===== package-verify.rc.txt ===== LOCAL_RC=0 ===== package-verify.stderr.txt ===== ===== package-verify.stdout.txt ===== RESULT=PASS_R20QW_READONLY_PACKAGE_VERIFY ===== vm100-audit.rc.txt ===== REMOTE_RC=0 MACHINE=vm100 ===== vm100-audit.stderr.txt ===== sh: hostname: not found ssh: Ignoring unknown configuration option 'IdentitiesOnly=yes' ===== vm100-audit.stdout.txt ===== SCHEMA=wg-paid-vm100-readonly-audit-v1 MACHINE=VM100 AUDIT_UTC=2026-08-02T10:15:05Z HOSTNAME= ===== SYSTEM ===== { "kernel": "6.6.93", "hostname": "OpenWrt", "system": "Intel(R) Core(TM) i7-6950X CPU @ 3.00GHz", "model": "QEMU Standard PC (i440FX + PIIX, 1996)", "board_name": "qemu-standard-pc-i440fx-piix-1996", "rootfs_type": "ext4", "release": { "distribution": "OpenWrt", "version": "24.10.2", "revision": "r28739-d9340319c6", "target": "x86/64", "description": "OpenWrt 24.10.2 r28739-d9340319c6", "builddate": "1750711236" } } Linux OpenWrt 6.6.93 #0 SMP Mon Jun 23 20:40:36 2025 x86_64 GNU/Linux 10:15:05 up 8 days, 13:39, load average: 0.00, 0.00, 0.00 Filesystem Size Used Available Use% Mounted on /dev/root 1.1G 84.9M 1011.7M 8% / /dev/root 1.1G 84.9M 1011.7M 8% / ===== MACHINE GIT ===== >>> [vm100-git] precheck MODE=--check PROFILE=/etc/router-machine-git-source.conf PROFILE_VERSION=2 PROFILE_SHA256=ee2c3b5366d8eb4c4ebf9766c07f6926ecc927e9c38a3766d870fc7397ab2743 MACHINE_ID=vm100 GIT_DIR=/root/.vm100-source.git WORK_TREE=/ BRANCH=main REMOTE_URL=git@github.com:DChuvelev/wg-paid-vm100.git LOCAL_HEAD=a8b7337674b931c2e73f9b4bd7ebe76866e6a81f >>> [vm100-git] verify remote branch REMOTE_HEAD=a8b7337674b931c2e73f9b4bd7ebe76866e6a81f >>> [vm100-git] build current project allowlist >>> [vm100-git] read paths already tracked by git CURRENT_ALLOWED_COUNT=30 TRACKED_COUNT=30 MANAGED_UNION_COUNT=30 >>> [vm100-git] strict path validation STRICT_PATH_VALIDATION=true >>> [vm100-git] show tracked files now missing from machine TRACKED_PATH_MISSING_COUNT=0 >>> [vm100-git] build simulated git index STAGED_CHANGE_COUNT=0 STAGED_PATHS=NONE >>> [vm100-git] validate simulated staged paths STAGED_PATH_VALIDATION=true SIMULATED_TREE_SHA=9bf4d21d4088629d5469c8f5659391c96e150fc5 SIMULATED_TREE_FILE_COUNT=30 >>> [vm100-git] high-confidence secret scan of simulated tree HIGH_CONFIDENCE_SECRET_MATCHES=0 >>> [vm100-git] keyword review scan KEYWORD_REVIEW_FILES=NONE RESULT=PASS_vm100_GIT_PUBLISH_CHECK MACHINE_ID=vm100 GIT_COMMIT=a8b7337674b931c2e73f9b4bd7ebe76866e6a81f GIT_TREE=9bf4d21d4088629d5469c8f5659391c96e150fc5 GIT_FILE_COUNT=30 COMMIT_CREATED=false PUSH_PERFORMED=false VM100_GIT_CHECK=PASS ===== COMMANDS AND PACKAGES ===== WG_CLI_PRESENT=true AMNEZIAWG_CLI_PRESENT=true amneziawg-tools - 1.0.20240213-r1 kmod-amneziawg - 6.6.93-r1 kmod-wireguard - 6.6.93-r1 luci-app-amneziawg - 25.176.66860~0c726ca luci-proto-wireguard - 26.101.22949~8aafcdf wireguard-tools - 1.0.20210914-r4 AMNEZIAWG_PACKAGE_COUNT=3 wireguard 65536 0 - Live 0xffffffffa06c8000 libchacha20poly1305 16384 1 wireguard, Live 0xffffffffa0564000 curve25519_x86_64 32768 1 wireguard, Live 0xffffffffa0554000 libcurve25519_generic 49152 2 wireguard,curve25519_x86_64, Live 0xffffffffa04c8000 ip6_udp_tunnel 12288 1 wireguard, Live 0xffffffffa0342000 udp_tunnel 16384 1 wireguard, Live 0xffffffffa0337000 ===== NETWORK SUMMARY ===== lo UNKNOWN 00:00:00:00:00:00 eth0 UP bc:24:11:94:bb:fb eth1 UP bc:24:11:ee:7d:14 eth2 UP bc:24:11:e4:6c:fb br-lan UP bc:24:11:ee:7d:14 wg_paid UNKNOWN wg_remote UNKNOWN lo UNKNOWN 127.0.0.1/8 eth0 UP 10.201.0.1/24 eth2 UP 10.200.0.1/24 br-lan UP 10.71.100.1/24 wg_paid UNKNOWN 10.253.1.1/16 wg_remote UNKNOWN 10.250.100.1/24 default via 10.201.0.2 dev eth0 proto static metric 10 default via 10.200.0.2 dev eth2 proto static metric 20 10.71.100.0/24 dev br-lan proto kernel scope link src 10.71.100.1 10.200.0.0/24 dev eth2 proto static scope link metric 20 10.201.0.0/24 dev eth0 proto static scope link metric 10 10.250.100.0/24 dev wg_remote proto kernel scope link src 10.250.100.1 10.250.100.2 dev wg_remote proto static scope link 10.250.100.3 dev wg_remote proto static scope link 10.250.100.4 dev wg_remote proto static scope link 10.250.100.5 dev wg_remote proto static scope link 10.250.100.121 dev wg_remote proto static scope link 10.253.0.0/16 dev wg_paid proto kernel scope link src 10.253.1.1 --- UCI network redacted --- network.loopback=interface network.loopback.device='lo' network.loopback.proto='static' network.loopback.ipaddr='127.0.0.1' network.loopback.netmask='255.0.0.0' network.globals=globals network.globals.packet_steering='1' network.@device[0]=device network.@device[0].name='br-lan' network.@device[0].type='bridge' network.@device[0].ports='eth1' network.lan=interface network.lan.device='br-lan' network.lan.proto='static' network.lan.ipaddr='10.71.100.1' network.lan.netmask='255.255.255.0' network.device=eth2 network.proto=static network.ipaddr=10.200.0.1 network.transit_direct=interface network.transit_direct.proto='static' network.transit_direct.device='eth0' network.transit_direct.ipaddr='10.201.0.1/24' network.transit_direct.gateway='10.201.0.2' network.transit_direct.dns='10.201.0.2' network.transit_direct.metric='10' network.transit_vpn=interface network.transit_vpn.proto='static' network.transit_vpn.device='eth2' network.transit_vpn.ipaddr='10.200.0.1' network.transit_vpn.netmask='255.255.255.0' network.transit_vpn.gateway='10.200.0.2' network.transit_vpn.metric='20' network.wg_remote=interface network.wg_remote.proto='wireguard' network.wg_remote.private_key= network.wg_remote.listen_port='51820' network.wg_remote.addresses='10.250.100.1/24' network.@wireguard_wg_remote[0]=wireguard_wg_remote network.@wireguard_wg_remote[0].description='support-mgts' network.@wireguard_wg_remote[0].public_key= network.@wireguard_wg_remote[0].private_key= network.@wireguard_wg_remote[0].allowed_ips='10.250.100.2/32' network.@wireguard_wg_remote[0].route_allowed_ips='1' network.@wireguard_wg_remote[1]=wireguard_wg_remote network.@wireguard_wg_remote[1].description='owner-mgts' network.@wireguard_wg_remote[1].public_key= network.@wireguard_wg_remote[1].private_key= network.@wireguard_wg_remote[1].allowed_ips='10.250.100.3/32' network.@wireguard_wg_remote[1].route_allowed_ips='1' network.@wireguard_wg_remote[2]=wireguard_wg_remote network.@wireguard_wg_remote[2].description='router-ops-mgts' network.@wireguard_wg_remote[2].public_key= network.@wireguard_wg_remote[2].allowed_ips='10.250.100.4/32' network.@wireguard_wg_remote[2].route_allowed_ips='1' network.wg_paid=interface network.wg_paid.proto='wireguard' network.wg_paid.private_key= network.wg_paid.listen_port='51830' network.wg_paid.addresses='10.253.1.1/16' network.