What's new

Wireguard Session Manager - Discussion (3rd) thread

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

@ZebMcKayhan , your github setup guide is going to grow in size!
looking forward to it!
Although recent indicators shows that it might need to shrink in size. It may be too intimidating for beginners when they see it.
perhaps we would need some short quick-start guide as supplement... unfortunately there is little time now during the summer for me to do this but luckily:
Winter is coming
 
It was never my intention of being harsh, just trying to support. well I just leave you to it instead.
Abject apologies for my cranky post on Sunday, but it was close to midnight and bad weekend etc. but doesn't excuse taking out my frustration on you as a valued supporter of my project.



Anyway, I've uploaded wg_manager Beta v4.17bB/wg_manager.asp Beta v0.7

Use at your own risk



The main change is peer commands (and ALL the others) can now be requested via the WebUI wgm Execute dialog box (in lieu of dedicated shortcut buttons)

There are still minor GUI bugs...HELP button that doesn't help..... and Configuration Radio buttons that still don't reflect the actual State/Status. plus the limitation to only display (in the formal GUI form) the single wg11 'client' Peer configuration (although you can import an additional 8 'client' Peers, up to wg19!) and of course the 'Dummy SAVE' button, but they are next on the list.

So the proof of concept to allow a user to import a WireGuard® 'client' Peer and fully manage its status via WebUI buttons is now reality.

1655798809668.png



WARNING: Commands that generate console prompts will automatically be replied to with an AFFIRMATIVE 'Y'

e.g.
Bash:
e  = Exit Script [?]

E:Option ==> peer wg18 del

    Deleting 'client' Peer (wg18)

    Press y to CONFIRM or press [Enter] to SKIP.

This is a simple case, where usually only the single prompt is issued but clearly a WebUI typo could cause the wrong 'client' Peer to be instantly deleted.

Furthermore, a request may generate multiple prompts,

e.g. suppose you wanted to delete a Road-Warrior 'device' Peer....
Bash:
e  = Exit Script [?]

E:Option ==> peer iPhone del

    Deleting 'device' Peer (iPhone)

    Press y to CONFIRM or press [Enter] to SKIP.
y
    'device' Peer iPhone removed from 'server' Peer (wg21)
    'device' Peer iPhone DELETED

    WireGuard® 'server' Peer needs to be restarted to remove 'client' Peer
    Press y to restart 'server' Peer (wg21) or press [Enter] to SKIP.

Obviously restarting the 'server' should be delayed to OoO, but the WebUI request would be actioned immediately which would interrupt the service provided by the 'server' Peer.

NOTE: Command '7. QRCode' requests cannot (yet) be used as the qrencode -t ANSIUTF8 QRCODE get brutally mangled in the text box. (This will need a button on the WebUI to generate the PNG)

To install Beta 0.7 of the WebUI issue command:
Bash:
e  = Exit Script [?]

E:Option ==> www refresh

    WebUI page 'user2.asp' ('wg_manager.asp') unmounted
    WebUI page ('wg_manager.asp') mounted as 'user2.asp'

and you must also switch to a different Page on the GUI of the router, then re-select the WireGuard® Manager ADD-on TAB to load the new HTML Page.

Alternatively, (if you think you will forget to jump to a different TAB) you can force the WebUI TAB display refresh by restarting HTTPD, so you get booted out, and then are forced to log back in!

Bash:
e  = Exit Script [?]

E:Option ==> www unmount

    WebUI page 'user2.asp' ('wg_manager.asp') unmounted
Bash:
e  = Exit Script [?]

E:Option ==> www mountX

    WebUI page ('wg_manager.asp') mounted as 'user2.asp'
    [✔] Restarted service_httpd for WebUI
 
Last edited:
Abject apologies for my cranky post on Sunday, but it was close to midnight and bad weekend etc. but doesn't excuse taking out my frustration on you as a valued supporter of my project.
I understand, dont worry about it. But I appreciate it.

The main change is peer commands (and ALL the others) can now be requested via the WebUI wgm Execute dialog box (in lieu of dedicated shortcut buttons)
does this mean that my wgm Addon wgmExpo.sh is now obsolete :oops:?
 
I understand, dont worry about it. But I appreciate it.


does this mean that my wgm Addon wgmExpo.sh is now obsolete :oops:?
I wouldn't have thought so, as SSH/Siri shortcuts are probably quicker/more convenient than initiating a Web logon to the router and manually navigating and clicking on the appropriate button, or entering the desired command into the Execute dialog box.

