Wireguard Session Manager - Discussion (3rd) thread

archiel · Apr 27, 2022

Martineau said:
Weirdly (given the context of the error message) it seems script wg_client has somehow assumed text string 'ip=10.50.1.3/32' to be a WireGuard interface? such as wg11 and possibly extracted from the SQL database?

Could you please wgm stop wg11 then start it manually in full debug/trace mode using the appropriate command

i.e. If wg11 has auto=p issue

Code:

sh -x /jffs/addons/wireguard/wg_client wg11 policy

otherwise issue

Code:

sh -x /jffs/addons/wireguard/wg_client wg11

then PM me the top half of the debug trace output upto the point where the error message 'grep: /opt/etc/wireguard.d/ip=10.50.1.3/32.conf: No such file or directory' occurs.

I removed pho21 and laptop from passthru (and the associated rules) but when I add

peer wg21 passthru add wg11 ip=10.50.1.3/32 ipv6=aa36:7ef1:2add:aa88:100::3/128

I now get

***ERROR: 'device' Peer (ip=10.50.1.3/32) doesn't exist!

even though

Code:

E:Option ==> 8

        Peers (Auto start: Auto=P - Policy, Auto=S - Site-to-Site)
Server  Auto  Subnet                                       Port   Annotate
wg21    N     10.50.1.1/24,aa36:7ef1:2add:aa88:100::1/120  11501  # RT-AX88U (IPv4/IPv6) Server 1

Client  Auto  IP                                              Endpoint                   DNS                                   MTU  Annotate
wg11    P     <vpn_ipv4>/19, <vpn_ipv6>/64                    endpoint:nnnn       10.55.63.1,fe80::aa5e:45ff:feae:5050       # N/A

        Peers (Auto=X - External i.e. Cell/Mobile/Site)
Device  Auto  IP                                           DNS                                   Allowed IPs      Annotate
pho21   X     10.50.1.2/32,aa36:7ef1:2add:aa88:100::2/128  10.50.1.1,aa36:7ef1:2add:aa88:100::1  0.0.0.0/0, ::/0  # pho21 "Device"
laptop  X     10.50.1.3/32,aa36:7ef1:2add:aa88:100::3/128  10.50.1.1,aa36:7ef1:2add:aa88:100::1  0.0.0.0/0, ::/0  # laptop "Device"

(I have removed the unused peers & devices from the above)
As I don't seem to be able to re-add the passthru by IP, do you still want the debug & trace?

Also

Code:

grep -i "^version" /jffs/addons/wireguard/wg_server
VERSION="v4.16.12"

Martineau · Apr 27, 2022

archiel said:
I don't seem to be able to re-add the passthru by IP, do you still want the debug & trace?

As per the help

Code:

e  = Exit Script [?]

E:Option ==> peer help

    peer help                               - This text
    peer                                    - Show ALL Peers in database

<snip>

                                                       peer wg21 passthru add wg11 SGS8
                                                       peer wg21 passthru add wg15 all
                                                       peer wg21 passthru add wg12 10.100.100.0/27
                                                       peer wg21 passthru del SGS8
                                                       peer wg21 passthru del all

the prefix 'ip=' has never been required (for the add request, the IP/CIDR must be the 6th positional parameter and therefore cannot be confused with another parameter), but as per the changelog for v4.16bD the Road-Warrior 'device' now must pass validation.

So for Dual-stack IPv4+IPv6 use CIDR format (but the 'device' Peer name will probably be more human-friendly assuming that it resolves to a single IP - rather than a true CIDR range)

Code:

peer wg21 passthru add wg11 10.50.1.3/32,aa36:7ef1:2add:aa88:100::3/128

archiel · Apr 27, 2022

Martineau said:
As per the help

Code:

e = Exit Script [?] E:Option ==> peer help peer help - This text peer - Show ALL Peers in database <snip> peer wg21 passthru add wg11 SGS8 peer wg21 passthru add wg15 all peer wg21 passthru add wg12 10.100.100.0/27 peer wg21 passthru del SGS8 peer wg21 passthru del all

the prefix 'ip=' has never been required (for the add request, the IP/CIDR must be the 6th positional parameter and therefore cannot be confused with another parameter), but as per the changelog for v4.16bD the Road-Warrior 'device' now must pass validation.

if i want to add ipv4 and ipv6 for a device, can I add them together or one at a time - does it matter?

