feat: bootstrap awg2 harness rust workspace and docs
This commit is contained in:
@@ -0,0 +1,14 @@
|
||||
# /etc/systemd/system/amnezia-tc-watcher.service
|
||||
[Unit]
|
||||
Description=AmneziaWG docker watcher
|
||||
After=docker.service
|
||||
Requires=docker.service
|
||||
|
||||
[Service]
|
||||
Type=simple
|
||||
Restart=always
|
||||
RestartSec=3
|
||||
ExecStart=/opt/amnezia/docker_watcher.sh
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,14 @@
|
||||
# /etc/systemd/system/amnezia-tc.service
|
||||
[Unit]
|
||||
Description=Apply AmneziaWG traffic limits
|
||||
After=docker.service network-online.target
|
||||
Requires=docker.service
|
||||
|
||||
[Service]
|
||||
Type=oneshot
|
||||
Environment=WG_IF=awg0
|
||||
ExecStart=/opt/amnezia/limit_peers.sh
|
||||
RemainAfterExit=yes
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
@@ -0,0 +1,190 @@
|
||||
root@5862577-oj93961:~# cat /usr/local/bin/check-vpn-limits
|
||||
#!/bin/bash
|
||||
echo "┌──────────────────────────────────────────────────┐"
|
||||
echo "│ AmneziaWG Traffic Control v1.2 │"
|
||||
echo "└──────────────────────────────────────────────────┘"
|
||||
echo ""
|
||||
|
||||
# === Auto-detect container and interface ===
|
||||
# Supported container names in order of preference
|
||||
POSSIBLE_CONTAINERS=("amnezia-awg" "amnezia-awg2")
|
||||
CONTAINER=""
|
||||
for name in "${POSSIBLE_CONTAINERS[@]}"; do
|
||||
if docker ps --format '{{.Names}}' 2>/dev/null | grep -xq "$name"; then
|
||||
CONTAINER="$name"
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
# helper to run docker exec if container found
|
||||
docker_exec() {
|
||||
if [ -z "$CONTAINER" ]; then
|
||||
return 1
|
||||
fi
|
||||
docker exec "$CONTAINER" "$@"
|
||||
}
|
||||
|
||||
# detect interface name inside container (prefer wg*, tun*, amnezia*, veth*)
|
||||
IF=""
|
||||
if [ -n "$CONTAINER" ]; then
|
||||
IF=$(docker_exec sh -c "ip -o link show 2>/dev/null | awk -F': ' '{print \$2}'" 2>/dev/null | \
|
||||
egrep -o '^(wg[0-9]+|wg|amnezia[0-9]*|tun[0-9]+|veth[0-9]+)' | head -n1 || true)
|
||||
|
||||
# fallback: pick first iface that has an ipv4 address inside container
|
||||
if [ -z "$IF" ]; then
|
||||
IF=$(docker_exec sh -c "ip -o -4 addr show 2>/dev/null | awk '{print \$2}'" 2>/dev/null | head -n1 || true)
|
||||
fi
|
||||
fi
|
||||
|
||||
# final fallback to wg0 for backwards-compatibility (if nothing found)
|
||||
IF=${IF:-wg0}
|
||||
|
||||
# 1. Состояние системы
|
||||
echo "📊 СИСТЕМНЫЙ СТАТУС:"
|
||||
if systemctl is-active amnezia-tc.service >/dev/null 2>&1; then
|
||||
echo " Сервис: ✅ активен"
|
||||
else
|
||||
echo " Сервис: ❌ неактивен"
|
||||
fi
|
||||
|
||||
if systemctl is-active amnezia-tc.timer >/dev/null 2>&1; then
|
||||
next_time=$(systemctl list-timers --all | grep amnezia 2>/dev/null | head -1 | awk '{print $2, $3, $4, $5}')
|
||||
if [ -n "$next_time" ]; then
|
||||
echo " Таймер: ✅ активен (след. запуск: $next_time)"
|
||||
else
|
||||
echo " Таймер: ✅ активен (расписание не найдено)"
|
||||
fi
|
||||
else
|
||||
echo " Таймер: ❌ неактивен"
|
||||
fi
|
||||
|
||||
# container status (if found)
|
||||
if [ -n "$CONTAINER" ]; then
|
||||
container_status=$(docker ps --filter "name=^${CONTAINER}$" --format '{{.Status}}' 2>/dev/null)
|
||||
echo " Контейнер: ✅ ${CONTAINER} — ${container_status}"
|
||||
else
|
||||
# Try to detect if any amnezia container exists at all (for clearer message)
|
||||
any_amnezia=$(docker ps --format '{{.Names}}' 2>/dev/null | grep -i amne || true)
|
||||
if [ -n "$any_amnezia" ]; then
|
||||
echo " Контейнер: ❌ ожидается amnezia-awg/awg2, но не найден в списке запущенных контейнеров. Найдены: $any_amnezia"
|
||||
else
|
||||
echo " Контейнер: ❌ не запущен"
|
||||
fi
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# 2. Клиенты
|
||||
echo "👥 ПОДКЛЮЧЕННЫЕ КЛИЕНТЫ:"
|
||||
if [ -n "$CONTAINER" ]; then
|
||||
docker_exec wg show 2>/dev/null | awk '
|
||||
BEGIN {count=0}
|
||||
/^peer:/ {peer=$2}
|
||||
/allowed ips:/ {ip=$3; gsub("/32","",ip)}
|
||||
/latest handshake:/ {
|
||||
if ($3 == "Never") {
|
||||
status="❌ отключен"
|
||||
time="никогда"
|
||||
} else {
|
||||
time=$3" "$4
|
||||
if ($4 ~ /second|minute/) status="✅ онлайн"
|
||||
else if ($4 ~ /hour/) status="⚠ давно"
|
||||
else status="✅ онлайн"
|
||||
}
|
||||
}
|
||||
/transfer:/ {
|
||||
rx=$3; tx=$6
|
||||
printf " • %-15s %-15s %8s ↓ / %8s ↑\n", ip, status, rx, tx
|
||||
count++
|
||||
}'
|
||||
if ! docker ps --format '{{.Names}}' 2>/dev/null | grep -q -x "$CONTAINER"; then
|
||||
echo " Контейнер не запущен"
|
||||
fi
|
||||
else
|
||||
echo " Контейнер не запущен — не могу показать клиентов (wg)."
