Search Results for ipv6 he net 路由自动 |

WireGuard wg-quick PostUp的高级玩法

真的很高级。 wg-quick是WireGuard用来启动网络设备的**脚本**。注意了，迄今为止，wg-quick是用bash写的一个脚本，不知道未来会不会变，至少目前shebang是

!#/bin/bash

1	!#/bin/bash

Incoming search terms:wireguard高级wireguard ipv6wireguard postupgroundr3mspellsndsituationzj2severalv9apond965partymdsorbitm41includecak4U5B点对多点wireguardgarageai8excepts9hconversationb3lcomposedfjachosenem5cardrruarticlerrqLink to this post!

SNIProxy Bind Outgoing Interface

这篇纯技术，没兴趣的别看。关于需求最早试图用路由器自带的功能去实现sni检测＋自动路由，结果发现edgerouter的dpi没开放太多资料。再又试图用squid去实现正向代理，绑定上行网络地址或者设备，虽然edgerouter自带squid以实现transparent proxy，但是自带版本SNI检测不支持（新版不知），绑定upstream的地址或者设备也没看到有人说支持。又考虑过haproxy，但是这个必须自己写backend（似乎可以haproxy + squid，没去实践过，至少haproxy的acl要写好长；而且这个组合里haproxy都可以直接被跳过，反正有DNAT也有DNS劫持）。从上边的方案思考过程，我觉得应该能看懂我想要什么。关于实现选用sniproxy，也算偶然。虽然之前vps上实验sni检测＋代理的时候，大概看了眼（但是最后还是选了haproxy）。不过最后选这个的重要原因就是好改 XD 官方github在https://github.com/dlundquist/sniproxy。先考虑的方案是，通过socket上联时绑定客户端IP。本身支持上行设置请求的源地址，大致实现代码在 connection.c：

    if (con->listener->source_address) {
        int on = 1;
        setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));

        int result = 0;
        int tries = 5;
        do {
            result = bind(sockfd,
                    address_sa(con->listener->source_address),
                    address_sa_len(con->listener->source_address));
        } while (tries-- > 0
                && result < 0
                && errno == EADDRINUSE
                && address_port(con->listener->source_address) == 0);
        if (result < 0) {
            err("bind failed: %s", strerror(errno));
            close(sockfd);
            abort_connection(con);
            return;
        }
    }

if (con->listener->source_address) {

int on = 1;

setsockopt(sockfd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));

int result = 0;

int tries = 5;

do {

result = bind(sockfd,

address_sa(con->listener->source_address),

address_sa_len(con->listener->source_address));

} while (tries-- > 0

&& result < 0

&& errno == EADDRINUSE

&& address_port(con->listener->source_address) == 0);

if (result < 0) {

err("bind failed: %s", strerror(errno));

close(sockfd);

abort_connection(con);

return;

}

但是经过试验，配置source address后，数据包还是会根据路由上的路由表跳到域名解析IP该走的那个网络。所以，这个方案是不满足我的要求的。如果绑定IP不行，那就试试绑定设备。绑定IP的方案的可行性，很早以前跟同学Windows下讨论一个客户端设计的时候验证过；但是绑定设备的，完全没搞过。现查。然后查到了 SO_BINDTODEVICE。 SO_BINDTODEVICE Bind this socket to a particular device like “eth0”, as specified in the passed interface name. If the name is an empty string or the option length is zero, … Continue reading “SNIProxy Bind Outgoing Interface”

TunnelBroker for EdgeRouter Lite

创建隧道在北京联通这种不给IPv6网络的ISP下生存，总有走v6翻墙的欲望。免费的Tunnel服务很多，最出名莫过HE.net的TunnelBroker 首先申请一个Tunnel。访问：

https://tunnelbroker.net/new_tunnel.php

1	https://tunnelbroker.net/new_tunnel.php

注册登录之后，创建并输入当前路由公网IP “YOUR.ROUTER.INTERNET.IP”。创建成功后会被跳转到

https://tunnelbroker.net/tunnel_detail.php?tid=XXXXX

1	https://tunnelbroker.net/tunnel_detail.php?tid=XXXXX

XXXXX的部分是一串数字，所谓的Tunnel ID. 在这个页面上选择第二个标签页 “Example Configurations” 选择 “Vyatta / Ubiquiti EdgeMAX” 文本框会自动生成如下配置：

configure
edit interfaces tunnel tun0
set encapsulation sit
set local-ip YOUR.ROUTER.INTERNET.IP
set remote-ip 74.82.46.6
set address 2001:470:23:XXXX::XX/64
set description "HE.NET IPv6 Tunnel"
exit
set protocols static interface-route6 ::/0 next-hop-interface tun0
commit

configure

edit interfaces tunnel tun0

set encapsulation sit

set local-ip YOUR.ROUTER.INTERNET.IP

set remote-ip 74.82.46.6

set address 2001:470:23:XXXX::XX/64

set description "HE.NET IPv6 Tunnel"

