicKey = $SERVER_PUB_KEY
-PresharedKey = $SYMM_PRE_KEY
-Endpoint = $ENDPOINT
-AllowedIPs = 0.0.0.0/0,::/0" >> "$HOME/$SERVER_WG_NIC-client-$CLIENT_NAME.conf"
-
-    # Add the client as a peer to the server
-    echo -e "\n[Peer]
-PublicKey = $CLIENT_PUB_KEY
-PresharedKey = $SYMM_PRE_KEY
-AllowedIPs = $CLIENT_WG_IPV4/32,$CLIENT_WG_IPV6/128" >> "/etc/wireguard/$SERVER_WG_NIC.conf"
-
-    systemctl restart "wg-quick@$SERVER_WG_NIC"
-
-    echo -e "\nHere is your client config file as a QR Code:"
-
-    qrencode -t ansiutf8 -l L < "$HOME/$SERVER_WG_NIC-client-$CLIENT_NAME.conf"
-
-    echo "It is also available in $HOME/$SERVER_WG_NIC-client-$CLIENT_NAME.conf"
+function isRoot() {
+	if [ "${EUID}" -ne 0 ]; then
+		echo "You need to run this script as root"
+		exit 1
+	fi
 }
 
-if [ "$EUID" -ne 0 ]; then
-    echo "You need to run this script as root"
-    exit 1
-fi
+function checkVirt() {
+	if [ "$(systemd-detect-virt)" == "openvz" ]; then
+		echo "OpenVZ is not supported"
+		exit 1
+	fi
 
-if [ "$(systemd-detect-virt)" == "openvz" ]; then
-    echo "OpenVZ is not supported"
-    exit
-fi
+	if [ "$(systemd-detect-virt)" == "lxc" ]; then
+		echo "LXC is not supported (yet)."
+		echo "WireGuard can technically run in an LXC container,"
+		echo "but the kernel module has to be installed on the host,"
+		echo "the container has to be run with some specific parameters"
+		echo "and only the tools need to be installed in the container."
+		exit 1
+	fi
+}
 
-if [ "$(systemd-detect-virt)" == "lxc" ]; then
-    echo "LXC is not supported (yet)."
-    echo "WireGuard can technically run in an LXC container,"
-    echo "but the kernel module has to be installed on the host,"
-    echo "the container has to be run with some specific parameters"
-    echo "and only the tools need to be installed in the container."
-    exit
-fi
+function checkOS() {
+	# Check OS version
+	if [[ -e /etc/debian_version ]]; then
+		source /etc/os-release
+		OS="${ID}" # debian or ubuntu
+		if [[ ${ID} == "debian" || ${ID} == "raspbian" ]]; then
+			if [[ ${VERSION_ID} -ne 10 ]]; then
+				echo "Your version of Debian (${VERSION_ID}) is not supported. Please use Debian 10 Buster"
+				exit 1
+			fi
+		fi
+	elif [[ -e /etc/fedora-release ]]; then
+		source /etc/os-release
+		OS="${ID}"
+	elif [[ -e /etc/centos-release ]]; then
+		source /etc/os-release
+		OS=centos
+	elif [[ -e /etc/arch-release ]]; then
+		OS=arch
+	else
+		echo "Looks like you aren't running this installer on a Debian, Ubuntu, Fedora, CentOS or Arch Linux system"
+		exit 1
+	fi
+}
 
-if [[ $1 == "add_client" ]];then
-    if [[ -e /etc/wireguard ]]; then
-        addClient
-        exit 0
-    else
-        echo "Please install WireGuard first."
-        exit 1
-    fi
-elif [[ -e /etc/wireguard ]]; then
-    echo "WireGuard is already installed. Run with 'add_client' to add a client."