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# 3. Ограничения TC
|
||||
echo "⏸️ ОГРАНИЧЕНИЯ ТРАФИКА (70 Мбит/с):"
|
||||
if [ -n "$CONTAINER" ]; then
|
||||
count=$(docker_exec sh -c "tc class show dev ${IF} 2>/dev/null | grep -c 'rate 70Mbit'" 2>/dev/null || true)
|
||||
if [ -n "$count" ] && [ "$count" -gt 0 ]; then
|
||||
echo " Классы TC:"
|
||||
docker_exec sh -c "tc class show dev ${IF} 2>/dev/null | grep 'rate 70Mbit'" 2>/dev/null | \
|
||||
while read -r line; do
|
||||
class_id=$(echo "$line" | awk '{print $2}' | cut -d: -f2)
|
||||
if [ -n "$class_id" ]; then
|
||||
echo " • Класс 1:$class_id → 70 Мбит/с"
|
||||
fi
|
||||
done
|
||||
echo " ✅ Ограничения активны для $count клиентов"
|
||||
else
|
||||
echo " ❌ Нет активных ограничений"
|
||||
fi
|
||||
else
|
||||
echo " Контейнер не запущен"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# 4. Статистика фильтров
|
||||
echo "📈 СТАТИСТИКА ФИЛЬТРОВ:"
|
||||
if [ -n "$CONTAINER" ]; then
|
||||
docker_exec sh -c "tc -s filter show dev ${IF} parent 1: 2>/dev/null" 2>/dev/null | \
|
||||
grep -B1 -A1 "flowid" | while read -r line1; do
|
||||
if echo "$line1" | grep -q "flowid"; then
|
||||
read -r line2
|
||||
read -r line3
|
||||
class=$(echo "$line1" | grep -o "flowid 1:[0-9]*" | cut -d: -f2)
|
||||
hex_ip=$(echo "$line2" | grep -o "match [0-9a-f]*" | awk '{print $2}')
|
||||
success=$(echo "$line3" | grep -o "success [0-9]*" | awk '{print $2}')
|
||||
|
||||
if [ -n "$hex_ip" ] && [ -n "$class" ]; then
|
||||
ip=$(printf "%d.%d.%d.%d" \
|
||||
0x${hex_ip:0:2} \
|
||||
0x${hex_ip:2:2} \
|
||||
0x${hex_ip:4:2} \
|
||||
0x${hex_ip:6:2} 2>/dev/null)
|
||||
|
||||
if [ -n "$success" ] && [ "$success" -gt 0 ]; then
|
||||
echo " • $ip → активен ($success пакетов)"
|
||||
else
|
||||
echo " • $ip → ожидание трафика"
|
||||
fi
|
||||
fi
|
||||
fi
|
||||
done
|
||||
if ! docker_exec sh -c "tc -s filter show dev ${IF} parent 1: 2>/dev/null" 2>/dev/null | grep -q "flowid"; then
|
||||
echo " Нет активных фильтров"
|
||||
fi
|
||||
else
|
||||
echo " Контейнер не запущен"
|
||||
fi
|
||||
echo ""
|
||||
|
||||
# 5. Последние события
|
||||
echo "🔄 ПОСЛЕДНИЕ СОБЫТИЯ:"
|
||||
if [ -f "/var/log/amnezia-tc.log" ]; then
|
||||
tail -3 /var/log/amnezia-tc.log | while read -r line; do
|
||||
message=$(echo "$line" | cut -d']' -f2-)
|
||||
echo " $message"
|
||||
done
|
||||
else
|
||||
echo " Лог-файл не найден"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "┌──────────────────────────────────────────────────┐"
|
||||
echo "│ СИСТЕМА ГОТОВА К ЭКСПЛУАТАЦИИ! 🎉 │"
|
||||
echo "│ │"
|
||||
echo "│ Проверено: │"
|
||||
echo "│ ✅ Автозапуск после перезагрузки │"
|
||||
echo "│ ✅ Автоматическое восстановление правил │"
|
||||
echo "│ ✅ Ограничение 70 Мбит/с на клиента │"
|
||||
echo "│ ✅ Обнаружение новых клиентов │"
|
||||
echo "└──────────────────────────────────────────────────┘"
|
||||
echo ""
|
||||
echo "📋 Команды управления:"
|
||||
echo " check-vpn-limits - этот отчет"
|
||||
echo " systemctl restart amnezia-tc.service - перезапуск"
|
||||
echo " journalctl -u amnezia-tc.service -f - логи"
|
||||
echo " docker restart ${CONTAINER:-amnezia-awg2} - перезапуск WG (поменяйте имя при необходимости)"
|
||||
@@ -0,0 +1,25 @@
|
||||
#!/usr/bin/env bash
|
||||
set -e
|
||||
|
||||
wait_wg() {
|
||||
local c="$1"
|
||||
for i in {1..20}; do
|
||||
if docker exec "$c" ip link show awg0 >/dev/null 2>&1; then
|
||||
return 0
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
return 1
|
||||
}
|
||||
|
||||
docker events --filter event=start --format '{{.Actor.Attributes.name}}' | while read name; do
|
||||
if [[ "$name" == "amnezia-awg2" || "$name" == "amnezia-awg" ]]; then
|
||||
echo "[watcher] container started: $name, waiting wg..."
|
||||
if wait_wg "$name"; then
|
||||
echo "[watcher] wg ready, applying limits"
|
||||
WG_IF=awg0 /opt/amnezia/limit_peers.sh
|
||||
else
|
||||
echo "[watcher] wg not appeared, skip"
|
||||
fi
|
||||
fi
|
||||
done
|
||||
@@ -0,0 +1,24 @@
|
||||
root@5862577-oj93961:~# echo "===== kernel ====="
|
||||
===== kernel =====
|
||||
root@5862577-oj93961:~# uname -a