P.S. Not sure what automation tools exist on Phones for Web page manipulation?
 
Last edited:
I wouldn't have thought so, as SSH/Siri shortcuts are probably quicker/more convenient than initiating a Web logon to the router and manually navigating and clicking on the appropriate button, or entering the desired command into the Execute dialog box.
I guess. I just figured that you already incorperated what it's doing to be able to send all commands to wgm via gui without having an instance running, so it might be replicable from the shell. But maybee not.

Ssh Button is really convenient (altough the gui/buttons are abit ugly), and I love the idea of each computer/phone/tablet could have home-screen buttons do toggle wan/vpn1/vpn2 for this device but I wonder if someone is actually using it. Maybee an old mans dream.

P.S. Not sure what automation tools exist on Phones for Web page manipulation?
I couldn't imagine they would be easier to use then ssh button/Shortcuts but if you only used the gui and never wgm command one may choose that path. Also to retrieve the feedback if executed ok or not feels like a pain to setup.
 
Also to retrieve the feedback if executed ok or not feels like a pain to setup.
Well it's all been a pain for an old-Skool HTML dabbler who has long since forgotten most of the Microsoft DOM stuff!

CSS,AJAX etc. and Javascript - I can just about spell them but I am amazed how slick some of the commercial web sites/pages have become, so no wonder the good web designers/programmers can demand a shed-load of money!

Anyway I digress,......so it isn't a problem getting the results back from the wg_manager instance, but the problem is how to do it without blocking the WebUI with a tacky sleep/spin-loop.

Currently you may have noticed that I fudge the issue and subsequently ALL WebUI requests are given 5 secs for the onscreen spinning 'Applying Setting' message even though I think only a WebUI request to terminate multiple Peers gets close to half that figure?

I'll probably end up adding a little visible Return status box, but this will need wg_manager to always set a return code, which I know it currently doesn't.
 
Currently you may have noticed that I fudge the issue and subsequently ALL WebUI requests are given 5 secs for the onscreen spinning 'Applying Setting' message even though I think only a WebUI request to terminate multiple Peers gets close to half that figure?
I've noticed, but wasn't going to say anything... but I understand the issue. What if wgm, when invoked from the gui, wrote its output to a file in /tmp instead, then the command output dialogue could just display that file every 5sec, much as syslog is doing it. Probably a rotten idea, I tend to have bad luck with ideas.
 
The config part display all disabled even though I have Entware modules enabled.
Fixed
Some food for thought for the future:
1) import would Ideally open file location from your device same as when we upgrade firmware. Perhaps this is really difficult, I dunno.
Feature implemented

1655935553547.png


e.g. Clicking Choose File should now open a dialog box for the device you are using, to allow you to select the desired WIreGuard 'client' Peer Profile

Having selected a 'client' Peer profile it is uploaded and presented in the WebUI for inspection

1655935772980.png


Clicking theImport button should result in something similar to the following:

1655935853944.png


Use at your own risk

To upgrade to wg_manager Beta v4.17bC / WebUI Beta v0.8
Code:
e  = Exit Script [?]

E:Option ==> uf dev
Code:
e  = Exit Script [?]

E:Option ==> www refresh
Then switch to another TAB to to refresh the WebGUI
 
Hi Guys,
what does it mean? i press yes but after router reboot that message comes up again.


(wg_manager.sh): 12344 DEBUG= *********************************WTF!? Rogue RPDB IPv4 rule 220 FOUND?????!!!!!************

IPv4 RPDB

0: from all lookup local
220: from all lookup 220
10210: from all to 104.31.16.4 lookup ovpnc1
10211: from all to 104.31.16.125 lookup ovpnc1
10212: from all to 94.23.21.86 lookup ovpnc1
10213: from all to 104.20.197.22 lookup ovpnc1
10214: from all to 104.20.196.22 lookup ovpnc1
10215: from all to 172.67.17.73 lookup ovpnc1
10410: from 192.168.1.210 lookup ovpnc2
32766: from all lookup main
32767: from all lookup default

IPv4 Route Table 220


Press y to Delete rogue RPDB PRIO 220 rules or press [Enter] to SKIP.
 
Hi Guys,
what does it mean? i press yes but after router reboot that message comes up again.


