Порты Ubuntu в Oracle Cloud

[dnstkrv]

Доброго дня. Не специалист ни разу, мучаюсь третий день. Есть alwaysFree VPS Oracle, стоит WireGuard, не подключаются к нему клиенты. В Security List в настройках VPS уже открыто все и во все стороны https://prnt.sc/1sj7px0

root@instance-20210916-0948:/home/ubuntu# iptables-save

(Нажмите, чтобы показать/скрыть)

Код: [Выделить]

# Generated by iptables-save v1.8.4 on Fri Sep 17 07:17:26 2021
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:InstanceServices - [0:0]
:f2b-sshd - [0:0]
:ufw-after-forward - [0:0]
:ufw-after-input - [0:0]
:ufw-after-logging-forward - [0:0]
:ufw-after-logging-input - [0:0]
:ufw-after-logging-output - [0:0]
:ufw-after-output - [0:0]
:ufw-before-forward - [0:0]
:ufw-before-input - [0:0]
:ufw-before-logging-forward - [0:0]
:ufw-before-logging-input - [0:0]
:ufw-before-logging-output - [0:0]
:ufw-before-output - [0:0]
:ufw-logging-allow - [0:0]
:ufw-logging-deny - [0:0]
:ufw-not-local - [0:0]
:ufw-reject-forward - [0:0]
:ufw-reject-input - [0:0]
:ufw-reject-output - [0:0]
:ufw-skip-to-policy-forward - [0:0]
:ufw-skip-to-policy-input - [0:0]
:ufw-skip-to-policy-output - [0:0]
:ufw-track-forward - [0:0]
:ufw-track-input - [0:0]
:ufw-track-output - [0:0]
:ufw-user-forward - [0:0]
:ufw-user-input - [0:0]
:ufw-user-limit - [0:0]
:ufw-user-limit-accept - [0:0]
:ufw-user-logging-forward - [0:0]
:ufw-user-logging-input - [0:0]
:ufw-user-logging-output - [0:0]
:ufw-user-output - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol none -j DROP
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p udp -m multiport --dports 500,4500 -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -m policy --dir in --pol ipsec -j ACCEPT
-A INPUT -p udp -m udp --dport 1701 -j DROP
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p udp -m udp --sport 123 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -j ufw-before-logging-input
-A INPUT -j ufw-before-input
-A INPUT -j ufw-after-input
-A INPUT -j ufw-after-logging-input
-A INPUT -j ufw-reject-input
-A INPUT -j ufw-track-input
-A FORWARD -m conntrack --ctstate INVALID -j DROP
-A FORWARD -i ens3 -o ppp+ -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i ppp+ -o ens3 -j ACCEPT
-A FORWARD -i ppp+ -o ppp+ -j ACCEPT
-A FORWARD -d 192.168.43.0/24 -i ens3 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -s 192.168.43.0/24 -o ens3 -j ACCEPT
-A FORWARD -s 192.168.43.0/24 -o ppp+ -j ACCEPT
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j ufw-before-logging-forward
-A FORWARD -j ufw-before-forward
-A FORWARD -j ufw-after-forward
-A FORWARD -j ufw-after-logging-forward
-A FORWARD -j ufw-reject-forward
-A FORWARD -j ufw-track-forward
-A FORWARD -i ens3 -o wg0 -j ACCEPT
-A FORWARD -i wg0 -j ACCEPT
-A FORWARD -j DROP
-A FORWARD -i ens3 -o wg0 -j ACCEPT
-A FORWARD -i wg0 -j ACCEPT
-A OUTPUT -d 169.254.0.0/16 -j InstanceServices
-A OUTPUT -j ufw-before-logging-output
-A OUTPUT -j ufw-before-output
-A OUTPUT -j ufw-after-output
-A OUTPUT -j ufw-after-logging-output
-A OUTPUT -j ufw-reject-output
-A OUTPUT -j ufw-track-output
-A InstanceServices -d 169.254.0.2/32 -p tcp -m owner --uid-owner 0 -m tcp --dport 3260 -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j ACCEPT
-A InstanceServices -d 169.254.2.0/24 -p tcp -m owner --uid-owner 0 -m tcp --dport 3260 -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j ACCEPT
-A InstanceServices -d 169.254.4.0/24 -p tcp -m owner --uid-owner 0 -m tcp --dport 3260 -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j ACCEPT
-A InstanceServices -d 169.254.5.0/24 -p tcp -m owner --uid-owner 0 -m tcp --dport 3260 -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j ACCEPT
-A InstanceServices -d 169.254.0.2/32 -p tcp -m tcp --dport 80 -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j ACCEPT
-A InstanceServices -d 169.254.169.254/32 -p udp -m udp --dport 53 -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j ACCEPT
-A InstanceServices -d 169.254.169.254/32 -p tcp -m tcp --dport 53 -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j ACCEPT
