From 7772331aa5df0b8106f3523a0070269fae735894 Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Sun, 17 Mar 2024 21:09:42 -0700 Subject: xyzca init --- etc/services | 5 ----- 1 file changed, 5 deletions(-) (limited to 'etc/services') diff --git a/etc/services b/etc/services index 03819fb0..b1b9f5bc 100644 --- a/etc/services +++ b/etc/services @@ -11512,8 +11512,3 @@ wireguard 49432/udp # https://www.reddit.com/r/verizon/comments/to1q43/verizon_5g_home_internet_blocking_ssh_service_port/ ssh-isp 49812/tcp iperf3 53497/tcp -# qbittorrent-nox web ui port for remote access browser gui -qbt-nox 57151/tcp -# qbittorrent/ options/ connection/ listening port -qbt 57737/tcp -qbt 57737/udp -- cgit v1.2.3-70-g09d2 From 1e20d2372ee99457c1efc609914015657b71f4ed Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Tue, 9 Apr 2024 01:10:31 -0700 Subject: swith to new ca server; wireguard no need --- etc/nftables.conf | 30 ++-------------------- etc/services | 1 - etc/sysctl.d/99-sysctl.conf | 7 ----- .../multi-user.target.wants/wg-quick@wg0.service | 1 - home/xyz/.config/myconf/pacman_Qqne | 1 - 5 files changed, 2 insertions(+), 38 deletions(-) delete mode 100644 etc/sysctl.d/99-sysctl.conf delete mode 120000 etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service (limited to 'etc/services') diff --git a/etc/nftables.conf b/etc/nftables.conf index c4ca7f45..22e38dfe 100644 --- a/etc/nftables.conf +++ b/etc/nftables.conf @@ -3,17 +3,11 @@ # IPv4/IPv6 Simple & Safe firewall ruleset. # More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/. -# references, some codes from: -# https://wiki.archlinux.org/title/Nftables -# https://www.procustodibus.com/blog/2021/11/wireguard-nftables -# https://wiki.gentoo.org/wiki/Nftables/Examples#Basic_NAT +# some codes from https://wiki.archlinux.org/title/Nftables # needed for reload config using `sudo systemctl restart nftables` or `sudo nft -f /etc/nftables.conf` flush ruleset -define pub_iface = "eth0" -define wg_iface = "wg0" - table inet my_table { chain my_input { @@ -23,7 +17,6 @@ table inet my_table { ct state invalid drop comment "early drop of invalid connections" ct state {established, related} accept comment "allow tracked connections" iifname lo accept comment "allow from loopback" - iifname $wg_iface accept comment "allow from wireguard" ip protocol icmp accept meta l4proto ipv6-icmp accept @@ -32,7 +25,7 @@ table inet my_table { #tcp dport qbt accept #udp dport qbt accept #tcp dport iperf3 accept - udp dport wireguard accept + #udp dport wireguard accept # for acme.sh standalone mode builtin webserver to renew ssl cert tcp dport http accept # email related ports @@ -52,12 +45,6 @@ table inet my_table { type filter hook forward priority filter policy drop # Drop everything forwarded to us. We do not forward. That is routers job. - - # needed for wireguard? - #iifname $wg_iface oifname $pub_iface accept - #iifname $pub_iface oifname $wg_iface accept - iifname $wg_iface accept - oifname $wg_iface accept } chain my_output { @@ -66,16 +53,3 @@ table inet my_table { # Accept every outbound connection } } - -# needed to wireguard NAT masquerade VPN traffic -# Need inet to masquerade both ipv4 and ipv6? If use ip it will only masquerade ipv4? If use ip6 it will only masquerade ipv6? -# https://wiki.nftables.org/wiki-nftables/index.php/Nftables_families -table inet nat { - # newer kernel no need for `chain prerouting { type nat hook prerouting priority -100; policy accept; }`, more see https://www.procustodibus.com/blog/2021/11/wireguard-nftables/ - # for all packets to $pub_iface, after routing, replace source address with primary IP of $pub_iface interface - chain postrouting { - type nat hook postrouting priority 100 - policy accept - oifname $pub_iface masquerade - } -} diff --git a/etc/services