From: Ian Kelling Date: Sun, 24 May 2026 22:32:37 +0000 (-0400) Subject: vpn improvements X-Git-Url: https://iankelling.org/git/?a=commitdiff_plain;h=689a32a3aee473bb3a3674fc917f9fcd9000f7b6;p=distro-setup vpn improvements --- diff --git a/brc b/brc index a767bc9..5045e39 100644 --- a/brc +++ b/brc @@ -5005,6 +5005,13 @@ loc() { done | sort -n } +wg-log-on() { + e module wireguard +p | s tee /sys/kernel/debug/dynamic_debug/control + } +wg-log-off() { + e module wireguard -p | s tee /sys/kernel/debug/dynamic_debug/control +} + # * stuff that makes sense to be at the end # note, if we unset IFS, that will mess up completion scripts which diff --git a/brc2 b/brc2 index 94aeb78..e67c8cd 100644 --- a/brc2 +++ b/brc2 @@ -3868,21 +3868,29 @@ mailnncheck() { vpncmd() { - sdncmd wg-quick-tr@client.service "$@" + local n="$1" ser_suf=tr + if [[ $n ]]; then ser_suf=nn; shift; fi + sdncmd wg-quick-$ser_suf@client$n.service "$@" } vpncmdroot() { - sdncmdroot wg-quick-tr@client.service "$@" + local n="$1" ser_suf=tr + if [[ $n ]]; then ser_suf=nn; shift; fi + sdncmdroot wg-quick-$ser_suf@client$n.service "$@" } # usage: vpni [suffix] # suffix selects non-default vpn. # shellcheck disable=SC2120 # expected vpni() { + local n="$1" ser_suf=tr + if [[ $n ]]; then ser_suf=nn; fi # m sudo nsenter --net=/var/run/netns/client sudo -u iank -i bash # for just the netns - sdncmd wg-quick-tr@client$1.service bash + sdncmd wg-quick-$ser_suf@client$n.service bash } vpnbash() { + local n="$1" ser_suf=tr + if [[ $n ]]; then ser_suf=nn; fi #m sudm nsenter --net=/var/run/netns/client bash # only gets netns - sdncmdroot wg-quick-tr@client.service bash + sdncmdroot wg-quick-$ser_suf@client$n.service bash } @@ -4026,11 +4034,15 @@ ovpnoff() { sudo systemctl stop $vpn_service@$1 } vpnoffc() { # vpn off client - ser stop wg-quick-tr@client + local n="$1" ser_suf=tr + if [[ $n ]]; then ser_suf=nn; fi + ser stop wg-quick-$ser_suf@client$n } vpnc() { local unit - unit=wg-quick-tr@client + local n="$1" ser_suf=tr + if [[ $n ]]; then ser_suf=nn; fi + unit=wg-quick-$ser_suf@client$n sudo -v if [[ $(systemctl is-active $unit) != active ]]; then s systemctl start $unit diff --git a/filesystem/etc/systemd/system/wg-quick-nn-pre@.service b/filesystem/etc/systemd/system/wg-quick-nn-pre@.service new file mode 100644 index 0000000..583ea64 --- /dev/null +++ b/filesystem/etc/systemd/system/wg-quick-nn-pre@.service @@ -0,0 +1,11 @@ +[Unit] +Description=Initial setup of netns for wg-quick-nn %I + +[Service] +Type=oneshot +ExecStart=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns start %i +ExecStop=/usr/bin/flock -w 20 /tmp/newns.flock /usr/local/bin/newns stop %i +RemainAfterExit=yes + +[Install] +WantedBy=multi-user.target diff --git a/filesystem/etc/systemd/system/wg-quick-nn@.service b/filesystem/etc/systemd/system/wg-quick-nn@.service new file mode 100644 index 0000000..5b9a7b0 --- /dev/null +++ b/filesystem/etc/systemd/system/wg-quick-nn@.service @@ -0,0 +1,29 @@ +# iank: Background: I originally setup wg-quick-tr@.service for +# transmission, but it actually does not support any @name other than +# @client because of a hardcoded ip setup specifically for +# transmission. Figuring out a way to make that dynamic was harder than +# just creating a new service for multiple dynamic wg netns services. +# +[Unit] +Description=WireGuard via wg-quick(8) for %I +After=network-online.target nss-lookup.target wg-quick-nn-pre@%i.service +Wants=network-online.target nss-lookup.target wg-quick-nn-pre@%i.service +Documentation=man:wg-quick(8) +Documentation=man:wg(8) + +[Service] +Type=simple +ExecReload=/bin/bash -c 'exec /usr/bin/wg syncconf %i <(exec /usr/bin/wg-quick strip %i)' +ExecStartPre=/a/c/wg-quick-nn-iptables %i +ExecStartPre=/usr/bin/wg-quick up %i +ExecStart=/bin/sleep infinity +ExecStopPost=/usr/bin/wg-quick down %i +# not important, but complete. +ExecStopPost=/sbin/iptables-restore /a/bin/ds/transmission-firewall/empty.rules +NetworkNamespacePath=/var/run/netns/%i +BindReadOnlyPaths=/etc/tr-resolv:/run/systemd/resolve:norbind /etc/basic-nsswitch:/etc/resolved-nsswitch:norbind +# copied from wg-quick@.service +Environment=WG_ENDPOINT_RESOLUTION_RETRIES=infinity + +[Install] +WantedBy=multi-user.target diff --git a/subdir_files/.config/konsolerc b/subdir_files/.config/konsolerc index d4271cf..354f497 100644 --- a/subdir_files/.config/konsolerc +++ b/subdir_files/.config/konsolerc @@ -24,8 +24,8 @@ ShowMenuBarByDefault=false 2 screens: XPosition=2 2 screens: YPosition=2 3840x2160 screen: Height=2156 -3840x2160 screen: Width=1276 -3840x2160 screen: XPosition=1409 +3840x2160 screen: Width=1916 +3840x2160 screen: XPosition=2 3840x2160 screen: YPosition=2 DP-0=DP-0 DP-1 eDP-1=DP-1 diff --git a/transmission-firewall/netns.rules b/transmission-firewall/netns.rules index 185d6f9..1c11a13 100644 --- a/transmission-firewall/netns.rules +++ b/transmission-firewall/netns.rules @@ -32,7 +32,7 @@ -A OUTPUT -o client -j ACCEPT -A INPUT -i client -j ACCEPT -# from /etc/wireguard/client.conf +# from /etc/wireguard/client*.conf -A OUTPUT -p udp -m udp --dport 51820 -j ACCEPT -A INPUT -p udp -m udp --sport 51820 -j ACCEPT diff --git a/wg-quick-nn-iptables b/wg-quick-nn-iptables new file mode 100755 index 0000000..312f28d --- /dev/null +++ b/wg-quick-nn-iptables @@ -0,0 +1,55 @@ +#!/bin/bash +# I, Ian Kelling, follow the GNU license recommendations at +# https://www.gnu.org/licenses/license-recommendations.en.html. They +# recommend that small programs, < 300 lines, be licensed under the +# Apache License 2.0. This file contains or is part of one or more small +# programs. If a small program grows beyond 300 lines, I plan to change +# to a recommended GPL license. + +# Copyright 2025 Ian Kelling + +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at + +# http://www.apache.org/licenses/LICENSE-2.0 + +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +. /a/c/fsf-script-lib + +config="$1" +if [[ ! $config ]]; then + err "expected 1 arg of wg config name aka / systemd @name (%i within config)" + exit 1 +fi + +iptables-restore <