mirror of
https://github.com/kevinveenbirkenbach/client-playbook.git
synced 2024-11-14 11:51:04 +01:00
Solved wireguard bugs
This commit is contained in:
parent
efe2efd739
commit
028e94d282
@ -4,7 +4,6 @@
|
|||||||
roles:
|
roles:
|
||||||
- system-pacman
|
- system-pacman
|
||||||
- collection-administrator-base
|
- collection-administrator-base
|
||||||
- application-caffeine
|
|
||||||
- driver-non-free
|
- driver-non-free
|
||||||
|
|
||||||
- name: application-wireguard
|
- name: application-wireguard
|
||||||
|
@ -1,3 +1,2 @@
|
|||||||
dependencies:
|
dependencies:
|
||||||
- system-aur-helper
|
- system-aur-helper
|
||||||
- system-gnome
|
|
@ -10,35 +10,6 @@ Manages wireguard on a client.
|
|||||||
echo "PresharedKey: $(wg genpsk)"
|
echo "PresharedKey: $(wg genpsk)"
|
||||||
```
|
```
|
||||||
|
|
||||||
## Debug
|
|
||||||
|
|
||||||
### RTNETLINK answers: Permission denied
|
|
||||||
When ```systemctl restart wg-quick@wg0.service``` returns __RTNETLINK answers: Permission denied__, modify _/etc/sysctl.conf_:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
net.ipv6.conf.all.disable_ipv6 = 0
|
|
||||||
net.ipv6.conf.default.disable_ipv6 = 0
|
|
||||||
net.ipv6.conf.lo.disable_ipv6 = 0
|
|
||||||
```
|
|
||||||
|
|
||||||
Afterwards reload:
|
|
||||||
```bash
|
|
||||||
sysctl -p
|
|
||||||
systemctl restart wg-quick@wg0.service
|
|
||||||
```
|
|
||||||
|
|
||||||
|
|
||||||
### SSH
|
|
||||||
|
|
||||||
When the SSH connection over wireguard is buggy try:
|
|
||||||
|
|
||||||
```bash
|
|
||||||
ip li set mtu 1400 dev eth0
|
|
||||||
ip li set mtu 1400 dev wlo1
|
|
||||||
```
|
|
||||||
|
|
||||||
This can be connected to the [MTU](https://www.imperva.com/learn/application-security/what-is-mtu-mss/)
|
|
||||||
|
|
||||||
## Other
|
## Other
|
||||||
- https://golb.hplar.ch/2019/01/expose-server-vpn.html
|
- https://golb.hplar.ch/2019/01/expose-server-vpn.html
|
||||||
- https://wiki.archlinux.org/index.php/WireGuard
|
- https://wiki.archlinux.org/index.php/WireGuard
|
||||||
@ -51,3 +22,7 @@ This can be connected to the [MTU](https://www.imperva.com/learn/application-sec
|
|||||||
- https://serverfault.com/questions/1086297/wireguard-connection-dies-on-ubuntu-peer
|
- https://serverfault.com/questions/1086297/wireguard-connection-dies-on-ubuntu-peer
|
||||||
- https://unix.stackexchange.com/questions/624987/ssh-fails-to-start-when-listenaddress-is-set-to-wireguard-vpn-ip
|
- https://unix.stackexchange.com/questions/624987/ssh-fails-to-start-when-listenaddress-is-set-to-wireguard-vpn-ip
|
||||||
- https://serverfault.com/questions/210408/cannot-ssh-debug1-expecting-ssh2-msg-kex-dh-gex-reply
|
- https://serverfault.com/questions/210408/cannot-ssh-debug1-expecting-ssh2-msg-kex-dh-gex-reply
|
||||||
|
- https://www.thomas-krenn.com/de/wiki/Linux_ip_Kommando
|
||||||
|
- https://wiki.archlinux.org/title/dhcpcd
|
||||||
|
- https://wiki.ubuntuusers.de/NetworkManager/Dispatcher/
