Menu
What's new
By:
Filters Better Search

Wireguard Session Manager - Discussion (2nd) thread

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

DreaZ said:
Yes :\ I've confirmed that there was a issue with the killswitch in 4.11 and have permanently disabled it in 4.12b2 for now. But I still have the same issue when I start wg11 Internet dies, I can't reach 'anything'. As soon as I stop it, Internet works again. I don't have this issue with OpenVPN on the router or when I try the exact same Wireguard key in another device.

And I can't see anything wrong in the imported Wireguard key in WGM. The only difference I see is that I DNS and Address is disabled with # in front of them.

I'm not familiar with Linux and iptables at all, so the wgm diag doesn't say anything to me. But I did sent it to @Martineau

I'm on Merlin fw RT-AC86U_386.3_2 for my Asus RT-AC86U

WAN on the Router:
I have tried different DNS (Cloudflare and my VPN Provider) and automatic from ISP
Disabled Rebind protection and DNSSEC

LAN on the router:
DNSFilter is enabled and Global set to Router

Restarted router within the gui and also tried a hard restart.

Disabled Skynet and Diversion just in case.

But yea... the issue remains...
Click to expand...
I don't appear to have received feedback on explicit ping/nslookup diagnostics.

However, the diag shows
Code: 
Chain WGDNS1 (2 references)

num pkts bytes target prot opt in out source destination
1 23 1528 DNAT all -- * * 192.168.1.0/24 0.0.0.0/0 /* WireGuard 'client1 DNS' */ to:192.165.9.158

So I assume that you are using VPN provider OVPN.COM? and just contacted them....

1634890237997.png


I guess unless I formally sign-up for a minimum 1-month €11 subscription they have clearly stated their position unless you can think of another option?

Not sure if @ZebMcKayhan's tip about using a different DNS will work?
 
Last edited:
ZebMcKayhan said:
ok, lets hope @Martineau finds anything that could be fixed.

if you, from the terminal issue "wg show" (not inside wgm) do you see any traffic (rx/tx) bytes or are they both 00?

if the peer is working and you have at least any rx/tx bytes you could check if it is DNS related by pinging an ip that does not need to be resolved (like www.google.com):
Code: 
ping 142.250.74.36

and see if you get any replies... if you do, the connection works you just cant resolve names (which usually appears as not being able to access anything).

some VPN ISP blocks access to other DNS servers than their own, which is included in the .conf file. I dont know how this is with OVPN, but using the DNS from the original .conf file might be required. DNS in @Odkrys scripts works differently depending if you use default routing or policy routing.
when you had this working did you use default or policy routing? did you use the DNS from the original .conf file and moved into wg scripts?

wgm usually overrides WAN DNS from the router GUI from the one you specify inside wgm. The DNS should be changed inside wgm by:
Code: 
peer wg11 dns=9.9.9.9
then restart the client:
Code: 
restart wg11

make a note of your original DNS from the .conf file and try to swap back and forth. but this all ofcource requires the peer to work, meaning you have some rx/tx bytes and can ping ipadresses.

//Zeb
Click to expand...

I'm pretty sure @Martineau saw that the wg11 was clearly up and there was traffic. I will try adding the DNS inside WGM as you suggested and ping google.com

I tried both default and policy when I used @Odkrys guide, DNS and address was disabled in .conf file and DNS was added under WAN in the router gui (I did not add anything in wg scripts) DNSLeakTest showed IP from OVPN.com and their DNS.
Martineau said:
I don't appear to have received feedback on explicit ping/nslookup diagnostics.

However, the diag shows
Code: 
Chain WGDNS1 (2 references)

num pkts bytes target prot opt in out source destination
1 23 1528 DNAT all -- * * 192.168.1.0/24 0.0.0.0/0 /* WireGuard 'client1 DNS' */ to:192.165.9.158

So I assume that you are using VPN provider OVPN.COM? and just contacted them....

View attachment 36941

I guess unless I formally sign-up for a minimum 1-month €11 subscription they have clearly stated their position unless you can think of another option?

Not sure if @ZebMcKayhan's tip about using a different DNS will work?
Click to expand...

