From: vados-dev <192440777+vados-dev@users.noreply.github.com> Date: Tue, 14 Jul 2026 23:35:05 +0000 (+0300) Subject: Autocommit in repo: ros.vados.ru, generated by owner: root, in 02:35:04 15.07.2026. X-Git-Url: https://git.vados.ru/gitweb.cgi?a=commitdiff_plain;h=0c95d49c3c22daa871c425c270bab930bb8b84fb;p=Mikrotiks%2Fros.vados.ru.git Autocommit in repo: ros.vados.ru, generated by owner: root, in 02:35:04 15.07.2026. --- diff --git a/html/AM-GlobalFunc.rsc b/html/AM-GlobalFunc.rsc index 2fc90adbc..2e9fa2760 100644 --- a/html/AM-GlobalFunc.rsc +++ b/html/AM-GlobalFunc.rsc @@ -17,9 +17,9 @@ :global GlobalFuncReady false; # Git commit id & info, expected configuration version -:global CommitId "main/735/d5d8ff2d"; +:global CommitId "main/736/80e2ca4c"; :global CommitTAG "unknown"; -:global CommitInfo "Autocommit in repo: ros.vados.ru, generated by owner: root, in 02:30:04 15.07.2026."; +:global CommitInfo "Autocommit in repo: ros.vados.ru, generated by owner: root, in 02:35:04 15.07.2026."; # The variables are received right here. :global GlobalConfVersion 140; diff --git a/html/amneziawg/wg-killSwitch/index.html b/html/amneziawg/index.html similarity index 100% rename from html/amneziawg/wg-killSwitch/index.html rename to html/amneziawg/index.html diff --git a/html/amneziawg/wg-killSwitch/wg-nm-firewalld.md b/html/amneziawg/wg-killSwitch/wg-nm-firewalld.md new file mode 100644 index 000000000..090966b98 --- /dev/null +++ b/html/amneziawg/wg-killSwitch/wg-nm-firewalld.md @@ -0,0 +1,453 @@ +# WireGuard VPN setup with NetworkManager and firewalld + +## Prerequisites + +This guide uses NetworkManager and firewalld. Both of these are installed and used by default on current versions of Red Hat Enterprise Linux and Fedora. + +First, test that NetworkManager is in use: + +``` +# nmcli +eth0: connected to eth0 + "The Linux Foundation Microsoft Hyper-V" + ethernet (hv_netvsc), 00:15:5D:01:03:0C, hw, mtu 1500 + ip4 default, ip6 default + inet4 192.168.1.134/24 + route4 192.168.1.0/24 metric 100 + route4 default via 192.168.1.1 metric 100 + inet6 2001:4c4e:24cd:d400:215:5dff:fe01:30c/64 + inet6 fe80::215:5dff:fe01:30c/64 + route6 fe80::/64 metric 1024 + route6 2001:4c4e:24cd:d400::/64 metric 100 + route6 2001:4c4e:24cd:d400::/64 via fe80::8efd:deff:fe33:fb18 metric 105 + route6 default via fe80::8efd:deff:fe33:fb18 metric 100 + +lo: connected (externally) to lo + "lo" + loopback (unknown), 00:00:00:00:00:00, sw, mtu 65536 + inet4 127.0.0.1/8 + inet6 ::1/128 + +DNS configuration: + servers: 192.168.1.1 + domains: home + interface: eth0 + + servers: 2001:4c48:1::1 + domains: home + interface: eth0 +``` + +Then test that firewalld is active: + +``` +# firewall-cmd --state +running +``` + +## Generating a WireGuard configuration file + +VPN services that support WireGuard will usually have a configuration generator site or guide. My chosen service, AirVPN, generated the following file when selecting a Czeh server: + +```ini +[Interface] +Address = 10.184.152.149/32, fd7d:76ee:e68f:a993:d172:bc31:cc8:3a7f/128 +PrivateKey = 6K+Ij5DThhAdbW2YL7gyjvhKOTV37qmZZQ6p8oSjH0U= +MTU = 1320 +DNS = 10.128.0.1, fd7d:76ee:e68f:a993::1 + +[Peer] +PublicKey = PyLCXAQT8KkM4T+dUsOQfn+Ub3pGxfGlxkIApuig+hk= +PresharedKey = bXLsMq+/4koXwJ8UFcqZCoGLJOzokeKiZd6M9VP0CDM= +Endpoint = 185.156.174.117:1637 +AllowedIPs = 0.0.0.0/0, ::/0 +PersistentKeepalive = 15 +``` + +These are usually fairly similar across services, so just substitute your own one in place. + +## Importing into NetworkManager + +Rename your configuration to the name you'd like the profile and interface to be named. I chose `wg-centaurus.conf` as that's what AirVPN calls this specific server. Then, import the file: + +``` +# nmcli connection import type wireguard file wg-centaurus.conf +Connection 'wg-centaurus' (4e1b0fd1-6fd1-46a1-9358-03b6f238d58f) successfully added. +``` + +It should automatically connect, and you should now have the masked IP address! We should test it: + +``` +# curl ipinfo.io +{ + "ip": "185.156.174.115", + "hostname": "115.174.156.185.in-addr.arpa", + "city": "Prague", + "region": "Prague", + "country": "CZ", + "loc": "50.0880,14.4208", + "org": "AS9009 M247 Europe SRL", + "postal": "110 