-    exit 1
-fi
+function initialCheck() {
+	isRoot
+	checkVirt
+	checkOS
+}
 
-# Check OS version
-if [[ -e /etc/debian_version ]]; then
-    source /etc/os-release
-    OS=$ID # debian or ubuntu
-elif [[ -e /etc/fedora-release ]]; then
-    source /etc/os-release
-    OS=$ID
-elif [[ -e /etc/centos-release ]]; then
-    OS=centos
-elif [[ -e /etc/arch-release ]]; then
-    OS=arch
+function installQuestions() {
+	echo "Welcome to the WireGuard installer!"
+	echo "The git repository is available at: https://github.com/angristan/wireguard-install"
+	echo ""
+	echo "I need to ask you a few questions before starting the setup."
+	echo "You can leave the default options and just press enter if you are ok with them."
+	echo ""
+
+	# Detect public IPv4 or IPv6 address and pre-fill for the user
+	SERVER_PUB_IP=$(ip -4 addr | sed -ne 's|^.* inet \([^/]*\)/.* scope global.*$|\1|p' | head -1)
+	if [[ -z ${SERVER_PUB_IP} ]]; then
+		# Detect public IPv6 address
+		SERVER_PUB_IP=$(ip -6 addr | sed -ne 's|^.* inet6 \([^/]*\)/.* scope global.*$|\1|p' | head -1)
+	fi
+	read -rp "IPv4 or IPv6 public address: " -e -i "${SERVER_PUB_IP}" SERVER_PUB_IP
+
+	# Detect public interface and pre-fill for the user
+	SERVER_NIC="$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1)"
+	until [[ ${SERVER_PUB_NIC} =~ ^[a-zA-Z0-9_]+$ ]]; do
+		read -rp "Public interface: " -e -i "${SERVER_NIC}" SERVER_PUB_NIC
+	done
+
+	until [[ ${SERVER_WG_NIC} =~ ^[a-zA-Z0-9_]+$ && ${#SERVER_WG_NIC} -lt 16 ]]; do
+		read -rp "WireGuard interface name: " -e -i wg0 SERVER_WG_NIC
+	done
+
+	until [[ ${SERVER_WG_IPV4} =~ ^([0-9]{1,3}\.){3} ]]; do
+		read -rp "Server's WireGuard IPv4: " -e -i 10.66.66.1 SERVER_WG_IPV4
+	done
+
+	until [[ ${SERVER_WG_IPV6} =~ ^([a-f0-9]{1,4}:){3,4}: ]]; do
+		read -rp "Server's WireGuard IPv6: " -e -i fd42:42:42::1 SERVER_WG_IPV6
+	done
+
+	# Generate random number within private ports range
+	RANDOM_PORT=$(shuf -i49152-65535 -n1)
+	until [[ ${SERVER_PORT} =~ ^[0-9]+$ ]] && [ "${SERVER_PORT}" -ge 1 ] && [ "${SERVER_PORT}" -le 65535 ]; do
+		read -rp "Server's WireGuard port [1-65535]: " -e -i "${RANDOM_PORT}" SERVER_PORT
+	done
+
+	# Adguard DNS by default
+	until [[ ${CLIENT_DNS_1} =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ ]]; do
+		read -rp "First DNS resolver to use for the clients: " -e -i 176.103.130.130 CLIENT_DNS_1
+	done
+	until [[ ${CLIENT_DNS_2} =~ ^((25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)$ ]]; do
+		read -rp "Second DNS resolver to use for the clients (optional): " -e -i 176.103.130.131 CLIENT_DNS_2
+		if [[ ${CLIENT_DNS_2} == "" ]]; then
+			CLIENT_DNS_2="${CLIENT_DNS_1}"
+		fi
+	done
+
+	echo ""
+	echo "Okay, that was all I needed. We are ready to setup your WireGuard server now."
+	echo "You will be able to generate a client at the end of the installation."
+	read -n1 -r -p "Press any key to continue..."
