88 lines
2.5 KiB
Markdown
88 lines
2.5 KiB
Markdown
# WireGuard VPN — Eagle ↔ Kraken
|
||
|
||
> Создано: 2026-05-14
|
||
> Статус: ✅ работает
|
||
|
||
## Топология
|
||
|
||
```
|
||
Eagle (10.99.0.2) ←→ wg0 VPS (10.99.0.1) ←→ wg1 VPS (10.99.1.1) ←→ Kraken (10.99.1.2)
|
||
:51820 :51821
|
||
```
|
||
|
||
Два интерфейса на VPS чтобы избежать hairpin forwarding. FORWARD идёт wg0→wg1, SNAT меняет src Eagle на `10.99.1.1`.
|
||
|
||
---
|
||
|
||
## Адреса
|
||
|
||
| Узел | VPN IP |
|
||
|------|--------|
|
||
| VPS | 10.99.0.1 (wg0) / 10.99.1.1 (wg1) |
|
||
| Eagle | 10.99.0.2 |
|
||
| Kraken | 10.99.1.2 |
|
||
|
||
`kraken` резолвится через dnsmasq на VPS (DNS = 10.99.0.1 в конфиге Eagle).
|
||
|
||
---
|
||
|
||
## Персистентность
|
||
|
||
| Компонент | Узел | Как выживает ребут |
|
||
|-----------|------|--------------------|
|
||
| wg-quick@wg0 + wg-quick@wg1 | VPS | systemd enabled |
|
||
| PostUp FORWARD + SNAT | VPS | в `/etc/wireguard/wg0.conf` |
|
||
| nftables (10.99.0.0/16 forward) | VPS | `/etc/nftables.conf`, systemd enabled |
|
||
| dnsmasq (`kraken` → 10.99.1.2) | VPS | `/etc/dnsmasq.d/vpn-hosts.conf`, systemd enabled |
|
||
| wg-quick@wg0 | Kraken | systemd enabled |
|
||
| wg-auto LaunchDaemon | Eagle | `/Library/LaunchDaemons/top.eagle.wg-auto.plist` |
|
||
|
||
---
|
||
|
||
## Auto-connect на Eagle
|
||
|
||
`/usr/local/bin/wg-auto.sh` — следит за SSID через `WatchPaths` на `/Library/Preferences/SystemConfiguration/`:
|
||
- SSID == `ASUS5` → `wg-quick down` (дома, Kraken в локалке, туннель не нужен)
|
||
- SSID != `ASUS5` → `wg-quick up` (вне дома, TM через VPN)
|
||
|
||
---
|
||
|
||
## Time Machine
|
||
|
||
Destination обновлён:
|
||
- Старый: `smb://timemachine@kraken._smb._tcp.local./TimeMachine` (mDNS, не работает)
|
||
- Новый: `smb://timemachine@kraken/TimeMachine` (VPN DNS ✅)
|
||
|
||
Контейнер: `mbentley/timemachine:smb` на Кракене.
|
||
Расписание: 04:00–16:00 UTC (10:00–22:00 GMT+6), root crontab.
|
||
|
||
---
|
||
|
||
## Ключи
|
||
|
||
| Узел | Публичный ключ |
|
||
|------|---------------|
|
||
| VPS wg0 | `6W6hSw0JFLm0BbyeNp1g7wF7dKKTZmGvPRdir68mz0w=` |
|
||
| VPS wg1 | `ssRV2497NQ3Lfzvx/FLO0jDlcCXdK/RReJQ36i0yuR8=` |
|
||
| Eagle | `dDgIjBUNguodOHWoz7iFsImvKhteodHcFWM8mMe4UiE=` |
|
||
| Kraken | `8kIdCKMIoMsW09/aQX6+pU0SS/rN4PysJL59w17eGRg=` |
|
||
|
||
---
|
||
|
||
## Диагностика
|
||
|
||
```bash
|
||
# Eagle
|
||
sudo wg show
|
||
ping kraken
|
||
|
||
# VPS
|
||
ssh root@91.207.28.205 "wg show all"
|
||
|
||
# Kraken
|
||
ssh kraken-ssh "sudo wg show"
|
||
|
||
# Логи auto-connect Eagle
|
||
cat /var/log/wg-auto.log
|
||
```
|