From 7772331aa5df0b8106f3523a0070269fae735894 Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Sun, 17 Mar 2024 21:09:42 -0700 Subject: xyzca init --- etc/systemd/system/multi-user.target.wants/qbittorrent-nox@xyz.service | 1 - 1 file changed, 1 deletion(-) delete mode 120000 etc/systemd/system/multi-user.target.wants/qbittorrent-nox@xyz.service (limited to 'etc/systemd/system') diff --git a/etc/systemd/system/multi-user.target.wants/qbittorrent-nox@xyz.service b/etc/systemd/system/multi-user.target.wants/qbittorrent-nox@xyz.service deleted file mode 120000 index 41aa9f51..00000000 --- a/etc/systemd/system/multi-user.target.wants/qbittorrent-nox@xyz.service +++ /dev/null @@ -1 +0,0 @@ -/usr/lib/systemd/system/qbittorrent-nox@.service \ No newline at end of file -- cgit v1.2.3-70-g09d2 From a1aa00ec962710241609205869e386a44a3bded5 Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Thu, 4 Apr 2024 08:01:26 +0000 Subject: acme.sh.service override --- etc/systemd/system/acme.sh.service.d/override.conf | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 etc/systemd/system/acme.sh.service.d/override.conf (limited to 'etc/systemd/system') diff --git a/etc/systemd/system/acme.sh.service.d/override.conf b/etc/systemd/system/acme.sh.service.d/override.conf new file mode 100644 index 00000000..722f60a6 --- /dev/null +++ b/etc/systemd/system/acme.sh.service.d/override.conf @@ -0,0 +1,2 @@ +[Service] +ReadWritePaths=/etc/acme.sh /var/log/acme.sh /etc/postfix -- cgit v1.2.3-70-g09d2 From e6e7ab2f7029fc18c10e2a18d2e2fcc0c0440aa2 Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Fri, 5 Apr 2024 07:54:47 +0000 Subject: new --- etc/systemd/system/opendmarc.service.d/override.conf | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 etc/systemd/system/opendmarc.service.d/override.conf (limited to 'etc/systemd/system') diff --git a/etc/systemd/system/opendmarc.service.d/override.conf b/etc/systemd/system/opendmarc.service.d/override.conf new file mode 100644 index 00000000..40ab443c --- /dev/null +++ b/etc/systemd/system/opendmarc.service.d/override.conf @@ -0,0 +1,4 @@ +# https://wiki.archlinux.org/title/OpenDMARC +[Service] +Group= +Group=postfix -- cgit v1.2.3-70-g09d2 From 1e20d2372ee99457c1efc609914015657b71f4ed Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Tue, 9 Apr 2024 01:10:31 -0700 Subject: swith to new ca server; wireguard no need --- etc/nftables.conf | 30 ++-------------------- etc/services | 1 - etc/sysctl.d/99-sysctl.conf | 7 ----- .../multi-user.target.wants/wg-quick@wg0.service | 1 - home/xyz/.config/myconf/pacman_Qqne | 1 - 5 files changed, 2 insertions(+), 38 deletions(-) delete mode 100644 etc/sysctl.d/99-sysctl.conf delete mode 120000 etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service (limited to 'etc/systemd/system') diff --git a/etc/nftables.conf b/etc/nftables.conf index c4ca7f45..22e38dfe 100644 --- a/etc/nftables.conf +++ b/etc/nftables.conf @@ -3,17 +3,11 @@ # IPv4/IPv6 Simple & Safe firewall ruleset. # More examples in /usr/share/nftables/ and /usr/share/doc/nftables/examples/. -# references, some codes from: -# https://wiki.archlinux.org/title/Nftables -# https://www.procustodibus.com/blog/2021/11/wireguard-nftables -# https://wiki.gentoo.org/wiki/Nftables/Examples#Basic_NAT +# some codes from https://wiki.archlinux.org/title/Nftables # needed for reload config using `sudo systemctl restart nftables` or `sudo nft -f /etc/nftables.conf` flush ruleset -define pub_iface = "eth0" -define wg_iface = "wg0" - table inet my_table { chain my_input { @@ -23,7 +17,6 @@ table inet my_table { ct state invalid drop comment "early drop of invalid connections" ct state {established, related} accept comment "allow tracked connections" iifname lo accept comment "allow from loopback" - iifname $wg_iface accept comment "allow from wireguard" ip protocol icmp accept meta l4proto ipv6-icmp accept @@ -32,7 +25,7 @@ table inet my_table { #tcp dport qbt accept #udp dport qbt accept #tcp dport iperf3 accept - udp