Menu
What's new
By:
Filters Better Search

Wireguard Session Manager - Discussion (2nd) thread

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

ZebMcKayhan said:
I had 2 lines with the same domains and the second line ipset were NOT populated, so I would say they must be unique.



I don't see any point in bypassing dnsmasq so someone else could look into this.



Good to know! I'm typically not using my guest networks daily so I can keep this on experimental for now. I was connected 1h yesterday with no problems at all and nothing in syslog. Will keep testing.
Click to expand...
Hi Zeb, is there some kind of a tutorial or wiki page how to write the commands in wgm? for example how do i delete a rule i created? "peer wg11 rule add vpn src=192.168.1.x comment SingleIpToWg11"
thanks
 
abir1909 said:
Hi Zeb, is there some kind of a tutorial or wiki page how to write the commands in wgm? for example how do i delete a rule i created? "peer wg11 rule add vpn src=192.168.1.x comment SingleIpToWg11"
thanks
Click to expand...
You can list the database rules for the 'client' peer defined as 'Policy' mode

e.g. 'client' Peer 'wg15'
Code: 
E:Option ==> peer wg15

    Peers (Auto=P - Policy, Auto=X - External i.e. Cell/Mobile)

Client  Auto  IP                               Endpoint                    DNS             MTU  Public                                        Private                                       Annotate
wg15    P     fc00:bbbb:bbbb:bb01::2:c556/128  2001:ac8:21:ac::a22f:51820  193.138.218.74       deadnJvtHlh15E54kL/HJlZBL5yXkEQlC0AxOyDXNRU=  uL//HQ02jmorcPY6RyptwCMWH/6g/2ahrmoVzODx9Es=  # Mullvad UK, Manchester

    Selective Routing RPDB rules
ID  Peer  Interface  Source  Destination  Description
1   wg15  VPN        Any     ::0
...then delete the rule by specifying the ID number of the rule you wish to delete....

e.g.
Code: 
e  = Exit Script [?]

E:Option ==> peer wg15 rule del 1

    [✔] Deleted RPDB Selective Routing rule for wg15


    Peers (Auto=P - Policy, Auto=X - External i.e. Cell/Mobile)

Client  Auto  IP                               Endpoint                    DNS             MTU  Public                                        Private                                       Annotate
wg15    P     fc00:bbbb:bbbb:bb01::2:c556/128  2001:ac8:21:ac::a22f:51820  193.138.218.74       deadnJvtHlh15E54kL/HJlZBL5yXkEQlC0AxOyDXNRU=  uL//HQ02jmorcPY6RyptwCMWH/6g/2ahrmoVzODx9Es=  # Mullvad UK, Manchester

    No RPDB Selective Routing/Passthru rules for 'client' Peer wg15
 
Last edited:
Martineau said:
You can list the database rules for the 'client' peer defined as 'Policy' mode

e.g. 'client' Peer 'wg15'
Code: 
E:Option ==> peer wg15

    Peers (Auto=P - Policy, Auto=X - External i.e. Cell/Mobile)

Client  Auto  IP                               Endpoint                    DNS             MTU  Public                                        Private                                       Annotate
wg15    P     fc00:bbbb:bbbb:bb01::2:c556/128  2001:ac8:21:ac::a22f:51820  193.138.218.74       deadnJvtHlh15E54kL/HJlZBL5yXkEQlC0AxOyDXNRU=  uL//HQ02jmorcPY6RyptwCMWH/6g/2ahrmoVzODx9Es=  # Mullvad UK, Manchester

    Selective Routing RPDB rules
ID  Peer  Interface  Source  Destination  Description
1   wg15  VPN        Any     ::0
...then delete the rule by specifying the number of the rule you wish to delete....

e.g.
Code: 
e  = Exit Script [?]

E:Option ==> peer wg15 rule del 1

    [✔] Deleted RPDB Selective Routing rule for wg15


    Peers (Auto=P - Policy, Auto=X - External i.e. Cell/Mobile)

Client  Auto  IP                               Endpoint                    DNS             MTU  Public                                        Private                                       Annotate
wg15    P     fc00:bbbb:bbbb:bb01::2:c556/128  2001:ac8:21:ac::a22f:51820  193.138.218.74       BDTfnJvtHlh15E54kLYHJlZBL5yXkEQlC0AtOyDXNRU=  uLo6HQ02jmyrcPY6RyStwCMWH96g/2ahrmoVzODL9Es=  # Mullvad UK, Manchester

    No RPDB Selective Routing/Passthru rules for 'client' Peer wg15
Click to expand...
Thank you
 
abir1909 said:
Zeb, is there some kind of a tutorial or wiki page how to write the commands in wgm? for example how do i delete a rule i created? "peer wg11 rule add vpn src=192.168.1.x comment SingleIpToWg11"
thanks
Click to expand...
Yup, specific section about creating/managing rules here

If you scroll up to near the top you will find a table of content you could click on to link to different sections.

