Comments (11)
anartikov
commented on May 22, 2024
3
@hwdsl2
I did it. After adding the command everything works well after a reboot. Thanks
from wireguard-install.
archidote
commented on May 22, 2024
1
So according to my investigations:
What you told me about /etc/rc.local works fine. BUT (IN MY CASE),
I had already installed a VPN from one of your scripts
(https://github.com/hwdsl2/setup-ipsec-vpn)
after re-reading my rc.local file, I noticed that some instructions were already present in this file (from your script :)
In my case, the problem was obviously the "exit 0".
I commented it, and since then everything is working again. rc.local is running fine.
Here is my /etc/rc.local configuration:
#!/bin/sh
# Added by hwdsl2 VPN script (L2TP/ipsec/ikev2)
(sleep 15
service ipsec restart
service xl2tpd restart
echo 1 > /proc/sys/net/ipv4/ip_forward)&
#exit 0
# manually edit hwdsl2 wireguard vpn script
systemctl restart wg-iptables.service
# echo "hello" >> /tmp/test.txt
and the rights of the file :
-rwxr-xr-x 1 root root 259 Nov 17 16:47 rc.local
For all, here is a reconfiguration from scratch that I just did and that worked well even after reboots :
root@debian:~# wget -O wireguard.sh https://get.vpnsetup.net/wg
Saving to: ‘wireguard.sh’
2022-11-17 16:53:03 (14.0 MB/s) - ‘wireguard.sh’ saved [31498/31498]
root@debian:~# sudo bash wireguard.sh --auto
WireGuard Script
https://github.com/hwdsl2/wireguard-install
Starting WireGuard setup using default options.
Server IP: x.x.x.x
Port: UDP/51820
Client name: client
Client DNS: Google Public DNS
Installing WireGuard, please wait...
+ apt-get -yqq update
+ apt-get -yqq install wireguard qrencode
+ systemctl enable --now wg-iptables.service
+ systemctl enable --now [email protected]
████ ▄▄▄▄▄ █▀▄▀█▀▀▄ ▀▀▄█ ▄▀█ ▀▀▀▄▄ ▄▄▀▄▀█▄█▄▄█▄▀▀ ▄▀█▄█▀▄██▄▀█ ▄▄▄▄▄ ████
↑ That is a QR code containing the client configuration.
Finished!
The client configuration is available in: /root/client.conf
New clients can be added by running this script again.
root@debian:~# nano /etc/rc.local
root@debian:~# nano /etc/rc.local
root@debian:~# echo "systemctl restart wg-iptables.service" >> /etc/rc.local
root@debian:~# cat /etc/rc.local | tail -1
systemctl restart wg-iptables.service
root@debian:~# sudo iptables -nvL; sudo iptables -nvL -t nat
Chain INPUT (policy ACCEPT 805 packets, 220K bytes)
pkts bytes target prot opt in out source destination
2 352 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:51820
[...]
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT all -- * * 10.7.0.0/24 0.0.0.0/0
[...]
Chain POSTROUTING (policy ACCEPT 146 packets, 10708 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * ens5 192.168.42.0/24 0.0.0.0/0
0 0 MASQUERADE all -- * ens5 192.168.43.0/24 0.0.0.0/0 policy match dir out pol none
0 0 SNAT all -- * * 10.7.0.0/24 !10.7.0.0/24 to:192.168.1.19
root@debian:~# reboot # test if after a reboot, the rule is correctly charged
Connection to 192.168.1.19 closed by remote host.
Connection to 192.168.1.19 closed.
┌──(kali㉿kali)-[~]
└─$ ssh [email protected] -p 2019
root@debian:~# sudo iptables -nvL; sudo iptables -nvL -t nat
Chain INPUT (policy ACCEPT 3849 packets, 1177K bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:51820
[...]
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT all -- * * 10.7.0.0/24 0.0.0.0/0
[...]
Chain POSTROUTING (policy ACCEPT 188 packets, 13001 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * ens5 192.168.42.0/24 0.0.0.0/0
0 0 MASQUERADE all -- * ens5 192.168.43.0/24 0.0.0.0/0 policy match dir out pol none
5 306 SNAT all -- * * 10.7.0.0/24 !10.7.0.0/24 to:192.168.1.19
root@debian:~#
++
from wireguard-install.
hwdsl2
commented on May 22, 2024
1
@archidote Thanks for the update. A fix has been applied in f50b376 for this issue.
from wireguard-install.
hwdsl2
commented on May 22, 2024
@anartikov Hello! This could be an IPTables issue. Can you post the IPTables rules from your server?
sudo iptables -nvL; sudo iptables -nvL -t nat
Also post the contents of /etc/sysconfig/iptables if the file exists.