dport wireguard accept + #udp dport wireguard accept # for acme.sh standalone mode builtin webserver to renew ssl cert tcp dport http accept # email related ports @@ -52,12 +45,6 @@ table inet my_table { type filter hook forward priority filter policy drop # Drop everything forwarded to us. We do not forward. That is routers job. - - # needed for wireguard? - #iifname $wg_iface oifname $pub_iface accept - #iifname $pub_iface oifname $wg_iface accept - iifname $wg_iface accept - oifname $wg_iface accept } chain my_output { @@ -66,16 +53,3 @@ table inet my_table { # Accept every outbound connection } } - -# needed to wireguard NAT masquerade VPN traffic -# Need inet to masquerade both ipv4 and ipv6? If use ip it will only masquerade ipv4? If use ip6 it will only masquerade ipv6? -# https://wiki.nftables.org/wiki-nftables/index.php/Nftables_families -table inet nat { - # newer kernel no need for `chain prerouting { type nat hook prerouting priority -100; policy accept; }`, more see https://www.procustodibus.com/blog/2021/11/wireguard-nftables/ - # for all packets to $pub_iface, after routing, replace source address with primary IP of $pub_iface interface - chain postrouting { - type nat hook postrouting priority 100 - policy accept - oifname $pub_iface masquerade - } -} diff --git a/etc/services b/etc/services index b1b9f5bc..500c6ac7 100644 --- a/etc/services +++ b/etc/services @@ -11507,7 +11507,6 @@ nusrp 49001/tcp nusdp-disc 49001/udp inspider 49150/tcp # my services -wireguard 49432/udp # My ISP verizon block incomming to gateway port 22. So I need to use another port to ssh into my home server. # https://www.reddit.com/r/verizon/comments/to1q43/verizon_5g_home_internet_blocking_ssh_service_port/ ssh-isp 49812/tcp diff --git a/etc/sysctl.d/99-sysctl.conf b/etc/sysctl.d/99-sysctl.conf deleted file mode 100644 index b9677c02..00000000 --- a/etc/sysctl.d/99-sysctl.conf +++ /dev/null @@ -1,7 +0,0 @@ -# at least `net.ipv4.ip_forward = 1` is needed for wireguard masquerade? to work. Without will result into can't ping ips, can't curl websites, browser can't visit websites -# ka seems has this as default, maybe arch linux cloud-init image has this as default? -# https://forums.rockylinux.org/t/wireguard-masquerade-wont-work/7752 -# https://wiki.archlinux.org/title/Nftables#NAT_with_port_forwarding -# https://github.com/teddysun/across/blob/acef6b00a6ad062c0e99286ea136d1a246def644/wireguard.sh#L514-L522 -net.ipv4.ip_forward = 1 -net.ipv6.conf.all.forwarding = 1 diff --git a/etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service b/etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service deleted file mode 120000 index 0a92cb9a..00000000 --- a/etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service +++ /dev/null @@ -1 +0,0 @@ -/usr/lib/systemd/system/wg-quick@.service \ No newline at end of file diff --git a/home/xyz/.config/myconf/pacman_Qqne b/home/xyz/.config/myconf/pacman_Qqne index 912426c0..f60f41bc 100644 --- a/home/xyz/.config/myconf/pacman_Qqne +++ b/home/xyz/.config/myconf/pacman_Qqne @@ -49,7 +49,6 @@ tree unrar-free unzip vidir2-git -wireguard-tools xdg-user-dirs xfsprogs zip -- cgit v1.2.3-70-g09d2 From 3ad044bd524482662af6d3200f32e8afeab6b293 Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Tue, 9 Apr 2024 01:21:12 -0700 Subject: new ca no need save storage, paccache can delete less --- etc/systemd/system/paccache.service.d/10-remove-all.conf | 8 -------- .../system/paccache.service.d/20-remove-all-uninstalled.conf | 9 +++++++++ 2 files changed, 9 insertions(+), 8 deletions(-) delete mode 100644 etc/systemd/system/paccache.service.d/10-remove-all.conf create mode 100644 etc/systemd/system/paccache.service.d/20-remove-all-uninstalled.conf (limited to 'etc/systemd/system') diff --git a/etc/systemd/system/paccache.service.d/10-remove-all.conf b/etc/systemd/system/paccache.service.d/10-remove-all.conf deleted file mode 100644 index a33a36a2..00000000 --- a/etc/systemd/system/paccache.service.d/10-remove-all.conf +++ /dev/null @@ -1,8 +0,0 @@ -[Service] -# may need `sudo systemctl daemon-reload` afterward -# need a line of `ExecStart=` to clear the list first, -# more about drop-in dir see `man systemd.unit`, more about ExecStart see `man systemd.service` -# https://wiki.archlinux.org/title/Systemd#Drop-in_files -# https://wiki.archlinux.org/title/Systemd#Examples -ExecStart= -ExecStart=/usr/bin/paccache -rk0 diff --git a/etc/systemd/system/paccache.service.d/20-remove-all-uninstalled.conf b/etc/systemd/system/paccache.service.d/20-remove-all-uninstalled.conf new file mode 100644 index 00000000..38d3c2d0 --- /dev/null +++ b/etc/systemd/system/paccache.service.d/20-remove-all-uninstalled.conf @@ -0,0 +1,9 @@ +[Service] +# keep original `ExecStart=/usr/bin/paccache -r` while adding to the list +# because I want the default behavior and also remove all uninstalled pacman package cache +# may need `sudo systemctl daemon-reload` afterward +# if I want to clear the list first, I should do a line of `ExecStart=` first +# more about drop-in dir see `man systemd.unit`, more about ExecStart see `man systemd.service` +# https://wiki.archlinux.org/title/Systemd#Drop-in_files +# https://wiki.archlinux.org/title/Systemd#Examples +ExecStart=/usr/bin/paccache -ruk0 -- cgit v1.2.3-70-g09d2 From 9c956cfe1ee447fc0968d88516e7c859a601b25a Mon Sep 17 00:00:00 2001 From: Xiao Pan Date: Fri, 28 Jun 2024 00:57:17 +0000 Subject: feat: wg and swgp config, mainly for aa --- etc/nftables.conf | 25 +++++++++++++++++++++- etc/services | 2 ++ etc/sysctl.d/99-sysctl.conf | 7 ++++++ etc/systemd/network/10-cloud-init-eth0.network | 7 ++++++ .../multi-user.target.wants/wg-quick@wg0.service | 1 + home/xyz/.config/myconf/pacman_Qqme | 3 ++- home/xyz/.config/myconf/pacman_Qqne | 2 +- home/xyz/.config/myconf/sye | 3 ++- 8 files changed, 46 insertions(+), 4 deletions(-) create mode 100644 etc/sysctl.d/99-sysctl.conf create mode 120000 etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service (limited to 'etc/systemd/system') diff --git a/etc/nftables.conf b/etc/nftables.conf index 22e38dfe..b824edee 100644 --- a/etc/nftables.conf +++ b/etc/nftables.conf @@ -8,6 +8,8 @@ # needed for reload config using `sudo systemctl restart nftables` or `sudo nft -f /etc/nftables.conf` flush ruleset +define pub_iface = "eth0" +define wg_iface = "wg0" table inet my_table { chain my_input { @@ -17,6 +19,7 @@ table inet my_table { ct state invalid drop comment "early drop of invalid connections" ct state {established, related} accept comment "allow tracked connections" iifname lo accept comment "allow from loopback" + iifname $wg_iface accept comment "allow from wireguard" ip protocol icmp accept meta l4proto ipv6-icmp accept @@ -25,7 +28,8 @@ table inet my_table { #tcp dport qbt accept #udp dport qbt accept #tcp dport iperf3 accept - #udp dport wireguard accept + udp dport wireguard accept + udp dport swgp accept # for acme.sh standalone mode builtin webserver to renew ssl cert tcp dport http accept # email related ports @@ -45,6 +49,12 @@ table inet my_table { type filter hook forward priority filter policy drop # Drop everything forwarded to us. We do not forward. That is routers job. + + # needed for wireguard? + #iifname $wg_iface oifname $pub_iface accept + #iifname $pub_iface oifname $wg_iface accept + iifname $wg_iface accept + oifname $wg_iface accept } chain my_output { @@ -53,3 +63,16 @@ table inet my_table { # Accept every outbound connection } } + +# needed to wireguard NAT masquerade VPN traffic +# Need inet to masquerade both ipv4 and ipv6? If use ip it will only masquerade ipv4? If use ip6 it will only masquerade ipv6? +# https://wiki.nftables.org/wiki-nftables/index.php/Nftables_families +table inet nat { + # newer kernel no need for `chain prerouting { type nat hook prerouting priority -100; policy accept; }`, more see https://www.procustodibus.com/blog/2021/11/wireguard-nftables/ + # for all packets to $pub_iface, after routing, replace source address with primary IP