It is also linked to in Wireguard Session Manager if you enter ?.

//Zeb
 
How would source based routing work for ipv6? I've searched around the web only to find out the general consensus is that it is problematic.

With SLAAC where ip is mac- based, or SLAAC with privacy extention where it is seemingly random and changes when the lease expires???

The only device which I have ipv6 turned on is my Android phone which seems to keep pretty much the same ipv6 suffix even when I swap to guest wifi that has a different subnet. Even if I forget the network and reconnect it seems to give itself the same suffix and it does not match my Mac address.

What about when we get dynamic prefixes from our isp?

Acouple of options from the ip6tables:
eui64

This module matches the EUI-64 part of a stateless autoconfigured IPv6 address. It compares the EUI-64 derived from the source MAC address in Ehternet frame with the lower 64 bits of the IPv6 source address. But "Universal/Local" bit is not compared. This module doesn't match other link layer frame, and is only valid in the PREROUTING, FORWARD or INPUT chains.
Click to expand...

Or:
mac

--mac-source [!] addressMatch source MAC address. It must be of the form XX:XX:XX:XX:XX:XX. Note that this only makes sense for packets coming from an Ethernet device and entering the PREROUTING, FORWARD or INPUT chains.
Click to expand...

Any other idea?
 
Last edited:
ZebMcKayhan said:
Yup, specific section about creating/managing rules here

If you scroll up to near the top you will find a table of content you could click on to link to different sections.

It is also linked to in Wireguard Session Manager if you enter ?.

//Zeb
Click to expand...
Hi Zeb, is there an ssh command to turn on/off wgm client? in other words i want to be able to turn wgm on and off from my iphone using shortcuts with ssh.
thanks
 
abir1909 said:
Hi Zeb, is there an ssh command to turn on/off wgm client? in other words i want to be able to turn wgm on and off from my iphone using shortcuts with ssh.
thanks
Click to expand...
To stop an individual Peer

e.g.
Code: 
wgm stop wg12

    Requesting WireGuard VPN Peer stop (wg12)

    wg12: transfer: 0 B received, 888 B sent            0 Days, 00:00:31 from 2022-01-06 07:13:58 >>>>>>
    wg12: period : 0 Bytes received, 888 Bytes sent (Rx=0;Tx=888)
    wireguard-clientwg12: Wireguard VPN 'client' Peer (wg12) to 193.32.126.66:51820 (# Mullvad France, Paris) Terminated
To stop ALL ACTIVE Peers; don't specify the Peer (or category name)
Code: 
wgm stop

    Requesting WireGuard VPN Peer stop (wg21 wg11)

    wireguard-server1: Wireguard VPN (IPv6) [2a02:c7f:644f:1000:42b0:76ff:fe37:6160] 'Server' Peer (wg21) on 192.168.0.1:51820 (# RT-AC86U Server #1) Terminated

    wg11: transfer: 0 B received, 4.05 KiB sent            0 Days, 00:02:23 from 2022-01-06 07:13:44 >>>>>>
    wg11: period : 0 Bytes received, 4.05 KiB sent (Rx=0;Tx=4147)
    wireguard-clientwg11: Wireguard VPN 'client' Peer (wg11) to 89.45.90.2:51820 (# Mullvad USA, Los Angeles) Terminated

Substitute start/restart directive for stop as appropriate
 
Martineau said:
To stop an individual Peer

e.g.
Code: 
wgm stop wg12

    Requesting WireGuard VPN Peer stop (wg12)

    wg12: transfer: 0 B received, 888 B sent            0 Days, 00:00:31 from 2022-01-06 07:13:58 >>>>>>
    wg12: period : 0 Bytes received, 888 Bytes sent (Rx=0;Tx=888)
    wireguard-clientwg12: Wireguard VPN 'client' Peer (wg12) to 193.32.126.66:51820 (# Mullvad France, Paris) Terminated
To stop ALL ACTIVE Peers; don't specify the Peer (or category name)
Code: 
wgm stop

