vpn improvements

diff --git a/brc b/brc
index a767bc911686e9834fd5c91f6cee0e8e7cd2834e..5045e39de62c8998f76d78686c9a4be3bc5406db 100644 (file)
--- a/brc
+++ b/brc
@@ -5005,6 +5005,13 @@ loc() {
   done | sort -n
 }
 
+wg-log-on() {
+  e module wireguard +p | s tee /sys/kernel/debug/dynamic_debug/control
+  }
+wg-log-off() {
+  e module wireguard -p | s tee /sys/kernel/debug/dynamic_debug/control
+}
+
 # * stuff that makes sense to be at the end
 
 # note, if we unset IFS, that will mess up completion scripts which

diff --git a/brc2 b/brc2
index 94aeb78bef7c4ccabe98c3c3222e9e53906577da..e67c8cdd9c1c7eed4395c7f9992047570a95ecb9 100644 (file)
--- a/brc2
+++ b/brc2
@@ -3868,21 +3868,29 @@ mailnncheck() {
 
 
 vpncmd() {
-  sdncmd wg-quick-tr@client.service "$@"
+  local n="$1" ser_suf=tr
+  if [[ $n ]]; then ser_suf=nn; shift; fi
+  sdncmd wg-quick-$ser_suf@client$n.service "$@"
 }
 vpncmdroot() {
-  sdncmdroot wg-quick-tr@client.service "$@"
+  local n="$1" ser_suf=tr
+  if [[ $n ]]; then ser_suf=nn; shift; fi
+  sdncmdroot wg-quick-$ser_suf@client$n.service "$@"
 }
 # usage: vpni [suffix]
 # suffix selects non-default vpn.
 # shellcheck disable=SC2120 # expected
 vpni() {
+  local n="$1" ser_suf=tr
+  if [[ $n ]]; then ser_suf=nn; fi
   # m sudo nsenter --net=/var/run/netns/client sudo -u iank -i bash # for just the netns
-  sdncmd wg-quick-tr@client$1.service bash
+  sdncmd wg-quick-$ser_suf@client$n.service bash
 }
 vpnbash() {
+  local n="$1" ser_suf=tr
+  if [[ $n ]]; then ser_suf=nn; fi
   #m sudm nsenter --net=/var/run/netns/client bash # only gets netns
-  sdncmdroot wg-quick-tr@client.service bash
+  sdncmdroot wg-quick-$ser_suf@client$n.service bash
 }
 
 
@@ -4026,11 +4034,15 @@ ovpnoff() {
   sudo systemctl stop $vpn_service@$1
 }
 vpnoffc() { # vpn off client
-  ser stop wg-quick-tr@client
+  local n="$1" ser_suf=tr
+  if [[ $n ]]; then ser_suf=nn; fi
+  ser stop wg-quick-$ser_suf@client$n
 }
 vpnc() {
   local unit
-  unit=wg-quick-tr@client
+  local n="$1" ser_suf=tr
+  if [[ $n ]]; then ser_suf=nn; fi
+  unit=wg-quick-$ser_suf@client$n
   sudo -v
   if [[ $(systemctl is-active $unit) != active ]]; then
     s systemctl start $unit

diff --git a/filesystem/etc/systemd/system/wg-quick-nn-pre@.service b/filesystem/etc/systemd/system/wg-quick-nn-pre@.service
new file mode 100644 (file)
index 0000000..583ea64
--- /dev/null
+++ b/filesystem/etc/systemd/system/wg-quick-nn-pre@.service
@@ -0,0 +1,11 @@
+[Unit]
+Description=Initial setup of netns for wg-quick-nn %I
+
+[Service]
+Type=oneshot
+ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns start %i
+ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i
+RemainAfterExit=yes
+
+[Install]
+WantedBy=multi-user.target