+}
+
+function installWireGuard() {
+	# Run setup questions first
+	installQuestions
+
+	# Install WireGuard tools and module
+	if [[ ${OS} == 'ubuntu' ]]; then
+		apt-get update
+		apt-get install -y wireguard iptables resolvconf qrencode
+	elif [[ ${OS} == 'debian' ]]; then
+		if ! grep -rqs "^deb .* buster-backports" /etc/apt/; then
+			echo "deb http://deb.debian.org/debian buster-backports main" >/etc/apt/sources.list.d/backports.list
+			apt-get update
+		fi
+		apt update
+		apt-get install -y iptables resolvconf qrencode
+		apt-get install -y -t buster-backports wireguard
+	elif [[ ${OS} == 'fedora' ]]; then
+		if [[ ${VERSION_ID} -lt 32 ]]; then
+			dnf install -y dnf-plugins-core
+			dnf copr enable -y jdoss/wireguard
+			dnf install -y wireguard-dkms
+		fi
+		dnf install -y wireguard-tools iptables qrencode
+	elif [[ ${OS} == 'centos' ]]; then
+		yum -y install epel-release elrepo-release
+		if [[ ${VERSION_ID} -eq 7 ]]; then
+			yum -y install yum-plugin-elrepo
+		fi
+		yum -y install kmod-wireguard wireguard-tools iptables qrencode
+	elif [[ ${OS} == 'arch' ]]; then
+		# Check if current running kernel is LTS
+		ARCH_KERNEL_RELEASE=$(uname -r)
+		if [[ ${ARCH_KERNEL_RELEASE} == *lts* ]]; then
+			pacman -S --noconfirm linux-lts-headers
+		else
+			pacman -S --noconfirm linux-headers
+		fi
+		pacman -S --noconfirm wireguard-tools iptables qrencode
+	fi
+
+	# Make sure the directory exists (this does not seem the be the case on fedora)
+	mkdir /etc/wireguard >/dev/null 2>&1
+
+	chmod 600 -R /etc/wireguard/
+
+	SERVER_PRIV_KEY=$(wg genkey)
+	SERVER_PUB_KEY=$(echo "${SERVER_PRIV_KEY}" | wg pubkey)
+
+	# Save WireGuard settings
+	echo "SERVER_PUB_IP=${SERVER_PUB_IP}
+SERVER_PUB_NIC=${SERVER_PUB_NIC}
+SERVER_WG_NIC=${SERVER_WG_NIC}
+SERVER_WG_IPV4=${SERVER_WG_IPV4}
+SERVER_WG_IPV6=${SERVER_WG_IPV6}
+SERVER_PORT=${SERVER_PORT}
+SERVER_PRIV_KEY=${SERVER_PRIV_KEY}
+SERVER_PUB_KEY=${SERVER_PUB_KEY}
+CLIENT_DNS_1=${CLIENT_DNS_1}
+CLIENT_DNS_2=${CLIENT_DNS_2}" >/etc/wireguard/params
+
+	# Add server interface
+	echo "[Interface]
+Address = ${SERVER_WG_IPV4}/24,${SERVER_WG_IPV6}/64
+ListenPort = ${SERVER_PORT}
+PrivateKey = ${SERVER_PRIV_KEY}" >"/etc/wireguard/${SERVER_WG_NIC}.conf"
+
+	if pgrep firewalld; then
+		FIREWALLD_IPV4_ADDRESS=$(echo "${SERVER_WG_IPV4}" | cut -d"." -f1-3)".0"
+		FIREWALLD_IPV6_ADDRESS=$(echo "${SERVER_WG_IPV6}" | sed 's/:[^:]*$/:0/')
+		echo "PostUp = firewall-cmd --add-port ${SERVER_PORT}/udp && firewall-cmd --add-rich-rule='rule family=ipv4 source address=${FIREWALLD_IPV4_ADDRESS}/24 masquerade' && firewall-cmd --add-rich-rule='rule family=ipv6 source address=${FIREWALLD_IPV6_ADDRESS}/24 masquerade'
+PostDown = firewall-cmd --remove-port ${SERVER_PORT}/udp && firewall-cmd --remove-rich-rule='rule family=ipv4 source address=${FIREWALLD_IPV4_ADDRESS}/24 masquerade' && firewall-cmd --remove-rich-rule='rule family=ipv6 source address=${FIREWALLD_IPV6_ADDRESS}/24 masquerade'" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