Martineau · Apr 27, 2022

archiel said:
if i want to add ipv4 and ipv6 for a device, can I add them together or one at a time - does it matter?

see updated post #122

archiel · Apr 27, 2022

Martineau said:
see updated post #122

After changing to

Code:

peer wg21 passthru add wg11 10.50.1.3/32 aa36:7ef1:2add:aa88:100::3/128

I still got the error - this may be as I separated IPv4 and IPv6 using a [space] rather than a , so I will delete, reboot and try again.

UPDATE: changing to

Code:

peer wg21 passthru add wg11 10.50.1.3/32,aa36:7ef1:2add:aa88:100::3/128

just changes the error from

Code:

grep: /opt/etc/wireguard.d/10.50.1.3/32.conf: No such file or directory

to

Code:

grep: /opt/etc/wireguard.d/10.50.1.3/32,aa36:7ef1:2add:aa88:100::3/128.conf: No such file or directory

Martineau · Apr 28, 2022

archiel said:

UPDATE: changing to

Code:

peer wg21 passthru add wg11 10.50.1.3/32,aa36:7ef1:2add:aa88:100::3/128

just changes the error from

Code:

grep: /opt/etc/wireguard.d/10.50.1.3/32.conf: No such file or directory

to

Code:

grep: /opt/etc/wireguard.d/10.50.1.3/32,aa36:7ef1:2add:aa88:100::3/128.conf: No such file or directory

Thanks - This innocuous error is due to trying to extract the description tag (originally for your Passthru Road-Warrior 'device' Peer 'pho21'), but clearly now you are manually explicitly specifying multiple CIDR IPs, the script shouldn't attempt to examine (as a fallback) the non-existent '.conf'.
Hopefully fixed:

Update wg_client · MartineauUK/wireguard@efd03fd

FIX: Do not attempt to extract Passthru 'client' Peer description if it is not a valid Road-Warrior 'device' Peer FIX: Enhance multliple RPDB rule deletion when 'client' Pe...

github.com

archiel said:
So it seem that adding a device adds the required rules but removing it (or at least removing all) leaves the rules intact.

Thanks - I've uploaded wireguard_manager Beta v4.16bE

Update wg_manager.sh · MartineauUK/wireguard@07a4e80

FIX: 'peer wg2X passthru del all' doesn't remove any rule entries from SQL database - Thanks SNB Forum member @archiel NEW: 'peer wg2X passthru del wg1X ['all']' wil...

github.com

To Upgrade/apply the patches use:

Code:

e  = Exit Script [?]

E:Option ==> uf dev

archiel · Apr 28, 2022

Martineau said:
Thanks - This innocuous error is due to trying to extract the description tag (originally for your Passthru Road-Warrior 'device' Peer 'pho21'), but clearly now you are manually explicitly specifying multiple CIDR IPs, the script shouldn't attempt to examine (as a fallback) the non-existent '.conf'.
Hopefully fixed:

Update wg_client · MartineauUK/wireguard@efd03fd

FIX: Do not attempt to extract Passthru 'client' Peer description if it is not a valid Road-Warrior 'device' Peer FIX: Enhance multliple RPDB rule deletion when 'client' Pe...

github.com

Thanks - I've uploaded wireguard_manager Beta v4.16bE

Update wg_manager.sh · MartineauUK/wireguard@07a4e80

FIX: 'peer wg2X passthru del all' doesn't remove any rule entries from SQL database - Thanks SNB Forum member @archiel NEW: 'peer wg2X passthru del wg1X ['all']' wil...

github.com

To Upgrade/apply the patches use:

Code:

e = Exit Script [?] E:Option ==> uf dev

I have updated and rebooted (just in case) and wg_server is now v4.16.13

The grep errors from specified IPs rather than a device name are now all gone, however I am still having issues if I remove a passthru rule

