ip6tables -t nat -A WGDNS1 -i br0 -j DNAT --to-destination ${WanIp6}I know! I've done the same.
ERR: bdmf_attrelem_add_as_num#4276: system: status:No resources. attribute:ipv4_host_address_table index:0 value:171049217E:Option ==> stop wg21
Requesting WireGuard® VPN Peer stop (wg21)
ip6tables v1.4.15: unknown option "--to"
Try `ip6tables -h' or 'ip6tables --help' for more information.
ip6tables v1.4.15: unknown option "--to"
Try `ip6tables -h' or 'ip6tables --help' for more information.#!/bin/sh
###############################################################################
# Example for Wg21 ipv6 = aa00:aaaa:bbbb:cccc:100::1/120
# Change to your needs but keep formatting
Wg21Prefix=aa36:7ef1:2add:aa88:: #Wg21 ULA prefix with aa instead of fd
Wg21Suffix=100::1 #Wg21 Device suffix (last 64 bits)
Wg21PrefixLength=120 #Wg21 Prefix Length (120 recommended)
WanInterface=eth0
# Changing below lines should not be needed:
WanIp6Prefix=$(nvram get ipv6_prefix) #WanIp6Prefix=2001:1111:2222:3333::
Wg21_PrefIp=${Wg21Prefix%:*}${Wg21Suffix}/${Wg21PrefixLength} #aa00:aaaa:bbbb:cccc:100::1/120
WanWg21_PrefIp=${WanIp6Prefix%:*}${Wg21Suffix}/${Wg21PrefixLength} #2001:1111:2222:3333:100::1/120
# Execute firewall commands:
ip6tables -t nat -I POSTROUTING -s ${Wg21_PrefIp} -o ${WanInterface} -j NETMAP --to ${WanIp6Prefix}/64
ip6tables -t nat -I PREROUTING -i ${WanInterface} -d ${WanWg21_PrefIp} -j NETMAP --to ${Wg21Prefix}/64
###############################################################################ERR: bdmf_attrelem_add_as_num#4276: system: status:No resources. attribute:ipv4_host_address_table index:0 value:167775100ip6tables -t mangle -I POSTROUTING -s ${Wg21_PrefIp} -o eth0 -j SNPT --src-pfx ${Wg21Prefix}/64 --dst-pfx ${WanIp6Prefix}/64Probably something restarting at your router removing some firewall rules and/or routes. Anything from the syslog?
? inside wgm that firewall-start or nat-start is monitor the firewall rules. Perhaps you need both?Depending on what you want to change but most could be changed in the gui.
I mean change some settings in wg11/wg21/etc without dell and import again
The Wireguard GUI is located under Addons menu. From there you could update peer information. You dont have to delete them but for the server peer you might not get the desired change until you generate new clients.
Well, since Wireguard is a connectionless protocol the other end is not aware about you restarting wg11 so something is clearly interfering with wireguard on your router. Auto-restart wg11 periodically will not solve this and instead of creating scripts for checking and restarting I suggest we find what goes missing on your router and see if we can re-apply it at the right event(the same event that removes it)
iptables -nvL FORWARD -t filteriptables -nvL POSTROUTING -t natwg showYou typically dont need to import the config again (but that could depend on what you are trying to change).
Once the Peer .conf is imported (using
peer import xxxxxx.conf) , the command line peer command can used to modify the Peer configuration (except for Keys) and most changes can now also be applied via the Beta WebUIe = Exit Script [?]
