Dit is in mijn eigen netwerk!!! Met het kpn modem, vpn met wireguard, dns en dhcp en volumio met de MiniDLNA server
MiniDLNA
Update /etc/wireguard/wg0.conf
[Interface] PrivateKey = i---GEHEIM---3o= Address = 10.210.109.1/24 ListenPort = 51820 MTU = 1420 ## The PostUp will run when the WireGuard Server starts the virtual VPN tunnel. ## The PostDown rules run when the WireGuard Server stops the virtual VPN tunnel. ## Specify the command that allows traffic to leave the server and give the VPN clients access to the Internet. # --- PostUp regels --- PostUp = iptables -A FORWARD -i wg0 -j ACCEPT PostUp = iptables -A FORWARD -o wg0 -j ACCEPT PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # Blokkeer KPN IPTV multicast (LAN flooding) PostUp = iptables -I FORWARD -i eth0 -s 195.0.0.0/8 -j DROP PostUp = iptables -I FORWARD -i eth0 -d 224.0.0.0/4 -j DROP PostUp = iptables -t raw -I PREROUTING -i eth0 -s 195.0.0.0/8 -j DROP PostUp = iptables -t raw -I PREROUTING -i eth0 -d 224.0.0.0/4 -j DROP # --- PostDown regels --- PostDown = iptables -D FORWARD -i wg0 -j ACCEPT PostDown = iptables -D FORWARD -o wg0 -j ACCEPT PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE # Verwijder IPTV-block regels PostDown = iptables -D FORWARD -i eth0 -s 195.0.0.0/8 -j DROP PostDown = iptables -D FORWARD -i eth0 -d 224.0.0.0/4 -j DROP PostDown = iptables -t raw -D PREROUTING -i eth0 -s 195.0.0.0/8 -j DROP PostDown = iptables -t raw -D PREROUTING -i eth0 -d 224.0.0.0/4 -j DROP # # # Clients # # # ### begin TelefoonMarike ### [Peer] PublicKey = ThgZQhNZLwsakhjJO6useSfkhd05jCUWVg++eRp7kxk= PresharedKey = wz---GEHEIM---xK7s= AllowedIPs = 10.210.109.3/32 ### end TelefoonMarike ### ### begin iPhone13Arjan ### [Peer] PublicKey = LQ62XBRHsAIIiw93TAVERw7Ja94V09AsEnAWnLYm7k4= PresharedKey = iuW---GEHEIM---98e0z0= AllowedIPs = 10.210.109.4/32 ### end iPhone13Arjan ###
Herstart wireguard:
sudo systemctl restart wg-quick@wg0
Installeer:
sudo apt install igmpproxy
Update /etc/igmpproxy.conf:
quickleave ## LAN interface (DLNA server) phyint eth0 upstream ratelimit 0 threshold 1 altnet 192.168.2.0/24 ## VPN interface (WireGuard) phyint wg0 downstream ratelimit 0 threshold 1 ## Niet gebruikte interfaces uitschakelen phyint eth1 disabled phyint eth2 disabled
Maak een service file voor igmpproxy /etc/systemd/system/igmpproxy.service
[Unit] Description=IGMP Proxy Service After=wg-quick@wg0.service network-online.target Requires=wg-quick@wg0.service [Service] Type=forking ExecStart=/etc/init.d/igmpproxy start ExecStop=/etc/init.d/igmpproxy stop Restart=on-failure [Install] WantedBy=multi-user.target
Disable de gegenereerde service file (uit init script) en enable de nieuwe, herlaad systemd, restart wireguard en en igmpproxy
sudo systemctl disable igmpproxy sudo systemctl enable igmpproxy.service sudo systemctl daemon-reload sudo systemctl restart wg-quick@wg0 sudo systemctl restart igmpproxy
Jellyfin
Om jellyfin nu ook toegankelijk te maken voor vpn clients moet je alleen de firewall rules in de vpn (wireguard) aan te passen. Verander ze in het volgende (/etc/wireguard/wg0.conf):
# --- VPN → LAN en LAN → VPN --- PostUp = iptables -A FORWARD -i wg0 -o eth0 -j ACCEPT PostUp = iptables -A FORWARD -i eth0 -o wg0 -j ACCEPT # --- NAT voor VPN-clients --- PostUp = iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE # --- IPTV blokkeren --- PostUp = iptables -I FORWARD -i eth0 -s 195.0.0.0/8 -j DROP PostUp = iptables -I FORWARD -i eth0 -d 224.0.0.0/4 -j DROP PostUp = iptables -t raw -I PREROUTING -i eth0 -s 195.0.0.0/8 -j DROP PostUp = iptables -t raw -I PREROUTING -i eth0 -d 224.0.0.0/4 -j DROP # --- PostDown --- PostDown = iptables -D FORWARD -i wg0 -o eth0 -j ACCEPT PostDown = iptables -D FORWARD -i eth0 -o wg0 -j ACCEPT PostDown = iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE PostDown = iptables -D FORWARD -i eth0 -s 195.0.0.0/8 -j DROP PostDown = iptables -D FORWARD -i eth0 -d 224.0.0.0/4 -j DROP PostDown = iptables -t raw -D PREROUTING -i eth0 -s 195.0.0.0/8 -j DROP PostDown = iptables -t raw -D PREROUTING -i eth0 -d 224.0.0.0/4 -j DROP
Nu wireguard herstarten
sudo systemctl restart wg-quick@wg0