Cloud/Hetzner/AA: Difference between revisions

From Chorke Wiki
Jump to navigation Jump to search
 
(47 intermediate revisions by the same user not shown)
Line 2: Line 2:
<syntaxhighlight lang="bash">
<syntaxhighlight lang="bash">
ssh -i ~/.ssh/cid.chorke.org_ed25519 [email protected]
ssh -i ~/.ssh/cid.chorke.org_ed25519 [email protected]
cat <<'EXE' | sudo bash
free -th && echo && systemd-analyze && echo
df -h    && echo && lsblk && echo
swapon --show
EXE
</syntaxhighlight>
</syntaxhighlight>


Line 22: Line 28:
mkdir -p /etc/apt/keyrings
mkdir -p /etc/apt/keyrings
apt list -a --upgradable;apt-get upgrade -y;echo
apt list -a --upgradable;apt-get upgrade -y;echo
apt-get install -y apt-transport-https ca-certificates gnupg build-essential snap jq
apt-get install -y apt-transport-https ca-certificates gnupg build-essential snap jq traceroute
apt-get clean cache && find /tmp -type f -atime +10 -delete && find /tmp -type s -atime +10 -delete
EXE
EXE
</syntaxhighlight>
</syntaxhighlight>
Line 105: Line 112:
cluster: null
cluster: null
YML
YML
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
sudo ufw enable
sudo iptables -S
cat << EXE | sudo bash
ufw      allow OpenSSH
ufw      allow in  on lxdbr0
ufw route allow in  on lxdbr0
ufw route allow out on lxdbr0
EXE
sudo ufw status numbered
sudo iptables -S
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
cat << EXE | sudo bash
snap restart  lxd
snap services lxd
EXE
</syntaxhighlight>
</syntaxhighlight>


Line 124: Line 153:
apt list -a --upgradable;apt-get upgrade -y;echo
apt list -a --upgradable;apt-get upgrade -y;echo
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
apt-get clean cache && find /tmp -type f,s -atime +10 -delete
EXE
EXE
</syntaxhighlight>
</syntaxhighlight>
Line 150: Line 180:
usermod -aG docker shahed
usermod -aG docker shahed
EXE
EXE
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
ip a
docker image ls
docker network ls


ip a
echo 'id -nG'|sudo -i -u shahed bash
echo 'id -nG'|sudo -i -u shahed bash
echo 'id -nG'|sudo -i -u chorke bash
echo 'id -nG'|sudo -i -u chorke bash
docker run --rm alpine cat /etc/hosts
docker run --rm alpine cat /etc/resolv.conf
</syntaxhighlight>
</syntaxhighlight>


Line 176: Line 214:
<syntaxhighlight lang="bash">
<syntaxhighlight lang="bash">
cat << EXE | sudo bash
cat << EXE | sudo bash
systemctl enable  warp0.service
systemctl daemon-reload
systemctl start  warp0.service
systemctl enable --now warp0.service
systemctl status warp0.service
systemctl status       warp0.service
EXE
EXE


Line 184: Line 222:
</syntaxhighlight>
</syntaxhighlight>


==Cloudflare » Argo Tunnel==
==Cloudflare » Argo » Tunnel==
<syntaxhighlight lang="bash">
<syntaxhighlight lang="bash">
wget -cq https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64.deb -P ${HOME}/Downloads
wget -cq https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64.deb -P ${HOME}/Downloads
Line 190: Line 228:
       rm -rf ${HOME}/Downloads/cloudflared-linux-arm64.deb
       rm -rf ${HOME}/Downloads/cloudflared-linux-arm64.deb
</syntaxhighlight>
</syntaxhighlight>
----
<syntaxhighlight lang="properties">
cat <<'SYS' | sudo tee -a /etc/sysctl.conf >/dev/null
###################################################################
# Cloudflared Tunnel Private Network Config
# This config added by Chorke Academia, Inc
# ICMP Group ID Range 0 to 10,000 Users
net.ipv4.ping_group_range = 0 10000
# 208 KiB Default RX Buffer
net.core.rmem_default=212992
# 208 KiB Default TX Buffer
net.core.wmem_default=212992
# 8 MB Maximum RX Buffer
net.core.rmem_max=8388608
# 8 MB Maximum TX Buffer
net.core.wmem_max=8388608
SYS


sudo sysctl -p
</syntaxhighlight>
----
[[Cloudflare/Argo_Tunnel#Argo Tunnel|Skipped » Find More » 👈]]
[[Cloudflare/Argo_Tunnel#Argo Tunnel|Skipped » Find More » 👈]]


