coś nie umię tego uruchomić - sam konfig nie wyglada skomplikowanie , klucze na pewno wpisałem prawidłowo , wydaje mi sie ze coś nie działa ze wzgledu na firewolla .
ps
31669 root 1324 S /bin/sh ./wireguard.sh wireguard setup wg0 {"proto":"wireguard","listen_port":55055,"private_key":"+KLpGTxpKxxxxxxxxxxxxxxHZfzx42ogYZTcHXs="}
network
config interface 'wg0'
option proto 'wireguard'
option listen_port '55055'
list addresses '10.9.0.1/24'
option private_key '+KLpGTxpKxxxxxxxxxxxxxxxxxx42ogYZTcHXs='
config wireguard_wg0
option public_key 'yaDpmcxxxxxxxxxxxxxxcWhMMXTm8='
option route_allowed_ips '1'
list allowed_ips '0.0.0.0/0'
option persistent_keepalive '25'
option description 'android'
firewall
root@OpenWrt:~# cat /etc/config/firewall
config defaults
option syn_flood '1'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'REJECT'
option flow_offloading '1'
option flow_offloading_hw '1'
config zone
option name 'lan'
list network 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
config zone
option name 'wan'
list network 'wan'
list network 'wan6'
option input 'REJECT'
option output 'ACCEPT'
option forward 'REJECT'
option masq '1'
option mtu_fix '1'
config forwarding
option src 'lan'
option dest 'wan'
config rule
option name 'Allow-DHCP-Renew'
option src 'wan'
option proto 'udp'
option dest_port '68'
option target 'ACCEPT'
option family 'ipv4'
config rule
option name 'Allow-Ping'
option src 'wan'
option proto 'icmp'
option icmp_type 'echo-request'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-IGMP'
option src 'wan'
option proto 'igmp'
option family 'ipv4'
option target 'ACCEPT'
config rule
option name 'Allow-DHCPv6'
option src 'wan'
option proto 'udp'
option src_ip 'fc00::/6'
option dest_ip 'fc00::/6'
option dest_port '546'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-MLD'
option src 'wan'
option proto 'icmp'
option src_ip 'fe80::/10'
list icmp_type '130/0'
list icmp_type '131/0'
list icmp_type '132/0'
list icmp_type '143/0'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Input'
option src 'wan'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
list icmp_type 'router-solicitation'
list icmp_type 'neighbour-solicitation'
list icmp_type 'router-advertisement'
list icmp_type 'neighbour-advertisement'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-ICMPv6-Forward'
option src 'wan'
option dest '*'
option proto 'icmp'
list icmp_type 'echo-request'
list icmp_type 'echo-reply'
list icmp_type 'destination-unreachable'
list icmp_type 'packet-too-big'
list icmp_type 'time-exceeded'
list icmp_type 'bad-header'
list icmp_type 'unknown-header-type'
option limit '1000/sec'
option family 'ipv6'
option target 'ACCEPT'
config rule
option name 'Allow-IPSec-ESP'
option src 'wan'
option dest 'lan'
option proto 'esp'
option target 'ACCEPT'
config rule
option name 'Allow-ISAKMP'
option src 'wan'
option dest 'lan'
option dest_port '500'
option proto 'udp'
option target 'ACCEPT'
config include
option path '/etc/firewall.user'
config rule
option src 'wan'
option target 'ACCEPT'
option proto 'udp'
option dest_port '55055'
option name 'wireguard'
config zone
option name 'wg'
option input 'ACCEPT'
option forward 'ACCEPT'
option output 'ACCEPT'
option masq '1'
option network 'wg0'
config forwarding
option src 'wg'
option dest 'wan'
config forwarding
option src 'wan'
option dest 'wg'
config forwarding
option src 'wg'
option dest 'lan'
config forwarding
option src 'lan'
option dest 'wg'
czy powinien być widoczny w netstat -apn - tam nie widze by coś słuchało na porcie 55055
jak sie go uruchamia ręcznie sam proces - nawet nie idzie go skillować
probuje sie połaczyc z klijenta na androidzie - tam na pewno mam wszystko dobrze wpisane ( zreszta jak cos jest zle to nie zapisze)
po przeładowaniu firewolla
root@OpenWrt:~# /etc/init.d/firewall reload
Warning: Unable to locate ipset utility, disabling ipset support
Warning: Section @zone[1] (wan) cannot resolve device of network 'wan6'
Warning: Section @zone[2] (wg) cannot resolve device of network 'wg0'
Warning: Section @zone[2] (wg) has no device, network, subnet or extra options
* Clearing IPv4 filter table
* Clearing IPv4 nat table
* Clearing IPv4 mangle table
* Populating IPv4 filter table
* Rule 'Allow-DHCP-Renew'
* Rule 'Allow-Ping'
* Rule 'Allow-IGMP'
* Rule 'Allow-IPSec-ESP'
* Rule 'Allow-ISAKMP'
* Rule 'wireguard'
* Forward 'lan' -> 'wan'
* Forward 'wg' -> 'wan'
* Forward 'wan' -> 'wg'
* Forward 'wg' -> 'lan'
* Forward 'lan' -> 'wg'
* Zone 'lan'
* Zone 'wan'
* Zone 'wg'
* Populating IPv4 nat table
* Zone 'lan'
* Zone 'wan'
* Zone 'wg'
* Populating IPv4 mangle table
* Zone 'lan'
* Zone 'wan'
* Zone 'wg'
* Set tcp_ecn to off
* Set tcp_syncookies to on
* Set tcp_window_scaling to on
root@OpenWrt:~#
