=== STEP_033H2 WGPAY PEER SOURCE DISCOVERY === timestamp=20260708-112830 mode=read-only goal: find WGPay peer/tunnel source IPs for canary; DHCP leases are intentionally irrelevant date=Wed Jul 8 11:28:30 UTC 2026 === ip -br addr === lo UNKNOWN 127.0.0.1/8 ::1/128 eth0 UP 10.201.0.1/24 fe80::be24:11ff:fe94:bbfb/64 eth1 UP eth2 UP 10.200.0.1/24 fe80::be24:11ff:fee4:6cfb/64 br-lan UP 10.71.100.1/24 fe80::be24:11ff:feee:7d14/64 wg_paid UNKNOWN 10.253.1.1/16 wg_remote UNKNOWN 10.250.100.1/24 === UCI network wg_paid / wireguard === network.wg_remote.proto='wireguard' network.@wireguard_wg_remote[0]=wireguard_wg_remote network.@wireguard_wg_remote[0].description='support-mgts' network.@wireguard_wg_remote[0].public_key='b4BGigyYOJB9LKd6uhCbW6LZldKs712SAI2Z0Qlat1A=' network.@wireguard_wg_remote[0].private_key='SD5mIiwP0NyOAyfp8UPciJ5QB/jZ0B8kyTMIenIuYXY=' network.@wireguard_wg_remote[0].allowed_ips='10.250.100.2/32' network.@wireguard_wg_remote[0].route_allowed_ips='1' network.@wireguard_wg_remote[1]=wireguard_wg_remote network.@wireguard_wg_remote[1].description='owner-mgts' network.@wireguard_wg_remote[1].public_key='WqYFbdEvf4h4pMbtOswWyBt78Dp3NkGbjVhQiTPypGk=' network.@wireguard_wg_remote[1].private_key='OL9YYa7/ZU0aEYazGUOZA0UJsR73/dor54UgwgxICmU=' network.@wireguard_wg_remote[1].allowed_ips='10.250.100.3/32' network.@wireguard_wg_remote[1].route_allowed_ips='1' network.@wireguard_wg_remote[2]=wireguard_wg_remote network.@wireguard_wg_remote[2].description='router-ops-mgts' network.@wireguard_wg_remote[2].public_key='d/j8WzjSJW6MpFPCIUthmsj8M3SzxEfwLrLP+fJ9qnI=' network.@wireguard_wg_remote[2].allowed_ips='10.250.100.4/32' network.@wireguard_wg_remote[2].route_allowed_ips='1' network.wg_paid=interface network.wg_paid.proto='wireguard' network.wg_paid.private_key='4HdlxlrT3zfHmoWXFYrbsPLlrNf/baQGIVRizcqCvW0=' network.wg_paid.listen_port='51830' network.wg_paid.addresses='10.253.1.1/16' network.@wireguard_wg_remote[3]=wireguard_wg_remote network.@wireguard_wg_remote[3].description='VM121 wg-access-dev direct admin' network.@wireguard_wg_remote[3].public_key='DH9S3NewxZZjIhlshl9saO+5EdXafebWjxSkzNBkZEU=' network.@wireguard_wg_remote[3].allowed_ips='10.250.100.121/32' network.@wireguard_wg_remote[3].route_allowed_ips='1' === wg interfaces === interface: wg_paid public key: FD1J+KVZ965pCjgtO0YWxJsKANY9uz6v1P54JLkiZzY= private key: (hidden) listening port: 51830 interface: wg_remote public key: uTNh8zWnLbORIY2DZeKJMV+ygB+ii69hmDckI/T3h3Y= private key: (hidden) listening port: 51820 peer: DH9S3NewxZZjIhlshl9saO+5EdXafebWjxSkzNBkZEU= endpoint: 10.71.100.2:39845 allowed ips: 10.250.100.121/32 latest handshake: 6 seconds ago transfer: 159.63 KiB received, 43.30 KiB sent peer: b4BGigyYOJB9LKd6uhCbW6LZldKs712SAI2Z0Qlat1A= endpoint: 10.71.100.2:53541 allowed ips: 10.250.100.2/32 latest handshake: 54 seconds ago transfer: 1.31 MiB received, 10.62 MiB sent peer: d/j8WzjSJW6MpFPCIUthmsj8M3SzxEfwLrLP+fJ9qnI= endpoint: 10.71.100.2:54671 allowed ips: 10.250.100.4/32 latest handshake: 1 minute, 3 seconds ago transfer: 3.19 MiB received, 5.56 MiB sent peer: WqYFbdEvf4h4pMbtOswWyBt78Dp3NkGbjVhQiTPypGk= allowed ips: 10.250.100.3/32 === wg_paid peers concise === interface: wg_paid public key: FD1J+KVZ965pCjgtO0YWxJsKANY9uz6v1P54JLkiZzY= private key: (hidden) listening port: 51830 === routes involving wg_paid / 10.253 === 10.253.0.0/16 dev wg_paid proto kernel scope link src 10.253.1.1 10.253.0.0/16 dev wg_paid proto kernel scope link src 10.253.1.1 local 10.253.1.1 dev wg_paid table local proto kernel scope host src 10.253.1.1 broadcast 10.253.255.255 dev wg_paid table local proto kernel scope link src 10.253.1.1 multicast ff00::/8 dev wg_paid table local proto kernel metric 256 pref medium === firewall wg_paid / transit_vpn / NAT relevant === firewall.