Menu
What's new
By:
Filters Better Search

Wireguard Session Manager - Discussion (2nd) thread

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Martineau said:
Code: 
menu show
or
Code: 
menu on
Click to expand...
Thanks!

I've made a wrapper script:
Code: 
nano /opt/bin/wgmExpo
Populate with:
Code: 
#!/bin/sh

commands=""
pad="\n"
for arg in "$@"
  do
    commands="${commands}${arg}${pad}"
  done
commands="${commands}e"

echo -e "$commands" | wg_manager | awk '/Option ==>/{flag=1; next} /WireGuard ACTIVE Peer Status/{flag=0} flag'
Save & exit
Make executable
Code: 
chmod +x /opt/bin/wgmExpo

So now you could run commands inside wgm by:
Code: 
wgmExpo "colour off" "peer wg11 dns=9.9.9.9" "restart wg11"

I will put it on my github wgm fork shortly and make some install instruction when I have time...
 
Ripped the installer command from wg_manager and tweaked it to my needs:

To Install wgmExpo, run:
Code: 
curl --retry 3 "https://raw.githubusercontent.com/ZebMcKayhan/WireguardManager/main/wgmExpo" -o "/opt/bin/wgmExpo" && chmod 755 "/opt/bin/wgmExpo"

it will download the file to /opt/bin/ folder, which is in the router path so you could access it from anywhere.

added some header texts:
Code: 
admin@RT-AC86U-D7D8:/tmp/home/root# wgmExpo
wgmExpo Version 0.1 by ZebMcKayhan
wgmExpo --help for usage info

admin@RT-AC86U-D7D8:/tmp/home/root# wgmExpo --help
wgmExpo Version 0.1 by ZebMcKayhan

usage:
wgmExpo "command 1" "command 2" "command n"

example:
wgmExpo "colour off" "peer wg11 dns=9.9.9.9" "restart wg11"

admin@RT-AC86U-D7D8:/tmp/home/root#

There are no checks in the scripts that the commands you are running in wgm are ok, but it will output any error message from wgm while processing the commands. It will always end with exiting wgm so you return to shell prompt.

if you wish to remove the script, simply execute:
Code: 
rm /opt/bin/wgmExpo

suggestions & feedback are always welcome

//Zeb
 
Had some time today, so extended wgmExpo abilities alittle:
Code: 
admin@RT-AC86U-D7D8:/tmp/home/root# wgmExpo --help
   wgmExpo Version 0.2 by ZebMcKayhan

   Execute menu command in Wireguard Session Manager

   usage:
      wgmExpo <Option> "command 1" "command 2" "command n"

   Options:
      -h     - help
      -v     - version
      -s     - Silent mode, no output
      -c     - Monocrome output (no ASCII escape characters)
      -t     - Display Wireguard ACTIVE Peer Status: each command

   example:
      wgmExpo -c "peer wg11 dns=9.9.9.9" "restart wg11"
      wgmExpo -ct "livin wg11 192.168.10.53"

c & t are the only options that work together (and the only to make sense)

Be careful with -s it will not produce any outputs att all (>/dev/null 2>&1).

@Martineau when I block outputs with 1>/dev/null there are still 1 output line from start wg12. Do wgm produce ERR outputs normally? This line:
Code: 
wireguard-clientwg12: Initialisation complete.

The file is updated on github, install with same command:
Code: 
curl --retry 3 "https://raw.githubusercontent.com/ZebMcKayhan/WireguardManager/main/wgmExpo" -o "/opt/bin/wgmExpo" && chmod 755 "/opt/bin/wgmExpo"

Again suggestions & feedback are always welcome

@abir1909 if you install this wrapper you could use the simpler command in Shortcuts:
Code: 
wgmExpo -c "livin @home 192.168.1.94"
And it should produce a neat output and also provide you with any unexpected output.

