#networking | Linus Tech Tips | Page 298

slate sonnet Mar 11, 2021, 5:28 PM

#

So what do I do with the tracert log?

tame carbon Mar 11, 2021, 5:28 PM

#

send it here

#

it gives us a view of the route that your data takes

slate sonnet Mar 11, 2021, 5:28 PM

#

Tracing route to one.one.one.one [1.1.1.1]
over a maximum of 30 hops:

1 64 ms 64 ms 63 ms 10.0.0.1
2 69 ms 64 ms 65 ms 45.8.229.1
3 69 ms 67 ms 66 ms GW-CloudFlare.retn.net [87.245.255.223]
4 66 ms 66 ms 66 ms one.one.one.one [1.1.1.1]

Trace complete.

untold elbow Mar 11, 2021, 5:28 PM

#

that looks good

tame carbon Mar 11, 2021, 5:28 PM

#

its using the tunnel.

#

@untold elbow what if one was to set AllowedIPs to 10.0.0.0/24

#

?

untold elbow Mar 11, 2021, 5:29 PM

#

try to ssh from putty to 10.0.0.1 with the tunnel up

#

@tame carbon he'd only get to 10.0.0.1

tame carbon Mar 11, 2021, 5:29 PM

#

that's the point, no?

untold elbow Mar 11, 2021, 5:29 PM

#

and a bunch of unused IPs

tame carbon Mar 11, 2021, 5:29 PM

#

all other traffic should go over another if

untold elbow Mar 11, 2021, 5:29 PM

#

oh if that's the point then yeah

tame carbon Mar 11, 2021, 5:30 PM

#

He only wants a NAT around his CG-NAT

slate sonnet Mar 11, 2021, 5:30 PM

#

untold elbow try to `ssh` from putty to 10.0.0.1 with the tunnel up

sshed

tame carbon Mar 11, 2021, 5:30 PM

#

through a public VPS

#

so he can host minecraft

#

His VPS host masquerades traffic from WAN through wireguard

#

WG is merely a LAN network to the client, it shouldnt be used as a gateway

untold elbow Mar 11, 2021, 5:30 PM

#

i think i missed the first part of this where you were talking about what the purpose of all this was lol

slate sonnet Mar 11, 2021, 5:31 PM

#

Well basically I want to only route minecraft server traffic through the vps

#

That's it

#

If possible

tame carbon Mar 11, 2021, 5:31 PM

#

@slate sonnet change AllowedIPs in the client config

#

to say 10.0.0.0/24 instead of 0.0.0.0/0

#

then restart tunnel

slate sonnet Mar 11, 2021, 5:31 PM

#

Done

tame carbon Mar 11, 2021, 5:31 PM

#

see if you have internet, if yes: run another traceroute

#

that should now be using your regular network

#

instead of WG

slate sonnet Mar 11, 2021, 5:32 PM

#

First one is router gateway

tame carbon Mar 11, 2021, 5:32 PM

#

so its going through 192.168.foo.bar?

slate sonnet Mar 11, 2021, 5:33 PM

#

yeah

tame carbon Mar 11, 2021, 5:33 PM

#

Nice.

slate sonnet Mar 11, 2021, 5:33 PM

#

That's the first route

tame carbon Mar 11, 2021, 5:33 PM

#

ok then: ping 10.0.0.1

slate sonnet Mar 11, 2021, 5:33 PM

#

64ms

tame carbon Mar 11, 2021, 5:33 PM

#

Ok. we're set.

slate sonnet Mar 11, 2021, 5:33 PM

#

wait

#

well

#

yeah

tame carbon Mar 11, 2021, 5:33 PM

#

You now have a tunnel endpoint from your VPS to your windows machine

slate sonnet Mar 11, 2021, 5:33 PM

#

Okay

tame carbon Mar 11, 2021, 5:33 PM

#

so at this point..

#

start a minecraft server :D

untold elbow Mar 11, 2021, 5:33 PM

#

coolest part of WG setup is the qr code stuff you can do

#

slate sonnet Mar 11, 2021, 5:34 PM

#

So in the server ip I post 10.0.0.1?

#

In the minecraft config

tame carbon Mar 11, 2021, 5:34 PM

#

@slate sonnet no, leave the mincraft config ip= empty

untold elbow Mar 11, 2021, 5:34 PM

#

with qrencode you can generate that qr code and scan it with your phone client to add the config

slate sonnet Mar 11, 2021, 5:34 PM

#

Okay

tame carbon Mar 11, 2021, 5:34 PM

#

@slate sonnet if you leave it empty, the minecraft server will be active on all interfaces

slate sonnet Mar 11, 2021, 5:34 PM

#

And people can connect to my server with my vps ip

tame carbon Mar 11, 2021, 5:34 PM

#

including the 10.0.0.1 interface

#

then, other users can use your public IP from the VPS

#

to connect

slate sonnet Mar 11, 2021, 5:35 PM

#

Okay

tame carbon Mar 11, 2021, 5:35 PM

#

🤞

slate sonnet Mar 11, 2021, 5:35 PM

#

gotta get a friend lmao

#

1 sec

tame carbon Mar 11, 2021, 5:35 PM

#

I have mc

#

what version?

untold elbow Mar 11, 2021, 5:35 PM

#

he said a friend

tame carbon Mar 11, 2021, 5:35 PM

#

to test

untold elbow Mar 11, 2021, 5:35 PM

#

lol

slate sonnet Mar 11, 2021, 5:35 PM

#

tame carbon what version?

1.16.4

tame carbon Mar 11, 2021, 5:36 PM

#

https://i.imgur.com/7GhLSdp.png

Imgur

#

starting...

#

is it up?

slate sonnet Mar 11, 2021, 5:37 PM

#

Starting

tame carbon Mar 11, 2021, 5:37 PM

#

I hope this doesnt conflict with my network lol. I have bunch of russian IP prefixes nullrouted on my network

slate sonnet Mar 11, 2021, 5:37 PM

#

1 sec

slate sonnet Mar 11, 2021, 5:37 PM

#

tame carbon I hope this doesnt conflict with my network lol. I have bunch of russian IP pref...

what does that mean?

#

Server up

untold elbow Mar 11, 2021, 5:37 PM

#

he doesnt like russians

tame carbon Mar 11, 2021, 5:37 PM

#

^

slate sonnet Mar 11, 2021, 5:37 PM

#

Understandable

#

Same here tbh

tame carbon Mar 11, 2021, 5:37 PM

#

its mostly hackers and such

#

bunch of ssh flooding I dont need

#

same with china

#

its not connecting...

#

mhh

slate sonnet Mar 11, 2021, 5:38 PM

#

Oh wait

#

I forgot to change the ip

#

1 sec

tame carbon Mar 11, 2021, 5:38 PM

#

I can reach the server though

#

so ping works

slate sonnet Mar 11, 2021, 5:38 PM

#

starting again

untold elbow Mar 11, 2021, 5:38 PM

#

you have stuff in the wg config to forward the minecraft ports to your windows system?

#

i wasnt here for that part

tame carbon Mar 11, 2021, 5:39 PM

#

@untold elbow it shouldnt need to?

slate sonnet Mar 11, 2021, 5:39 PM

#

Try connecting

tame carbon Mar 11, 2021, 5:39 PM

#

@untold elbow those configs on that tutorial reference to other computers on his /24 LAN

#

Mh. not responding no

slate sonnet Mar 11, 2021, 5:39 PM

#

Huh

#

I have the ip set to nothing as you said

tame carbon Mar 11, 2021, 5:39 PM

#

it shouldnt have to be filled out

#

but for sake of trying

#

put 10.0.0.2 in there

slate sonnet Mar 11, 2021, 5:40 PM

#

starting again

#

Done

tame carbon Mar 11, 2021, 5:41 PM

#

mh. still nothing

slate sonnet Mar 11, 2021, 5:41 PM

#

Hmm

tame carbon Mar 11, 2021, 5:42 PM

#

@untold elbow does wireguard installation require a reboot of the host at all?

untold elbow Mar 11, 2021, 5:42 PM

#

nope

tame carbon Mar 11, 2021, 5:43 PM

#

I'm trying telnet on his 25565 port

untold elbow Mar 11, 2021, 5:43 PM

#

i think you might need another iptables statement to forward minecraft port traffic

tame carbon Mar 11, 2021, 5:43 PM

#

not even establishing a connection

untold elbow Mar 11, 2021, 5:43 PM

#

iptables -t nat -A PREROUTING -p udp -i eth0 '!' --dport 25565 -j DNAT --to-destination 10.0.0.2;

#

if i had to guess

tame carbon Mar 11, 2021, 5:43 PM

#

mp

#

no

#

@untold elbow that ! inverts

untold elbow Mar 11, 2021, 5:43 PM

#

oh i dont know iptables either apparently lol

tame carbon Mar 11, 2021, 5:43 PM

#

it was ! 22 meaning all ports except 22

untold elbow Mar 11, 2021, 5:43 PM

#

oh hm

tame carbon Mar 11, 2021, 5:44 PM

#

and minecraft is tcp

#

not udp

untold elbow Mar 11, 2021, 5:44 PM

#

if i had to guess, it's looking at the VPS for a tcp 25565 service and not finding one

#

and that request has to somehow be forwarded through the tunnel

tame carbon Mar 11, 2021, 5:44 PM

#

@slate sonnet go back to the config file on your wg host.

#

double check the iptable rules

lean pebble Mar 11, 2021, 5:45 PM

#

tame carbon and minecraft is tcp

True, but bedrock version is udp

tame carbon Mar 11, 2021, 5:46 PM

#

@slate sonnet on your wg host you can verify the currently running iptable config with: iptables -S

slate sonnet Mar 11, 2021, 5:46 PM

#

tame carbon Mar 11, 2021, 5:47 PM

#

that doesnt seem right

#

there's no NAT entry at all

#

@slate sonnet iptables -t nat -L

#

@untold elbow only reason I know a little about iptables, has to do with mikrotik, since their configurations are using iptables internally

untold elbow Mar 11, 2021, 5:49 PM

#

ahh

tame carbon Mar 11, 2021, 5:49 PM

#

that's where the ! comes from

#

xD

untold elbow Mar 11, 2021, 5:49 PM

#

im not really a network guy so i know very little about it

#

know only slightly more than this guy https://www.youtube.com/watch?v=SXmv8quf_xM

YouTube

NextGenHacker101

How to view someones IP address and connection speed!

