From 2a2338fe82421b7f4eb450d4e1aeaad87d3ae57c Mon Sep 17 00:00:00 2001 From: Christoph Emsenhuber Date: Thu, 25 Jun 2026 20:55:28 +0200 Subject: [PATCH] =?UTF-8?q?TP10=20=F0=9F=94=90=20WG-Hub-Apply=20self-heali?= =?UTF-8?q?ng:=20Peers=20fm/dw=20mit=20Keys=20+=20Allowed-IPs=20gefixt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - peer1/peer2 → fm/dw umbenannt, public-keys explizit gesetzt (idempotent) - dw allowed-address auf 10.95.10.0/24 reduziert (192.168.178.0/24 raus → Dual-Address auf Gelis FB verhindert LAN-Kopplung) - zugehörige 192.168.178.0/24-Route entfernt, DW-Routenkommentar bereinigt Co-Authored-By: Claude Opus 4.8 --- routeros/tp10-cutover-apply.rsc | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/routeros/tp10-cutover-apply.rsc b/routeros/tp10-cutover-apply.rsc index 92d3cdb..9acede4 100644 --- a/routeros/tp10-cutover-apply.rsc +++ b/routeros/tp10-cutover-apply.rsc @@ -16,23 +16,24 @@ :log info "TP10-cutover: apply start" -# --- A) WireGuard-Hub: Peers säubern (Transfernetz raus) + scharf schalten -# peer1/FM: erreichbar (eigener myfritz-Endpoint, KEIN CGNAT) -> Endpoint setzen -# => bidirektional (ap1 ODER FM kann aufbauen). peer2/DW bleibt Dial-in (CGNAT, Endpoint leer). +# --- A) WireGuard-Hub: Peers mit korrekten Keys + Allowed-IPs (self-healing) +# fm: erreichbar (eigener myfritz-Endpoint, KEIN CGNAT) -> bidirektional. +# dw: CGNAT -> Dial-in (Endpoint leer). NUR 10.95.10.0/24 (Gelis FB sourct daraus; +# Dual-Address 192.168.178.1/24,10.95.10.1/24 auf der FB verhindert LAN-Kopplung). /interface/wireguard/peers -set [find where name="peer1"] allowed-address=10.101.0.0/24 \ +set [find where name="fm"] public-key="dzRY0lnnUygijChWe5wXZmXPeNcbdALpqBptA3fyiVE=" \ + allowed-address=10.101.0.0/24 \ endpoint-address=abxhutfgsid9snmy.myfritz.net endpoint-port=52476 disabled=no -set [find where name="peer2"] allowed-address=192.168.178.0/24,10.95.10.0/24 disabled=no +set [find where name="dw"] public-key="FqYZLztQ/qME5VDie5QLGH++5299WJiE1dPpQnPbzUw=" \ + allowed-address=10.95.10.0/24 disabled=no # --- B) Routen zu den Spoke-Netzen (Gateway = Interface wg-hub) # RouterOS leitet aus allowed-address KEINE Routen ab -> explizit. /ip/route :if ([:len [find where dst-address="10.101.0.0/24" gateway="wg-hub"]]=0) do={ \ add dst-address=10.101.0.0/24 gateway=wg-hub comment="TP10: FM spoke -> wg-hub" } -:if ([:len [find where dst-address="192.168.178.0/24" gateway="wg-hub"]]=0) do={ \ - add dst-address=192.168.178.0/24 gateway=wg-hub comment="TP10: DW spoke (heute) -> wg-hub" } :if ([:len [find where dst-address="10.95.10.0/24" gateway="wg-hub"]]=0) do={ \ - add dst-address=10.95.10.0/24 gateway=wg-hub comment="TP10: DW spoke (kuenftig) -> wg-hub" } + add dst-address=10.95.10.0/24 gateway=wg-hub comment="TP10: DW spoke -> wg-hub" } # --- C) Input-Chain abdichten (WAN-Seal). Reihenfolge oben->unten: # est/rel | drop invalid | [WG 51821 vorhanden] | dhcp68 | icmp | LAN | drop WAN