diff --git a/filesystem/etc/systemd/system/wg-quick-nn@.service b/filesystem/etc/systemd/system/wg-quick-nn@.service
new file mode 100644 (file)
index 0000000..5b9a7b0
--- /dev/null
+++ b/filesystem/etc/systemd/system/wg-quick-nn@.service
@@ -0,0 +1,29 @@
+# iank: Background: I originally setup wg-quick-tr@.service for
+# transmission, but it actually does not support any @name other than
+# @client because of a hardcoded ip setup specifically for
+# transmission. Figuring out a way to make that dynamic was harder than
+# just creating a new service for multiple dynamic wg netns services.
+#
+[Unit]
+Description=WireGuard via wg-quick(8) for %I
+After=network-online.target nss-lookup.target wg-quick-nn-pre@%i.service
+Wants=network-online.target nss-lookup.target wg-quick-nn-pre@%i.service
+Documentation=man:wg-quick(8)
+Documentation=man:wg(8)
+
+[Service]
+Type=simple
+ExecReload=/bin/bash -c 'exec /usr/bin/wg syncconf %i <(exec /usr/bin/wg-quick strip %i)'
+ExecStartPre=/a/c/wg-quick-nn-iptables %i
+ExecStartPre=/usr/bin/wg-quick up %i
+ExecStart=/bin/sleep infinity
+ExecStopPost=/usr/bin/wg-quick down %i
+# not important, but complete.
+ExecStopPost=/sbin/iptables-restore /a/bin/ds/transmission-firewall/empty.rules
+NetworkNamespacePath=/var/run/netns/%i
+BindReadOnlyPaths=/etc/tr-resolv:/run/systemd/resolve:norbind /etc/basic-nsswitch:/etc/resolved-nsswitch:norbind
+# copied from wg-quick@.service
+Environment=WG_ENDPOINT_RESOLUTION_RETRIES=infinity
+
+[Install]
+WantedBy=multi-user.target

diff --git a/subdir_files/.config/konsolerc b/subdir_files/.config/konsolerc
index d4271cfed13a3e11fb457f408743d6861f503b95..354f4976b24b51fca83e810b810c9150a417866a 100644 (file)
--- a/subdir_files/.config/konsolerc
+++ b/subdir_files/.config/konsolerc
@@ -24,8 +24,8 @@ ShowMenuBarByDefault=false
 2 screens: XPosition=2
 2 screens: YPosition=2
 3840x2160 screen: Height=2156
-3840x2160 screen: Width=1276
-3840x2160 screen: XPosition=1409
+3840x2160 screen: Width=1916
+3840x2160 screen: XPosition=2
 3840x2160 screen: YPosition=2
 DP-0=DP-0
 DP-1 eDP-1=DP-1

diff --git a/transmission-firewall/netns.rules b/transmission-firewall/netns.rules
index 185d6f98c7f4a1736b1d2456c70d3a0cda0ca459..1c11a132f9ffbb5ab3a959fe3c77fce9b4eabaf5 100644 (file)
--- a/transmission-firewall/netns.rules
+++ b/transmission-firewall/netns.rules
@@ -32,7 +32,7 @@
 -A OUTPUT -o client -j ACCEPT
 -A INPUT -i client -j ACCEPT
 
-# from /etc/wireguard/client.conf
+# from /etc/wireguard/client*.conf
 -A OUTPUT -p udp -m udp --dport 51820 -j ACCEPT
 -A INPUT -p udp -m udp --sport 51820 -j ACCEPT
 

diff --git a/wg-quick-nn-iptables b/wg-quick-nn-iptables
new file mode 100755 (executable)
index 0000000..312f28d
--- /dev/null
+++ b/wg-quick-nn-iptables
@@ -0,0 +1,55 @@
+#!/bin/bash
+# I, Ian Kelling, follow the GNU license recommendations at
+# https://www.gnu.org/licenses/license-recommendations.en.html. They
+# recommend that small programs, < 300 lines, be licensed under the
+# Apache License 2.0. This file contains or is part of one or more small
+# programs. If a small program grows beyond 300 lines, I plan to change
+# to a recommended GPL license.
+
+# Copyright 2025 Ian Kelling
+
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+
+#     http://www.apache.org/licenses/LICENSE-2.0
+
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+. /a/c/fsf-script-lib
+
+config="$1"
+if [[ ! $config ]]; then
+  err "expected 1 arg of wg config name aka / systemd @name (%i within config)"
+  exit 1
+fi
+
+iptables-restore <<EOF
+# format from iptables-save. [0:0] are comments of packet-count/byte-count
+# which I removed
+*filter
+:INPUT DROP
+:FORWARD ACCEPT
+:OUTPUT DROP
+
+-A OUTPUT -o $config -j ACCEPT
+-A INPUT -i $config -j ACCEPT
+
+# from /etc/wireguard/client*.conf
+-A OUTPUT -p udp -m udp --dport 51820 -j ACCEPT
+-A INPUT -p udp -m udp --sport 51820 -j ACCEPT
+
+# makes debugging things easier
+-A INPUT -p icmp -j ACCEPT
+-A OUTPUT -p icmp -j ACCEPT
+
+# allow us to run servers on localhost
+-A INPUT -d 127.0.0.0/8 -j ACCEPT
+-A OUTPUT -s 127.0.0.0/8 -j ACCEPT
+
+COMMIT
+EOF