So if I load the rule as

peer wg21 passthru add wg11 laptop

then whether I try

peer wg21 passthru del all, or
peer wg21 passthru del wg11 all, or
peer wg21 passthru del wg11 laptop

the rules are not removed (if I run ip rule or ip -6 rule they are still there). So a stupid question - I am assuming the SQL database for WGM is /opt/etc/wireguard.d/WireGuard.db and that when routing rules are setup they are added here as well as to RPDB; when the passthru is taken down and the rules removed from WireGuard.db are they also removed from RPDB?

Martineau · Apr 28, 2022

archiel said:
Rules are not removed (if I run ip rule or ip -6 rule they are still there). So a stupid question - I am assuming the SQL database for WGM is /opt/etc/wireguard.d/WireGuard.db and that when routing rules are setup they are added here as well as to RPDB; when the passthru is taken down and the rules removed from WireGuard.db are they also removed from RPDB?

I've Uploaded wg_client v4.16.18

Update wg_client · MartineauUK/wireguard@d6ff18d

FIX: Delete (unidentified) Passthru rules on termination (already deleted from the database using command 'peer wg2X del wg1X') - Thanks SNB Forum member @archiel

github.com

To apply the patch use:

Code:

e  = Exit Script [?]

E:Option ==> uf dev

Implementation of the RPDB Passthru rules is handled by wg_client, hence the (current) need to stop/start the 'client' Peer after using command

Code:

peer wg2X passthru [ add | del ] xxxxxxxxxxx

If the Passthru 'client' Peer is DOWN when the Passthru rules are deleted from the SQL database, then the physical management of the Passthru RPDB rules are managed correctly.

The design allows deletion of the rules from the SQL database to legitimately occur whilst the 'client' Peer is UP, and the RPDB rules will actively remain (without causing disruption) until the 'client' Peer is restarted at a convenient (OoH) time.

The flaw is that having removed the Passthru rules from the SQL database, how does wg_client know which Passthru rules to delete on termination?!!

archiel · Apr 29, 2022

Martineau said:
I've Uploaded wg_client v4.16.18

Update wg_client · MartineauUK/wireguard@d6ff18d

FIX: Delete (unidentified) Passthru rules on termination (already deleted from the database using command 'peer wg2X del wg1X') - Thanks SNB Forum member @archiel

github.com

To apply the patch use:

Code:

e = Exit Script [?] E:Option ==> uf dev

Implementation of the RPDB Passthru rules is handled by wg_client, hence the (current) need to stop/start the 'client' Peer after using command

Code:

peer wg2X passthru [ add | del ] xxxxxxxxxxx

If the Passthru 'client' Peer is DOWN when the Passthru rules are deleted from the SQL database, then the physical management of the Passthru RPDB rules are managed correctly.

The design allows deletion of the rules from the SQL database to legitimately occur whilst the 'client' Peer is UP, and the RPDB rules will actively remain (without causing disruption) until the 'client' Peer is restarted at a convenient (OoH) time.

The flaw is that having removed the Passthru rules from the SQL database, how does wg_client know which Passthru rules to delete on termination?!!

I have updated and the revised client 4.16.18 is showing however after removing the passthu the ip / ip -6 rules are not being removed. What am I missing / can I do?

Martineau · Apr 29, 2022

archiel said:
I have updated and the revised client 4.16.18 is showing however after removing the passthu the ip / ip -6 rules are not being removed. What am I missing / can I do?

Update wg_client · MartineauUK/wireguard@bade7b7

FIX: 'while [ $? -eq 0 ]' syntax loop cannot be used to reliably test '$?' for Passthru RPDB deletion!

github.com

Update to wg_client v4.16.19

Code:

e  = Exit Script [?]

