Posts by QBJack

  • LE 11 and Wireguard VPN to my Unifi Dreammachine

    Scritch Try this instructions:

    Post

    RE: Wireguard - changes the default route although not configured

    After a few days I managed to solve default route issue. Below there are my scripts with descriptions.

    WG configuration:

    /storage/.config/wireguard/wg0.conf

    (Code, 9 lines)

    Wireguard startup script:

    /storage/.config/wgconnect.sh

    (Code, 15 lines)

    Stop Wireguard connection:

    /storage/.config/wgdisconnect.sh

    (Code, 3 lines)

    Systemd service:

    /storage/.config/system.d/wireguard.service

    (Code, 15 lines)

    Then all traffic routes via default eth0 interface and several ip's via wg0. Routes look as follows:

    (Code, 11…
    knedlyk
    September 26, 2022 at 12:58 PM

    Worked for me perfectly and it has the benefit that you can use a FDQN / hostname for the VPN server.

  • Wireguard - changes the default route although not configured

    Quote from mglae

    QBJack Not possible with connman use wg. See post 14.

    Thanks mglae . I used the description in that post and made it working as it should. It has the big benefit, that you can use hostnames / FQDN for the VPN server host.

    Quote from chewitt

    Stop blindly copying things from the wiki. It shows general hints not verbatim instructions. Your existing service file results in a connection. You can add move-after or move-before commands to adjust the routing config. You can also run the move-after/before commands from the SSH console to experiment in-situ and see the impact on the routes on your box. Go experiment, figure out what combination you need, then add the same sequence to the file. If you don't need static routes, don't add static routes.

    Thanks, but a guide like that wiki page is not very helpful for noob linux users like me and I do not have the time and the patience to become a linux networking and routing expert.

    Whatever, I made it working as described in post #14. Thanks for your support.

  • Wireguard - changes the default route although not configured

    Quote from chewitt

    ConnMan adds a route to the WireGuard server so you do not need to.

    The code in my last post is taken from here WireGuard | LibreELEC.wiki (known issues part) so I assumed it needs to be in that wireguard.service file to make the routing as expected: do only route the desired network over VPN and not the whole traffic.

    Quote from chewitt

    All you need is the move-after/move-before connmanctl comands to adjust the interface/service order so WireGuard is not the default route that everything is tunnelled down (and the interface you want to be default, is the default.

    Hmm, is there maybe a typo in the wiki as I only see two "move-after" and not one "move-before" commands in the example from the above mentioned wiki page:

    [Service]
    Type=oneshot
    RemainAfterExit=yes
    ExecStartPre=/usr/bin/sleep 5
    ExecStart=/usr/bin/connmanctl connect vpn_service_name
    ExecStartPost=/usr/bin/connmanctl move-after vpn_service_name ethernet_b827eb10c45a_cable
    ExecStartPost=/usr/bin/connmanctl move-after vpn_service_name ethernet_b827eb10c45a_cable
    ExecStartPost=/usr/sbin/route add -net 192.168.2.0 netmask 255.255.255.0 gw 10.0.0.2
    ExecStartPost=/usr/sbin/route add 64.109.130.11/32 via 192.168.0.1 dev eth0
    ExecStop=/usr/bin/connmanctl disconnect vpn_service_name


    So this part is not necessary in a common scenario as this is your TVHeadend special?:

    ExecStartPost=/usr/sbin/route add 64.109.130.11/32 via 192.168.0.1 dev eth0

    Sorry to bother you about that so much but I want to understand that and make it working "correctly".

  • Wireguard - changes the default route although not configured

    Thanks for updating the part about routing. As there are many different IPs mentioned in every step, it is very difficult to follow that instructions as it is not clear (for me) which IPs are those mentioned in this part:

    Code
    ExecStartPost=/usr/sbin/route add -net 192.168.2.0 netmask 255.255.255.0 gw 10.0.0.2
ExecStartPost=/usr/sbin/route add 64.109.130.11/32 via 192.168.0.1 dev eth0

    In this example code which is which IP?