b/etc/services index b1b9f5bc..500c6ac7 100644 --- a/etc/services +++ b/etc/services @@ -11507,7 +11507,6 @@ nusrp 49001/tcp nusdp-disc 49001/udp inspider 49150/tcp # my services -wireguard 49432/udp # My ISP verizon block incomming to gateway port 22. So I need to use another port to ssh into my home server. # https://www.reddit.com/r/verizon/comments/to1q43/verizon_5g_home_internet_blocking_ssh_service_port/ ssh-isp 49812/tcp diff --git a/etc/sysctl.d/99-sysctl.conf b/etc/sysctl.d/99-sysctl.conf deleted file mode 100644 index b9677c02..00000000 --- a/etc/sysctl.d/99-sysctl.conf +++ /dev/null @@ -1,7 +0,0 @@ -# at least `net.ipv4.ip_forward = 1` is needed for wireguard masquerade? to work. Without will result into can't ping ips, can't curl websites, browser can't visit websites -# ka seems has this as default, maybe arch linux cloud-init image has this as default? -# https://forums.rockylinux.org/t/wireguard-masquerade-wont-work/7752 -# https://wiki.archlinux.org/title/Nftables#NAT_with_port_forwarding -# https://github.com/teddysun/across/blob/acef6b00a6ad062c0e99286ea136d1a246def644/wireguard.sh#L514-L522 -net.ipv4.ip_forward = 1 -net.ipv6.conf.all.forwarding = 1 diff --git a/etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service b/etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service deleted file mode 120000 index 0a92cb9a..00000000 --- a/etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service +++ /dev/null @@ -1 +0,0 @@ -/usr/lib/systemd/system/wg-quick@.service \ No newline at end of file diff --git a/home/xyz/.config/myconf/pacman_Qqne b/home/xyz/.config/myconf/pacman_Qqne index 912426c0..f60f41bc 100644 --- a/home/xyz/.config/myconf/pacman_Qqne +++ b/home/xyz/.config/myconf/pacman_Qqne @@ -49,7 +49,6 @@ tree unrar-free unzip vidir2-git -wireguard-tools xdg-user-dirs xfsprogs zip -- cgit v1.2.3-70-g09d2 From ec77aa3bdc0046ef59899011e9f13b4dc4556aea Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Thu, 18 Apr 2024 03:06:15 -0700 Subject: pacdiff --- etc/services | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'etc/services') diff --git a/etc/services b/etc/services index 500c6ac7..aa270681 100644 --- a/etc/services +++ b/etc/services @@ -5620,8 +5620,8 @@ jpegmpeg 3155/tcp jpegmpeg 3155/udp indura 3156/tcp indura 3156/udp -e3consultants 3157/tcp -e3consultants 3157/udp +lsa-comm 3157/tcp +lsa-comm 3157/udp stvp 3158/tcp stvp 3158/udp navegaweb-port 3159/tcp @@ -11153,6 +11153,7 @@ icl-twobase9 25008/tcp icl-twobase9 25008/udp icl-twobase10 25009/tcp icl-twobase10 25009/udp +db2c-tls 25100/tcp rna 25471/sctp sauterdongle 25576/tcp idtp 25604/tcp -- cgit v1.2.3-70-g09d2 From 9c956cfe1ee447fc0968d88516e7c859a601b25a Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Fri, 28 Jun 2024 00:57:17 +0000 Subject: feat: wg and swgp config, mainly for aa --- etc/nftables.conf | 25 +++++++++++++++++++++- etc/services | 2 ++ etc/sysctl.d/99-sysctl.conf | 7 ++++++ etc/systemd/network/10-cloud-init-eth0.network | 7 ++++++ .../multi-user.target.wants/wg-quick@wg0.service | 1 + home/xyz/.config/myconf/pacman_Qqme | 3 ++- home/xyz/.config/myconf/pacman_Qqne | 2 +- home/xyz/.config/myconf/sye | 3 ++- 8 files changed, 46 insertions(+), 4 deletions(-) create mode 100644 etc/sysctl.d/99-sysctl.conf create mode 120000 etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service (limited to 'etc/services') diff --git a/etc/nftables.conf b/etc/nftables.conf index 22e38dfe..b824edee 100644 --- a/etc/nftables.conf +++ b/etc/nftables.conf @@ -8,6 +8,8 @@ # needed for reload config using `sudo systemctl restart nftables` or `sudo nft -f /etc/nftables.conf` flush ruleset +define pub_iface = "eth0" +define wg_iface = "wg0" table inet my_table { chain my_input { @@ -17,6 +19,7 @@ table inet my_table { ct state