|
||||
== iproute2 ====="
|
||||
tc -V
|
||||
|
||||
echo "===== docker ====="
|
||||
docker -Linux 5862577-oj93961 6.12.57+deb13-cloud-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.57-1 (2025-11-05) x86_64 GNU/Linux
|
||||
root@5862577-oj93961:~#
|
||||
root@5862577-oj93961:~# echo "===== iproute2 ====="
|
||||
===== iproute2 =====
|
||||
root@5862577-oj93961:~# tc -V
|
||||
inspect amnezia-awg2 --format '{{.Config.Image}}'tc utility, iproute2-6.15.0, libbpf 1.5.0
|
||||
root@5862577-oj93961:~#
|
||||
root@5862577-oj93961:~# echo "===== docker ====="
|
||||
===== docker =====
|
||||
root@5862577-oj93961:~# docker --version
|
||||
Docker version 26.1.5+dfsg1, build a72d7cd
|
||||
root@5862577-oj93961:~#
|
||||
root@5862577-oj93961:~# echo "===== amnezia container ====="
|
||||
===== amnezia container =====
|
||||
root@5862577-oj93961:~# docker inspect amnezia-awg2 --format '{{.Config.Image}}'
|
||||
amnezia-awg2
|
||||
root@5862577-oj93961:~#
|
||||
@@ -0,0 +1,138 @@
|
||||
#!/usr/bin/env bash
|
||||
# Traffic control for AmneziaWG (production-ready)
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
LOG="/var/log/amnezia-tc.log"
|
||||
LOCK_FILE="/tmp/amnezia-tc.lock"
|
||||
LIMIT="${LIMIT:-70mbit}"
|
||||
CONTAINER=""
|
||||
WG_IF="${WG_IF:-wg0}"
|
||||
|
||||
# Prefer new container name, fall back to old
|
||||
for c in amnezia-awg2 amnezia-awg; do
|
||||
if docker ps --format '{{.Names}}' 2>/dev/null | grep -xq "$c"; then
|
||||
CONTAINER="$c"
|
||||
break
|
||||
fi
|
||||
done
|
||||
|
||||
log() {
|
||||
echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG"
|
||||
}
|
||||
|
||||
# Lock to avoid concurrent runs
|
||||
exec 200>"$LOCK_FILE"
|
||||
flock -n 200 || { log "Script already running, exit"; exit 0; }
|
||||
|
||||
if [ -z "$CONTAINER" ]; then
|
||||
log "Container amnezia-awg2/amnezia-awg not found, exit"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# detect interface inside container if default not present there
|
||||
if ! docker exec "$CONTAINER" ip link show "$WG_IF" >/dev/null 2>&1; then
|
||||
DET_IF=$(docker exec "$CONTAINER" sh -c "ip -o link show 2>/dev/null | awk -F': ' '{print $2}'" 2>/dev/null \
|
||||
| egrep -o '^(wg[0-9]+|wg|awg[0-9]*|amnezia[0-9]*|tun[0-9]+)' | head -n1 || true)
|
||||
|
||||
if [ -n "$DET_IF" ]; then
|
||||
WG_IF="$DET_IF"
|
||||
log "Detected interface inside container: $WG_IF"
|
||||
else
|
||||
log "Interface $WG_IF not found inside container $CONTAINER, exit"
|
||||
exit 0
|
||||
fi
|
||||
fi
|
||||
|
||||
log "=== Start updating rules === (container=$CONTAINER, iface=$WG_IF, limit=$LIMIT)"
|
||||
|
||||
# Get current clients
|
||||
CLIENT_IPS=$(docker exec "$CONTAINER" sh -c "wg show all allowed-ips 2>/dev/null" 2>/dev/null \
|
||||
| awk '{print $3}' | grep -oE '10\.8\.1\.[0-9]{1,3}' | sort -u || true)
|
||||
|
||||
# fallback
|
||||
if [ -z "$CLIENT_IPS" ]; then
|
||||
CLIENT_IPS=$(docker exec "$CONTAINER" sh -c "wg show 2>/dev/null" 2>/dev/null \
|
||||
| grep -Eo '10\.8\.1\.[0-9]{1,3}' | sort -u || true)
|
||||
fi
|
||||
|
||||
if [ -z "$CLIENT_IPS" ]; then
|
||||
log "No clients found, exit"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
log "Clients: $(echo $CLIENT_IPS | tr '\n' ' ')"
|
||||
|
||||
EXISTING_RULES=$(docker exec "$CONTAINER" sh -c "tc filter show dev $WG_IF parent 1: 2>/dev/null || true" 2>/dev/null \
|
||||
| grep -oE 'match [0-9a-f]+' | awk '{print $2}' | sort -u || true)
|
||||
|
||||
NEEDS_UPDATE=false
|
||||
|
||||
num_ips=$(echo "$CLIENT_IPS" | wc -w)
|
||||
num_rules=$(echo "$EXISTING_RULES" | wc -w)
|
||||
if [ "$num_rules" -ne "$num_ips" ] || [ -z "$EXISTING_RULES" ]; then
|
||||
NEEDS_UPDATE=true
|
||||
else
|
||||
for ip in $CLIENT_IPS; do
|
||||
hex_ip=$(printf '%02x' ${ip//./ } | tr -d '\n' || true)
|
||||
if ! echo "$EXISTING_RULES" | grep -q "$hex_ip"; then
|
||||
NEEDS_UPDATE=true
|
||||
break
|
||||
fi
|
||||
done
|
||||
fi
|
||||
|
||||
if [ "$NEEDS_UPDATE" = false ]; then
|
||||
log "Rules are already up-to-date, skip"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
log "Updating rules (old will be removed)"