00", + "timezone": "Europe/Prague", + "readme": "https://ipinfo.io/missingauth" +} +``` +``` +# curl v6.ipinfo.io +{ + "ip": "2001:ac8:33:8:f7e9:fa3:a40c:ab11", + "city": "Prague", + "region": "Prague", + "country": "CZ", + "loc": "50.0880,14.4208", + "org": "AS9009 M247 Europe SRL", + "postal": "110 00", + "timezone": "Europe/Prague", + "readme": "https://ipinfo.io/missingauth" +} +``` + +## Killswitch with firewalld + +Now, see what happens if we disable the VPN profile: + +``` +# nmcli connection down wg-centaurus +Connection 'wg-centaurus' successfully deactivated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/3) +``` + +``` +# curl ipinfo.io +{ + ... + "country": "HU", + ... +} +``` +``` +#curl v6.ipinfo.io +{ + ... + "country": "HU", + ... +} +``` + +As expected, the internet is still accessible, however the original IP is displayed. + +To prevent this from happening, we'll be following [meow646's blogpost on setting up a VPN Killswitch](https://meow464.neocities.org/blog/firewalld-vpn-killswitch/). Please visit their site for full details. + +We first create the policy: + +``` +# firewall-cmd --permanent --new-zone VPN-Only +success +``` +``` +# firewall-cmd --permanent --zone VPN-Only --set-target DROP +success +``` +``` +# firewall-cmd --permanent --new-policy VPN-Killswitch +success +``` +``` +# firewall-cmd --permanent --policy VPN-Killswitch --set-target DROP +success +``` +``` +# firewall-cmd --reload +success +``` + +Then we exclude the VPN server from the policy. Since AirVPN is using a non-standard WireGuard port, we modify the command to allow a specific port instead of the predefined `wireguard` service: + +``` +# firewall-cmd --policy VPN-Killswitch --add-rich-rule='rule family="ipv4" destination address="185.156.174.117" port port="1637" protocol="udp" accept' +success +``` + +If you want to allow access to your LAN, you'll need to add a rule for that too. My network uses the `192.168.1.0/24` range, therefore I'm running the command unmodified: + +``` +# firewall-cmd --policy VPN-Killswitch --add-rich-rule='rule family="ipv4" destination address="192.168.1.0/24" accept' +success +``` + +Then we set ingress and egress zones: + +``` +# firewall-cmd --policy VPN-Killswitch --add-ingress-zone HOST +success +``` +``` +# firewall-cmd --policy VPN-Killswitch --add-egress-zone VPN-Only +success +``` + +Next we add the network interfaces. As seen in the initial `nmcli`, I only have one named `eth0`: + +``` +# firewall-cmd --permanent --zone VPN-Only --add-interface=eth0 +The interface is under control of NetworkManager, setting zone to 'VPN-Only'. +success +``` + +And we should be done. Time to test it again: + +``` +# curl --connect-timeout 1 ipinfo.io +curl: (28) Failed to connect to ipinfo.io port 80 after 1001 ms: Timeout was reached +``` +``` +# curl --connect-timeout 1 v6.ipinfo.io +curl: (28) Failed to connect to v6.ipinfo.io port 80 after 1000 ms: Timeout was reached +``` + +Great, seems like there's no connection made. Let's enable VPN and try again: + +``` +# nmcli connection up wg-centaurus +Connection successfully activated (D-Bus active path: /org/freedesktop/NetworkManager/ActiveConnection/5) +``` +``` +# curl --connect-timeout 1 ipinfo.io +{ + "ip": "185.156.174.115", + "hostname": "115.174.156.185.in-addr.arpa", + "city": "Prague", + "region": "Prague", + "country": "CZ", + "loc": "50.0880,14.4208", + "org": "AS9009 M247 Europe SRL", + "postal": "110 00", + "timezone": "Europe/Prague", + "readme": "https://ipinfo.io/missingauth" +} +``` +``` +# curl --connect-timeout 1 v6.ipinfo.io +{ + "ip": "2001:ac8:33:8:f7e9:fa3:a40c:ab11", + "city": "Prague", + "region": "Prague", + "country": "CZ", + "loc": "50.0880,14.4208", + "org": "AS9009 M247 Europe SRL", + "postal": "110 00", + "timezone": "Europe/Prague", + "readme": "https://ipinfo.io/missingauth" +} +``` + +And it seems like the VPN connection still works as intended. Now, we should write the running configuration to file so it doesn't go away on a reboot: + +``` +# firewall-cmd --runtime-to-permanent +success +``` + +## Port forwarding + +This is the exact same as without a VPN when using firewalld, however for the sake of completeness is included here. I prefer creating a "service" to group the VPN forwarded ports under: + +``` +# firewall-cmd --permanent --new-service=vpn-ports +success +``` +``` +# firewall-cmd --permanent --service=vpn-ports "--set-description=VPN Ports" +success +``` +``` +# firewall-cmd --permanent --service=vpn-ports "--set-short=VPN Ports" +success +``` +``` +# firewall-cmd --permanent --service=vpn-ports --add-port=3333/tcp +success +``` + +Now we just want to allow this service on the VPN connection's zone. Let's find out the zone: + +``` +# firewall-cmd --get-active-zones +FedoraServer + interfaces: wg-centaurus +VPN-Only + interfaces: eth0 +``` + +And add the service: + +``` +# firewall-cmd --permanent --zone=FedoraServer --add-service=vpn-ports +success +``` + +Then reload, as `--permanent` does not apply to the current running configuration: + +``` +# firewall-cmd --reload +success +``` + +Let's test if it worked by listening on the port with netcat: + +``` +# nc -v -l 3333 +Ncat: Version 7.93 ( https://nmap.org/ncat ) +Ncat: Listening on :::3333 +Ncat: Listening on 0.0.0.0:3333 +``` + +And on another device, let's visit the expected URL: + +``` +# curl http://185.156.174.115:3333/ +``` + +This should result in netcat printing the request: + +``` +Ncat: Connection from 185.9.19.107. +Ncat: Connection from 185.9.19.107:40518. +GET / HTTP/1.1 +Host: 185.156.174.115:3333 +User-Agent: curl/8.0.1 +Accept: */* +``` + +Congratulations, your port forward is working! + +--- + +"WireGuard" is a registered trademark of Jason A. Donenfeld. + +--- + +LICENSE OF THIS GUIDE: + +``` +Creative Commons Legal Code + +CC0 1.0 Universal + + CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE + LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN + ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS + INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES + REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS + PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM + THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED + HEREUNDER. + +Statement of Purpose + +The laws of most jurisdictions throughout the world automatically confer +exclusive Copyright and Related Rights (defined below) upon the creator +and subsequent owner(s) (each and all, an "owner") of an original work of +authorship and/or a database (each, a "Work"). + +Certain owners wish to permanently relinquish those rights to a Work for +the purpose of contributing to a commons of creative, cultural and +scientific works ("Commons") that the public can reliably and without fear +of later claims of infringement build upon, modify, incorporate in other +works, reuse and redistribute as freely as possible in any form whatsoever +and for any purposes, including without limitation commercial purposes. +These owners may contribute to the Commons to promote the ideal of a free +culture and the further production of creative, cultural and scientific +works, or to gain reputation or greater distribution for their Work in +part through the use and efforts of others. + +For these and/or other purposes and motivations, and without any +expectation of additional consideration or compensation, the person +associating CC0 with a Work (the "Affirmer"), to the extent that he or she +is an owner of Copyright and Related Rights in the Work, voluntarily +elects to apply CC0 to the Work and publicly distribute the Work under its +terms, with knowledge of his or her Copyright and Related Rights in the +Work and the meaning and intended legal effect of CC0 on those rights. + +1. Copyright and Related Rights. A Work made available under CC0 may be +protected by copyright and related or neighboring rights ("Copyright and +Related Rights"). Copyright and Related Rights include, but are not +limited to, the following: + + i. the right to reproduce, adapt, distribute, perform, display, + communicate, and translate a Work; + ii. moral rights retained by the original author(s) and/or performer(s); +iii. publicity and privacy rights pertaining to a person's image or + likeness depicted in a Work; + iv. rights protecting against unfair competition in regards to a Work, + subject to the limitations in paragraph 4(a), below; + v. rights protecting the extraction, dissemination, use and reuse of data + in a Work; + vi. database rights (such as those