Dunno...works for me?
wg21 defined to be able to bind/listen for the Road-Warrior device Samsung-S9 connection(s)?e = Exit Script [?]
E:Option ==> peer wg21e = Exit Script [?]
E:Option ==> peer
No i dont, how do i create that?
E:Option ==> import bahnhof.conf
[✔] Config bahnhof import as wg11 success
Peers (Auto start: Auto=P - Policy, Auto=S - Site-to-Site)
Client Auto IP Endpoint DNS MTU Annotate
wg11 N 10.0.117.180/24,fdab:1337:1337:117::180/64 wireguard.5july.net:48574 192.168.50.1,2001:9b1:8826::53,2001:9b0:4:2601::53, Auto # N/A
Peers (Auto=X - External i.e. Cell/Mobile/Site)
E:Option ==> peer wg11 auto=y
[✔] Updated 'wg11' AUTO=Y
Client Auto IP Endpoint DNS MTU Annotate
wg11 Y 10.0.117.180/24,fdab:1337:1337:117::180/64 wireguard.5july.net:48574 192.168.50.1,2001:9b1:8826::53,2001:9b0:4:2601::53, Auto # N/A
No RPDB Selective Routing/Passthru rules for 'client' Peer wg11
E:Option ==> 4
Requesting WireGuard® VPN Peer start (wg11)
wg_manager-clientwg11: Initialising WireGuard® VPN 'client' Peer (wg11) to wireguard.5july.net:48574 (# N/A) DNS=192.168.50.1,2001:9b1:8826::53,2001:9b0:4:2601::53,
wg_manager-clientwg11: Initialisation complete.
E:Option ==> peer new wg21
Press y to Create 'server' Peer (wg21) 10.50.1.1/24:11501 or press [Enter] to SKIP.
y
Creating WireGuard® Private/Public key-pair for 'server' Peer wg21 on RT-AX86U (v386.5_2)
Press y to Start 'server' Peer (wg21) or press [Enter] to SKIP.
y
Requesting WireGuard® VPN Peer start (wg21)
wg_manager-serverwg21: Initialising WireGuard® VPN (IPv6) [fdab:1337:1337:117::180] 'Server' Peer (wg21) on 10.50.1.1:11501 (# RT-AX86U Server 1)
wg_manager-serverwg21: Initialisation complete.
interface: wg11 EndPoint=98.128.186.110:48574 10.0.117.180/24,fdab:1337:1337:117::180/64 # N/A
peer: ipW9/ysMc9vQbg/x7WK/udnl06+NJioWZZ4XIqz4PQY=
latest handshake: 1 minute, 4 seconds ago
transfer: 2.69 MiB received, 169.19 KiB sent 0 Days, 00:01:11 since Mon May 23 12:51:28 2022 >>>>>>
interface: wg21 Port:11501 10.50.1.1/24 VPN Tunnel Network # RT-AX86U Server 1
E:Option ==> peer wg21 auto=y
[✔] Updated 'wg21' AUTO=Y
Server Auto Subnet Port Annotate
wg21 Y 10.50.1.1/24 11501 # RT-AX86U Server 1
E:Option ==> peer wg21 passthru add wg11 all
[✔] Passthru Routing rule (wg21) '10.50.1.1/24' via wg11 created.
[✔] Passthru Routing rule (wg21) '10.50.1.1/24' via wg11 now ENABLED
Server Auto Subnet Port Annotate
wg21 Y 10.50.1.1/24 11501 # RT-AX86U Server 1
Server Client Passthru
wg21 wg11 10.50.1.1/24
E:Option ==> 3
interface: wg21 Port:11501 10.50.1.1/24 VPN Tunnel Network # RT-AX86U Server 1
peer: hcrSi9lHDEavgd7n9De8ipPNo0+cromQ0HWmjuXcRFE= 10.50.1.2/32 # Samsung-S9 "Device"
interface: wg11 EndPoint=98.128.186.110:48574 10.0.117.180/24,fdab:1337:1337:117::180/64 # N/A
peer: ipW9/ysMc9vQbg/x7WK/udnl06+NJioWZZ4XIqz4PQY=
latest handshake: 5 seconds ago
transfer: 2.50 MiB received, 273.84 KiB sent 0 Days, 00:02:14 since Mon May 23 12:59:30 2022 >>>>>>Server will not work (out of the box) when you have a Wireguard Internet Client in Auto=Y(ALL) mode. simply because the server tries to communicate over VPN as you have selected the default route to be over wg11.