(wg_manager.sh): 12344 DEBUG= *********************************WTF!? Rogue RPDB IPv4 rule 220 FOUND?????!!!!!************

IPv4 RPDB

0: from all lookup local
220: from all lookup 220
10210: from all to 104.31.16.4 lookup ovpnc1
10211: from all to 104.31.16.125 lookup ovpnc1
10212: from all to 94.23.21.86 lookup ovpnc1
10213: from all to 104.20.197.22 lookup ovpnc1
10214: from all to 104.20.196.22 lookup ovpnc1
10215: from all to 172.67.17.73 lookup ovpnc1
10410: from 192.168.1.210 lookup ovpnc2
32766: from all lookup main
32767: from all lookup default

IPv4 Route Table 220


Press y to Delete rogue RPDB PRIO 220 rules or press [Enter] to SKIP.
Previously discussed....


You can decide to either ignore the warning, or delete the 'rogue' rule by uncommenting ROGUEDELETE (or spot the spelling mistake for ROGUEIGNORE :oops::rolleyes:!) using the vx command

Code:
e  = Exit Script [?]

E:Option ==> vx
e.g. If you are sure that deleting the rule won't cause any harm

Code:
<snip>

# Enable Weekly 07:00 every Sunday cron job to trim SQL database older than xx days (0 - no trimming!)
#     Use command 'vx' to edit this setting
#     (You can temporarily override this by using menu command 'trimdb cron xx')
TrimDB 99

# Auto delete the rogue RPDB PRIO 220 rules
#     Use command 'vx' to edit this setting
#ROGUE220IGNORE
ROGUE220DELETE

# During Boot 'init' request process, specify a delay period e.g. INITDELAY 90s
#     Use command 'vx' to edit this setting
INITDELAY 20s

# Enable WebUI
#     Use command 'vx' to edit this setting
WEBUI
 
Last edited:
Nice progress on the Web UI! Coming along nicely.

@Martineau , not a big deal, but for some reason on my AX88U, whenever I do a uf dev it takes 2 restarts of wg_manager to get the version forced.

For example, this morning I was on 4.17bA - did the uf dev then tried www refresh. I told me “refresh” was not valid.
Quit wg_manager, restarted and I saw it still showed 4.17bA. Quit one more time and restarted. Now it shows 4.17bC and www refresh worked.

Just an FYI - I would prefer you continue on the Web UI rather then my issue.
Tell you what, let me investigate further.
 
Fixed

Feature implemented

View attachment 42055

e.g. Clicking Choose File should now open a dialog box for the device you are using, to allow you to select the desired WIreGuard 'client' Peer Profile

Having selected a 'client' Peer profile it is uploaded and presented in the WebUI for inspection

View attachment 42056

Clicking theImport button should result in something similar to the following:

View attachment 42057

Use at your own risk

To upgrade to wg_manager Beta v4.17bC / WebUI Beta v0.8
Code:
e  = Exit Script [?]

E:Option ==> uf dev
Code:
e  = Exit Script [?]

E:Option ==> www refresh
Then switch to another TAB to to refresh the WebGUI
wow, fast working! Great job!

I have a question regarding cloning VPNDirector rules:
1) are these rules somehow handled differently from ordinary policy rules? I remember seeing something about they have different priority. i.e. In menu, will they show up along side ordinary rules and be deletable as usual?
2) if you create a set of rules in VPNDirector and choose to clone them into WGM. what happens if you change the rules and clone them again will the rules be appended again (as one may only have changed 1 out of many rules) or will the old VPNDirector rules be flushed and replaced with the new import?
 
wow, fast working! Great job!

I have a question regarding cloning VPNDirector rules:
1) are these rules somehow handled differently from ordinary policy rules? I remember seeing something about they have different priority. i.e. In menu, will they show up along side ordinary rules and be deletable as usual?
They are RPDB rules so nothing has changed regarding their execution order priority.

i.e. WIreGuard 'client' Peers have Priority over OpenVPN Clients, and lower number clients have a higher priority over their siblings.

VPNDirector simply makes it convenient to now manage ALL VPN Client Selective Rules from a single admin focal point.
2) if you create a set of rules in VPNDirector and choose to clone them into WGM. what happens if you change the rules and clone them again will the rules be appended again (as one may only have changed 1 out of many rules) or will the old VPNDirector rules be flushed and replaced with the new import?
Duplicates are ignored.

e.g. Added a new rule via VPNDirector,........
Code:
e  = Exit Script [?]