@wireguard_wg_remote[3]=wireguard_wg_remote network.@wireguard_wg_remote[3].description='VM121 wg-access-dev direct admin' network.@wireguard_wg_remote[3].public_key= network.@wireguard_wg_remote[3].allowed_ips='10.250.100.121/32' network.@wireguard_wg_remote[3].route_allowed_ips='1' network.@wireguard_wg_remote[4]=wireguard_wg_remote network.@wireguard_wg_remote[4].public_key= network.@wireguard_wg_remote[4].private_key= network.@wireguard_wg_remote[4].description='MityaMgtsRemotePhone' network.@wireguard_wg_remote[4].route_allowed_ips='1' network.@wireguard_wg_remote[4].allowed_ips='10.250.100.5/32' --- interface dump --- { "interface": [ { "interface": "lan", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 740391, "l3_device": "br-lan", "proto": "static", "device": "br-lan", "updated": [ "addresses" ], "metric": 0, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "10.71.100.1", "mask": 24 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "loopback", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 740391, "l3_device": "lo", "proto": "static", "device": "lo", "updated": [ "addresses" ], "metric": 0, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "127.0.0.1", "mask": 8 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "transit_direct", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 740391, "l3_device": "eth0", "proto": "static", "device": "eth0", "updated": [ "addresses", "routes" ], "metric": 10, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "10.201.0.1", "mask": 24 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ { "target": "0.0.0.0", "mask": 0, "nexthop": "10.201.0.2", "source": "0.0.0.0/0" } ], "dns-server": [ "10.201.0.2" ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "transit_vpn", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 740391, "l3_device": "eth2", "proto": "static", "device": "eth2", "updated": [ "addresses", "routes" ], "metric": 20, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "10.200.0.1", "mask": 24 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ { "target": "0.0.0.0", "mask": 0, "nexthop": "10.200.0.2", "source": "0.0.0.0/0" } ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "wg_paid", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 740390, "l3_device": "wg_paid", "proto": "wireguard", "updated": [ "addresses" ], "metric": 0, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "10.253.1.1", "mask": 16 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "wg_remote", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 48737, "l3_device": "wg_remote", "proto": "wireguard", "updated": [ "addresses", "routes" ], "metric": 0, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "10.250.100.1", "mask": 24 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ { "target": "10.250.100.2", "mask": 32, "nexthop": "0.0.0.0", "source": "0.0.0.0/0" }, { "target": "10.250.100.3", "mask": 32, "nexthop": "0.0.0.0", "source": "0.0.0.0/0" }, { "target": "10.250.100.4", "mask": 32, "nexthop": "0.0.0.0", "source": "0.0.0.0/0" }, { "target": "10.250.100.5", "mask": 32, "nexthop": "0.0.0.0", "source": "0.0.0.0/0" }, { "target": "10.250.100.121", "mask": 32, "nexthop": "0.0.0.0", "source": "0.0.0.0/0" } ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } } ] } WG_PAID_PRESENT=true WG_PAID_LISTEN_PORT=51830 WG_PAID_PUBLIC_KEY_SHA256=442e3c1e4ed1a3bb371b03bb16ed75158bba311f513c72fa67396ee6010ea343 WG_PAID_PEER_COUNT=5 AWG_PAID_INTERFACE_PRESENT=false ===== SELECTOR AND TOPOLOGY ===== 46d41783effb8d80ea1b09895f829b98a0946e0edbff1e29e7651eb3ef9b036a /etc/router-wgpay-selector.d/peers.conf SELECTOR_FILE=/etc/router-wgpay-selector.d/peers.conf ACTIVE_ENTRY_COUNT=5 46d41783effb8d80ea1b09895f829b98a0946e0edbff1e29e7651eb3ef9b036a /etc/router-wgpay-selector.d/canonical.conf SELECTOR_FILE=/etc/router-wgpay-selector.d/canonical.conf ACTIVE_ENTRY_COUNT=5 SELECTOR_ENTRY_COUNT=5 schema=router-wgpay-slot-topology-ack-v1 result=PASS direct_policy_enabled=0 healthy_slot_count=5 min_healthy_slots_to_exit_direct=3 direct_active_before=false direct_probe_result=PASS_DIRECT_MODE_PROBE direct_transition=NOT_REQUIRED direct_action=NOT_REQUIRED direct_action_result=NOT_REQUESTED direct_request_result=NOT_REQUESTED selector_transaction_suppressed=false accepted_generation=000000000016 applied_generation=000000000016 apply_performed=true payload_sha256=98273ca7df91ba4ddfad6e002acadef74d24d1d29584fbea103bdcc591c0f5f6 selector_sha256_before=8e75b7ab9b3a9d223c4cfe07dd7f9963d4c9abfeb980f7a1391eea8b686f8ac3 selector_sha256=46d41783effb8d80ea1b09895f829b98a0946e0edbff1e29e7651eb3ef9b036a plan_sha256=2bb7228ed391811bef20a7e08024fe9ed0fab573a8e779a7a3f4041dfdcbc6c4 peer_count=5 moved_peer_count=1 exhausted_rows_remaining=0 rollback_performed=false rollback_result=NOT_REQUIRED counts.cs1=1 counts.cs2=1 counts.cs3=1 counts.cs4=1 counts.cs5=1 schema=router-wgpay-slot-topology-state-v2 accepted_generation=000000000016 applied_generation=000000000016 payload_sha256=98273ca7df91ba4ddfad6e002acadef74d24d1d29584fbea103bdcc591c0f5f6 mode=NORMAL source_vm101_generation=WATCHER_bridge_clear_egress1_1785605342 healthy_slots=egress1,egress2,egress3,egress4,egress5 exhausted_slots= allowed_selectors=cs1,cs2,cs3,cs4,cs5 exhausted_selectors= created_epoch=1785605342 received_epoch=1785605342 apply_result=PASS direct_policy_enabled=0 healthy_slot_count=5 min_healthy_slots_to_exit_direct=3 direct_active_before=false direct_probe_result=PASS_DIRECT_MODE_PROBE direct_transition=NOT_REQUIRED direct_action=NOT_REQUIRED direct_action_result=NOT_REQUESTED direct_request_result=NOT_REQUESTED selector_transaction_suppressed=false apply_performed=true selector_sha256_before=8e75b7ab9b3a9d223c4cfe07dd7f9963d4c9abfeb980f7a1391eea8b686f8ac3 selector_sha256=46d41783effb8d80ea1b09895f829b98a0946e0edbff1e29e7651eb3ef9b036a peer_count=5 moved_peer_count=1 exhausted_rows_remaining=0 plan_sha256=2bb7228ed391811bef20a7e08024fe9ed0fab573a8e779a7a3f4041dfdcbc6c4 counts.cs1=1 counts.cs2=1 counts.cs3=1 counts.cs4=1 counts.cs5=1 ===== FIREWALL PBR DIRECT ACTIVITY ===== firewall.@zone[1].name='transit_direct' firewall.@zone[1].network='transit_direct' firewall.@forwarding[0].dest='transit_direct' firewall.@zone[2].name='transit_vpn' firewall.@zone[2].network='transit_vpn' firewall.@forwarding[1].dest='transit_vpn' firewall.@forwarding[3].dest='transit_direct' firewall.@forwarding[4].dest='transit_vpn' firewall.