-A InstanceServices -d 169.254.0.3/32 -p tcp -m owner --uid-owner 0 -m tcp --dport 80 -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j ACCEPT
-A InstanceServices -d 169.254.0.4/32 -p tcp -m tcp --dport 80 -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j ACCEPT
-A InstanceServices -d 169.254.169.254/32 -p tcp -m tcp --dport 80 -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j ACCEPT
-A InstanceServices -d 169.254.169.254/32 -p udp -m udp --dport 67 -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j ACCEPT
-A InstanceServices -d 169.254.169.254/32 -p udp -m udp --dport 69 -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j ACCEPT
-A InstanceServices -d 169.254.169.254/32 -p udp -m udp --dport 123 -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j ACCEPT
-A InstanceServices -d 169.254.0.0/16 -p tcp -m tcp -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j REJECT --reject-with tcp-reset
-A InstanceServices -d 169.254.0.0/16 -p udp -m udp -m comment --comment "See the Oracle-Provided Images section in the Oracle Cloud Infrastructure documentation for security impact of modifying or removing this rule" -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -j RETURN
-A ufw-after-input -p udp -m udp --dport 137 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 138 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 139 -j ufw-skip-to-policy-input
-A ufw-after-input -p tcp -m tcp --dport 445 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 67 -j ufw-skip-to-policy-input
-A ufw-after-input -p udp -m udp --dport 68 -j ufw-skip-to-policy-input
-A ufw-after-input -m addrtype --dst-type BROADCAST -j ufw-skip-to-policy-input
-A ufw-after-logging-forward -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-after-logging-input -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A ufw-before-forward -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ufw-before-forward -j ufw-user-forward
-A ufw-before-input -i lo -j ACCEPT
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP
-A ufw-before-input -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 11 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 12 -j ACCEPT
-A ufw-before-input -p icmp -m icmp --icmp-type 8 -j ACCEPT
-A ufw-before-input -p udp -m udp --sport 67 --dport 68 -j ACCEPT
-A ufw-before-input -j ufw-not-local
-A ufw-before-input -d 224.0.0.251/32 -p udp -m udp --dport 5353 -j ACCEPT
-A ufw-before-input -d 239.255.255.250/32 -p udp -m udp --dport 1900 -j ACCEPT
-A ufw-before-input -j ufw-user-input
-A ufw-before-output -o lo -j ACCEPT
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A ufw-before-output -j ufw-user-output
-A ufw-logging-allow -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW ALLOW] "
-A ufw-logging-deny -m conntrack --ctstate INVALID -m limit --limit 3/min --limit-burst 10 -j RETURN
-A ufw-logging-deny -m limit --limit 3/min --limit-burst 10 -j LOG --log-prefix "[UFW BLOCK] "
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny
-A ufw-not-local -j DROP
-A ufw-skip-to-policy-forward -j DROP
-A ufw-skip-to-policy-input -j DROP
-A ufw-skip-to-policy-output -j ACCEPT
-A ufw-track-output -p tcp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-track-output -p udp -m conntrack --ctstate NEW -j ACCEPT
-A ufw-user-input -p tcp -m tcp --dport 22 -j ACCEPT
-A ufw-user-input -p udp -m udp --dport 53350 -j ACCEPT
-A ufw-user-limit -m limit --limit 3/min -j LOG --log-prefix "[UFW LIMIT BLOCK] "
-A ufw-user-limit -j REJECT --reject-with icmp-port-unreachable
-A ufw-user-limit-accept -j ACCEPT
COMMIT
# Completed on Fri Sep 17 07:17:26 2021
# Generated by iptables-save v1.8.4 on Fri Sep 17 07:17:26 2021
*nat
:PREROUTING ACCEPT [2041:91523]
:INPUT ACCEPT [6:252]
:OUTPUT ACCEPT [3113:140887]
:POSTROUTING ACCEPT [1041:47424]
-A POSTROUTING -s 192.168.42.0/24 -o ens3 -j MASQUERADE
-A POSTROUTING -s 192.168.43.0/24 -o ens3 -m policy --dir out --pol none -j MASQUERADE
-A POSTROUTING -o ens3 -j MASQUERADE
-A POSTROUTING -o ens3 -j MASQUERADE
COMMIT
# Completed on Fri Sep 17 07:17:26 2021