E:Option ==> vpndirector clone

    Auto clone VPN Director rules

    peer wg11 rule add wan 172.16.1.0/25 comment First 127 via WAN
    ***ERROR Peer wg11 WAN rule already exists!

    peer wg11 rule add vpn 172.16.1.10 comment Device10 VPN1
    ***ERROR Peer wg11 VPN rule already exists!

    peer wg11 rule add vpn 172.16.1.123 comment Device123 VPN1
    ***ERROR Peer wg11 VPN rule already exists!

    peer wg12 rule add vpn 172.16.2.2 comment Device2 VPN2
    ***ERROR Peer wg12 VPN rule already exists!

    peer wg12 rule add vpn 172.16.2.222 comment Device222 VPN2
    ***ERROR Peer wg12 VPN rule already exists!

    peer wg15 rule add vpn 172.16.99.111 comment Client
    [✔] Updated RPDB Selective Routing rule for wg15


    VPN Director Selective Routing RPDB rules

ID  Peer  Interface  Source         Destination  Description
18  wg11  WAN        172.16.1.0/25  Any          VPN Director: First 127 via WAN
19  wg11  VPN        172.16.1.10    Any          VPN Director: Device10 VPN1
20  wg11  VPN        172.16.1.123   Any          VPN Director: Device123 VPN1
21  wg12  VPN        172.16.2.2     Any          VPN Director: Device2 VPN2
22  wg12  VPN        172.16.2.222   Any          VPN Director: Device222 VPN2
23  wg15  VPN        172.16.99.111  Any          VPN Director: Client

NOTE: Deletion of a VPN Director rule isn't reflected in the clone process - you would have to issue the delete command (or click the delete button) then re-clone.
 
Last edited:
They are RPDB rules so nothing has changed regarding their execution order priority.

i.e. WIreGuard 'client' Peers have Priority over OpenVPN Clients, and lower number clients have a higher priority over their siblings.

VPNDirector simply makes it convenient to now manage ALL VPN Client Selective Rules from a single admin focal point.

Duplicates are ignored.

e.g. Added a new rule via VPNDirector,........
Code:
e  = Exit Script [?]

E:Option ==> vpndirector clone

    Auto clone VPN Director rules

    peer wg11 rule add wan 172.16.1.0/25 comment First 127 via WAN
    ***ERROR Peer wg11 WAN rule already exists!

    peer wg11 rule add vpn 172.16.1.10 comment Device10 VPN1
    ***ERROR Peer wg11 VPN rule already exists!

    peer wg11 rule add vpn 172.16.1.123 comment Device123 VPN1
    ***ERROR Peer wg11 VPN rule already exists!

    peer wg12 rule add vpn 172.16.2.2 comment Device2 VPN2
    ***ERROR Peer wg12 VPN rule already exists!

    peer wg12 rule add vpn 172.16.2.222 comment Device222 VPN2
    ***ERROR Peer wg12 VPN rule already exists!

    peer wg15 rule add vpn 172.16.99.111 comment Client
    [✔] Updated RPDB Selective Routing rule for wg15


    VPN Director Selective Routing RPDB rules

ID  Peer  Interface  Source         Destination  Description
18  wg11  WAN        172.16.1.0/25  Any          VPN Director: First 127 via WAN
19  wg11  VPN        172.16.1.10    Any          VPN Director: Device10 VPN1
20  wg11  VPN        172.16.1.123   Any          VPN Director: Device123 VPN1
21  wg12  VPN        172.16.2.2     Any          VPN Director: Device2 VPN2
22  wg12  VPN        172.16.2.222   Any          VPN Director: Device222 VPN2
23  wg15  VPN        172.16.99.111  Any          VPN Director: Client

NOTE: Deletion of a VPN Director rule isn't reflected in the clone process - you would have to issue the delete command (or click the delete button) then re-clone.
Aah, ok, so pressing delete under VPNDirector section will only delete current VPNDirector imports but leave other rules?

I have created a couple of rules in VPNDirector. The rules are enabled but the ovpn clients are not (as I dont have any) and when I press Show It gives me:
Code:
Thu Jun 23 15:33:18 DST 2022
============================

No WireGuard® VPN Director Policy rules found
Do the ovpn clients need to be connected for this to work?
 
Aah, ok, so pressing delete under VPNDirector section will only delete current VPNDirector imports but leave other rules?