from wireguard-install.
anartikov
commented on May 22, 2024
[root@nartserv2 ~]# sudo iptables -nvL; sudo iptables -nvL -t nat
Chain INPUT (policy ACCEPT 641 packets, 37212 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1701 policy match dir in pol none
10 431 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
36956 33M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
11 3792 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 500,4500
2 214 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1701 policy match dir in pol ipsec
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1701
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
7 835 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
230 257K ACCEPT all -- eth0 ppp+ 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
114 24033 ACCEPT all -- ppp+ eth0 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- ppp+ ppp+ 192.168.42.0/24 192.168.42.0 /24
0 0 ACCEPT all -- eth0 * 0.0.0.0/0 192.168.43.0 /24 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- * eth0 192.168.43.0/24 0.0.0.0/0
392 85125 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 37598 packets, 33M bytes)
pkts bytes target prot opt in out source destination
Chain PREROUTING (policy ACCEPT 1064 packets, 130K bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 648 packets, 39668 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 700 packets, 45940 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 701 packets, 47220 bytes)
pkts bytes target prot opt in out source destination
21 3634 MASQUERADE all -- * eth0 192.168.42.0/24 0.0.0.0/0
0 0 MASQUERADE all -- * eth0 192.168.43.0/24 0.0.0.0/0 policy match dir out pol none
from wireguard-install.
anartikov
commented on May 22, 2024
/etc/sysconfig/iptables
# Modified by hwdsl2 VPN script
# Generated by iptables-save v1.4.21 on Thu Oct 18 18:52:13 2018
*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
-A POSTROUTING -s 192.168.42.0/24 -o eth0 -j MASQUERADE
-A POSTROUTING -s 192.168.43.0/24 -o eth0 -m policy --dir out --pol none -j MASQUERADE
COMMIT
# Completed on Thu Oct 18 18:52:13 2018
# Generated by iptables-save v1.4.21 on Thu Oct 18 18:52:13 2018
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol none -j DROP
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 500,4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j DROP
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -i eth0 -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ppp+ -o eth0 -j ACCEPT
-A FORWARD -s 192.168.42.0/24 -d 192.168.42.0/24 -i ppp+ -o ppp+ -j ACCEPT
-A FORWARD -d 192.168.43.0/24 -i eth0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.43.0/24 -o eth0 -j ACCEPT
-A FORWARD -j DROP
COMMIT
# Completed on Thu Oct 18 18:52:13 2018
from wireguard-install.
hwdsl2
commented on May 22, 2024
@anartikov Your IPTables rules does not contain any rules for WireGuard, only IPsec. Try:
systemctl enable --now wg-iptables.service
systemctl enable --now [email protected]
If this doesn't work, remove and re-install WireGuard from this repo.
from wireguard-install.
archidote
commented on May 22, 2024
Hello,
I had the same issue as @anartikov.
I have done your workarround, but it still does not work... even after a new fresh install.
This is what the IPTables rules look like from my server when the problem occurs (after a reboot)
sudo iptables -nvL; sudo iptables -nvL -t nat
Chain INPUT (policy ACCEPT 9099 packets, 718K bytes)
pkts bytes target prot opt in out source destination
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1701 policy match dir in pol none
3 120 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
75871 9509K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
3 2746 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 500,4500
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1701 policy match dir in pol ipsec
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1701
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
0 0 ACCEPT all -- ens5 ppp+ 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- ppp+ ens5 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- ppp+ ppp+ 0.0.0.0/0 0.0.0.0/0
84 29578 ACCEPT all -- ens5 * 0.0.0.0/0 192.168.43.0/24 ctstate RELATED,ESTABLISHED
74 21286 ACCEPT all -- * ens5 192.168.43.0/24 0.0.0.0/0
0 0 ACCEPT all -- * ppp+ 192.168.43.0/24 0.0.0.0/0
148 9361 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 66559 packets, 32M bytes)
pkts bytes target prot opt in out source destination
Chain PREROUTING (policy ACCEPT 8571 packets, 565K bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 8408 packets, 548K bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 145 packets, 10564 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 145 packets, 10564 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * ens5 192.168.42.0/24 0.0.0.0/0
10 7041 MASQUERADE all -- * ens5 192.168.43.0/24 0.0.0.0/0 policy match dir out pol none
After a fresh install, this is what it looks like:
