__HOST__ Thu Jul 9 13:31:09 UTC 2026 __IFSTATUS_BEGIN__wg_paid { "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 9406, "l3_device": "wg_paid", "proto": "wireguard", "updated": [ "addresses" ], "metric": 0, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "10.253.1.1", "mask": 16 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } } __IFSTATUS_END__wg_paid __IFSTATUS_BEGIN__transit_vpn { "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 9407, "l3_device": "eth2", "proto": "static", "device": "eth2", "updated": [ "addresses", "routes" ], "metric": 20, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "10.200.0.1", "mask": 24 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ { "target": "0.0.0.0", "mask": 0, "nexthop": "10.200.0.2", "source": "0.0.0.0/0" } ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } } __IFSTATUS_END__transit_vpn __IFSTATUS_BEGIN__transit_direct { "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 9407, "l3_device": "eth0", "proto": "static", "device": "eth0", "updated": [ "addresses", "routes" ], "metric": 10, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "10.201.0.1", "mask": 24 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ { "target": "0.0.0.0", "mask": 0, "nexthop": "10.201.0.2", "source": "0.0.0.0/0" } ], "dns-server": [ "10.201.0.2" ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } } __IFSTATUS_END__transit_direct __WG_PAID__ listen_port=51830 peer_count=5 allowed_ip_count=5 __SELECTOR__ 10.253.1.10 cs1 canary_vpn3 10.253.1.11 cs2 canary_vpn4 10.253.1.12 cs3 canary_vpn5 10.253.1.13 cs4 canary_vpn1 10.253.1.14 cs5 canary_vpn2 __LINKS__ 1: lo: mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000\ link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: eth0: mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000\ link/ether bc:24:11:94:bb:fb brd ff:ff:ff:ff:ff:ff 3: eth1: mtu 1500 qdisc fq_codel master br-lan state UP mode DEFAULT group default qlen 1000\ link/ether bc:24:11:ee:7d:14 brd ff:ff:ff:ff:ff:ff 4: eth2: mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000\ link/ether bc:24:11:e4:6c:fb brd ff:ff:ff:ff:ff:ff 5: br-lan: mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000\ link/ether bc:24:11:ee:7d:14 brd ff:ff:ff:ff:ff:ff 6: wg_paid: mtu 1420 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000\ link/none 7: wg_remote: mtu 1420 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000\ link/none __ROUTES__ default via 10.201.0.2 dev eth0 table pbr_transit_direct default via 10.200.0.2 dev eth2 table pbr_transit_vpn default via 10.201.0.2 dev eth0 proto static metric 10 default via 10.200.0.2 dev eth2 proto static metric 20 10.200.0.0/24 dev eth2 proto static scope link metric 20 10.201.0.0/24 dev eth0 proto static scope link metric 10 10.253.0.0/16 dev wg_paid proto kernel scope link src 10.253.1.1 local 10.200.0.1 dev eth2 table local proto kernel scope host src 10.200.0.1 broadcast 10.200.0.255 dev eth2 table local proto kernel scope link src 10.200.0.1 local 10.201.0.1 dev eth0 table local proto kernel scope host src 10.201.0.1 broadcast 10.201.0.255 dev eth0 table local proto kernel scope link src 10.201.0.1 local 10.253.1.1 dev wg_paid table local proto kernel scope host src 10.253.1.1 broadcast 10.253.255.255 dev wg_paid table local proto kernel scope link src 10.253.1.1 multicast ff00::/8 dev wg_paid table local proto kernel metric 256 pref medium __NFT_TABLES__ table inet fw4 table inet wgpay_dscp_canary __EXISTING_ACTIVITY_TABLE__ __NFT_HINTS__ set pbr_transit_direct_4_dst_ip_user { set pbr_transit_direct_4_src_ip_user { set pbr_transit_direct_4_src_mac_user { set pbr_transit_vpn_4_dst_ip_user { set pbr_transit_vpn_4_src_ip_user { set pbr_transit_vpn_4_src_mac_user { ip saddr 10.250.0.0/24 ip daddr 192.168.30.64 oifname "br-lan" counter packets 0 bytes 0 snat ip to 192.168.30.1 comment "wg_remote_to_pc64_snat" iifname "eth0" jump input_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 input traffic" iifname "eth2" jump input_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 input traffic" iifname "wg_paid" jump input_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 input traffic" iifname "eth0" jump forward_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 forward traffic" iifname "eth2" jump forward_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 forward traffic" iifname "wg_paid" jump forward_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 forward traffic" udp dport 51830 counter packets 0 bytes 0 accept comment "!fw4: Allow-WG-Paid-51830" oifname "eth0" jump output_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 output traffic" oifname "eth2" jump output_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 output traffic" oifname "wg_paid" jump output_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 output traffic" iifname "wg_paid" jump helper_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 helper assignment" jump accept_to_transit_direct comment "!fw4: Accept lan