|
||||
|
||||
docker exec "$CONTAINER" sh -c "
|
||||
tc qdisc del dev $WG_IF root 2>/dev/null || true
|
||||
tc qdisc del dev $WG_IF ingress 2>/dev/null || true
|
||||
ip link del ifb0 2>/dev/null || true
|
||||
" 2>/dev/null || true
|
||||
|
||||
docker exec "$CONTAINER" sh -c "
|
||||
tc qdisc add dev $WG_IF root handle 1: htb 2>/dev/null || true
|
||||
tc class add dev $WG_IF parent 1: classid 1:1 htb rate 1000mbit ceil 1000mbit 2>/dev/null || true
|
||||
" 2>/dev/null || true
|
||||
|
||||
docker exec "$CONTAINER" sh -c "
|
||||
modprobe ifb 2>/dev/null || true
|
||||
ip link add name ifb0 type ifb 2>/dev/null || true
|
||||
ip link set dev ifb0 up 2>/dev/null || true
|
||||
|
||||
tc qdisc add dev $WG_IF handle ffff: ingress 2>/dev/null || true
|
||||
tc filter add dev $WG_IF parent ffff: protocol all u32 match u32 0 0 action mirred egress redirect dev ifb0 2>/dev/null || true
|
||||
|
||||
tc qdisc add dev ifb0 root handle 2: htb 2>/dev/null || true
|
||||
tc class add dev ifb0 parent 2: classid 2:1 htb rate 1000mbit ceil 1000mbit 2>/dev/null || true
|
||||
" 2>/dev/null || true
|
||||
|
||||
class_id=10
|
||||
count=0
|
||||
for ip in $CLIENT_IPS; do
|
||||
log "Adding limit for $ip (class $class_id)"
|
||||
|
||||
docker exec "$CONTAINER" sh -c "
|
||||
tc class add dev $WG_IF parent 1:1 classid 1:$class_id htb rate $LIMIT ceil $LIMIT 2>/dev/null || true
|
||||
tc qdisc add dev $WG_IF parent 1:$class_id fq_codel 2>/dev/null || true
|
||||
tc filter add dev $WG_IF parent 1: protocol ip u32 match ip dst $ip flowid 1:$class_id 2>/dev/null || true
|
||||
" 2>/dev/null || true
|
||||
|
||||
docker exec "$CONTAINER" sh -c "
|
||||
tc class add dev ifb0 parent 2:1 classid 2:$class_id htb rate $LIMIT ceil $LIMIT 2>/dev/null || true
|
||||
tc qdisc add dev ifb0 parent 2:$class_id fq_codel 2>/dev/null || true
|
||||
tc filter add dev ifb0 parent 2: protocol ip u32 match ip src $ip flowid 2:$class_id 2>/dev/null || true
|
||||
" 2>/dev/null || true
|
||||
|
||||
class_id=$((class_id + 1))
|
||||
count=$((count + 1))
|
||||
done
|
||||
|
||||
log "Limits applied for $count clients"
|
||||
log "=== Completed successfully ==="
|
||||
exit 0
|
||||
@@ -0,0 +1,17 @@
|
||||
root@5862577-oj93961:~# echo "===== permissions ====="
|
||||
===== permissions =====
|
||||
root@5862577-oj93961:~# ls -l /opt/amnezia/
|
||||
ho "===== systemd enabled ====="
|
||||
systemctl is-enabled amnezia-tc.service
|
||||
systemctl is-enabled amnezia-tc-watchtotal 16
|
||||
drwxr-xr-x 2 root root 4096 Feb 21 05:15 amnezia-awg2
|
||||
-rwxr-xr-x 1 root root 618 Feb 21 18:24 docker_watcher.sh
|
||||
-rwxr-xr-x 1 root root 4496 Feb 21 18:17 limit_peers.sh
|
||||
root@5862577-oj93961:~#
|
||||
root@5862577-oj93961:~# echo "===== systemd enabled ====="
|
||||
===== systemd enabled =====
|
||||
root@5862577-oj93961:~# systemctl is-enabled amnezia-tc.service
|
||||
enabled
|
||||
root@5862577-oj93961:~# systemctl is-enabled amnezia-tc-watcher.service
|
||||
enabled
|
||||
root@5862577-oj93961:~#
|
||||
@@ -0,0 +1,172 @@
|
||||
root@5862577-oj93961:~# echo "===== TC qdisc ====="
|
||||
===== TC qdisc =====
|
||||
root@5862577-oj93961:~# docker exec amnezia-awg2 tc qdisc show dev awg0
|
||||
|
||||
docker exec amnezia-awg2 tc class show dev awg0
|
||||
|
||||
echo "===== TC filters ====="
|
||||
docker exec amnezia-awg2 tc filter show dev awg0qdisc htb 1: root refcnt 2 r2q 10 default 0 direct_packets_stat 6 direct_qlen 500
|
||||
qdisc fq_codel 807b: parent 1:24 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 807f: parent 1:26 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 807d: parent 1:25 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8081: parent 1:27 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8083: parent 1:28 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8087: parent 1:30 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8085: parent 1:29 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8089: parent 1:31 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 805f: parent 1:10 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 