That is correct, OVPN.com is a Swedish provider i'm using. Following @Odkrys guide I got Wireguard easily to work though using both default and policy. DNS and address disabled in the conf and the DNS was added under WAN in the router gui. So it should not be an issue with my OVPN.com. But if it happens to be that, I just have to change VPN provider, probably Mullvad (I think my one-year subscription at OVPN.com is closing in to it's end anyway).

I can try later tonight adding the DNS in WGM following @ZebMcKayhan advice.

I missed the part I don't appear to have received feedback on explicit ping/nslookup diagnostics.

Will take a look at that as well.

I'm not a network techie so I apologize for any inconvenience.
 
Last edited:
Martineau said:
I guess unless I formally sign-up for a minimum 1-month €11 subscription they have clearly stated their position unless you can think of another option?
Click to expand...
Since @DreaZ actually had this working using @Odkrys scripts it should not be that far away. we just need to figure out what is different between that working setup and the current wgm setup.

//Zeb
 
DreaZ said:
I'm pretty sure @Martineau saw that the wg11 was clearly up and there was traffic.
Click to expand...
The WireGuard wg11 interface is clearly UP, as indicated by the explicit handshake message (and the transfer metrics)

Code: 
latest handshake: 1 minute, 59 seconds ago
transfer: 444 B received, 112.86 KiB sent

Also, hopefully in Syslog, wireguard_manager should be writing messages showing the increasing RX/TX metrics every hour?

e.g.
Code: 
Oct 20 16:59:01 RT-AC86U-6160 (wg_manager.sh): 24753 wg12: transfer: 95.32 KiB received, 352.91 KiB sent        1 days 12:57:00 from 2021-10-19 04:02:01 >>>>>>
Oct 20 16:59:01 RT-AC86U-6160 (wg_manager.sh): 24753 wg12: period : 2.60 KiB received, 9.59 KiB sent (Rx=2663;Tx=9820)

Since you are not using Selective RPDB Routing, ALL LAN devices are routed via the WireGuard interface 'wg11' as indicated by the clever routing rules 0.0.0.0/1 and 128.0.0.0/1

Code: 
DEBUG: Routing Table main

0.0.0.0/1 dev wg11 scope link
128.0.0.0/1 dev wg11 scope link
10.50.1.0/24 dev wg21 proto kernel scope link src 10.50.1.1

If the same .conf still works i.e. it hasn't expired (sometimes indicated by a very low received Byte count e.g. 444 B for the Handshake message) then it would suggest a DNS issue. Did you remove The OVPN DNS from the WAN configuration page after temporarily removing the @Odkrys method?
DreaZ said:
I can try later tonight adding the DNS in WGM following @ZebMcKayhan advice.
Click to expand...
:)
DreaZ said:
I'm not a network techie so I apologize for any inconvenience.
Click to expand...
No problem.
 
ZebMcKayhan said:
Since @DreaZ actually had this working using @Odkrys scripts it should not be that far away. we just need to figure out what is different between that working setup and the current wgm setup.

//Zeb
Click to expand...
No doubt it is probably staring me in the face, or perhaps it is simply destiny subtly nudging me again to take down/retire wireguard_manager. ;)
 
Martineau said:
Chain WGDNS1 (2 references) num pkts bytes target prot opt in out source destination 1 23 1528 DNAT all -- * * 192.168.1.0/24 0.0.0.0/0 /* WireGuard 'client1 DNS' */ to:192.165.9.158
Click to expand...
Are dns DNAT used even for default routing? Guess it makes sense to eliminate leaks.

Wonder if it is an idea for @DreaZ to test to put in the OVPN dns in wan page and issue in wgm:
Code: 
peer wg11 dns=192.168.1.1
restart wg11

Then router and dnsmasq would handle dns request and if there is anything blocking access it would be bypassed?
So if this works there are probably some gui setting causing the router to block dns dnat??

This solution would not be sustainable but could give us a clue what is going on?

Noticing @DreaZ said: "DNSFilter is enabled and Global set to Router" This would enforce dns requests to router? Wouldn't this conflict with dnat? Maybee dns filter should be disabled? Atleast worth to test?

//Zeb

Edit: just checked my own setting and dns-filter is enabled, Global filter set to Router and the client list is empty and wgm dns dnat works for me...
 