//Zeb
 
Last edited:
ZebMcKayhan said:
Ripped the installer command from wg_manager and tweaked it to my needs:

To Install wgmExpo, run:
Code: 
curl --retry 3 "https://raw.githubusercontent.com/ZebMcKayhan/WireguardManager/main/wgmExpo" -o "/opt/bin/wgmExpo" && chmod 755 "/opt/bin/wgmExpo"

it will download the file to /opt/bin/ folder, which is in the router path so you could access it from anywhere.
Click to expand...
I believe the accepted convention adopted by script authors (and used by the wireguard_manager installer ;)) is to create an '/opt/bin' alias to the actual .sh script, so you would install (assuming you didn't want to add the .sh suffix to 'wgmExpo' in your repository) as say

Code: 
curl --retry 3 "https://raw.githubusercontent.com/ZebMcKayhan/WireguardManager/main/wgmExpo" -o "/jffs/addons/wireguard/wgmExpo.sh" && chmod 755 "/jffs/addons/wireguard/wgmExpo.sh"

Consequently, using the above install location (rather than '/jffs/scripts'), when the parent wireguard_manager is uninstalled then your wgmExpo.sh child script will also automatically get removed.

Create the alias...
Code: 
ln -s /jffs/addons/wireguard/wgmExpo.sh /opt/bin/wgmExpo

NOTE: If the alias is orphaned, hopefully you should be able to identify where the actual script is supposed to be located

e.g the following hack should hopefully show all the symlinks
Code: 
ls -l /opt/bin | grep ^l
and a couple of scripts can then conveniently assist in showing the status of available Entware packages/3rd-Party addons

1644561954377.png


P.S. Of course I could amend wireguard_manager to always remove your alias or indeed quietly have wireguard_manager fully manage the availability/install of your addon direct from your Github? :cool:
 
Last edited:
JGrana said:
ps: One minor issue with wg_manager. When you first setup the Home server/peer, wg_manager tells you to copy the Home and Cabin files to the remote (Cabin) site.
JGrana said:
One of those is Home.conf. But, if you look in the /opt/etc/wireguard.d directory, there is only Home.conf_imported. Makes sense since I selected "y" to import.
Maybe keep another version - Home.conf as well to reduce confusion.
Click to expand...
Click to expand...
Given there is no obligation to import 'Home.conf', I suppose it might be better to actually zip the files that are to be manually exported to the remote Site-to-Site location, and simply only refer to the zip file name (rather than its content)?

i.e. having the rogue 'Home.conf' sitting alongside 'Home.conf_Imported' will surely lead to increased confusion!? :oops:
 
Last edited:
ZebMcKayhan said:
@Martineau when I block outputs with 1>/dev/null there are still 1 output line from start wg12. outputs normally? This line:
Code: 
wireguard-clientwg12: Initialisation complete.
.....Do wgm produce ERR outputs normally?
Click to expand...
Who knows with my manky coding skills, but the message isn't issued by the wireguard_manager.sh script...it originates from a different script - either wg_client or wg_server

but....
Code: 
wgmExpo "stop wg13"

    Requesting WireGuard VPN Peer stop (wg13)


    wg13: transfer: 16.21 KiB received, 11.22 KiB sent        0 Days, 00:00:16 from >>>>>>
    wg13: period : 16.21 KiB received, 11.22 KiB sent (Rx=16599;Tx=11489)
    wireguard-clientwg13: Wireguard VPN 'client' Peer (wg13) to 193.27.13.194:51820 (# Mullvad USA, Dallas) Terminated
and then with the -s option, I didn't receive the standard Initialisation message (except in Syslog)
Code: 
wgmExpo -s "start wg13"
Code: 
 wgmExpo -v

   wgmExpo Version 0.2 by ZebMcKayhan
 
Last edited:
Martineau said:
quietly have wireguard_manager fully manage the availability/install of your addon direct from your Github?
Click to expand...
That would really be fantastic! The tool is anyway quite useless without wireguard manager, and clearly you know your way around the router file system and what is deemed proper and not.
I would like to have the .sh but it is really in the way when typing the command. a symlink is a convenient way to get around this indeed. I will duplicate wgmExpo to EgmExpo.sh on my github (shortly) if you like to start implementing.

