--- host --- Thu Jul 9 12:18:42 UTC 2026 --- wg_paid summary --- listen_port=51830 peer_count=5 allowed_ip_count=5 --- wg latest handshakes / transfer redacted counts --- 1 0 2 0 3 0 4 0 5 0 1 0 0 2 0 0 3 0 0 4 0 0 5 0 0 --- selector file --- 10.253.1.10 cs1 canary_vpn3 10.253.1.11 cs2 canary_vpn4 10.253.1.12 cs3 canary_vpn5 10.253.1.13 cs4 canary_vpn1 10.253.1.14 cs5 canary_vpn2 --- selector/apply scripts --- -rwxr-xr-x 1 root root 233 Jul 8 12:28 /etc/init.d/router-wgpay-canary -rwxr-xr-x 1 root root 1826 Jul 8 12:38 /usr/local/sbin/router-wgpay-canary-apply.sh --- nft candidate rules for wg_paid/dscp/counters --- set pbr_transit_direct_4_dst_ip_user { set pbr_transit_direct_4_src_ip_user { set pbr_transit_direct_4_src_mac_user { set pbr_transit_vpn_4_dst_ip_user { set pbr_transit_vpn_4_src_ip_user { set pbr_transit_vpn_4_src_mac_user { ip saddr 10.250.0.0/24 ip daddr 192.168.30.64 oifname "br-lan" counter packets 0 bytes 0 snat ip to 192.168.30.1 comment "wg_remote_to_pc64_snat" iifname "eth0" jump input_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 input traffic" iifname "eth2" jump input_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 input traffic" iifname "wg_paid" jump input_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 input traffic" iifname "eth0" jump forward_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 forward traffic" iifname "eth2" jump forward_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 forward traffic" iifname "wg_paid" jump forward_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 forward traffic" udp dport 51830 counter packets 0 bytes 0 accept comment "!fw4: Allow-WG-Paid-51830" oifname "eth0" jump output_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 output traffic" oifname "eth2" jump output_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 output traffic" oifname "wg_paid" jump output_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 output traffic" iifname "wg_paid" jump helper_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 helper assignment" jump accept_to_transit_direct comment "!fw4: Accept lan to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept lan to transit_vpn forwarding" iifname "br-lan" counter packets 11 bytes 772 accept comment "!fw4: accept lan IPv4/IPv6 traffic" oifname "br-lan" counter packets 19 bytes 1288 accept comment "!fw4: accept lan IPv4/IPv6 traffic" oifname "br-lan" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject lan IPv4/IPv6 traffic" chain input_transit_direct { ip daddr 10.201.0.1 udp dport 51820 counter packets 0 bytes 0 accept comment "!fw4: Allow-WG-Remote-In" jump accept_from_transit_direct chain output_transit_direct { jump accept_to_transit_direct chain forward_transit_direct { jump reject_to_transit_direct chain accept_from_transit_direct { iifname "eth0" counter packets 1 bytes 56 accept comment "!fw4: accept transit_direct IPv4/IPv6 traffic" chain accept_to_transit_direct { meta nfproto ipv4 oifname "eth0" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage" oifname "eth0" counter packets 1441 bytes 98351 accept comment "!fw4: accept transit_direct IPv4/IPv6 traffic" chain reject_to_transit_direct { oifname "eth0" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject transit_direct IPv4/IPv6 traffic" chain input_transit_vpn { jump accept_from_transit_vpn chain output_transit_vpn { jump accept_to_transit_vpn chain forward_transit_vpn { jump reject_to_transit_vpn chain accept_from_transit_vpn { iifname "eth2" counter packets 1 bytes 56 accept comment "!fw4: accept transit_vpn IPv4/IPv6 traffic" chain accept_to_transit_vpn { meta nfproto ipv4 oifname "eth2" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage" oifname "eth2" counter packets 2 bytes 232 accept comment "!fw4: accept transit_vpn IPv4/IPv6 traffic" chain reject_to_transit_vpn { oifname "eth2" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject transit_vpn IPv4/IPv6 traffic" ip saddr 10.250.1.3 tcp