Last edited:
ZebMcKayhan said:
Are dns DNAT used even for default routing? Guess it makes sense to eliminate leaks.

Wonder if it is an idea for @DreaZ to test to put in the OVPN dns in wan page and issue in wgm:
Code: 
peer wg11 dns=192.168.1.1
restart wg11

Then router and dnsmasq would handle dns request and if there is anything blocking access it would be bypassed?
So if this works there are probably some gui setting causing the router to block dns dnat??

This solution would not be sustainable but could give us a clue what is going on?

Noticing @DreaZ said: "DNSFilter is enabled and Global set to Router" This would enforce dns requests to router? Wouldn't this conflict with dnat? Maybee dns filter should be disabled? Atleast worth to test?

//Zeb

Edit: just checked my own setting and dns-filter is enabled, Global filter set to Router and the client list is empty and wgm dns dnat works for me...
Click to expand...
All very puzzling....and starting to have self-doubt regarding the possibility of a serious flaw with wireguard_manager

Consequently, I have just signed up for a FREE (no credit card details asked for) three day trial with Cactus VPN to use their WireGuard service, and their online configurator

1634929767916.png


Clicking the Download Configuration File button created 'dallas.conf' and having duly imported the .config it worked as expected (NOTE: the use of DNS 1.1.1.1)
Code: 
e  = Exit Script [?]

E:Option ==> import dallas comment Cactus USA, Dallas

    [✔] Config dallas import as wg15 success
Closed ALL running 'server'/'client' peers
Code: 
e  = Exit Script [?]

E:Option ==> stop
then started the imported wg1x interface (in my case wg15)
Code: 
e  = Exit Script [?]

E:Option ==> start wg15

    Requesting WireGuard VPN Peer start (wg15 )

    wireguard-clientwg15: Initialising Wireguard VPN 'client' Peer (wg15) to xxx.xxx.xxx.xxx:ppppp (# Cactus USA, Dallas) DNS=1.1.1.1
    wireguard-clientwg15: Initialisation complete.
and all is fine....geo location puts me in Texas USA, and stopping the connection shows expected traffic metrics:
Code: 
e  = Exit Script [?]

E:Option ==> stop wg15

    Requesting WireGuard VPN Peer stop (wg15 )

    wg15: transfer: 35.77 MiB received, 11.18 MiB sent      0 Days, 00:54:50 from 2021-10-22 16:43:13 >>>>>>
    wg15: period : 13.49 MiB received, 4.76 MiB sent (Rx=14145291;Tx=4991222)
    wireguard-clientwg15: Wireguard VPN 'client' Peer (wg15) to xxx.xxx.xxx.xxx:ppppp (# Cactus USA, Dallas) Terminated

@DreaZ, if you have time/motivation, perhaps you could care to quickly try Cactus VPN, to see if wireguard_manager still fails even with a different provider?
 
Last edited:
Martineau said:
All very puzzling....and starting to have self-doubt regarding the possibility of a serious flaw with wireguard_manager

Consequently, I have just signed up for a FREE (no credit card details asked for) three day trial with Cactus VPN to use their WireGuard service, and their online configurator

View attachment 36957

Clicking the Download Configuration File button created 'dallas.conf' and having duly imported the .config it worked as expected (NOTE: the use of DNS 1.1.1.1)
Code: 
e  = Exit Script [?]

E:Option ==> import dallas comment Cactus USA, Dallas

    [✔] Config dallas import as wg15 success
Closed ALL running 'server'/'client' peers
Code: 
e  = Exit Script [?]

E:Option ==> stop
then started the imported wg1x interface (in my case wg15)
Code: 
e  = Exit Script [?]

E:Option ==> start wg15

    Requesting WireGuard VPN Peer start (wg15 )

    wireguard-clientwg15: Initialising Wireguard VPN 'client' Peer (wg15) to xxx.xxx.xxx.xxx:ppppp (# Cactus USA, Dallas) DNS=1.1.1.1
    wireguard-clientwg15: Initialisation complete.
and all is fine....geo location puts me in Texas USA, and stopping the connection shows expected traffic metrics:
Code: 
e  = Exit Script [?]