    192.168.2.0 - the remote network I want to reach over VPN?

    10.0.0.2 - remote Wireguard VPN network?

    64.109.130.11/32 - public IP of the VPN server?

    192.168.0.1 - local gateway (where the LE client is)?

  • Wireguard - changes the default route although not configured

    I followed the guide at WireGuard | LibreELEC.wiki - especially the part "known-issues". I set my config to only route my internal network over the VPN connection - everything else should use the clients local internet breakout.

    This does not work - everything is routed through my VPN network. A short check with i.e. curl -4 icanhazip.com shows my VPN networks public IP. Traceroute to "somethingontheweb.com" tells me the same.

    Here is some log output:

    192.168.200.0 is my local network.

    192.168.4.0 is the VPN network.

    192.168.8.0 is the remote clients network.

    Any ideas?

  • LE 11 and Wireguard VPN to my Unifi Dreammachine

    After playing around a bit, I think that I have found the reason for that behavior. I used my VPN server's (public) hostname (fqdn) instead of it's public IP address. Using an IP makes the VPN connection work.

    Great that it works that way but using an dynamic public IP (which can change from time to time) is not a great solution as you have to check and manually edit those config files again on every IP change.

    Is that really so, that this wireshark implementation cannot handle hostnames (fqdn) and must use IPs instead?

  • LE 11 and Wireguard VPN to my Unifi Dreammachine

    Hello and a happy new year.

    I have updated LE to 12.0.1 and gave that wireguard VPN a second chance. The behavior is the same, connection does not work - exactly the same as in LE 11 over a year ago.

    Does somebody has any ideas how to make that work as it is an official supported method and described in LE wiki to be supported.

    Thanks.

  • [RPi4B] Argon One Case Shutdown

    Thanks for this addon. I have installed that on LE12 on my Rpi4B. But the fan does not spin up. The power off / restart function of the button does not work as well. It seems to me, that there is no service running for controlling that. Should there be a service? I am not sure.

    What I see in the journal are a lot of these messages:

    Dec 13 12:38:11 LibreELEC kernel: i2c-bcm2835 fe804000.i2c: i2c transfer timed out
    Dec 13 12:39:13 LibreELEC kernel: i2c-bcm2835 fe804000.i2c: i2c transfer timed out
    Dec 13 12:40:14 LibreELEC kernel: i2c-bcm2835 fe804000.i2c: i2c transfer timed out
    Dec 13 12:41:15 LibreELEC kernel: i2c-bcm2835 fe804000.i2c: i2c transfer timed out

    Any help is appreciated.

    Cheers

    Thomas

  • LE 11 and Wireguard VPN to my Unifi Dreammachine

    Hello guys,

    I need help to get a working VPN connection from Rpi4 with LE 11 (latest as today) to my Unifi Dreammachine.

    I used this instruction to setup the LE side: WireGuard - LibreELEC.wiki

    On my Unifi DM I created a new WG client and downloaded the provided config file. This files contains most data for the config on LE side like privatekey, publickey, allowed-ips and so on. UDM version is the latest release as well.

    From that information given I created the following wireguard.config file :

    When starting the VPN connection I get:

    Code
    LibreELEC:~/.config/wireguard # connmanctl connect vpn_my_ip_here
Connected vpn_my_ip_here

    but trying to ping the VPN gateway's private IP or anything else on my private network gives me this:

    Code
    LibreELEC:~/.config/wireguard # ping 192.168.4.1
PING 192.168.4.1 (192.168.4.1): 56 data bytes
ping: sendto: Required key not available

    Simple ping is not possible and my UDM shows no VPN clients connected at all.

    Using this exact config from my UDM on my Wireguard Windows Installation just works without issues and I can ping and access my network stuff.

    Please help on that. Thanks in advance.

    Best regards

    Thomas