Have fun with this you guys!!!
"tracert "website"

▶ Play video

slate sonnet Mar 11, 2021, 5:49 PM

#

tame carbon Mar 11, 2021, 5:49 PM

#

@untold elbow https://i.imgur.com/zTYYJVR.png

Imgur

untold elbow Mar 11, 2021, 5:50 PM

#

fancy

#

i run pfsense... need to get some mikrotik gear

#

unifi switches are getting kind of crappy

tame carbon Mar 11, 2021, 5:51 PM

#

@slate sonnet okay.. so far that looks to be alright

#

wait no

#

source is not even set.

#

@slate sonnet can you open your wg config once more. on the server

slate sonnet Mar 11, 2021, 5:53 PM

#

command? I really need to write it on my forehead lmao

untold elbow Mar 11, 2021, 5:53 PM

#

nano /etc/wireguard/wg0.conf

slate sonnet Mar 11, 2021, 5:53 PM

#

tame carbon <@!289451427011756032> can you open your wg config once more. on the server

And send it here?

untold elbow Mar 11, 2021, 5:53 PM

#

leave out your private key

slate sonnet Mar 11, 2021, 5:53 PM

#

untold elbow leave out your private key

Yes

untold elbow Mar 11, 2021, 5:54 PM

#

mostly i think crystal wants the postup and postdown lines

tame carbon Mar 11, 2021, 5:54 PM

#

correct

#

@untold elbow I am unsure, but I think his host needs a restart

untold elbow Mar 11, 2021, 5:54 PM

#

just as a cross-reference, here are the post-up and post-down lines from my wg server:

PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o ens18 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o ens18 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o ens18 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o ens18 -j MASQUERADE

tame carbon Mar 11, 2021, 5:54 PM

#

or at least, push a kernel config to /proc/sys

untold elbow Mar 11, 2021, 5:54 PM

#

it's worth a shot

slate sonnet Mar 11, 2021, 5:54 PM

#

tame carbon Mar 11, 2021, 5:54 PM

#

because by default linux distros dont do v4 forwarding..

untold elbow Mar 11, 2021, 5:55 PM

#

i think if it's passing traffic from his windows client out to the internet, forwarding is working though

#

but i've never set it up going the other way

tame carbon Mar 11, 2021, 5:55 PM

#

@untold elbow see the snat rule at the end on the first postup ?

#

that's for client -> server -> internet

#

source-nat

#

but we're port forwarding here, so we use DNAT

untold elbow Mar 11, 2021, 5:56 PM

#

ahh ok

slate sonnet Mar 11, 2021, 5:56 PM

#

So what should I do?

tame carbon Mar 11, 2021, 5:56 PM

#

I'm thinking

slate sonnet Mar 11, 2021, 5:56 PM

#

Oh, okay

untold elbow Mar 11, 2021, 5:57 PM

#

reboot can't hurt in the meantime

tame carbon Mar 11, 2021, 5:57 PM

#

yeah, reboot your server

slate sonnet Mar 11, 2021, 5:57 PM

#

I guess

tame carbon Mar 11, 2021, 5:57 PM

#

might be worth a shot

slate sonnet Mar 11, 2021, 5:57 PM

#

rebooting

tame carbon Mar 11, 2021, 5:57 PM

#

@untold elbow I'm looking at the sources provided by the tutorial

#

https://i.imgur.com/ZEJeUBM.png

Imgur

#

which points to some information on reddit

#

these guys write some additional settings to the kernel

untold elbow Mar 11, 2021, 5:57 PM

#

if you didn't run sysctl enable on the wg service, you'll need to manually start it again

tame carbon Mar 11, 2021, 5:58 PM

#

note the first two postup

untold elbow Mar 11, 2021, 5:58 PM

#

i believe ipv4 forward should already be 1, but not the arp proxy

#

but this is way over my head

tame carbon Mar 11, 2021, 5:58 PM

#

that proxy arp is not nessesary

#

that's only if you wish to know about the hosts on the other side of the tunnel

slate sonnet Mar 11, 2021, 5:59 PM

#

untold elbow if you didn't run `sysctl enable` on the wg service, you'll need to manually sta...

Did that

tame carbon Mar 11, 2021, 5:59 PM

#

@untold elbow I have proxy-arp running on my VPN bridge on my mikrotik

#

so that my VPN clients can interact with other devices on the LAN

#

but its tricky

#

and can lead to arppoisoning

#

if poorly configured

untold elbow Mar 11, 2021, 5:59 PM

#

from here: https://github.com/mochman/Bypass_CGNAT isn't step 1b the same as that first postup rule?

GitHub

mochman/Bypass_CGNAT

Wireguard setup to bypass CGNAT with a VPS. Contribute to mochman/Bypass_CGNAT development by creating an account on GitHub.

tame carbon Mar 11, 2021, 6:00 PM

#

/etc/sysctl.conf is read on startup

untold elbow Mar 11, 2021, 6:00 PM

#

sysctl -p after it though

#

still worth a reboot just to try

slate sonnet Mar 11, 2021, 6:01 PM

#

I rebooted

#

net.ipv4.ip_forward = 1

#

after sysctl -p

tame carbon Mar 11, 2021, 6:02 PM

#

reconnect your tunnel

slate sonnet Mar 11, 2021, 6:02 PM

#

So like disconnect and reconnect it?

tame carbon Mar 11, 2021, 6:02 PM

#

Just connect.

slate sonnet Mar 11, 2021, 6:03 PM

#

Done I think

#

On client side, right?

untold elbow Mar 11, 2021, 6:03 PM

#

yeah

tame carbon Mar 11, 2021, 6:04 PM

#

the only difference in the setup we have, and the tutorial

#

is that the tutorial uses NAT a 2nd time

#

on the client, to then pass traffic to local devices

slate sonnet Mar 11, 2021, 6:05 PM

#

Well in the tutorial on the github page, there are postup and postdown lines

untold elbow Mar 11, 2021, 6:05 PM

#

what's the server hostname and MC port?

slate sonnet Mar 11, 2021, 6:05 PM

#

And in them I'm assuming that some of them port forward

#

Why can't I do that with port 25565?

tame carbon Mar 11, 2021, 6:05 PM

#

@slate sonnet currently, traffic would arrive at 10.0.0.2:25565

slate sonnet Mar 11, 2021, 6:06 PM

#

untold elbow what's the server hostname and MC port?

Dm

tame carbon Mar 11, 2021, 6:06 PM

#

those postup rules on the client

#

only do this: https://i.imgur.com/EpXY47J.png

Imgur

untold elbow Mar 11, 2021, 6:06 PM

#

do you have the MC server up and the tunnel running?

slate sonnet Mar 11, 2021, 6:06 PM

#

Starting server

tame carbon Mar 11, 2021, 6:06 PM

#

https://xkcd.com/2259/

xkcd: Networking Problems

slate sonnet Mar 11, 2021, 6:06 PM

#

Started

slate sonnet Mar 11, 2021, 6:07 PM

#

tame carbon https://xkcd.com/2259/

Lmao

untold elbow Mar 11, 2021, 6:07 PM

#

Trying 194.87.80.92...
^C
root@wireguard:/etc/wireguard# telnet 194.87.80.92 22
Trying 194.87.80.92...
Connected to 194.87.80.92.
Escape character is '^]'.
SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.2
^C
Connection closed by foreign host.```

#

it doesn't see a service on 25565

tame carbon Mar 11, 2021, 6:08 PM

#

@untold elbow it would interest me

untold elbow Mar 11, 2021, 6:08 PM

#

but i guess we knew that

tame carbon Mar 11, 2021, 6:08 PM

#

He should run telnet on his server

#

to 10.0.0.2

untold elbow Mar 11, 2021, 6:08 PM

#

yeah

tame carbon Mar 11, 2021, 6:08 PM

#

see if windows even properly exposes it

untold elbow Mar 11, 2021, 6:08 PM

#

telnet 10.0.0.2 25565

tame carbon Mar 11, 2021, 6:08 PM

#

@slate sonnet ^

#

run that on your server

slate sonnet Mar 11, 2021, 6:09 PM

#

Trying for a long time

untold elbow Mar 11, 2021, 6:09 PM

#

doesn't see the service on that side either

slate sonnet Mar 11, 2021, 6:09 PM

#

Did 10.0.0.2

untold elbow Mar 11, 2021, 6:09 PM

#

so that's a clue

slate sonnet Mar 11, 2021, 6:09 PM

#

Without 25565

tame carbon Mar 11, 2021, 6:09 PM

#

yeah the port needs to be on there

#

telnet opens a tcp connection to that IP & port

slate sonnet Mar 11, 2021, 6:09 PM

#

Oh

tame carbon Mar 11, 2021, 6:09 PM

#

and if there's a server on other side, we'll know

slate sonnet Mar 11, 2021, 6:09 PM

#

Said connected

tame carbon Mar 11, 2021, 6:10 PM

#

so you have a session on port 25565?