I have created a couple of rules in VPNDirector. The rules are enabled but the ovpn clients are not (as I dont have any) and when I press Show It gives me:
Code:
Thu Jun 23 15:33:18 DST 2022
============================

No WireGuard® VPN Director Policy rules found
Do the ovpn clients need to be connected for this to work?
Have you try restart the wg client?
I did not stop ovpn client when I clone VPN Director though. After click clone, I ssh to wgm and run peer wg11, I can see the rules are cloned. But it is not reflected in ip rule yet. It gets applied after wg client restart and then click on GUI show will display it. Perhaps an auto-restart of wg client is preferred after clone?
It seems to clone from /jffs/openvpn/vpndirector_rulelist. Regardless of the state <0> or <1>. I have rules for ovpn client 1 and 3 in VPN Director, when I select ovpn client 1 as source to clone using default mapping, even ovpn client 3 rules are getting cloned.
 
Last edited:
VPNDirector simply makes it convenient to now manage ALL VPN Client Selective Rules from a single admin focal point.
It was one of the goals when I designed VPNDirector, because I knew at that time that I would eventually have to add support for Wireguard. I'll just have to add the wg interfaces to the list of available interfaces, and reuse the OpenVPN firewall code for WG as well.
 
Have you try restart the wg client?
I did not stop ovpn client when I clone VPN Director though. After click clone, I ssh to wgm and run peer wg11, I can see the rules are cloned. But it is not reflected in ip rule yet. It gets applied after wg client restart and then click on GUI show will display it. Perhaps an auto-restart of wg client is preferred after clone?
It seems to clone from /jffs/openvpn/vpndirector_rulelist. Regardless of the state <0> or <1>. I have rules for ovpn client 1 and 3 in VPN Director, when I select ovpn client 1 as source to clone using default mapping, even ovpn client 3 rules are getting cloned.
I never imported them, just tried to get wgm gui to show them.
They seem to be there:
Code:
admin@RT-AC86U-D7D8:/jffs/openvpn# cat vpndirector_rulelist
<1>Yazfi Guest 1>192.168.2.1/24>>WAN<1>Inbound>0.0.0.0/0>192.168.0.0/16>WAN<1
>Yazfi Guest 2>192.168.5.1/24>>OVPN2admin@RT-AC86U-D7D8:/jffs/openvpn#

Still:
Code:
Thu Jun 23 19:57:30 DST 2022
============================

No WireGuard® VPN Director Policy rules found

maybee just the Show function in the gui not complete yet.
 
I never imported them, just tried to get wgm gui to show them.
They seem to be there:
Code:
admin@RT-AC86U-D7D8:/jffs/openvpn# cat vpndirector_rulelist
<1>Yazfi Guest 1>192.168.2.1/24>>WAN<1>Inbound>0.0.0.0/0>192.168.0.0/16>WAN<1
>Yazfi Guest 2>192.168.5.1/24>>OVPN2admin@RT-AC86U-D7D8:/jffs/openvpn#

Still:
Code:
Thu Jun 23 19:57:30 DST 2022
============================

No WireGuard® VPN Director Policy rules found

maybee just the Show function in the gui not complete yet.
You have to import the VPN Director rules.....,which saves them in the wg_manager SQL database....then the show/list request will work.

NOTE: The VPN Director import filter/mapping feature currently only works from the command line; the WebUI drop-down filter/mapping options are not applied/honoured during actual VPN Director import.
 
Have you try restart the wg client?
I did not stop ovpn client when I clone VPN Director though. After click clone, I ssh to wgm and run peer wg11, I can see the rules are cloned. But it is not reflected in ip rule yet. It gets applied after wg client restart and then click on GUI show will display it. Perhaps an auto-restart of wg client is preferred after clone?
I'll have to check if I implemented a trigger prompt to restart the 'client' Peer for any peer wg1X rule [add|del] command request, but on reflection I probably didn't i.e. if you had more than one rule modification to be applied (say 5) then it would be tedious to have a prompt for each of the 5 modifications.

(VPN Director on the other hand probably should ask if the 'client' Peer should be restarted (if ACTIVE) as it is a bulk modification of the RPDB rules.
It seems to clone from /jffs/openvpn/vpndirector_rulelist. Regardless of the state <0> or <1>. I have rules for ovpn client 1 and 3 in VPN Director, when I select ovpn client 1 as source to clone using default mapping, even ovpn client 3 rules are getting cloned.
Good point - perhaps it is prudent to only clone ACTIVE rules, or maybe better yet, have the ability to similarly tag the rules in the SQL database as either ACTIVE/INACTIVE.
 

Latest threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top