E:Option ==> stop wg15

    Requesting WireGuard VPN Peer stop (wg15 )

    wg15: transfer: 35.77 MiB received, 11.18 MiB sent      0 Days, 00:54:50 from 2021-10-22 16:43:13 >>>>>>
    wg15: period : 13.49 MiB received, 4.76 MiB sent (Rx=14145291;Tx=4991222)
    wireguard-clientwg15: Wireguard VPN 'client' Peer (wg15) to xxx.xxx.xxx.xxx:ppppp (# Cactus USA, Dallas) Terminated

@DreaZ, if you have time/motivation, perhaps you could care to quickly try Cactus VPN, to see if wireguard_manager still fails even with a different provider?
Click to expand...
Tried some more today with OVPN.

Generated a brand new WG-key and imported it.

Changed the DNS inside WGM to OVPN 46.227.67.134
192.165.9.158
DNS inside router gui as Automatic from ISP. No luck.

Changed to OVPN DNS in router gui and 192.168.1.1 on peer in WGM, restarted peer - no luck.

Tried ping Google - 142.250.74.3 - Request timed out

Rx/tx is not empty. But other than that, no improvement.

Tried Cactus and worked instantly. DNS is 1.1.1.1 and geo loc puts me in Stockholm.
 
Cactus conf
[Interface]
Address =
DNS = 1.1.1.1
PrivateKey =

[Peer]
PublicKey =
Endpoint =
AllowedIPs =

OVPN original conf
[Interface]
Privatekey =
Address =
DNS = 46.227.67.134, 192.165.9.158

[Peer]
PublicKey =
AllowedIPs =
Endpoint =

OVPN modified/imported
Interface]
#Address =
#DNS = 46.227.67.134
PrivateKey =

[Peer]
PublicKey =
Endpoint =
AllowedIPs =

I’ve noticed an issue when peer is up in WGM with Skynet firewall though. When entering the menu for Skynet, it takes and it says Lock file detected and no internet connectivity.

Shutting down WGM peer and the issue is gone.

Hmm…

Edit: Skynet issue seems to have resolved itself.
 
Last edited:
DreaZ said:
Cactus conf
[Interface]
Address = 10.1.84.70/32
DNS = 1.1.1.1
PrivateKey =

[Peer]
PublicKey =
Endpoint = 185.117.88.249:60100
AllowedIPs = 0.0.0.0/0

OVPN original conf
[Interface]
Privatekey =
Address = 172.16.228.253/32, fd00:0000:1337:cafe:1111:1111:7abe:95b1/128
DNS = 46.227.67.134, 192.165.9.158

[Peer]
PublicKey =
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = vpn01.prd.malmo.ovpn.com:9929

OVPN modified/imported
Interface]
#Address = 172.16.228.253/32
#DNS = 46.227.67.134
PrivateKey =

[Peer]
PublicKey =
Endpoint = vpn01.prd.malmo.ovpn.com:9929
AllowedIPs = 0.0.0.0/0

I’ve noticed an issue when peer is up in WGM with Skynet firewall though. When entering the menu for Skynet, it takes and it says Lock file detected and no internet connectivity.

Shutting down WGM peer and the issue is gone.

Hmm…

Edit: Skynet issue seems to have resolved itself.
Click to expand...
Really glad you made it work!

From what I can see you changed the location of the PrivateKey, allowedips and removed ipv6. I have ipv6 adresses to and that's no problem.
I checked my files and all have privatekey first. I do however got the position of your working allowedips. Could that order really matter??

Well, now you should be able to get this working as you want:
Code: 
E:Option ==> peer wg11 rule add wan src=192.168.1.x comment SingleUseWAN
E:Option ==> peer wg11 rule add vpn src=192.168.1.1/24 comment RestUseVPN
E:Option ==> peer wg11 auto=p

I usually get lockfile after reinstall or aborting some command. Don't really know the meaning but usually it is resolved by itself after 10min or so.