@zone[0]=zone firewall.@zone[0].name='lan' firewall.@zone[0].input='ACCEPT' firewall.@zone[0].output='ACCEPT' firewall.@zone[0].forward='ACCEPT' firewall.@zone[0].network='lan' firewall.@zone[1]=zone firewall.@zone[1].name='transit_direct' firewall.@zone[1].input='ACCEPT' firewall.@zone[1].output='ACCEPT' firewall.@zone[1].forward='REJECT' firewall.@zone[1].network='transit_direct' firewall.@zone[1].masq='1' firewall.@zone[1].mtu_fix='1' firewall.@forwarding[0]=forwarding firewall.@forwarding[0].src='lan' firewall.@forwarding[0].dest='transit_direct' firewall.@zone[2]=zone firewall.@zone[2].name='transit_vpn' firewall.@zone[2].input='ACCEPT' firewall.@zone[2].output='ACCEPT' firewall.@zone[2].forward='REJECT' firewall.@zone[2].masq='1' firewall.@zone[2].mtu_fix='1' firewall.@zone[2].network='transit_vpn' firewall.@forwarding[1]=forwarding firewall.@forwarding[1].src='lan' firewall.@forwarding[1].dest='transit_vpn' firewall.@zone[3]=zone firewall.@zone[3].name='remote_in' firewall.@zone[3].input='ACCEPT' firewall.@zone[3].output='ACCEPT' firewall.@zone[3].forward='ACCEPT' firewall.@zone[3].network='wg_remote' firewall.@forwarding[2]=forwarding firewall.@forwarding[2].src='remote_in' firewall.@forwarding[2].dest='lan' firewall.@forwarding[3]=forwarding firewall.@forwarding[3].src='remote_in' firewall.@forwarding[3].dest='transit_direct' firewall.@forwarding[4]=forwarding firewall.@forwarding[4].src='remote_in' firewall.@forwarding[4].dest='transit_vpn' firewall.@rule[0].src='transit_direct' firewall.@rule[1].src='remote_in' firewall.@rule[2].src='remote_in' firewall.@rule[2].dest='lan' firewall.@rule[3].src='remote_in' firewall.@rule[4].src='remote_in' firewall.@rule[4].dest='lan' firewall.@rule[5].src='remote_in' firewall.@rule[5].dest='lan' firewall.@rule[6].src='remote_in' firewall.@rule[6].dest='lan' firewall.wg_paid=zone firewall.wg_paid.name='wg_paid' firewall.wg_paid.input='ACCEPT' firewall.wg_paid.output='ACCEPT' firewall.wg_paid.forward='REJECT' firewall.wg_paid.network='wg_paid' firewall.wg_paid_to_transit_direct=forwarding firewall.wg_paid_to_transit_direct.src='wg_paid' firewall.wg_paid_to_transit_direct.dest='transit_direct' firewall.wg_paid_to_transit_vpn=forwarding firewall.wg_paid_to_transit_vpn.src='wg_paid' firewall.wg_paid_to_transit_vpn.dest='transit_vpn' firewall.allow_wg_paid_51830=rule firewall.allow_wg_paid_51830.name='Allow-WG-Paid-51830' firewall.allow_wg_paid_51830.proto='udp' firewall.allow_wg_paid_51830.dest_port='51830' firewall.allow_wg_paid_51830.target='ACCEPT' === nft relevant wg_paid / 10.253 / NAT === 122.10.164.0-122.10.195.255, 122.10.200.0-122.10.219.255, 194.110.253.0/24, 194.113.34.0/23, 10.252.100.0/24, 10.253.0.0/16 } chain wg_remote_snat_to_pc { type nat hook postrouting priority srcnat - 1; policy accept; ip saddr 10.250.0.0/24 ip daddr 192.168.30.64 oifname "br-lan" counter packets 0 bytes 0 snat ip to 192.168.30.1 comment "wg_remote_to_pc64_snat" iifname "wg_paid" jump input_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 input traffic" chain forward { type filter hook forward priority filter; policy drop; ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" iifname "eth0" jump forward_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 forward traffic" iifname "eth2" jump forward_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 forward traffic" iifname "wg_remote" jump forward_remote_in comment "!fw4: Handle remote_in IPv4/IPv6 forward traffic" iifname "wg_paid" jump forward_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 forward traffic" oifname "wg_paid" jump output_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 output traffic" chain prerouting { type filter hook prerouting priority filter; policy accept; iifname "wg_paid" jump helper_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 helper assignment" chain forward_lan { jump accept_to_transit_direct comment "!fw4: Accept lan to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept lan to transit_vpn forwarding" chain forward_transit_direct { chain forward_transit_vpn { chain forward_remote_in { jump accept_to_lan comment "!fw4: Accept remote_in to lan forwarding" jump accept_to_transit_direct comment "!fw4: Accept remote_in to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept remote_in to transit_vpn forwarding" chain input_wg_paid { jump accept_from_wg_paid chain output_wg_paid { jump accept_to_wg_paid chain forward_wg_paid { jump accept_to_transit_direct comment "!fw4: Accept wg_paid to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept wg_paid to transit_vpn forwarding" jump reject_to_wg_paid chain helper_wg_paid { chain accept_from_wg_paid { iifname "wg_paid" counter packets 0 bytes 0 accept comment "!fw4: accept wg_paid IPv4/IPv6 traffic" chain accept_to_wg_paid { oifname "wg_paid" counter packets 0 bytes 0 accept comment "!fw4: accept wg_paid IPv4/IPv6 traffic" chain reject_to_wg_paid { oifname "wg_paid" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wg_paid IPv4/IPv6 traffic" type nat hook prerouting priority dstnat; policy accept; type nat hook postrouting priority srcnat; policy accept; meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_direct traffic" meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_vpn traffic" chain raw_prerouting { type filter hook prerouting priority raw; policy accept; chain mangle_prerouting { type filter hook prerouting priority mangle; policy accept; jump pbr_prerouting chain mangle_postrouting { type filter hook postrouting priority mangle; policy accept; chain mangle_forward { type filter hook forward priority mangle; policy accept; jump pbr_forward chain pbr_forward { meta mark & 0x00ff0000 != 0x00000000 return meta mark & 0x00ff0000 != 0x00000000 return chain pbr_prerouting { meta mark & 0x00ff0000 != 0x00000000 return ip daddr @pbr_transit_direct_4_dst_ip_user goto pbr_mark_0x010000 ip saddr @pbr_transit_direct_4_src_ip_user goto pbr_mark_0x010000 ether saddr @pbr_transit_direct_4_src_mac_user goto pbr_mark_0x010000 ip daddr @pbr_transit_vpn_4_dst_ip_user goto pbr_mark_0x020000 ip saddr @pbr_transit_vpn_4_src_ip_user goto pbr_mark_0x020000 ether saddr @pbr_transit_vpn_4_src_mac_user goto pbr_mark_0x020000 chain pbr_mark_0x010000 { meta mark set meta mark & 0xff01ffff | 0x00010000 chain pbr_mark_0x020000 { meta mark set meta mark & 0xff02ffff | 0x00020000 === possible WGPay files === /etc/modules.d/wireguard /etc/wireguard/wg_paid.key /root/clientize-backup-20260530-180916/dhcp /root/clientize-backup-20260530-180916/firewall /root/clientize-backup-20260530-180916/network /root/clientize-backup-20260530-180916/pbr /root/clientize-backup-20260530-180916/pbr.d/default_lan_to_vpn.sh /root/clientize-backup-20260530-180916/pbr.d/ru_to_direct.sh /root/clientize-vm100.sh /root/fix-vm100-client-cleanup.sh /root/mgts-wg-remote-backup/network.before-router-ops-peer-20260706_104252 === runtime conntrack sample WGPay if available === === UCI pending === === STEP_033H2 RESULT === wgpaid_present_lines=55 peer_lines=4 allowed_10_253_lines=0 uci_pending_lines=0 decision=PASS_WGPAY_PEER_DISCOVERY