Martineau said:
and then with the -s option, I didn't receive the standard Initialisation message (except in Syslog)
Click to expand...
no, you wouldnt, because I changed the Silent Mode to use
Code: 
echo -e "$commands" | wg_manager >/dev/null 2>&1
so, currently both std and err output is sent to /dev/null/

my initial intention was that only std out would be piped so any script errors and similar would still show. so if you execute:
Code: 
echo -e "stop wg13\nstart wg13\ne" | wg_manager 1>/dev/null

you will get the one line still but all else hidden. The thought crossed my mind too if it shows because a 3rd script outputs it, but I really have no idea.

//Zeb
 
Last edited:
@Martineau
Your "manky coding skills" are working great, Thank You!
I'm still working on my "copy/paste" skills for the Pi.
 
Last edited:
@Martineau , can you check to see if you are setting up a route on site-2-site from the server to the peer?
On v4.15b6, the tunnel comes up fine (wg shows both sides sending and receiving) but I can't access devices across the tunnel.
Using the conf files created by wg_manager and using wg-quick, I can see a route added and I can access devices on both sides. Here are the routing tables from the remote (Cabin) with wg_manager and wg-quick:

Code: 
wg-quick:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         108.12.6.1      0.0.0.0         UG    0      0        0 eth0
10.9.8.1        *               255.255.255.255 UH    0      0        0 Cabin
68.237.161.12   108.12.6.1      255.255.255.255 UGH   1      0        0 eth0
71.250.0.12     108.12.6.1      255.255.255.255 UGH   1      0        0 eth0
108.12.6.0      *               255.255.255.0   U     0      0        0 eth0
108.12.6.1      *               255.255.255.255 UH    0      0        0 eth0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
192.168.1.0     *               255.255.255.0   U     0      0        0 Cabin
192.168.2.0     *               255.255.255.0   U     0      0        0 br0
default via 108.12.6.1 dev eth0
10.9.8.1 dev Cabin  scope link
68.237.161.12 via 108.12.6.1 dev eth0  metric 1
71.250.0.12 via 108.12.6.1 dev eth0  metric 1
108.12.6.0/24 dev eth0  proto kernel  scope link  src 108.12.6.5
108.12.6.1 dev eth0  proto kernel  scope link
127.0.0.0/8 dev lo  scope link
192.168.1.0/24 dev Cabin  scope link
192.168.2.0/24 dev br0  proto kernel  scope link  src 192.168.2.1

wg_manager:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         108.12.6.1      0.0.0.0         UG    0      0        0 eth0
68.237.161.12   108.12.6.1      255.255.255.255 UGH   1      0        0 eth0
71.250.0.12     108.12.6.1      255.255.255.255 UGH   1      0        0 eth0
108.12.6.0      *               255.255.255.0   U     0      0        0 eth0
108.12.6.1      *               255.255.255.255 UH    0      0        0 eth0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
192.168.1.0     *               255.255.255.0   U     0      0        0 wg22
192.168.2.0     *               255.255.255.0   U     0      0        0 br0
default via 108.12.6.1 dev eth0
68.237.161.12 via 108.12.6.1 dev eth0  metric 1
71.250.0.12 via 108.12.6.1 dev eth0  metric 1
108.12.6.0/24 dev eth0  proto kernel  scope link  src 108.12.6.5
108.12.6.1 dev eth0  proto kernel  scope link
127.0.0.0/8 dev lo  scope link
192.168.1.0/24 dev wg22  scope link
192.168.2.0/24 dev br0  proto kernel  scope link  src 192.168.2.1

wg_quick adds the route to 10.9.8.1 but it seems wg_manager does not.
 
Is there a way to set the MTU for a server from wgm? I'm setting up a site2site connection between my home and cabin where the cabin side is connected over LTE and has a lower than normal MTU of 1460. This means that the max MTU for Wireguard is 1400 instead of the default 1420.

