From 2a946fe47bd0744dbe22e2e7eb604d814e58a46d Mon Sep 17 00:00:00 2001 From: Eric Chang Date: Wed, 7 Aug 2019 14:43:50 +0800 Subject: [PATCH] fix typo --- .../post/another-way-to-keep-ansible-log.md | 37 ++ ...-vpn-using-wireguard-in-two-edgerouters.md | 231 +++++++ public/404.html | 18 +- public/author/eric-chang/index.html | 315 ++++----- public/author/eric-chang/index.xml | 53 +- public/author/eric-chang/page/2/index.html | 312 ++++----- public/author/eric-chang/page/3/index.html | 272 +++++--- public/author/eric-chang/page/4/index.html | 391 +++++++++++ public/author/index.html | 20 +- public/author/index.xml | 2 +- public/categories/ansible/index.html | 102 ++- public/categories/ansible/index.xml | 24 +- public/categories/index.html | 22 +- public/categories/index.xml | 6 +- public/categories/linux/index.html | 18 +- public/categories/proxmox/index.html | 18 +- public/categories/ps/index.html | 18 +- public/categories/碎念/index.html | 18 +- public/categories/筆記/index.html | 190 +++--- public/categories/筆記/index.xml | 31 +- public/categories/筆記/page/2/index.html | 188 +++--- public/categories/筆記/page/3/index.html | 109 ++- public/categories/群暉/index.html | 18 +- public/gallery/index.html | 18 +- public/gallery/sammy93/index.html | 18 +- public/index.html | 315 ++++----- public/index.json | 14 + public/index.xml | 53 +- public/page/2/index.html | 312 ++++----- public/page/3/index.html | 278 +++++--- public/page/4/index.html | 397 +++++++++++ .../index.html | 18 +- .../index.html | 424 ++++++++++++ .../index.html | 18 +- .../post/ansible-selectattr-filter/index.html | 18 +- .../index.html | 18 +- public/post/ansible-selectattr/index.html | 18 +- public/post/bookstack-docker/index.html | 18 +- .../index.html | 18 +- .../post/change-timezone-in-docker/index.html | 18 +- .../post/command_to_test_main_ssl/index.html | 18 +- public/post/copy_role_in_pgsql/index.html | 18 +- .../index.html | 18 +- .../enable-synology-public-ssh/index.html | 18 +- .../index.html | 18 +- .../incredibly-slow-mdadm-rebuild/index.html | 18 +- public/post/index.html | 315 ++++----- public/post/index.xml | 53 +- .../index.html | 18 +- .../index.html | 18 +- .../index.html | 18 +- .../index.html | 18 +- public/post/log-all-bash-commands/index.html | 18 +- .../post/nice-du-report-tool-durep/index.html | 18 +- public/post/page/2/index.html | 312 ++++----- public/post/page/3/index.html | 202 +++++- .../index.html | 18 +- .../index.html | 20 +- .../index.html | 619 ++++++++++++++++++ .../index.html | 18 +- .../synology-ds415-repair-cost/index.html | 18 +- .../transfer-cent62-using-rsync/index.html | 18 +- .../index.html | 18 +- .../index.html | 18 +- .../weird-client-server-connection/index.html | 18 +- public/sitemap.xml | 2 +- public/tags/10g/index.html | 18 +- public/tags/ansible/index.html | 102 ++- public/tags/ansible/index.xml | 24 +- public/tags/backup/index.html | 18 +- public/tags/bookstack/index.html | 18 +- public/tags/bsd/index.html | 18 +- public/tags/centos/index.html | 18 +- public/tags/docker/index.html | 18 +- public/tags/du/index.html | 18 +- public/tags/edgerouter/index.html | 414 ++++++++++++ public/tags/edgerouter/index.xml | 43 ++ public/tags/edgerouter/page/1/index.html | 1 + public/tags/firefox/index.html | 18 +- public/tags/freenas/index.html | 18 +- public/tags/index.html | 24 +- public/tags/index.xml | 20 +- public/tags/inventory/index.html | 18 +- public/tags/linux/index.html | 18 +- public/tags/log/index.html | 18 +- public/tags/mdadm/index.html | 18 +- public/tags/mellanox/index.html | 18 +- public/tags/meshcentral/index.html | 18 +- public/tags/metabase/index.html | 18 +- public/tags/nas/index.html | 18 +- public/tags/proxmox/index.html | 18 +- public/tags/ps/index.html | 18 +- public/tags/psql/index.html | 18 +- public/tags/pxe/index.html | 18 +- public/tags/raid/index.html | 18 +- public/tags/remote/index.html | 18 +- public/tags/ssh/index.html | 18 +- public/tags/synology/index.html | 18 +- public/tags/timezone/index.html | 18 +- public/tags/ubuntu/index.html | 18 +- public/tags/vim/index.html | 18 +- public/tags/vpn/index.html | 414 ++++++++++++ public/tags/vpn/index.xml | 43 ++ public/tags/vpn/page/1/index.html | 1 + public/tags/zfs/index.html | 18 +- public/tags/短今/index.html | 18 +- public/tags/筆記/index.html | 18 +- public/tags/群暉/index.html | 18 +- public/tw/sitemap.xml | 36 +- 109 files changed, 5955 insertions(+), 1994 deletions(-) create mode 100644 content/post/another-way-to-keep-ansible-log.md create mode 100644 content/post/site-to-site-vpn-using-wireguard-in-two-edgerouters.md create mode 100644 public/author/eric-chang/page/4/index.html create mode 100644 public/page/4/index.html create mode 100644 public/post/another-way-to-keep-ansible-log/index.html create mode 100644 public/post/site-to-site-vpn-using-wireguard-in-two-edgerouters/index.html create mode 100644 public/tags/edgerouter/index.html create mode 100644 public/tags/edgerouter/index.xml create mode 100644 public/tags/edgerouter/page/1/index.html create mode 100644 public/tags/vpn/index.html create mode 100644 public/tags/vpn/index.xml create mode 100644 public/tags/vpn/page/1/index.html diff --git a/content/post/another-way-to-keep-ansible-log.md b/content/post/another-way-to-keep-ansible-log.md new file mode 100644 index 00000000..655786de --- /dev/null +++ b/content/post/another-way-to-keep-ansible-log.md @@ -0,0 +1,37 @@ +--- +title: "[筆記] 為了保存log 用script 指令執行ansible / Another Way to Keep Ansible Log using script command" +date: 2019-08-05T16:24:40+08:00 +noSummary: false +featuredImage: "https://h.cowbay.org/images/post-default-10.jpg" +categories: ['ansible'] +tags: ['ansible'] +author: "Eric Chang" +--- + +之前為了能夠在執行完 ansible playbook 後，能有個log 可以看 + +所以在每次執行的時候，都要加入 tee 的指令 + +像是 +``` +ANSIBLE_CONFIG=/home/D/ansiblecontrol/ansible.cfg /usr/local/bin/ansible-playbook /home/D/ansiblecontrol/playbook.user_client.yml --vault-password-file=/home/D/ansiblecontrol/vault.passwd -i /home/D/ansiblecontrol/inventory/production -f1 --limit tyuserclients |tee /tmp/tyuserclients.log +``` + +一直都是放在crontab 裡面執行，也就沒有去管他 + +反正也沒有人關心結果怎樣 (攤手 + + + +後來發現有個指令叫 script 可以完整紀錄指令執行期間的console 畫面變化(包含了ansi color!) + +剛剛測試了一下，發現的確是可以用，不過也沒感覺有特別好用的地方，就只是做個紀錄吧，說不定以後其他地方可以用得到 + +``` +sciprt -c 'make EXTRA_ARGS="-i inventory/production --limit hqpc074" user_client' -f hqpc074.out' +``` +結果長這樣 +![](https://i.imgur.com/F9KFAWV.png) + +就真的跟console 的畫面一樣 + diff --git a/content/post/site-to-site-vpn-using-wireguard-in-two-edgerouters.md b/content/post/site-to-site-vpn-using-wireguard-in-two-edgerouters.md new file mode 100644 index 00000000..f89d093b --- /dev/null +++ b/content/post/site-to-site-vpn-using-wireguard-in-two-edgerouters.md @@ -0,0 +1,231 @@ +--- +title: "[筆記] 在edgerouter上用wireguard 建立site to site VPN / Site to Site Vpn Using Wireguard in Two Edgerouters" +date: 2019-08-06T17:14:17+08:00 +noSummary: false +featuredImage: "https://h.cowbay.org/images/post-default-5.jpg" +categories: ['筆記'] +tags: ['vpn','edgerouter'] +author: "Eric Chang" +--- + +之前總部和分公司之間 是用buffalo 的小AP 灌 openwrt + +然後用strongswan 來打 IPSEC site to site VPN + +config 看起來不是很難 (只是看起來) + +但是實際上已經找不到當初的文件 + +所以要維護很困難(光那些RSA KEY 就不知道為何、如何產生) + +後來採購了兩台edgerouter X 做測試 + +也用openvpn 成功的建立了 site to site VPN + +本來想說 openvpn 已經夠簡單了 + +今天看到文章說用wireguard 可以更簡單 + +於是研究了一下，發現還真的很簡單！ + + +### download deb for your edgerouter +#### go check https://github.com/Lochnair/vyatta-wireguard first + +``` +curl -L -O https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20190702-1/wireguard-v2.0-e50-0.0.20190702-1.deb +dpkg -i wireguard-v2.0-e50-0.0.20190702-1.deb +``` + +process log + +``` +root@ubnt112:~# dpkg -i wireguard-v2.0-e50-0.0.20190702-1.deb +Selecting previously unselected package wireguard. +(Reading database ... 37024 files and directories currently installed.) +Preparing to unpack wireguard-v2.0-e50-0.0.20190702-1.deb ... +Adding 'diversion of /opt/vyatta/share/perl5/Vyatta/Interface.pm to /opt/vyatta/share/perl5/Vyatta/Interface.pm.vyatta by wireguard' +Adding 'diversion of /opt/vyatta/share/vyatta-cfg/templates/firewall/options/mss-clamp/interface-type/node.def to /opt/vyatta/share/vyatta-cfg/templates/firewall/options/mss-clamp/interface-type/node.def.vyatta by wireguard' +Unpacking wireguard (0.0.20190702-1) ... +Setting up wireguard (0.0.20190702-1) ... +``` + +#### generate private/public key in left router + +``` +wg genkey | tee /dev/tty | wg pubkey +``` + +first one in private key and the next one is public key of this router + +``` +QGAUHJSDFAdkfjskdjo1DP8H1NuLTrXH6kue6kphaQk/iAkc= +ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= +``` + +#### configure left site edgerouter + +``` +configure +set interfaces wireguard wg0 address 192.168.99.1/24 +set interfaces wireguard wg0 listen-port 51820 +set interfaces wireguard wg0 route-allowed-ips true +### paster your private key which was just been generate +set interfaces wireguard wg0 private-key QGAUHJSDFAdkfjskdjo1DP8H1NuLTrXH6kue6kphaQk/iAkc= +``` + +#### generate private/public key in right router +``` +wg genkey | tee /dev/tty | wg pubkey +``` + +first one in private key and the next one is public key of this router + +``` +UBzmPabcdefghijklmnopqrlbi5tnsQqjoJ4+H4= +tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= +``` + +#### configure right site edgerouter +``` +configure +set interfaces wireguard wg0 address 192.168.99.2/24 +set interfaces wireguard wg0 listen-port 51820 +set interfaces wireguard wg0 route-allowed-ips true +### paster your private key which was just been generate +set interfaces wireguard wg0 private-key UBzmPabcdefghijklmnopqrlbi5tnsQqjoJ4+H4= +``` + +now , configure both router to talk to each other + +#### configure in left router +``` +### use the right router public key here +set interfaces wireguard wg0 peer tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= allowed-ips 192.168.99.0/16 +set interfaces wireguard wg0 peer tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= endpoint 222.222.222.222:51820 +set interfaces wireguard wg0 peer tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= persistent-keepalive 15 +``` + +#### configre in right router +``` +### use the left router public key here +set interfaces wireguard wg0 peer ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= allowed-ips 192.168.99.0/16 +set interfaces wireguard wg0 peer ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= endpoint 111.111.111.111:51280 +set interfaces wireguard wg0 peer ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= persistent-keepalive 15 +``` + +#### configure firewall policy in left site router +``` +### change 40 to your own rule number +set firewall name WAN_LOCAL rule 40 source port 51820 +set firewall name WAN_LOCAL rule 40 destination port 51820 +``` + +#### configure firewall policy in right site router +``` +### change 40 to your own rule number +set firewall name WAN_LOCAL rule 40 source port 51820 +set firewall name WAN_LOCAL rule 40 destination port 51820 +``` + +then finally , commit