@rule[0].src='transit_direct' firewall.wg_paid=zone firewall.wg_paid.name='wg_paid' firewall.wg_paid.input='ACCEPT' firewall.wg_paid.output='ACCEPT' firewall.wg_paid.forward='REJECT' firewall.wg_paid.network='wg_paid' firewall.wg_paid_to_transit_direct=forwarding firewall.wg_paid_to_transit_direct.src='wg_paid' firewall.wg_paid_to_transit_direct.dest='transit_direct' firewall.wg_paid_to_transit_vpn=forwarding firewall.wg_paid_to_transit_vpn.src='wg_paid' firewall.wg_paid_to_transit_vpn.dest='transit_vpn' firewall.allow_wg_paid_51830=rule firewall.allow_wg_paid_51830.name='Allow-WG-Paid-51830' firewall.allow_wg_paid_51830.proto='udp' firewall.allow_wg_paid_51830.dest_port='51830' firewall.allow_wg_paid_51830.target='ACCEPT' pbr.config.webui_show_ignore_target='1' pbr.config.supported_interface='transit_direct' 'transit_vpn' pbr.@policy[0].name='IGNORE_ADMIN_WG_TO_LAN' pbr.@policy[0].interface='ignore' /etc/pbr.d/default_lan_to_vpn.sh:6:nft add element inet fw4 pbr_transit_vpn_4_src_ip_user "{ 10.71.100.0/24, 10.250.100.0/24, 10.252.100.0/24, 10.253.0.0/16 }" 2>/dev/null || true /usr/local/sbin/router-wgpay-direct-mode.sh:18:PAID_CIDR="${ROUTER_WGPAY_DIRECT_PAID_SOURCE_CIDR:-${TOPOLOGY_DIRECT_PAID_SOURCE_CIDR:-10.253.0.0/16}}" /etc/router-egress-activity/router_egress_activity.nft:16: iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.10/32 counter name peer_10_253_1_10_out_vpn comment "activity_out 10.253.1.10/32 cs1 cs1_vpn3" /etc/router-egress-activity/router_egress_activity.nft:17: iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.10/32 counter name peer_10_253_1_10_in_vpn comment "activity_in 10.253.1.10/32 cs1 cs1_vpn3" /etc/router-egress-activity/router_egress_activity.nft:18: iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.11/32 counter name peer_10_253_1_11_out_vpn comment "activity_out 10.253.1.11/32 cs2 cs2_vpn4" /etc/router-egress-activity/router_egress_activity.nft:19: iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.11/32 counter name peer_10_253_1_11_in_vpn comment "activity_in 10.253.1.11/32 cs2 cs2_vpn4" /etc/router-egress-activity/router_egress_activity.nft:20: iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.12/32 counter name peer_10_253_1_12_out_vpn comment "activity_out 10.253.1.12/32 cs3 cs3_vpn5" /etc/router-egress-activity/router_egress_activity.nft:21: iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.12/32 counter name peer_10_253_1_12_in_vpn comment "activity_in 10.253.1.12/32 cs3 cs3_vpn5" /etc/router-egress-activity/router_egress_activity.nft:22: iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.13/32 counter name peer_10_253_1_13_out_vpn comment "activity_out 10.253.1.13/32 cs4 cs4_vpn1" /etc/router-egress-activity/router_egress_activity.nft:23: iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.13/32 counter name peer_10_253_1_13_in_vpn comment "activity_in 10.253.1.13/32 cs4 cs4_vpn1" /etc/router-egress-activity/router_egress_activity.nft:24: iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.14/32 counter name peer_10_253_1_14_out_vpn comment "activity_out 10.253.1.14/32 cs5 cs5_vpn2" /etc/router-egress-activity/router_egress_activity.nft:25: iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.14/32 counter name peer_10_253_1_14_in_vpn comment "activity_in 10.253.1.14/32 cs5 cs5_vpn2" iifname "wg_paid" jump input_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 input traffic" iifname "wg_paid" jump forward_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 forward traffic" udp dport 51830 counter packets 0 bytes 0 accept comment "!fw4: Allow-WG-Paid-51830" oifname "wg_paid" jump output_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 output traffic" iifname "wg_paid" jump helper_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 helper assignment" chain input_wg_paid { jump accept_from_wg_paid chain output_wg_paid { jump accept_to_wg_paid chain forward_wg_paid { jump accept_to_transit_direct comment "!fw4: Accept wg_paid to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept wg_paid to transit_vpn forwarding" jump reject_to_wg_paid chain helper_wg_paid { chain accept_from_wg_paid { iifname "wg_paid" counter packets 0 bytes 0 accept comment "!fw4: accept wg_paid IPv4/IPv6 traffic" chain accept_to_wg_paid { oifname "wg_paid" counter packets 0 bytes 0 accept comment "!fw4: accept wg_paid IPv4/IPv6 traffic" chain reject_to_wg_paid { oifname "wg_paid" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wg_paid IPv4/IPv6 traffic" iifname "wg_remote" ip dscp set cs4 counter packets 78881 bytes 12405643 comment "WG_REMOTE_DEFAULT_SELECTOR_CS4" iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.10 counter name "peer_10_253_1_10_out_vpn" comment "activity_out 10.253.1.10/32 cs1 cs1_vpn3" iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.10 counter name "peer_10_253_1_10_in_vpn" comment "activity_in 10.253.1.10/32 cs1 cs1_vpn3" iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.11 counter name "peer_10_253_1_11_out_vpn" comment "activity_out 10.253.1.11/32 cs2 cs2_vpn4" iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.11 counter name "peer_10_253_1_11_in_vpn" comment "activity_in 10.253.1.11/32 cs2 cs2_vpn4" iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.12 counter name "peer_10_253_1_12_out_vpn" comment "activity_out 10.253.1.12/32 cs3 cs3_vpn5" iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.12 counter name "peer_10_253_1_12_in_vpn" comment "activity_in 10.253.1.12/32 cs3 cs3_vpn5" iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.13 counter name "peer_10_253_1_13_out_vpn" comment "activity_out 10.253.1.13/32 cs4 cs4_vpn1" iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.13 counter name "peer_10_253_1_13_in_vpn" comment "activity_in 10.253.1.13/32 cs4 cs4_vpn1" iifname "wg_paid" oifname "eth2" ip saddr 10.253.1.14 counter name "peer_10_253_1_14_out_vpn" comment "activity_out 10.253.1.14/32 cs5 cs5_vpn2" iifname "eth2" oifname "wg_paid" ip daddr 10.253.1.14 counter name "peer_10_253_1_14_in_vpn" comment "activity_in 10.253.1.14/32 cs5 cs5_vpn2" iifname "wg_paid" ip saddr 10.253.1.10 ip dscp set cs5 counter packets 0 bytes 0 comment "STEP_035B_SELECTOR_WGPAY_canary_vpn2_10.253.1.10_cs5" iifname "wg_paid" ip saddr 10.253.1.11 ip dscp set cs2 counter packets 0 bytes 0 comment "STEP_035B_SELECTOR_WGPAY_canary_vpn4_10.253.1.11_cs2" iifname "wg_paid" ip saddr 10.253.1.12 ip dscp set cs3 counter packets 0 bytes 0 comment "STEP_035B_SELECTOR_WGPAY_canary_vpn5_10.253.1.12_cs3" iifname "wg_paid" ip saddr 10.253.1.13 ip dscp set cs4 counter packets 0 bytes 0 comment "STEP_035B_SELECTOR_WGPAY_canary_vpn1_10.253.1.13_cs4" iifname "wg_paid" ip saddr 