    Requesting WireGuard VPN Peer stop (wg21 wg11)

    wireguard-server1: Wireguard VPN (IPv6) [2a02:c7f:644f:1000:42b0:76ff:fe37:6160] 'Server' Peer (wg21) on 192.168.0.1:51820 (# RT-AC86U Server #1) Terminated

    wg11: transfer: 0 B received, 4.05 KiB sent            0 Days, 00:02:23 from 2022-01-06 07:13:44 >>>>>>
    wg11: period : 0 Bytes received, 4.05 KiB sent (Rx=0;Tx=4147)
    wireguard-clientwg11: Wireguard VPN 'client' Peer (wg11) to 89.45.90.2:51820 (# Mullvad USA, Los Angeles) Terminated

Substitute start/restart directive for stop as appropriate
Click to expand...
Perfect, it’s working! Thx
 
abir1909 said:
Perfect, it’s working! Thx
Click to expand...
Well. It’s working great with ssh/terminal client from my iPhone However, I can’t figure it out with shortcuts. I guess it’s looking for wgm actual location so it can start / stop it.
what’s the path for the wgm file?
 

Attachments

  • 7CF1756F-7504-4868-ABE7-C0855DFBD308.jpeg
    7CF1756F-7504-4868-ABE7-C0855DFBD308.jpeg
    27.7 KB · Views: 77
  • 53948177-F46B-4EAE-8BFF-43129DF5D12A.jpeg
    53948177-F46B-4EAE-8BFF-43129DF5D12A.jpeg
    20.8 KB · Views: 79
abir1909 said:
Well. It’s working great with ssh/terminal client from my iPhone However, I can’t figure it out with shortcuts. I guess it’s looking for wgm actual location so it can start / stop it.
what’s the path for the wgm file?
Click to expand...
In the terminal profile an alias (shortcut) is created; effectively
Code: 
wgm()  { /jffs/addons/wireguard/wg_manager.sh $@; }          # WireGuard Session Manager
or legacy Entware symlinked
Code: 
wgm='wg_manager'
together with Entware path '/opt/bin' the symlink is as follows
Code: 
ls -l /opt/bin/wg*

lrwxrwxrwx    1 admin    root            36 Dec 30 15:38 wg_manager -> /jffs/addons/wireguard/wg_manager.sh*
 
Last edited:
abir1909 said:
Well. It’s working great with ssh/terminal client from my iPhone However, I can’t figure it out with shortcuts. I guess it’s looking for wgm actual location so it can start / stop it.
what’s the path for the wgm file?
Click to expand...
I tested a similar app for Android "SSH button". For it to work I had to enter the full command:
Code: 
sh /jffs/addons/wireguard/wg_manager.sh start wg12

Then I could start/stop wg12 using buttons on my home screen.
 

Attachments

  • Screenshot_20220107-084443_SSH button.jpg
    Screenshot_20220107-084443_SSH button.jpg
    40.7 KB · Views: 86
Martineau said:
In the terminal profile an alias (shortcut) is created; effectively
Code: 
wgm()  { /jffs/addons/wireguard/wg_manager.sh $@; }          # WireGuard Session Manager
or legacy Entware symlinked
Code: 
wgm='wg_manager'
together with Entware path '/opt/bin' the symlink is as follows
Code: 
ls -l /opt/bin/wg*

lrwxrwxrwx    1 admin    root            36 Dec 30 15:38 wg_manager -> /jffs/addons/wireguard/wg_manager.sh*
Click to expand...
Works! Using “wg_manager”. Thanks again
 
abir1909 said:
So i have 3 wg clients, they all start automatically after reboot... is there a way to make only selected clients to start after reboot? thx
Click to expand...
only clients set as Y | P will autostart, so in order to not having a peer start at boot you need to set it to N, issue in wgm:
Code: 
E:Option ==> peer wg11 auto=N
to disable wg11 from autostart.

however, as wg11 now has auto=N it will no longer start at generic commands as:
Code: 
E:Option ==> start
# or
wgm start

but only when explicitly called:
Code: 
E:Option ==> start wg11
# or
wgm start wg11

but when the peer start it will be in Y (Default route) mode. Don't think there is a way to have this behavior for P (Policy) mode.

if more then one peer is started in this mode, the latest started will be the one used (if memory serves).
 