+	else
+		echo "PostUp = iptables -A FORWARD -i ${SERVER_PUB_NIC} -o ${SERVER_WG_NIC} -j ACCEPT; iptables -A FORWARD -i ${SERVER_WG_NIC} -j ACCEPT; iptables -t nat -A POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE; ip6tables -A FORWARD -i ${SERVER_WG_NIC} -j ACCEPT; ip6tables -t nat -A POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE
+PostDown = iptables -D FORWARD -i ${SERVER_PUB_NIC} -o ${SERVER_WG_NIC} -j ACCEPT; iptables -D FORWARD -i ${SERVER_WG_NIC} -j ACCEPT; iptables -t nat -D POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE; ip6tables -D FORWARD -i ${SERVER_WG_NIC} -j ACCEPT; ip6tables -t nat -D POSTROUTING -o ${SERVER_PUB_NIC} -j MASQUERADE" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
+	fi
+
+	# Enable routing on the server
+	echo "net.ipv4.ip_forward = 1
+net.ipv6.conf.all.forwarding = 1" >/etc/sysctl.d/wg.conf
+
+	sysctl --system
+
+	systemctl start "wg-quick@${SERVER_WG_NIC}"
+	systemctl enable "wg-quick@${SERVER_WG_NIC}"
+
+	# Check if WireGuard is running
+	systemctl is-active --quiet "wg-quick@${SERVER_WG_NIC}"
+	WG_RUNNING=$?
+
+	# WireGuard might not work if we updated the kernel. Tell the user to reboot
+	if [[ ${WG_RUNNING} -ne 0 ]]; then
+		echo -e "\nWARNING: WireGuard does not seem to be running."
+		echo "You can check if WireGuard is running with: systemctl status wg-quick@${SERVER_WG_NIC}"
+		echo "If you get something like \"Cannot find device ${SERVER_WG_NIC}\", please reboot!"
+	fi
+
+	newClient
+	echo "If you want to add more clients, you simply need to run this script another time!"
+}
+
+function newClient() {
+	ENDPOINT="${SERVER_PUB_IP}:${SERVER_PORT}"
+
+	echo ""
+	echo "Tell me a name for the client."
+	echo "The name must consist of alphanumeric character. It may also include an underscore or a dash and can't exceed 15 chars."
+
+	until [[ ${CLIENT_NAME} =~ ^[a-zA-Z0-9_-]+$ && ${CLIENT_EXISTS} == '0' && ${#CLIENT_NAME} -lt 16 ]]; do
+		read -rp "Client name: " -e CLIENT_NAME
+		CLIENT_EXISTS=$(grep -c -E "^### Client ${CLIENT_NAME}\$" "/etc/wireguard/${SERVER_WG_NIC}.conf")
+
+		if [[ ${CLIENT_EXISTS} == '1' ]]; then
+			echo ""
+			echo "A client with the specified name was already created, please choose another name."
+			echo ""
+		fi
+	done
+
+	for DOT_IP in {2..254}; do
+		DOT_EXISTS=$(grep -c "${SERVER_WG_IPV4::-1}${DOT_IP}" "/etc/wireguard/${SERVER_WG_NIC}.conf")
+		if [[ ${DOT_EXISTS} == '0' ]]; then
+			break
+		fi
+	done
+
+	if [[ ${DOT_EXISTS} == '1' ]]; then
+		echo ""
+		echo "The subnet configured supports only 253 clients."
+		exit 1
+	fi
+
+	until [[ ${IPV4_EXISTS} == '0' ]]; do
+		read -rp "Client's WireGuard IPv4: ${SERVER_WG_IPV4::-1}" -e -i "${DOT_IP}" DOT_IP
+		CLIENT_WG_IPV4="${SERVER_WG_IPV4::-1}${DOT_IP}"
+		IPV4_EXISTS=$(grep -c "$CLIENT_WG_IPV4" "/etc/wireguard/${SERVER_WG_NIC}.conf")
+
+		if [[ ${IPV4_EXISTS} == '1' ]]; then
+			echo ""
+			echo "A client with the specified IPv4 was already created, please choose another IPv4."
