Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
Because your self-signed certs are not trusted by your Mac/Browser? Get a Letsencrypt or import into your Mac...I did:
Imported both keys into the key management of my MacBookOk, might not have been as clear as I thought. I will modify my post to make it clear.
Marked both (CA and intermediate) as fully trusted
#!/bin/bash
#!/bin/bash
#set -x
#logger "BACKUP started"
IP="10.10.10.1"
static="123.45.78.97" # is static address
function reset()
{
ifdown wg0
sleep 2s
ifup wg0
sleep 10s
return
}
function test()
{
OK=0
ping -i 1 -c 1 -q $1 &>/dev/null ||OK=1
echo $OK
}
function replace()
{
# get current dynIP
new=( $(host dyn.dns.fqdn|grep address|awk -F\ '{ print $4 }') )
old=`grep "dyn.dns.fqdn" /etc/hosts|awk -F\ '{ print $1 }'`
if [ "$static" = "$old" ]; then
sed -i "0,/$old/s//$new/" /etc/hosts
else
if [ "$new" = "$old" ]; then
sed -i "0,/$old/s//$static/" /etc/hosts
else
sed -i "0,/$old/s//$new/" /etc/hosts
fi
fi
return
}
BO=0
BO=$(test $IP )
while [ $BO -eq 1 ]
do
echo "Verbindung fehlerhaft"
replace
reset
BO=$(test $IP )
if [ $BO -eq 1 ]; then
sleep 10m
BO=$(test $IP )
fi
done
Wireguard indeed was listening to both interfaces.IPv4, length 610: 192.168.1.254 > 192.168.1.252: ICMP 192.168.9.50 unreachable - need to frag (mtu 1420), length 576
So the OPNSense rejects a packet because it need to be defragmented due to low MTU and the device in question has the "don't fragment" (DF) bit set.ethertype IPv4 (0x0800), length 1514: (tos 0x0, ttl 64, id 53198, offset 0, flags [DF], proto TCP (6), length 1500)
192.168.1.252.80 > 192.168.9.50.49272: Flags [.], cksum 0xe438 (correct), seq 1000:2448, ack 744, win 486, options [nop,nop,TS val 6430537 ecr 851618161], length 1448: HTTP, length: 1448
HTTP/1.1 200 OK# indicate that wg0 should be created when the system boots, and on ifup -a
auto wg0
# describe wg0 as an IPv4 interface with static address
iface wg0 inet static
# the IP address of this client on the WireGuard network
address 10.10.10.2/32
# before ifup, create the device with this ip link command
pre-up ip link add $IFACE type wireguard
# before ifup, set the WireGuard config from earlier
pre-up wg setconf $IFACE /etc/wireguard/$IFACE.conf
# after ifdown, destroy the wg0 interface
post-down ip link del $IFACE
# define the local WireGuard interface (client)
[Interface]
#Address = 10.10.10.2/32
# contents of file wg-private.key that was recently created
PrivateKey = 8On*ix0k0=
#ListenPort = 39026
# define the remote WireGuard interface (server)
[Peer]
# contents of wg-public.key on the WireGuard server
PublicKey = ZA6*ipXg=
# the IP address of the remote network(s)
AllowedIPs = 192.168.8.0/24
# public IP address and port of the WireGuard server
Endpoint = [public ip of server]:51280
There is one issue with the documentation on step 7:root@client:/etc# ifup wg0
Line unrecognized: `Address=10.10.10.2/32'
Configuration parsing error
ifup: failed to bring up wg0
root@netcup:/etc# wg
interface: wg0
public key: 27Pu1yyz*p9Yqo+HqVTU=
private key: (hidden)
listening port: 51838
peer: ZA6BNlmf7z*jj32rKDDh5l6WipXg=
endpoint: publicsrvip:51280
allowed ips: 192.168.8.0/242023-08-28T08:13:24.556000 query-errors Informational client @0x84289eb60 192.168.8.2#50719 (www.zdf.de): query failed (failure) for www.zdf.de/IN/A at query.c:7824
2023-08-28T08:13:24.551000 resolver Informational resolver priming query complete: failure