==Cloudflare » WARP Tunnel==
==Cloudflare » WARP » Tunnel==
<syntaxhighlight lang="bash">
<syntaxhighlight lang="bash">
lxc launch ubuntu:24.04 cloudflare
lxc launch ubuntu:24.04 cloudflare
lxc list -c=n -f=json|jq -r '.[]|select(.name=="cloudflare")|.status'
lxc list -c=n -f=json|jq -r '.[]|select(.name=="cloudflare")|.status'
cat <<'EXE' | lxc exec cloudflare -- bash
apt-get update;echo
mkdir -p /etc/apt/keyrings
apt list -a --upgradable;apt-get upgrade -y;echo
apt-get install -y apt-transport-https ca-certificates gnupg jq && apt-get clean
EXE
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
cat <<'EXE' | lxc exec cloudflare -- bash
curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg \
| sudo tee /etc/apt/keyrings/cloudflare.asc >/dev/null
DISTRIBUTION=$(. /etc/os-release && echo "${VERSION_CODENAME}");\
cat << SRC | sudo tee /etc/apt/sources.list.d/cloudflare.list >/dev/null
deb [arch=$(dpkg --print-architecture)\
signed-by=/etc/apt/keyrings/cloudflare.asc]\
https://pkg.cloudflareclient.com/ ${DISTRIBUTION} main
SRC
cat /etc/apt/sources.list.d/cloudflare.list
cat /etc/apt/keyrings/cloudflare.asc
EXE
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
cat <<'EXE' | lxc exec cloudflare -- bash
apt-get update;echo
apt list -a --upgradable;apt-get upgrade -y;echo
apt-get install -y cloudflare-warp && apt-get clean
EXE
lxc exec cloudflare -- bash
sudo vim /etc/sysctl.conf
</syntaxhighlight>
<syntaxhighlight lang="ini" line start="27" highlight="2">
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1
</syntaxhighlight>
----
sudo sysctl -p
'''net.ipv4.ip_forward = 1'''
ip route | grep default
default via 10.20.0.1 dev eth0 proto dhcp src 10.20.0.161 metric 100
----
<syntaxhighlight lang="bash">
lxc snapshot cloudflare base:2024.12.554.0
lxc publish  cloudflare/base:2024.12.554.0 --alias cloudflare/base:2024.12.554.0
lxc restore  cloudflare base:2024.12.554.0
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
lxc exec cloudflare -- bash
sudo warp-cli status
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
cat <<'EXE' | lxc exec cloudflare -- bash
warp-cli connector new eyJhIjoiNW…
warp-cli connect
EXE
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
cat << EXE | lxc exec cloudflare -- bash
warp-cli status
systemctl daemon-reload
systemctl enable --now warp-svc.service
systemctl status      warp-svc.service
EXE
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
cat << EXE | lxc exec cloudflare -- bash
echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections
echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections
apt-get -y install iptables-persistent && apt-get clean cache
EXE
</syntaxhighlight>
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
cat << EXE | lxc exec cloudflare -- bash
# allow forwarding traffic from host
iptables -A FORWARD -i eth0 -o CloudflareWARP -j ACCEPT
iptables -A FORWARD -i CloudflareWARP -o eth0 -j ACCEPT
# cloudflarewarp nat gateway setup for host
iptables -t nat -A POSTROUTING -o CloudflareWARP -j MASQUERADE