10.253.1.14 ip dscp set cs1 counter packets 0 bytes 0 comment "STEP_035B_SELECTOR_WGPAY_canary_vpn3_10.253.1.14_cs1" ===== UDP LISTENERS AND CANDIDATES ===== Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name udp 0 0 0.0.0.0:51820 0.0.0.0:* - udp 0 0 0.0.0.0:51830 0.0.0.0:* - udp 0 0 10.250.100.1:53 0.0.0.0:* 4600/dnsmasq udp 0 0 127.0.0.1:53 0.0.0.0:* 4600/dnsmasq udp 0 0 10.201.0.1:53 0.0.0.0:* 4600/dnsmasq udp 0 0 10.200.0.1:53 0.0.0.0:* 4600/dnsmasq udp 0 0 10.71.100.1:53 0.0.0.0:* 4600/dnsmasq udp 0 0 10.253.1.1:53 0.0.0.0:* 4600/dnsmasq udp 0 0 0.0.0.0:67 0.0.0.0:* 4600/dnsmasq udp 0 0 :::51820 :::* - udp 0 0 :::51830 :::* - udp 0 0 ::1:53 :::* 4600/dnsmasq udp 0 0 fe80::be24:11ff:fe94:bbfb:53 :::* 4600/dnsmasq udp 0 0 fe80::be24:11ff:fee4:6cfb:53 :::* 4600/dnsmasq udp 0 0 fe80::be24:11ff:feee:7d14:53 :::* 4600/dnsmasq CANDIDATE_AWG_PORT=51831 CANDIDATE_AWG_PORT_COLLISION=false CANDIDATE_AWG_POOL=10.254.0.0/16 CANDIDATE_AWG_POOL_CONFLICT=false RESULT=PASS_R20QW_VM100_READONLY_AUDIT ===== vm101-audit.rc.txt ===== REMOTE_RC=0 MACHINE=vm101 ===== vm101-audit.stderr.txt ===== sh: hostname: not found ===== vm101-audit.stdout.txt ===== SCHEMA=wg-paid-vm101-readonly-audit-v1 MACHINE=VM101 AUDIT_UTC=2026-08-02T10:15:07Z HOSTNAME= ===== SYSTEM ===== { "kernel": "6.6.93", "hostname": "OpenWrt", "system": "Intel(R) Core(TM) i7-6950X CPU @ 3.00GHz", "model": "QEMU Standard PC (i440FX + PIIX, 1996)", "board_name": "qemu-standard-pc-i440fx-piix-1996", "rootfs_type": "ext4", "release": { "distribution": "OpenWrt", "version": "24.10.2", "revision": "r28739-d9340319c6", "target": "x86/64", "description": "OpenWrt 24.10.2 r28739-d9340319c6", "builddate": "1750711236" } } Linux OpenWrt 6.6.93 #0 SMP Mon Jun 23 20:40:36 2025 x86_64 GNU/Linux 10:15:07 up 1 day, 21 min, load average: 0.00, 0.01, 0.00 Filesystem Size Used Available Use% Mounted on /dev/root 990.3M 170.8M 803.4M 18% / /dev/root 990.3M 170.8M 803.4M 18% / ===== MACHINE GIT ===== >>> [vm101-git] precheck MODE=--check PROFILE=/etc/router-machine-git-source.conf PROFILE_VERSION=2 PROFILE_SHA256=06dc8ff6870d79ace67e50a983adc5d6e4c1a66683d869013cd8f92b9aa25011 MACHINE_ID=vm101 GIT_DIR=/root/.vm101-source.git WORK_TREE=/ BRANCH=main REMOTE_URL=git@github.com:DChuvelev/wg-paid-vm101.git LOCAL_HEAD=ac678d1b3164e0201d221967fa131e354a211881 >>> [vm101-git] verify remote branch REMOTE_HEAD=ac678d1b3164e0201d221967fa131e354a211881 >>> [vm101-git] build current project allowlist >>> [vm101-git] read paths already tracked by git CURRENT_ALLOWED_COUNT=58 TRACKED_COUNT=58 MANAGED_UNION_COUNT=58 >>> [vm101-git] strict path validation STRICT_PATH_VALIDATION=true >>> [vm101-git] show tracked files now missing from machine TRACKED_PATH_MISSING_COUNT=0 >>> [vm101-git] build simulated git index STAGED_CHANGE_COUNT=0 STAGED_PATHS=NONE >>> [vm101-git] validate simulated staged paths STAGED_PATH_VALIDATION=true SIMULATED_TREE_SHA=0d00ec84743795ff4dde671e42ac3e77241591ef SIMULATED_TREE_FILE_COUNT=58 >>> [vm101-git] high-confidence secret scan of simulated tree HIGH_CONFIDENCE_SECRET_MATCHES=0 >>> [vm101-git] keyword review scan === FILES REQUIRING KEYWORD REVIEW === 0d00ec84743795ff4dde671e42ac3e77241591ef:hmn/hmn-load-vpn-test.sh 0d00ec84743795ff4dde671e42ac3e77241591ef:hmn/hmn-set-code.sh RESULT=PASS_vm101_GIT_PUBLISH_CHECK MACHINE_ID=vm101 GIT_COMMIT=ac678d1b3164e0201d221967fa131e354a211881 GIT_TREE=0d00ec84743795ff4dde671e42ac3e77241591ef GIT_FILE_COUNT=58 COMMIT_CREATED=false PUSH_PERFORMED=false VM101_GIT_CHECK=PASS ===== NETWORK ===== lo UNKNOWN 00:00:00:00:00:00 eth0 UP bc:24:11:42:83:cf eth1 UP bc:24:11:09:4e:2c eth2 UP bc:24:11:4d:7a:71 eth3 UP bc:24:11:c8:2e:e1 vpn1 UNKNOWN vpn2 UNKNOWN vpn3 UNKNOWN vpn4 UNKNOWN vpn5 UNKNOWN lo UNKNOWN 127.0.0.1/8 eth0 UP 95.165.105.4/20 eth1 UP 10.200.0.2/24 eth2 UP 10.71.100.2/24 eth3 UP 10.201.0.2/24 vpn1 UNKNOWN 10.86.108.200/32 vpn2 UNKNOWN 10.91.168.223/32 vpn3 UNKNOWN 10.83.41.157/32 vpn4 UNKNOWN 10.103.187.191/32 vpn5 UNKNOWN 10.124.237.218/32 default via 95.165.96.1 dev eth0 proto static src 95.165.105.4 10.71.100.0/24 dev eth2 proto kernel scope link src 10.71.100.2 10.200.0.0/24 dev eth1 proto kernel scope link src 10.200.0.2 10.201.0.0/24 dev eth3 proto kernel scope link src 10.201.0.2 10.250.100.0/24 via 10.71.100.1 dev eth2 proto static 23.158.72.87 via 95.165.96.1 dev eth0 proto static 37.235.54.96 via 95.165.96.1 dev eth0 proto static 38.7.197.83 via 95.165.96.1 dev eth0 proto static 38.244.192.244 via 95.165.96.1 dev eth0 proto static 46.246.127.84 via 95.165.96.1 dev eth0 proto static 64.253.89.235 via 95.165.96.1 dev eth0 proto static 77.67.8.84 via 95.165.96.1 dev eth0 proto static 78.31.250.16 via 95.165.96.1 dev eth0 proto static 84.32.230.159 via 95.165.96.1 dev eth0 proto static 89.40.104.201 via 95.165.96.1 dev eth0 proto static 89.46.232.39 via 95.165.96.1 dev eth0 proto static 89.46.237.14 via 95.165.96.1 dev eth0 proto static 95.165.96.0/20 dev eth0 proto kernel scope link src 95.165.105.4 95.211.68.119 via 95.165.96.1 dev eth0 proto static 103.57.251.39 via 95.165.96.1 dev eth0 proto static 107.172.187.100 via 95.165.96.1 dev eth0 proto static 107.174.226.51 via 95.165.96.1 dev eth0 proto static 107.175.93.59 via 95.165.96.1 dev eth0 proto static 109.248.198.4 via 95.165.96.1 dev eth0 proto static 112.120.98.53 via 95.165.96.1 dev eth0 proto static 141.98.189.83 via 95.165.96.1 dev eth0 proto static 149.154.157.24 via 95.165.96.1 dev eth0 proto static 151.236.30.139 via 95.165.96.1 dev eth0 proto static 157.173.25.198 via 95.165.96.1 dev eth0 proto static 157.173.27.69 via 95.165.96.1 dev eth0 proto static 178.215.227.13 via 95.165.96.1 dev eth0 proto static 185.14.97.234 via 95.165.96.1 dev eth0 proto static 188.190.17.80 via 95.165.96.1 dev eth0 proto static 192.71.27.64 via 95.165.96.1 dev eth0 proto static 192.71.244.202 via 95.165.96.1 dev eth0 proto static 192.71.247.18 via 95.165.96.1 dev eth0 proto static 192.121.162.75 via 95.165.96.1 dev eth0 proto static 192.121.163.235 via 95.165.96.1 dev eth0 proto static 193.235.207.39 via 95.165.96.1 dev eth0 proto static 194.71.126.45 via 95.165.96.1 dev eth0 proto static 194.71.227.212 via 95.165.96.1 dev eth0 proto static network.loopback=interface network.loopback.device='lo' network.loopback.proto='static' network.loopback.ipaddr='127.0.0.1' network.loopback.netmask='255.0.0.0' network.globals=globals network.globals.packet_steering='1' network.wan=interface network.wan.device='eth0' network.wan.proto='dhcp' network.wan.peerdns='0' network.wan.dns='1.1.1.1' '8.8.8.8' network.mgmt=interface network.mgmt.proto='static' network.mgmt.device='eth2' network.mgmt.ipaddr='10.71.100.2' network.mgmt.netmask='255.255.255.0' network.direct_in=interface network.direct_in.proto='static' network.direct_in.device='eth3' network.direct_in.ipaddr='10.201.0.2' network.direct_in.netmask='255.255.255.0' network.vpn_in=interface network.vpn_in.proto='static' network.vpn_in.device='eth1' network.vpn_in.ipaddr='10.200.0.2/24' network.