#

cool, so at least that works

untold elbow Mar 11, 2021, 6:10 PM

#

wait telnet 10.0.0.2 25565 says connected?

slate sonnet Mar 11, 2021, 6:10 PM

#

Oh wait

#

Idk

#

untold elbow Mar 11, 2021, 6:10 PM

#

that's basically checking if it can see any service running on that port

#

ok cool

#

thats a good thing, it sees the MC service

tame carbon Mar 11, 2021, 6:11 PM

#

The VPS can see the minecraft server.

untold elbow Mar 11, 2021, 6:11 PM

#

your server just isn't forwarding it to the windows system

slate sonnet Mar 11, 2021, 6:11 PM

#

Huh

tame carbon Mar 11, 2021, 6:11 PM

#

We're triangulating the problem right now

#

VPS -> Minecraft works

#

its just Public IP -> VPS that is finecky

untold elbow Mar 11, 2021, 6:13 PM

#

def something with those cryptic postup iptables commands

tame carbon Mar 11, 2021, 6:13 PM

#

iptables -t nat -A PREROUTING -p tcp -i eth0 '!' --dport 22 -j DNAT --to-destination 10.0.0.2;
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 1.2.3.4

#

those are the two commands on the first line

#

and it basically just says, for any traffic incoming on -i eth0

#

and any destination port that isnt 22

#

we port forward to destination <ip>

untold elbow Mar 11, 2021, 6:15 PM

#

hm yeah that should work

slate sonnet Mar 11, 2021, 6:16 PM

#

I have it the other way around

untold elbow Mar 11, 2021, 6:16 PM

#

how do you mean

slate sonnet Mar 11, 2021, 6:16 PM

#

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 1.2.3.4
iptables -t nat -A PREROUTING -p tcp -i eth0 '!' --dport 22 -j DNAT --to-destination 10.0.0.2;

untold elbow Mar 11, 2021, 6:16 PM

#

oh thats fine i think

slate sonnet Mar 11, 2021, 6:16 PM

#

Or does it matter?

tame carbon Mar 11, 2021, 6:17 PM

#

@slate sonnet does your config say 1.2.3.4 ????

slate sonnet Mar 11, 2021, 6:17 PM

#

No

untold elbow Mar 11, 2021, 6:17 PM

#

lmao

#

well thats good

slate sonnet Mar 11, 2021, 6:17 PM

#

Wait

#

In my config it says

#

AllowedIPs = 10.0.0.2/32

#

But on my client its /24

untold elbow Mar 11, 2021, 6:18 PM

#

yeah that's correct

slate sonnet Mar 11, 2021, 6:18 PM

#

Everywhere

tame carbon Mar 11, 2021, 6:18 PM

#

that's correct.

slate sonnet Mar 11, 2021, 6:18 PM

#

Okay

tame carbon Mar 11, 2021, 6:18 PM

#

@untold elbow you think it might be worth removing the eth0 filter, and doing it by IP instead?

#

--dst 194.87.80.92 --dport 25565

#

instead of -i eth0

#

and we write our own iptable rule

untold elbow Mar 11, 2021, 6:19 PM

#

hmmm not sure, might be worth a try. or adding -j LOG and checking kern.log while people are connecting

slate sonnet Mar 11, 2021, 6:20 PM

#

Wait

#

What does "!" mean again?

tame carbon Mar 11, 2021, 6:20 PM

#

not

#

! 22 not 22

slate sonnet Mar 11, 2021, 6:20 PM

#

Okay

tame carbon Mar 11, 2021, 6:20 PM

#

Hold on, writing a oneliner for iptables

slate sonnet Mar 11, 2021, 6:22 PM

#

Should I harden my vps in the mean time?

#

Or not yet

tame carbon Mar 11, 2021, 6:22 PM

#

nah, lets not add any more barriers

slate sonnet Mar 11, 2021, 6:22 PM

#

Okay

untold elbow Mar 11, 2021, 6:23 PM

#

iptables -t nat -A PREROUTING -j LOG && iptables -t nat -A POSTROUTING -j LOG

#

and then tail -f /var/log/kern.log

#

@tame carbon think that's worth looking at?

tame carbon Mar 11, 2021, 6:23 PM

#

tcpdump lol

#

Perhaps

#

@untold elbow I came up with: iptables -t nat -A PREROUTING -p tcp --dst 194.87.80.92 --dport 25565 -j DNAT --to-destination 10.0.0.2;

#

as a custom rule, which only port forwards what we want

untold elbow Mar 11, 2021, 6:24 PM

#

hmmmm would that work for the MC client's return traffic?

tame carbon Mar 11, 2021, 6:24 PM

#

@untold elbow NAT does connection tracking

#

pretty sure it wont matter

untold elbow Mar 11, 2021, 6:24 PM

#

ok, that might work then

tame carbon Mar 11, 2021, 6:24 PM

#

SNAT is only for outgoing connections

slate sonnet Mar 11, 2021, 6:24 PM

#

Don't I have to have both tcp and udp?

untold elbow Mar 11, 2021, 6:25 PM

#

nah just tcp

tame carbon Mar 11, 2021, 6:25 PM

#

nah minecraft is just TCP

slate sonnet Mar 11, 2021, 6:25 PM

#

According to minecraft server tutorials lmao

#

They all say to port forward both

untold elbow Mar 11, 2021, 6:25 PM

#

people do both tcp and udp when they're not sure which it uses

#

shotgun approach

slate sonnet Mar 11, 2021, 6:25 PM

#

Got it

tame carbon Mar 11, 2021, 6:25 PM

#

in essence, that's all you need

hollow marlin Mar 11, 2021, 6:25 PM

#

Better take your IP out of there lol

tame carbon Mar 11, 2021, 6:26 PM

#

@hollow marlin its a publicly routed one

#

doesnt trace back to my WAN

#

so you can DoS me

#

wont have an effect

#

@hollow marlin perhaps you can smarten us up

#

we've set up a WG tunnel

#

trying to NAT traffic through it

hollow marlin Mar 11, 2021, 6:26 PM

#

Ewww

tame carbon Mar 11, 2021, 6:27 PM

#

@hollow marlin he's behind a CG-NAT

untold elbow Mar 11, 2021, 6:27 PM

#

its prob not working because you leaked your ip in discord

slate sonnet Mar 11, 2021, 6:27 PM

#

Me

tame carbon Mar 11, 2021, 6:27 PM

#

And we're using this as a workaround

slate sonnet Mar 11, 2021, 6:27 PM

#

untold elbow its prob not working because you leaked your ip in discord

Me?

hollow marlin Mar 11, 2021, 6:27 PM

#

I assume using a VPS for WG?

untold elbow Mar 11, 2021, 6:27 PM

#

no im joking

tame carbon Mar 11, 2021, 6:27 PM

#

Ye

slate sonnet Mar 11, 2021, 6:27 PM

#

hollow marlin I assume using a VPS for WG?

Yes

untold elbow Mar 11, 2021, 6:27 PM

#

ok so do we want to try my think or crystal's thing first

#

my thing*

#

do crystal's thing

tame carbon Mar 11, 2021, 6:28 PM

#

friggen network debugging. love it 🔫

hollow marlin Mar 11, 2021, 6:28 PM

#

What point are you guys at? I assume WG tunnel is up and connected so far?

untold elbow Mar 11, 2021, 6:28 PM

#

if this doesn't end up working, dynamic dns might be an easier route

tame carbon Mar 11, 2021, 6:28 PM

#

WG works

#

WG host can see a tcp service on WG client

#

its just the public ip NAT that is not functional

untold elbow Mar 11, 2021, 6:29 PM

#

wg host passes wg client traffic too

tame carbon Mar 11, 2021, 6:29 PM

#

@hollow marlin

#

10.0.0.1 is the VPS, and 10.0.0.2 is the client

hollow marlin Mar 11, 2021, 6:30 PM

#

So basically Home --> WG --> VPS --x--> NAT --> internet?

untold elbow Mar 11, 2021, 6:30 PM

#

other way around

#

well sort of

tame carbon Mar 11, 2021, 6:30 PM

#

@hollow marlin https://github.com/mochman/Bypass_CGNAT/blob/main/Basic Topology.png?raw=true

#

https://github.com/mochman/Bypass_CGNAT

GitHub

mochman/Bypass_CGNAT

Wireguard setup to bypass CGNAT with a VPS. Contribute to mochman/Bypass_CGNAT development by creating an account on GitHub.

#

@hollow marlin his outgoing traffic should still be through his default gateway.

untold elbow Mar 11, 2021, 6:31 PM

#

forward tcp port 25565 traffic from internet to VPS through wg tunnel to home system

tame carbon Mar 11, 2021, 6:31 PM

#

incoming traffic on his VPS should be NATed through WG

#

[Interface]
PrivateKey = SHOULD_ALREADY_BE_FILLED_OUT
ListenPort = 55107
Address = 10.0.0.1/24

PostUp = iptables -t nat -A PREROUTING -p tcp -i eth0 '!' --dport 22 -j DNAT --to-destination 10.0.0.2; iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 1.2.3.4
PostUp = iptables -t nat -A PREROUTING -p udp -i eth0 '!' --dport 55107 -j DNAT --to-destination 10.0.0.2;

PostDown = iptables -t nat -D PREROUTING -p tcp -i eth0 '!' --dport 22 -j DNAT --to-destination 10.0.0.2; iptables -t nat -D POSTROUTING -o eth0 -j SNAT --to-source 1.2.3.4
PostDown = iptables -t nat -D PREROUTING -p udp -i eth0 '!' --dport 55107 -j DNAT --to-destination 10.0.0.2;

[Peer]
PublicKey = 
AllowedIPs = 10.0.0.2/32

#

this is the server config, as it stands

#

And I'm suspecting there's something wrong with those iptable rules

hollow marlin Mar 11, 2021, 6:33 PM

#

Oh boy, getting into IPtables

dense wolf Mar 11, 2021, 6:33 PM

#

I have a question do you need any kind of portforwarding for nginx server setup??

hollow marlin Mar 11, 2021, 6:33 PM

#

So first thing is WG is L2 to the VPS, is there another subnet that was created to use that VPS? You are going to need routing here

tame carbon Mar 11, 2021, 6:34 PM

#

10.0.0.0/24

untold elbow Mar 11, 2021, 6:35 PM

#

wg is l3

#

not that it matters

untold elbow Mar 11, 2021, 6:36 PM

#

dense wolf I have a question do you need any kind of portforwarding for nginx server setup?...

yes, you'll need to forward http/https ports if you don't have them exposed to the internet on your web server

hollow marlin Mar 11, 2021, 6:37 PM

#

I thought it was L2, yeah looks to be L3. Even better. Never personally worked with it

dense wolf Mar 11, 2021, 6:37 PM

#

untold elbow yes, you'll need to forward http/https ports if you don't have them exposed to t...