# persist across reboots, save the rules
        mkdir -p /etc/iptables/
iptables-save  > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
EXE
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
lxc snapshot cloudflare init:2025.02.16
lxc publish  cloudflare/init:2025.02.16 --alias cloudflare/init:2025.02.16
lxc restore  cloudflare init:2025.02.16
</syntaxhighlight>
----
[[Cloudflare/WARP Connector#WARP Client|Skipped » Find More » 👈]]
[[Cloudflare/WARP Connector#WARP Client|Skipped » Find More » 👈]]
==Cloudflare » WARP » Exclude==
{|class="wikitable"
|-
| colspan="3"| <code>Settings » 0Trust » WARP Client » Device settings » Profile settings » Default » Configure » </code>
|-
| colspan="3"| <code>Split Tunnels » Exclude IPs and domains » Manage » Manage Split Tunnels</code>
|-
!scope="col"| Name    !!scope="col"| Network            !!scope="col"              | Exclude
|-
| Network » OpenVPN  || <code>10.20.30.0/24</code>    ||style='text-align:center'| ✅
|-
| Network » Hetzner  || <code>10.20.31.0/24</code>    ||style='text-align:center'| ✅
|-
| Network » Docker    || <code>10.20.13.0/24</code>    ||style='text-align:center'| ✅
|-
| Network » Home      || <code>10.19.83.0/24</code>    ||style='text-align:center'| ✅
|-
| Network » LXD      || <code>10.20.0.0/24</code>      ||style='text-align:center'| ✅
|}
==Cloudflare » WARP » Forward==
{|class="wikitable"
|-
!scope="col" colspan="4" | Implement Forward Routing
|-
!scope="col" style='width:180px'| Name
!scope="col" style='width:140px'| Network
!scope="col" style='width:220px'| Subnets
!scope="col" style='width:90px' | Forward
|-
| Network » Cloudflare  || <code>10.20.40.0/21</code>    || <code>10.20.40 … 47.0/24 = 8</code>  ||style='text-align:center'| ✅
|-
| Network » Cloudflare  || <code>10.20.48.0/21</code>    || <code>10.20.48 … 55.0/24 = 8</code>  ||style='text-align:center'| ⚪️
|-
| Network » Cloudflare  || <code>10.20.56.0/21</code>    || <code>10.20.56 … 63.0/24 = 8</code>  ||style='text-align:center'| ⚪️
|-
| Network » Cloudflare  || <code>10.20.46.0/23</code>    || <code>10.20.46 … 47.0/24 = 2</code>  ||style='text-align:center'| ⚪️
|-
| Network » Cloudflare  || <code>10.20.48.0/23</code>    || <code>10.20.48 … 49.0/24 = 2</code>  ||style='text-align:center'| ✅
|-
| Network » Cloudflare  || <code>10.20.50.0/23</code>    || <code>10.20.50 … 51.0/24 = 2</code>  ||style='text-align:center'| ⚪️
|}
==Cloudflare » WARP » Route » Host==
vim /etc/sysctl.conf
<syntaxhighlight lang="ini" line start="27" highlight="2">
# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1
</syntaxhighlight>
----
sudo sysctl -p
'''net.ipv4.ip_forward = 1'''
ip route | grep default
default via 172.31.1.1 dev eth0 proto dhcp src 65.21.251.38 metric 100
----
<syntaxhighlight lang="bash">
cat << EXE | sudo bash
cat << ENV | tee /etc/default/warp-route >/dev/null
LXC_WARP_CLI_NAME=cloudflare
LXC_WARP_CLI_HOST=$(lxc list -f=json cloudflare | jq -r '.[]|.state.network.eth0.addresses[]|select(.family=="inet")|.address')
ENV
echo
cat /etc/default/warp-route
EXE
</syntaxhighlight>
----
<syntaxhighlight lang="ini">
cat <<'INI' | sudo tee /etc/systemd/system/warp-route.service >/dev/null
[Unit]
Description=WARP Routes Over Clodflare LXC
Wants=network-online.target docker.service snap.lxd.daemon.service containerd.service
After=network-online.target docker.service snap.lxd.daemon.service containerd.service
[Service]
Type=oneshot
EnvironmentFile=-/etc/default/warp-route
ExecStartPre=/bin/sleep 60
ExecStartPre=/bin/bash -c "if [ -z \"${LXC_WARP_CLI_HOST}\" ]; then echo \"Variable LXC_WARP_CLI_HOST not set in /etc/default/warp-route\"; errors_exit; fi"
ExecStart=/usr/sbin/ip route add 10.20.40.0/21 via $LXC_WARP_CLI_HOST
ExecStart=/usr/sbin/ip route add 10.20.48.0/23 via $LXC_WARP_CLI_HOST
ExecStop=/usr/sbin/ip  route del 10.20.40.0/21
ExecStop=/usr/sbin/ip  route del 10.20.48.0/23
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
INI
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
cat << EXE | sudo bash
systemctl daemon-reload
cat /etc/systemd/system/warp-route.service
systemctl enable  --now warp-route.service
systemctl status        warp-route.service
echo && ip route show
echo && sysctl -p
EXE
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
cat << EXE | bash
traceroute 10.20.40.1
traceroute 10.20.41.1
EXE
</syntaxhighlight>
----
<syntaxhighlight lang="bash">
cat << EXE | sudo bash
systemctl daemon-reload
cat /etc/systemd/system/warp-route.service
systemctl disable --now warp-route.service
systemctl status        warp-route.service
echo && ip route show
echo && sysctl -p
EXE
</syntaxhighlight>