|
||||||
|
- https://askubuntu.com/questions/1024916/how-can-i-launch-a-systemd-service-at-startup-before-another-systemd-service-sta
|
10
roles/application-wireguard/files/set-mtu.service
Normal file
10
roles/application-wireguard/files/set-mtu.service
Normal file
@ -0,0 +1,10 @@
|
|||||||
|
[Unit]
|
||||||
|
Description=set MTU
|
||||||
|
Before=wg-quick@wg0.service
|
||||||
|
|
||||||
|
[Service]
|
||||||
|
Type=oneshot
|
||||||
|
ExecStart=set-mtu.sh
|
||||||
|
|
||||||
|
[Install]
|
||||||
|
RequiredBy=wg-quick@wg0.service
|
8
roles/application-wireguard/files/wireguard-ip.conf
Normal file
8
roles/application-wireguard/files/wireguard-ip.conf
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
# This file is created by
|
||||||
|
# https://github.com/kevinveenbirkenbach/client-playbook/tree/main/roles/application-wireguard
|
||||||
|
|
||||||
|
net.ipv6.conf.all.disable_ipv6 = 0
|
||||||
|
net.ipv6.conf.default.disable_ipv6 = 0
|
||||||
|
net.ipv6.conf.lo.disable_ipv6 = 0
|
||||||
|
net.ipv6.conf.all.forwarding = 1
|
||||||
|
net.ipv4.ip_forward = 1
|
@ -1,3 +1,10 @@
|
|||||||
|
- name: "restart set-mtu.service"
|
||||||
|
systemd:
|
||||||
|
name: set-mtu.service
|
||||||
|
state: restarted
|
||||||
|
enabled: yes
|
||||||
|
daemon_reload: yes
|
||||||
|
|
||||||
- name: "restart wireguard"
|
- name: "restart wireguard"
|
||||||
systemd:
|
systemd:
|
||||||
name: wg-quick@wg0.service
|
name: wg-quick@wg0.service
|
||||||
|
@ -3,11 +3,25 @@
|
|||||||
name: wireguard-tools
|
name: wireguard-tools
|
||||||
state: present
|
state: present
|
||||||
|
|
||||||
- name: enable ipv4-forwarding
|
- name: create set-mtu.service
|
||||||
shell: sysctl net.ipv4.ip_forward=1
|
copy:
|
||||||
|
src: set-mtu.service
|
||||||
|
dest: /etc/systemd/system/set-mtu.service
|
||||||
|
notify: restart set-mtu.service
|
||||||
|
|
||||||
- name: enable ipv6-forwarding
|
- name: create set-mtu.sh
|
||||||
shell: sysctl net.ipv6.conf.all.forwarding=1
|
template:
|
||||||
|
src: set-mtu.sh.j2
|
||||||
|
dest: /usr/local/bin/set-mtu.sh
|
||||||
|
notify: restart set-mtu.service
|
||||||
|
|
||||||
|
- name: create wireguard-ip.conf
|
||||||
|
copy:
|
||||||
|
src: "wireguard-ip.conf"
|
||||||
|
dest: /etc/sysctl.d/wireguard-ip.conf
|
||||||
|
owner: root
|
||||||
|
group: root
|
||||||
|
notify: reload sysctl configuration
|
||||||
|
|
||||||
- name: create /etc/wireguard/wg0.conf
|
- name: create /etc/wireguard/wg0.conf
|
||||||
copy:
|
copy:
|
||||||
|
4
roles/application-wireguard/templates/set-mtu.sh.j2
Normal file
4
roles/application-wireguard/templates/set-mtu.sh.j2
Normal file
@ -0,0 +1,4 @@
|
|||||||
|
#!/bin/bash
|
||||||
|
ip li set mtu 1400 dev eth0
|
||||||
|
ip li set mtu 1400 dev wlo1
|
||||||
|
sysctl -p
|
@ -1,2 +1,3 @@
|
|||||||
dependencies:
|
dependencies:
|
||||||
- application-git
|
- application-git
|
||||||
|
- application-caffeine
|
Loading…
Reference in New Issue
Block a user