+			echo ""
+		fi
+	done
+
+	until [[ ${IPV6_EXISTS} == '0' ]]; do
+		read -rp "Client's WireGuard IPv6: ${SERVER_WG_IPV6::-1}" -e -i "${DOT_IP}" DOT_IP
+		CLIENT_WG_IPV6="${SERVER_WG_IPV6::-1}${DOT_IP}"
+		IPV6_EXISTS=$(grep -c "${CLIENT_WG_IPV6}" "/etc/wireguard/${SERVER_WG_NIC}.conf")
+
+		if [[ ${IPV6_EXISTS} == '1' ]]; then
+			echo ""
+			echo "A client with the specified IPv6 was already created, please choose another IPv6."
+			echo ""
+		fi
+	done
+
+	# Generate key pair for the client
+	CLIENT_PRIV_KEY=$(wg genkey)
+	CLIENT_PUB_KEY=$(echo "${CLIENT_PRIV_KEY}" | wg pubkey)
+	CLIENT_PRE_SHARED_KEY=$(wg genpsk)
+
+	# Home directory of the user, where the client configuration will be written
+	if [ -e "/home/${CLIENT_NAME}" ]; then # if $1 is a user name
+		HOME_DIR="/home/${CLIENT_NAME}"
+	elif [ "${SUDO_USER}" ]; then # if not, use SUDO_USER
+		HOME_DIR="/home/${SUDO_USER}"
+	else # if not SUDO_USER, use /root
+		HOME_DIR="/root"
+	fi
+
+	# Create client file and add the server as a peer
+	echo "[Interface]
+PrivateKey = ${CLIENT_PRIV_KEY}
+Address = ${CLIENT_WG_IPV4}/32,${CLIENT_WG_IPV6}/128
+DNS = ${CLIENT_DNS_1},${CLIENT_DNS_2}
+
+[Peer]
+PublicKey = ${SERVER_PUB_KEY}
+PresharedKey = ${CLIENT_PRE_SHARED_KEY}
+Endpoint = ${ENDPOINT}
+AllowedIPs = 0.0.0.0/0,::/0" >>"${HOME_DIR}/${SERVER_WG_NIC}-client-${CLIENT_NAME}.conf"
+
+	# Add the client as a peer to the server
+	echo -e "\n### Client ${CLIENT_NAME}
+[Peer]
+PublicKey = ${CLIENT_PUB_KEY}
+PresharedKey = ${CLIENT_PRE_SHARED_KEY}
+AllowedIPs = ${CLIENT_WG_IPV4}/32,${CLIENT_WG_IPV6}/128" >>"/etc/wireguard/${SERVER_WG_NIC}.conf"
+
+	systemctl restart "wg-quick@${SERVER_WG_NIC}"
+
+	echo -e "\nHere is your client config file as a QR Code:"
+
+	qrencode -t ansiutf8 -l L <"${HOME_DIR}/${SERVER_WG_NIC}-client-${CLIENT_NAME}.conf"
+
+	echo "It is also available in ${HOME_DIR}/${SERVER_WG_NIC}-client-${CLIENT_NAME}.conf"
+}
+
+function revokeClient() {
+	NUMBER_OF_CLIENTS=$(grep -c -E "^### Client" "/etc/wireguard/${SERVER_WG_NIC}.conf")
+	if [[ ${NUMBER_OF_CLIENTS} == '0' ]]; then
+		echo ""
+		echo "You have no existing clients!"