==References==
==References==
{|
{|
|valign="top"|
|valign="top"|
* [[Cloudflare/WARP Connector|Cloudflare » WARP Connector]]
* [[Cloudflare/Argo Tunnel|Cloudflare » Argo Tunnel]]
* [[Cloudflare/WARP Host|Cloudflare » WARP Host]]
* [[Cloud Computing Cost]]
* [[OpenLDAP/BackSQL|OpenLDAP » BackSQL]]
* [[OpenLDAP/BackSQL|OpenLDAP » BackSQL]]
* [[Google Cloud CLI]]
* [[EKSctl|AWS » EKS » CLI]]
* [[Swap Space]]
* [[Swap Space]]
* [[Online App]]
* [[OpenLDAP]]
* [[OpenLDAP]]
* [[Cloudflare]]
* [[Terraform]]
* [[AWS CLI]]
* [[CLI App]]
* [[Kubectl]]


|valign="top"|
|valign="top"|
* [[HAProxy]]
* [[Jasypt]]
* [[CURL]]
* [[K8s]]
* [[K9s]]


|valign="top"|
|valign="top"|
|-
| colspan="3" |
----
|-
| valign="top" |
* [[Cloudflare/WARP Connector|Cloudflare » WARP Connector]]
* [[Cloudflare/Argo Tunnel|Cloudflare » Argo Tunnel]]
* [[Cloudflare/WARP Host|Cloudflare » WARP Host]]
* [[Cloud/Shahed/AF|Cloud » Shahed » AF]]
* [[Cloud/Shahed/AL|Cloud » Shahed » AL]]
* [[Cloudflare]]
| valign="top" |
* [https://www.calculator.net/ip-subnet-calculator.html?cclass=b&csubnet=21&cip=10.20.40.0&ctype=ipv4&x=Calculate 10.20.40.0/21 🟢]
* [https://www.calculator.net/ip-subnet-calculator.html?cclass=b&csubnet=21&cip=10.20.40.0&ctype=ipv4&x=Calculate 10.20.48.0/21 ⚪️]
* [https://www.calculator.net/ip-subnet-calculator.html?cclass=b&csubnet=21&cip=10.20.40.0&ctype=ipv4&x=Calculate 10.20.56.0/21 ⚪️]
| valign="top" |
* [https://www.calculator.net/ip-subnet-calculator.html?cclass=b&csubnet=23&cip=10.20.40.0&ctype=ipv4&x=Calculate 10.20.46.0/23 ⚪️]
* [https://www.calculator.net/ip-subnet-calculator.html?cclass=b&csubnet=23&cip=10.20.40.0&ctype=ipv4&x=Calculate 10.20.48.0/23 🟢]
* [https://www.calculator.net/ip-subnet-calculator.html?cclass=b&csubnet=23&cip=10.20.40.0&ctype=ipv4&x=Calculate 10.20.50.0/23 ⚪️]


|-
|-

Latest revision as of 09:27, 21 February 2025

SSH

ssh -i ~/.ssh/cid.chorke.org_ed25519 [email protected]

cat <<'EXE' | sudo bash
free -th && echo && systemd-analyze && echo
df -h    && echo && lsblk && echo
swapon --show
EXE

Add User

# root
passwd

adduser chorke
passwd  chorke

adduser shahed
passwd  shahed

APT Update

cat << EXE | sudo bash
apt-get update;echo
mkdir -p /etc/apt/keyrings
apt list -a --upgradable;apt-get upgrade -y;echo
apt-get install -y apt-transport-https ca-certificates gnupg build-essential snap jq traceroute
apt-get clean cache && find /tmp -type f -atime +10 -delete && find /tmp -type s -atime +10 -delete
EXE