root@instance-20210916-0948:/home/ubuntu# nmap localhost             

(Нажмите, чтобы показать/скрыть)

Код: [Выделить]

      Starting Nmap 7.80 ( https://nmap.org ) at 2021-09-17 07:25 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000060s latency).
Not shown: 998 closed ports
PORT    STATE SERVICE
22/tcp  open  ssh
111/tcp open  rpcbind

Nmap done: 1 IP address (1 host up) scanned in 0.13 second

root@instance-20210916-0948:/home/ubuntu# nmap 140.238.220.210           

(Нажмите, чтобы показать/скрыть)

Код: [Выделить]

       Starting Nmap 7.80 ( https://nmap.org ) at 2021-09-17 07:27 UTC
Nmap scan report for 140.238.220.210
Host is up (0.00028s latency).
Not shown: 999 filtered ports
PORT   STATE SERVICE
22/tcp open  ssh

Nmap done: 1 IP address (1 host up) scanned in 5.19 seconds

Подскажите, куда копать?

[ALiEN]

c сервера:

Код: [Выделить]

sudo ss -ulpn
journalctl -eu wg-quick@XXX.serviceXXX - поменять на интерфейс wireguard

Пользователь добавил сообщение 17 Сентября 2021, 15:33:42:

nmap localhost

Код: [Выделить]

nmap -sU localhost

[dnstkrv]

root@instance-20210916-0948:/home/ubuntu# sudo ss -ulpn

(Нажмите, чтобы показать/скрыть)

Код: [Выделить]

State    Recv-Q   Send-Q          Local Address:Port        Peer Address:Port                                                                                                                                                                Process
UNCONN   0        0               127.0.0.53%lo:53               0.0.0.0:*                                                                                                                                                                    users:(("systemd-resolve",pid=709,fd=12))
UNCONN   0        0           172.31.254.3%ens3:68               0.0.0.0:*                                                                                                                                                                    users:(("systemd-network",pid=707,fd=20))
UNCONN   0        0                     0.0.0.0:51820            0.0.0.0:*                                                                                                                                                                   
UNCONN   0        0                     0.0.0.0:111              0.0.0.0:*                                                                                                                                                                    users:(("rpcbind",pid=641,fd=5),("systemd",pid=1,fd=36))
UNCONN   0        0                     0.0.0.0:1701             0.0.0.0:*                                                                                                                                                                    users:(("xl2tpd",pid=2009,fd=3))
UNCONN   0        0                   127.0.0.1:4500             0.0.0.0:*                                                                                                                                                                    users:(("pluto",pid=1990,fd=20))
UNCONN   0        0                172.31.254.3:4500             0.0.0.0:*                                                                                                                                                                    users:(("pluto",pid=1990,fd=18))
UNCONN   0        0                  10.66.66.1:4500             0.0.0.0:*                                                                                                                                                                    users:(("pluto",pid=1990,fd=16))
UNCONN   0        0                   127.0.0.1:500              0.0.0.0:*                                                                                                                                                                    users:(("pluto",pid=1990,fd=19))
UNCONN   0        0                172.31.254.3:500              0.0.0.0:*                                                                                                                                                                    users:(("pluto",pid=1990,fd=17))
UNCONN   0        0                  10.66.66.1:500              0.0.0.0:*                                                                                                                                                                    users:(("pluto",pid=1990,fd=15))
UNCONN   0        0                        [::]:51820               [::]:*                                                                                                                                                                   
UNCONN   0        0                        [::]:111                 [::]:*                                                                                                                                                                    users:(("rpcbind",pid=641,fd=7),("systemd",pid=1,fd=38))
UNCONN   0        0             [fd42:42:42::1]:500                 [::]:*                                                                                                                                                                    users:(("pluto",pid=1990,fd=22))
UNCONN   0        0                       [::1]:500                 [::]:*                                                                                                                                                                    users:(("pluto",pid=1990,fd=21))

root@instance-20210916-0948:/home/ubuntu# journalctl -eu wg-quick@wg0.service

(Нажмите, чтобы показать/скрыть)

