mirror of
https://github.com/bivlked/amneziawg-installer.git
synced 2026-07-09 17:29:19 +00:00
Release v5.18.1: --force port change, full-tunnel iOS ::/0, dual DNS, low ports
Bug-fix release. Four fixes plus documentation. - install --force --port=N now changes the server port (was silently ignored: the render re-read the old ListenPort). - full-tunnel clients get 0.0.0.0/0, ::/0 so AmneziaVPN on iOS accepts the all-traffic mode; manage regen upgrades non-customized clients too. - default client DNS is now the 1.1.1.1, 1.0.0.1 pair. - --port accepts ports 1-65535 (was 1024-65535) so 443/80/53 work for DPI evasion on mobile carriers. Docs: CHANGELOG, S3/S4 range fix, stale issue link cleanup, Ubuntu 26.04 in the subtitle, --force re-run FAQ, a mobile-port note. Live-tested on Debian 13 (x86_64) and Ubuntu 26.04 (ARM64, native IPv6).
This commit is contained in:
Ivan Bondarev
GitHub
parent
ed8945d54d
commit
702d3aff5b
17 changed files with 375 additions and 83 deletions
|
|
@ -233,7 +233,7 @@ Then re-import the new `.conf` on the device. A plain `regen` will not help here
|
|||
<a id="dns-adv"></a>
|
||||
### DNS
|
||||
|
||||
* **Default value:** `1.1.1.1` (Cloudflare).
|
||||
* **Default value:** `1.1.1.1, 1.0.0.1` (Cloudflare, primary + fallback).
|
||||
* DNS server for the client inside the VPN.
|
||||
* **Change:** `sudo bash /root/awg/manage_amneziawg.sh modify <name> DNS "8.8.8.8,1.0.0.1"`
|
||||
|
||||
|
|
@ -383,7 +383,7 @@ H4 = 4567890
|
|||
|
||||
Notes for manual setups:
|
||||
|
||||
- **S3/S4** are AWG 2.0 parameters added to the protocol later than S1/S2. Configs from the earlier AWG 1.x release may not have them — add by hand, any value in `0-127` works, the key point is that the keys exist at all.
|
||||
- **S3/S4** are AWG 2.0 parameters added to the protocol later than S1/S2. Configs from the earlier AWG 1.x release may not have them - add by hand, `S3` takes `0-64` and `S4` takes `0-32`, the key point is that the keys exist at all.
|
||||
- **H1–H4** can be single-value (`H1 = 1234567`) or a range (`H1 = 100000-200000`); ranges must not overlap. Keep the upper bound at `2147483647` (`INT32_MAX`) or below, otherwise `amneziawg-windows-client` may flag the value as invalid.
|
||||
- **I1-I5** (CPS / special-junk packets) are optional. Without `I1` the AWG client falls back to AWG 1.0 mode; for full AWG 2.0 obfuscation add `I1 = <r 128>` (random 128 bytes) or `I1 = <b 0xHEX>` (binary). Since v5.18.0 all five (`I1`-`I5`) are carried into client configs, not just `I1`: set `I2`-`I5` in the `[Interface]` section of `awg0.conf`, restart the service (`sudo systemctl restart awg-quick@awg0`), and distribute to clients with `sudo bash /root/awg/manage_amneziawg.sh regen <name>` - the values flow into the `.conf`, QR, and `vpn://`. Ready-made sets come from, e.g., the VoidWaifu list; tag formats: `<r N>`, `<b 0xHEX>`, `<c>`, `<t>`. The values must match on server and clients. Unset `I2`-`I5` are simply not emitted.
|
||||
- **MTU**, **PostUp/PostDown** are optional and depend on the setup (see the `amneziawg-go` LXC section on `iptables` MASQUERADE).
|
||||
|
|
@ -600,7 +600,7 @@ Client keys are stored in `/root/awg/keys/` (permissions 600). Server keys are i
|
|||
The installer downloads `awg_common.sh` and `manage_amneziawg.sh` from URLs pinned to the specific version tag:
|
||||
|
||||
```
|
||||
https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common.sh
|
||||
https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common.sh
|
||||
```
|
||||
|
||||
This provides **supply chain pinning**: downloaded scripts match the installer version, even if `main` has already been updated.
|
||||
|
|
@ -620,12 +620,12 @@ To update the management and shared library scripts **without reinstalling the s
|
|||
|
||||
```bash
|
||||
# Russian version:
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/manage_amneziawg.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common.sh
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/manage_amneziawg.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common.sh
|
||||
|
||||
# English version:
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/manage_amneziawg_en.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common_en.sh
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/manage_amneziawg_en.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common_en.sh
|
||||
|
||||
# Set permissions
|
||||
chmod 700 /root/awg/manage_amneziawg.sh /root/awg/awg_common.sh
|
||||
|
|
@ -1106,6 +1106,23 @@ The rule is applied automatically on install and reinstall (`--force`) for v5.17
|
|||
|
||||
> The MSS clamp only affects TCP. Video and QUIC/HTTP3 (UDP) are untouched: if that is the traffic that stalls, the cause is elsewhere - see the obfuscation parameters and carrier presets.
|
||||
|
||||
### Carrier blocks the port (no connection)
|
||||
|
||||
If the tunnel does not come up at all on cellular (the handshake never completes) while it works fine on Wi-Fi, the problem may be the port rather than the obfuscation. By default the server listens on UDP 39743; some carriers (MTS, for example) drop that non-standard UDP port but reliably pass `443/udp` - it looks like QUIC/HTTP3. In this case `--preset=mobile` does not help (it changes the traffic disguise, not the port).
|
||||
|
||||
Set the port at install time - `sudo bash install_amneziawg.sh --port=443 ...`. On an already running server, change the port without reinstalling:
|
||||
|
||||
```bash
|
||||
sudo sed -i 's/^ListenPort = .*/ListenPort = 443/' /etc/amnezia/amneziawg/awg0.conf
|
||||
sudo sed -i 's/^export AWG_PORT=.*/export AWG_PORT=443/' /root/awg/awgsetup_cfg.init
|
||||
sudo ufw allow 443/udp
|
||||
sudo systemctl restart awg-quick@awg0
|
||||
```
|
||||
|
||||
Then re-issue the client configs (`sudo bash /root/awg/manage_amneziawg.sh regen <name>`) - the new port lands in `Endpoint` - and re-import them on the devices. Port 443 also works on regular networks, so you can move all devices to it.
|
||||
|
||||
> If, on the other hand, the tunnel comes up but some sites (e.g. YouTube) do not open while the VPN is connected, the cause is usually not the port but the device's IPv6 going around the tunnel. See the [IPv6 in IPv4-only mode](#ipv6-tunnel-adv) section for the explanation and fix.
|
||||
|
||||
---
|
||||
|
||||
<a id="as-blocking-adv"></a>
|
||||
|
|
@ -1125,7 +1142,7 @@ The rule is applied automatically on install and reinstall (`--force`) for v5.17
|
|||
|
||||
Control: a tunnel to a server in a different AS (US) came up and held on all three ISPs, so in our test on Seven Sky it was Hetzner specifically that stayed unreachable, not VPN as such. On Seven Sky the block reproduced consistently, both evening and night, and the QUIC mimicry with two different SNIs did not lift it. In summary: 0ka's method does work, but not universally - the outcome depends on the ISP and the regional TSPU configuration.
|
||||
|
||||
**How to apply manually.** The installer does not yet generate the QUIC mimicry `I1` on its own (planned, [issue #71](https://github.com/bivlked/amneziawg-installer/issues/71)); for now it is a manual step:
|
||||
**How to apply manually.** The installer does not generate the QUIC mimicry `I1` on its own - this is a manual step:
|
||||
|
||||
1. Generate the `I1` string for your hoster in [Mini QUIC Generator](https://sageptr.github.io/mini_quic_generator/) (by SagePtr): enter the SNI (`7-zip.org` for Hetzner) and copy the value from the "AmneziaWG 1.5+ (I1 = )" field.
|
||||
2. Replace the `I1 = ...` line in the `[Interface]` section of the server config `/etc/amnezia/amneziawg/awg0.conf` (`I1`-`I5` are case-sensitive, uppercase only).
|
||||
|
|
|
|||
33
ADVANCED.md
33
ADVANCED.md
|
|
@ -231,7 +231,7 @@ sudo bash /root/awg/manage_amneziawg.sh add <имя>
|
|||
<a id="dns-adv"></a>
|
||||
### DNS
|
||||
|
||||
* **Значение по умолчанию:** `1.1.1.1` (Cloudflare).
|
||||
* **Значение по умолчанию:** `1.1.1.1, 1.0.0.1` (Cloudflare, основной + резервный).
|
||||
* DNS-сервер для клиента внутри VPN.
|
||||
* **Изменение:** `sudo bash /root/awg/manage_amneziawg.sh modify <имя> DNS "8.8.8.8,1.0.0.1"`
|
||||
|
||||
|
|
@ -381,7 +381,7 @@ H4 = 4567890
|
|||
|
||||
Нюансы для ручной установки:
|
||||
|
||||
- **S3/S4** — параметры AWG 2.0, добавлены в протокол позже S1/S2. В конфигах от предыдущих версий (AWG 1.x) их может не быть — надо дописать руками, значения любые в диапазоне 0-127, главное что вообще есть.