does it need to be specifically http or any open port that I can configure

hollow marlin Mar 11, 2021, 6:38 PM

#

@tame carbon where is the sticking point at the moment? Just dying at the src NAT rules?

untold elbow Mar 11, 2021, 6:38 PM

#

dense wolf does it need to be specifically http or any open port that I can configure

if you don't want to manually specify the port after your server address, yes. if you're okay doing <server address>:<non-standard port>, you can use any free port

dense wolf Mar 11, 2021, 6:38 PM

#

untold elbow if you don't want to manually specify the port after your server address, yes. i...

ok thanks

tame carbon Mar 11, 2021, 6:39 PM

#

@hollow marlin He has a minecraft server listening on his windows machine (port 25565)
On his VPS, he can use telnet to establish a connection to this windows machine

#

But the iptable rules that are ment to DNAT the traffic through wg from his public interface, do not work.

dense wolf Mar 11, 2021, 6:39 PM

#

tame carbon <@!462711605063450628> He has a minecraft server listening on his windows machin...

are you guys trying to host a minecraft server

slate sonnet Mar 11, 2021, 6:39 PM

#

I am

#

I have CGNAT

dense wolf Mar 11, 2021, 6:40 PM

#

you don't need to host a full vps for palying minecraft

untold elbow Mar 11, 2021, 6:40 PM

#

oh boy

dense wolf Mar 11, 2021, 6:40 PM

#

you can simply use ngrok.exe

untold elbow Mar 11, 2021, 6:40 PM

#

that isn't the issue @dense wolf

dense wolf Mar 11, 2021, 6:40 PM

#

oo

tame carbon Mar 11, 2021, 6:40 PM

#

@hollow marlin the rules set out by the tutorial (and the block of text I posted above) is what he's currently using.
It basically is ment to DNAT all traffic except ssh and wireguard

#

@dense wolf he's behind a CG-NAT, a shared public IP, and thus cannot port forward.

#

using a cheap ass VPS to route his traffic around

untold elbow Mar 11, 2021, 6:42 PM

#

looking at iptables docs more, i'd try that dnat rule crystal made

#

and maybe even make it more general

#

well, maybe not more general

tame carbon Mar 11, 2021, 6:42 PM

#

@untold elbow I am unsure if that input on eth0 is gonna work like that

#

might be better to do it on IP layer

untold elbow Mar 11, 2021, 6:43 PM

#

which input? the one from the github? or the one you made?

tame carbon Mar 11, 2021, 6:43 PM

#

-i eth0

#

instead of --dst <ip>

untold elbow Mar 11, 2021, 6:43 PM

#

oh

#

worth a shot

#

i gotta step away for a bit... good luck and god speed

slate sonnet Mar 11, 2021, 6:44 PM

#

We'll definitely need it

untold elbow Mar 11, 2021, 6:44 PM

#

if you hit a wall... look into dynamic dns instead

tame carbon Mar 11, 2021, 6:44 PM

#

at this point, I am at a loss. Those are the last suggestions I have that we could try

#

I could try consult the 420-gods, but that doesnt always work

slate sonnet Mar 11, 2021, 6:44 PM

#

@tame carbon so what should I try?

tame carbon Mar 11, 2021, 6:45 PM

#

@slate sonnet It is definetly an issue with iptables

#

but iptables is dark magic

dense wolf Mar 11, 2021, 6:45 PM

#

tame carbon using a cheap ass VPS to route his traffic around

ngrok does the same think but its simpliar

tame carbon Mar 11, 2021, 6:45 PM

#

so I am hoping @hollow marlin has some enlightening perspective on this

hollow marlin Mar 11, 2021, 6:45 PM

#

Just looking through some of the IPtables syntax

slate sonnet Mar 11, 2021, 6:47 PM

#

@tame carbon so can you explain what the postup and postdown lines do in the github page?

tame carbon Mar 11, 2021, 6:47 PM

#

@slate sonnet those are commands it will run when it connects and disconnects

#

PostUp is Post (after) it goes up

#

iptables controls the network stack on linux

#

we basically add a rule, to port forward all your traffic

#

but there's something awry.. not working properly..

slate sonnet Mar 11, 2021, 6:49 PM

#

Okay, but the lines pretty much say something along the lines of
"when connected, route this port to this ip, etc etc"?

hollow marlin Mar 11, 2021, 6:49 PM

#

Everything looks good, but I would assume you need a forwarding chain as well right?

tame carbon Mar 11, 2021, 6:49 PM

#

that's what it is ment to do

#

@hollow marlin elaborate?

#

@hollow marlin https://github.com/mochman/Bypass_CGNAT#1c-installing-wireguard

GitHub

mochman/Bypass_CGNAT

Wireguard setup to bypass CGNAT with a VPS. Contribute to mochman/Bypass_CGNAT development by creating an account on GitHub.

#

Really, this is what we're doing

slate sonnet Mar 11, 2021, 6:50 PM

#

Well if that works, can't I just copy and paste with port 25565?

tame carbon Mar 11, 2021, 6:50 PM

#

and either this doc is wrong

#

@slate sonnet might try to remove the existing postup rules in there, and replace it with the one I suggested.

#

iptables -t nat -A PREROUTING -p tcp --dst 194.87.80.92 --dport 25565 -j DNAT --to-destination 10.0.0.2;

#

make sure you add the same rule to the PostDown as well

#

replacing the -A with -D

#

-D = delete

slate sonnet Mar 11, 2021, 6:51 PM

#

Just add that to the bottom of the postup and postdown lists?

tame carbon Mar 11, 2021, 6:51 PM

#

remove the existing ones, and put a new one in

peak cloak Mar 11, 2021, 6:51 PM

#

dense wolf ngrok does the same think but its simpliar

that's centerlized

slate sonnet Mar 11, 2021, 6:51 PM

#

So completely remove everything?

#

That's postup and postdown

tame carbon Mar 11, 2021, 6:52 PM

#

@slate sonnet remove the postup and postdown rules

lean pebble Mar 11, 2021, 6:52 PM

#

I guess you can just host mc server on vps instead tunneling

tame carbon Mar 11, 2021, 6:52 PM

#

and add a new PostUp =

#

with that ip table rule

#

@lean pebble its a $2 vps

slate sonnet Mar 11, 2021, 6:52 PM

#

Will I still have ssh?

tame carbon Mar 11, 2021, 6:52 PM

#

@slate sonnet that rule doesnt forward all ports, only 25565.

lean pebble Mar 11, 2021, 6:52 PM

#

tame carbon <@!109801863771074560> its a $2 vps

So openvpn

tame carbon Mar 11, 2021, 6:52 PM

#

@lean pebble wireguard.

slate sonnet Mar 11, 2021, 6:52 PM

#

lean pebble I guess you can just host mc server on vps instead tunneling

I can host on my pc, literally no reason to get a vps just for that

tame carbon Mar 11, 2021, 6:52 PM

#

But the VPN isnt the issue

peak cloak Mar 11, 2021, 6:52 PM

#

dense wolf ngrok does the same think but its simpliar

also a good learning experience

tame carbon Mar 11, 2021, 6:53 PM

#

the VPN works. its not the issue

#

its just the iptable settings that are applied by the VPN, that are incorrect

lean pebble Mar 11, 2021, 6:54 PM

#

tame carbon its just the iptable settings that are applied by the VPN, that are incorrect

He can use wiregaurd on his network while having cgnat ? 🤔

tame carbon Mar 11, 2021, 6:54 PM

#

@lean pebble yes. because the wg server is on his vps

#

client dials out to the vps

slate sonnet Mar 11, 2021, 6:54 PM

#

Like this?

tame carbon Mar 11, 2021, 6:54 PM

#

and we use his VPS IP as a public endpoint

lean pebble Mar 11, 2021, 6:54 PM

#

He don't need dedicated IP on his side ?

peak cloak Mar 11, 2021, 6:55 PM

#

lean pebble He don't need dedicated IP on his side ?

no

tame carbon Mar 11, 2021, 6:55 PM

#

@slate sonnet yuh.

lean pebble Mar 11, 2021, 6:55 PM

#

Oh ok good to know

#

Never used wg

peak cloak Mar 11, 2021, 6:55 PM

#

lean pebble Never used wg

it's a vpn just need a public IP on one side

slate sonnet Mar 11, 2021, 6:55 PM

#

How to restart wg?

tame carbon Mar 11, 2021, 6:55 PM

#

@slate sonnet systemctl

#

@slate sonnet press arrow key up

#

until you find the command

lean pebble Mar 11, 2021, 6:56 PM

#

peak cloak it's a vpn just need a public IP on one side

Openvpn is vpn to and he can use it to connect to his server to I think.

tame carbon Mar 11, 2021, 6:56 PM

#

wireguard is easier to setup :P

lean pebble Mar 11, 2021, 6:56 PM

#

That's for sure

slate sonnet Mar 11, 2021, 6:56 PM

#

done

lean pebble Mar 11, 2021, 6:56 PM

#

Everything is easier than openvpn

#

😆

tame carbon Mar 11, 2021, 6:56 PM

#

@slate sonnet reconnect with your windows client

peak cloak Mar 11, 2021, 6:56 PM

#

lean pebble Openvpn is vpn to and he can use it to connect to his server to I think.

wireguard is more resource efficent

lean pebble Mar 11, 2021, 6:57 PM

#

My openvpn working on my pfsense in cloud

slate sonnet Mar 11, 2021, 6:57 PM

#

tame carbon <@!289451427011756032> reconnect with your windows client

Done

tame carbon Mar 11, 2021, 6:57 PM

#

@slate sonnet ok, as a sanity check. Can you do the telnet again on your server

#

I want to make sure we didnt just break something else

slate sonnet Mar 11, 2021, 6:57 PM

#

just telnet?

lean pebble Mar 11, 2021, 6:57 PM

#

peak cloak wireguard is more resource efficent

Never had resource issues with it

tame carbon Mar 11, 2021, 6:57 PM

#

the whole command

#

@slate sonnet just arrow key up, its still in your history :)