//Zeb
 
Last edited:
DreaZ said:
Cactus conf
[Interface]
Address = 10.1.84.70/32
DNS = 1.1.1.1
PrivateKey =

[Peer]
PublicKey =
Endpoint = 185.117.88.249:60100
AllowedIPs = 0.0.0.0/0

OVPN original conf
[Interface]
Privatekey =
Address = 172.16.228.253/32, fd00:0000:1337:cafe:1111:1111:7abe:95b1/128
DNS = 46.227.67.134, 192.165.9.158

[Peer]
PublicKey =
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = vpn01.prd.malmo.ovpn.com:9929

OVPN modified/imported
Interface]
#Address = 172.16.228.253/32
#DNS = 46.227.67.134
PrivateKey =

[Peer]
PublicKey =
Endpoint = vpn01.prd.malmo.ovpn.com:9929
AllowedIPs = 0.0.0.0/0

I’ve noticed an issue when peer is up in WGM with Skynet firewall though. When entering the menu for Skynet, it takes and it says Lock file detected and no internet connectivity.

Shutting down WGM peer and the issue is gone.

Hmm…

Edit: Skynet issue seems to have resolved itself.
Click to expand...
So effectivly you manually removed ALL IPv6 related fields?
Code: 
OVPN original conf                                                          OVPN modified/imported

[Interface]                                                                 [Interface]
Privatekey =                                                                PrivateKey =
Address = 172.16.228.253/32, fd00:0000:1337:cafe:1111:1111:7abe:95b1/128    #Address = 172.16.228.253/32
DNS = 46.227.67.134, 192.165.9.158                                          #DNS = 46.227.67.134

[Peer]                                                                      [Peer]
PublicKey =                                                                 PublicKey =
AllowedIPs = 0.0.0.0/0, ::/0                                                AllowedIPs = 0.0.0.0/0
Endpoint = vpn01.prd.malmo.ovpn.com:9929                                    Endpoint = vpn01.prd.malmo.ovpn.com:9929

So I tried the import aginst the OVPN.conf containing the IPv6 stuff
Code: 
e  = Exit Script [?]

E:Option ==> import ovpn comment OVPN failing conf

    [✔] Config ovpn import as wg11 success

    Peers (Auto=P - Policy, Auto=X - External i.e. Cell/Mobile)
Server  Auto  Subnet        Port   Annotate
wg21    Y     10.50.1.1/24  51820  # RT-AC86U Server #1

Client  Auto  IP                                              Endpoint                       DNS             MTU  Annotate
wg11    N     fd00:0000:1337:cafe:1111:1111:7abe:95b1/128/32  vpn01.prd.malmo.ovpn.com:9929  192.165.9.158        # OVPN failing conf

Clearly I can see that wireguard_manager has corrupted the IPv6 address by incorrectly appending the additional '/32' suffix.

Given wireguard_manager has apparently decided that ONLY IPv6 should be configured, am I correct in assuming that IPv6 is ENABLED on your router?
Code: 
nvram get ipv6_service

As I have no access to IPv6, I did pay nominal lip-service to IPv6 and tried to guess what should be added to the IPv6 iptables, but clearly I've failed at the first step and can't even process/extract the IPv6 address correctly :rolleyes: (and unnecessarily dropped the IPv4 address?)

I'll have to investigate the import logic and identify what needs to be done to fix/alert of the show-stopper IPv6 import function.

Thanks for trying Cactus VPN, and your assistance in identifying the bug(s)!

P.S. I don't use skynet so no idea if you are referring to wireguard_manager 'lock-file' ?
 
Martineau said:
So effectivly you manually removed ALL IPv6 related fields?
Code: 
OVPN original conf                                                          OVPN modified/imported

[Interface]                                                                 [Interface]
Privatekey =                                                                PrivateKey =
Address = 172.16.228.253/32, fd00:0000:1337:cafe:1111:1111:7abe:95b1/128    #Address = 172.16.228.253/32
DNS = 46.227.67.134, 192.165.9.158                                          #DNS = 46.227.67.134

[Peer]                                                                      [Peer]
PublicKey =                                                                 PublicKey =
AllowedIPs = 0.0.0.0/0, ::/0                                                AllowedIPs = 0.0.0.0/0
Endpoint = vpn01.prd.malmo.ovpn.com:9929                                    Endpoint = vpn01.prd.malmo.ovpn.com:9929

So I tried the import aginst the OVPN.conf containing the IPv6 stuff
Code: 
e  = Exit Script [?]