invalid drop comment "early drop of invalid connections" ct state {established, related} accept comment "allow tracked connections" iifname lo accept comment "allow from loopback" + iifname $wg_iface accept comment "allow from wireguard" ip protocol icmp accept meta l4proto ipv6-icmp accept @@ -25,7 +28,8 @@ table inet my_table { #tcp dport qbt accept #udp dport qbt accept #tcp dport iperf3 accept - #udp dport wireguard accept + udp dport wireguard accept + udp dport swgp accept # for acme.sh standalone mode builtin webserver to renew ssl cert tcp dport http accept # email related ports @@ -45,6 +49,12 @@ table inet my_table { type filter hook forward priority filter policy drop # Drop everything forwarded to us. We do not forward. That is routers job. + + # needed for wireguard? + #iifname $wg_iface oifname $pub_iface accept + #iifname $pub_iface oifname $wg_iface accept + iifname $wg_iface accept + oifname $wg_iface accept } chain my_output { @@ -53,3 +63,16 @@ table inet my_table { # Accept every outbound connection } } + +# needed to wireguard NAT masquerade VPN traffic +# Need inet to masquerade both ipv4 and ipv6? If use ip it will only masquerade ipv4? If use ip6 it will only masquerade ipv6? +# https://wiki.nftables.org/wiki-nftables/index.php/Nftables_families +table inet nat { + # newer kernel no need for `chain prerouting { type nat hook prerouting priority -100; policy accept; }`, more see https://www.procustodibus.com/blog/2021/11/wireguard-nftables/ + # for all packets to $pub_iface, after routing, replace source address with primary IP of $pub_iface interface + chain postrouting { + type nat hook postrouting priority 100 + policy accept + oifname $pub_iface masquerade + } +} diff --git a/etc/services b/etc/services index aa270681..91a89df2 100644 --- a/etc/services +++ b/etc/services @@ -11510,5 +11510,7 @@ inspider 49150/tcp # my services # My ISP verizon block incomming to gateway port 22. So I need to use another port to ssh into my home server. # https://www.reddit.com/r/verizon/comments/to1q43/verizon_5g_home_internet_blocking_ssh_service_port/ +wireguard 49432/udp ssh-isp 49812/tcp iperf3 53497/tcp +swgp 54635/udp diff --git a/etc/sysctl.d/99-sysctl.conf b/etc/sysctl.d/99-sysctl.conf new file mode 100644 index 00000000..b9677c02 --- /dev/null +++ b/etc/sysctl.d/99-sysctl.conf @@ -0,0 +1,7 @@ +# at least `net.ipv4.ip_forward = 1` is needed for wireguard masquerade? to work. Without will result into can't ping ips, can't curl websites, browser can't visit websites +# ka seems has this as default, maybe arch linux cloud-init image has this as default? +# https://forums.rockylinux.org/t/wireguard-masquerade-wont-work/7752 +# https://wiki.archlinux.org/title/Nftables#NAT_with_port_forwarding +# https://github.com/teddysun/across/blob/acef6b00a6ad062c0e99286ea136d1a246def644/wireguard.sh#L514-L522 +net.ipv4.ip_forward = 1 +net.ipv6.conf.all.forwarding = 1 diff --git a/etc/systemd/network/10-cloud-init-eth0.network b/etc/systemd/network/10-cloud-init-eth0.network index 1bc579b9..7829f528 100644 --- a/etc/systemd/network/10-cloud-init-eth0.network +++ b/etc/systemd/network/10-cloud-init-eth0.network @@ -14,7 +14,14 @@ Address=38.175.201.185/22 Address=2606:a8c0:3::75f/128 [Address] +# another ipv6 address for aa wireguard+swgp into +# not sure if it is corret, but it works +Address=2606:a8c0:3:773::b/64 + +[Address] +# the last address seems is the default? # ...:1/64 also works, but I use ...:a/64 because crunchbits panel reverse DNS support this address +# 2024-06-27, ...:1/64 seems doe not work any more, not sure why Address=2606:a8c0:3:773::a/64 # use the following will not need GatewayOnLink=yes in [Route] section, but I'm not sure if it is correct, I'm not sure if those ips could be accessed without gateway, more