808b: parent 1:32 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8063: parent 1:12 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8061: parent 1:11 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8065: parent 1:13 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8067: parent 1:14 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 806b: parent 1:16 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8069: parent 1:15 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 806d: parent 1:17 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 806f: parent 1:18 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8071: parent 1:19 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8075: parent 1:21 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8073: parent 1:20 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8077: parent 1:22 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc fq_codel 8079: parent 1:23 limit 10240p flows 1024 quantum 1420 target 5ms interval 100ms memory_limit 32Mb ecn drop_batch 64
|
||||
qdisc ingress ffff: parent ffff:fff1 ----------------
|
||||
root@5862577-oj93961:~#
|
||||
root@5862577-oj93961:~# echo "===== TC class ====="
|
||||
===== TC class =====
|
||||
root@5862577-oj93961:~# docker exec amnezia-awg2 tc class show dev awg0
|
||||
class htb 1:11 parent 1:1 leaf 8061: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:32 parent 1:1 leaf 808b: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:10 parent 1:1 leaf 805f: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:31 parent 1:1 leaf 8089: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:13 parent 1:1 leaf 8065: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:30 parent 1:1 leaf 8087: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:12 parent 1:1 leaf 8063: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:15 parent 1:1 leaf 8069: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:14 parent 1:1 leaf 8067: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:17 parent 1:1 leaf 806d: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:16 parent 1:1 leaf 806b: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:19 parent 1:1 leaf 8071: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:18 parent 1:1 leaf 806f: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:22 parent 1:1 leaf 8077: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:23 parent 1:1 leaf 8079: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:1 root rate 1Gbit ceil 1Gbit burst 1375b cburst 1375b
|
||||
class htb 1:20 parent 1:1 leaf 8073: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:21 parent 1:1 leaf 8075: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:26 parent 1:1 leaf 807f: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:27 parent 1:1 leaf 8081: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:24 parent 1:1 leaf 807b: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:25 parent 1:1 leaf 807d: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:28 parent 1:1 leaf 8083: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class htb 1:29 parent 1:1 leaf 8085: prio 0 rate 70Mbit ceil 70Mbit burst 1583b cburst 1583b
|
||||
class fq_codel 805f:75 parent 805f:
|
||||
class fq_codel 805f:7b parent 805f:
|
||||
class fq_codel 805f:325 parent 805f:
|
||||
class fq_codel 805f:3ab parent 805f:
|
||||
class fq_codel 805f:3e5 parent 805f:
|
||||
class fq_codel 808b:41 parent 808b:
|
||||
class fq_codel 808b:d5 parent 808b:
|
||||
class fq_codel 808b:e7 parent 808b:
|
||||
class fq_codel 808b:147 parent 808b:
|
||||
class fq_codel 808b:1a4 parent 808b:
|
||||
class fq_codel 8063:251 parent 8063:
|
||||
class fq_codel 8063:290 parent 8063:
|
||||
class fq_codel 8061:284 parent 8061:
|
||||
class fq_codel 8065:203 parent 8065:
|
||||
class fq_codel 8069:2bf parent 8069:
|
||||
root@5862577-oj93961:~#
|
||||
root@5862577-oj93961:~# echo "===== TC filters ====="
|
||||
===== TC filters =====
|
||||
root@5862577-oj93961:~# docker exec amnezia-awg2 tc filter show dev awg0
|
||||