#

telnet 10.0.0.2 25565

#

If we can figure out what we did wrong, I will fork this tutorial and write my own :)

lean pebble Mar 11, 2021, 6:58 PM

#

I was bored so I made my openvpn work with tls / ssl on TCP

slate sonnet Mar 11, 2021, 6:59 PM

#

I'm trying to telnet while my server is off

#

That's a 200iq move

#

Connected

tame carbon Mar 11, 2021, 7:00 PM

#

Ok. let me try from over here

#

rip

slate sonnet Mar 11, 2021, 7:00 PM

#

Rip

tame carbon Mar 11, 2021, 7:00 PM

#

@hollow marlin anything?

lean pebble Mar 11, 2021, 7:00 PM

#

Make sure your server cfg pointing to the vpn internal IP

slate sonnet Mar 11, 2021, 7:01 PM

#

It is

tame carbon Mar 11, 2021, 7:01 PM

#

Let me do some googling

#

one sec

lean pebble Mar 11, 2021, 7:01 PM

#

And you enabled Eula

tame carbon Mar 11, 2021, 7:01 PM

#

@lean pebble shhhh

slate sonnet Mar 11, 2021, 7:01 PM

#

I've started the server

#

Lol

#

Got some plugins and stuff

lean pebble Mar 11, 2021, 7:01 PM

#

Ok

tame carbon Mar 11, 2021, 7:01 PM

#

@lean pebble He can connect to his port 25565 from his wg host.

slate sonnet Mar 11, 2021, 7:01 PM

#

I used to play with my friends with zerotier

lean pebble Mar 11, 2021, 7:02 PM

#

Ok but not from outside ?

tame carbon Mar 11, 2021, 7:02 PM

#

@lean pebble instead of minecraft, we're using telnet to see if there's a server listening

slate sonnet Mar 11, 2021, 7:02 PM

#

But I don't want them do download an app and stuff

#

A little annoying step

tame carbon Mar 11, 2021, 7:02 PM

#

@lean pebble his VPS has two interfaces

lean pebble Mar 11, 2021, 7:02 PM

#

Ok

tame carbon Mar 11, 2021, 7:02 PM

#

wg0 and eth0

#

wg0 is on 10.0.0.1/24

#

and eth0 is his public address

lean pebble Mar 11, 2021, 7:02 PM

#

Ok

tame carbon Mar 11, 2021, 7:02 PM

#

but I can't for the life of me figure out how to NAT this

#

its trivial.

#

this shouldnt be difficult.

lean pebble Mar 11, 2021, 7:03 PM

#

He should nat on his port to the internal IP

tame carbon Mar 11, 2021, 7:03 PM

#

@slate sonnet gimme a moment

#

Im doing some reading

slate sonnet Mar 11, 2021, 7:03 PM

#

No problem

lean pebble Mar 11, 2021, 7:03 PM

#

He uses iptables or firewalld / ufw

slate sonnet Mar 11, 2021, 7:04 PM

#

ufw is disabled

#

I think

tame carbon Mar 11, 2021, 7:04 PM

#

@lean pebble ufw is off

#

we've been at this since early afternoon

#

its evening now.

#

We've only got 1 hitch left.

#

90% is working

lean pebble Mar 11, 2021, 7:04 PM

#

Lol I know it's evening

#

You say no routing to the port right ?

#

Telnet not working

tame carbon Mar 11, 2021, 7:06 PM

#

@slate sonnet ok remove the iptable rule

#

and replace it with

#

iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 25565 -j DNAT --to-destination 10.0.0.2:25565; iptables -A FORWARD -p tcp -d 10.0.0.2 --dport 25565 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

hollow marlin Mar 11, 2021, 7:06 PM

#

tame carbon <@!462711605063450628> anything?

Looks to follow the page you linked. I still think or would assume a forward chain is needed which is not in the guide. Just like Mikrotik, PREROUTING -> FORWARD -> POSTROUTING. Without a forward the packet matches the PREROUTING, makes the changes, then drops. My assumption anyway

tame carbon Mar 11, 2021, 7:06 PM

#

@hollow marlin read above ^

hollow marlin Mar 11, 2021, 7:06 PM

#

lol yeah typed at the same time

slate sonnet Mar 11, 2021, 7:06 PM

#

Both postup and postdown? @tame carbon

tame carbon Mar 11, 2021, 7:06 PM

#

@slate sonnet Yes. Please pay attention, there's a ; in the middle, these are two commands on a single line

#

You have to modify both -A's

slate sonnet Mar 11, 2021, 7:07 PM

#

Okay

lean pebble Mar 11, 2021, 7:07 PM

#

I had the same issue 2 months ago

tame carbon Mar 11, 2021, 7:08 PM

#

@hollow marlin so NAT is two components

#

PREROUTING does the translation

#

and then you still need to accept the packet when it comes to the moment to decide on forward

hollow marlin Mar 11, 2021, 7:09 PM

#

Depends on when and where you want to make the chain, and yeah you need a FORWARD chain in the middle to actually accept and route the traffic

slate sonnet Mar 11, 2021, 7:09 PM

#

Does there have to be a space after the ';'?

#

In the middle

#

I'm assuming not

tame carbon Mar 11, 2021, 7:10 PM

#

https://i.imgur.com/8GLe280.png

Imgur

#

no

#

xD

slate sonnet Mar 11, 2021, 7:10 PM

#

Okay

#

Done

#

telnet connected

#

I've restarted wg before telnet

tame carbon Mar 11, 2021, 7:11 PM

#

@hollow marlin still doesn't work

#

wait, don't we need SNAT as well?

#

in POSTROUTING

hollow marlin Mar 11, 2021, 7:12 PM

#

Yes, else its not going to go back out the WG tunnel

tame carbon Mar 11, 2021, 7:15 PM

#

@slate sonnet add another PostUp and PostDown, put this in: iptables -A POSTROUTING -t nat -p tcp -d 10.0.0.2 --dport 25565 -j MASQUERADE

slate sonnet Mar 11, 2021, 7:17 PM

#

Now telnet can't connect

#

No route to host

tame carbon Mar 11, 2021, 7:17 PM

#

lol

#

We did something right though

#

slate sonnet Mar 11, 2021, 7:18 PM

#

That means that you can technically connect?

tame carbon Mar 11, 2021, 7:18 PM

#

Im logged in

#

it works

#

:D

slate sonnet Mar 11, 2021, 7:18 PM

#

Oooooo

#

Yeeeeeee

tame carbon Mar 11, 2021, 7:18 PM

#

@hollow marlin You're a god.

#

https://i.imgur.com/rBDkQOH.png

Imgur

slate sonnet Mar 11, 2021, 7:19 PM

#

Only little sad thing is that I can't ipban

#

But I think I can just do that on the vps

tame carbon Mar 11, 2021, 7:19 PM

#

you can use ufw for that

slate sonnet Mar 11, 2021, 7:19 PM

#

I'll read into that later then

tame carbon Mar 11, 2021, 7:19 PM

#

@slate sonnet do you know how to set up ssh key authorization?

#

might be a good time now to lock down your vps a bit

slate sonnet Mar 11, 2021, 7:20 PM

#

No?

tame carbon Mar 11, 2021, 7:20 PM

#

ok

slate sonnet Mar 11, 2021, 7:20 PM

#

tame carbon might be a good time now to lock down your vps a bit

Yeah

tame carbon Mar 11, 2021, 7:20 PM

#

which machine do you log on with ?

#

your windows box?

slate sonnet Mar 11, 2021, 7:20 PM

#

yes

#

And I've logged in with my phone

tame carbon Mar 11, 2021, 7:21 PM

#

okay, but we're setting up an ssh key on your windows machine first

slate sonnet Mar 11, 2021, 7:21 PM

#

But I think I'm mostly gonna use my windows pc

#

Okay

tame carbon Mar 11, 2021, 7:21 PM

#

do you have git installed perhaps?

slate sonnet Mar 11, 2021, 7:21 PM

#

Lemme check

tame carbon Mar 11, 2021, 7:21 PM

#

https://git-scm.com/

#

@slate sonnet git-scm

#

has a full package

#

with ssh tools

slate sonnet Mar 11, 2021, 7:21 PM

#

installing it

#

oh

#

well I just installed git

tame carbon Mar 11, 2021, 7:22 PM

#

well

#

you need ssh-keygen

#

which I usually install with git-scm

#

it has a little windows bash interpreter

#

https://i.imgur.com/SHwOzgw.png

Imgur

slate sonnet Mar 11, 2021, 7:23 PM

#

git clone https://github.com/git/git

GitHub

git/git

Git Source Code Mirror - This is a publish-only repository and all pull requests are ignored. Please follow Documentation/SubmittingPatches procedure for any of your improvements. - git/git

#

Did that

tame carbon Mar 11, 2021, 7:23 PM

#

It has nothing to do with git :(((

slate sonnet Mar 11, 2021, 7:23 PM

#

Oh

tame carbon Mar 11, 2021, 7:23 PM

#

i ment to say git-scm

#

its a toolkit

#

xD

slate sonnet Mar 11, 2021, 7:23 PM

#

No?

#

Oof

tame carbon Mar 11, 2021, 7:23 PM

#

just, grab that real quick

#

its like 15mb

#

https://i.imgur.com/uIbNVuu.png

Imgur

slate sonnet Mar 11, 2021, 7:24 PM

#

Oh

#

Like on pc?

tame carbon Mar 11, 2021, 7:24 PM

#

ye

#

on your windows machine

slate sonnet Mar 11, 2021, 7:24 PM

#

Oooooh

#

Lmao

#

1 sec

#

I already have the installer

tame carbon Mar 11, 2021, 7:24 PM

#

@hollow marlin I'm using POSTROUTE masquerade now, this however changes the source address...

#

is there a way to not overwrite source IP?