these changes on both side router +``` +commit +### and save if you want +save +``` + +#### oops , one more step , add static route +##### manually add static route in left router +``` +ip route add 192.168.111.0/24 dev wg0 +``` + +##### manually add static route in right router +``` +ip route add 192.168.112.0/24 dev wg0 +``` + +#### check wireguard status in both router +##### left +``` + root@ubnt112:~# sudo wg +interface: wg0 + public key: ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= + private key: (hidden) + listening port: 51820 + +peer: tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= + endpoint: 111.111.111.111:51820 + allowed ips: 192.168.99.0/16 + latest handshake: 1 minute, 19 seconds ago + transfer: 7.49 MiB received, 195.86 MiB sent + persistent keepalive: every 15 seconds +root@ubnt112:~# +``` + +##### right +``` +interface: wg0 + public key: tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= + private key: (hidden) + listening port: 51820 + +peer: ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= + endpoint: 222.222.222.222:51820 + allowed ips: 192.168.99.0/16 + latest handshake: 1 minute, 48 seconds ago + transfer: 195.60 MiB received, 8.07 MiB sent + persistent keepalive: every 15 seconds +root@ubnt111:~# +``` + +### need more edgerouter and lease line to try multiple site to site VPN using wideguard + +##### need to study about allowed-ips + +### sort out scripts +##### left router +``` +wg genkey | tee /dev/tty | wg pubkey +QGAUHJSDFAdkfjskdjo1DP8H1NuLTrXH6kue6kphaQk/iAkc= +ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= +configure +set interfaces wireguard wg0 address 192.168.99.1/24 +set interfaces wireguard wg0 listen-port 51820 +set interfaces wireguard wg0 route-allowed-ips true +set interfaces wireguard wg0 private-key QGAUHJSDFAdkfjskdjo1DP8H1NuLTrXH6kue6kphaQk/iAkc= +set interfaces wireguard wg0 peer tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= allowed-ips 192.168.99.0/16 +set interfaces wireguard wg0 peer tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= endpoint 222.222.222.222:51820 +set interfaces wireguard wg0 peer tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= persistent-keepalive 15 +set firewall name WAN_LOCAL rule 40 action accept +set firewall name WAN_LOCAL rule 40 protocol udp +set firewall name WAN_LOCAL rule 40 source port 51820 +set firewall name WAN_LOCAL rule 40 destination port 51820 +commit +save +ip route add 192.168.111.0/24 dev wg0 +``` +##### right router +``` +wg genkey | tee /dev/tty | wg pubkey +UBzmPabcdefghijklmnopqrlbi5tnsQqjoJ4+H4= +tmlrPSabcdefghijklmnopqrIb1Enzf+108yotkhdRmk= +configure +set interfaces wireguard wg0 address 192.168.99.2/24 +set interfaces wireguard wg0 listen-port 51820 +set interfaces wireguard wg0 route-allowed-ips true +set interfaces wireguard wg0 private-key UBzmPabcdefghijklmnopqrlbi5tnsQqjoJ4+H4= +set interfaces wireguard wg0 peer ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= allowed-ips 192.168.99.0/16 +set interfaces wireguard wg0 peer ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= endpoint 111.111.111.111:51280 +set interfaces wireguard wg0 peer ta+GJCWNUHJSDFAdkfjskdjnkppY5FpsIs3a8dc4oArtV8FU= persistent-keepalive 15 +set firewall name WAN_LOCAL rule 40 action accept +set firewall name WAN_LOCAL rule 40 protocol udp +set firewall name WAN_LOCAL rule 40 source port 51820 +set firewall name WAN_LOCAL rule 40 destination port 51820 +commit +save +ip route add 192.168.112.0/24 dev wg0 +``` + + diff --git a/public/404.html b/public/404.html index 65978739..79c9dc35 100644 --- a/public/404.html +++ b/public/404.html @@ -116,31 +116,31 @@ @@ -153,11 +153,11 @@