allen
f15ac69925
Includes: - package/ GL-XE3000 kit-busrouter (opkg) - scripts/provision.sh (GL) and provision-synology.sh (Synology) - syno-balance/ — new WAN balancer replacing aiwanbal (SmartWAN adapter) - kit-connect/ — unified connectivity SPK (Tailscale + reverse SSH) - docs/deployment/synology-rt2600ac-checklist.md — 62-point checklist - docs/provisioning/device-identity.md — fleet identity spec - docs/pilot/checklist.md — field pilot validation - x4078_20260721.dss — reference config backup Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
48 lines
2.4 KiB
Bash
Executable File
48 lines
2.4 KiB
Bash
Executable File
#!/bin/sh
|
|
# wg-mgmt-diagnose.sh — READ-ONLY diagnosis of the WG mgmt tunnel on the bench router.
|
|
# Run ON THE ROUTER over LAN: ssh root@192.168.8.1 (pw kitPLANE1!!), then: sh wg-mgmt-diagnose.sh
|
|
# Safe: only reads state + captures packets. Mutates nothing.
|
|
# Context: docs/handoff/2026-07-01-wg-mgmt-incident-and-resume.md
|
|
set +e
|
|
HUB_WG=10.88.0.1
|
|
MGMT_SRC=10.88.0.2
|
|
HUB_PUB=167.172.237.162
|
|
|
|
echo "===== A. FULL WG state (THE missing datapoint — check persistent-keepalive + allowed-ips) ====="
|
|
wg show
|
|
echo
|
|
echo "===== routing / policy (should steer mgmt-sourced traffic into table 1001) ====="
|
|
echo "-- ip rule --"; ip rule
|
|
echo "-- table 1001 --"; ip route show table 1001
|
|
echo "-- default routes --"; ip route show | grep -E '^default'
|
|
echo "-- underlay path to hub --"; ip route get "$HUB_PUB"
|
|
echo "-- mgmt-sourced return path --"; ip route get "$HUB_WG" from "$MGMT_SRC" 2>/dev/null
|
|
echo "-- rp_filter (expect 0; NOT the cause) --"
|
|
for f in /proc/sys/net/ipv4/conf/all/rp_filter /proc/sys/net/ipv4/conf/eth0/rp_filter \
|
|
/proc/sys/net/ipv4/conf/rmnet_mhi0/rp_filter /proc/sys/net/ipv4/conf/wgclient1/rp_filter; do
|
|
[ -f "$f" ] && echo " $f = $(cat "$f")"
|
|
done
|
|
echo "-- iface MTUs --"
|
|
for i in eth0 rmnet_mhi0 wgclient1; do ip link show "$i" 2>/dev/null | sed -n 's/.*\(mtu [0-9]*\).*/ '"$i"': \1/p'; done
|
|
|
|
echo
|
|
echo "===== B. Live capture: watch fiber(eth0) WG + decrypted(wgclient1) while pinging the hub ====="
|
|
echo " [eth0] = encrypted WG on the fiber underlay ; [wg] = decrypted inner packets"
|
|
( timeout 12 tcpdump -ni eth0 udp port 51820 2>/dev/null | sed 's/^/[eth0] /' & )
|
|
( timeout 12 tcpdump -ni wgclient1 2>/dev/null | sed 's/^/[wg] /' & )
|
|
sleep 1
|
|
ping -c 8 -W 2 -I "$MGMT_SRC" "$HUB_WG"
|
|
echo "ping rc=$?"
|
|
wait 2>/dev/null
|
|
|
|
echo
|
|
echo "===== INTERPRET ====="
|
|
cat <<'EOF'
|
|
* wg show 'persistent keepalive: (none)' -> hypothesis #1 (NAT mapping expiry). Fix: keepalive.
|
|
* hub-peer 'allowed ips' lacks 10.88.0.1 -> hypothesis #2. Replies get cryptokey-dropped.
|
|
* [eth0] shows OUTBOUND + INBOUND :51820 -> hub replies DO arrive on fiber -> decrypt/inner issue.
|
|
* [eth0] shows OUTBOUND only -> router pkts not leaving OR hub not returning -> coordinate hub capture.
|
|
* [wg] shows echo-request but no echo-reply -> confirms replies not reaching inner iface.
|
|
Next: apply scripts/diag/wg-mgmt-fix.sh (keepalive first). See the handoff doc.
|
|
EOF
|