of $pub_iface interface + chain postrouting { + type nat hook postrouting priority 100 + policy accept + oifname $pub_iface masquerade + } +} diff --git a/etc/services b/etc/services index aa270681..91a89df2 100644 --- a/etc/services +++ b/etc/services @@ -11510,5 +11510,7 @@ inspider 49150/tcp # my services # My ISP verizon block incomming to gateway port 22. So I need to use another port to ssh into my home server. # https://www.reddit.com/r/verizon/comments/to1q43/verizon_5g_home_internet_blocking_ssh_service_port/ +wireguard 49432/udp ssh-isp 49812/tcp iperf3 53497/tcp +swgp 54635/udp diff --git a/etc/sysctl.d/99-sysctl.conf b/etc/sysctl.d/99-sysctl.conf new file mode 100644 index 00000000..b9677c02 --- /dev/null +++ b/etc/sysctl.d/99-sysctl.conf @@ -0,0 +1,7 @@ +# at least `net.ipv4.ip_forward = 1` is needed for wireguard masquerade? to work. Without will result into can't ping ips, can't curl websites, browser can't visit websites +# ka seems has this as default, maybe arch linux cloud-init image has this as default? +# https://forums.rockylinux.org/t/wireguard-masquerade-wont-work/7752 +# https://wiki.archlinux.org/title/Nftables#NAT_with_port_forwarding +# https://github.com/teddysun/across/blob/acef6b00a6ad062c0e99286ea136d1a246def644/wireguard.sh#L514-L522 +net.ipv4.ip_forward = 1 +net.ipv6.conf.all.forwarding = 1 diff --git a/etc/systemd/network/10-cloud-init-eth0.network b/etc/systemd/network/10-cloud-init-eth0.network index 1bc579b9..7829f528 100644 --- a/etc/systemd/network/10-cloud-init-eth0.network +++ b/etc/systemd/network/10-cloud-init-eth0.network @@ -14,7 +14,14 @@ Address=38.175.201.185/22 Address=2606:a8c0:3::75f/128 [Address] +# another ipv6 address for aa wireguard+swgp into +# not sure if it is corret, but it works +Address=2606:a8c0:3:773::b/64 + +[Address] +# the last address seems is the default? # ...:1/64 also works, but I use ...:a/64 because crunchbits panel reverse DNS support this address +# 2024-06-27, ...:1/64 seems doe not work any more, not sure why Address=2606:a8c0:3:773::a/64 # use the following will not need GatewayOnLink=yes in [Route] section, but I'm not sure if it is correct, I'm not sure if those ips could be accessed without gateway, more see https://superuser.com/q/1562380 #Address=2606:a8c0:3:773::a/48 diff --git a/etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service b/etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service new file mode 120000 index 00000000..0a92cb9a --- /dev/null +++ b/etc/systemd/system/multi-user.target.wants/wg-quick@wg0.service @@ -0,0 +1 @@ +/usr/lib/systemd/system/wg-quick@.service \ No newline at end of file diff --git a/home/xyz/.config/myconf/pacman_Qqme b/home/xyz/.config/myconf/pacman_Qqme index 1ae6f3b5..1ae88691 100644 --- a/home/xyz/.config/myconf/pacman_Qqme +++ b/home/xyz/.config/myconf/pacman_Qqme @@ -5,8 +5,9 @@ bash-complete-alias dashbinsh grub-hook htop-vim -librespeed-cli +librespeed-cli-bin neovim-plug paru-bin pipdeptree +swgp-go task-spooler diff --git a/home/xyz/.config/myconf/pacman_Qqne b/home/xyz/.config/myconf/pacman_Qqne index 21020ae5..c1e1c8bd 100644 --- a/home/xyz/.config/myconf/pacman_Qqne +++ b/home/xyz/.config/myconf/pacman_Qqne @@ -54,7 +54,7 @@ unrar-free unzip vidir2-git wget +wireguard-tools xdg-user-dirs -xfsprogs zip zoxide diff --git a/home/xyz/.config/myconf/sye b/home/xyz/.config/myconf/sye index 8d845498..a47a970f 100644 --- a/home/xyz/.config/myconf/sye +++ b/home/xyz/.config/myconf/sye @@ -6,6 +6,7 @@ opendkim.service enabled disabled opendmarc.service enabled disabled postfix.service enabled disabled sshd.service enabled disabled +swgp-go.service enabled disabled systemd-network-generator.service enabled enabled systemd-networkd-wait-online.service enabled enabled systemd-networkd.service enabled enabled @@ -19,4 +20,4 @@ acme.sh.timer enabled disabled paccache.timer enabled disabled pacman-filesdb-refresh.timer enabled disabled -19 unit files listed. +20 unit files listed. -- cgit v1.2.3-70-g09d2