@route[0]=route network.@route[0].interface='mgmt' network.@route[0].target='10.250.100.0/24' network.@route[0].gateway='10.71.100.1' network.vpn1=interface network.vpn1.proto='amneziawg' network.vpn1.private_key= network.vpn1.awg_jc='3' network.vpn1.awg_jmin='50' network.vpn1.awg_jmax='100' network.vpn1.awg_s1='107' network.vpn1.awg_s2='122' network.vpn1.awg_h1='711662706' network.vpn1.awg_h2='1180552356' network.vpn1.awg_h3='1975038815' network.vpn1.awg_h4='1815189548' network.vpn1.auto='0' network.vpn1.disabled='0' network.vpn1.delegate='0' network.vpn1.peerdns='0' network.vpn1.defaultroute='0' network.vpn1.hmn_role='production_slot' network.vpn1.hmn_source_config='/var/lib/router-egress-recovery/generations/staging/r20c-20260801-171610-1447/configs/egress1.conf' network.vpn1.hmn_loaded_at='2026-08-01T17:28:00Z' network.vpn1.hmn_endpoint='192.121.163.235:42530' network.vpn1.hmn_generation_id='r20c-20260801-171610-1447' network.vpn1.addresses='10.86.108.200/32' network.vpn1.dns='1.1.1.1' network.vpn_user=interface network.vpn_user.proto='amneziawg' network.vpn_user.private_key= network.vpn_user.awg_jc='3' network.vpn_user.awg_jmin='50' network.vpn_user.awg_jmax='100' network.vpn_user.awg_s1='20' network.vpn_user.awg_s2='87' network.vpn_user.awg_h1='217767672' network.vpn_user.awg_h2='1805649910' network.vpn_user.awg_h3='665837737' network.vpn_user.awg_h4='1257888244' network.vpn_user.auto='0' network.vpn_user.disabled='0' network.vpn_user.delegate='0' network.vpn_user.peerdns='0' network.vpn_user.defaultroute='0' network.vpn_user.addresses='10.90.235.244/32' network.vpn_user.dns='1.1.1.1' network.vpn_user.hmn_role='user_select_slot' network.vpn_user.hmn_source_config='/root/hmn/configs/awg1/latest/146-GB-United-Kingdom-London-S1-37.235.54.96-awg1.conf' network.vpn_user.hmn_loaded_at='2026-07-06T17:41:02+00:00' network.vpn_user.hmn_endpoint='37.235.54.96:38971' network.@amneziawg_vpn_user[0]=amneziawg_vpn_user network.@amneziawg_vpn_user[0].description='146-GB-United-Kingdom-London-S1-37.235.54.96-awg1.conf' network.@amneziawg_vpn_user[0].public_key= network.@amneziawg_vpn_user[0].allowed_ips='0.0.0.0/0' network.@amneziawg_vpn_user[0].route_allowed_ips='0' network.@amneziawg_vpn_user[0].persistent_keepalive='28' network.@amneziawg_vpn_user[0].endpoint_host='37.235.54.96' network.@amneziawg_vpn_user[0].endpoint_port='38971' network.vpn2=interface network.vpn2.proto='amneziawg' network.vpn2.private_key= network.vpn2.awg_jc='3' network.vpn2.awg_jmin='50' network.vpn2.awg_jmax='100' network.vpn2.awg_s1='17' network.vpn2.awg_s2='121' network.vpn2.awg_h1='1770463880' network.vpn2.awg_h2='1868667466' network.vpn2.awg_h3='938498412' network.vpn2.awg_h4='71620529' network.vpn2.auto='0' network.vpn2.disabled='0' network.vpn2.delegate='0' network.vpn2.peerdns='0' network.vpn2.defaultroute='0' network.vpn2.hmn_role='production_slot' network.vpn2.hmn_source_config='/var/lib/router-egress-recovery/generations/staging/r20c-20260801-171610-1447/configs/egress2.conf' network.vpn2.hmn_loaded_at='2026-08-01T17:28:00Z' network.vpn2.hmn_endpoint='157.173.25.198:34340' network.vpn2.hmn_generation_id='r20c-20260801-171610-1447' network.vpn2.addresses='10.91.168.223/32' network.vpn2.dns='1.1.1.1' network.vpn3=interface network.vpn3.proto='amneziawg' network.vpn3.private_key= network.vpn3.awg_jc='3' network.vpn3.awg_jmin='50' network.vpn3.awg_jmax='100' network.vpn3.awg_s1='80' network.vpn3.awg_s2='113' network.vpn3.awg_h1='1671317470' network.vpn3.awg_h2='469282168' network.vpn3.awg_h3='844208806' network.vpn3.awg_h4='4169549' network.vpn3.auto='0' network.vpn3.disabled='0' network.vpn3.delegate='0' network.vpn3.peerdns='0' network.vpn3.defaultroute='0' network.vpn3.hmn_role='production_slot' network.vpn3.hmn_source_config='/var/lib/router-egress-recovery/generations/staging/r20c-20260801-171610-1447/configs/egress3.conf' network.vpn3.hmn_loaded_at='2026-08-01T17:28:00Z' network.vpn3.hmn_endpoint='185.14.97.234:37492' network.vpn3.hmn_generation_id='r20c-20260801-171610-1447' network.vpn3.addresses='10.83.41.157/32' network.vpn3.dns='1.1.1.1' network.vpn4=interface network.vpn4.proto='amneziawg' network.vpn4.private_key= network.vpn4.awg_jc='3' network.vpn4.awg_jmin='50' network.vpn4.awg_jmax='100' network.vpn4.awg_s1='52' network.vpn4.awg_s2='88' network.vpn4.awg_h1='247439890' network.vpn4.awg_h2='1157952265' network.vpn4.awg_h3='469264248' network.vpn4.awg_h4='95652034' network.vpn4.auto='0' network.vpn4.disabled='0' network.vpn4.delegate='0' network.vpn4.peerdns='0' network.vpn4.defaultroute='0' network.vpn4.hmn_role='production_slot' network.vpn4.hmn_source_config='/var/lib/router-egress-recovery/generations/staging/r20c-20260801-171610-1447/configs/egress4.conf' network.vpn4.hmn_loaded_at='2026-08-01T17:28:00Z' network.vpn4.hmn_endpoint='84.32.230.159:43808' network.vpn4.hmn_generation_id='r20c-20260801-171610-1447' network.vpn4.addresses='10.103.187.191/32' network.vpn4.dns='1.1.1.1' network.vpn5=interface network.vpn5.proto='amneziawg' network.vpn5.private_key= network.vpn5.awg_jc='3' network.vpn5.awg_jmin='50' network.vpn5.awg_jmax='100' network.vpn5.awg_s1='110' network.vpn5.awg_s2='69' network.vpn5.awg_h1='1835589950' network.vpn5.awg_h2='1099975115' network.vpn5.awg_h3='829252662' network.vpn5.awg_h4='1534369890' network.vpn5.auto='0' network.vpn5.disabled='0' network.vpn5.delegate='0' network.vpn5.peerdns='0' network.vpn5.defaultroute='0' network.vpn5.hmn_role='production_slot' network.vpn5.hmn_source_config='/var/lib/router-egress-recovery/generations/staging/r20c-20260801-171610-1447/configs/egress5.conf' network.vpn5.hmn_loaded_at='2026-08-01T17:28:00Z' network.vpn5.hmn_endpoint='151.236.30.139:33998' network.vpn5.hmn_generation_id='r20c-20260801-171610-1447' network.vpn5.addresses='10.124.237.218/32' network.vpn5.dns='1.1.1.1' network.vpn_test=interface network.vpn_test.proto='amneziawg' network.vpn_test.private_key= network.vpn_test.awg_jc='3' network.vpn_test.awg_jmin='50' network.vpn_test.awg_jmax='100' network.vpn_test.awg_s1='18' network.vpn_test.awg_s2='76' network.vpn_test.awg_h1='1955462561' network.vpn_test.awg_h2='1627595855' network.vpn_test.awg_h3='1760056293' network.vpn_test.awg_h4='1765367965' network.vpn_test.auto='0' network.vpn_test.disabled='0' network.vpn_test.delegate='0' network.vpn_test.peerdns='0' network.vpn_test.defaultroute='0' network.vpn_test.addresses='10.67.234.5/32' network.vpn_test.dns='1.1.1.1' network.vpn_test.hmn_role='test_slot' network.vpn_test.hmn_source_config='/root/hmn/configs/awg1/20260801-171613/225-IL-Israel-Tel-Aviv-S5-192.71.27.64-awg1.conf' network.vpn_test.hmn_loaded_at='2026-08-01T17:27:40+00:00' network.vpn_test.hmn_endpoint='192.71.27.64:40044' network.