E:Option ==> peer help
peer help - This text
peer - Show ALL Peers in database
peer peer_name - Show Peer in database or for details e.g peer wg21 config
peer peer_name {cmd {options} } - Action the command against the Peer
peer peer_name del - Delete the Peer from the database and all of its files *.conf, *.key
peer peer_name ip=xxx.xxx.xxx.xxx - Change the Peer VPN Pool IP
peer category - Show Peer categories in database
peer peer_name category [category_name {del | add peer_name[...]} ] - Create a new category with 3 Peers e.g. peer category GroupA add wg17 wg99 wg11
peer new [peer_name [options]] - Create new server Peer e.g. peer new wg27 ip=10.50.99.1/24 port=12345
peer new [peer_name] {ipv6} - Create new Dual-stack server Peer with 'aa' prefix e.g. peer new ipv6
peer new [peer_name] {ipv6} - Create new Dual-stack server Peer with 'fd' prefix e.g. peer new ipv6 ula
peer new [peer_name] {ipv6 noipv4 [ula[4]]} - Create new IPv6 Only server Peer e.g. peer new ipv6 noipv4
peer new [peer_name] {ipv6 noipv4} - Create new IPv6 Only server Peer e.g. peer new ipv6 noipv4 ipv6=aaff:a37f:fa75:100:100::1/120
peer import peer_conf [options] - Import '.conf' into SQL database e.g. import Mullvad_Dallas
import SiteA type=server
peer peer_name [del|add|upd] ipset {ipset_name[...]} - Selectively Route IPSets e.g. peer wg13 add ipset NetFlix Hulu
peer wg12 upd ipset MACs dstsrc src
peer wg12 upd ipset all enable n
peer peer_name [add] subnet {IPSubnet[...]} - Configure downstream subnets e.g. peer wg13 add subnet 192.168.5.0/24
peer peer_name {rule [del [all|id_num]|add [wan] rule_def]} - Manage Policy rules e.g. peer wg13 rule add 172.16.1.0/24 comment All LAN
peer wg13 rule add wan 52.97.133.162 comment smtp.office365.com
peer wg13 rule add wan 172.16.1.100 9.9.9.9 comment Quad9 DNS
peer wg17 rule del 10
peer wg17 rule del all
peer serv_peer_name {passthru client_peer {[add|del] [device|IP/CIDR]}} - Manage Passthu rules; 'server' peer devices/IPs/CIDR outbound via 'client' peer
peer wg21 passthru add wg11 SGS8
peer wg21 passthru add wg15 all
peer wg21 passthru add wg12 10.100.100.0/27
peer wg21 passthru del wg15 all
peer wg21 passthru del SGS8
peer wg21 passthru del all
peer serv_peer_name {bind device_peer} - Bind a Road Warrior 'device' Peer to a 'server' Peer e.g. peer wg21 bind SGS20
Visit @ZebMcKayhan's Hint's and Tips Guide https://github.com/ZebMcKayhan/WireguardManager/blob/main/README.md#table-of-contentpeer command accepts the following directives to alter the associated field for the relevant 'client'/'server' Peer:Ouh... Beta WebUI - Is it available in the update or does it need to be installed separately?
Wg11 seems to be running but no sign of any rules for accept forwarding or masquarade for it. But wg21 is there so nothing seems flushed. Any error messages from wgm when wg11 is started? clearly wg11 would not work like this, but you say it is working after restart of wg11 then turns into this later?
E:Option ==> www mountNo errors, no other issues. From time to time (1-3) days, I need to restart wg11 (or full router reboot), as it's stop working without any errors.
Depending on which version you have it should already be installed automatically.
e = Exit Script [?]
E:Option ==> uf deve = Exit Script [?]
E:Option ==> uf deve = Exit Script [?]
E:Option ==> www mount
WebUI page ('wg_manager.asp') mounted as 'user2.asp'e = Exit Script [?]
E:Option ==> www refreshX
WebUI page 'user2.asp' ('wg_manager.asp') unmounted
WebUI page ('wg_manager.asp') mounted as 'user2.asp'
[✔] Restarted service_httpd for WebUIReally strange. So something is deleting wg11 rules while leaving wg21 rules intact. Must be wgm doing something, altough unlikely. Sounds like wg11 gets half-stopped or something, creating some failure when the peer is stopped (but still initially succeeds).
wg_manager stopwg_manager startI suggest you schedule a
cron job to dump diagnostics to Syslog, to give you a definitive indication of when (and how) the issue occurs.cru a debugwg "0/5 * * * *" wgm diag >>/tmp/syslog.log
cru l
Welcome To SNBForums
SNBForums is a community for anyone who wants to learn about or discuss the latest in wireless routers, network storage and the ins and outs of building and maintaining a small network.
If you'd like to post a question, simply register and have at it!
While you're at it, please check out SmallNetBuilder for product reviews and our famous Router Charts, Ranker and plenty more!