Swap Space

echo 'swapon --show'|sudo bash
cat <<'EXE' | sudo bash
swapoff /swap.img
fallocate -l 20G /swap.img
ls -lh /swap.img && mkswap /swap.img
chmod 0600 /swap.img && swapon /swap.img && swapon --show && free -th
EXE

cat << FST | sudo tee -a /etc/fstab >/dev/null
# loop based swap storage » 16GB + 4GB 
/swap.img              none            swap    sw              0       0
FST

free -th
cat /etc/fstab 
echo 'swapon --show'|sudo bash

Utility » Tool

cat << EXE|sudo bash
PLATFORM=\$(uname -s)_\$(dpkg --print-architecture)
YQ_BINARY=\$(echo "yq_\${PLATFORM}"|tr '[:upper:]' '[:lower:]')
wget https://github.com/mikefarah/yq/releases/latest/download/\${YQ_BINARY} -O /usr/bin/yq && chmod +x /usr/bin/yq
EXE

Containerize » LXD

cat << EXE | sudo bash
snap install lxd --channel=6/stable
usermod -aG lxd chorke
usermod -aG lxd shahed
EXE

echo 'id -nG'|sudo -i -u chorke bash
echo 'id -nG'|sudo -i -u shahed bash

cat <<YML | sudo lxd init --preseed
---
config: {}
networks:
- config:
    ipv4.address: 10.20.0.1/24
    ipv4.nat: "true"
    ipv6.address: auto
  description: ""
  name: lxdbr0
  type: ""
  project: default
storage_pools:
- config:
    size: 30GiB
  description: ""
  name: lxd-zfs-pool-aa
  driver: zfs
storage_volumes: []
profiles:
- config: {}
  description: ""
  devices:
    eth0:
      name: eth0
      network: lxdbr0
      type: nic
    root:
      path: /
      pool: lxd-zfs-pool-aa
      type: disk
  name: default
projects: []
cluster: null
YML

sudo ufw enable
sudo iptables -S

cat << EXE | sudo bash
ufw       allow OpenSSH
ufw       allow in  on lxdbr0
ufw route allow in  on lxdbr0
ufw route allow out on lxdbr0
EXE

sudo ufw status numbered
sudo iptables -S

cat << EXE | sudo bash
snap restart  lxd
snap services lxd
EXE

Containerize » Docker

curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
| sudo tee /etc/apt/keyrings/docker.asc >/dev/null

DISTRIBUTION=$(. /etc/os-release && echo "${VERSION_CODENAME}")
cat << SRC | sudo tee /etc/apt/sources.list.d/docker.list >/dev/null
deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu ${DISTRIBUTION}  stable
SRC

cat << EXE | sudo bash
apt-get update;echo
apt-cache policy docker-ce
apt list -a --upgradable;apt-get upgrade -y;echo
apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
apt-get clean cache && find /tmp -type f,s -atime +10 -delete
EXE

cat << EOF | sudo tee /etc/docker/daemon.json >/dev/null
{
    "bip"  : "10.20.13.1/24",
    "mtu"  : 1500,
    "dns"  : [
        "8.8.8.8",
        "8.8.4.4"
    ],
    "debug": true
}
EOF

cat << EXE | sudo bash
systemctl stop  docker.socket
systemctl stop  docker.service
systemctl start docker.service

usermod -aG docker chorke
usermod -aG docker shahed
EXE

ip a
docker image ls
docker network ls

echo 'id -nG'|sudo -i -u shahed bash
echo 'id -nG'|sudo -i -u chorke bash

docker run --rm alpine cat /etc/hosts
docker run --rm alpine cat /etc/resolv.conf