to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept lan to transit_vpn forwarding" iifname "br-lan" counter packets 19 bytes 1244 accept comment "!fw4: accept lan IPv4/IPv6 traffic" oifname "br-lan" counter packets 33 bytes 2112 accept comment "!fw4: accept lan IPv4/IPv6 traffic" oifname "br-lan" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject lan IPv4/IPv6 traffic" chain input_transit_direct { ip daddr 10.201.0.1 udp dport 51820 counter packets 0 bytes 0 accept comment "!fw4: Allow-WG-Remote-In" jump accept_from_transit_direct chain output_transit_direct { jump accept_to_transit_direct chain forward_transit_direct { jump reject_to_transit_direct chain accept_from_transit_direct { iifname "eth0" counter packets 3 bytes 168 accept comment "!fw4: accept transit_direct IPv4/IPv6 traffic" chain accept_to_transit_direct { meta nfproto ipv4 oifname "eth0" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage" oifname "eth0" counter packets 2153 bytes 146870 accept comment "!fw4: accept transit_direct IPv4/IPv6 traffic" chain reject_to_transit_direct { oifname "eth0" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject transit_direct IPv4/IPv6 traffic" chain input_transit_vpn { jump accept_from_transit_vpn chain output_transit_vpn { jump accept_to_transit_vpn chain forward_transit_vpn { jump reject_to_transit_vpn chain accept_from_transit_vpn { iifname "eth2" counter packets 2 bytes 112 accept comment "!fw4: accept transit_vpn IPv4/IPv6 traffic" chain accept_to_transit_vpn { meta nfproto ipv4 oifname "eth2" ct state invalid counter packets 0 bytes 0 drop comment "!fw4: Prevent NAT leakage" oifname "eth2" counter packets 2 bytes 232 accept comment "!fw4: accept transit_vpn IPv4/IPv6 traffic" chain reject_to_transit_vpn { oifname "eth2" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject transit_vpn IPv4/IPv6 traffic" ip saddr 10.250.1.3 tcp dport 53 counter packets 0 bytes 0 accept comment "!fw4: ALLOW_OWNER_DNS_VM100" ip saddr 10.250.1.3 udp dport 53 counter packets 0 bytes 0 accept comment "!fw4: ALLOW_OWNER_DNS_VM100" ip saddr 10.250.1.3 counter packets 0 bytes 0 jump handle_reject comment "!fw4: BLOCK_OWNER_VM100_ROUTER" ip saddr 10.250.1.3 ip daddr 10.71.1.189 tcp dport 51822 counter packets 0 bytes 0 jump accept_to_lan comment "!fw4: ALLOW_OWNER_WGEASY_UI" ip saddr 10.250.1.3 ip daddr 10.71.1.2 counter packets 0 bytes 0 jump reject_to_lan comment "!fw4: BLOCK_OWNER_VM101" ip saddr 10.250.1.3 ip daddr 10.71.1.222 counter packets 0 bytes 0 jump reject_to_lan comment "!fw4: BLOCK_OWNER_PROXMOX" ip saddr 10.250.1.3 ip daddr 10.71.1.189 counter packets 0 bytes 0 jump reject_to_lan comment "!fw4: BLOCK_OWNER_VM103_EXCEPT_UI" jump accept_to_transit_direct comment "!fw4: Accept remote_in to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept remote_in to transit_vpn forwarding" iifname "wg_remote" counter packets 863 bytes 57705 accept comment "!fw4: accept remote_in IPv4/IPv6 traffic" oifname "wg_remote" counter packets 0 bytes 0 accept comment "!fw4: accept remote_in IPv4/IPv6 traffic" chain input_wg_paid { jump accept_from_wg_paid chain output_wg_paid { jump accept_to_wg_paid chain forward_wg_paid { jump accept_to_transit_direct comment "!fw4: Accept wg_paid to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept wg_paid to transit_vpn forwarding" jump reject_to_wg_paid chain helper_wg_paid { chain accept_from_wg_paid { iifname "wg_paid" counter packets 0 bytes 0 accept comment "!fw4: accept wg_paid IPv4/IPv6 traffic" chain accept_to_wg_paid { oifname "wg_paid" counter packets 0 bytes 0 accept comment "!fw4: accept wg_paid IPv4/IPv6 traffic" chain reject_to_wg_paid { oifname "wg_paid" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wg_paid IPv4/IPv6 traffic" oifname "eth0" jump srcnat_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 srcnat traffic" oifname "eth2" jump srcnat_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 srcnat traffic" chain srcnat_transit_direct { meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_direct traffic" chain srcnat_transit_vpn { meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_vpn traffic" oifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_direct IPv4/IPv6 egress MTU fixing" oifname "eth2" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_vpn IPv4/IPv6 egress MTU fixing" iifname "eth0" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_direct IPv4/IPv6 ingress MTU fixing" iifname "eth2" tcp flags & (fin | syn | rst) == syn tcp option maxseg size set rt mtu comment "!fw4: Zone transit_vpn IPv4/IPv6 ingress MTU fixing" ip daddr @pbr_transit_direct_4_dst_ip_user goto pbr_mark_0x010000 ip saddr @pbr_transit_direct_4_src_ip_user goto pbr_mark_0x010000 ether saddr @pbr_transit_direct_4_src_mac_user goto pbr_mark_0x010000 ip daddr @pbr_transit_vpn_4_dst_ip_user goto pbr_mark_0x020000 ip saddr @pbr_transit_vpn_4_src_ip_user goto pbr_mark_0x020000 ether saddr @pbr_transit_vpn_4_src_mac_user goto pbr_mark_0x020000 table inet wgpay_dscp_canary {