By default, during the installation of
wireguard_manager, the 'server' Peer wg21 is ALWAYS created; then immediately asks if you wish to create/bind a Road-Warrior 'device' Peer such as iPhone to it.wg21 then the script has correctly responded as designed.wg21 could indeed exist but fat-finger typos can and do occur so a request to bind a new 'device' Peer to say non-existent 'server' Peer wg22 shouldn't (IMHO) result in stupidly creating the mistyped 'server' Peer on each occasion.The instability server issue was more than 6 months ago. I don't recall having any issue this year. I still see some flap count occasionally but overall it has been very stable. Most importantly no noticeable internet access issue.Commercial VPN providers have a lot to answer for when a paid subscription service is erratic either by design or simply oversubscribed etc.
Clearly you have needed to engineer a sophisticated resilient VPN environment...auto fallback to OpenVPN when WireGuard fails! - most impressive
....although I haven't noticed any blips with either the Mullvad nor TorGuard WireGuard tunnels that I use but DNS issues could have occurred although I don't bindUnboundthru either vendor.
P.S. I have now implemented (locally for as yet unpublished Beta v4.17b8) a new command to allow modification of the Endpoint (updates both the '.conf' and SQL database) to save having to delete/re-import.
Yeah ok.
Ok.
Selective Routing RPDB rules
ID Peer Interface Source Destination Description
4 wg11 WAN 0.0.0.0/0 192.168.50.1/24 To LAN Use Main
3 wg11 WAN 0.0.0.0/0 192.168.5.1/24 To Guest Use Main
6 wg11 WAN 0.0.0.0/0 10.50.1.1/24 To LAN Use Main
2 wg11 VPN 192.168.50.1/24 Any LAN To VPN
1 wg11 VPN 192.168.5.1/24 Any Guest To VPN
5 wg11 VPN 10.50.1.1/24 Any VPN SERVER To VPNRule number 2 and 4 is for your LAN right? they look ok, altough rule 4 is probably not needed since wgm adds route to lan in policy route table.
IPSET_NAME_mac=Test_Mac
IPv4Rule=192.168.1.38
ipset create ${IPSET_NAME_mac} hash:mac timeout 600
ipset flush ${IPSET_NAME_mac}
iptables -t mangle -I PREROUTING -s ${IPv4Rule} -m conntrack --ctstate NEW -j SET --add-set ${IPSET_NAME_mac} src --existstop wg21
peer wg21 auto=N
import mullvad-us45.conf
start wg11cru a cycleVPN "0 1 * * * /bin/bash /opt/etc/wireguard.d/randomize.sh"
/bin/bash /opt/etc/wireguard.d/randomize.sh#!/bin/bash
FILE=/opt/etc/wireguard.d/lastRandom.txt
if [ -f "$FILE" ]; then
random=$(awk 'BEGIN { srand(); print int( rand() * (6-1)+1);}')
read -r lastRandom < $FILE
if wg|grep -q 'wg11'; then
/opt/bin/wg_manager stop wg11
elif wg|grep -q 'wg12'; then
/opt/bin/wg_manager stop wg12
elif wg|grep -q 'wg13'; then
/opt/bin/wg_manager stop wg13
elif wg|grep -q 'wg14'; then
/opt/bin/wg_manager stop wg14
elif wg|grep -q 'wg15'; then
/opt/bin/wg_manager stop wg15
elif wg|grep -q 'wg16'; then
/opt/bin/wg_manager stop wg16
fi
if ! [ "$lastRandom " -eq "$lastRandom " ] 2> /dev/null; then
#echo "Not a number"
echo "$random" > $FILE
elif [[ "$random" -eq "$lastRandom" ]]; then
while [[ "$random" -eq "$lastRandom" ]]
do
#echo "Numbers are the same. Generating a new one"
random=$(awk 'BEGIN { srand(); print int( rand() * (6-1)+1);}')
echo "$random" > $FILE
done
else
#echo "Generating a new number"
random=$(awk 'BEGIN { srand(); print int( rand() * (6-1)+1);}')
echo "$random" > $FILE
fi
else
#echo "$file doesnt exist"
random=$(awk 'BEGIN { srand(); print int( rand() * (6-1)+1);}')
echo "$random" > $FILE
fi
/opt/bin/wg_manager start wg1$random policy* * * * * /bin/bash /home/pi/checkVPN.sh >> /var/log/pi.log 2>/var/log/pierrors.log#!/bin/bash