+		exit 1
+	fi
+
+	echo ""
+	echo "Select the existing client you want to revoke"
+	grep -E "^### Client" "/etc/wireguard/${SERVER_WG_NIC}.conf" | cut -d ' ' -f 3 | nl -s ') '
+	until [[ ${CLIENT_NUMBER} -ge 1 && ${CLIENT_NUMBER} -le ${NUMBER_OF_CLIENTS} ]]; do
+		if [[ ${CLIENT_NUMBER} == '1' ]]; then
+			read -rp "Select one client [1]: " CLIENT_NUMBER
+		else
+			read -rp "Select one client [1-${NUMBER_OF_CLIENTS}]: " CLIENT_NUMBER
+		fi
+	done
+
+	# match the selected number to a client name
+	CLIENT_NAME=$(grep -E "^### Client" "/etc/wireguard/${SERVER_WG_NIC}.conf" | cut -d ' ' -f 3 | sed -n "${CLIENT_NUMBER}"p)
+
+	# remove [Peer] block matching $CLIENT_NAME
+	sed -i "/^### Client ${CLIENT_NAME}\$/,/^$/d" "/etc/wireguard/${SERVER_WG_NIC}.conf"
+
+	# remove generated client file
+	rm -f "${HOME}/${SERVER_WG_NIC}-client-${CLIENT_NAME}.conf"
+
+	# restart wireguard to apply changes
+	systemctl restart "wg-quick@${SERVER_WG_NIC}"
+}
+
+function uninstallWg() {
+	echo ""
+	read -rp "Do you really want to remove WireGuard? [y/n]: " -e -i n REMOVE
+	if [[ $REMOVE == 'y' ]]; then
+		checkOS
+
+		systemctl stop "wg-quick@${SERVER_WG_NIC}"
+		systemctl disable "wg-quick@${SERVER_WG_NIC}"
+
+		if [[ ${OS} == 'ubuntu' ]]; then
+			apt-get autoremove --purge -y wireguard qrencode
+		elif [[ ${OS} == 'debian' ]]; then
+			apt-get autoremove --purge -y wireguard qrencode
+		elif [[ ${OS} == 'fedora' ]]; then
+			dnf remove -y wireguard-tools qrencode
+			if [[ ${VERSION_ID} -lt 32 ]]; then
+				dnf remove -y wireguard-dkms
+				dnf copr disable -y jdoss/wireguard
+			fi
+			dnf autoremove -y
+		elif [[ ${OS} == 'centos' ]]; then
+			yum -y remove kmod-wireguard wireguard-tools qrencode
+			yum -y autoremove
+		elif [[ ${OS} == 'arch' ]]; then
+			pacman -Rs --noconfirm wireguard-tools qrencode
+		fi
+
+		rm -rf /etc/wireguard
+		rm -f /etc/sysctl.d/wg.conf
+
+		# Reload sysctl
+		sysctl --system
+
+		# Check if WireGuard is running
+		systemctl is-active --quiet "wg-quick@${SERVER_WG_NIC}"
+		WG_RUNNING=$?
+
+		if [[ ${WG_RUNNING} -eq 0 ]]; then
+			echo "WireGuard failed to uninstall properly."
+			exit 1
+		else
+			echo "WireGuard uninstalled successfully."
+			exit 0
+		fi
+	else
+		echo ""
+		echo "Removal aborted!"
+	fi
+}
+
+function manageMenu() {
+	echo "Welcome to WireGuard-install!"
+	echo "The git repository is available at: https://github.com/angristan/wireguard-install"
+	echo ""
+	echo "It looks like WireGuard is already installed."
+	echo ""
+	echo "What do you want to do?"
+	echo "   1) Add a new user"
+	echo "   2) Revoke existing user"
+	echo "   3) Uninstall WireGuard"
+	echo "   4) Exit"
+	until [[ ${MENU_OPTION} =~ ^[1-4]$ ]]; do
+		read -rp "Select an option [1-4]: " MENU_OPTION
+	done
+	case "${MENU_OPTION}" in
+	1)
+		newClient
+		;;
+	2)
+		revokeClient
+		;;
+	3)
+		uninstallWg
+		;;
+	4)
+		exit 0
+		;;
+	esac
+}
+
+# Check for root, virt, OS...