Cloudflare » VIRT

cat << INI | sudo tee /etc/systemd/system/warp0.service >/dev/null
[Unit]
Description=Cloudflared WARP Routing Virtual Interface
After=network.target
[Service]
Type=oneshot
ExecStart=/usr/sbin/ip link add warp0 type dummy
ExecStartPost=/usr/sbin/ip addr add 10.20.41.1/32 dev warp0
ExecStartPost=/usr/sbin/ip link set warp0 up
ExecStop=/usr/sbin/ip link delete warp0
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
INI

cat << EXE | sudo bash
systemctl daemon-reload
systemctl enable --now warp0.service
systemctl status       warp0.service
EXE

ip a

Cloudflare » Argo » Tunnel

wget -cq https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-arm64.deb -P ${HOME}/Downloads
sudo dpkg -i ${HOME}/Downloads/cloudflared-linux-arm64.deb; sudo apt install -f
      rm -rf ${HOME}/Downloads/cloudflared-linux-arm64.deb

cat <<'SYS' | sudo tee -a /etc/sysctl.conf >/dev/null

###################################################################
# Cloudflared Tunnel Private Network Config
# This config added by Chorke Academia, Inc
# ICMP Group ID Range 0 to 10,000 Users
net.ipv4.ping_group_range = 0 10000

# 208 KiB Default RX Buffer
net.core.rmem_default=212992

# 208 KiB Default TX Buffer
net.core.wmem_default=212992

# 8 MB Maximum RX Buffer
net.core.rmem_max=8388608

# 8 MB Maximum TX Buffer
net.core.wmem_max=8388608

SYS

sudo sysctl -p

Skipped » Find More » 👈

Cloudflare » WARP » Tunnel

lxc launch ubuntu:24.04 cloudflare
lxc list -c=n -f=json|jq -r '.[]|select(.name=="cloudflare")|.status'

cat <<'EXE' | lxc exec cloudflare -- bash
apt-get update;echo
mkdir -p /etc/apt/keyrings
apt list -a --upgradable;apt-get upgrade -y;echo
apt-get install -y apt-transport-https ca-certificates gnupg jq && apt-get clean
EXE

cat <<'EXE' | lxc exec cloudflare -- bash
curl -fsSL https://pkg.cloudflareclient.com/pubkey.gpg \
 | sudo tee /etc/apt/keyrings/cloudflare.asc >/dev/null

DISTRIBUTION=$(. /etc/os-release && echo "${VERSION_CODENAME}");\
cat << SRC | sudo tee /etc/apt/sources.list.d/cloudflare.list >/dev/null
deb [arch=$(dpkg --print-architecture)\
 signed-by=/etc/apt/keyrings/cloudflare.asc]\
 https://pkg.cloudflareclient.com/ ${DISTRIBUTION} main
SRC

cat /etc/apt/sources.list.d/cloudflare.list
cat /etc/apt/keyrings/cloudflare.asc
EXE

cat <<'EXE' | lxc exec cloudflare -- bash
apt-get update;echo
apt list -a --upgradable;apt-get upgrade -y;echo
apt-get install -y cloudflare-warp && apt-get clean
EXE

lxc exec cloudflare -- bash
sudo vim /etc/sysctl.conf

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1

sudo sysctl -p
net.ipv4.ip_forward = 1

ip route | grep default
default via 10.20.0.1 dev eth0 proto dhcp src 10.20.0.161 metric 100

lxc snapshot cloudflare base:2024.12.554.0
lxc publish  cloudflare/base:2024.12.554.0 --alias cloudflare/base:2024.12.554.0
lxc restore  cloudflare base:2024.12.554.0

lxc exec cloudflare -- bash
sudo warp-cli status

cat <<'EXE' | lxc exec cloudflare -- bash
warp-cli connector new eyJhIjoiNW…
warp-cli connect
EXE

cat << EXE | lxc exec cloudflare -- bash
warp-cli status
systemctl daemon-reload
systemctl enable --now warp-svc.service
systemctl status       warp-svc.service
EXE

cat << EXE | lxc exec cloudflare -- bash
echo iptables-persistent iptables-persistent/autosave_v4 boolean true | debconf-set-selections
echo iptables-persistent iptables-persistent/autosave_v6 boolean true | debconf-set-selections
apt-get -y install iptables-persistent && apt-get clean cache
EXE

cat << EXE | lxc exec cloudflare -- bash
# allow forwarding traffic from host
iptables -A FORWARD -i eth0 -o CloudflareWARP -j ACCEPT
iptables -A FORWARD -i CloudflareWARP -o eth0 -j ACCEPT

