Solved wireguard bugs

This commit is contained in:
Kevin Veen-Birkenbach 2023-04-18 13:56:43 +02:00
parent efe2efd739
commit 028e94d282
9 changed files with 56 additions and 39 deletions

View File

@ -4,7 +4,6 @@
roles:
- system-pacman
- collection-administrator-base
- application-caffeine
- driver-non-free
- name: application-wireguard

View File

@ -1,3 +1,2 @@
dependencies:
- system-aur-helper
- system-gnome
- system-aur-helper

View File

@ -10,35 +10,6 @@ Manages wireguard on a client.
echo "PresharedKey: $(wg genpsk)"
```
## Debug
### RTNETLINK answers: Permission denied
When ```systemctl restart wg-quick@wg0.service``` returns __RTNETLINK answers: Permission denied__, modify _/etc/sysctl.conf_:
```bash
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0
net.ipv6.conf.lo.disable_ipv6 = 0
```
Afterwards reload:
```bash
sysctl -p
systemctl restart wg-quick@wg0.service
```
### SSH
When the SSH connection over wireguard is buggy try:
```bash
ip li set mtu 1400 dev eth0
ip li set mtu 1400 dev wlo1
```
This can be connected to the [MTU](https://www.imperva.com/learn/application-security/what-is-mtu-mss/)
## Other
- https://golb.hplar.ch/2019/01/expose-server-vpn.html
- https://wiki.archlinux.org/index.php/WireGuard
@ -50,4 +21,8 @@ This can be connected to the [MTU](https://www.imperva.com/learn/application-sec
- https://forum.openwrt.org/t/cannot-ssh-to-clients-on-lan-when-accessing-router-via-wireguard-client/132709/3
- https://serverfault.com/questions/1086297/wireguard-connection-dies-on-ubuntu-peer
- https://unix.stackexchange.com/questions/624987/ssh-fails-to-start-when-listenaddress-is-set-to-wireguard-vpn-ip
- https://serverfault.com/questions/210408/cannot-ssh-debug1-expecting-ssh2-msg-kex-dh-gex-reply
- https://serverfault.com/questions/210408/cannot-ssh-debug1-expecting-ssh2-msg-kex-dh-gex-reply
- https://www.thomas-krenn.com/de/wiki/Linux_ip_Kommando
- https://wiki.archlinux.org/title/dhcpcd
- https://wiki.ubuntuusers.de/NetworkManager/Dispatcher/
- https://askubuntu.com/questions/1024916/how-can-i-launch-a-systemd-service-at-startup-before-another-systemd-service-sta

View File

@ -0,0 +1,10 @@
[Unit]
Description=set MTU
Before=wg-quick@wg0.service
[Service]
Type=oneshot
ExecStart=set-mtu.sh
[Install]
RequiredBy=wg-quick@wg0.service

View File

@ -0,0 +1,8 @@
# This file is created by
# https://github.com/kevinveenbirkenbach/client-playbook/tree/main/roles/application-wireguard
net.ipv6.conf.all.disable_ipv6 = 0
net.ipv6.conf.default.disable_ipv6 = 0
net.ipv6.conf.lo.disable_ipv6 = 0
net.ipv6.conf.all.forwarding = 1
net.ipv4.ip_forward = 1

View File

@ -1,6 +1,13 @@
- name: "restart set-mtu.service"
systemd:
name: set-mtu.service
state: restarted
enabled: yes
daemon_reload: yes
- name: "restart wireguard"
systemd:
name: wg-quick@wg0.service
state: restarted
enabled: yes
daemon_reload: yes
daemon_reload: yes

View File

@ -3,11 +3,25 @@
name: wireguard-tools
state: present
- name: enable ipv4-forwarding
shell: sysctl net.ipv4.ip_forward=1
- name: create set-mtu.service
copy:
src: set-mtu.service
dest: /etc/systemd/system/set-mtu.service
notify: restart set-mtu.service
- name: enable ipv6-forwarding
shell: sysctl net.ipv6.conf.all.forwarding=1
- name: create set-mtu.sh
template:
src: set-mtu.sh.j2
dest: /usr/local/bin/set-mtu.sh
notify: restart set-mtu.service
- name: create wireguard-ip.conf
copy:
src: "wireguard-ip.conf"
dest: /etc/sysctl.d/wireguard-ip.conf
owner: root
group: root
notify: reload sysctl configuration
- name: create /etc/wireguard/wg0.conf
copy:

View File

@ -0,0 +1,4 @@
#!/bin/bash
ip li set mtu 1400 dev eth0
ip li set mtu 1400 dev wlo1
sysctl -p

View File

@ -1,2 +1,3 @@
dependencies:
- application-git
- application-git
- application-caffeine