+initialCheck
+
+# Check if WireGuard is already installed and load params
+if [[ -e /etc/wireguard/params ]]; then
+	source /etc/wireguard/params
+	manageMenu
 else
-    echo "Looks like you aren't running this installer on a Debian, Ubuntu, Fedora, CentOS or Arch Linux system"
-    exit 1
+	installWireGuard
 fi
-
-# Detect public IPv4 address and pre-fill for the user
-SERVER_PUB_IPV4=$(ip addr | grep 'inet' | grep -v inet6 | grep -vE '127\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | head -1)
-read -rp "IPv4 or IPv6 public address: " -e -i "$SERVER_PUB_IPV4" SERVER_PUB_IP
-
-# Detect public interface and pre-fill for the user
-SERVER_PUB_NIC="$(ip -4 route ls | grep default | grep -Po '(?<=dev )(\S+)' | head -1)"
-read -rp "Public interface: " -e -i "$SERVER_PUB_NIC" SERVER_PUB_NIC
-
-SERVER_WG_NIC="wg0"
-read -rp "WireGuard interface name: " -e -i "$SERVER_WG_NIC" SERVER_WG_NIC
-
-SERVER_WG_IPV4="10.66.66.1"
-read -rp "Server's WireGuard IPv4: " -e -i "$SERVER_WG_IPV4" SERVER_WG_IPV4
-
-SERVER_WG_IPV6="fd42:42:42::1"
-read -rp "Server's WireGuard IPv6: " -e -i "$SERVER_WG_IPV6" SERVER_WG_IPV6
-
-# Generate random number within private ports range
-SERVER_PORT=$(shuf -i49152-65535 -n1)
-read -rp "Server's WireGuard port: " -e -i "$SERVER_PORT" SERVER_PORT
-
-# Install WireGuard tools and module
-if [[ "$OS" = 'ubuntu' ]]; then
-    apt-get install -y software-properties-common
-    add-apt-repository -y ppa:wireguard/wireguard
-    apt-get update
-    apt-get install -y "linux-headers-$(uname -r)"
-    apt-get install -y wireguard iptables resolvconf qrencode
-elif [[ "$OS" = 'debian' ]]; then
-    echo "deb http://deb.debian.org/debian/ unstable main" > /etc/apt/sources.list.d/unstable.list
-    printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' > /etc/apt/preferences.d/limit-unstable
-    apt update
-    apt-get install -y "linux-headers-$(uname -r)"
-    apt-get install -y wireguard iptables resolvconf qrencode
-elif [[ "$OS" = 'fedora' ]]; then
-    if [[ "$VERSION_ID" -lt 32 ]]; then
-        dnf install -y dnf-plugins-core
-        dnf copr enable -y jdoss/wireguard
-        dnf install -y wireguard-dkms
-    fi
-    dnf install -y wireguard-tools iptables qrencode
-elif [[ "$OS" = 'centos' ]]; then
-    curl -Lo /etc/yum.repos.d/wireguard.repo https://copr.fedorainfracloud.org/coprs/jdoss/wireguard/repo/epel-7/jdoss-wireguard-epel-7.repo
-    yum -y install epel-release
-    yum -y install wireguard-dkms wireguard-tools iptables qrencode
-elif [[ "$OS" = 'arch' ]]; then
-    pacman -S --noconfirm linux-headers
-    pacman -S --noconfirm wireguard-tools iptables wireguard-arch qrencode
-fi
-
-# Make sure the directory exists (this does not seem the be the case on fedora)
-mkdir /etc/wireguard > /dev/null 2>&1
-
-chmod 600 -R /etc/wireguard/
-
-SERVER_PRIV_KEY=$(wg genkey)
-SERVER_PUB_KEY=$(echo "$SERVER_PRIV_KEY" | wg pubkey)