@amneziawg_vpn_test[0]=amneziawg_vpn_test network.@amneziawg_vpn_test[0].description='225-IL-Israel-Tel-Aviv-S5-192.71.27.64-awg1.conf' network.@amneziawg_vpn_test[0].public_key= network.@amneziawg_vpn_test[0].allowed_ips='0.0.0.0/0' network.@amneziawg_vpn_test[0].route_allowed_ips='0' network.@amneziawg_vpn_test[0].persistent_keepalive='24' network.@amneziawg_vpn_test[0].endpoint_host='192.71.27.64' network.@amneziawg_vpn_test[0].endpoint_port='40044' network.@amneziawg_vpn1[0]=amneziawg_vpn1 network.@amneziawg_vpn1[0].description='r16-r20c-20260801-171610-1447-egress1' network.@amneziawg_vpn1[0].public_key= network.@amneziawg_vpn1[0].allowed_ips='0.0.0.0/0' network.@amneziawg_vpn1[0].route_allowed_ips='0' network.@amneziawg_vpn1[0].persistent_keepalive='24' network.@amneziawg_vpn1[0].endpoint_host='192.121.163.235' network.@amneziawg_vpn1[0].endpoint_port='42530' network.@amneziawg_vpn2[0]=amneziawg_vpn2 network.@amneziawg_vpn2[0].description='r16-r20c-20260801-171610-1447-egress2' network.@amneziawg_vpn2[0].public_key= network.@amneziawg_vpn2[0].allowed_ips='0.0.0.0/0' network.@amneziawg_vpn2[0].route_allowed_ips='0' network.@amneziawg_vpn2[0].persistent_keepalive='27' network.@amneziawg_vpn2[0].endpoint_host='157.173.25.198' network.@amneziawg_vpn2[0].endpoint_port='34340' network.@amneziawg_vpn3[0]=amneziawg_vpn3 network.@amneziawg_vpn3[0].description='r16-r20c-20260801-171610-1447-egress3' network.@amneziawg_vpn3[0].public_key= network.@amneziawg_vpn3[0].allowed_ips='0.0.0.0/0' network.@amneziawg_vpn3[0].route_allowed_ips='0' network.@amneziawg_vpn3[0].persistent_keepalive='25' network.@amneziawg_vpn3[0].endpoint_host='185.14.97.234' network.@amneziawg_vpn3[0].endpoint_port='37492' network.@amneziawg_vpn4[0]=amneziawg_vpn4 network.@amneziawg_vpn4[0].description='r16-r20c-20260801-171610-1447-egress4' network.@amneziawg_vpn4[0].public_key= network.@amneziawg_vpn4[0].allowed_ips='0.0.0.0/0' network.@amneziawg_vpn4[0].route_allowed_ips='0' network.@amneziawg_vpn4[0].persistent_keepalive='26' network.@amneziawg_vpn4[0].endpoint_host='84.32.230.159' network.@amneziawg_vpn4[0].endpoint_port='43808' network.@amneziawg_vpn5[0]=amneziawg_vpn5 network.@amneziawg_vpn5[0].description='r16-r20c-20260801-171610-1447-egress5' network.@amneziawg_vpn5[0].public_key= network.@amneziawg_vpn5[0].allowed_ips='0.0.0.0/0' network.@amneziawg_vpn5[0].route_allowed_ips='0' network.@amneziawg_vpn5[0].persistent_keepalive='24' network.@amneziawg_vpn5[0].endpoint_host='151.236.30.139' network.@amneziawg_vpn5[0].endpoint_port='33998' { "interface": [ { "interface": "direct_in", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 87709, "l3_device": "eth3", "proto": "static", "device": "eth3", "updated": [ "addresses" ], "metric": 0, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "10.201.0.2", "mask": 24 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "loopback", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 87709, "l3_device": "lo", "proto": "static", "device": "lo", "updated": [ "addresses" ], "metric": 0, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "127.0.0.1", "mask": 8 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "mgmt", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 87709, "l3_device": "eth2", "proto": "static", "device": "eth2", "updated": [ "addresses", "routes" ], "metric": 0, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "10.71.100.2", "mask": 24 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ { "target": "10.250.100.0", "mask": 24, "nexthop": "10.71.100.1", "source": "0.0.0.0/0" } ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "vpn1", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 60427, "l3_device": "vpn1", "proto": "amneziawg", "updated": [ "addresses" ], "metric": 0, "dns_metric": 0, "delegation": false, "ipv4-address": [ { "address": "10.86.108.200", "mask": 32 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ ], "dns-server": [ "1.1.1.1" ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "vpn2", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 60420, "l3_device": "vpn2", "proto": "amneziawg", "updated": [ "addresses" ], "metric": 0, "dns_metric": 0, "delegation": false, "ipv4-address": [ { "address": "10.91.168.223", "mask": 32 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ ], "dns-server": [ "1.1.1.1" ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "vpn3", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 60412, "l3_device": "vpn3", "proto": "amneziawg", "updated": [ "addresses" ], "metric": 0, "dns_metric": 0, "delegation": false, "ipv4-address": [ { "address": "10.83.41.157", "mask": 32 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ ], "dns-server": [ "1.1.1.1" ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "vpn4", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 60404, "l3_device": "vpn4", "proto": "amneziawg", "updated": [ "addresses" ], "metric": 0, "dns_metric": 0, "delegation": false, "ipv4-address": [ { "address": "10.103.187.191", "mask": 32 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ ], "dns-server": [ "1.1.1.1" ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "vpn5", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 60396, "l3_device": "vpn5", "proto": "amneziawg", "updated": [ "addresses" ], "metric": 0, "dns_metric": 0, "delegation": false, "ipv4-address": [ { "address": "10.124.237.218", "mask": 32 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ ], "dns-server": [ "1.1.1.1" ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "vpn_in", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 87709, "l3_device": "eth1", "proto": "static", "device": "eth1", "updated": [ "addresses" ], "metric": 0, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "10.200.0.2", "mask": 24 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ ], "dns-search": [ ], "neighbors": [ ] }, "data": { } }, { "interface": "vpn_test", "up": false, "pending": false, "available": true, "autostart": false, "dynamic": false, "proto": "amneziawg", "data": { } }, { "interface": "vpn_user", "up": false, "pending": false, "available": true, "autostart": false, "dynamic": false, "proto": "amneziawg", "data": { } }, { "interface": "wan", "up": true, "pending": false, "available": true, "autostart": true, "dynamic": false, "uptime": 87709, "l3_device": "eth0", "proto": "dhcp", "device": "eth0", "metric": 0, "dns_metric": 0, "delegation": true, "ipv4-address": [ { "address": "95.165.105.4", "mask": 20 } ], "ipv6-address": [ ], "ipv6-prefix": [ ], "ipv6-prefix-assignment": [ ], "route": [ { "target": "0.0.0.0", "mask": 0, "nexthop": "95.165.96.1", "source": "95.165.105.4/32" } ], "dns-server": [ "1.1.1.1", "8.8.8.8" ], "dns-search": [ ], "neighbors": [ ], "inactive": { "ipv4-address": [ ], "ipv6-address": [ ], "route": [ ], "dns-server": [ "62.112.113.170", "62.112.106.130" ], "dns-search": [ ], "neighbors": [ ] }, "data": { "dhcpserver": "95.165.96.1", "leasetime": 300 } } ] } ===== PAID INBOUND FIREWALL AND DNAT ===== firewall.