#

@hollow marlin iptables -A POSTROUTING -t nat -p tcp -d 10.0.0.2 --dport 25565 -j MASQUERADE

slate sonnet Mar 11, 2021, 7:25 PM

#

What git editor should I use?

tame carbon Mar 11, 2021, 7:26 PM

#

@slate sonnet just hit next

#

whatever is default is ok

slate sonnet Mar 11, 2021, 7:26 PM

#

Use openssl library?

tame carbon Mar 11, 2021, 7:26 PM

#

ye. just hit next next next

slate sonnet Mar 11, 2021, 7:27 PM

#

Okay

hollow marlin Mar 11, 2021, 7:27 PM

#

tame carbon is there a way to not overwrite source IP?

No POSTROUTING rule will do that after a forward, or to make sure PREROUTING is not translating also

slate sonnet Mar 11, 2021, 7:27 PM

#

Installed git

#

Run git bash?

tame carbon Mar 11, 2021, 7:27 PM

#

@slate sonnet yes

#

@hollow marlin how come in SOHO when you port forward, you can still see the source IP ?

#

even I can do that here

hollow marlin Mar 11, 2021, 7:28 PM

#

Thats dst. NAT, MASQUERADE is source NAT

tame carbon Mar 11, 2021, 7:29 PM

#

https://i.imgur.com/qSO2Dr0.png DST NAT

Imgur

hollow marlin Mar 11, 2021, 7:29 PM

#

Basically "change source IP of the exiting interface"

tame carbon Mar 11, 2021, 7:30 PM

#

@hollow marlin so I'm doing something wrong

#

so what should POSTROUTING do?

#

just -j ACCEPT ?

#

instead of masquerade?

#

because we added that

#

and it started working

#

I'm confused with the pre and post now

#

hollow marlin Mar 11, 2021, 7:32 PM

#

It started working because when traffic was routed and leaving 10.0.0.1, the SRC was changed. Now on return, 10.0.0.0/24 points to the WG tunnel and its routed back out. Without this, traffic will come in the VPS, be routed without src. NAT, and return traffic will be sent out his WAN then will be dropped by the remote FW

#

Asymmetrical routing

slate sonnet Mar 11, 2021, 7:34 PM

#

@tame carbon what do I do in git?

tame carbon Mar 11, 2021, 7:34 PM

#

@slate sonnet run ssh-keygen -t rsa -b 4096 -C "your_email@example.com" replace that with whatever email

#

@hollow marlin I'm at a loss, what would you change?

slate sonnet Mar 11, 2021, 7:35 PM

#

"enter file in which to save the key"

hollow marlin Mar 11, 2021, 7:35 PM

#

tame carbon I'm confused with the pre and post now

Prerouting is used to alter a packet prior to routing, say for firewall filter as you go down the rules. Postrouting is the same but after routing has been done. Really a case by case.

tame carbon Mar 11, 2021, 7:35 PM

#

iptables -A POSTROUTING -t nat -p tcp -d 10.0.0.2 --dport 25565 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 25565 -j DNAT --to-destination 10.0.0.2:25565
iptables -A FORWARD -p tcp -d 10.0.0.2 --dport 25565 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#

this is what we have running rn

slate sonnet Mar 11, 2021, 7:36 PM

#

slate sonnet "enter file in which to save the key"

.ssh?

hollow marlin Mar 11, 2021, 7:36 PM

#

That is correct, you will want src. NAT in this situation

tame carbon Mar 11, 2021, 7:36 PM

#

@slate sonnet just hit enter

#

@slate sonnet default name is what you should use

slate sonnet Mar 11, 2021, 7:37 PM

#

passphrase

tame carbon Mar 11, 2021, 7:37 PM

#

you can put one on there, if you want to encrypt your key

slate sonnet Mar 11, 2021, 7:37 PM

#

Kinda like a password?

#

Ok

tame carbon Mar 11, 2021, 7:37 PM

#

otherwise anyone can use your private key

slate sonnet Mar 11, 2021, 7:37 PM

#

Done

#

Now what?

tame carbon Mar 11, 2021, 7:38 PM

#

@hollow marlin yes, but can the host not translate packets from WG -> WAN to be masqueraded

#

while packets from WAN -> WG are not translated?

#

or does that not follow through, because this is L3 and not L2 ?

untold elbow Mar 11, 2021, 7:38 PM

#

ayyye you got MC working

#

gj

slate sonnet Mar 11, 2021, 7:38 PM

#

Yup :D

tame carbon Mar 11, 2021, 7:38 PM

#

This is networking at its finest

slate sonnet Mar 11, 2021, 7:39 PM

#

Want to thank everyone who helped out

tame carbon Mar 11, 2021, 7:39 PM

#

and why ipv4 sucks.

#

USE IPV6!

#

stupid NAT.

slate sonnet Mar 11, 2021, 7:39 PM

#

Router doesn't have ipv6 lmao

tame carbon Mar 11, 2021, 7:39 PM

#

garbage ISP

slate sonnet Mar 11, 2021, 7:39 PM

#

Yup

#

Only one available though :(

tame carbon Mar 11, 2021, 7:39 PM

#

@slate sonnet did you create the key?

slate sonnet Mar 11, 2021, 7:39 PM

#

Can't wait till I move out from my mom's house

slate sonnet Mar 11, 2021, 7:40 PM

#

tame carbon <@!289451427011756032> did you create the key?

Yes

tame carbon Mar 11, 2021, 7:40 PM

#

ok now run

#

ssh-copy-id root@194.87.80.92

slate sonnet Mar 11, 2021, 7:40 PM

#

Where?

#

putty?

tame carbon Mar 11, 2021, 7:40 PM

#

in git bash

slate sonnet Mar 11, 2021, 7:40 PM

#

Okay

tame carbon Mar 11, 2021, 7:41 PM

#

you'll have to enter your password for your VPS

slate sonnet Mar 11, 2021, 7:41 PM

#

"are you sure you want to continue?"

tame carbon Mar 11, 2021, 7:41 PM

#

yes

slate sonnet Mar 11, 2021, 7:41 PM

#

Just enter

tame carbon Mar 11, 2021, 7:41 PM

#

this copies your public key to the server

#

its kinda like we did with WG

dense furnace Mar 11, 2021, 7:41 PM

#

you guys still working on it?

#

:D

slate sonnet Mar 11, 2021, 7:41 PM

#

Logged into the vps

tame carbon Mar 11, 2021, 7:42 PM

#

@dense furnace it works now

dense furnace Mar 11, 2021, 7:42 PM

#

wow :o

tame carbon Mar 11, 2021, 7:42 PM

#

just hardening the vps now

dense furnace Mar 11, 2021, 7:42 PM

#

congratz

tame carbon Mar 11, 2021, 7:42 PM

#

yeah took a while

dense furnace Mar 11, 2021, 7:42 PM

#

probably

tame carbon Mar 11, 2021, 7:42 PM

#

iptables -A POSTROUTING -t nat -p tcp -d 10.0.0.2 --dport 25565 -j MASQUERADE
iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 25565 -j DNAT --to-destination 10.0.0.2:25565
iptables -A FORWARD -p tcp -d 10.0.0.2 --dport 25565 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

#

the solution ^

dense furnace Mar 11, 2021, 7:42 PM

#

oh god

slate sonnet Mar 11, 2021, 7:42 PM

#

@tame carbon so now try connecting on putty?

tame carbon Mar 11, 2021, 7:42 PM

#

@slate sonnet nah, you can just run ssh root@ip now

#

in git bash

#

you dont need putty per-se

#

you could. make a preset for it

#

you just have to tell putty to use that private key

#

but git bash just has ssh

slate sonnet Mar 11, 2021, 7:43 PM

#

logged in

tame carbon Mar 11, 2021, 7:43 PM

#

nice

dense furnace Mar 11, 2021, 7:43 PM

#

oh you even secured the server?

tame carbon Mar 11, 2021, 7:44 PM

#

@slate sonnet now modify /etc/ssh/sshd_config

#

@dense furnace well, the wireguard stuff @untold elbow helped out with, while I was eating dinner

slate sonnet Mar 11, 2021, 7:44 PM

#

What do I modify?

tame carbon Mar 11, 2021, 7:45 PM

#

then it was a matter of modifying the kernel's IP table configuration to properly port forward the minecraft packets over the VPN

#

which took the longest

dense furnace Mar 11, 2021, 7:45 PM

#

oof

#

better write that down for the future @slate sonnet :D

#

that = everything you did today

slate sonnet Mar 11, 2021, 7:46 PM

#

"Write that down, write that down!"

#

xD

dense furnace Mar 11, 2021, 7:46 PM

#

reverse ssh tunnel would have taken 20 minutes

#

rofl

#

:D

slate sonnet Mar 11, 2021, 7:46 PM

#

I wanted to learn networking and stuff

tame carbon Mar 11, 2021, 7:46 PM

#

@slate sonnet search (CTRL + W) for PasswordAuthentication

slate sonnet Mar 11, 2021, 7:46 PM

#

Now I'm not so sure lmao

tame carbon Mar 11, 2021, 7:47 PM

#

@slate sonnet on a router like mikrotik this is much easier

dense furnace Mar 11, 2021, 7:47 PM

#

PasswordAuthentication no and PubkeyAuth yes?

slate sonnet Mar 11, 2021, 7:47 PM

#

tame carbon <@!289451427011756032> search (CTRL + W) for PasswordAuthentication

Found it

tame carbon Mar 11, 2021, 7:47 PM

#

@slate sonnet that commandline crap on linux looks like this on here: https://i.imgur.com/XSrkwZN.png

Imgur

#

@slate sonnet ok set it to no

#

if its commented, uncomment it

slate sonnet Mar 11, 2021, 7:48 PM

#

Still confusing, but at least don't have to keep going through the history lol

#

So uncomment it and set it to no

#

Done

tame carbon Mar 11, 2021, 7:49 PM

#

@slate sonnet this is NAT on mikrotik: https://i.imgur.com/atyYpTl.png

Imgur

#

you just dont need to memorize IPs

#

everything uses aliases

slate sonnet Mar 11, 2021, 7:49 PM

#

Save and exit out of the config file?

tame carbon Mar 11, 2021, 7:50 PM

#

make sure PubkeyAuthentication is set to yes

#

and then save and exit

#

then run: systemctl restart ssh

slate sonnet Mar 11, 2021, 7:50 PM

#

Okay

hollow marlin Mar 11, 2021, 7:50 PM

#

tame carbon <@!462711605063450628> yes, but can the host not translate packets from WG -> WA...