arising under Directive 96/9/EC of the + European Parliament and of the Council of 11 March 1996 on the legal + protection of databases, and under any national implementation + thereof, including any amended or successor version of such + directive); and +vii. other similar, equivalent or corresponding rights throughout the + world based on applicable law or treaty, and any national + implementations thereof. + +2. Waiver. To the greatest extent permitted by, but not in contravention +of, applicable law, Affirmer hereby overtly, fully, permanently, +irrevocably and unconditionally waives, abandons, and surrenders all of +Affirmer's Copyright and Related Rights and associated claims and causes +of action, whether now known or unknown (including existing as well as +future claims and causes of action), in the Work (i) in all territories +worldwide, (ii) for the maximum duration provided by applicable law or +treaty (including future time extensions), (iii) in any current or future +medium and for any number of copies, and (iv) for any purpose whatsoever, +including without limitation commercial, advertising or promotional +purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each +member of the public at large and to the detriment of Affirmer's heirs and +successors, fully intending that such Waiver shall not be subject to +revocation, rescission, cancellation, termination, or any other legal or +equitable action to disrupt the quiet enjoyment of the Work by the public +as contemplated by Affirmer's express Statement of Purpose. + +3. Public License Fallback. Should any part of the Waiver for any reason +be judged legally invalid or ineffective under applicable law, then the +Waiver shall be preserved to the maximum extent permitted taking into +account Affirmer's express Statement of Purpose. In addition, to the +extent the Waiver is so judged Affirmer hereby grants to each affected +person a royalty-free, non transferable, non sublicensable, non exclusive, +irrevocable and unconditional license to exercise Affirmer's Copyright and +Related Rights in the Work (i) in all territories worldwide, (ii) for the +maximum duration provided by applicable law or treaty (including future +time extensions), (iii) in any current or future medium and for any number +of copies, and (iv) for any purpose whatsoever, including without +limitation commercial, advertising or promotional purposes (the +"License"). The License shall be deemed effective as of the date CC0 was +applied by Affirmer to the Work. Should any part of the License for any +reason be judged legally invalid or ineffective under applicable law, such +partial invalidity or ineffectiveness shall not invalidate the remainder +of the License, and in such case Affirmer hereby affirms that he or she +will not (i) exercise any of his or her remaining Copyright and Related +Rights in the Work or (ii) assert any associated claims and causes of +action with respect to the Work, in either case contrary to Affirmer's +express Statement of Purpose. + +4. Limitations and Disclaimers. + + a. No trademark or patent rights held by Affirmer are waived, abandoned, + surrendered, licensed or otherwise affected by this document. + b. Affirmer offers the Work as-is and makes no representations or + warranties of any kind concerning the Work, express, implied, + statutory or otherwise, including without limitation warranties of + title, merchantability, fitness for a particular purpose, non + infringement, or the absence of latent or other defects, accuracy, or + the present or absence of errors, whether or not discoverable, all to + the greatest extent permissible under applicable law. + c. Affirmer disclaims responsibility for clearing rights of other persons + that may apply to the Work or any use thereof, including without + limitation any person's Copyright and Related Rights in the Work. + Further, Affirmer disclaims responsibility for obtaining any necessary + consents, permissions or other rights required for any use of the + Work. + d. Affirmer understands and acknowledges that Creative Commons is not a + party to this document and has no duty or obligation with respect to + this CC0 or use of the Work. +``` \ No newline at end of file