|
||||
- **S3/S4** - параметры AWG 2.0, добавлены в протокол позже S1/S2. В конфигах от предыдущих версий (AWG 1.x) их может не быть - надо дописать руками, значения: `S3` в диапазоне 0-64, `S4` в диапазоне 0-32, главное что вообще есть.
|
||||
- **H1–H4** могут быть single-value (`H1 = 1234567`) или range (`H1 = 100000-200000`), диапазоны не должны пересекаться. Безопасный верхний предел — 2147483647 (`INT32_MAX`), иначе `amneziawg-windows-client` может подсвечивать значения как invalid.
|
||||
- **I1-I5** (CPS / special-junk пакеты) опциональны. Без `I1` AWG-клиент работает в AWG 1.0 fallback режиме; для полной AWG 2.0 обфускации добавьте `I1 = <r 128>` (random 128 байт) или `I1 = <b 0xHEX>` (binary). С версии 5.18.0 в клиентские конфиги переносятся все пять (`I1`-`I5`), а не только `I1`: пропишите `I2`-`I5` в секции `[Interface]` файла `awg0.conf`, перезапустите сервис (`sudo systemctl restart awg-quick@awg0`) и раздайте клиентам через `sudo bash /root/awg/manage_amneziawg.sh regen <имя>` - значения разойдутся в `.conf`, QR и `vpn://`. Готовые наборы берут, например, из списка VoidWaifu; форматы тегов: `<r N>`, `<b 0xHEX>`, `<c>`, `<t>`. Значения обязаны совпадать на сервере и клиентах. Незаданные `I2`-`I5` просто не выводятся.
|
||||
- **MTU**, **PostUp/PostDown** — опциональны, зависят от сетапа (см. `amneziawg-go` секцию про iptables MASQUERADE в LXC).
|
||||
|
|
@ -598,7 +598,7 @@ graph TD
|
|||
Инсталлятор скачивает `awg_common.sh` и `manage_amneziawg.sh` с URL, привязанных к конкретному тегу версии:
|
||||
|
||||
```
|
||||
https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common.sh
|
||||
https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common.sh
|
||||
```
|
||||
|
||||
Это даёт **supply chain pinning**: скачиваемые скрипты соответствуют версии инсталлятора, даже если `main` уже обновлён.
|
||||
|
|
@ -618,12 +618,12 @@ AWG_BRANCH=my-feature-branch sudo bash ./install_amneziawg.sh
|
|||
|
||||
```bash
|
||||
# Русская версия:
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/manage_amneziawg.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common.sh
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/manage_amneziawg.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common.sh
|
||||
|
||||
# Английская версия:
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/manage_amneziawg_en.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common_en.sh
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/manage_amneziawg_en.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common_en.sh
|
||||
|
||||
# Установить права
|
||||
chmod 700 /root/awg/manage_amneziawg.sh /root/awg/awg_common.sh
|
||||
|
|
@ -1104,6 +1104,23 @@ sudo systemctl restart awg-quick@awg0
|
|||
|
||||
> MSS-clamp работает только для TCP. Видео и QUIC/HTTP3 (UDP) он не затрагивает: если тормозит именно такой трафик, причина в другом - смотрите параметры обфускации и операторские пресеты.
|
||||
|
||||
### Сотовый оператор режет порт (нет коннекта)
|
||||
|
||||
Если на мобильном интернете туннель вообще не поднимается (handshake не проходит), хотя на Wi-Fi всё работает, дело может быть в порте, а не в обфускации. По умолчанию сервер слушает UDP 39743; некоторые операторы (например, МТС) такой нестандартный UDP-порт глушат, но стабильно пропускают `443/udp` - он выглядит как QUIC/HTTP3. В этом случае `--preset=mobile` не помогает (он меняет маскировку трафика, а не порт).
|
||||
|
||||
При установке задайте порт сразу - `sudo bash install_amneziawg.sh --port=443 ...`. На уже работающем сервере смените порт без переустановки:
|
||||
|
||||
```bash
|
||||
sudo sed -i 's/^ListenPort = .*/ListenPort = 443/' /etc/amnezia/amneziawg/awg0.conf
|
||||
sudo sed -i 's/^export AWG_PORT=.*/export AWG_PORT=443/' /root/awg/awgsetup_cfg.init
|
||||
sudo ufw allow 443/udp
|
||||
sudo systemctl restart awg-quick@awg0
|
||||
```
|
||||
|
||||
Затем перевыпустите клиентские конфиги (`sudo bash /root/awg/manage_amneziawg.sh regen <имя>`) - в `Endpoint` подставится новый порт - и заново импортируйте их на устройства. Порт 443 проходит и на обычных сетях, поэтому на него можно перевести все устройства.
|
||||
|
||||
> Если же туннель поднимается, но часть сайтов (например, YouTube) не открывается, хотя VPN подключён - причина обычно не в порте, а в IPv6 устройства, который идёт мимо туннеля. Разбор и решение - в разделе про [IPv6 в IPv4-only режиме](#ipv6-tunnel-adv).
|
||||
|
||||
---
|
||||
|
||||
<a id="as-blocking-adv"></a>
|
||||
|
|
@ -1123,7 +1140,7 @@ sudo systemctl restart awg-quick@awg0
|
|||
|
||||
Контрольная проверка: туннель к серверу в другой AS (США) поднимался и держался на всех трёх операторах, значит в нашем тесте на Seven Sky оставался недоступен именно Hetzner, а не VPN вообще. На Seven Sky блок повторялся стабильно и вечером, и ночью, а QUIC-мимикрия с двумя разными SNI его не снимала. Вывод: метод 0ka действительно работает, но не универсально - результат зависит от оператора и региональной настройки ТСПУ.
|
||||
|
||||
**Как применить вручную.** Инсталлятор пока не генерирует QUIC-мимикрию `I1` сам (запланировано, [issue #71](https://github.com/bivlked/amneziawg-installer/issues/71)); сейчас это ручная настройка:
|
||||
**Как применить вручную.** Инсталлятор не генерирует QUIC-мимикрию `I1` сам - это ручная настройка:
|
||||
|
||||
1. Сгенерируйте строку `I1` под нужного хостера в [Mini QUIC Generator](https://sageptr.github.io/mini_quic_generator/) (автор SagePtr): впишите SNI (`7-zip.org` для Hetzner) и скопируйте значение из поля «AmneziaWG 1.5+ (I1 = )».
|
||||
2. Замените строку `I1 = ...` в секции `[Interface]` серверного конфига `/etc/amnezia/amneziawg/awg0.conf` (`I1`-`I5` регистрозависимы, только верхний регистр).
|
||||
|
|
|
|||
|
|
@ -14,6 +14,31 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
|
|||
|
||||
---
|
||||
|
||||
## [5.18.1] - 2026-06-27
|
||||
|
||||
**v5.18.1** - bug-fix release. Fixes `--port` on reinstall: `install --force --port=N` now actually changes the server port (previously the new port was silently ignored). Full-tunnel clients now get `0.0.0.0/0, ::/0` so AmneziaVPN on iOS accepts the "all traffic" mode. The default DNS is now a resolver pair `1.1.1.1, 1.0.0.1`. `--port` now accepts any port 1-65535, including 443 (useful for mobile carriers that drop a non-standard high UDP port). Plus documentation fixes. Behaviour of existing installs and connected clients is unchanged; the improvements apply to new and re-issued (`manage regen`) configs. Support matrix unchanged: Ubuntu 24.04 / 25.10 / 26.04, Debian 12 / 13, x86_64 + ARM.
|
||||
|
||||
### Fixed
|
||||
|
||||
- `install --force --port=N` now changes the server port. Previously the new port was silently ignored: when rendering the server config, the port was re-read from the old `awg0.conf`, overwriting the value passed via `--port`. The port for the new config is now taken from the saved install parameters (the user's intent), which correctly survives the reboots during `--force`. Client `regen` is unaffected - it still reads the port from the live `awg0.conf`
|
||||
- Full-tunnel clients (`AllowedIPs = 0.0.0.0/0`) now get `0.0.0.0/0, ::/0`. With a bare `0.0.0.0/0`, AmneziaVPN on iOS treated the config as incomplete split tunneling and refused to bring the tunnel up. `::/0` sends IPv6 into the tunnel (and drops it if the server has no native IPv6), so nothing leaks past the VPN. Split tunneling (a custom route list) is not affected
|
||||
|
||||
### Changed
|
||||
|
||||
- The default DNS in client configs is now a pair `1.1.1.1, 1.0.0.1` instead of a single resolver (a fallback DNS in case the first one is unreachable)
|
||||
- `--port` now accepts ports 1-65535 (previously only 1024-65535). Low ports like 443/80/53 help with DPI evasion on mobile carriers: MTS, for example, drops a non-standard high UDP port but passes 443/udp. The VPN service runs as root, so privileged ports bind fine
|
||||
|
||||
### Documentation
|
||||
|
||||
- ADVANCED: fixed the `S3`/`S4` range in the minimal-config example (`S3`: 0-64, `S4`: 0-32 instead of the wrong 0-127); removed the stale link of the active-probing section to the already-closed issue #71; added notes on the mobile port and on direct IPv6 traffic bypassing the tunnel
|
||||
- README: added Ubuntu 26.04 to the subtitle; clarified the `--force` gate in the re-run FAQ
|
||||
|
||||
### Tests
|
||||
|
||||
- Added `tests/test_v5181_bugfix.bats` - the port from the saved parameters wins over the old `awg0.conf` on render; a full-tunnel client gets `::/0`, a split one does not; the default DNS pair; RU/EN parity of all three fixes
|
||||
|
||||
---
|
||||
|
||||
## [5.18.0] - 2026-06-26
|
||||
|
||||
**v5.18.0** - the special-junk params `I2`-`I5` now reach clients. Previously only `I1` made it into the client config; `I2`-`I5` were hard-coded empty in the `vpn://` URI and never rendered into the `.conf`, so even if the admin set them in `awg0.conf` they could not reach the client. Now all five CPS params are carried into the client `.conf`, the QR code, and the `vpn://` link. Workflow: set `I2`-`I5` in the `[Interface]` of `awg0.conf`, restart the service, and distribute to clients with `manage regen`. No new install flags; when `I2`-`I5` are unset, behavior is identical to before. Support matrix unchanged: Ubuntu 24.04 / 25.10 / 26.04, Debian 12 / 13, x86_64 + ARM (issue #71).