@redirect[0]=redirect firewall.@redirect[0].name='WG_easy_51821_to_VM103' firewall.@redirect[0].family='ipv4' firewall.@redirect[0].src='wan' firewall.@redirect[0].src_dport='51821' firewall.@redirect[0].proto='udp' firewall.@redirect[0].dest='Management' firewall.@redirect[0].dest_ip='10.71.1.189' firewall.@redirect[0].dest_port='51821' firewall.@redirect[0].target='DNAT' firewall.@redirect[1]=redirect firewall.@redirect[1].name='wg_remote_to_vm100' firewall.@redirect[1].src='wan' firewall.@redirect[1].dest='Management' firewall.@redirect[1].src_dport='51820' firewall.@redirect[1].dest_ip='10.71.100.1' firewall.@redirect[1].dest_port='51820' firewall.@redirect[1].proto='udp' firewall.@redirect[1].target='DNAT' firewall.dnat_wg_paid_51830=redirect firewall.dnat_wg_paid_51830.name='DNAT-WG-Paid-51830-to-VM100' firewall.dnat_wg_paid_51830.src='wan' firewall.dnat_wg_paid_51830.src_dport='51830' firewall.dnat_wg_paid_51830.dest_ip='10.71.100.1' firewall.dnat_wg_paid_51830.dest_port='51830' firewall.dnat_wg_paid_51830.proto='udp' firewall.dnat_wg_paid_51830.target='DNAT' firewall.dnat_wg_paid_51830.dest='Management' firewall.reports_http_80=redirect firewall.reports_http_80.target='DNAT' firewall.reports_https_443=redirect firewall.reports_https_443.target='DNAT' ct status dnat accept comment "!fw4: Accept port redirections" ct status dnat accept comment "!fw4: Accept port forwards" ct status dnat accept comment "!fw4: Accept port redirections" ct status dnat accept comment "!fw4: Accept port forwards" meta nfproto ipv4 udp dport 51821 counter packets 0 bytes 0 dnat ip to 10.71.1.189:51821 comment "!fw4: WG_easy_51821_to_VM103" meta nfproto ipv4 udp dport 51820 counter packets 16 bytes 2672 dnat ip to 10.71.100.1:51820 comment "!fw4: wg_remote_to_vm100" meta nfproto ipv4 udp dport 51830 counter packets 0 bytes 0 dnat ip to 10.71.100.1:51830 comment "!fw4: DNAT-WG-Paid-51830-to-VM100" meta nfproto ipv4 tcp dport 80 counter packets 195 bytes 10228 dnat ip to 10.71.100.84:80 comment "!fw4: Reports HTTP 80 to VM130" meta nfproto ipv4 tcp dport 443 counter packets 354 bytes 18548 dnat ip to 10.71.100.84:443 comment "!fw4: Reports HTTPS 443 to VM130" ip saddr 10.71.100.0/24 ip daddr 95.165.105.4 udp dport 51821 dnat ip to 10.71.1.189:51821 comment "!fw4: WG_easy_51821_to_VM103 (reflection)" ip saddr 10.71.100.0/24 ip daddr 95.165.105.4 udp dport 51820 dnat ip to 10.71.100.1:51820 comment "!fw4: wg_remote_to_vm100 (reflection)" ip saddr 10.71.100.0/24 ip daddr 95.165.105.4 udp dport 51830 dnat ip to 10.71.100.1:51830 comment "!fw4: DNAT-WG-Paid-51830-to-VM100 (reflection)" ip saddr 10.71.100.0/24 ip daddr 95.165.105.4 tcp dport 80 dnat ip to 10.71.100.84:80 comment "!fw4: Reports HTTP 80 to VM130 (reflection)" ip saddr 10.71.100.0/24 ip daddr 95.165.105.4 tcp dport 443 dnat ip to 10.71.100.84:443 comment "!fw4: Reports HTTPS 443 to VM130 (reflection)" ip saddr 10.71.100.0/24 ip daddr 10.71.100.1 udp dport 51820 snat ip to 10.71.100.2 comment "!fw4: wg_remote_to_vm100 (reflection)" ip saddr 10.71.100.0/24 ip daddr 10.71.100.1 udp dport 51830 snat ip to 10.71.100.2 comment "!fw4: DNAT-WG-Paid-51830-to-VM100 (reflection)" WG_PAID_PUBLIC_PORT=51830 WG_PAID_DNAT_PRESENT=true CANDIDATE_AWG_PUBLIC_PORT=51831 CANDIDATE_AWG_PUBLIC_PORT_COLLISION=false CANDIDATE_AWG_DNAT_PRESENT=false ===== UDP LISTENERS ===== Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name udp 0 0 0.0.0.0:42156 0.0.0.0:* - udp 0 0 0.0.0.0:42216 0.0.0.0:* - udp 0 0 0.0.0.0:50984 0.0.0.0:* - udp 0 0 10.124.237.218:53 0.0.0.0:* 3789/dnsmasq udp 0 0 10.103.187.191:53 0.0.0.0:* 3789/dnsmasq udp 0 0 10.83.41.157:53 0.0.0.0:* 3789/dnsmasq udp 0 0 10.91.168.223:53 0.0.0.0:* 3789/dnsmasq udp 0 0 10.86.108.200:53 0.0.0.0:* 3789/dnsmasq udp 0 0 127.0.0.1:53 0.0.0.0:* 3789/dnsmasq udp 0 0 95.165.105.4:53 0.0.0.0:* 3789/dnsmasq udp 0 0 10.200.0.2:53 0.0.0.0:* 3789/dnsmasq udp 0 0 10.71.100.2:53 0.0.0.0:* 3789/dnsmasq udp 0 0 10.201.0.2:53 0.0.0.0:* 3789/dnsmasq udp 0 0 0.0.0.0:44598 0.0.0.0:* - udp 0 0 0.0.0.0:47990 0.0.0.0:* - udp 0 0 :::42156 :::* - udp 0 0 :::42216 :::* - udp 0 0 :::50984 :::* - udp 0 0 fe80::be24:11ff:fe42:83cf:53 :::* 3789/dnsmasq udp 0 0 fe80::be24:11ff:fe4d:7a71:53 :::* 3789/dnsmasq udp 0 0 ::1:53 :::* 3789/dnsmasq udp 0 0 fe80::be24:11ff:fe09:4e2c:53 :::* 3789/dnsmasq udp 0 0 fe80::be24:11ff:fec8:2ee1:53 :::* 3789/dnsmasq udp 0 0 :::44598 :::* - udp 0 0 :::47990 :::* - ===== CURRENT SELECTOR MAPPER HEALTH ===== 10011: from all fwmark 0x201 lookup 201 10012: from all fwmark 0x202 lookup 202 10013: from all fwmark 0x203 lookup 203 10014: from all fwmark 0x204 lookup 204 10015: from all fwmark 0x205 lookup 205 TABLE_201=default dev vpn1 scope link TABLE_202=default dev vpn2 scope link TABLE_203=default dev vpn3 scope link TABLE_204=default dev vpn4 scope link TABLE_205=default dev vpn5 scope link EGRESS_AWG_INTERFACES=vpn1 vpn2 vpn3 vpn4 vpn5 RESULT=PASS_R20QW_VM101_READONLY_AUDIT ===== vm121-audit.rc.txt ===== REMOTE_RC=0 MACHINE=vm121 ===== vm121-audit.stderr.txt ===== ===== vm121-audit.stdout.txt ===== SCHEMA=wg-paid-vm121-readonly-audit-v1 MACHINE=VM121 AUDIT_UTC=2026-08-02T10:15:01Z HOSTNAME=wg-access-dev ===== SYSTEM ===== Linux wg-access-dev 6.1.0-50-cloud-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.176-1 (2026-07-02) x86_64 GNU/Linux PRETTY_NAME="Debian GNU/Linux 12 (bookworm)" NAME="Debian GNU/Linux" VERSION_ID="12" VERSION="12 (bookworm)" VERSION_CODENAME=bookworm ID=debian HOME_URL="https://www.debian.org/" SUPPORT_URL="https://www.debian.org/support" BUG_REPORT_URL="https://bugs.debian.org/" 10:15:01 up 17 days, 20:14, 0 user, load average: 0.11, 