E:Option ==> uf dev

Enter the following commands

Code:

wgm stop wg11;  ip rule;ip -6 rule

Code:

wgm start wg11; ip rule;ip -6 rule

Code:

wgm stop wg11;  ip rule;ip -6 rule

If both the IPv4 prio 9981 rule(s) and the IPv6 prio 9981 rule(s) remain, you will have to run a debug/trace

Code:

wgm start wg11

sh -x /jffs/addons/wireguard/wg_client wg11 disable

and post the output on Pastebin

archiel · Apr 29, 2022

Martineau said:
Update wg_client · MartineauUK/wireguard@bade7b7

FIX: 'while [ $? -eq 0 ]' syntax loop cannot be used to reliably test '$?' for Passthru RPDB deletion!

github.com

Update to wg_client v4.16.19

Code:

e = Exit Script [?] E:Option ==> uf dev

Enter the following commands

Code:

wgm stop wg11; ip rule;ip -6 rule

Code:

wgm start wg11; ip rule;ip -6 rule

Code:

wgm stop wg11; ip rule;ip -6 rule

If both the IPv4 prio 9981 rule(s) and the IPv6 prio 9981 rule(s) remain, you will have to run a debug/trace

Code:

wgm start wg11 sh -x /jffs/addons/wireguard/wg_client wg11 disable

and post the output on Pastebin

Client v4.16.19 nailed it. Code removed for both ipv4 and ipv6.

unsynaps · Apr 30, 2022

Now that FiOS FINALLY has IPv6 in my area as of yesterday I have been looking into getting it working over WG.

From the sound of this thread, it is still up in the air. Am I reading into this right?

ZebMcKayhan · Apr 30, 2022

unsynaps said:
Now that FiOS FINALLY has IPv6 in my area as of yesterday I have been looking into getting it working over WG.

From the sound of this thread, it is still up in the air. Am I reading into this right?

Both client and server works with ipv6 but there could be some features not tested yet on ipv6 (like site-2-site ipv6).

There is also a variety of ipv6 connections but if you set it up and report if you run into problems here I'm sure we could fix it together.

https://github.com/ZebMcKayhan/WireguardManager#table-of-content[/CODE]

unsynaps · Apr 30, 2022

ZebMcKayhan said:
Both client and server works with ipv6 but there could be some features not tested yet on ipv6 (like site-2-site ipv6).

There is also a variety of ipv6 connections but if you set it up and report if you run into problems here I'm sure we could fix it together.

https://github.com/ZebMcKayhan/WireguardManager#table-of-content[/CODE]

My guess is the dev version is the only one working ATM right?

Martineau · Apr 30, 2022

WireGuard Manager Release v4.16

Github md5=9db9936e2a55b956274ee1c2419ab14b

Change Log https://github.com/MartineauUK/wireguard/commit/2c24e7aff451d44293b3676d4bcb374cc73c6051

Main goal of this release was to improve IPv6 compatibility - Many thanks for the diligent/patient Dual-stack (advanced) IPv4+IPv6 testing by @archiel , supported by @ZebMcKayhan

To upgrade use

Code:

e  = Exit Script [?]

E:Option ==> uf

and it is advised to issue the following

Code:

e  = Exit Script [?]

E:Option ==> createconfig

    Warning: WireGuard configuration file '/jffs/addons/wireguard/WireguardVPN.conf' already exists!...renamed to 'WireguardVPN.conf20220430-101031'

    Creating/Updating WireGuard configuration file '/jffs/addons/wireguard/WireguardVPN.conf'

to take advantage of any new customisable configuration features.

Change log etc.

Code:

e  = Exit Script [?]

E:Option ==> ?

    Router RT-AX86U Firmware (v386.5_2)

    [✔] Entware Architecture arch=aarch64


    v4.16 WireGuard Session Manager (Change Log: https://github.com/MartineauUK/wireguard/commits/main/wg_manager.sh)
    MD5=9db9936e2a55b956274ee1c2419ab14b /jffs/addons/wireguard/wg_manager.sh

    [✔] WireGuard Kernel module/User Space Tools included in Firmware (1.0.20210124)

<snip>

ZebMcKayhan · Apr 30, 2022

unsynaps said:
My guess is the dev version is the only one working ATM right?