|
||||
|
|
@ -1435,7 +1460,8 @@ Major security and reliability update after several consecutive code audits. The
|
|||
- Diagnostic report (`--diagnostic`).
|
||||
- Full uninstall (`--uninstall`).
|
||||
|
||||
[Unreleased]: https://github.com/bivlked/amneziawg-installer/compare/v5.17.0...HEAD
|
||||
[Unreleased]: https://github.com/bivlked/amneziawg-installer/compare/v5.18.1...HEAD
|
||||
[5.18.1]: https://github.com/bivlked/amneziawg-installer/compare/v5.18.0...v5.18.1
|
||||
[5.18.0]: https://github.com/bivlked/amneziawg-installer/compare/v5.17.0...v5.18.0
|
||||
[5.17.0]: https://github.com/bivlked/amneziawg-installer/compare/v5.16.1...v5.17.0
|
||||
[5.16.1]: https://github.com/bivlked/amneziawg-installer/compare/v5.16.0...v5.16.1
|
||||
|
|
|
|||
28
CHANGELOG.md
28
CHANGELOG.md
|
|
@ -14,6 +14,31 @@
|
|||
|
||||
---
|
||||
|
||||
## [5.18.1] - 2026-06-27
|
||||
|
||||
**v5.18.1** - багфикс-релиз. Исправлен `--port` при повторной установке: `install --force --port=N` теперь действительно меняет порт сервера (раньше новый порт молча игнорировался). Полнотуннельные клиенты получают `0.0.0.0/0, ::/0`, чтобы AmneziaVPN на iOS принимал режим «весь трафик». DNS по умолчанию - пара резолверов `1.1.1.1, 1.0.0.1`. `--port` теперь принимает любой порт 1-65535, в том числе 443 (полезно для мобильных операторов, режущих нестандартный высокий UDP-порт). Плюс правки документации. Поведение существующих установок и подключённых клиентов не меняется; улучшения применяются к новым и перевыпущенным (`manage regen`) конфигам. Матрица поддержки прежняя: Ubuntu 24.04 / 25.10 / 26.04, Debian 12 / 13, x86_64 + ARM.
|
||||
|
||||
### Исправлено
|
||||
|
||||
- `install --force --port=N` теперь меняет порт сервера. Прежде новый порт молча игнорировался: при рендере серверного конфига порт перечитывался из старого `awg0.conf` и затирал значение, переданное в `--port`. Теперь порт для нового конфига берётся из сохранённых параметров установки (намерение пользователя), что корректно переживает перезагрузки в ходе `--force`. Клиентский `regen` не затронут - он по-прежнему читает порт из живого `awg0.conf`
|
||||
- Полнотуннельные клиенты (`AllowedIPs = 0.0.0.0/0`) теперь получают `0.0.0.0/0, ::/0`. AmneziaVPN на iOS при голом `0.0.0.0/0` считал конфиг незавершённым раздельным туннелированием и не поднимал туннель. `::/0` направляет IPv6 в туннель (и отсекает его, если у сервера нет нативного IPv6) - мимо VPN ничего не утекает. Раздельное туннелирование (кастомный список маршрутов) не затрагивается
|
||||
|
||||
### Изменено
|
||||
|
||||
- DNS по умолчанию в клиентских конфигах - пара `1.1.1.1, 1.0.0.1` вместо одного резолвера (резервный DNS на случай недоступности первого)
|
||||
- `--port` принимает порты 1-65535 (раньше только 1024-65535). Низкие порты вроде 443/80/53 помогают обходить DPI у мобильных операторов: например, МТС глушит нестандартный высокий UDP-порт, но пропускает 443/udp. VPN-сервис работает под root, поэтому привилегированные порты биндятся штатно
|
||||
|
||||
### Документация
|
||||
|
||||
- ADVANCED: исправлен диапазон `S3`/`S4` в примере минимального конфига (`S3`: 0-64, `S4`: 0-32 вместо неверного 0-127); убрана устаревшая привязка раздела про активное зондирование к уже закрытому issue #71; добавлены заметки про мобильный порт и про прямой IPv6-трафик в обход туннеля
|
||||
- README: в подзаголовок добавлена Ubuntu 26.04; в FAQ про повторный запуск уточнён гейт `--force`
|
||||
|
||||
### Тесты
|
||||
|
||||
- Добавлен `tests/test_v5181_bugfix.bats` - порт из сохранённых параметров побеждает старый `awg0.conf` при рендере; полнотуннельный клиент получает `::/0`, раздельный - нет; DNS-пара по умолчанию; RU/EN-паритет всех трёх правок
|
||||
|
||||
---
|
||||
|
||||
## [5.18.0] - 2026-06-26
|
||||
|
||||
**v5.18.0** - параметры special-junk `I2`-`I5` теперь доходят до клиентов. Раньше до клиентского конфига доходил только `I1`, а `I2`-`I5` жёстко уходили пустыми в `vpn://` и вообще не попадали в `.conf` - даже если администратор прописывал их в `awg0.conf`, до клиента они не доезжали. Теперь все пять CPS-параметров переносятся в клиентский `.conf`, QR и `vpn://`-ссылку. Рабочий процесс: задать `I2`-`I5` в `[Interface]` файла `awg0.conf`, перезапустить сервис и раздать клиентам через `manage regen`. Новых флагов установки нет; если `I2`-`I5` не заданы, поведение идентично прежнему. Матрица поддержки прежняя: Ubuntu 24.04 / 25.10 / 26.04, Debian 12 / 13, x86_64 + ARM (issue #71).
|
||||
|
|
@ -1435,7 +1460,8 @@ Hardening-фиксы надёжности и безопасности по ре
|
|||
- Диагностический отчет (`--diagnostic`).
|
||||
- Полная деинсталляция (`--uninstall`).
|
||||
|
||||
[Unreleased]: https://github.com/bivlked/amneziawg-installer/compare/v5.17.0...HEAD
|
||||
[Unreleased]: https://github.com/bivlked/amneziawg-installer/compare/v5.18.1...HEAD
|
||||
[5.18.1]: https://github.com/bivlked/amneziawg-installer/compare/v5.18.0...v5.18.1
|
||||
[5.18.0]: https://github.com/bivlked/amneziawg-installer/compare/v5.17.0...v5.18.0
|
||||
[5.17.0]: https://github.com/bivlked/amneziawg-installer/compare/v5.16.1...v5.17.0
|
||||
[5.16.1]: https://github.com/bivlked/amneziawg-installer/compare/v5.16.0...v5.16.1
|
||||
|
|
|
|||
|
|
@ -118,7 +118,7 @@ The same mirror rule applies to user-facing markdown documents:
|
|||
When updating any of them, keep the following in sync between the two versions:
|
||||
|
||||
- Section headings and order
|
||||
- Commands and code examples (identical — commands are bash)
|
||||
- Commands and code examples (identical - commands are bash)
|
||||
- Release facts: version numbers, test counts, supported distros
|
||||
- Internal links (each RU anchor should have an EN counterpart at the same place)
|
||||
- Tables (same rows and columns)
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ A step-by-step guide for deploying an AmneziaWG 2.0 VPN server on a clean Ubuntu
|
|||
|
||||
- One command, MIT-licensed, fully self-hosted, no third-party dependencies at runtime.
|
||||
- Works on Ubuntu 24.04 LTS, Ubuntu 25.10/26.04, Debian 12 (bookworm), Debian 13 (trixie).
|
||||
- Built for cheap VPS budgets: $3 to $5 a month, 1 vCPU, 512 MB RAM minimum (1 GB recommended), 5 GB disk.
|
||||
- Built for cheap VPS budgets: $3 to $5 a month, 1 vCPU, 512 MB RAM minimum (1 GB recommended), 2 GB disk minimum (3+ GB recommended).
|
||||
- Both x86_64 (amd64) and ARM64 (aarch64), with prebuilt kernel modules covering Raspberry Pi 4/5, Ubuntu 24.04/25.10 ARM64, and Debian 12/13 ARM64 (Hetzner CAX, Oracle Ampere A1, AWS Graviton all run on these stock kernels). Ubuntu 26.04 ARM64 builds the module from source via DKMS.
|
||||
- DPI bypass for Russia (ТСПУ), Iran, China, school and corporate firewalls.
|
||||
- Survives kernel upgrades automatically via DKMS auto-repair (since v5.12.0).
