admin/bf-infra
1
0
Fork 0
Code Issues 21 Pull Requests Actions Packages Projects Releases Wiki Activity

TP10 🔐 WG-Hub-Apply self-healing: Peers fm/dw mit Keys + Allowed-IPs gefixt

Browse Source 
- peer1/peer2 → fm/dw umbenannt, public-keys explizit gesetzt (idempotent)
- dw allowed-address auf 10.95.10.0/24 reduziert (192.168.178.0/24 raus →
  Dual-Address auf Gelis FB verhindert LAN-Kopplung)
- zugehörige 192.168.178.0/24-Route entfernt, DW-Routenkommentar bereinigt

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Christoph Emsenhuber
2026-06-25 20:55:28 +02:00
parent 963e3c5f9a
commit 2a2338fe82
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
routeros/tp10-cutover-apply.rsc
View File

@@ -16,23 +16,24 @@
:log info "TP10-cutover: apply start"
# --- A) WireGuard-Hub: Peers säubern (Transfernetz raus) + scharf schalten
# peer1/FM: erreichbar (eigener myfritz-Endpoint, KEIN CGNAT) -> Endpoint setzen
# => bidirektional (ap1 ODER FM kann aufbauen). peer2/DW bleibt Dial-in (CGNAT, Endpoint leer).
# --- A) WireGuard-Hub: Peers mit korrekten Keys + Allowed-IPs (self-healing)
# fm: erreichbar (eigener myfritz-Endpoint, KEIN CGNAT) -> bidirektional.
# dw: CGNAT -> Dial-in (Endpoint leer). NUR 10.95.10.0/24 (Gelis FB sourct daraus;
# Dual-Address 192.168.178.1/24,10.95.10.1/24 auf der FB verhindert LAN-Kopplung).
/interface/wireguard/peers
set [find where name="peer1"] allowed-address=10.101.0.0/24 \
set [find where name="fm"] public-key="dzRY0lnnUygijChWe5wXZmXPeNcbdALpqBptA3fyiVE=" \
allowed-address=10.101.0.0/24 \
endpoint-address=abxhutfgsid9snmy.myfritz.net endpoint-port=52476 disabled=no
set [find where name="peer2"] allowed-address=192.168.178.0/24,10.95.10.0/24 disabled=no
set [find where name="dw"] public-key="FqYZLztQ/qME5VDie5QLGH++5299WJiE1dPpQnPbzUw=" \
allowed-address=10.95.10.0/24 disabled=no
# --- B) Routen zu den Spoke-Netzen (Gateway = Interface wg-hub)
# RouterOS leitet aus allowed-address KEINE Routen ab -> explizit.
/ip/route
:if ([:len [find where dst-address="10.101.0.0/24" gateway="wg-hub"]]=0) do={ \
add dst-address=10.101.0.0/24 gateway=wg-hub comment="TP10: FM spoke -> wg-hub" }
:if ([:len [find where dst-address="192.168.178.0/24" gateway="wg-hub"]]=0) do={ \
add dst-address=192.168.178.0/24 gateway=wg-hub comment="TP10: DW spoke (heute) -> wg-hub" }
:if ([:len [find where dst-address="10.95.10.0/24" gateway="wg-hub"]]=0) do={ \
add dst-address=10.95.10.0/24 gateway=wg-hub comment="TP10: DW spoke (kuenftig) -> wg-hub" }
add dst-address=10.95.10.0/24 gateway=wg-hub comment="TP10: DW spoke -> wg-hub" }
# --- C) Input-Chain abdichten (WAN-Seal). Reihenfolge oben->unten:
# est/rel | drop invalid | [WG 51821 vorhanden] | dhcp68 | icmp | LAN | drop WAN