tamtosiamto napisał(a):

nie bawilem sie wczesniej z ac3200 z tomato wiec dla pewnosci zapytam-czy moge wgrac wrersje 64k lub 128k na kazdy ruter? Czy moze ruter bedzie wymagac jakichs modyfikacji?

pedro napisał(a):
[big]FreshTomato-ARM 2021.1 jest gotowe do pobrania.

Steps to make a wireguard interface:
1. `ip link add dev wgX type wireguard`
2. `ip addr add dev wgX 172.16.1.1/24` (replace 172.16.1.1/24 with user entered IP address and subnet, this is the IP address and subnet mask of the wireguard interface itself, can be IPv4 or IPv6, if user wants both, will need to make another call to ip addr add dev wgX IPV6 address).

3. A config file is needed which defines the keys and peers, it looks like this:
```
[Interface]
PrivateKey = XXXXXXX // (this is the private key set by user or generate a new by using `wg genkey`, you should add a readonly field in the GUI that show the public key of this private key because the user will need it in the config of the other side machine. you can generate the public key from the private key (no need to store it in nvram) by calling `echo the-public-key | wg pubkey`)
ListenPort = 51040 // (this is used only in case of setting up wireguard server, this port will be needed to add to firewall to allow access from all (or some) wan interfaces if user want).

[Peer]
PublicKey = XXXXXX (this is the public key added by the user of the other side machine)
AllowedIPs = X.X.X.X.X/XX, X:X:X:X;X/XX (this is the list of addresses that the wireguard interface will allow to reach, for case of wireguard client, it will be 0.0.0.0/0, ::/0 like that with comma, for server it will be IP address of the other side that user enter).

[Peer]
PublicKey = AnotherPeerKey
AllowedIPs = IP-of-client-2
```
Then you need to call `wg setconf wgX /path/to/the/generated/conf/in/tmp`

Finally in case of WireGuard client, you need to add routing like policy routing of OpenVPN to let the client choose what traffic to send to the wireguard.

You will need to use fwmarks also, look at qos.c, we can use the same half-byte of WAN PBR and OpenVPN. SInce there is only 4 WAN and 4 OpenVPN, we can use values 5-8, of course shifted left by 12 and with mask 0xf00 (like wan pbr).

So, 1-4 will be WAN PBR, 5-8 will be 4 Wireguards PBR, and 9-12 will be 4 OpenVPNs PBR.

amikot napisał(a):

W nocy zrobiłem update routera i właśnie spostrzegłem się, że użycie procesora nie schodzi poniżej 98%.
Jest to o tyle dziwne, że tym razem zrezygnowałem z klienta VPN i właściwie cały konfig jest banalnie prosty.. CTF, Stubby, ZerotierOne.
Oczywiście uaktualnienie z czyszczeniem NVRAM.
Poniżej screenshot z HTOPa.

pedro napisał(a):

Coś dziwnego.

1. patrząc na syslogd, dlaczego masz ścieżkę "/opt/var/log/" a nie /opt/var/log/messages" z plikiem na końcu? Działa to u Ciebie w ten sposób, bo u mnie nawet się syslogd nie załącza jak mu dam tę ścieżkę jak u Ciebie?
To jest "Custom Log File Path" a nie "Directory" (jak w "Web Monitor").

2. co tam masz za ipset'y pododawane, bo coś mielą.

//EDIT: a już wiem: wejdź na - na przykład - "Access Restriction".