UDM-SE-EU & Split-VPN (WireGuard)

**꧁𓊈𒆜 ƁєηLυє 𒆜𓊉꧂** · 16. Dezember 2022

Hallo zusammen,

ihr kennt mit Sicherheit aus der Vergangenheit das Script split-vpn von peacey auf GitHub? Ich habe folgendes Problem:

Tunnel lässt sich ohne Probleme öffnen, jedoch haperts bei mir mit dem DNS. Der DNS Server darf ja laut Anweisung nicht mehr in die wg0.conf geschrieben werden und muss dafür in die vpn.conf. Egal welchen DNS Server (1.1.1.1 oder adaptiert aus meinen Windoofs Client: 10.13.13.1) der Browser/Console möchte ums verrecken nicht den Host auflösen. Ping auf pub IP funktioniert!.

Wireguard Clienten starten:

Code: wg-quick up ./wg0.conf

benlue@Dream-Machine-Special-Edition:/etc/split-vpn/wireguard/ivpn$ sudo wg-quick up ./wg0.conf
Warning: `/data/split-vpn/wireguard/ivpn/wg0.conf' is world accessible
wg-quick: `wg0' is not a WireGuard interface
Warning: `/data/split-vpn/wireguard/ivpn/wg0.conf' is world accessible
[#] ip link add wg0 type wireguard
[#] wg setconf wg0 /dev/fd/63
[#] ip -4 address add 10.13.13.4/32 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] ip -6 route add ::/1 dev wg0
[#] ip -6 route add 8000::/1 dev wg0
[#] ip -4 route add 128.0.0.0/1 dev wg0
[#] ip -4 route add 0.0.0.0/1 dev wg0
[#] sh /etc/split-vpn/vpn/updown.sh wg0 up
[Fri Dec 16 11:29:26 CET 2022] split-vpn: wg0 up: Loading configuration from /data/split-vpn/wireguard/ivpn/vpn.conf.

Alles anzeigen

Ping (UDM-SE-EU) auf 8.8.8.8:

Code: ping 8.8.8.8

benlue@Dream-Machine-Special-Edition:/etc/split-vpn/wireguard/ivpn$ ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8) 56(84) bytes of data.
64 bytes from 8.8.8.8: icmp_seq=1 ttl=113 time=86.3 ms
64 bytes from 8.8.8.8: icmp_seq=2 ttl=113 time=81.1 ms
64 bytes from 8.8.8.8: icmp_seq=3 ttl=113 time=85.4 ms
64 bytes from 8.8.8.8: icmp_seq=4 ttl=113 time=74.5 ms
64 bytes from 8.8.8.8: icmp_seq=5 ttl=113 time=90.8 ms
64 bytes from 8.8.8.8: icmp_seq=6 ttl=113 time=80.2 ms
64 bytes from 8.8.8.8: icmp_seq=7 ttl=113 time=73.7 ms
64 bytes from 8.8.8.8: icmp_seq=8 ttl=113 time=81.7 ms
64 bytes from 8.8.8.8: icmp_seq=9 ttl=113 time=81.1 ms
^C
--- 8.8.8.8 ping statistics ---
9 packets transmitted, 9 received, 0% packet loss, time 8010ms
rtt min/avg/max/mdev = 73.743/81.664/90.845/5.121 ms

Alles anzeigen

Code: curl ifconfig.me

benlue@Dream-Machine-Special-Edition:/etc/split-vpn/wireguard/ivpn$ curl ifconfig.me
curl: (6) Could not resolve host: ifconfig.me

Ping (DESKTOP-SOM2LB5) auf 8.8.8.8

Code: ping 8.8.8.8

C:\Users\benja>ping 8.8.8.8

Ping wird ausgeführt für 8.8.8.8 mit 32 Bytes Daten:
Zeitüberschreitung der Anforderung.
Zeitüberschreitung der Anforderung.
Zeitüberschreitung der Anforderung.

Ping-Statistik für 8.8.8.8:
    Pakete: Gesendet = 3, Empfangen = 0, Verloren = 3
    (100% Verlust),

Irgendwie wermurkst split-vpn mein ganzes WAN bzw eth9. Hat jmd einen Rat was falsch sein könnte?