I guess I don't understand, PRE/POST rules will automatically apply the same in reverse with connection tracking

tame carbon Mar 11, 2021, 7:51 PM

#

Yeah that's why I was confused too lol

#

because usually if you apply a NAT rule

#

it just tracks immediately

slate sonnet Mar 11, 2021, 7:51 PM

#

tame carbon then run: `systemctl restart ssh`

Done

tame carbon Mar 11, 2021, 7:51 PM

#

@slate sonnet ok now, you can only log in on ssh with that keyfile

#

password is now blocked

#

you can try it from your phone, and test

#

that key is 4096 bits

#

which takes longer than the age of the universe to compute

#

so its safe

#

unless someone steals that key ofcourse and brute forces the passphrase xD

slate sonnet Mar 11, 2021, 7:52 PM

#

That's a whole 4kbits

dense furnace Mar 11, 2021, 7:52 PM

#

tame carbon which takes longer than the age of the universe to compute

nowadays

tame carbon Mar 11, 2021, 7:53 PM

#

@slate sonnet on your linux system you can do the same ssh-key-gen

#

and then you just cat ~/.ssh/id_rsa.pub

slate sonnet Mar 11, 2021, 7:53 PM

#

Yup

#

Permission denied

dense furnace Mar 11, 2021, 7:53 PM

#

dense furnace nowadays

we don't know about the future O:

lean pebble Mar 11, 2021, 7:53 PM

#

tame carbon which takes longer than the age of the universe to compute

😆

#

So all good now ?

slate sonnet Mar 11, 2021, 7:53 PM

#

I think so

tame carbon Mar 11, 2021, 7:53 PM

#

@slate sonnet public keys on the server are stored in: ~/.ssh/authorized_keys one key per line

#

for root this is /root/.ssh/authorized_keys

slate sonnet Mar 11, 2021, 7:54 PM

#

Got it

tame carbon Mar 11, 2021, 7:55 PM

#

@slate sonnet ofcourse you can use that vps for all sorts of stuff

#

like even hosting a small website

#

it has 20GB storage

#

which is not bad

#

@dense furnace https://i.imgur.com/644bS5p.png

Imgur

dense furnace Mar 11, 2021, 7:56 PM

#

tame carbon like even hosting a small website

with nginx e.g.

#

wait

#

you're on pr0 too?

tame carbon Mar 11, 2021, 7:57 PM

#

_>

dense furnace Mar 11, 2021, 7:57 PM

#

just don't talk about it ok

#

why imgur tho

tame carbon Mar 11, 2021, 7:57 PM

#

@dense furnace this is my bad habbit of rehosting

#

and this was like 30 mins after they came back on

#

service was still laggy

slate sonnet Mar 11, 2021, 7:58 PM

#

tame carbon like even hosting a small website

Oooo

#

True!

dense furnace Mar 11, 2021, 7:58 PM

#

where r you from crystal?

tame carbon Mar 11, 2021, 7:58 PM

#

@slate sonnet as @dense furnace said, nginx is perfect for this

#

its small footprint, like 5MB memory

#

@dense furnace Netherlands

#

Though I have dual citizenship

#

and speak three languages xD

#

German, Dutch, English

dense furnace Mar 11, 2021, 7:59 PM

#

ohhhh

#

nice

tame carbon Mar 11, 2021, 7:59 PM

#

I'm like 5 mins from the border

#

half my family is german

dense furnace Mar 11, 2021, 7:59 PM

#

nice

dense furnace Mar 11, 2021, 8:00 PM

#

tame carbon <@!223850412317474826> https://i.imgur.com/644bS5p.png

laughed hard about this

#

I like all the memes

tame carbon Mar 11, 2021, 8:00 PM

#

these datacenter memes are extra spicy

slate sonnet Mar 11, 2021, 8:00 PM

#

Well anyway, thank you @tame carbon @untold elbow @hollow marlin @peak cloak

dense furnace Mar 11, 2021, 8:00 PM

#

so much good oc

untold elbow Mar 11, 2021, 8:01 PM

#

🙂

slate sonnet Mar 11, 2021, 8:01 PM

#

It was fun learning a little bit about all of this

tame carbon Mar 11, 2021, 8:02 PM

#

@slate sonnet if you ever want to learn more, you can always get a small router

#

and run your wireguard client on there

#

I do something opposite of what you did today. I run a VPN server on my router

#

so my phone always has a LAN ip when I am outside using LTE

dense furnace Mar 11, 2021, 8:03 PM

#

I also use this

tame carbon Mar 11, 2021, 8:03 PM

#

but I guess this wont be of any use to ya with the ISP you have right now

#

but you have a tunnel now, which is a start

dense furnace Mar 11, 2021, 8:03 PM

#

and a raspberry pi with pi-hole

tame carbon Mar 11, 2021, 8:03 PM

#

you can always set up more tunnels on your wg vps

#

for your phone and such

peak cloak Mar 11, 2021, 8:03 PM

#

tame carbon so my phone always has a LAN ip when I am outside using LTE

did the same thing

#

except on a VM

tame carbon Mar 11, 2021, 8:04 PM

#

backdoor with a very strong lock :)

slate sonnet Mar 11, 2021, 8:04 PM

#

I'm gonna experiment more once I move into my own place where I don't have a crappy isp

dense furnace Mar 11, 2021, 8:04 PM

#

I bet crystal is working in IT

tame carbon Mar 11, 2021, 8:05 PM

#

beta version of RouterOS has wireguard in this list too: https://i.imgur.com/fxxWwnL.png

Imgur

#

sadly this is still v6

#

@dense furnace developer

#

Written a lot of server applications

#

and that comes with its share of linux & networking

#

and this is the only LTT channel where we can talk about Linux and dis on windows without starting an OS 🔥 war

dense furnace Mar 11, 2021, 8:06 PM

#

rofl

#

y windows bad

#

👀

tame carbon Mar 11, 2021, 8:08 PM

#

because

dense furnace Mar 11, 2021, 8:08 PM

#

no there is no because here

tame carbon Mar 11, 2021, 8:08 PM

#

you know what we just did with that iptable stuff right?

#

you need windows server for that to work

#

which costs $$$

#

routing doesnt work on normal windows

#

you can only do a LAN bridge with connection sharing

#

that's it.

#

Like, I can go on and on

#

windows is just garbage in every single way

#

package distribution, updates, system layout

#

driver stack

#

network stack

#

and it costs money

dense furnace Mar 11, 2021, 8:10 PM

#

currently I use win10 for gaming only

tame carbon Mar 11, 2021, 8:10 PM

#

same

#

but my work laptop runs ubuntu

#

and my servers debian

dense furnace Mar 11, 2021, 8:10 PM

#

I know there is stuff like wine, but meh

tame carbon Mar 11, 2021, 8:10 PM

#

native games work just fine on linux

dense furnace Mar 11, 2021, 8:10 PM

#

tame carbon and my servers debian

Oh I see you're a man of culture aswell

peak cloak Mar 11, 2021, 8:11 PM

#

currently playing ksp

dense furnace Mar 11, 2021, 8:11 PM

#

peak cloak currently playing ksp

that's an horrible good game

peak cloak Mar 11, 2021, 8:11 PM

#

native linux support

dense furnace Mar 11, 2021, 8:11 PM

#

y

tame carbon Mar 11, 2021, 8:11 PM

#

@dense furnace my laptop is the place, where i need to quickly be able to get something to work

dense furnace Mar 11, 2021, 8:11 PM

#

many steam games have native linux support now

tame carbon Mar 11, 2021, 8:11 PM

#

hence ubuntu, easier to find stuff for online

#

debian is slightly different, sudo for example is not a thing

dense furnace Mar 11, 2021, 8:11 PM

#

true

tame carbon Mar 11, 2021, 8:12 PM

#

and its also less bloated

#

I run debian as a host OS

#

my vm with my own mc server, that's a broken install with ubuntu 18

#

that i managed to repair to the point of running java

dense furnace Mar 11, 2021, 8:12 PM

#

ubuntu has a great community but I also like to use debian for my servers

tame carbon Mar 11, 2021, 8:12 PM

#

I moved a year ago to this place

#

and all the fiber things changed

dense furnace Mar 11, 2021, 8:13 PM

#

my company currently uses centos but will switch soon

#

maybe to ubuntu

#

because of update policie

last solstice Mar 11, 2021, 8:13 PM

#

but centos is so nice

untold elbow Mar 11, 2021, 8:13 PM

#

was so nice*

tame carbon Mar 11, 2021, 8:13 PM

#

the thing is

last solstice Mar 11, 2021, 8:13 PM

#

If they want support but currently have centos why not just go to redhat

peak cloak Mar 11, 2021, 8:13 PM

#

rocky linux will replace it

tame carbon Mar 11, 2021, 8:13 PM

#

software support for linux is slowly improving

dense furnace Mar 11, 2021, 8:13 PM

#

centos is dying

tame carbon Mar 11, 2021, 8:13 PM

#

and those who first start adding support, often add fedora and ubuntu first

#

everything else comes after

#

so if you just use a debian based system

#

you get the largest market share of compatible packets

#

unless ofcourse you run ARCH

last solstice Mar 11, 2021, 8:14 PM

#

Arch best

dense furnace Mar 11, 2021, 8:14 PM

#

https://scontent-frx5-1.xx.fbcdn.net/v/t1.0-0/p526x296/109618601_1759578370849589_736435313539592753_o.jpg?_nc_cat=100&ccb=1-3&_nc_sid=8024bb&_nc_ohc=mbd__t8YCckAX-JZe-x&_nc_ht=scontent-frx5-1.xx&tp=6&oh=a1af3736541c12ee1bf33a7c85017f3b&oe=606F19B9

dense furnace Mar 11, 2021, 8:14 PM

#

last solstice Arch best

^

tame carbon Mar 11, 2021, 8:14 PM

#

but I've used arch for 3 months, until it updated itself and broke, the day I had important meetings

#

never again.