dport 53 counter packets 0 bytes 0 accept comment "!fw4: ALLOW_OWNER_DNS_VM100" ip saddr 10.250.1.3 udp dport 53 counter packets 0 bytes 0 accept comment "!fw4: ALLOW_OWNER_DNS_VM100" ip saddr 10.250.1.3 counter packets 0 bytes 0 jump handle_reject comment "!fw4: BLOCK_OWNER_VM100_ROUTER" ip saddr 10.250.1.3 ip daddr 10.71.1.189 tcp dport 51822 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: ALLOW_OWNER_WGEASY_UI" ip saddr 10.250.1.3 ip daddr 10.71.1.2 counter packets 0 bytes 0 jump reject_to_lan comment "!fw4: BLOCK_OWNER_VM101" ip saddr 10.250.1.3 ip daddr 10.71.1.222 counter packets 0 bytes 0 jump reject_to_lan comment "!fw4: BLOCK_OWNER_PROXMOX" ip saddr 10.250.1.3 ip daddr 10.71.1.189 counter packets 0 bytes 0 jump reject_to_lan comment "!fw4: BLOCK_OWNER_VM103_EXCEPT_UI" jump accept_to_transit_direct comment "!fw4: Accept remote_in to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept remote_in to transit_vpn forwarding" iifname "wg_remote" counter packets 543 bytes 36364 accept comment "!fw4: accept remote_in IPv4/IPv6 traffic" oifname "wg_remote" counter packets 0 bytes 0 accept comment "!fw4: accept remote_in IPv4/IPv6 traffic" chain input_wg_paid { jump accept_from_wg_paid chain output_wg_paid { jump accept_to_wg_paid chain forward_wg_paid { jump accept_to_transit_direct comment "!fw4: Accept wg_paid to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept wg_paid to transit_vpn forwarding" jump reject_to_wg_paid chain helper_wg_paid { chain accept_from_wg_paid { iifname "wg_paid" counter packets 0 bytes 0 accept comment "!fw4: accept wg_paid IPv4/IPv6 traffic" chain accept_to_wg_paid { oifname "wg_paid" counter packets 0 bytes 0 accept comment "!fw4: accept wg_paid IPv4/IPv6 traffic" chain reject_to_wg_paid { oifname "wg_paid" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wg_paid IPv4/IPv6 traffic" oifname "eth0" jump srcnat_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 srcnat traffic" oifname "eth2" jump srcnat_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 srcnat traffic" chain srcnat_transit_direct { meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_direct traffic" chain srcnat_transit_vpn { meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_vpn traffic" oifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_direct IPv4/IPv6 egress MTU fixing" oifname "eth2" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_vpn IPv4/IPv6 egress MTU fixing" iifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_direct IPv4/IPv6 ingress MTU fixing" iifname "eth2" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_vpn IPv4/IPv6 ingress MTU fixing" ip daddr @pbr_transit_direct_4_dst_ip_user goto pbr_mark_0x010000 ip saddr @pbr_transit_direct_4_src_ip_user goto pbr_mark_0x010000 ether saddr @pbr_transit_direct_4_src_mac_user goto pbr_mark_0x010000 ip daddr @pbr_transit_vpn_4_dst_ip_user goto pbr_mark_0x020000 ip saddr @pbr_transit_vpn_4_src_ip_user goto pbr_mark_0x020000 ether saddr @pbr_transit_vpn_4_src_mac_user goto pbr_mark_0x020000 table inet wgpay_dscp_canary { --- routes/firewall hints --- default via 10.201.0.2 dev eth0 table pbr_transit_direct default via 10.200.0.2 dev eth2 table pbr_transit_vpn default via 10.201.0.2 dev eth0 proto static metric 10 default via 10.200.0.2 dev eth2 proto static metric 20 10.200.0.0/24 dev eth2 proto static scope link metric 20 10.201.0.0/24 dev eth0 proto static scope link metric 10 10.253.0.0/16 dev wg_paid proto kernel scope link src 10.253.1.1 local 10.200.0.1 dev eth2 table local proto kernel scope host src 10.200.0.1 broadcast 10.200.0.255 dev eth2 table local proto kernel scope link src 10.200.0.1 local 10.201.0.1 dev eth0 table local proto kernel scope host src 10.201.0.1 broadcast 10.201.0.255 dev eth0 table local proto kernel scope link src 10.201.0.1 local 10.253.1.1 dev wg_paid table local proto kernel scope host src 10.253.1.1 broadcast 10.253.255.255 dev wg_paid table local proto kernel scope link src 10.253.1.1