Код: [Выделить]

Sep 16 07:51:34 instance-20210916-0948 systemd[1]: Stopped WireGuard via wg-qui>
Sep 16 07:52:30 instance-20210916-0948 systemd[1]: Starting WireGuard via wg-qu>
Sep 16 07:52:30 instance-20210916-0948 wg-quick[35979]: [#] ip link add wg0 typ>
Sep 16 07:52:30 instance-20210916-0948 wg-quick[35979]: [#] wg setconf wg0 /dev>
Sep 16 07:52:30 instance-20210916-0948 wg-quick[35979]: [#] ip -4 address add 1>
Sep 16 07:52:30 instance-20210916-0948 wg-quick[35979]: [#] ip -6 address add f>
Sep 16 07:52:30 instance-20210916-0948 wg-quick[35979]: [#] ip link set mtu 892>
Sep 16 07:52:30 instance-20210916-0948 wg-quick[35979]: [#] iptables -A FORWARD>
Sep 16 07:52:30 instance-20210916-0948 systemd[1]: Finished WireGuard via wg-qu>
Sep 17 07:06:15 instance-20210916-0948 systemd[1]: Stopping WireGuard via wg-qu>
Sep 17 07:06:15 instance-20210916-0948 wg-quick[54866]: [#] ip link delete dev >
Sep 17 07:06:16 instance-20210916-0948 wg-quick[54866]: [#] iptables -D FORWARD>
Sep 17 07:06:16 instance-20210916-0948 systemd[1]: wg-quick@wg0.service: Succee>
Sep 17 07:06:16 instance-20210916-0948 systemd[1]: Stopped WireGuard via wg-qui>
-- Reboot --
Sep 17 07:06:48 instance-20210916-0948 systemd[1]: Starting WireGuard via wg-qu>
Sep 17 07:06:49 instance-20210916-0948 wg-quick[942]: [#] ip link add wg0 type >
Sep 17 07:06:49 instance-20210916-0948 wg-quick[942]: [#] wg setconf wg0 /dev/f>
Sep 17 07:06:49 instance-20210916-0948 wg-quick[942]: [#] ip -4 address add 10.>
Sep 17 07:06:49 instance-20210916-0948 wg-quick[942]: [#] ip -6 address add fd4>
Sep 17 07:06:50 instance-20210916-0948 wg-quick[942]: [#] ip link set mtu 8920 >
Sep 17 07:06:50 instance-20210916-0948 wg-quick[942]: [#] iptables -A FORWARD ->
Sep 17 07:06:50 instance-20210916-0948 systemd[1]: Finished WireGuard via wg-qu>
lines 14-36/36 (END)
Sep 16 07:51:34 instance-20210916-0948 systemd[1]: Stopped WireGuard via wg-quick(8) for wg0.
Sep 16 07:52:30 instance-20210916-0948 systemd[1]: Starting WireGuard via wg-quick(8) for wg0...
Sep 16 07:52:30 instance-20210916-0948 wg-quick[35979]: [#] ip link add wg0 type wireguard
Sep 16 07:52:30 instance-20210916-0948 wg-quick[35979]: [#] wg setconf wg0 /dev/fd/63
Sep 16 07:52:30 instance-20210916-0948 wg-quick[35979]: [#] ip -4 address add 10.66.66.1/24 dev wg0
Sep 16 07:52:30 instance-20210916-0948 wg-quick[35979]: [#] ip -6 address add fd42:42:42::1/64 dev wg0
Sep 16 07:52:30 instance-20210916-0948 wg-quick[35979]: [#] ip link set mtu 8920 up dev wg0
Sep 16 07:52:30 instance-20210916-0948 wg-quick[35979]: [#] iptables -A FORWARD -i ens3 -o wg0 -j ACCEPT; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT;>
Sep 16 07:52:30 instance-20210916-0948 systemd[1]: Finished WireGuard via wg-quick(8) for wg0.
Sep 17 07:06:15 instance-20210916-0948 systemd[1]: Stopping WireGuard via wg-quick(8) for wg0...
Sep 17 07:06:15 instance-20210916-0948 wg-quick[54866]: [#] ip link delete dev wg0
Sep 17 07:06:16 instance-20210916-0948 wg-quick[54866]: [#] iptables -D FORWARD -i ens3 -o wg0 -j ACCEPT; iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT;>
Sep 17 07:06:16 instance-20210916-0948 systemd[1]: wg-quick@wg0.service: Succeeded.
Sep 17 07:06:16 instance-20210916-0948 systemd[1]: Stopped WireGuard via wg-quick(8) for wg0.
-- Reboot --
Sep 17 07:06:48 instance-20210916-0948 systemd[1]: Starting WireGuard via wg-quick(8) for wg0...
Sep 17 07:06:49 instance-20210916-0948 wg-quick[942]: [#] ip link add wg0 type wireguard
Sep 17 07:06:49 instance-20210916-0948 wg-quick[942]: [#] wg setconf wg0 /dev/fd/63
Sep 17 07:06:49 instance-20210916-0948 wg-quick[942]: [#] ip -4 address add 10.66.66.1/24 dev wg0
Sep 17 07:06:49 instance-20210916-0948 wg-quick[942]: [#] ip -6 address add fd42:42:42::1/64 dev wg0
Sep 17 07:06:50 instance-20210916-0948 wg-quick[942]: [#] ip link set mtu 8920 up dev wg0
Sep 17 07:06:50 instance-20210916-0948 wg-quick[942]: [#] iptables -A FORWARD -i ens3 -o wg0 -j ACCEPT; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; i>
Sep 17 07:06:50 instance-20210916-0948 systemd[1]: Finished WireGuard via wg-quick(8) for wg0.


