Document network operations and WireGuard maintenance
This commit is contained in:
windyboy
+102
@@ -0,0 +1,102 @@
|
||||
# gw — EdgeRouter X primary LAN gateway
|
||||
|
||||
## Role and access
|
||||
|
||||
| Item | Value |
|
||||
|---|---|
|
||||
| Role | Primary router for the `192.168.66.0/24` and `192.168.55.0/24` LANs |
|
||||
| IPv4 | `192.168.66.254` |
|
||||
| Verified hostname | `gw` |
|
||||
| SSH | `ssh -4 zhiqiang@192.168.66.254` |
|
||||
| Platform | Ubiquiti EdgeRouter X 5-Port, EdgeOS `v3.0.1` (Build `5862409`) |
|
||||
| Kernel | `4.14.54-UBNT` |
|
||||
| Time zone | `Asia/Shanghai` |
|
||||
|
||||
Use `zhiqiang` as the default account for all routine gateway operations. Its
|
||||
key-only SSH login and passwordless `sudo` were verified on 2026-08-04; use
|
||||
`BatchMode=yes` for unattended read-only checks. `ubnt` remains an existing
|
||||
administrative account, but is not the routine operations entry point.
|
||||
|
||||
Do not store account passwords, PPPoE credentials, SSH keys, configuration
|
||||
password hashes, or UISP/UNMS connection strings in this repository. Both
|
||||
administrative accounts have EdgeOS configuration and sudo privileges. Verify a
|
||||
new SSH host key out of band before accepting it.
|
||||
|
||||
## Network topology
|
||||
|
||||
| Interface | Address / role |
|
||||
|---|---|
|
||||
| `eth0` | `192.168.66.254/24`; LAN 66 |
|
||||
| `switch0` (`eth1`–`eth3`) | `192.168.55.254/24`; LAN 55 |
|
||||
| `eth4` | WAN physical port; PPPoE uplink |
|
||||
| `pppoe0` | WAN default route; MTU `1492`; IPv6 prefix delegation `/60` |
|
||||
|
||||
IPv6 prefix delegation assigns SLAAC-capable `/64` networks to both LANs.
|
||||
`eth4` applies the WAN IPv4 and IPv6 firewall policies.
|
||||
|
||||
Detailed effective configuration, including firewall binding and WAN exposure,
|
||||
is recorded in [the EdgeRouter X configuration record](../docs/edgerouter-x-configuration.md).
|
||||
|
||||
## Services and policy
|
||||
|
||||
- DHCP serves both LANs with 24-hour leases. Client DNS is `192.168.66.36`.
|
||||
Pools are `.38`–`.243` on both networks; selected infrastructure and client
|
||||
addresses have static mappings. The UniFi controller is advertised as
|
||||
`192.168.66.46`.
|
||||
- DNS forwarding listens on `eth0` and `switch0` with a cache size of 512.
|
||||
- WAN NAT masquerades all IPv4 traffic leaving `pppoe0`.
|
||||
- `WAN_IN` and `WAN_LOCAL` default to drop, permitting established/related
|
||||
sessions and rejecting invalid state. Equivalent IPv6 policies permit
|
||||
necessary ICMPv6 and DHCPv6 traffic.
|
||||
- `LAN_IN` defines a default drop plus explicit `55 → 66` and `66 → 55`
|
||||
allows, but it is **not currently applied to an interface**. The active
|
||||
inter-VLAN posture is therefore ordinary routed access: LAN55 and LAN66 can
|
||||
communicate bidirectionally unless a different active policy intervenes.
|
||||
`LAN_OUT` is likewise defined but inactive; WAN policies are active on
|
||||
`pppoe0`.
|
||||
- Management services: SSH on TCP 22; EdgeOS GUI on HTTP 80 and HTTPS 443.
|
||||
|
||||
## Safe inspection
|
||||
|
||||
Use the EdgeOS operational CLI for routine inspection. `show configuration
|
||||
commands` can expose credentials and remote-management tokens, so either avoid
|
||||
copying it or filter sensitive lines before recording output.
|
||||
|
||||
```bash
|
||||
ssh -4 -o BatchMode=yes zhiqiang@192.168.66.254
|
||||
show version
|
||||
show interfaces
|
||||
show ip route
|
||||
show system uptime
|
||||
show firewall
|
||||
```
|
||||
|
||||
The [official EdgeOS User Guide](https://dl.ubnt.com/guides/edgemax/EdgeOS_UG.pdf)
|
||||
explains that a firewall policy is a ruleset and must be applied to the
|
||||
relevant interface/direction to take effect. Use the operational `show
|
||||
firewall` output—not merely the configured rule definitions—to determine the
|
||||
effective policy.
|
||||
|
||||
## Maintenance notes
|
||||
|
||||
- EdgeOS writes persistent changes through its configuration tree: enter
|
||||
`configure`, make the intended change, then run `commit` and `save`.
|
||||
- The current SSH service reported a non-post-quantum key-exchange warning.
|
||||
Treat any cryptography or SSH-policy maintenance as a planned, lockout-safe
|
||||
change following the repository SSH safety procedure.
|
||||
- This device is distinct from `gfw.windy.lan` (`192.168.66.1`), the OpenWrt
|
||||
OpenClash gateway. Do not apply OpenWrt procedures to this router.
|
||||
|
||||
## Verification record
|
||||
|
||||
Configuration and reachability were checked by read-only SSH on 2026-08-04.