# cloudflarewarp nat gateway setup for host
iptables -t nat -A POSTROUTING -o CloudflareWARP -j MASQUERADE

# persist across reboots, save the rules
        mkdir -p /etc/iptables/
iptables-save  > /etc/iptables/rules.v4
ip6tables-save > /etc/iptables/rules.v6
EXE

lxc snapshot cloudflare init:2025.02.16
lxc publish  cloudflare/init:2025.02.16 --alias cloudflare/init:2025.02.16
lxc restore  cloudflare init:2025.02.16

Skipped » Find More » 👈

Cloudflare » WARP » Exclude

Settings » 0Trust » WARP Client » Device settings » Profile settings » Default » Configure »
Split Tunnels » Exclude IPs and domains » Manage » Manage Split Tunnels
Name Network Exclude
Network » OpenVPN 10.20.30.0/24 ✅
Network » Hetzner 10.20.31.0/24 ✅
Network » Docker 10.20.13.0/24 ✅
Network » Home 10.19.83.0/24 ✅
Network » LXD 10.20.0.0/24 ✅

Cloudflare » WARP » Forward

Implement Forward Routing
Name Network Subnets Forward
Network » Cloudflare 10.20.40.0/21 10.20.40 … 47.0/24 = 8 ✅
Network » Cloudflare 10.20.48.0/21 10.20.48 … 55.0/24 = 8 ⚪️
Network » Cloudflare 10.20.56.0/21 10.20.56 … 63.0/24 = 8 ⚪️
Network » Cloudflare 10.20.46.0/23 10.20.46 … 47.0/24 = 2 ⚪️
Network » Cloudflare 10.20.48.0/23 10.20.48 … 49.0/24 = 2 ✅
Network » Cloudflare 10.20.50.0/23 10.20.50 … 51.0/24 = 2 ⚪️

Cloudflare » WARP » Route » Host

vim /etc/sysctl.conf

# Uncomment the next line to enable packet forwarding for IPv4
net.ipv4.ip_forward=1

sudo sysctl -p
net.ipv4.ip_forward = 1

ip route | grep default
default via 172.31.1.1 dev eth0 proto dhcp src 65.21.251.38 metric 100

cat << EXE | sudo bash
cat << ENV | tee /etc/default/warp-route >/dev/null
LXC_WARP_CLI_NAME=cloudflare
LXC_WARP_CLI_HOST=$(lxc list -f=json cloudflare | jq -r '.[]|.state.network.eth0.addresses[]|select(.family=="inet")|.address')
ENV
echo
cat /etc/default/warp-route
EXE

cat <<'INI' | sudo tee /etc/systemd/system/warp-route.service >/dev/null
[Unit]
Description=WARP Routes Over Clodflare LXC
Wants=network-online.target docker.service snap.lxd.daemon.service containerd.service
After=network-online.target docker.service snap.lxd.daemon.service containerd.service

[Service]
Type=oneshot
EnvironmentFile=-/etc/default/warp-route

ExecStartPre=/bin/sleep 60
ExecStartPre=/bin/bash -c "if [ -z \"${LXC_WARP_CLI_HOST}\" ]; then echo \"Variable LXC_WARP_CLI_HOST not set in /etc/default/warp-route\"; errors_exit; fi"
ExecStart=/usr/sbin/ip route add 10.20.40.0/21 via $LXC_WARP_CLI_HOST
ExecStart=/usr/sbin/ip route add 10.20.48.0/23 via $LXC_WARP_CLI_HOST
ExecStop=/usr/sbin/ip  route del 10.20.40.0/21
ExecStop=/usr/sbin/ip  route del 10.20.48.0/23
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
INI

cat << EXE | sudo bash
systemctl daemon-reload
cat /etc/systemd/system/warp-route.service
systemctl enable  --now warp-route.service
systemctl status        warp-route.service
echo && ip route show
echo && sysctl -p
EXE

cat << EXE | bash
traceroute 10.20.40.1
traceroute 10.20.41.1
EXE

cat << EXE | sudo bash
systemctl daemon-reload
cat /etc/systemd/system/warp-route.service
systemctl disable --now warp-route.service
systemctl status        warp-route.service
echo && ip route show
echo && sysctl -p
EXE

References

Retrieved from "https://cdn.chorke.org/weke/index.php?title=Cloud/Hetzner/AA&oldid=14119"