mirror of
https://github.com/kevinveenbirkenbach/client-playbook.git
synced 2024-11-28 09:51:04 +01:00
Compare commits
4 Commits
efe2efd739
...
e40c2b698b
Author | SHA1 | Date | |
---|---|---|---|
e40c2b698b | |||
13f29ce5f7 | |||
1de60742f4 | |||
028e94d282 |
@ -1,3 +1,6 @@
|
||||
|
||||
:no_entry: [DEPRECATED] Developing continues here: https://github.com/kevinveenbirkenbach/computer-playbook
|
||||
|
||||
# Client Playbook
|
||||
[![License: AGPL v3](https://img.shields.io/badge/License-AGPL%20v3-blue.svg)](https://www.gnu.org/licenses/agpl-3.0)
|
||||
|
||||
|
@ -4,7 +4,6 @@
|
||||
roles:
|
||||
- system-pacman
|
||||
- collection-administrator-base
|
||||
- application-caffeine
|
||||
- driver-non-free
|
||||
|
||||
- name: application-wireguard
|
||||
|
@ -1,3 +1,2 @@
|
||||
dependencies:
|
||||
- system-aur-helper
|
||||
- system-gnome
|
@ -10,35 +10,6 @@ Manages wireguard on a client.
|
||||
echo "PresharedKey: $(wg genpsk)"
|
||||
```
|
||||
|
||||
## Debug
|
||||
|
||||
### RTNETLINK answers: Permission denied
|
||||
When ```systemctl restart wg-quick@wg0.service``` returns __RTNETLINK answers: Permission denied__, modify _/etc/sysctl.conf_:
|
||||
|
||||
```bash
|
||||
net.ipv6.conf.all.disable_ipv6 = 0
|
||||
net.ipv6.conf.default.disable_ipv6 = 0
|
||||
net.ipv6.conf.lo.disable_ipv6 = 0
|
||||
```
|
||||
|
||||
Afterwards reload:
|
||||
```bash
|
||||
sysctl -p
|
||||
systemctl restart wg-quick@wg0.service
|
||||
```
|
||||
|
||||
|
||||
### SSH
|
||||
|
||||
When the SSH connection over wireguard is buggy try:
|
||||
|
||||
```bash
|
||||
ip li set mtu 1400 dev eth0
|
||||
ip li set mtu 1400 dev wlo1
|
||||
```
|
||||
|
||||
This can be connected to the [MTU](https://www.imperva.com/learn/application-security/what-is-mtu-mss/)
|
||||
|
||||
## Other
|
||||
- https://golb.hplar.ch/2019/01/expose-server-vpn.html
|
||||
- https://wiki.archlinux.org/index.php/WireGuard
|
||||
@ -51,3 +22,7 @@ This can be connected to the [MTU](https://www.imperva.com/learn/application-sec
|
||||
- https://serverfault.com/questions/1086297/wireguard-connection-dies-on-ubuntu-peer
|
||||
- https://unix.stackexchange.com/questions/624987/ssh-fails-to-start-when-listenaddress-is-set-to-wireguard-vpn-ip
|
||||
- https://serverfault.com/questions/210408/cannot-ssh-debug1-expecting-ssh2-msg-kex-dh-gex-reply
|
||||
- https://www.thomas-krenn.com/de/wiki/Linux_ip_Kommando
|
||||
- https://wiki.archlinux.org/title/dhcpcd
|
||||
- https://wiki.ubuntuusers.de/NetworkManager/Dispatcher/
|
||||
- https://askubuntu.com/questions/1024916/how-can-i-launch-a-systemd-service-at-startup-before-another-systemd-service-sta
|
10
roles/application-wireguard/files/set-mtu.service
Normal file
10
roles/application-wireguard/files/set-mtu.service
Normal file
@ -0,0 +1,10 @@
|
||||
[Unit]
|
||||
Description=set MTU
|
||||
Before=wg-quick@wg0.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
ExecStart=set-mtu.sh
|
||||
|
||||
[Install]
|
||||
RequiredBy=wg-quick@wg0.service
|
8
roles/application-wireguard/files/wireguard-ip.conf
Normal file
8
roles/application-wireguard/files/wireguard-ip.conf
Normal file
@ -0,0 +1,8 @@
|
||||
# This file is created by
|
||||
# https://github.com/kevinveenbirkenbach/client-playbook/tree/main/roles/application-wireguard
|
||||
|
||||
net.ipv6.conf.all.disable_ipv6 = 0
|
||||
net.ipv6.conf.default.disable_ipv6 = 0
|
||||
net.ipv6.conf.lo.disable_ipv6 = 0
|
||||
net.ipv6.conf.all.forwarding = 1
|
||||
net.ipv4.ip_forward = 1
|
@ -1,6 +1,16 @@
|
||||
- name: "restart set-mtu.service"
|
||||
systemd:
|
||||
name: set-mtu.service
|
||||
state: restarted
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
|
||||
- name: "restart wireguard"
|
||||
systemd:
|
||||
name: wg-quick@wg0.service
|
||||
state: restarted
|
||||
enabled: yes
|
||||
daemon_reload: yes
|
||||
|
||||
- name: "reload sysctl configuration"
|
||||
shell: "sysctl -p"
|
@ -3,11 +3,25 @@
|
||||
name: wireguard-tools
|
||||
state: present
|
||||
|
||||
- name: enable ipv4-forwarding
|
||||
shell: sysctl net.ipv4.ip_forward=1
|
||||
- name: create set-mtu.service
|
||||
copy:
|
||||
src: set-mtu.service
|
||||
dest: /etc/systemd/system/set-mtu.service
|
||||
notify: restart set-mtu.service
|
||||
|
||||
- name: enable ipv6-forwarding
|
||||
shell: sysctl net.ipv6.conf.all.forwarding=1
|
||||
- name: create set-mtu.sh
|
||||
template:
|
||||
src: set-mtu.sh.j2
|
||||
dest: /usr/local/bin/set-mtu.sh
|
||||
notify: restart set-mtu.service
|
||||
|
||||
- name: create wireguard-ip.conf
|
||||
copy:
|
||||
src: "wireguard-ip.conf"
|
||||
dest: /etc/sysctl.d/wireguard-ip.conf
|
||||
owner: root
|
||||
group: root
|
||||
notify: reload sysctl configuration
|
||||
|
||||
- name: create /etc/wireguard/wg0.conf
|
||||
copy:
|
||||
|
4
roles/application-wireguard/templates/set-mtu.sh.j2
Normal file
4
roles/application-wireguard/templates/set-mtu.sh.j2
Normal file
@ -0,0 +1,4 @@
|
||||
#!/bin/bash
|
||||
{% for internet_interface in internet_interfaces %}
|
||||
ip li set mtu 1400 dev {{internet_interface}}
|
||||
{% endfor %}
|
@ -1,2 +1,3 @@
|
||||
dependencies:
|
||||
- application-git
|
||||
- application-caffeine
|
Loading…
Reference in New Issue
Block a user