#

I rather run an outdated LTS kernel

dense furnace Mar 11, 2021, 8:15 PM

#

you don't use arch because you want an easy life

tame carbon Mar 11, 2021, 8:15 PM

#

than to run arch

dense furnace Mar 11, 2021, 8:15 PM

#

you use arch to flex

last solstice Mar 11, 2021, 8:15 PM

#

Im on mint on my laptop, but wanna switch to kali lol

untold elbow Mar 11, 2021, 8:15 PM

#

lol why

slate sonnet Mar 11, 2021, 8:15 PM

#

I've noticed that there's some like lag on my mc server. That can only be fixed by using a better quality vps provider?

last solstice Mar 11, 2021, 8:15 PM

#

because csec major

tame carbon Mar 11, 2021, 8:15 PM

#

kali is leak af

dense furnace Mar 11, 2021, 8:15 PM

#

slate sonnet I've noticed that there's some like lag on my mc server. That can only be fixed ...

huh?

slate sonnet Mar 11, 2021, 8:15 PM

#

As if there's a lot of latency between me and my server

untold elbow Mar 11, 2021, 8:15 PM

#

@slate sonnet yeah probably

dense furnace Mar 11, 2021, 8:15 PM

#

no way

tame carbon Mar 11, 2021, 8:15 PM

#

no fw, no default security in place, everything is root.

dense furnace Mar 11, 2021, 8:15 PM

#

slate sonnet As if there's a lot of latency between me and my server

connect locally

#

from your machine

#

does it lag too?

slate sonnet Mar 11, 2021, 8:16 PM

#

Well I know I can connect locally

dense furnace Mar 11, 2021, 8:16 PM

#

slate sonnet Well I know I can connect locally

do it to test it

slate sonnet Mar 11, 2021, 8:16 PM

#

But my friends will lag which is worse than zerotier lol

untold elbow Mar 11, 2021, 8:16 PM

#

you're adding an extra network hop, that's gonna add latency

slate sonnet Mar 11, 2021, 8:16 PM

#

dense furnace do it to test it

It's fine if I do it locally

dense furnace Mar 11, 2021, 8:16 PM

#

O_O

#

that's funny

slate sonnet Mar 11, 2021, 8:16 PM

#

So basically no real way around it huh

untold elbow Mar 11, 2021, 8:17 PM

#

not without a different VPS, no

dense furnace Mar 11, 2021, 8:17 PM

#

that's weird tbh

slate sonnet Mar 11, 2021, 8:17 PM

#

By different vps you mean different vps location?

tame carbon Mar 11, 2021, 8:17 PM

#

@slate sonnet try pinging 46.243.190.1 how much latency do you get?

slate sonnet Mar 11, 2021, 8:17 PM

#

From my pc?

untold elbow Mar 11, 2021, 8:17 PM

#

dynamic dns would let you have a hostname that doesn't change mapped to your CGNAT IP address and doesn't require an extra network hop

dense furnace Mar 11, 2021, 8:17 PM

#

do YOU also lag if you connect trough the vps?

tame carbon Mar 11, 2021, 8:17 PM

#

@untold elbow he's connecting to his own VPS endpoint, that's gonna have an RTT of 4x

#

no wonder it will lag.

untold elbow Mar 11, 2021, 8:18 PM

#

yeah but it'll be roughly the same experience as his friends connecting

slate sonnet Mar 11, 2021, 8:18 PM

#

tame carbon <@!289451427011756032> try pinging `46.243.190.1` how much latency do you get?

avg ping is 89ms

untold elbow Mar 11, 2021, 8:18 PM

#

oof

tame carbon Mar 11, 2021, 8:18 PM

#

I'm on fiber optics

#

5ms from amsterdam exchange

dense furnace Mar 11, 2021, 8:18 PM

#

what

#

wait

tame carbon Mar 11, 2021, 8:18 PM

#

82 ms then

dense furnace Mar 11, 2021, 8:18 PM

#

tame carbon <@!289451427011756032> try pinging `46.243.190.1` how much latency do you get?

this ip? i got 25ms

tame carbon Mar 11, 2021, 8:18 PM

#

@untold elbow he's not that far away

slate sonnet Mar 11, 2021, 8:19 PM

#

I can say I live in krasnodar krai

tame carbon Mar 11, 2021, 8:19 PM

#

@slate sonnet your internet has bad ping, and the route to your VPS is suboptimal.

slate sonnet Mar 11, 2021, 8:19 PM

#

So kinda near europe

dense furnace Mar 11, 2021, 8:19 PM

#

y it's not the vps or the server

#

@slate sonnet it's you right now

tame carbon Mar 11, 2021, 8:19 PM

#

he has 60ms to his gateway

slate sonnet Mar 11, 2021, 8:19 PM

#

What?

tame carbon Mar 11, 2021, 8:20 PM

#

but that's 60ms to a host in a datacenter, which is pretty close for everyone else

#

@slate sonnet ping your vps

#

or do a traceroute to your vps

untold elbow Mar 11, 2021, 8:20 PM

#

was that ip not his vps?

tame carbon Mar 11, 2021, 8:20 PM

#

that was mine xD

untold elbow Mar 11, 2021, 8:20 PM

#

o

slate sonnet Mar 11, 2021, 8:20 PM

#

69ms ping (nice)

tame carbon Mar 11, 2021, 8:20 PM

#

just wanted to see how bad it is

dense furnace Mar 11, 2021, 8:20 PM

#

oh

#

so this is yours? 46.243.190.1

tame carbon Mar 11, 2021, 8:20 PM

#

that's a router of mine yes

untold elbow Mar 11, 2021, 8:20 PM

#

hackin u now

dense furnace Mar 11, 2021, 8:20 PM

#

it's ok for me

dense furnace Mar 11, 2021, 8:20 PM

#

untold elbow hackin u now

rofl

tame carbon Mar 11, 2021, 8:21 PM

#

@untold elbow that's my public /29

#

its routed through my WAN, but doesnt show in traces

dense furnace Mar 11, 2021, 8:21 PM

#

slate sonnet 69ms ping (nice)

it's definitely you scratch

tame carbon Mar 11, 2021, 8:21 PM

#

and the rDNS is not set

dense furnace Mar 11, 2021, 8:21 PM

#

perform a speedtest @slate sonnet

tame carbon Mar 11, 2021, 8:22 PM

#

@dense furnace basically:

traceroute to 1.1.1.1 (1.1.1.1), 64 hops max
  1   46.243.190.1  0.004ms  0.006ms  0.225ms 
  2   46.243.152.3  6.025ms  6.253ms  6.098ms 
  3   46.249.55.194  6.899ms  6.713ms  6.969ms 
  4   185.8.179.33  7.108ms  6.993ms  7.105ms 
  5   80.249.211.140  8.683ms  8.864ms  9.322ms 
  6   1.1.1.1  8.186ms  8.354ms  8.103ms

dense furnace Mar 11, 2021, 8:23 PM

#

nice

tame carbon Mar 11, 2021, 8:23 PM

#

its quite nice, when you have your own Public IPs

#

especially for local use >_>

#

and firewall it off

slate sonnet Mar 11, 2021, 8:23 PM

#

15ms ping @dense furnace

dense furnace Mar 11, 2021, 8:23 PM

#

huh

slate sonnet Mar 11, 2021, 8:23 PM

#

Yet on my phone its 1ms

#

This is weird

tame carbon Mar 11, 2021, 8:24 PM

#

@slate sonnet from experience, anything below 150ms on minecraft, you don't really feel/notice

dense furnace Mar 11, 2021, 8:24 PM

#

but to your vps you get 69ms??

slate sonnet Mar 11, 2021, 8:24 PM

#

dense furnace but to your vps you get 69ms??

Yup

#

It's located in moscow

tame carbon Mar 11, 2021, 8:24 PM

#

minecraft runs at 20tps, so it has a change in gamestate every 50ms

#

so at most, you lag 3 ticks behind

dense furnace Mar 11, 2021, 8:24 PM

#

tame carbon minecraft runs at 20tps, so it has a change in gamestate every 50ms

but that's for the game logic, not the players position?

#

or am I missing something

slate sonnet Mar 11, 2021, 8:25 PM

#

dense furnace but that's for the game logic, not the players position?

Yes

#

That's only for game logic

tame carbon Mar 11, 2021, 8:25 PM

#

@dense furnace network thread is asynchronous from the gamethread

dense furnace Mar 11, 2021, 8:25 PM

#

so you definetly feel a ping of 70~

tame carbon Mar 11, 2021, 8:25 PM

#

Yes, there is latency

#

but not a lot

slate sonnet Mar 11, 2021, 8:25 PM

#

I can send a vid

tame carbon Mar 11, 2021, 8:25 PM

#

You'd have a bigger issue if this was a shooter

#

minecraft isnt that sensitive

dense furnace Mar 11, 2021, 8:25 PM

#

may I ask for the server ip to join the minecraft server? I want to see if there's any lag for me. You can dm me

tame carbon Mar 11, 2021, 8:25 PM

#

Oh I didnt even test that lol

#

@slate sonnet its really not that bad

#

you had.. 89ms

#

https://i.imgur.com/JAh6Fnu.png

Imgur

dense furnace Mar 11, 2021, 8:27 PM

#

hmmm

#

the question is

tame carbon Mar 11, 2021, 8:27 PM

#

18ms added by the tunnel

dense furnace Mar 11, 2021, 8:27 PM

#

is it the vps?

tame carbon Mar 11, 2021, 8:27 PM

#

no

#

its his internet.

dense furnace Mar 11, 2021, 8:27 PM

#

because speedtest told him 15ms

slate sonnet Mar 11, 2021, 8:27 PM

#

Your internet connection is coming from amsterdam?

#

@tame carbon

tame carbon Mar 11, 2021, 8:27 PM

#

Yes

#

I'm like 3 hops from the exchange

dense furnace Mar 11, 2021, 8:28 PM

#

mine is also 107ms

#

germany