diff --git a/src/config.js b/src/config.js index 17690f03..f6206e4d 100644 --- a/src/config.js +++ b/src/config.js @@ -14,9 +14,11 @@ module.exports.WG_DEVICE = process.env.WG_DEVICE || 'ens3'; module.exports.WG_HOST = process.env.WG_HOST || 'oracle-daily.duckdns.org'; module.exports.WG_PORT = process.env.WG_PORT || '51820'; module.exports.WG_CONFIG_PORT = process.env.WG_CONFIG_PORT || process.env.WG_PORT || '51820'; -module.exports.WG_MTU = process.env.WG_MTU || '1412'; +module.exports.WG_MTU = process.env.WG_MTU || '8920'; +// module.exports.WG_MTU = process.env.WG_MTU || '1296'; +// module.exports.WG_MTU = process.env.WG_MTU || '8064'; module.exports.WG_PERSISTENT_KEEPALIVE = process.env.WG_PERSISTENT_KEEPALIVE || '25'; -module.exports.WG_DEFAULT_ADDRESS = process.env.WG_DEFAULT_ADDRESS || '10.8.0.x'; +module.exports.WG_DEFAULT_ADDRESS = process.env.WG_DEFAULT_ADDRESS || '10.250.1.x'; module.exports.WG_DEFAULT_ADDRESS6 = process.env.WG_DEFAULT_ADDRESS6 || 'fd01:1:1::x'; module.exports.WG_DEFAULT_DNS = typeof process.env.WG_DEFAULT_DNS === 'string' ? process.env.WG_DEFAULT_DNS diff --git a/src/wgsh/wg0-post-up.sh b/src/wgsh/wg0-post-up.sh index ac68eff4..b1fd112f 100644 --- a/src/wgsh/wg0-post-up.sh +++ b/src/wgsh/wg0-post-up.sh @@ -10,17 +10,6 @@ SUB_NET="10.250.1.0/24" # WG IPv4 sub/net aka CIDR # SUB_NET_6="fdcc:abcd:abcd:abcd::cafe:0/64" # Change this according SUB_NET_6="fd01:1:1::0/64" WG_PORT="51820" # WG udp port -# WG_TABLE='10' - -#iptables -t nat -I POSTROUTING 1 -s 10.250.1.0/24 -o ens3 -j MASQUERADE; -#iptables -I INPUT 1 -p udp -m udp --dport 51820 -j ACCEPT; -#iptables -I FORWARD 1 -i wg0 -j ACCEPT; -#iptables -I FORWARD 1 -o wg0 -j ACCEPT; - -#ip6tables -t nat -I POSTROUTING 1 -o ens3 -j MASQUERADE; -#ip6tables -I INPUT 1 -p udp -m udp --dport 51820 -j ACCEPT; -#ip6tables -I FORWARD 1 -i wg0 -j ACCEPT; -#ip6tables -I FORWARD 1 -o wg0 -j ACCEPT; ## IPv4 ## working with single tunnel $IPT -I INPUT 1 -p udp --dport $WG_PORT -j ACCEPT # for incoming connection @@ -28,6 +17,8 @@ $IPT -I INPUT 1 -p tcp --dport 51821 -j ACCEPT # for webui $IPT -t nat -I POSTROUTING 1 -s $SUB_NET -o $IN_FACE -j MASQUERADE $IPT -I FORWARD 1 -i $WG_FACE -j ACCEPT #for internet $IPT -I FORWARD 1 -o $WG_FACE -j ACCEPT #for internet +# MSS clamping IPv4 +$IPT -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $WG_FACE -j TCPMSS --clamp-mss-to-pmtu # IPv6 (Uncomment) ## $IPT6 -I INPUT 1 -p udp --dport $WG_PORT -j ACCEPT # for incoming connection @@ -35,15 +26,10 @@ $IPT6 -I INPUT 1 -p tcp --dport 51821 -j ACCEPT # for webui $IPT6 -t nat -I POSTROUTING 1 -s $SUB_NET_6 -o $IN_FACE -j MASQUERADE $IPT6 -I FORWARD 1 -i $WG_FACE -j ACCEPT #for internet $IPT6 -I FORWARD 1 -o $WG_FACE -j ACCEPT #for internet -# $IPT6 -t nat -I POSTROUTING 1 -s $SUB_NET_6 -o $IN_FACE -j MASQUERADE -# $IPT6 -I INPUT 1 -i $WG_FACE -j ACCEPT -# $IPT6 -I FORWARD 1 -i $IN_FACE -o $WG_FACE -j ACCEPT -# $IPT6 -I FORWARD 1 -i $WG_FACE -o $IN_FACE -j ACCEPT - -# wg-quick up wg1 -# systemctl start mount-mypi.service - -# wg set wg0 fwmark 51820 +# MSS clamping IPv6 +$IPT6 -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $WG_FACE -j TCPMSS --clamp-mss-to-pmtu +wg-quick up wg1 +systemctl start mount-mypi.service set -e \ No newline at end of file diff --git a/src/wgsh/wg0-pre-down.sh b/src/wgsh/wg0-pre-down.sh index 8880015a..8df99200 100644 --- a/src/wgsh/wg0-pre-down.sh +++ b/src/wgsh/wg0-pre-down.sh @@ -17,6 +17,8 @@ $IPT -D INPUT -p tcp --dport 51821 -j ACCEPT # for webui $IPT -t nat -D POSTROUTING -s $SUB_NET -o $IN_FACE -j MASQUERADE $IPT -D FORWARD -i $WG_FACE -j ACCEPT #for internet $IPT -D FORWARD -o $WG_FACE -j ACCEPT #for internet +# MSS clamping IPv4 +$IPT -t mangle -D POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $WG_FACE -j TCPMSS --clamp-mss-to-pmtu # IPv4 rules # $IPT6 -D INPUT -p udp --dport $WG_PORT -j ACCEPT # for incoming connection @@ -24,6 +26,8 @@ $IPT6 -D INPUT -p tcp --dport 51821 -j ACCEPT # for webui $IPT6 -t nat -D POSTROUTING -s $SUB_NET_6 -o $IN_FACE -j MASQUERADE $IPT6 -D FORWARD -i $WG_FACE -j ACCEPT #for internet $IPT6 -D FORWARD -o $WG_FACE -j ACCEPT #for internet +# MSS clamping IPv6 +$IPT6 -t mangle -D POSTROUTING -p tcp --tcp-flags SYN,RST SYN -o $WG_FACE -j TCPMSS --clamp-mss-to-pmtu # $IPT -t nat -D POSTROUTING -s $SUB_NET -o $IN_FACE -j MASQUERADE # $IPT -D FORWARD -i $IN_FACE -o $WG_FACE -j ACCEPT diff --git a/src/wgsh/wg1-post-up.sh b/src/wgsh/wg1-post-up.sh index a26c40c2..4fea6ba3 100644 --- a/src/wgsh/wg1-post-up.sh +++ b/src/wgsh/wg1-post-up.sh @@ -9,4 +9,10 @@ ip route add 10.250.0.0/24 dev docker_daily table 51820 ip route add 10.250.1.0/24 dev wg0 table 51820 +ip -6 rule add from fd01:0:2::0/64 table 51820 + +ip -6 route add fd01:0:1::0/64 dev docker_daily table 51820 + +ip -6 route add fd01:1:1::0/64 dev wg0 table 51820 + set -e \ No newline at end of file diff --git a/src/wgsh/wg1-pre-down.sh b/src/wgsh/wg1-pre-down.sh index 7eb17773..30d0329d 100644 --- a/src/wgsh/wg1-pre-down.sh +++ b/src/wgsh/wg1-pre-down.sh @@ -7,5 +7,10 @@ ip route del 10.250.0.0/24 dev docker_daily table 51820 ip route del 10.250.1.0/24 dev wg0 table 51820 +ip -6 rule del from fd01:0:2::0/64 table 51820 + +ip -6 route del fd01:0:1::0/64 dev docker_daily table 51820 + +ip -6 route del fd01:1:1::0/64 dev wg0 table 51820 set -e \ No newline at end of file