-
-# Save WireGuard settings
-echo "SERVER_PUB_IP=$SERVER_PUB_IP
-SERVER_PUB_NIC=$SERVER_PUB_NIC
-SERVER_WG_NIC=$SERVER_WG_NIC
-SERVER_WG_IPV4=$SERVER_WG_IPV4
-SERVER_WG_IPV6=$SERVER_WG_IPV6
-SERVER_PORT=$SERVER_PORT
-SERVER_PRIV_KEY=$SERVER_PRIV_KEY
-SERVER_PUB_KEY=$SERVER_PUB_KEY
-SYMM_PRE_KEY=$( wg genpsk )" > /etc/wireguard/params
-
-source /etc/wireguard/params
-
-# Add server interface
-echo "[Interface]
-Address = $SERVER_WG_IPV4/24,$SERVER_WG_IPV6/64
-ListenPort = $SERVER_PORT
-PrivateKey = $SERVER_PRIV_KEY" > "/etc/wireguard/$SERVER_WG_NIC.conf"
-
-if [ -x "$(command -v firewall-cmd)" ]; then
-    FIREWALLD_IPV4_ADDRESS=$(echo "$SERVER_WG_IPV4" | cut -d"." -f1-3)".0"
-    FIREWALLD_IPV6_ADDRESS=$(echo "$SERVER_WG_IPV6" | sed 's/:[^:]*$/:0/')
-    echo "PostUp = firewall-cmd --add-port $SERVER_PORT/udp && firewall-cmd --add-rich-rule='rule family=ipv4 source address=$FIREWALLD_IPV4_ADDRESS/24 masquerade' && firewall-cmd --add-rich-rule='rule family=ipv6 source address=$FIREWALLD_IPV6_ADDRESS/24 masquerade'
-PostDown = firewall-cmd --remove-port $SERVER_PORT/udp && firewall-cmd --remove-rich-rule='rule family=ipv4 source address=$FIREWALLD_IPV4_ADDRESS/24 masquerade' && firewall-cmd --remove-rich-rule='rule family=ipv6 source address=$FIREWALLD_IPV6_ADDRESS/24 masquerade'" >> "/etc/wireguard/$SERVER_WG_NIC.conf"
-else
-    echo "PostUp = iptables -A FORWARD -i $SERVER_WG_NIC -j ACCEPT; iptables -t nat -A POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE; ip6tables -A FORWARD -i $SERVER_WG_NIC -j ACCEPT; ip6tables -t nat -A POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE
-PostDown = iptables -D FORWARD -i $SERVER_WG_NIC -j ACCEPT; iptables -t nat -D POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE; ip6tables -D FORWARD -i $SERVER_WG_NIC -j ACCEPT; ip6tables -t nat -D POSTROUTING -o $SERVER_PUB_NIC -j MASQUERADE" >> "/etc/wireguard/$SERVER_WG_NIC.conf"
-fi
-
-# Enable routing on the server
-echo "net.ipv4.ip_forward = 1
-net.ipv6.conf.all.forwarding = 1" > /etc/sysctl.d/wg.conf
-
-sysctl --system
-
-systemctl start "wg-quick@$SERVER_WG_NIC"
-systemctl enable "wg-quick@$SERVER_WG_NIC"
-
-# Check if WireGuard is running
-systemctl is-active --quiet "wg-quick@$SERVER_WG_NIC"
-WG_RUNNING=$?
-
-# Warn user about kernel version mismatch with headers
-if [[ "$OS" =~ (fedora|centos) ]] && [[ $WG_RUNNING -ne 0 ]]; then
-    echo -e "\nWARNING: WireGuard does not seem to be running."
-    echo "Due to kernel mismatch issues on $OS, WireGuard might work if your system is out of date."
-    echo "You can check if WireGuard is running with: systemctl status wg-quick@$SERVER_WG_NIC"
-    echo "If you get something like \"Cannot find device wg0\", please run:"
-    if [[ "$OS" = 'fedora' ]]; then
-        echo "dnf update -y && reboot"
-    elif [[ "$OS" = 'centos' ]]; then
-        echo "yum update -y && reboot"
-    fi
-fi
-
-addClient