In case it was not obvious, everything should be included in the above stable release 4.16 which is installable directly from AMTM.

unsynaps · Apr 30, 2022

ZebMcKayhan said:
In case it was not obvious, everything should be included in the above stable release 4.16 which is installable directly from AMTM.

HA HA! Excellent. Thank you.

EDIT: And it is working!
Oh is there any major difference between a 'aa' prefix and a 'fd' prefix?

unsynaps · Apr 30, 2022

OK I take that back. Ugh.

Installed wgm through amtm.
peer wg21 del
peer new ipv6
peer wg21 auto=y
create test wg21

Code:

E:Option ==> 8

        Peers (Auto start: Auto=P - Policy, Auto=S - Site-to-Site)
Server  Auto  Subnet                        Port   Annotate
wg21    Y     10.50.1.1/24,fd00:50:1::1/64  11501  # GT-AXE11000 (IPv4/IPv6) Server 1


        Peers (Auto=X - External i.e. Cell/Mobile/Site)
Device  Auto  IP                             DNS         Allowed IPs      Annotate
test    X     10.50.1.2/32,fd00:50:1::2/128  10.50.1.1,  0.0.0.0/0, ::/0  # test "Device"

        WireGuard ACTIVE Peer Status: Clients 0, Servers 1

I can connect but only ipv4 works.

ZebMcKayhan · May 1, 2022

unsynaps said:

OK I take that back. Ugh.

Installed wgm through amtm.
peer wg21 del
peer new ipv6
peer wg21 auto=y
create test wg21

Code:

E:Option ==> 8

        Peers (Auto start: Auto=P - Policy, Auto=S - Site-to-Site)
Server  Auto  Subnet                        Port   Annotate
wg21    Y     10.50.1.1/24,fd00:50:1::1/64  11501  # GT-AXE11000 (IPv4/IPv6) Server 1


        Peers (Auto=X - External i.e. Cell/Mobile/Site)
Device  Auto  IP                             DNS         Allowed IPs      Annotate
test    X     10.50.1.2/32,fd00:50:1::2/128  10.50.1.1,  0.0.0.0/0, ::/0  # test "Device"

        WireGuard ACTIVE Peer Status: Clients 0, Servers 1

I can connect but only ipv4 works.

Guess you did not read through:
https://github.com/ZebMcKayhan/WireguardManager#setup-wg-server

Altough your setup should work to access lan ipv6 but not wan, so when you say it's not working are you referring to wan or lan?

unsynaps · May 1, 2022

I fail at scrolling down pages.

Its working working now.

Is there any reason I should NOT run it on port 80?
Why would I want to do this? Hospital I go to often... their wireless is locked down like a mofo. Can't even check iCloud e-mail on it because it uses STANDARD secure SMTP ports which are blocked. And can't use VPN. My guess is all 80/443 traffic is allowed.

Thread starter	Title	Forum	Replies	Date
	chatai - version two - have a chat session with either Googles Gemini AI or Anthropics Claude (or both at once)	Asuswrt-Merlin AddOns	4	Jul 26, 2024
	New Addon - ChatAI - have a chat session with Googles Gemini AI Bot	Asuswrt-Merlin AddOns	2	Apr 9, 2024
	Wireguard VPN Director for VPN - WireGuard® Manager© v1.04 by Martineau	Asuswrt-Merlin AddOns	3	Nov 27, 2024
D	Solved How do I remove WG Manager from amtm without resetting amtm?	Asuswrt-Merlin AddOns	2	Jun 13, 2024

Wireguard Session Manager - Discussion (3rd) thread

Very Senior Member

Part of the Furniture

Very Senior Member

Part of the Furniture

Very Senior Member

Part of the Furniture

Very Senior Member

Part of the Furniture

Very Senior Member

Part of the Furniture

Very Senior Member

Senior Member

Very Senior Member

Senior Member

Part of the Furniture

Very Senior Member

Senior Member

Senior Member

Very Senior Member

Senior Member

Similar threads

Similar threads

Support SNBForums w/ Amazon

Sign Up For SNBForums Daily Digest