I've already set the MTU at 1400 on the cabin ("client", a Teltonika RUTX09) side. Doing this alone doesn't seem to help though, as I get interrupted connections. Wgm doesn't seem to read the MTU option from the server conf file - as an Ubuntu Wireguard server would do - nor does it support setting MTU manually:

E:Option ==> peer wg21 mtu 1400 ***ERROR 'server' Peer 'wg21' cannot set MTU

I can fix the MTU and connection issues by running "ip link wg21 set mtu 1400" from the command line or hacking the "cmd ifconfig $VPN_ID mtu" line in wg_server to make the change persist over reboots. This is not very elegant, though.

The home server is an RT-AC86U running the latest release Merlin fw.
 
Last edited:
JGrana said:
@Martineau , can you check to see if you are setting up a route on site-2-site from the server to the peer?
On v4.15b6, the tunnel comes up fine (wg shows both sides sending and receiving) but I can't access devices across the tunnel.
Using the conf files created by wg_manager and using wg-quick, I can see a route added and I can access devices on both sides. Here are the routing tables from the remote (Cabin) with wg_manager and wg-quick:

Code: 
wg-quick:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         108.12.6.1      0.0.0.0         UG    0      0        0 eth0
10.9.8.1        *               255.255.255.255 UH    0      0        0 Cabin
68.237.161.12   108.12.6.1      255.255.255.255 UGH   1      0        0 eth0
71.250.0.12     108.12.6.1      255.255.255.255 UGH   1      0        0 eth0
108.12.6.0      *               255.255.255.0   U     0      0        0 eth0
108.12.6.1      *               255.255.255.255 UH    0      0        0 eth0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
192.168.1.0     *               255.255.255.0   U     0      0        0 Cabin
192.168.2.0     *               255.255.255.0   U     0      0        0 br0
default via 108.12.6.1 dev eth0
10.9.8.1 dev Cabin  scope link
68.237.161.12 via 108.12.6.1 dev eth0  metric 1
71.250.0.12 via 108.12.6.1 dev eth0  metric 1
108.12.6.0/24 dev eth0  proto kernel  scope link  src 108.12.6.5
108.12.6.1 dev eth0  proto kernel  scope link
127.0.0.0/8 dev lo  scope link
192.168.1.0/24 dev Cabin  scope link
192.168.2.0/24 dev br0  proto kernel  scope link  src 192.168.2.1

wg_manager:

Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         108.12.6.1      0.0.0.0         UG    0      0        0 eth0
68.237.161.12   108.12.6.1      255.255.255.255 UGH   1      0        0 eth0
71.250.0.12     108.12.6.1      255.255.255.255 UGH   1      0        0 eth0
108.12.6.0      *               255.255.255.0   U     0      0        0 eth0
108.12.6.1      *               255.255.255.255 UH    0      0        0 eth0
127.0.0.0       *               255.0.0.0       U     0      0        0 lo
192.168.1.0     *               255.255.255.0   U     0      0        0 wg22
192.168.2.0     *               255.255.255.0   U     0      0        0 br0
default via 108.12.6.1 dev eth0
68.237.161.12 via 108.12.6.1 dev eth0  metric 1
71.250.0.12 via 108.12.6.1 dev eth0  metric 1
108.12.6.0/24 dev eth0  proto kernel  scope link  src 108.12.6.5
108.12.6.1 dev eth0  proto kernel  scope link
127.0.0.0/8 dev lo  scope link
192.168.1.0/24 dev wg22  scope link
192.168.2.0/24 dev br0  proto kernel  scope link  src 192.168.2.1

wg_quick adds the route to 10.9.8.1 but it seems wg_manager does not.
Click to expand...
I've pushed a HOTFIX. (wg_server script)

github.com

Update wg_server · MartineauUK/wireguard@891366f

HOTFIX: SIte-to-Site: Revert detection of possible duplicate routes - SNB Forums member @JGrana
github.com github.com

Could you please see if it fixes your issue.
 