E:Option ==> import ovpn comment OVPN failing conf

    [✔] Config ovpn import as wg11 success

    Peers (Auto=P - Policy, Auto=X - External i.e. Cell/Mobile)
Server  Auto  Subnet        Port   Annotate
wg21    Y     10.50.1.1/24  51820  # RT-AC86U Server #1

Client  Auto  IP                                              Endpoint                       DNS             MTU  Annotate
wg11    N     fd00:0000:1337:cafe:1111:1111:7abe:95b1/128/32  vpn01.prd.malmo.ovpn.com:9929  192.165.9.158        # OVPN failing conf

Clearly I can see that wireguard_manager has corrupted the IPv6 address by incorrectly appending the additional '/32' suffix.

Given wireguard_manager has apparently decided that ONLY IPv6 should be configured, am I correct in assuming that IPv6 is ENABLED on your router?
Code: 
nvram get ipv6_service

As I have no access to IPv6, I did pay nominal lip-service to IPv6 and tried to guess what should be added to the IPv6 iptables, but clearly I've failed at the first step and can't even process/extract the IPv6 address correctly :rolleyes: (and unnecessarily dropped the IPv4 address?)

I'll have to investigate the import logic and identify what needs to be done to fix/alert of the show-stopper IPv6 import function.

Thanks for trying Cactus VPN, and your assistance in identifying the bug(s)!

P.S. I don't use skynet so no idea if you are referring to wireguard_manager 'lock-file' ?
Click to expand...

I also changed location of PrivateKey, DNS and Address

and Endpoint and AllowedIPs.

ipv6 is disabled.
 
DreaZ said:
I also changed location of PrivateKey, DNS and Address

and Endpoint and AllowedIPs.

ipv6 is disabled.
Click to expand...
Since both the DNS and Address directives will be auto-commented out by wireguard_manager anyway, the Private key effectively remains as the first line in the .conf, so it would appear that the crucial change was the Endpoint directive relocation, i.e. perhaps I should uncomment the clause in the import process to ensure it must be at the end of the .config
 
Martineau said:
perhaps I should uncomment the clause in the import process to ensure it must be at the end of the .config
Click to expand...
I have:
[Peer]
PublicKey =
Endpoint =
AllowedIps =
PersistKeepAlive =

My enterpretation is that Endpoint must be after PublicKey but not further down?
 
ZebMcKayhan said:
I have:
[Peer]
PublicKey =
Endpoint =
AllowedIps =
PersistKeepAlive =

My enterpretation is that Endpoint must be after PublicKey but not further down?
Click to expand...
Interesting discussion. My wg11.conf looks like this:

[Interface]
PrivateKey =
#Address =
#DNS =

[Peer]
PublicKey =
AllowedIPs =
Endpoint =
PersistentKeepalive =

Edit: I just check Wireguard apps in my phone. Looks like your sequence matches the sequence in the apps.
 
Ok, so now I know for sure what is the real deal in my conf if I want it to work.

Its the ipv6 in Address and Allowedips. I must remove those, otherwise it wont work. Nothing else needs changed.


Interface]
PrivateKey =
#Address = Must remove ipv6
#DNS =

[Peer]
PublicKey =
AllowedIPs = must remove ipv6
Endpoint =
PersistentKeepalive =
 
Last edited:
You must log in or register to reply here.

Similar threads

Martineau
Wireguard Session Manager (4th) thread
11 12 13
Replies
241
Views
24K
kfahoo
K
A
Splitting Wireguard between Router and client
2 3
Replies
53
Views
2K
ZebMcKayhan
Z
K
Unbound Unbound_DNS_via_OVPN.sh with Wireguard
Replies
1
Views
1K
ZebMcKayhan
Z
J
Tailscale as an Addon: Polite request for a Coder to implement
Replies
14
Views
935
jksmurf
J
W
Email Notice from SSH event
Replies
3
Views
770
Ranger802004
R
Similar threads
Thread starter Title Forum Replies Date
JGrana New Addon - ChatAI - have a chat session with Googles Gemini AI Bot Asuswrt-Merlin AddOns 2
J connmon Making config changes invokes password manager in MacOS Asuswrt-Merlin AddOns 4
Viktor Jaep VPNMON VPNMON-R3 - Early, early alpha discussion, progress & screenshots Asuswrt-Merlin AddOns 17

Similar threads

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 899 (members: 18, guests: 881)
Top