root@instance-20210916-0948:/home/ubuntu# nmap -sU localhost

(Нажмите, чтобы показать/скрыть)

Код: [Выделить]

Starting Nmap 7.80 ( https://nmap.org ) at 2021-09-17 12:37 UTC
Nmap scan report for localhost (127.0.0.1)
Host is up (0.0000070s latency).
Not shown: 996 closed ports
PORT     STATE         SERVICE
111/udp  open          rpcbind
500/udp  open|filtered isakmp
1701/udp open|filtered L2TP
4500/udp open|filtered nat-t-ike

Nmap done: 1 IP address (1 host up) scanned in 1.31 seconds

[ALiEN]

C клиента

Код: [Выделить]

nmap -sU -p 51820 140.238.220.210       

[dnstkrv]

Результат

(Нажмите, чтобы показать/скрыть)

Starting Nmap 7.01 ( https://nmap.org ) at 2021-09-17 15:50 MSK
Nmap scan report for 140.238.220.210
Host is up (0.054s latency).
PORT STATE SERVICE
51820/udp open|filtered unknown

Nmap done: 1 IP address (1 host up) scanned in 1.08 seconds

[ALiEN]

dnstkrv, а клиент при подключении что за ошибку пишет?

[dnstkrv]

Ошибки как таковой нет, якобы подключается, но ответа нет
https://prnt.sc/1skejhx
На кинетике и на устройстве с iOS картина одинаковая. Кинетик настраивался через импорт конфига, iOS через qr при добавлении пира на сервере
https://prnt.sc/1skesi9

[ALiEN]

Насчёт keenetik и ios не подскажу.