Last edited:
Bearnet said:
Is there a way to set the MTU for a server from wgm? I'm setting up a site2site connection between my home and cabin where the cabin side is connected over LTE and has a lower than normal MTU of 1460. This means that the max MTU for Wireguard is 1400 instead of the default 1420.

I've already set the MTU at 1400 on the cabin ("client", a Teltonika RUTX09) side. Doing this alone doesn't seem to help though, as I get interrupted connections. Wgm doesn't seem to read the MTU option from the server conf file - as an Ubuntu Wireguard server would do - nor does it support setting MTU manually:

E:Option ==> peer wg21 mtu 1400 ***ERROR 'server' Peer 'wg21' cannot set MTU

I can fix the MTU and connection issues by running "ip link wg21 set mtu 1400" from the command line or hacking the "cmd ifconfig $VPN_ID mtu" line in wg_server to make the change persist over reboots. This is not very elegant, though.

The home server is an RT-AC86U running the latest release Merlin fw.
Click to expand...
I've pushed a HOTFIX (wg_server script)

github.com

Update wg_server · MartineauUK/wireguard@8415641

CHANGE: Allow use of 'MTU =' in .conf to override 1420 default - SNB Forums member @bearnet
github.com github.com

Can you please test?

Upgrade using
Code: 
e  = Exit Script [?]

E:Option ==> uf dev
then you should specify MTU = 1400 in .conf then restart the 'server' Peer

NOTE: I think you could also specify the PostUP = ip link %i set mtu 1400 directive in the .conf as per wg-quick
 
Last edited:
Martineau said:
I've pushed a HOTFIX (wg_server script)

github.com

Update wg_server · MartineauUK/wireguard@f15fbd7

CHANGE: Allow use of 'MTU =' in .conf to override 1420 default - SNB Forums member @Bearnet
github.com github.com

Can you please test?

Upgrade using
Code: 
e  = Exit Script [?]

E:Option ==> uf dev
then you should specify MTU = 1400 in .conf then restart the 'server' Peer

NOTE: I think you could also specify the PostUP = ip link %i set mtu 1400 directive in the .conf as per wg-quick
Click to expand...
Thanks for the extremely quick response and attempt at resolution!

I upgraded the script and edited the wg21.conf file as follows:

# Home - 192.168.1.0/24
[Interface]
PrivateKey = <redacted>
#Address = 10.8.0.1/32
ListenPort = 51516
MTU = 1400

Running "restart servers" now produces the following output and doesn't work:

E:Option ==> restart servers

Requesting WireGuard VPN Peer restart for Category 'Servers' (wg21)

Restarting Wireguard 'server' Peer (wg21)
wireguard-server1: Wireguard VPN 'Server' Peer (wg21) on XXX:51516 (# Home - 192.168.1.0/24) Terminated

wireguard-server1: Initialising Wireguard VPN 'Server' Peer (wg21) on XXX:51516
(# Home - 192.168.1.0/24)
Line unrecognized: `MTU=1400'
Configuration parsing error

***ERROR Initialisation ABORTED - 'wg setconf wg21 /opt/etc/wireguard.d/wg21.conf' FAILED

Also, I think the latter "1420" in the change you made to wg_server should be "$MTU":

[ -z "$MTU" ] && cmd ifconfig $VPN_ID mtu 1420 || cmd ifconfig $VPN_ID mtu 1420 # v4.15.5 v1.02

Also, your pointer at adding the PostUp directive to wg21.conf doesn't work:

Line unrecognized: `PostUP=iplink%isetmtu1400'
Configuration parsing error
 
Last edited:
Bearnet said:
Line unrecognized: `PostUP=iplink%isetmtu1400'
Configuration parsing error
Click to expand...
Not sure if this is a copy-paste and/or output error but it looks as the blanks are removed. Did you add it without the blanks?