|
||||
|
|
@ -43,7 +43,7 @@ sudo ufw allow <your-ssh-port>/tcp
|
|||
Then:
|
||||
|
||||
```bash
|
||||
wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
|
||||
wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
|
||||
chmod +x install_amneziawg_en.sh
|
||||
sudo bash ./install_amneziawg_en.sh
|
||||
```
|
||||
|
|
|
|||
26
README.en.md
26
README.en.md
|
|
@ -9,7 +9,7 @@
|
|||
|
||||
<h1 align="center">Install AmneziaWG 2.0 VPN on Ubuntu and Debian VPS</h1>
|
||||
|
||||
<p align="center"><em>One-command, self-hosted AmneziaWG 2.0 VPN for Ubuntu 24.04 / 25.10 and Debian 12 / 13. Kernel-native DKMS, no Docker, no web panel, runs on any cheap VPS.</em></p>
|
||||
<p align="center"><em>One-command, self-hosted AmneziaWG 2.0 VPN for Ubuntu 24.04 / 25.10 / 26.04 and Debian 12 / 13. Kernel-native DKMS, no Docker, no web panel, runs on any cheap VPS.</em></p>
|
||||
|
||||
<p align="center">
|
||||
<a href="https://bivlked.github.io/amneziawg-installer/"><img src="https://img.shields.io/badge/Website-bivlked.github.io-3ddc97" alt="Project website"></a>
|
||||
|
|
@ -18,7 +18,7 @@
|
|||
<img src="https://img.shields.io/badge/Architecture-x86__64_|_ARM64_|_ARMv7-green" alt="x86_64 | ARM64 | ARMv7">
|
||||
<img src="https://img.shields.io/badge/AmneziaWG-2.0-blueviolet" alt="AWG 2.0">
|
||||
<a href="https://github.com/bivlked/amneziawg-installer/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="License"></a>
|
||||
<a href="https://github.com/bivlked/amneziawg-installer/releases"><img src="https://img.shields.io/badge/Installer_Version-5.18.0-blue" alt="Version"></a>
|
||||
<a href="https://github.com/bivlked/amneziawg-installer/releases"><img src="https://img.shields.io/badge/Installer_Version-5.18.1-blue" alt="Version"></a>
|
||||
<a href="https://github.com/bivlked/amneziawg-installer/actions/workflows/test.yml"><img src="https://github.com/bivlked/amneziawg-installer/actions/workflows/test.yml/badge.svg" alt="Tests"></a>
|
||||
<a href="https://github.com/bivlked/amneziawg-installer/stargazers"><img src="https://img.shields.io/github/stars/bivlked/amneziawg-installer?style=flat" alt="Stars"></a>
|
||||
<img src="https://img.shields.io/github/last-commit/bivlked/amneziawg-installer" alt="Last commit">
|
||||
|
|
@ -32,7 +32,7 @@
|
|||
## 🚀 Quick Start
|
||||
|
||||
```bash
|
||||
wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
|
||||
wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
|
||||
chmod +x install_amneziawg_en.sh
|
||||
sudo bash ./install_amneziawg_en.sh
|
||||
```
|
||||
|
|
@ -311,8 +311,8 @@ This installation method handles interactive prompts and colored output correctl
|
|||
|
||||
2. **Download the script:**
|
||||
```bash
|
||||
wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
|
||||
# or: curl -fLo install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
|
||||
wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
|
||||
# or: curl -fLo install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
|
||||
```
|
||||
> Minimal Debian may not ship curl (wget is usually present) - use `wget`. The installer itself adds curl in step 1.
|
||||
3. **Make it executable:**
|
||||
|
|
@ -327,7 +327,7 @@ This installation method handles interactive prompts and colored output correctl
|
|||
|
||||
> **Russian version:** For Russian output, use `install_amneziawg.sh`:
|
||||
> ```bash
|
||||
> wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg.sh
|
||||
> wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg.sh
|
||||
> sudo bash ./install_amneziawg.sh
|
||||
> ```
|
||||
> The Russian version is functionally identical; only user-facing messages and logs are in Russian.
|
||||
|
|
@ -447,11 +447,11 @@ Full list: `... help` or [ADVANCED.en.md#manage-commands-adv](ADVANCED.en.md#man
|
|||
|
||||
```bash
|
||||
# Installation (English)
|
||||
wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
|
||||
wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
|
||||
sudo bash ./install_amneziawg_en.sh # Run (+ 2 reboots)
|
||||
|
||||
# Installation (Russian)
|
||||
wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg.sh
|
||||
wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg.sh
|
||||
sudo bash ./install_amneziawg.sh # Run (+ 2 reboots)
|
||||
|
||||
# Client management
|
||||
|
|
@ -535,13 +535,13 @@ For a two-server cascade with a split exit for Russian and foreign traffic (spli
|
|||
<b>A:</b> Download the updated scripts and replace them on the server:
|
||||
<pre>
|
||||
# English version:
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/manage_amneziawg_en.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common_en.sh
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/manage_amneziawg_en.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common_en.sh
|
||||
chmod 700 /root/awg/manage_amneziawg.sh /root/awg/awg_common.sh
|
||||
|
||||
# Russian version:
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/manage_amneziawg.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common.sh
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/manage_amneziawg.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common.sh
|
||||
chmod 700 /root/awg/manage_amneziawg.sh /root/awg/awg_common.sh
|
||||
</pre>
|
||||
Server reinstallation is not required.
|
||||
|
|
@ -594,7 +594,7 @@ For a two-server cascade with a split exit for Russian and foreign traffic (spli
|
|||
|
||||
<details>
|
||||
<summary><strong>Q: Is it safe to re-run the installer?</strong></summary>
|
||||
<b>A:</b> Yes. On re-run, the server config is recreated, but existing clients are automatically restored from backup. Default clients (<code>my_phone</code>, <code>my_laptop</code>) are recreated; all others are preserved.
|
||||
<b>A:</b> Yes. Re-running over an already working service requires the <code>--force</code> flag (or <code>AWG_FORCE_REINSTALL=1</code>) - without it the script reports that AmneziaWG is already installed and changes nothing. With <code>--force</code> the server config is recreated, but existing clients are automatically restored from backup: default clients (<code>my_phone</code>, <code>my_laptop</code>) are recreated; all others are preserved.
|
||||
</details>
|
||||
|
||||
> More answers and solutions in **[ADVANCED.en.md](ADVANCED.en.md)**.
|
||||
|
|
|
|||
26
README.md
26
README.md
|
|
@ -10,7 +10,7 @@
|
|||
<h1 align="center">Install AmneziaWG 2.0 VPN on Ubuntu and Debian VPS</h1>
|
||||
|
||||
<p align="center"><em>VPN за одну команду - работает там, где WireGuard блокируют. Любой VPS за $3, без знания Linux.</em></p>
|
||||
<p align="center"><em>One-command, self-hosted AmneziaWG 2.0 VPN for Ubuntu 24.04 / 25.10 and Debian 12 / 13. Kernel-native DKMS, no Docker, no web panel, runs on any cheap VPS.</em></p>
|
||||
<p align="center"><em>One-command, self-hosted AmneziaWG 2.0 VPN for Ubuntu 24.04 / 25.10 / 26.04 and Debian 12 / 13. Kernel-native DKMS, no Docker, no web panel, runs on any cheap VPS.</em></p>
|
||||
|
||||
<p align="center">
|
||||
<a href="https://bivlked.github.io/amneziawg-installer/ru/"><img src="https://img.shields.io/badge/Website-bivlked.github.io-3ddc97" alt="Project website"></a>
|
||||
|
|
@ -19,7 +19,7 @@
|
|||
<img src="https://img.shields.io/badge/Architecture-x86__64_|_ARM64_|_ARMv7-green" alt="x86_64 | ARM64 | ARMv7">
|
||||
<img src="https://img.shields.io/badge/AmneziaWG-2.0-blueviolet" alt="AWG 2.0">
|
||||
<a href="https://github.com/bivlked/amneziawg-installer/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-MIT-green" alt="License"></a>
|
||||
<a href="https://github.com/bivlked/amneziawg-installer/releases"><img src="https://img.shields.io/badge/Installer_Version-5.18.0-blue" alt="Version"></a>
|
||||
<a href="https://github.com/bivlked/amneziawg-installer/releases"><img src="https://img.shields.io/badge/Installer_Version-5.18.1-blue" alt="Version"></a>
|
||||
<a href="https://github.com/bivlked/amneziawg-installer/actions/workflows/test.yml"><img src="https://github.com/bivlked/amneziawg-installer/actions/workflows/test.yml/badge.svg" alt="Tests"></a>
|
||||
<a href="https://github.com/bivlked/amneziawg-installer/stargazers"><img src="https://img.shields.io/github/stars/bivlked/amneziawg-installer?style=flat" alt="Stars"></a>
|
||||
<img src="https://img.shields.io/github/last-commit/bivlked/amneziawg-installer" alt="Last commit">
|
||||
|
|
@ -33,7 +33,7 @@
|
|||
## 🚀 Быстрый старт
|
||||
|
||||
```bash
|
||||
wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg.sh
|
||||
wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg.sh
|
||||
chmod +x install_amneziawg.sh
|
||||
sudo bash ./install_amneziawg.sh
|
||||
```
|
||||
|
|
@ -312,8 +312,8 @@ sudo bash ./install_amneziawg.sh --yes --route-all
|
|||
|
||||
2. **Скачайте скрипт:**
|
||||
```bash
|
||||
wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg.sh
|
||||
# или: curl -fLo install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg.sh
|
||||
wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg.sh
|
||||
# или: curl -fLo install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg.sh
|
||||
```
|
||||
> На минимальном Debian curl может отсутствовать (wget обычно есть) - используйте `wget`. Сам curl установщик доставит на шаге 1.