|
||||
No network policy changes were made during that inspection. The `zhiqiang`
|
||||
account password was subsequently rotated using the EdgeOS configuration tree
|
||||
and verified by a separate SSH login; the password is intentionally not
|
||||
recorded here.
|
||||
|
||||
Inter-VLAN access was rechecked by read-only SSH on 2026-08-05. A probe sourced
|
||||
from `192.168.55.254` reached the UniFi controller at `192.168.66.46` with
|
||||
3/3 ICMP replies. This supports the AP Inform path to
|
||||
`192.168.66.46:9080`; the controller listener and an online LAN55 AP provide
|
||||
the corresponding application-level evidence. No firewall changes were made.
|
||||
+9
-1
@@ -25,6 +25,7 @@ Verify a changed key out of band before accepting it.
|
||||
| Image | `jacobalberty/unifi:v9.5.21` |
|
||||
| Network mode | host |
|
||||
| HTTPS UI | `https://192.168.66.46:8443` |
|
||||
| Device inform endpoint | `http://192.168.66.46:9080/inform` |
|
||||
|
||||
The controller binds `*:8443`. A local HTTPS request to
|
||||
`https://127.0.0.1:8443/` is the primary quick health check.
|
||||
@@ -43,6 +44,14 @@ Without this bypass, a controller request to `localhost:8443` can be sent to
|
||||
the OpenClash gateway instead of remaining local. Details and verification are
|
||||
in [the UniFi localhost proxy note](../docs/unifi-openclash-localhost.md).
|
||||
|
||||
## Managed access points
|
||||
|
||||
The controller manages the APs listed in [the UniFi network record](../docs/unifi-network.md).
|
||||
The inform endpoint is deliberately on port `9080`, not UniFi's common default
|
||||
of `8080`. During adoption or recovery, use the documented `:9080/inform` URL;
|
||||
an AP left on `:8080` can remain reachable by ping and SSH while showing
|
||||
offline in the controller.
|
||||
|
||||
## Safe reconciliation and verification
|
||||
|
||||
```bash
|
||||
@@ -55,4 +64,3 @@ curl -k -sS -o /dev/null -w '%{http_code}\n' https://127.0.0.1:8443/
|
||||
|
||||
Recreating the service briefly interrupts the controller. Do not use `docker
|
||||
compose down -v`; it can remove persistent data.
|
||||
|
||||
|
||||
@@ -0,0 +1,61 @@
|
||||
# us4.wsvc.info
|
||||
|
||||
| Item | Value |
|
||||
|------|-------|
|
||||
| Role | WireGuard VPN server (LinuxServer Docker image) |
|
||||
| SSH | `ssh -4 windy@us4.wsvc.info` (prefer IPv4 from WSL) |
|
||||
| IPv4 | `185.201.226.122` |
|
||||
| Compose project | `/opt/wireguard` |
|
||||
| Compose file | `/opt/wireguard/compose.yml` |
|
||||
| Container | `wireguard` |
|
||||
| Image policy | Immutable digest, updated only in an approved maintenance window |
|
||||
| Public port | UDP `51820` on IPv4 and IPv6 |
|
||||
| Tunnel subnet | `10.13.13.0/24` |
|
||||
| Routing policy | IPv4-only full tunnel (`ALLOWEDIPS=0.0.0.0/0`); IPv6 traffic is not guaranteed to use the VPN |
|
||||
|
||||
## Safety
|
||||
|
||||
- Private keys, preshared keys, peer configuration files, and QR codes remain
|
||||
only in `/opt/wireguard/config`; do not copy them to this repository or
|
||||
Linear.
|
||||
- Local rollback archives are stored in `/opt/wireguard/backups` (directory
|
||||
mode `0700`, archives mode `0600`). They contain private keys, are not an
|
||||
off-host disaster-recovery backup, and must never leave the server.
|
||||
- Do not delete, move, or regenerate `/opt/wireguard/config` during
|
||||
maintenance.
|
||||
- Before a container recreation, validate `docker compose config` and retain a
|
||||
verified SSH session for rollback. Do not run `docker compose down -v`.
|
||||
|
||||
## Routine operations
|
||||
|
||||
Run read-only checks through Ansible:
|
||||
|
||||
```bash
|
||||
cd ansible
|
||||
ansible-playbook playbooks/health-report.yml --limit wireguard
|
||||
```
|
||||
|
||||
The image update and recreate procedure is deliberately separate and requires
|
||||
an immutable image digest in the server-side Compose file plus an explicit
|
||||
maintenance-window confirmation:
|
||||
|
||||
```bash
|
||||
cd ansible
|
||||
ansible-playbook playbooks/wireguard-maintenance.yml --limit wireguard \
|
||||
-e '{"wireguard_maintenance_confirm": true}'
|
||||
```
|
||||
|
||||
Before that recreate, apply the reviewed Compose hardening from the repository:
|
||||
|
||||
```bash
|
||||
ansible-playbook playbooks/wireguard-harden.yml --limit wireguard \
|
||||
-e '{"wireguard_harden_confirm": true}'
|
||||
```
|
||||
|
||||
## Verification
|
||||
|
||||
- Container `wireguard` is running and interface `wg0` exists.
|
||||
- UDP `51820` is listening on the host.
|
||||
- Validate a known client can handshake and sends IPv4 traffic through the VPN.
|
||||
- Do not treat inactive mobile peers as a failure solely because their latest
|
||||
handshake is old.
|
||||
Reference in New Issue
Block a user