0.10, 0.09 Filesystem Size Used Avail Use% Mounted on /dev/sda1 63G 3.5G 57G 6% / /dev/sda1 63G 3.5G 57G 6% / /dev/sda1 63G 3.5G 57G 6% / ===== MACHINE GIT ===== >>> [vm121-git] precheck MODE=--check PROFILE=/etc/router-machine-git-source.conf PROFILE_VERSION=2 PROFILE_SHA256=119996c097d5302e4911488ac542dd0b5105ea64c4775f476181bafa21eab60a MACHINE_ID=vm121 GIT_DIR=/root/.vm121-source.git WORK_TREE=/ BRANCH=main REMOTE_URL=git@github.com:DChuvelev/wg-paid-vm121.git LOCAL_HEAD=93e0e5a31f0900a498b77d22e6a7f2ca5fd7fee0 >>> [vm121-git] verify remote branch REMOTE_HEAD=93e0e5a31f0900a498b77d22e6a7f2ca5fd7fee0 >>> [vm121-git] build current project allowlist >>> [vm121-git] read paths already tracked by git CURRENT_ALLOWED_COUNT=41 TRACKED_COUNT=41 MANAGED_UNION_COUNT=41 >>> [vm121-git] strict path validation STRICT_PATH_VALIDATION=true >>> [vm121-git] show tracked files now missing from machine TRACKED_PATH_MISSING_COUNT=0 >>> [vm121-git] build simulated git index STAGED_CHANGE_COUNT=0 STAGED_PATHS=NONE >>> [vm121-git] validate simulated staged paths STAGED_PATH_VALIDATION=true SIMULATED_TREE_SHA=b6fb72951eedc96decf445b71e7d9d6e77ec5ee3 SIMULATED_TREE_FILE_COUNT=41 >>> [vm121-git] high-confidence secret scan of simulated tree HIGH_CONFIDENCE_SECRET_MATCHES=0 >>> [vm121-git] keyword review scan KEYWORD_REVIEW_FILES=NONE RESULT=PASS_VM121_GIT_PUBLISH_CHECK MACHINE_ID=vm121 GIT_COMMIT=93e0e5a31f0900a498b77d22e6a7f2ca5fd7fee0 GIT_TREE=b6fb72951eedc96decf445b71e7d9d6e77ec5ee3 GIT_FILE_COUNT=41 COMMIT_CREATED=false PUSH_PERFORMED=false VM121_GIT_CHECK=PASS ===== DOCKER ===== DOCKER_SERVER_VERSION=29.6.1 CONTAINER=wgaccess-backend IMAGE=python:3.12-slim STATUS=Up 2 weeks PORTS=0.0.0.0:18080->8000/tcp CONTAINER=wgaccess-postgres IMAGE=postgres:16-alpine STATUS=Up 2 weeks (healthy) PORTS=127.0.0.1:15432->5432/tcp COMPOSE_SERVICE=postgres COMPOSE_SERVICE=backend COMPOSE_IMAGE=python:3.12-slim COMPOSE_IMAGE=postgres:16-alpine ===== BACKEND HEALTH ===== {"status":"ok","service":"wg-access-backend","environment":"dev"} BACKEND_HEALTH=PASS {"status":"ok","db":1} DB_HEALTH=PASS ===== OPENAPI ROUTES ===== OPENAPI_ROUTE=get,post /admin/invites OPENAPI_ROUTE=get /admin/jobs OPENAPI_ROUTE=post /admin/maintenance/expire-subscriptions OPENAPI_ROUTE=get /admin/peers OPENAPI_ROUTE=post /admin/peers/{peer_id}/disable OPENAPI_ROUTE=post /admin/subscriptions OPENAPI_ROUTE=post /admin/subscriptions/{subscription_id}/cancel OPENAPI_ROUTE=get /admin/users OPENAPI_ROUTE=get /admin/users/by-email/{email} OPENAPI_ROUTE=get /admin/users/{user_id} OPENAPI_ROUTE=get /agent/jobs OPENAPI_ROUTE=post /agent/jobs/{job_id}/complete OPENAPI_ROUTE=post /agent/jobs/{job_id}/fail OPENAPI_ROUTE=post /agent/jobs/{job_id}/start OPENAPI_ROUTE=get /agent/peers OPENAPI_ROUTE=post /dev/create-test-peer OPENAPI_ROUTE=get /health OPENAPI_ROUTE=get /health/db ===== SYSTEMD ===== UNIT=wg-access-agent.path ACTIVE=inactive ENABLED=disabled UNIT=wg-access-agent.service ACTIVE=inactive ENABLED=static UNIT=wg-access-agent.timer ACTIVE=inactive ENABLED=disabled UNIT=wg-access-reconcile.service ACTIVE=inactive ENABLED=static UNIT=wg-access-reconcile.timer ACTIVE=active ENABLED=enabled UNIT=wg-access-expire-subscriptions.service ACTIVE=inactive ENABLED=static UNIT=wg-access-expire-subscriptions.timer ACTIVE=active ENABLED=enabled UNIT=wg-access-trigger-watch.service ACTIVE=active ENABLED=enabled NEXT LEFT LAST PASSED UNIT ACTIVATES Sun 2026-08-02 10:15:37 UTC 34s left Sun 2026-08-02 10:10:36 UTC 4min 27s ago wg-access-expire-subscriptions.timer wg-access-expire-subscriptions.service Sun 2026-08-02 10:19:19 UTC 4min 16s left Sun 2026-08-02 10:14:11 UTC 51s ago wg-access-reconcile.timer wg-access-reconcile.service ===== SAFE ENVIRONMENT ===== ENVIRONMENT=dev WG_CLIENT_ENDPOINT=wg-studio.secret-studio.ru:51830 WG_CLIENT_ALLOWED_IPS=0.0.0.0/0 WG_CLIENT_DNS= WG_CLIENT_POOL_CIDR=10.253.0.0/16 WG_CLIENT_FIRST_IP=10.253.1.10 AGENT_API_BASE_URL= AGENT_REMOTE_HOST=10.71.100.1 AGENT_REMOTE_USER=root AGENT_REMOTE_WG_INTERFACE=wg_paid WG_SERVER_PUBLIC_KEY_PRESENT=true WG_SERVER_PUBLIC_KEY_SHA256=442e3c1e4ed1a3bb371b03bb16ed75158bba311f513c72fa67396ee6010ea343 AGENT_TOKEN_PRESENT=true APP_SECRET_PRESENT=true POSTGRES_PASSWORD_PRESENT=true AGENT_AGENT_TOKEN_PRESENT=true AGENT_REMOTE_SSH_KEY_PRESENT=true ===== DATABASE SCHEMA AND AGGREGATES ===== POSTGRES_CONTAINER=wgaccess-postgres POSTGRES_QUERY=PASS ===== LISTENERS AND FIREWALL ===== Netid State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess udp UNCONN 0 0 127.0.0.54:53 0.0.0.0:* users:(("systemd-resolve",pid=310,fd=19)) udp UNCONN 0 0 127.0.0.53%lo:53 0.0.0.0:* users:(("systemd-resolve",pid=310,fd=17)) udp UNCONN 0 0 0.0.0.0:5355 0.0.0.0:* users:(("systemd-resolve",pid=310,fd=11)) udp UNCONN 0 0 [::]:5355 [::]:* users:(("systemd-resolve",pid=310,fd=13)) tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=477,fd=3)) tcp LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:* users:(("systemd-resolve",pid=310,fd=18)) tcp LISTEN 0 4096 127.0.0.1:15432 0.0.0.0:* users:(("docker-proxy",pid=924,fd=8)) tcp LISTEN 0 4096 127.0.0.54:53 0.0.0.0:* users:(("systemd-resolve",pid=310,fd=20)) tcp LISTEN 0 4096 0.0.0.0:5355 0.0.0.0:* users:(("systemd-resolve",pid=310,fd=12)) tcp LISTEN 0 4096 0.0.0.0:18080 0.0.0.0:* users:(("docker-proxy",pid=936,fd=8)) tcp LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=477,fd=4)) tcp LISTEN 0 4096 [::]:5355 [::]:* users:(("systemd-resolve",pid=310,fd=14)) iifname != "br-0dd299da43cc" ip daddr 127.0.0.1 tcp dport 15432 counter packets 0 bytes 0 dnat to 172.18.0.2:5432 iifname != "br-0dd299da43cc" tcp dport 18080 counter packets 0 bytes 0 dnat to 172.18.0.3:8000 iifname != "br-0dd299da43cc" oifname "br-0dd299da43cc" ip daddr 172.18.0.3 tcp dport 8000 counter packets 0 bytes 0 accept iifname != "br-0dd299da43cc" oifname "br-0dd299da43cc" ip daddr 172.18.0.2 tcp dport 5432 counter packets 0 bytes 0 accept iifname != "lo" ip daddr 127.0.0.1 tcp dport 15432 counter packets 0 bytes 0 drop ===== BACKUP METADATA ===== BACKUP_FILE_COUNT=162 BACKUP_NEWEST_EPOCH=1784419201 BACKUP_NEWEST_SIZE=0 ===== HISTORICAL SELECTOR HELPERS ===== SELECTOR_HELPER_PRESENT=/usr/local/sbin/wg-access-agent-selector-apply.py SELECTOR_HELPER_PRESENT=/usr/local/sbin/wg-access-agent-selector-contract-dry-run.py SELECTOR_HELPER_PRESENT=/usr/local/sbin/wg-access-agent-selector-remote-plan.py SELECTOR_HELPER_PRESENT=/usr/local/sbin/wg-access-agent-job-selector-plan.py SELECTOR_HELPER_PRESENT=/usr/local/sbin/wg-access-slot-allocator-dry-run.py SELECTOR_HELPER_ACTIVE=false RESULT=PASS_R20QW_VM121_READONLY_AUDIT