|
||||
3. **Сделайте его исполняемым:**
|
||||
|
|
@ -328,7 +328,7 @@ sudo bash ./install_amneziawg.sh --yes --route-all
|
|||
|
||||
> **English version:** Для вывода на английском используйте `install_amneziawg_en.sh`:
|
||||
> ```bash
|
||||
> wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
|
||||
> wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
|
||||
> sudo bash ./install_amneziawg_en.sh
|
||||
> ```
|
||||
> Английская версия функционально идентична; только сообщения и логи на английском.
|
||||
|
|
@ -448,11 +448,11 @@ sudo bash /root/awg/manage_amneziawg.sh <команда> [аргументы]
|
|||
|
||||
```bash
|
||||
# Установка (русский)
|
||||
wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg.sh
|
||||
wget -O install_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg.sh
|
||||
sudo bash ./install_amneziawg.sh # Запуск (+ 2 перезагрузки)
|
||||
|
||||
# Установка (English)
|
||||
wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/install_amneziawg_en.sh
|
||||
wget -O install_amneziawg_en.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/install_amneziawg_en.sh
|
||||
sudo bash ./install_amneziawg_en.sh # Запуск (+ 2 перезагрузки)
|
||||
|
||||
# Управление клиентами
|
||||
|
|
@ -536,13 +536,13 @@ sudo bash /root/awg/manage_amneziawg.sh restart # Перезапу
|
|||
<b>О:</b> Скачайте новый скрипт установки и замените скрипты управления на сервере:
|
||||
<pre>
|
||||
# Русская версия:
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/manage_amneziawg.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common.sh
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/manage_amneziawg.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common.sh
|
||||
chmod 700 /root/awg/manage_amneziawg.sh /root/awg/awg_common.sh
|
||||
|
||||
# Английская версия:
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/manage_amneziawg_en.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.0/awg_common_en.sh
|
||||
wget -O /root/awg/manage_amneziawg.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/manage_amneziawg_en.sh
|
||||
wget -O /root/awg/awg_common.sh https://raw.githubusercontent.com/bivlked/amneziawg-installer/v5.18.1/awg_common_en.sh
|
||||
chmod 700 /root/awg/manage_amneziawg.sh /root/awg/awg_common.sh
|
||||
</pre>
|
||||
Переустановка сервера не требуется.
|
||||
|
|
@ -595,7 +595,7 @@ sudo bash /root/awg/manage_amneziawg.sh restart # Перезапу
|
|||
|
||||
<details>
|
||||
<summary><strong>В: Безопасно ли запускать скрипт повторно?</strong></summary>
|
||||
<b>О:</b> Да. При повторном запуске серверный конфиг пересоздаётся, но существующие клиенты автоматически восстанавливаются из бэкапа. Дефолтные клиенты (<code>my_phone</code>, <code>my_laptop</code>) пересоздаются, остальные - сохраняются.
|
||||
<b>О:</b> Да. Повторная установка поверх уже работающего сервиса требует флага <code>--force</code> (или <code>AWG_FORCE_REINSTALL=1</code>) - без него скрипт сообщит, что AmneziaWG уже установлен, и ничего не тронет. С <code>--force</code> серверный конфиг пересоздаётся, но существующие клиенты автоматически восстанавливаются из бэкапа: дефолтные клиенты (<code>my_phone</code>, <code>my_laptop</code>) пересоздаются, остальные - сохраняются.
|
||||
</details>
|
||||
|
||||
> Больше ответов и решений см. в **[ADVANCED.md](ADVANCED.md)**.
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# ==============================================================================
|
||||
# Общая библиотека функций для AmneziaWG 2.0
|
||||
# Автор: @bivlked
|
||||
# Версия: 5.18.0
|
||||
# Дата: 2026-06-26
|
||||
# Версия: 5.18.1
|
||||
# Дата: 2026-06-27
|
||||
# Репозиторий: https://github.com/bivlked/amneziawg-installer
|
||||
# ==============================================================================
|
||||
#
|
||||
|
|
@ -950,6 +950,16 @@ render_server_config() {
|
|||
local peers_source="${1:-}"
|
||||
load_awg_params || return 1
|
||||
|
||||
# Порт для НОВОГО awg0.conf берём из init-файла (намерение пользователя:
|
||||
# флаг --port или сохранённый прежний порт), а НЕ из перезаписываемого
|
||||
# старого awg0.conf. load_awg_params перечитывает ListenPort из живого
|
||||
# конфига, поэтому без этого --port при --force молча игнорировался бы.
|
||||
# render_server_config вызывается только из install, regen клиентов
|
||||
# (regenerate_client) идёт своим путём и не затрагивается.
|
||||
local _init_port
|
||||
_init_port=$(grep -oP '^\s*export AWG_PORT=\K[0-9]+' "$CONFIG_FILE" 2>/dev/null | head -n1)
|
||||
[[ -n "$_init_port" ]] && AWG_PORT="$_init_port"
|
||||
|
||||
local server_privkey
|
||||
if [[ -f "$AWG_DIR/server_private.key" ]]; then
|
||||
server_privkey=$(cat "$AWG_DIR/server_private.key")
|
||||
|
|
@ -1158,6 +1168,15 @@ render_client_config() {
|
|||
esac
|
||||
else
|
||||
allowed_ips="${ALLOWED_IPS:-0.0.0.0/0}"
|
||||
# iOS AmneziaVPN в режиме "весь трафик" требует обе семьи адресов: при
|
||||
# голом 0.0.0.0/0 он считает это незавершённой раздельной маршрутизацией
|
||||
# и не поднимает туннель. Для full-tunnel добавляем ::/0 - IPv6 уходит в
|
||||
# туннель (и отсекается, если у сервера нет нативного IPv6), наружу мимо
|
||||
# VPN не утекает. Затрагивает только mode-1: split-режим = кастомный
|
||||
# список, не равен 0.0.0.0/0 и под условие не попадает.
|
||||
if [[ "$allowed_ips" == "0.0.0.0/0" ]]; then
|
||||
allowed_ips="0.0.0.0/0, ::/0"
|
||||
fi
|
||||
fi
|
||||
|
||||
# MTU: приоритет server awg0.conf > AWG_MTU из awgsetup_cfg.init > 1280 fallback.
|
||||
|
|
@ -1190,7 +1209,7 @@ render_client_config() {
|
|||
[Interface]
|
||||
PrivateKey = ${client_privkey}
|
||||
Address = ${address_line}
|
||||
DNS = 1.1.1.1
|
||||
DNS = 1.1.1.1, 1.0.0.1
|
||||
MTU = ${mtu}
|
||||
Jc = ${AWG_Jc}
|
||||
Jmin = ${AWG_Jmin}
|
||||
|
|
@ -2123,7 +2142,7 @@ regenerate_client() {
|
|||
fi
|
||||
|
||||
# Сохраняем пользовательские настройки из текущего .conf (modify)
|
||||
local current_dns="1.1.1.1" current_keepalive="33" current_allowed_ips="${ALLOWED_IPS:-0.0.0.0/0}"
|
||||
local current_dns="1.1.1.1, 1.0.0.1" current_keepalive="33" current_allowed_ips="${ALLOWED_IPS:-0.0.0.0/0}"
|
||||
if [[ -f "$AWG_DIR/${name}.conf" ]]; then
|
||||
local _v
|
||||
_v=$(sed -n 's/^DNS[ \t]*=[ \t]*//p' "$AWG_DIR/${name}.conf" | tr -d '[:space:]')
|
||||
|
|
@ -2172,6 +2191,13 @@ regenerate_client() {
|
|||
return 1
|
||||
}
|
||||
|
||||
# При regen подтягиваем новые дефолты для НЕ-кастомизированных клиентов:
|
||||
# полнотуннельный 0.0.0.0/0 получает ::/0 (нужно iOS AmneziaVPN), одиночный
|
||||
# DNS 1.1.1.1 становится парой с резервом. Значения, заданные пользователем
|
||||
# через modify, не равны старым дефолтам и потому сохраняются как есть.
|
||||
[[ "$current_allowed_ips" == "0.0.0.0/0" ]] && current_allowed_ips="0.0.0.0/0, ::/0"
|
||||
[[ "$current_dns" == "1.1.1.1" ]] && current_dns="1.1.1.1, 1.0.0.1"
|
||||
|
||||
# Восстанавливаем пользовательские настройки (экранируем & и \ для sed replacement)
|
||||
local _dns _ka _aip
|
||||
_dns=$(printf '%s' "$current_dns" | sed 's/[&\\/]/\\&/g')
|
||||
|
|
|
|||
|
|
@ -3,8 +3,8 @@
|
|||
# ==============================================================================
|
||||
# Shared function library for AmneziaWG 2.0
|
||||
# Author: @bivlked
|
||||
# Version: 5.18.0
|
||||
# Date: 2026-06-26
|
||||
# Version: 5.18.1
|
||||
# Date: 2026-06-27
|
||||
# Repository: https://github.com/bivlked/amneziawg-installer
|
||||
# ==============================================================================
|
||||
#
|
||||
|
|
@ -957,6 +957,16 @@ render_server_config() {
|
|||
local peers_source="${1:-}"