sudo iptables -nvL; sudo iptables -nvL -t nat
Chain INPUT (policy ACCEPT 18619 packets, 1530K bytes)
pkts bytes target prot opt in out source destination
1 176 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:51820
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1701 policy match dir in pol none
3 120 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
154K 19M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
3 2746 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 multiport dports 500,4500
0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1701 policy match dir in pol ipsec
0 0 DROP udp -- * * 0.0.0.0/0 0.0.0.0/0 udp dpt:1701
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT all -- * * 10.7.0.0/24 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
0 0 ACCEPT all -- ens5 ppp+ 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
0 0 ACCEPT all -- ppp+ ens5 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- ppp+ ppp+ 0.0.0.0/0 0.0.0.0/0
222 83218 ACCEPT all -- ens5 * 0.0.0.0/0 192.168.43.0/24 ctstate RELATED,ESTABLISHED
184 51985 ACCEPT all -- * ens5 192.168.43.0/24 0.0.0.0/0
0 0 ACCEPT all -- * ppp+ 192.168.43.0/24 0.0.0.0/0
248 15585 DROP all -- * * 0.0.0.0/0 0.0.0.0/0
Chain OUTPUT (policy ACCEPT 135K packets, 65M bytes)
pkts bytes target prot opt in out source destination
Chain PREROUTING (policy ACCEPT 17392 packets, 1152K bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 17106 packets, 1115K bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 171 packets, 12363 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 171 packets, 12363 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * ens5 192.168.42.0/24 0.0.0.0/0
29 19960 MASQUERADE all -- * ens5 192.168.43.0/24 0.0.0.0/0 policy match dir out pol none
0 0 SNAT all -- * * 10.7.0.0/24 !10.7.0.0/24 to:192.168.1.19
After a quick visual analysis, I notice that the last line has disappeared:
0 0 SNAT all -- * * 10.7.0.0/24 !10.7.0.0/24 to:192.168.1.19
I think that the problem comes from the, as if this rule was "temporary", and as soon as we restart, this one is not effective anymore...
Do you have an idea ?
best regards,
from wireguard-install.
hwdsl2
commented on May 22, 2024
@archidote Hello! Please try:
systemctl restart wg-iptables.service
Then check the IPTables rules again. The missing rules should be back after that. Let us know if this works for you. If so, add the command above to your /etc/rc.local.
from wireguard-install.
archidote
commented on May 22, 2024
@archidote Hello! Please try:
systemctl restart wg-iptables.serviceThen check the IPTables rules again. The missing rules should be back after that. Let us know if this works for you. If so, add the command above to your
/etc/rc.local.
Hello @hwdsl2 ,
First of all thank your for your answer.
I have done what you said previously and it works !
But in my point of view, the behaviour of iptables is very strange because,
If i do
systemctl restart wg-iptables.service
it works
but, if I do as following (because I'm a little bit curious ^^)
systemctl start wg-iptables.service
It does not work anymore ^^ iptables is still a mystery to me...
I run a Debian 11 fully updated server...
Maybe you can modify the wireguard-install.sh to auto add
systemctl restart wg-iptables.service
in /etc/rc.local ?
I think that It will help a lot of people in the futur. I saw on many forum/topics that some peoples had the same issue than us.
[Edit]
After inserting the line in /etc/rc.local and then restarting the server, I hav’nt seen any change.
I had to enter the command manually for the changes to take effect.
I look foward to hearing from you,
Best regards
from wireguard-install.
hwdsl2
commented on May 22, 2024
@archidote Thank you for the update. The reason that systemctl start wg-iptables.service doesn't work is because the service is already started, and it only adds the necessary IPTables rules when starting. On the other hand, systemctl restart works.
Make sure that your /etc/rc.local is executable by running:
chmod +x /etc/rc.local
Then reboot the server and check again. It should work. I plan to add a fix for this in the script.
from wireguard-install.
Related Issues (20)
- Abort install HOT 1
- CentOS 9 client configuration issue HOT 5
- ubuntu 22.04 manual install HOT 3
- 如何更改ip段呢？ HOT 1
- 请问怎么修改IP地址段呢，因为我有两台服务器对接一个设备，都是使用你的脚本就冲突了 HOT 1
- wireguard not working HOT 5
- fully disable the logs HOT 1
- Arch Linux support HOT 1
- How can i disable IPV6? HOT 1
- please add uninstall script HOT 1
- command: wg show, shows a different public key than imported to the client HOT 2
- 服务器重启了，wireguard没有开机自启动呢 HOT 1
- 作者你好，我想咨询一下分流的问题还有就是wireguard数据传输安全吗 HOT 1
- UFW Integration HOT 1
- 使用clash连接wireguard作为出口的速度 HOT 3
- wireguard will fail after reinstallation after uninstallation in Debian12 HOT 4
- Regenerate QR code HOT 4
- 连上了但是Ping不通 HOT 1
- 没有面板程序么？ HOT 1
- The internet is not accessible HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from wireguard-install.