It needs to to be added in conf file as:
Code: 
PostUP = ip link %i set mtu 1400
Think the spaces are vital for correct parsing.
 
ZebMcKayhan said:
Not sure if this is a copy-paste and/or output error but it looks as the blanks are removed. Did you add it without the blanks?

It needs to to be added in conf file as:
Code: 
PostUP = ip link %i set mtu 1400
Think the spaces are vital for correct parsing.
Click to expand...
The wg21.conf file has the line exactly as instructed with spaces:
PostUp = ip link %i set mtu 1400

Maybe your parser drops the spaces from the error message?
 
Bearnet said:
The wg21.conf file has the line exactly as instructed with spaces:
PostUp = ip link %i set mtu 1400

Maybe your parser drops the spaces from the error message?
Click to expand...
Ok, wierd. Looks like the parser dont get the spaces. What editor did you use?
Perhaps a
Code: 
dos2unix wg21.conf
Would fix if there is some ASCII conversation error (long shot)
 
ZebMcKayhan said:
Ok, wierd. Looks like the parser dont get the spaces. What editor did you use?
Perhaps a
Code: 
dos2unix wg21.conf
Would fix if there is some ASCII conversation error (long shot)
Click to expand...
I'm using nano in the router's terminal... Did you try that the command worked on your setup?

Edit: Just realised that error output is coming from wg itself. I wonder if the Asus-built wg binaries are to blame?
 
Last edited:
Bearnet said:
I'm using nano in the router's terminal... Did you try that the command worked on your setup?

Edit: Just realised that error output is coming from wg itself. I wonder if the Asus-built wg binaries are to blame?
Click to expand...
Ok, then I don't know...

While waiting for a fix, add it to wg21 custom start script:
Code: 
nano /jffs/addons/wireguard/Scripts/wg21-up.sh

Populate with:
Code: 
#!/bin/sh

ip link wg21 set mtu 1400

Save, exit, make executable and restart wg21
 
Bearnet said:
I'm using nano in the router's terminal... Did you try that the command worked on your setup?

Edit: Just realised that error output is coming from wg itself. I wonder if the Asus-built wg binaries are to blame?
Click to expand...
Aha... that's right, this config is already imported and will be sent to wg as-is.
You need to comment it:
Code: 
#PostUp = ip link %i set mtu 1400

Wgm will still parse and execute the command but wg will disregard it...

This comment is usually placed there by wgm during import process, but this is created locally so you need to place it or it will be sent to wg that can't process this.
 
You must log in or register to reply here.

Similar threads

W
Skynet SOLVED: Scrollbar Disappears on Skynet Tab on Asuswrt-Merlin 386.14
Replies
10
Views
1K
bennor
B
Martineau
Wireguard Session Manager (4th) thread
11 12 13
Replies
251
Views
30K
ZebMcKayhan
Z
A
Splitting Wireguard between Router and client
2 3
Replies
53
Views
3K
ZebMcKayhan
Z
Viktor Jaep
TAILMON TAILMON v1.0.20 -July 27, 2024- WireGuard-based Tailscale Installer, Configurator and Monitor (Now available in AMTM!)
Replies
2
Views
289
Viktor Jaep
Viktor Jaep
Tech9
Malware damaging ASUS routers?
9 10 11
Replies
210
Views
14K
Tech9
Tech9
Similar threads
Thread starter Title Forum Replies Date
JGrana chatai - version two - have a chat session with either Googles Gemini AI or Anthropics Claude (or both at once) Asuswrt-Merlin AddOns 4
JGrana New Addon - ChatAI - have a chat session with Googles Gemini AI Bot Asuswrt-Merlin AddOns 2
D Solved How do I remove WG Manager from amtm without resetting amtm? Asuswrt-Merlin AddOns 2

Similar threads

Latest threads

Support SNBForums w/ Amazon

If you'd like to support SNBForums, just use this link and buy anything on Amazon. Thanks!

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!

Staff online

Members online

Total: 963 (members: 40, guests: 923)
Top