|
||||
load_awg_params || return 1
|
||||
|
||||
# Port for the NEW awg0.conf comes from the init file (the user's intent:
|
||||
# the --port flag or the previously saved port), NOT from the old awg0.conf
|
||||
# being overwritten. load_awg_params re-reads ListenPort from the live
|
||||
# config, so without this --port on --force would be silently ignored.
|
||||
# render_server_config is only called from install; client regen
|
||||
# (regenerate_client) takes its own path and is unaffected.
|
||||
local _init_port
|
||||
_init_port=$(grep -oP '^\s*export AWG_PORT=\K[0-9]+' "$CONFIG_FILE" 2>/dev/null | head -n1)
|
||||
[[ -n "$_init_port" ]] && AWG_PORT="$_init_port"
|
||||
|
||||
local server_privkey
|
||||
if [[ -f "$AWG_DIR/server_private.key" ]]; then
|
||||
server_privkey=$(cat "$AWG_DIR/server_private.key")
|
||||
|
|
@ -1167,6 +1177,15 @@ render_client_config() {
|
|||
esac
|
||||
else
|
||||
allowed_ips="${ALLOWED_IPS:-0.0.0.0/0}"
|
||||
# iOS AmneziaVPN in "all traffic" mode requires both address families:
|
||||
# with a bare 0.0.0.0/0 it treats the config as incomplete split routing
|
||||
# and refuses to bring the tunnel up. For full tunnel we add ::/0 - IPv6
|
||||
# goes into the tunnel (and is dropped if the server has no native IPv6),
|
||||
# so it never leaks past the VPN. Affects mode-1 only: split mode uses a
|
||||
# custom list that is not equal to 0.0.0.0/0 and skips this branch.
|
||||
if [[ "$allowed_ips" == "0.0.0.0/0" ]]; then
|
||||
allowed_ips="0.0.0.0/0, ::/0"
|
||||
fi
|
||||
fi
|
||||
|
||||
# MTU resolution order: server awg0.conf > AWG_MTU from awgsetup_cfg.init >
|
||||
|
|
@ -1199,7 +1218,7 @@ render_client_config() {
|
|||
[Interface]
|
||||
PrivateKey = ${client_privkey}
|
||||
Address = ${address_line}
|
||||
DNS = 1.1.1.1
|
||||
DNS = 1.1.1.1, 1.0.0.1
|
||||
MTU = ${mtu}
|
||||
Jc = ${AWG_Jc}
|
||||
Jmin = ${AWG_Jmin}
|
||||
|
|
@ -2136,7 +2155,7 @@ regenerate_client() {
|
|||
fi
|
||||
|
||||
# Preserve user settings from current .conf (modified via modify command)
|
||||
local current_dns="1.1.1.1" current_keepalive="33" current_allowed_ips="${ALLOWED_IPS:-0.0.0.0/0}"
|
||||
local current_dns="1.1.1.1, 1.0.0.1" current_keepalive="33" current_allowed_ips="${ALLOWED_IPS:-0.0.0.0/0}"
|
||||
if [[ -f "$AWG_DIR/${name}.conf" ]]; then
|
||||
local _v
|
||||
_v=$(sed -n 's/^DNS[ \t]*=[ \t]*//p' "$AWG_DIR/${name}.conf" | tr -d '[:space:]')
|
||||
|
|
@ -2187,6 +2206,13 @@ regenerate_client() {
|
|||
return 1
|
||||
}
|
||||
|
||||
# On regen, pull in the new defaults for non-customized clients: a
|
||||
# full-tunnel 0.0.0.0/0 gets ::/0 (needed by iOS AmneziaVPN), a single DNS
|
||||
# 1.1.1.1 becomes a pair with a fallback. Values set by the user via modify
|
||||
# differ from the old defaults and are therefore kept as-is.
|
||||
[[ "$current_allowed_ips" == "0.0.0.0/0" ]] && current_allowed_ips="0.0.0.0/0, ::/0"
|
||||
[[ "$current_dns" == "1.1.1.1" ]] && current_dns="1.1.1.1, 1.0.0.1"
|
||||
|
||||
# Restore user settings (escape & and \ for sed replacement)
|
||||
local _dns _ka _aip
|
||||
_dns=$(printf '%s' "$current_dns" | sed 's/[&\\/]/\\&/g')
|
||||
|
|
|
|||
|
|
@ -28,6 +28,7 @@ tracked in issues and discussions, not here:
|
|||
- Reliability on mobile, double-NAT and cascade paths: the TCP MSS is clamped to the tunnel size, which fixes the common PMTU-blackhole stall where large TCP pages and downloads hang when path-MTU discovery is blocked along the way.
|
||||
- Full special-junk pass-through: all CPS concealment params `I1`-`I5` set in the server `awg0.conf` now reach clients (`.conf`, QR, `vpn://`), not just `I1`. Multi-packet concealment profiles can be configured server-side and distributed with `manage regen`.
|
||||
- Companion guides: how the project compares to the official Amnezia app, and a two-server cascade with split-tunnel routing.
|
||||
- Bug fixes: `install --force --port=N` now actually changes the server port; full-tunnel clients get `0.0.0.0/0, ::/0` so iOS AmneziaVPN accepts the all-traffic mode; the default client DNS is a `1.1.1.1, 1.0.0.1` pair.
|
||||
|
||||
## Under consideration
|
||||
|
||||
|
|
@ -80,6 +81,7 @@ Carrier reports (operator, region, working parameters) are especially useful.
|
|||
- Надёжность на мобильных, double-NAT и каскадных путях: TCP MSS ограничивается под размер туннеля, что устраняет типичный PMTU-блэкхол, когда крупные TCP-страницы и закачки зависают при заблокированном по пути обнаружении path-MTU.
|
||||
- Полный проброс special-junk: все CPS-параметры маскировки `I1`-`I5`, заданные в серверном `awg0.conf`, теперь доходят до клиентов (`.conf`, QR, `vpn://`), а не только `I1`. Многопакетные профили маскировки можно задать на сервере и раздать через `manage regen`.
|
||||
- Сопутствующие гайды: сравнение проекта с официальным приложением Amnezia и каскад из двух серверов со split-tunnel-маршрутизацией.
|
||||
- Багфиксы: `install --force --port=N` теперь действительно меняет порт сервера; полнотуннельные клиенты получают `0.0.0.0/0, ::/0`, чтобы iOS AmneziaVPN принимал режим всего трафика; DNS клиента по умолчанию - пара `1.1.1.1, 1.0.0.1`.
|
||||
|
||||
## На рассмотрении
|
||||
|
||||
|
|
|
|||
|
|
@ -8,15 +8,15 @@ fi
|
|||
# ==============================================================================
|
||||
# Скрипт для установки и настройки AmneziaWG 2.0 на Ubuntu/Debian серверах
|
||||
# Автор: @bivlked
|
||||
# Версия: 5.18.0
|
||||
# Дата: 2026-06-26
|
||||
# Версия: 5.18.1
|
||||
# Дата: 2026-06-27
|
||||
# Репозиторий: https://github.com/bivlked/amneziawg-installer
|
||||
# ==============================================================================
|
||||
|
||||
# --- Безопасный режим и Константы ---
|
||||
set -o pipefail
|
||||
|
||||
SCRIPT_VERSION="5.18.0"
|
||||
SCRIPT_VERSION="5.18.1"
|
||||
AWG_DIR="/root/awg"
|
||||
CONFIG_FILE="$AWG_DIR/awgsetup_cfg.init"
|
||||
STATE_FILE="$AWG_DIR/setup_state"
|
||||
|
|
@ -33,8 +33,8 @@ MANAGE_SCRIPT_PATH="$AWG_DIR/manage_amneziawg.sh"
|
|||
# Проверяются в step5_download_scripts() после curl.
|
||||
# Если AWG_BRANCH переопределён (не v$SCRIPT_VERSION), проверка пропускается.
|
||||
# Формат: sha256sum output (hex, 64 chars).
|
||||
COMMON_SCRIPT_SHA256="e45faa7de3db15dc105292072c6cbfe562fe0161783fa862fe866666a1205cd8"
|
||||
MANAGE_SCRIPT_SHA256="06e91e69a612b1fc57643d1c0d21459dc7816c7084e38fee55c7319ca9c2d927"
|
||||
COMMON_SCRIPT_SHA256="140bbb323ec490ba5b7f49b81ed3d9a27195d123ac3a9ad761994b2b050419f2"
|
||||
MANAGE_SCRIPT_SHA256="4c8cdec3b7a5a32fb9873f2d1ae64d8b56edd1c53165c85921ec861ba01de632"
|
||||
|
||||
# Флаги CLI
|
||||
UNINSTALL=0; HELP=0; HELP_EXIT_RC=0; DIAGNOSTIC=0; VERBOSE=0; NO_COLOR=0; AUTO_YES=0; NO_TWEAKS=0
|
||||
|
|
@ -275,7 +275,7 @@ show_help() {
|
|||
--diagnostic Создать диагностический отчет и выйти
|
||||
-v, --verbose Расширенный вывод для отладки (включая DEBUG)
|
||||
--no-color Отключить цветной вывод в терминале
|
||||
--port=НОМЕР Установить UDP порт (1024-65535) неинтерактивно
|
||||
--port=НОМЕР Установить UDP порт (1-65535) неинтерактивно
|
||||
--ssh-port=ПОРТ SSH-порт для правила UFW (по умолчанию определяется
|
||||
автоматически; список через запятую). Используйте, если
|
||||
SSH на нестандартном порту и автодетект недоступен
|
||||
|
|
@ -668,8 +668,8 @@ validate_port() {
|
|||
# в арифметике и проскакивает проверку диапазона) и ограничивает длину: без
|
||||
# лимита 64-битная арифметика (( )) переполняется и 2^64+51820 проходил бы
|
||||
# range-check. Сравнение - на чистом decimal.
|
||||
if ! [[ "$port" =~ ^[1-9][0-9]{0,4}$ ]] || (( port < 1024 )) || (( port > 65535 )); then
|
||||
die "Некорректный порт: '$port'. Допустимый диапазон: 1024-65535."
|
||||
if ! [[ "$port" =~ ^[1-9][0-9]{0,4}$ ]] || (( port > 65535 )); then
|
||||
die "Некорректный порт: '$port'. Допустимый диапазон: 1-65535."