Подключитесь из ubuntu.
Клиентский конфиг (допустим,wg0.conf) положить в /etc/wireguard/
и стартануть

Код: [Выделить]

wg-quick up wg0

[dnstkrv]

# wg-quick up wg0

(Нажмите, чтобы показать/скрыть)

Warning: `/etc/wireguard/wg0.conf' is world accessible

• ip link add wg0 type wireguard
• wg setconf wg0 /dev/fd/63
• ip -4 address add 10.66.66.10/32 dev wg0
• ip -6 address add fd42:42:42::10/128 dev wg0
• ip link set mtu 1420 up dev wg0
• resolvconf -a tun.wg0 -m 0 -x
• wg set wg0 fwmark 51820
• ip -6 route add ::/0 dev wg0 table 51820
• ip -6 rule add not fwmark 51820 table 51820
• ip -6 rule add table main suppress_prefixlength 0
• ip6tables-restore -n
• ip -4 route add 0.0.0.0/0 dev wg0 table 51820
• ip -4 rule add not fwmark 51820 table 51820
• ip -4 rule add table main suppress_prefixlength 0
• sysctl -q net.ipv4.conf.all.src_valid_mark=1
• iptables-restore -n

#ping 10.66.66.1

(Нажмите, чтобы показать/скрыть)

PING 10.66.66.1 (10.66.66.1) 56(84) bytes of data.

#ifconfig (оставил только интерфейс wg0)

(Нажмите, чтобы показать/скрыть)

wg0       Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
          inet addr:10.66.66.10  P-t-P:10.66.66.10  Mask:255.255.255.255
          inet6 addr: fd42:42:42::10/128 Scope:Общий
          UP POINTOPOINT RUNNING NOARP  MTU:1420  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:37 errors:0 dropped:670 overruns:0 carrier:0
          collisions:0 txqueuelen:1
          RX bytes:0 (0.0 B)  TX bytes:5476 (5.4 KB)

[ALiEN]

Версия Ubuntu? У ip a странный вывод

Вот у меня:

(Нажмите, чтобы показать/скрыть)

Код: [Выделить]

4: wg0: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1420 qdisc noqueue state UNKNOWN group default qlen 1000
    link/none
    inet 10.10.0.3/24 scope global wg0
       valid_lft forever preferred_lft forever

[dnstkrv]

Клиент Ubuntu 16.04.7 LTS

Код: [Выделить]

# sudo hping3 140.238.220.210 -2 -p 51820
HPING 140.238.220.210 (enp4s0 140.238.220.210): udp mode set, 28 headers + 0 data bytes
^C
--- 140.238.220.210 hping statistic ---
139 packets transmitted, 0 packets received, 100% packet loss
round-trip min/avg/max = 0.0/0.0/0.0 ms

Сервер Ubuntu 20.04.3 LTS

Код: [Выделить]

# tcpdump -n -i ens3 "port 51820"
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ens3, link-type EN10MB (Ethernet), capture size 262144 bytes
^C
0 packets captured
0 packets received by filter
0 packets dropped by kernel

[ALiEN]

Cкиньте конфиг сервера и клиента, только ключи затрите.

[dnstkrv]

Wg0

(Нажмите, чтобы показать/скрыть)

[Interface]
Address = 10.66.66.1/24,fd42:42:42::1/64
ListenPort = 51820
PrivateKey =
PostUp = iptables -A FORWARD -i ens3 -o wg0 -j ACCEPT; iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens3 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o ens3 -j MASQUERADE
PostDown = iptables -D FORWARD -i ens3 -o wg0 -j ACCEPT; iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens3 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o ens3 -j MASQUERADE

### Client dnstkv
[Peer]
PublicKey =
PresharedKey =
AllowedIPs = 10.66.66.2/32,fd42:42:42::2/128

### Client keenetic
[Peer]
PublicKey ==
PresharedKey =+L8Cn8cwXQw07M/7U9ygMvUk=
AllowedIPs = 10.66.66.10/32,fd42:42:42::10/128

Client

(Нажмите, чтобы показать/скрыть)

[Interface]
PrivateKey =
Address = 10.66.66.10/32,fd42:42:42::10/128
DNS = 8.8.8.8,94.140.15.15

[Peer]
PublicKey
Endpoint = 172.31.254.3:51820
AllowedIPs = 0.0.0.0/0,::/0

[ALiEN]

Endpoint = 172.31.254.3:51820

Это чей? Должен быть IP cервера c wireguard 140.238.220.210:51820

[dnstkrv]

Конфиг готовый с сервера сюда вложил, на клиенте руками меняю на внешний ip сервера 140.238.220.210:51820