ZebMcKayhan said:
only clients set as Y | P will autostart, so in order to not having a peer start at boot you need to set it to N, issue in wgm:
Code: 
E:Option ==> peer wg11 auto=N
to disable wg11 from autostart.

however, as wg11 now has auto=N it will no longer start at generic commands as:
Code: 
E:Option ==> start
# or
wgm start

but only when explicitly called:
Code: 
E:Option ==> start wg11
# or
wgm start wg11

but when the peer start it will be in Y (Default route) mode. Don't think there is a way to have this behavior for P (Policy) mode.

if more then one peer is started in this mode, the latest started will be the one used (if memory serves).
Click to expand...
well, that's kind of a bummer. as i have 3 peers set to P... i don't mind setting one/two to N but when i will manually turn it on it will set to Y which isn't good. well.....
 
abir1909 said:
well, that's kind of a bummer. as i have 3 peers set to P... i don't mind setting one/two to N but when i will manually turn it on it will set to Y which isn't good. well.....
Click to expand...
Perhaps you could try the Geo-location feature in wgm instead?
github.com

GitHub - ZebMcKayhan/WireguardManager: Manage/Install WireGuard on applicable ASUS routers

Manage/Install WireGuard on applicable ASUS routers - ZebMcKayhan/WireguardManager
github.com github.com

This way you could instantly move ips/subnets between different wireguard clients (or wan).

Think that @Martineau took care of the dns redirect bug so I think it works as expected now.

But as far as I know it cant be executed outside wgm (but with some clever shell scripting maybee... ?).
 
Last edited:
Have not tested this, but I'm thinking something like:
Code: 
echo -e "livin wg11 192.168.1.38\ne" | wg_manager

livin wg11 192.168.1.38 = command inside wgm
\n = enter
e = exit

Test in terminal Window if it works first (maybee something simple like):
Code: 
echo -e "peer help\ne" | wg_manager
you should see above wgm has started, executed peer help and then exit

you could put in more commands if needed:
Code: 
echo -e "peer help\npeer wg11\ne" | wg_manager
and so on... just have \n between commands and end with e.
 
Last edited:
just realized... you could probably achieve what you wished by:
Code: 
echo -e "peer wg11 auto=P\nstart wg11\ne" | wg_manager
and
Code: 
echo -e "stop wg11\npeer wg11 auto=N\ne" | wg_manager

if this works, the peer will basically boot up with it's latest setting it had before shutting down... but it sound like the livin option might be better suited for you?

please report back how it works out for you and how you did it!

Edit: Beware of using \n2... I made a typo and pressed enter without checking. unfortunately 2 means uninstall :eek:
Spent the last hour rewriting files... good that I have post as much of it here, and the rest I found in an excellent tutorial on github that someone had written that perfectly matched my setup ;)
@Martineau a confirmation if I really want to uninstall would be nice... now I have backup (lessons learned)
 
Last edited:
ZebMcKayhan said:
just realized... you could probably achieve what you wished by:
Code: 
echo -e "peer wg11 auto=P\nstart wg11\ne" | wg_manager
and
Code: 
echo -e "stop wg11\npeer wg11 auto=N\ne" | wg_manager

if this works, the peer will basically boot up with it's latest setting it had before shutting down... but it sound like the livin option might be better suited for you?

please report back how it works out for you and how you did it!

Edit: Beware of using \n2... I made a typo and pressed enter without checking. unfortunately 2 means uninstall :eek:
Spent the last hour rewriting files... good that I have post as much of it here, and the rest I found in an excellent tutorial on github that someone had written that perfectly matched my setup ;)
@Martineau a confirmation if I really want to uninstall would be nice... now I have backup (lessons learned)
Click to expand...
I feel guilty :oops:
 
You must log in or register to reply here.

Similar threads

W
Skynet SOLVED: Scrollbar Disappears on Skynet Tab on Asuswrt-Merlin 386.14
Replies
10
Views
998
bennor
B
Martineau
Wireguard Session Manager (4th) thread
11 12 13
Replies
251
Views
30K
ZebMcKayhan
Z
A
Splitting Wireguard between Router and client
2 3
Replies
53
Views
3K
ZebMcKayhan
Z
K
Unbound Unbound_DNS_via_OVPN.sh with Wireguard
Replies
1
Views
2K
ZebMcKayhan
Z
J
Tailscale as an Addon: Polite request for a Coder to implement
Replies
14
Views
2K
jksmurf
J
Similar threads
Thread starter Title Forum Replies Date
JGrana chatai - version two - have a chat session with either Googles Gemini AI or Anthropics Claude (or both at once) Asuswrt-Merlin AddOns 4
JGrana New Addon - ChatAI - have a chat session with Googles Gemini AI Bot Asuswrt-Merlin AddOns 2
D Solved How do I remove WG Manager from amtm without resetting amtm? Asuswrt-Merlin AddOns 2
Viktor Jaep VPNMON VPNMON-R3 - Early, early alpha discussion, progress & screenshots Asuswrt-Merlin AddOns 17

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Members online

Total: 722 (members: 24, guests: 698)
Top