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
@ -2001,7 +2001,7 @@ initialize_setup() {
|
|||
# авторитетными для CLI/конфиг-значений (там die уместен).
|
||||
if [[ "$AUTO_YES" -eq 0 ]]; then
|
||||
while true; do
|
||||
read -rp "Введите UDP порт AmneziaWG (1024-65535) [${AWG_PORT}]: " input_port < /dev/tty
|
||||
read -rp "Введите UDP порт AmneziaWG (1-65535) [${AWG_PORT}]: " input_port < /dev/tty
|
||||
[[ -z "$input_port" ]] && break
|
||||
if ( validate_port "$input_port" ); then AWG_PORT=$input_port; break; fi
|
||||
log_warn "Повторите ввод порта."
|
||||
|
|
|
|||
|
|
@ -8,14 +8,14 @@ fi
|
|||
# ==============================================================================
|
||||
# AmneziaWG 2.0 installation and configuration script for Ubuntu/Debian servers
|
||||
# Author: @bivlked
|
||||
# Version: 5.18.0
|
||||
# Date: 2026-06-26
|
||||
# Version: 5.18.1
|
||||
# Date: 2026-06-27
|
||||
# Repository: https://github.com/bivlked/amneziawg-installer
|
||||
# ==============================================================================
|
||||
|
||||
# --- Safe mode and Constants ---
|
||||
set -o pipefail
|
||||
SCRIPT_VERSION="5.18.0"
|
||||
SCRIPT_VERSION="5.18.1"
|
||||
|
||||
AWG_DIR="/root/awg"
|
||||
CONFIG_FILE="$AWG_DIR/awgsetup_cfg.init"
|
||||
|
|
@ -33,8 +33,8 @@ MANAGE_SCRIPT_PATH="$AWG_DIR/manage_amneziawg.sh"
|
|||
# Verified in step5_download_scripts() after curl.
|
||||
# Verification is skipped when AWG_BRANCH is overridden (test branch).
|
||||
# Format: sha256sum output (hex, 64 chars).
|
||||
COMMON_SCRIPT_SHA256="63ddb57418cab5fad6569ea5c253b6032a4c3bd9c3e42a9c9abc811b22032aea"
|
||||
MANAGE_SCRIPT_SHA256="2cb5f4b1928b659a106a9d9efd7e7099825e73eeadae1a34faf2b7b395a678ec"
|
||||
COMMON_SCRIPT_SHA256="fa5aec026334b48067e95ffcb8546e711bc6d0006bc77e3030862ec0650cfb82"
|
||||
MANAGE_SCRIPT_SHA256="a235a6de5fac1c5c61a3275b3b32e7cf15927450495bd095ee3ea34fbfc1d27d"
|
||||
|
||||
# CLI flags
|
||||
UNINSTALL=0; HELP=0; HELP_EXIT_RC=0; DIAGNOSTIC=0; VERBOSE=0; NO_COLOR=0; AUTO_YES=0; NO_TWEAKS=0
|
||||
|
|
@ -278,7 +278,7 @@ Options:
|
|||
--diagnostic Generate diagnostic report and exit
|
||||
-v, --verbose Verbose output for debugging (including DEBUG)
|
||||
--no-color Disable colored terminal output
|
||||
--port=NUMBER Set UDP port (1024-65535) non-interactively
|
||||
--port=NUMBER Set UDP port (1-65535) non-interactively
|
||||
--ssh-port=PORT SSH port for the UFW rule (auto-detected by default;
|
||||
comma-separated list). Use if SSH runs on a non-standard
|
||||
port and auto-detection is unavailable
|
||||
|
|
@ -674,8 +674,8 @@ validate_port() {
|
|||
# octal in arithmetic and slip past the range check) and bounds the length:
|
||||
# without a limit 64-bit (( )) arithmetic wraps, so 2^64+51820 would pass the
|
||||
# range check. Comparison uses plain decimal.
|
||||
if ! [[ "$port" =~ ^[1-9][0-9]{0,4}$ ]] || (( port < 1024 )) || (( port > 65535 )); then
|
||||
die "Invalid port: '$port'. Allowed range: 1024-65535."
|
||||
if ! [[ "$port" =~ ^[1-9][0-9]{0,4}$ ]] || (( port > 65535 )); then
|
||||
die "Invalid port: '$port'. Allowed range: 1-65535."
|
||||
fi
|
||||
}
|
||||
|
||||
|
|
@ -2009,7 +2009,7 @@ initialize_setup() {
|
|||
# appropriate there).
|
||||
if [[ "$AUTO_YES" -eq 0 ]]; then
|
||||
while true; do
|
||||
read -rp "Enter AmneziaWG UDP port (1024-65535) [${AWG_PORT}]: " input_port < /dev/tty
|
||||
read -rp "Enter AmneziaWG UDP port (1-65535) [${AWG_PORT}]: " input_port < /dev/tty
|
||||
[[ -z "$input_port" ]] && break
|
||||
if ( validate_port "$input_port" ); then AWG_PORT=$input_port; break; fi
|
||||
log_warn "Please re-enter the port."
|
||||
|
|
|
|||
|
|
@ -8,14 +8,14 @@ fi
|
|||
# ==============================================================================
|
||||
# Скрипт для управления пользователями (пирами) AmneziaWG 2.0
|
||||
# Автор: @bivlked
|
||||
# Версия: 5.18.0
|
||||
# Дата: 2026-06-26
|
||||
# Версия: 5.18.1
|
||||
# Дата: 2026-06-27
|
||||
# Репозиторий: https://github.com/bivlked/amneziawg-installer
|
||||
# ==============================================================================
|
||||
|
||||
# --- Безопасный режим и Константы ---
|
||||
# shellcheck disable=SC2034
|
||||
SCRIPT_VERSION="5.18.0"
|
||||
SCRIPT_VERSION="5.18.1"
|
||||
set -o pipefail
|
||||
AWG_DIR="/root/awg"
|
||||
SERVER_CONF_FILE="/etc/amnezia/amneziawg/awg0.conf"
|
||||
|
|
|
|||
|
|
@ -8,14 +8,14 @@ fi
|
|||
# ==============================================================================
|
||||
# AmneziaWG 2.0 peer management script
|
||||
# Author: @bivlked
|
||||
# Version: 5.18.0
|
||||
# Date: 2026-06-26
|
||||
# Version: 5.18.1
|
||||
# Date: 2026-06-27
|
||||
# Repository: https://github.com/bivlked/amneziawg-installer
|
||||
# ==============================================================================
|
||||
|
||||
# --- Safe mode and Constants ---
|
||||
# shellcheck disable=SC2034
|
||||
SCRIPT_VERSION="5.18.0"
|
||||
SCRIPT_VERSION="5.18.1"
|
||||
set -o pipefail
|
||||
AWG_DIR="/root/awg"
|
||||
SERVER_CONF_FILE="/etc/amnezia/amneziawg/awg0.conf"
