openwrt 的 wg0 接口推荐添加一个 wg0 的 firewall zone，然后 zone 里修改，允许转发到 lan(或者全部勾选上)。这个 zone 开 动态伪装 和 mss 。
死亡回环
如果你有 N 个局域网组网，假设 A 设备上 wg 能连到 B 局域网，然后你把 A 带到 B 的局域网内，只要 A 分配到了 B 局域网 IP ，默认路由和 A 上 wg 的路由都包含 B 的网段，你会抓包发现包发过去没有回应（也就是你无法网络上通到这个A设备，ssh啥的都不行）。避免这种办法有个优雅手段就是在 A 设备拿到 B 局域网之前提前准备好 hotplug。也可以用 fmark 避免这种问题。
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
cat > /etc/hotplug.d/iface/50-wg << 'EOF' #!/bin/sh if [ "ifup" = "$ACTION" ] && [ "$INTERFACE" = "wg0" ]; then # 设备在 192.168.101.0/24 网段内 wg 不代理 192.168.101.0/24，否则代理 192.168.101.0/24 if ip -4 a s | grep -Eq 192.168.101. && uci show network.@wireguard_wg0[0] | grep -Eq 192.168.101.0 ;then uci del_list network.@wireguard_wg0[0].allowed_ips='192.168.101.0/24' ip route delete 192.168.101.0/24 dev wg0 else uci add_list network.@wireguard_wg0[0].allowed_ips='192.168.101.0/24' ip route add 192.168.101.0/24 dev wg0 fi # 测了下 commit network 并不会触发 ifup wg从而死循环，所以上面临时操作下路由表 uci commit network fi EOF
windows的 wg 目前 Endpoint必须写本机的 ip（ipconfig命令查看），不能写127.0.0.1，否则无法连 peer（日志会一直刷Failed to send handshake initiation write udp4 0.0.0.0:xxx->127.0.0.1:16000: wsasendto: The requested address is not valid in its context），这个 bug 已经反馈给作者了。
udp2raw 的 client 连上 server 后，双方都会打印下面日志:
1 2 3 4
# server changed state to server_ready # client changed state from to client_handshake2 to client_ready
qos
但是也不是说你用了 udp2raw 就能百分之百能用，不同两个地方（或者说小区）俩 udpraw 使用同一个参数连云主机，可能一个能连一个不能连。比如你 A 和 B 同时 udp2raw 连你的云主机，A 可以 B 不可以，这种情况可以考虑换下 --raw-mode 和 --seq-mode ，有的可能 faketcp，有的可能 udp ，有的可能 icmp
usage: run as client : ./this_program -c -l local_listen_ip:local_port -r server_address:server_port [options] run as server : ./this_program -s -l server_listen_ip:server_port -r remote_address:remote_port [options]
common options,these options must be same on both side: --raw-mode <string> available values:faketcp(default),udp,icmp and easy-faketcp -k,--key <string> password to gen symetric key,default:"secret key" --cipher-mode <string> available values:aes128cfb,aes128cbc(default),xor,none --auth-mode <string> available values:hmac_sha1,md5(default),crc32,simple,none -a,--auto-rule auto add (and delete) iptables rule -g,--gen-rule generate iptables rule then exit,so that you can copy and add it manually.overrides -a --disable-anti-replay disable anti-replay,not suggested --fix-gro try to fix huge packet caused by GRO. this option is at an early stage. make sure client and server are at same version. client options: --source-ip <ip> force source-ip for raw socket --source-port <port> force source-port for raw socket,tcp/udp only this option disables port changing while re-connecting other options: --conf-file <string> read options from a configuration file instead of command line. check example.conf in repo for format --fifo <string> use a fifo(named pipe) for sending commands to the running program, check readme.md in repository for supported commands. --log-level <number> 0:never 1:fatal 2:error 3:warn 4:info (default) 5:debug 6:trace --log-position enable file name,function name,line number in log --disable-color disable log color --disable-bpf disable the kernel space filter,most time its not necessary unless you suspect there is a bug --dev <string> bind raw socket to a device, not necessary but improves performance --sock-buf <number> buf size for socket,>=10 and <=10240,unit:kbyte,default:1024 --force-sock-buf bypass system limitation while setting sock-buf --seq-mode <number> seq increase mode for faketcp: 0:static header,do not increase seq and ack_seq 1:increase seq for every packet,simply ack last seq 2:increase seq randomly, about every 3 packets,simply ack last seq 3:simulate an almost real seq/ack procedure(default) 4:similiar to 3,but do not consider TCP Option Window_Scale, maybe useful when firewall doesnt support TCP Option --lower-level <string> send packets at OSI level 2, format:'if_name#dest_mac_adress' ie:'eth0#00:23:45:67:89:b9'.or try '--lower-level auto' to obtain the parameter automatically,specify it manually if 'auto' failed --wait-lock wait for xtables lock while invoking iptables, need iptables v1.4.20+ --gen-add generate iptables rule and add it permanently,then exit.overrides -g --keep-rule monitor iptables and auto re-add if necessary.implys -a --hb-len <number> length of heart-beat packet, >=0 and <=1500 --mtu-warn <number> mtu warning threshold, unit:byte, default:1375 --clear clear any iptables rules added by this program.overrides everything --retry-on-error retry on error, allow to start udp2raw before network is initialized -h,--help print this help message
一个注意点
openwrt 上在接口 添加 wireguard 接口，然后 peer 那里的 ip 写 127.0.0.1(也就是openwrt上的udp2raw的ip)可能不行，换成 openwrt 的 局域网 ip 试下