COUNTER=0
RETRIES=10
# Check if another instance of script is running
pidof -o %PPID -x $0 >/dev/null && echo "ERROR: Script $0 already running" && exit 1
IP=$(curl https://am.i.mullvad.net/connected)
KEYWORD='You are not connected to Mullvad'
echo "$IP"
for ((i=0; i<RETRIES; i++)); do
if [[ "$IP" == *"$KEYWORD"* ]];
then
echo "$IP"
let COUNTER++
blink1-tool --red
sleep 30
else
blink1-tool --off
break
fi
done
(( RETRIES == i )) && { echo "$IP. Failed $COUNTER times. Restarting VPN at $(date)."; blink1-tool --red; ssh 192.168.0.1 "/bin/bash /opt/etc/wireguard.d/randomize.sh" 2>&1;}Disable flow-cache is indeed nessisary on newer routers but as you are on gigabit internet it will also hit your internet traffic not going through wg vpn quite hard, altough the AXE11000 is a quite performant router. What speeds are you getting over Wireguard, and over WAN with flow-cache disabled?
Great stuff! Thanks for sharing!
Wow holy smokes. You are right. It really kills the internet traffic without flow-cache. What can be done?
I thought you would have better speeds with this router, atleast 400-600Mb/s. You're not running the speed-test on the router, right?
wireguard_manager is currently hardcoded to auto-Disable Hardware Acceleration aka Flow Cache for only two models:wireguard_manager specific to a particular model, provision has been made to allow end-user customisation of the appropriate Flow cache status:e = Exit Script [?]
E:Option ==> fc disable
Broadcom Packet Flow Cache learning via BLOG disabled.
Broadcom Packet Flow Cache flushing the flows
Flow Cache Disabled
(Use 'vx' command to uncomment config option 'DISABLE_FLOW_CACHE' to DISABLE permanently)e = Exit Script [?]
E:Option ==> fc enable
Broadcom Packet Flow Cache learning via BLOG enabled.
Broadcom Packet Flow Cache flushing the flows
Flow Cache Enabled+======================================================================+
| Welcome to the WireGuard® Manager/Installer script (Asuswrt-Merlin) |
| |
| Version v4.17b8 by Martineau |
| |
| Requirements: HND or AX router with Kernel 4.1.xx or later |
| e.g. RT-AC86U or RT-AX86U etc. |
| |
| USB drive with Entware installed |
| |
| ******************************************************************** |
| * NOTE: WireGuard® is incompatible with Hardware Acceleration * |
| * You can disable Hardware Acceleration using command * |
| * * |
| * E:Option ==> fc disable * |
| * * |
| * but you will most likely limit the throughput via WAN * |
| * to match the maximum WireGuard® speed * |
| ******************************************************************** |
| |
| 1 = Install WireGuard |
| o1. Enable firewall-start protection for Firewall rules |
| o2. Enable DNS |
| |
| |
+======================================================================+I was running the speedtest from a wired desktop, not directly on the router
The firewall code is already identical for these three models that you list.
FYI, your "hack/workaround" works very well for marking Wireguard packages for the AC86U and AX88U and Flow Cache could be kept enabled. But it dont work for any other model and Flow Cache needs to be turned off. Guess that Broadcom changed the inner-workings here in such way that your workaround became less effective. The fact that the inner-workings are locked away in closed source pre-compiled blobs makes it impossible for anyone to do anything about.
It wasn't implemented by me, it was done by either Broadcom or Asus.
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!