**꧁𓊈𒆜 ƁєηLυє 𒆜𓊉꧂** · 16. Dezember 2022

Hier nochmals die Config FIles:

Code: wg0.conf

[Interface]
PrivateKey = <My-Top-Secret-PrivateKey>
ListenPort = 51820
Address = 10.13.13.4/32
PostUp = sh /etc/split-vpn/vpn/updown.sh %i up
PreDown = sh /etc/split-vpn/vpn/updown.sh %i down
#DNS = 10.13.13.1

[Peer]
PublicKey = <My-Top-Secret-PublicKey>
PresharedKey = <My-Top-Secret-PresharedKey>
#AllowedIPs = 0.0.0.0/0
AllowedIPs = 0.0.0.0/1,128.0.0.0/1,::/1,8000::/1
Endpoint = <Public Wireguard ServerIP>:51820

Alles anzeigen

Code: vpn.conf

### SPLIT VPN OPTIONS ###
# Enter multiple entries separated by spaces.
# Do not enter square brackets around the entries.

# Force these sources through the VPN.
# Format: [brX] for interface. [IP/nn] for IP. [xx:xx:xx:xx:xx:xx] for mac.
FORCED_SOURCE_INTERFACE="br10"
FORCED_SOURCE_IPV4=""
FORCED_SOURCE_IPV6=""
FORCED_SOURCE_MAC=""

# Format: [tcp/udp/both]-[IP/MAC Source]-[port1,port2:port3,port4,...]
# Maximum 15 ports per entry.
FORCED_SOURCE_IPV4_PORT=""
FORCED_SOURCE_IPV6_PORT=""
FORCED_SOURCE_MAC_PORT=""

# Force these destinations through the VPN.
# These destinations will be forced regardless of source.
# Format: [IP/nn]
FORCED_DESTINATIONS_IPV4=""
FORCED_DESTINATIONS_IPV6=""

# Force local UDM traffic going out of these WAN interfaces to go through the
# VPN instead for both IPv4 and IPv6 traffic.
# This does not include routed traffic, only local traffic generated by the UDM.
# Do not enable this unless you want to force UDM local traffic through the VPN.
# For UDM-Pro, set to "eth8" for WAN1/Ethernet port, or "eth9" for WAN2/SFP+ port,
# or "eth8 eth9" for both. For UDM Base, set to "eth1" for the WAN port.
# This option might cause unintended problems, so disable it if you encounter any issues.
FORCED_LOCAL_INTERFACE=""

# Exempt these sources from the VPN.
# Format: [IP/nn] for IP. [xx:xx:xx:xx:xx:xx] for mac.
EXEMPT_SOURCE_IPV4=""
EXEMPT_SOURCE_IPV6=""
EXEMPT_SOURCE_MAC=""

# Format: [tcp/udp/both]-[IP/MAC Source]-[port1,port2:port3,port4,...]
# Maximum 15 ports per entry.
EXEMPT_SOURCE_IPV4_PORT=""
EXEMPT_SOURCE_IPV6_PORT=""
EXEMPT_SOURCE_MAC_PORT=""

# Exempt these destinations from the VPN.
# Format: [IP/nn]
EXEMPT_DESTINATIONS_IPV4=""
EXEMPT_DESTINATIONS_IPV6=""

# Force/exempt these IP sets
# IP sets need to be created before this script is run or the script will error.
# IP sets can be updated externally and will be matched dynamically.
# Each IP set entry consists of the IP set name and whether to match on source
# or destination. src/dst needs to be specified for each IP set field.
#
# Enable NAT hairpin by exempting UBIOS_ADDRv4_ethX:dst for IPv4 or
# UBIOS_ADDRv6_ethX:dst for IPv6 (where X = 8 for RJ45, or 9 for SFP+ WAN).
# For IPv6 prefix delegation, exempt UBIOS_ADDRv6_brX, where X = VLAN number (0 = LAN).
#
# To allow communication with your VLAN subnets without hardcoding the subnets,
# exempt the UBIOS_NETv4_brX:dst ipset for IPv4 or UBIOS_NETv6_brX:dst for IPv6.
#
# Format: [IPSet Name]:[src/dst,src/dst,...]
FORCED_IPSETS=""
EXEMPT_IPSETS=""

# VPN port forwards.
# Format: [tcp/udp/both]-[VPN Port]-[Forward IP]-[Forward Port]
PORT_FORWARDS_IPV4=""
PORT_FORWARDS_IPV6=""

# Redirect IPv4 and IPv6 DNS to these addresses for VPN-destined traffic.
# Note that many VPN providers redirect DNS going through their VPN network
# to their own DNS servers. Redirection to other IPs might not work on all providers,
# except for DNS redirects to a local address, or rejecting DNS traffic completely.
#
# IPV4 Format: [IP] to redirect to IP, "DHCP" if using OpenVPN or OpenConnect to obtain
# DNS from DHCP options, or "REJECT" to reject all DNS traffic. "DHCP" is not supported on
# other VPN types like wireguard/external.
#
# Example: Get DNS from DHCP
#DNS_IPV4_IP="DHCP"
DNS_IPV4_IP="10.13.13.1"
#DNS_IPV4_PORT=53

# Set this to the interface (brX) the DNS is on if it is a local IP. Leave blank for
# non-local IPs. Local DNS redirects will not work without specifying the interface.
DNS_IPV4_INTERFACE=""

# IPV6 Format: [IP] to redirect to IP, or "REJECT" to reject IPv6 DNS traffic completely.
# IPV6 Format: [IP] to redirect to IP, "DHCP" if using OpenConnect to obtain DNS from DHCP
# options, or "REJECT" to reject all DNS traffic. "DHCP" is not supported on
# other VPN types.
DNS_IPV6_IP=""
DNS_IPV6_PORT=53
DNS_IPV6_INTERFACE=""

# Bypass masquerade (SNAT) for these source IPs. This option should only be used if your
# VPN server is setup to know how to route the subnet you do not want to masquerade
# (e.g.: the "iroute" option in OpenVPN).
# Set these options to ALL to disable masquerading completely.
# Format: [IP/nn] or "ALL"
BYPASS_MASQUERADE_IPV4=""
BYPASS_MASQUERADE_IPV6=""

# Enabling kill switch drops VPN-destined traffic that doesn't go through the VPN.
KILLSWITCH=0

# Enable this only if you are testing or you don't care about your real IP leaking
# when the vpn client restarts or exits.
REMOVE_KILLSWITCH_ON_EXIT=1

# Enable this if you added blackhole routes in the Unifi Settings to prevent Internet
# access at system startup before the VPN script runs. This option removes the blackhole
# routes to restore Internet access after the killswitch has been enabled.
# If you do not set this to 1, openvpn will not be able to connect at startup, and your
# Internet access will never be enabled until you manually remove the blackhole routes.
# Set this to 0 only if you did not add any blackhole routes.
REMOVE_STARTUP_BLACKHOLES=1

# Set the VPN provider.
# "openvpn" for OpenVPN (default), "openconnect" for OpenConnect, "external" for wireguard,
# or "nexthop" for an external VPN client.
VPN_PROVIDER="external"

# If using "external" for VPN_PROVIDER, set this to the VPN endpoint IP so that the
# gateway route can be automatically added for the VPN endpoint.
# OpenVPN passes the VPN endpoint IP to the script and will override these values.
# These must be defined if using VPN_PROVIDER="nexthop".
VPN_ENDPOINT_IPV4="s3debsrv02.vpn64.de"
VPN_ENDPOINT_IPV6=""

# Set this to the route table that contains the gateway route, "auto", or "disabled".
# The Ubiquiti route table is "201" if you're using Ethernet, "202" for SFP+, and
# "203" for U-LTE.
# Default is "auto" which works with WAN failover and automatically changes the endpoint
# via gateway route when the WAN or gateway routes changes.
# Set to "disabled" if you are using the nexthop option to connect to a VPN on your LAN.
#GATEWAY_TABLE="auto"
GATEWAY_TABLE="disabled"

# Set the MSS clamping on packets going out the VPN tunnel. Usually, it is not needed to
# set this manually, but some VPN connections stall if the MSS clamping is not set correctly.
# Typical values range from 1240 to 1460, but it could be lower.
MSS_CLAMPING_IPV4="1380"
MSS_CLAMPING_IPV6=""

# Set this to the timer to use for the rule watcher (in seconds).
# The script will wake up every N seconds to re-add rules if they're deleted by
# the system, or change gateway routes if they changed. Default is 1 second.
WATCHER_TIMER=1

# Options for custom table and chains.
# These options need to be unique for each instance of openvpn if running multiple.
ROUTE_TABLE=101
MARK=0x169
PREFIX="VPN_"
PREF=99
DEV=wg0

# To execute commands when the VPN connects or disconnects, you can use the
# callback functions hooks_pre_up, hooks_up, hooks_down, and
# hooks_force_down. These functions will be invoked in response to VPN events
# pre-up, up, down, and force-down respectively.
#
# For an example on using these hooks, please see vpn.conf.filled.sample.

Alles anzeigen

Willkommen! Melden Sie sich an oder registrieren Sie sich.

UDM-SE-EU & Split-VPN (WireGuard)

1 Benutzer hat hier geschrieben

Wer ist war online

Benutzer online 92

Wer war online 230