filter parent 1: protocol ip pref 49130 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49130 u32 chain 0 fh 816: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49130 u32 chain 0 fh 816::800 order 2048 key ht 816 bkt 0 flowid 1:32 not_in_hw
|
||||
match 0a080105/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49131 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49131 u32 chain 0 fh 815: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49131 u32 chain 0 fh 815::800 order 2048 key ht 815 bkt 0 flowid 1:31 not_in_hw
|
||||
match 0a080104/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49132 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49132 u32 chain 0 fh 814: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49132 u32 chain 0 fh 814::800 order 2048 key ht 814 bkt 0 flowid 1:30 not_in_hw
|
||||
match 0a080103/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49133 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49133 u32 chain 0 fh 813: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49133 u32 chain 0 fh 813::800 order 2048 key ht 813 bkt 0 flowid 1:29 not_in_hw
|
||||
match 0a08011b/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49134 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49134 u32 chain 0 fh 812: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49134 u32 chain 0 fh 812::800 order 2048 key ht 812 bkt 0 flowid 1:28 not_in_hw
|
||||
match 0a08011a/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49135 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49135 u32 chain 0 fh 811: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49135 u32 chain 0 fh 811::800 order 2048 key ht 811 bkt 0 flowid 1:27 not_in_hw
|
||||
match 0a080119/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49136 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49136 u32 chain 0 fh 810: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49136 u32 chain 0 fh 810::800 order 2048 key ht 810 bkt 0 flowid 1:26 not_in_hw
|
||||
match 0a080118/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49137 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49137 u32 chain 0 fh 80f: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49137 u32 chain 0 fh 80f::800 order 2048 key ht 80f bkt 0 flowid 1:25 not_in_hw
|
||||
match 0a080117/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49138 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49138 u32 chain 0 fh 80e: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49138 u32 chain 0 fh 80e::800 order 2048 key ht 80e bkt 0 flowid 1:24 not_in_hw
|
||||
match 0a080116/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49139 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49139 u32 chain 0 fh 80d: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49139 u32 chain 0 fh 80d::800 order 2048 key ht 80d bkt 0 flowid 1:23 not_in_hw
|
||||
match 0a080115/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49140 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49140 u32 chain 0 fh 80c: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49140 u32 chain 0 fh 80c::800 order 2048 key ht 80c bkt 0 flowid 1:22 not_in_hw
|
||||
match 0a080114/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49141 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49141 u32 chain 0 fh 80b: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49141 u32 chain 0 fh 80b::800 order 2048 key ht 80b bkt 0 flowid 1:21 not_in_hw
|
||||
match 0a080102/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49142 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49142 u32 chain 0 fh 80a: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49142 u32 chain 0 fh 80a::800 order 2048 key ht 80a bkt 0 flowid 1:20 not_in_hw
|
||||
match 0a080113/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49143 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49143 u32 chain 0 fh 809: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49143 u32 chain 0 fh 809::800 order 2048 key ht 809 bkt 0 flowid 1:19 not_in_hw
|
||||
match 0a080112/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49144 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49144 u32 chain 0 fh 808: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49144 u32 chain 0 fh 808::800 order 2048 key ht 808 bkt 0 flowid 1:18 not_in_hw
|
||||
match 0a080111/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49145 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49145 u32 chain 0 fh 807: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49145 u32 chain 0 fh 807::800 order 2048 key ht 807 bkt 0 flowid 1:17 not_in_hw
|
||||
match 0a080110/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49146 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49146 u32 chain 0 fh 806: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49146 u32 chain 0 fh 806::800 order 2048 key ht 806 bkt 0 flowid 1:16 not_in_hw
|
||||
match 0a08010f/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49147 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49147 u32 chain 0 fh 805: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49147 u32 chain 0 fh 805::800 order 2048 key ht 805 bkt 0 flowid 1:15 not_in_hw
|
||||
match 0a08010e/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49148 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49148 u32 chain 0 fh 804: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49148 u32 chain 0 fh 804::800 order 2048 key ht 804 bkt 0 flowid 1:14 not_in_hw
|
||||
match 0a08010d/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49149 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49149 u32 chain 0 fh 803: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49149 u32 chain 0 fh 803::800 order 2048 key ht 803 bkt 0 flowid 1:13 not_in_hw
|
||||
match 0a08010c/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49150 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49150 u32 chain 0 fh 802: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49150 u32 chain 0 fh 802::800 order 2048 key ht 802 bkt 0 flowid 1:12 not_in_hw
|
||||
match 0a08010b/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49151 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49151 u32 chain 0 fh 801: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49151 u32 chain 0 fh 801::800 order 2048 key ht 801 bkt 0 flowid 1:11 not_in_hw
|
||||
match 0a08010a/ffffffff at 16
|
||||
filter parent 1: protocol ip pref 49152 u32 chain 0
|
||||
filter parent 1: protocol ip pref 49152 u32 chain 0 fh 800: ht divisor 1
|
||||
filter parent 1: protocol ip pref 49152 u32 chain 0 fh 800::800 order 2048 key ht 800 bkt 0 flowid 1:10 not_in_hw
|
||||
match 0a080101/ffffffff at 16
|
||||
root@5862577-oj93961:~#
|
||||
@@ -0,0 +1,129 @@
|
||||
root@5862577-oj93961:~# echo "===== WG peers ====="
|
||||
===== WG peers =====
|
||||
root@5862577-oj93961:~# docker exec amnezia-awg2 wg show
|
||||
interface: awg0
|
||||
public key: 03RA0Pz5SXeHFlYOWVtbtuFFr1qRZfwoIsp1dX/KXA8=
|
||||
private key: (hidden)
|
||||
listening port: 44344
|
||||
jc: 4
|
||||
jmin: 10
|
||||
jmax: 50
|
||||
s1: 108
|
||||
s2: 92
|
||||
s3: 37
|
||||
s4: 5
|
||||
h1: 1644392140-1655070006
|
||||
h2: 1744170008-1963857766
|
||||
h3: 2020199760-2027285116
|
||||
h4: 2115790963-2141451260
|
||||
|
||||
peer: trH/DMazLMdu1QE5uXhpesx5SzWvNFoW5KZHd+gTulA=
|
||||
preshared key: (hidden)
|
||||
endpoint: 172.29.172.1:46697
|
||||
allowed ips: 10.8.1.5/32
|
||||
latest handshake: 14 seconds ago
|
||||
transfer: 575.60 KiB received, 1.42 MiB sent
|
||||
|
||||
peer: LNoepSV+wHrq8xrpG3nVR7ciSk3qqoOCtvZCkSpjbno=
|
||||
preshared key: (hidden)
|
||||
endpoint: 172.29.172.1:49282
|
||||
allowed ips: 10.8.1.11/32
|
||||
latest handshake: 14 seconds ago
|
||||
transfer: 7.53 MiB received, 159.08 MiB sent
|
||||
|
||||
peer: C57aO+jMb6LBJ8kI/olF8JLIM3SnERumSyZjEFm5jlY=
|
||||
preshared key: (hidden)
|
||||
endpoint: 172.29.172.1:51133
|
||||
allowed ips: 10.8.1.14/32
|
||||
latest handshake: 23 seconds ago
|
||||
transfer: 81.93 KiB received, 104.35 KiB sent
|
||||
|
||||
peer: FlbqHCQdjC53Wn9xFLq8E/v1RJmT0r93wV9w+uVrBCs=
|
||||
preshared key: (hidden)
|
||||
endpoint: 172.29.172.1:54591
|
||||
allowed ips: 10.8.1.12/32
|
||||
latest handshake: 40 seconds ago
|
||||
transfer: 5.16 MiB received, 102.56 MiB sent
|
||||
|
||||
peer: oAYyolWjgRmfWejHdjzoUivF7yk0FGsy1B3IeF0PLBg=
|
||||
preshared key: (hidden)
|
||||
endpoint: 172.29.172.1:51761
|
||||
allowed ips: 10.8.1.1/32
|
||||
latest handshake: 42 seconds ago
|
||||
transfer: 2.01 MiB received, 2.39 MiB sent
|
||||
|
||||
peer: jLBpMPRBc7E8b1NEDjlVHAVQG3PN7fmueC9paf8K8yM=
|
||||
preshared key: (hidden)
|
||||
endpoint: 172.29.172.1:57449
|
||||
allowed ips: 10.8.1.10/32
|
||||
latest handshake: 44 seconds ago
|
||||
transfer: 225.05 MiB received, 3.14 GiB sent
|
||||
|
||||
peer: OMeNeKilU+f1ilnrnwgpbyRV8lyVT9psAIK5iJLoKxI=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.27/32
|
||||
|
||||
peer: IYyJq14x4kOA8SbbCd+u6WQNuVZntLuSQu0JSs78uk4=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.26/32
|
||||
|
||||
peer: a+Yw80sFSnyKFXbfOZtQupWiO2f9BWLby7ydbyo7+RA=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.2/32
|
||||
|
||||
peer: Ir8DYbG96qGhudYPGpNSqs7AZaMO9oF6yecb0cq4WTQ=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.4/32
|
||||
|
||||
peer: Sg56DQUHGl9byHOLvrJBNbwQER+Y9LttyaonPTFX8Eg=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.16/32
|
||||
|
||||
peer: wgeDnqt7hfSPgHlGbpdKkDhAwWbKRBDsWBQ2e3OATlM=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.19/32
|
||||
|
||||
peer: iF4DdwwnEnWQ6Ve4KrnHt88dSGyr1reQWQuHGQ3OzSg=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.24/32
|
||||
|
||||
peer: kA8CUmfjcGAACXJHsVEXFxReLKU+/LGpZjI6Va+kwDQ=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.20/32
|
||||
|
||||
peer: J130uXmnNsPs7+OahiqG5hUOtJ/4eEOgeL3or9QMYQs=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.3/32
|
||||
|
||||
peer: 5QdCq+tlMDL4PTs7z9LD9g26Qr+bNeWxnmSI/DzBaDM=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.15/32
|
||||
|
||||
peer: KnqncORZhtC5RhC+MSttDLla19jCHrxooUvIY+MmnhA=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.18/32
|
||||
|
||||
peer: z8hfD0AqagIxJjob242MbQWdM2E450f4v/g4Pe9YUBc=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.23/32
|
||||
|
||||
peer: +XNRC3O5TEYAJWqF5ihN9ggvBBaf03FAAdGcXezKDHE=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.25/32
|
||||
|
||||
peer: 7/MIQLMhYBcvQtrlvJ+HAoXiPUdGVfKrD2RJNhJ0jR8=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.13/32
|
||||
|
||||
peer: PZRbsLPBZtTV2h82ggpENOrAqFNEkdCv2vJxU5cBaU4=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.17/32
|
||||
|
||||
peer: LphW/YJyc4lFf5mFOyS3G20yH3YvA5VavVaVRR+0yV0=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.21/32
|
||||
|
||||
peer: uc3UA+woJyqrSFfx5PM7yneBZAhNGSBZgjHXsHh8x2M=
|
||||
preshared key: (hidden)
|
||||
allowed ips: 10.8.1.22/32
|
||||
root@5862577-oj93961:~#
|
||||
@@ -0,0 +1,56 @@
|
||||
6. Единственный скрытый риск (самый важный)
|
||||
|
||||
Он не сейчас, а через время.
|
||||
|
||||
Amnezia иногда меняет имя интерфейса:
|
||||
|
||||
awg0
|
||||
wg0
|
||||
amnezia0
|
||||
|
||||
У тебя в логах уже видно:
|
||||
|
||||
iface=awg0
|
||||
|
||||
Если они обновят контейнер → имя изменится → tc пропадёт.
|
||||
|
||||
НО
|
||||
|
||||
Твой скрипт уже умеет авто-детект:
|
||||
|
||||
ip -o link show | egrep '^(wg[0-9]+|wg|amnezia[0-9]*|tun[0-9]+)'
|
||||
|
||||
✔ значит система устойчива даже к обновлениям Amnezia
|
||||
|
||||
|
||||
|
||||
|
||||
7. Итог
|
||||
|
||||
Сейчас у тебя:
|
||||
|
||||
Production-grade auto-healing bandwidth limiter
|
||||
|
||||
Он:
|
||||
|
||||
✔ переживает reboot
|
||||
✔ переживает restart docker
|
||||
✔ переживает restart контейнера
|
||||
✔ переживает обновление Amnezia
|
||||
✔ переживает добавление пользователей
|
||||
✔ переживает удаление пользователей
|
||||
|
||||
8. Когда он может сломаться
|
||||
|
||||
Только в 2 случаях:
|
||||
|
||||
Amnezia полностью поменяет формат wg show
|
||||
|
||||
в контейнере уберут tc или iproute2
|
||||
|
||||
Это редкость.
|
||||
|
||||
9. Вердикт
|
||||
|
||||
Да — сейчас система настроена правильно.
|
||||
Её уже можно считать стабильной боевой конфигурацией.
|
||||
Reference in New Issue
Block a user