exit

set protocols static interface-route6 ::/0 next-hop-interface tun0

commit

remote-ip是创建时选择的远端服务器IP，local-ip是本地当前的出口IP。鉴于ISP给的IP都是动态的，所以local-ip改成如下‘0.0.0.0’。如果之前有配置过tunnel，需要重新配置，则先删除既有的：

delete interfaces tunnel tun0

1	delete interfaces tunnel tun0

下面开始命令配置tunnel

configure
# tun to ipv6
edit interfaces tunnel tun0
set encapsulation sit
set local-ip 0.0.0.0
set remote-ip 74.82.46.6
set address 2001:470:23:XXXX::XX/64
set description "HE.NET IPv6 Tunnel"
exit
set protocols static interface-route6 ::/0 next-hop-interface tun0
commit
save

configure

# tun to ipv6

edit interfaces tunnel tun0

set encapsulation sit

set local-ip 0.0.0.0

set remote-ip 74.82.46.6

set address 2001:470:23:XXXX::XX/64

set description "HE.NET IPv6 Tunnel"

exit

set protocols static interface-route6 ::/0 next-hop-interface tun0

commit

save

Router Advert 配置完tunnel，就得配局域网内的配置了，毕竟只有路由能上v6是不够的

interfaces {
    ethernet eth0 {               
        address 192.168.11.1/24   
        duplex auto               
        ipv6 {                    
            address {             
                autoconf           
            }                     
            dup-addr-detect-transmits 1
            router-advert {                        
                cur-hop-limit 64  
                link-mtu 0        
                managed-flag false
                max-interval 600  
                other-config-flag false
                prefix 2001:470:24:xxx::/64 {
                    autonomous-flag true
                    on-link-flag true       
                    valid-lifetime 2592000         
                }                 
                radvd-options "RDNSS 2001:470:20::2  {} ;"
                reachable-time 0  
                retrans-timer 0   
                send-advert true  
            }                     
        }                         
        speed auto                          
    } 
...
}

interfaces {

ethernet eth0 {

address 192.168.11.1/24

duplex auto

ipv6 {

address {

autoconf

}

dup-addr-detect-transmits 1

router-advert {

cur-hop-limit 64

link-mtu 0

managed-flag false

max-interval 600

other-config-flag false

prefix 2001:470:24:xxx::/64 {

autonomous-flag true

on-link-flag true

valid-lifetime 2592000

}

radvd-options "RDNSS 2001:470:20::2 {} ;"

reachable-time 0

retrans-timer 0

send-advert true

}

speed auto

}

...

}

如果你本地的DNS规则有过配置，radvd-options 的配置一定要把ipv6地址设成路由器的v6地址实践证明，我之前折腾了好久的dhcpv6没用，但是配置也可以贴出来

...
service { 
...                     
    dhcpv6-server {                              
        shared-network-name LAN_DEAD {   
            name-server 2001:4860:4860::8888
            name-server 2001:4860:4860::8844 
            subnet 2001:470:23:xxxx:dead::/80 {   
                address-range {         
                    start 2001:470:23:xxxx:dead::1000 {
                        stop 2001:470:23:xxxx:dead::8000
                    }                            
                }                       
                name-server 2001:4860:4860::8888 
                name-server 2001:4860:4860::8844
                prefix-delegation {              
                    start 2001:470:23:xxxx:dead::1000 {
                        prefix-length 80
                    }                  
                }                          
            }                           
        }                               
    }  
}

...

service {

...

dhcpv6-server {

shared-network-name LAN_DEAD {

name-server 2001:4860:4860::8888

name-server 2001:4860:4860::8844

subnet 2001:470:23:xxxx:dead::/80 {

address-range {

start 2001:470:23:xxxx:dead::1000 {

stop 2001:470:23:xxxx:dead::8000

}

name-server 2001:4860:4860::8888

name-server 2001:4860:4860::8844

prefix-delegation {

start 2001:470:23:xxxx:dead::1000 {

prefix-length 80

}

自动更新IP 之前一片EdgeRouter Lite相关的配置文章里，我把He.net提供的DDNS配置好了。Dynamic DNS on HE.net, HE.net Dynamic DNS on Ubiquiti Router. 脚本更新首先按如下路径生成ddns专用的key

TunnelBroker.net -> Tunnel Details -> Advanced -> Update Key

1	TunnelBroker.net -> Tunnel Details -> Advanced -> Update Key

尝试过好多次，EdgeRouter Lite无法通过配置参数添加多个同类型的ddns配置。所以先提供一个简单粗暴的方法。参考 https://forums.he.net/index.php?topic=1994.0 的说明，有如下的客户端语法： … Continue reading “TunnelBroker for EdgeRouter Lite”