|
||||
|
|
|
|||
|
|
@ -6,7 +6,8 @@
|
|||
# canonical _valid_* in awg_common.sh. This file pins the hardening.
|
||||
#
|
||||
# .1 validators:
|
||||
# - validate_port: reject leading-zero/octal ('0080'), enforce 1024-65535
|
||||
# - validate_port: reject leading-zero/octal ('0080'), enforce 1-65535
|
||||
# (low ports like 443/80/53 allowed since v5.18.1 for DPI evasion)
|
||||
# - validate_subnet / validate_cidr_list: decimal octets, reject leading zeros
|
||||
# - validate_endpoint: structural [IPv6] check instead of charset-only
|
||||
# - validate_cidr_list: reject leading/trailing/double comma before split
|
||||
|
|
@ -30,14 +31,16 @@ setup() {
|
|||
# ---------- .1 validate_port ----------
|
||||
|
||||
@test ".1 validate_port: rejects leading-zero/octal and out-of-range" {
|
||||
for bad in 0080 080 80 0 23 65536 99999 abc ""; do
|
||||
# v5.18.1: low ports (1-1023) are now allowed; only zero, leading-zero/octal,
|
||||
# over-max and non-numeric stay rejected.
|
||||
for bad in 0080 080 0 65536 99999 abc ""; do
|
||||
run validate_port "$bad"
|
||||
[ "$status" -ne 0 ] || { echo "accepted invalid port: $bad"; false; }
|
||||
done
|
||||
}
|
||||
|
||||
@test ".1 validate_port: accepts valid high ports" {
|
||||
for ok in 1024 51820 65535; do
|
||||
@test ".1 validate_port: accepts valid ports incl. low DPI-evasion ports (v5.18.1)" {
|
||||
for ok in 1 53 80 443 1024 51820 65535; do
|
||||
run validate_port "$ok"
|
||||
[ "$status" -eq 0 ] || { echo "rejected valid port: $ok"; false; }
|
||||
done
|
||||
|
|
|
|||
149
tests/test_v5181_bugfix.bats
Normal file
149
tests/test_v5181_bugfix.bats
Normal file
|
|
@ -0,0 +1,149 @@
|
|||
#!/usr/bin/env bats
|
||||
# v5.18.1 bug-fix release. Three independent fixes:
|
||||
#
|
||||
# jue6 - install --force --port=N was silently ignored: render_server_config
|
||||
# calls load_awg_params, which re-reads ListenPort from the live
|
||||
# awg0.conf and overwrote the CLI/init port. The new server config now
|
||||
# takes the port from the init file (the user's intent, survives the
|
||||
# reboot-resume of --force). render_server_config is install-only, so
|
||||
# client regen (regenerate_client) is unaffected.
|
||||
# rl9c - client DNS default is now a Cloudflare pair "1.1.1.1, 1.0.0.1"
|
||||
# instead of a single resolver.
|
||||
# r11y - full-tunnel clients (AllowedIPs = 0.0.0.0/0) now get "0.0.0.0/0, ::/0"
|
||||
# so iOS AmneziaVPN accepts the "all traffic" mode. Split-tunnel
|
||||
# (custom list != 0.0.0.0/0) is untouched.
|
||||
# shellcheck disable=SC2154 # Variables set by sourced scripts at runtime
|
||||
|
||||
load test_helper
|
||||
|
||||
stub_nic() {
|
||||
get_main_nic() { echo "eth0"; }
|
||||
export -f get_main_nic
|
||||
}
|
||||
|
||||
# --- jue6: port from init wins over live awg0.conf in server render ---
|
||||
|
||||
@test "v5.18.1 jue6: render_server_config takes ListenPort from init, not old awg0.conf" {
|
||||
stub_nic
|
||||
create_init_config
|
||||
# Simulate --force --port=443: Step 0 saved the new port into init, while the
|
||||
# live awg0.conf still carries the old 39743.
|
||||
sed -i 's/^export AWG_PORT=.*/export AWG_PORT=443/' "$CONFIG_FILE"
|
||||
create_server_config
|
||||
echo "SERVER_PRIV" > "$AWG_DIR/server_private.key"
|
||||
|
||||
run render_server_config
|
||||
[ "$status" -eq 0 ]
|
||||
grep -qxF "ListenPort = 443" "$SERVER_CONF_FILE"
|
||||
# The stale 39743 from the old awg0.conf must not survive.
|
||||
run grep -qxF "ListenPort = 39743" "$SERVER_CONF_FILE"
|
||||
[ "$status" -ne 0 ]
|
||||
}
|
||||
|
||||
@test "v5.18.1 jue6: port unchanged when init matches old config (no --port)" {
|
||||
stub_nic
|
||||
create_init_config
|
||||
create_server_config
|
||||
echo "SERVER_PRIV" > "$AWG_DIR/server_private.key"
|
||||
|
||||
run render_server_config
|
||||
[ "$status" -eq 0 ]
|
||||
grep -qxF "ListenPort = 39743" "$SERVER_CONF_FILE"
|
||||
}
|
||||
|
||||
# --- rl9c: dual DNS default ---
|
||||
|
||||
@test "v5.18.1 rl9c: client config DNS defaults to 1.1.1.1, 1.0.0.1" {
|
||||
create_init_config
|
||||
render_client_config "c1" "10.9.9.2" "CLIENTPRIV" "SERVERPUB" "1.2.3.4" "443"
|
||||
grep -qxF "DNS = 1.1.1.1, 1.0.0.1" "$AWG_DIR/c1.conf"
|
||||
}
|
||||
|
||||
# --- r11y: full-tunnel ::/0 for iOS; split-tunnel untouched ---
|
||||
|
||||
@test "v5.18.1 r11y: full-tunnel client gets 0.0.0.0/0, ::/0" {
|
||||
create_init_config
|
||||
sed -i "s|^export ALLOWED_IPS=.*|export ALLOWED_IPS='0.0.0.0/0'|" "$CONFIG_FILE"
|
||||
render_client_config "c2" "10.9.9.3" "CLIENTPRIV" "SERVERPUB" "1.2.3.4" "443"
|
||||
grep -qxF "AllowedIPs = 0.0.0.0/0, ::/0" "$AWG_DIR/c2.conf"
|
||||
}
|
||||
|
||||
@test "v5.18.1 r11y: split-tunnel (custom list) does NOT get ::/0" {
|
||||
create_init_config
|
||||
sed -i "s|^export ALLOWED_IPS=.*|export ALLOWED_IPS='1.0.0.0/8, 2.0.0.0/7'|" "$CONFIG_FILE"
|
||||
render_client_config "c3" "10.9.9.4" "CLIENTPRIV" "SERVERPUB" "1.2.3.4" "443"
|
||||
grep -qxF "AllowedIPs = 1.0.0.0/8, 2.0.0.0/7" "$AWG_DIR/c3.conf"
|
||||
run grep -qF "::/0" "$AWG_DIR/c3.conf"
|
||||
[ "$status" -ne 0 ]
|
||||
}
|
||||
|
||||
# --- r11y/rl9c via regen: upgrade non-customized clients, preserve custom ones ---
|
||||
|
||||
# Build a full regen scenario: server peer block, an existing client .conf with
|
||||
# the OLD AllowedIPs/DNS, keys, and stubbed externals. regenerate_client runs the
|
||||
# real render + the restore-with-upgrade path under test.
|
||||
setup_regen_scenario() {
|
||||
# $1 name, $2 client_ip, $3 old_allowedips, $4 old_dns
|
||||
create_server_config
|
||||
create_init_config
|
||||
add_test_peer "$1" "$2"
|
||||
mkdir -p "$KEYS_DIR"
|
||||
printf 'FAKEPRIV' > "$KEYS_DIR/$1.private"
|
||||
printf 'FAKESERVERPUB' > "$AWG_DIR/server_public.key"
|
||||
cat > "$AWG_DIR/$1.conf" << EOF
|
||||
[Interface]
|
||||
PrivateKey = FAKEPRIV
|
||||
Address = $2/32
|
||||
DNS = $4
|
||||
MTU = 1280
|
||||
|
||||
[Peer]
|
||||
PublicKey = FAKESERVERPUB
|
||||
Endpoint = 1.2.3.4:39743
|
||||
AllowedIPs = $3
|
||||
PersistentKeepalive = 33
|
||||
EOF
|
||||
get_server_public_ip() { echo "1.2.3.4"; }
|
||||
_ensure_server_public_key() { return 0; }
|
||||
generate_qr() { return 0; }
|
||||
generate_vpn_uri() { return 0; }
|
||||
generate_qr_vpnuri() { return 0; }
|
||||
export -f get_server_public_ip _ensure_server_public_key generate_qr generate_vpn_uri generate_qr_vpnuri
|
||||
}
|
||||
|
||||
@test "v5.18.1 regen: full-tunnel client upgraded to ::/0 and DNS pair" {
|
||||
require_flock
|
||||
setup_regen_scenario "alice" "10.9.9.2" "0.0.0.0/0" "1.1.1.1"
|
||||
run regenerate_client "alice"
|
||||
[ "$status" -eq 0 ]
|
||||
grep -qxF "AllowedIPs = 0.0.0.0/0, ::/0" "$AWG_DIR/alice.conf"
|
||||
grep -qxF "DNS = 1.1.1.1, 1.0.0.1" "$AWG_DIR/alice.conf"
|
||||
}
|
||||
|
||||
@test "v5.18.1 regen: customized client (modify) preserved, no upgrade" {
|
||||
require_flock
|
||||
setup_regen_scenario "bob" "10.9.9.3" "10.0.0.0/8" "8.8.8.8"
|
||||
run regenerate_client "bob"
|
||||
[ "$status" -eq 0 ]
|
||||
grep -qxF "AllowedIPs = 10.0.0.0/8" "$AWG_DIR/bob.conf"
|
||||
grep -qxF "DNS = 8.8.8.8" "$AWG_DIR/bob.conf"
|
||||
run grep -qF "::/0" "$AWG_DIR/bob.conf"
|
||||
[ "$status" -ne 0 ]
|
||||
}
|
||||
|
||||
# --- RU/EN parity of the three fixes ---
|
||||
|
||||
@test "v5.18.1 parity: jue6 init-port override present in RU+EN" {
|
||||
local p
|
||||
for p in awg_common.sh awg_common_en.sh; do
|
||||
grep -qF '_init_port=$(grep -oP' "${BATS_TEST_DIRNAME}/../$p"
|
||||
done
|
||||
}
|
||||
|
||||
@test "v5.18.1 parity: rl9c dual DNS + r11y ::/0 present in RU+EN" {
|
||||
local p
|
||||
for p in awg_common.sh awg_common_en.sh; do
|
||||
grep -qF 'DNS = 1.1.1.1, 1.0.0.1' "${BATS_TEST_DIRNAME}/../$p"
|
||||
grep -qF 'allowed_ips="0.0.0.0/0, ::/0"' "${BATS_TEST_DIRNAME}/../$p"
|
||||
done
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue