16 lines
1.8 KiB
Bash
16 lines
1.8 KiB
Bash
#!/bin/sh
|
|
# aurora-vpn-diag (B15): read-only VPN/leak diagnostics, no secrets (no keys, no endpoint port).
|
|
. /etc/aurora/router.conf 2>/dev/null; LAN_NET=${LAN_NET:-192.168.77.0/24}; WAN_IF=${WAN_IF:-wwan0}; WG=wg0; TBL=51820
|
|
echo "== kernel"; uname -r
|
|
echo "== $WAN_IF"; ip -4 -o addr show $WAN_IF | awk '{print $4}'; ip route show default
|
|
echo "== $WG"; if ip link show $WG >/dev/null 2>&1; then ip -4 -o addr show $WG | awk '{print $2,$4,"mtu",$0}' | sed 's/.*mtu/mtu/;s/\\\\/ /'; wg show $WG | grep -vE "private|listening"; else echo DOWN; fi
|
|
echo "== handshake"; hs=$(wg show $WG latest-handshakes 2>/dev/null | awk '{print $2}' | head -1); [ -n "$hs" ] && [ "$hs" != 0 ] && echo "age $(( $(date +%s) - hs )) s" || echo "none"
|
|
echo "== rules"; ip rule show | grep -E "lookup $TBL|$LAN_NET" || echo none
|
|
echo "== table $TBL"; ip route show table $TBL || echo empty
|
|
echo "== endpoint path (must be $WAN_IF, not $WG):"; ep=$(cat /run/aurora-vpn/endpoint 2>/dev/null); [ -n "$ep" ] && ip route get "$ep" | head -1 || echo "no endpoint recorded"
|
|
echo "== nft forward/nat counters"; nft list table inet aurora_vpn 2>/dev/null | grep -E "oifname|masquerade|drop" | sed 's/^[ \t]*//'
|
|
echo "== wg transfer"; wg show $WG transfer 2>/dev/null | sed 's/\\t/ /g' || echo none
|
|
echo "== LEAK TEST (LAN source route): a LAN client packet must exit via $WG, NOT $WAN_IF"
|
|
echo " ip route get 1.1.1.1 from ${LAN_NET%/*}.100:"; ip route get 1.1.1.1 from "$(echo $LAN_NET | sed 's#0/24#100#')" 2>/dev/null | head -1
|
|
verdict=$(ip route get 1.1.1.1 from "$(echo $LAN_NET | sed 's#0/24#100#')" 2>/dev/null | grep -oE "dev [a-z0-9]+" | awk '{print $2}' | head -1)
|
|
if ip link show $WG >/dev/null 2>&1; then [ "$verdict" = "$WG" ] && echo " LEAK-GUARD: OK (LAN -> $WG)" || echo " LEAK-GUARD: WARN (LAN -> ${verdict:-?})"; else echo " LEAK-GUARD: VPN down -> LAN forward dropped (fail-closed)"; fi
|