allen
f15ac69925
Includes: - package/ GL-XE3000 kit-busrouter (opkg) - scripts/provision.sh (GL) and provision-synology.sh (Synology) - syno-balance/ — new WAN balancer replacing aiwanbal (SmartWAN adapter) - kit-connect/ — unified connectivity SPK (Tailscale + reverse SSH) - docs/deployment/synology-rt2600ac-checklist.md — 62-point checklist - docs/provisioning/device-identity.md — fleet identity spec - docs/pilot/checklist.md — field pilot validation - x4078_20260721.dss — reference config backup Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
59 lines
2.4 KiB
Bash
Executable File
59 lines
2.4 KiB
Bash
Executable File
#!/bin/sh
|
|
# wg-mgmt-fix.sh — apply ONE mgmt-tunnel robustness fix at a time, then bounce wgclient1.
|
|
# Run ON THE ROUTER over LAN: ssh root@192.168.8.1 (pw kitPLANE1!!)
|
|
# sh wg-mgmt-fix.sh keepalive # set persistent_keepalive=25 (TRY FIRST)
|
|
# sh wg-mgmt-fix.sh mtu # set wgclient1 mtu=1280 (fixes PMTU black-holes / SSH data)
|
|
# sh wg-mgmt-fix.sh rpfilter # persist loose rp_filter (=2) + hotplug re-assert
|
|
# sh wg-mgmt-fix.sh all # keepalive + mtu + rpfilter
|
|
# MUTATING but reversible (each is a uci change). Bounces the tunnel ~5s; touches nothing else.
|
|
# After each: re-test ping -c3 -W2 -I 10.88.0.2 10.88.0.1 (expect replies).
|
|
# Rationale + goal (mgmt over EITHER WAN): docs/handoff/2026-07-01-wg-mgmt-incident-and-resume.md
|
|
set -e
|
|
IFACE=wgclient1
|
|
|
|
bounce() { echo ">> uci commit network; ifup $IFACE"; uci commit network; ifup "$IFACE"; sleep 5; }
|
|
|
|
do_keepalive() {
|
|
echo "== persistent_keepalive=25 on $IFACE (hold NAT mapping open on whichever WAN) =="
|
|
uci set network.$IFACE.persistent_keepalive='25'
|
|
bounce
|
|
}
|
|
|
|
do_mtu() {
|
|
echo "== mtu=1280 on $IFACE (safe under cellular + ATT-fiber/PPPoE path MTUs) =="
|
|
uci set network.$IFACE.mtu='1280'
|
|
bounce
|
|
}
|
|
|
|
do_rpfilter() {
|
|
echo "== persist loose rp_filter (=2) so multi-WAN policy-routed mgmt isn't dropped =="
|
|
grep -q 'busrouter: loose reverse-path' /etc/sysctl.conf 2>/dev/null || cat >> /etc/sysctl.conf <<'EOF'
|
|
# busrouter: loose reverse-path filtering for multi-WAN WG mgmt failover
|
|
net.ipv4.conf.all.rp_filter=2
|
|
net.ipv4.conf.default.rp_filter=2
|
|
EOF
|
|
# apply now
|
|
sysctl -w net.ipv4.conf.all.rp_filter=2 >/dev/null
|
|
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 2 > "$f"; done
|
|
# re-assert on WAN flaps (GL DHCP hooks may re-tighten per-iface)
|
|
mkdir -p /etc/hotplug.d/iface
|
|
cat > /etc/hotplug.d/iface/99-busrouter-rpfilter <<'EOF'
|
|
#!/bin/sh
|
|
[ "$ACTION" = ifup ] || exit 0
|
|
for f in /proc/sys/net/ipv4/conf/*/rp_filter; do echo 2 > "$f" 2>/dev/null; done
|
|
EOF
|
|
chmod +x /etc/hotplug.d/iface/99-busrouter-rpfilter
|
|
echo " rp_filter now: all=$(cat /proc/sys/net/ipv4/conf/all/rp_filter)"
|
|
}
|
|
|
|
case "$1" in
|
|
keepalive) do_keepalive ;;
|
|
mtu) do_mtu ;;
|
|
rpfilter) do_rpfilter ;;
|
|
all) do_keepalive; do_mtu; do_rpfilter ;;
|
|
*) echo "usage: $0 {keepalive|mtu|rpfilter|all}"; exit 2 ;;
|
|
esac
|
|
|
|
echo
|
|
echo ">> Now verify: ping -c3 -W2 -I 10.88.0.2 10.88.0.1 (replies = mgmt tunnel healthy)"
|