see https://superuser.com/q/1562380 #Address=2606:a8c0:3:773::a/48 diff --git a/etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service b/etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service new file mode 120000 index 00000000..0a92cb9a --- /dev/null +++ b/etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service @@ -0,0 +1 @@ +/usr/lib/systemd/system/wg-quick@.service \ No newline at end of file diff --git a/home/xyz/.config/myconf/pacman_Qqme b/home/xyz/.config/myconf/pacman_Qqme index 1ae6f3b5..1ae88691 100644 --- a/home/xyz/.config/myconf/pacman_Qqme +++ b/home/xyz/.config/myconf/pacman_Qqme @@ -5,8 +5,9 @@ bash-complete-alias dashbinsh grub-hook htop-vim -librespeed-cli +librespeed-cli-bin neovim-plug paru-bin pipdeptree +swgp-go task-spooler diff --git a/home/xyz/.config/myconf/pacman_Qqne b/home/xyz/.config/myconf/pacman_Qqne index 21020ae5..c1e1c8bd 100644 --- a/home/xyz/.config/myconf/pacman_Qqne +++ b/home/xyz/.config/myconf/pacman_Qqne @@ -54,7 +54,7 @@ unrar-free unzip vidir2-git wget +wireguard-tools xdg-user-dirs -xfsprogs zip zoxide diff --git a/home/xyz/.config/myconf/sye b/home/xyz/.config/myconf/sye index 8d845498..a47a970f 100644 --- a/home/xyz/.config/myconf/sye +++ b/home/xyz/.config/myconf/sye @@ -6,6 +6,7 @@ opendkim.service enabled disabled opendmarc.service enabled disabled postfix.service enabled disabled sshd.service enabled disabled +swgp-go.service enabled disabled systemd-network-generator.service enabled enabled systemd-networkd-wait-online.service enabled enabled systemd-networkd.service enabled enabled @@ -19,4 +20,4 @@ acme.sh.timer enabled disabled paccache.timer enabled disabled pacman-filesdb-refresh.timer enabled disabled -19 unit files listed. +20 unit files listed. -- cgit v1.2.3-70-g09d2 From 177538387b6a32cab1f89844d2b84ccc52d0363d Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Tue, 27 Aug 2024 15:14:24 -0700 Subject: pacdiff --- etc/services | 2 ++ 1 file changed, 2 insertions(+) (limited to 'etc/services') diff --git a/etc/services b/etc/services index 91a89df2..15f3ad1b 100644 --- a/etc/services +++ b/etc/services @@ -9121,6 +9121,7 @@ abb-escp 6316/tcp abb-escp 6316/udp nav-data-cmd 6317/tcp nav-data 6317/udp +iona-data 6318/tcp repsvc 6320/tcp repsvc 6320/udp emp-server1 6321/tcp @@ -9642,6 +9643,7 @@ aries-kfinder 7570/tcp aries-kfinder 7570/udp coherence 7574/tcp coherence-disc 7574/udp +wtmi-panel 7575/tcp sun-lm 7588/tcp sun-lm 7588/udp mipi-debug 7606/tcp -- cgit v1.2.3-70-g09d2 From 30da5bb70ee3dc496898aa2b04c28089debcaff6 Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Mon, 28 Oct 2024 14:50:18 -0700 Subject: pacdiff --- etc/services | 1 + 1 file changed, 1 insertion(+) (limited to 'etc/services') diff --git a/etc/services b/etc/services index 15f3ad1b..384c630d 100644 --- a/etc/services +++ b/etc/services @@ -11193,6 +11193,7 @@ exoconfig 26487/udp exonet 26489/tcp exonet 26489/udp flex-lmadmin 27010/tcp +chlenix 27016/tcp mongodb 27017/tcp imagepump 27345/tcp imagepump 27345/udp -- cgit v1.2.3-70-g09d2 From 46c65d1bdb88d39e72d6e7280176687b6ad9488d Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Thu, 12 Dec 2024 19:09:18 -0800 Subject: pacdiff --- etc/services | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'etc/services') diff --git a/etc/services b/etc/services index 384c630d..45722821 100644 --- a/etc/services +++ b/etc/services @@ -4904,6 +4904,8 @@ f5-globalsite 2792/tcp f5-globalsite 2792/udp initlsmsad 2793/tcp initlsmsad 2793/udp +urp 2794/tcp +urp 2794/udp livestats 2795/tcp livestats 2795/udp ac-tech 2796/tcp @@ -8946,6 +8948,9 @@ fis 5912/sctp aoc-acars 5913/tcp aoc-acars 5913/udp ads-c 5913/sctp +ipsdtls 5914/tcp +ipsdtls 5914/udp +ipsdtls 5914/sctp indy 5963/tcp indy 5963/udp mppolicy-v5 5968/tcp -- cgit v1.2.3-70-g09d2