diff --git a/app.py b/app.py index 9c763bf..5037a09 100644 --- a/app.py +++ b/app.py @@ -46,7 +46,7 @@ from managers.awg_manager import AWGManager from managers.xray_manager import XrayManager from managers.wireguard_manager import WireGuardManager from managers.backup_manager import BackupManager -from managers.cascade_manager import CascadeManager +from managers.cascade_manager import CascadeManager, normalize_settings, DEFAULT_SETTINGS as CASCADE_DEFAULT_SETTINGS import telegram_bot as tg_bot # Configure logging @@ -1449,6 +1449,18 @@ class CascadeSetupRequest(BaseModel): exit_server_id: Optional[int] = None exit_protocol: str = 'awg2' enabled: bool = True + # Per-step cascade tuning + pin_exit_route: Optional[bool] = True + remove_eth_masquerade: Optional[bool] = True + force_forward: Optional[bool] = True + mss_clamp: Optional[bool] = True + wait_handshake: Optional[bool] = True + handshake_timeout_sec: Optional[int] = 25 + allowed_ips: Optional[str] = '0.0.0.0/0, ::/0' + keep_exit_dns: Optional[bool] = False + vpn_subnet_override: Optional[str] = '' + table_id: Optional[int] = 200 + rule_priority: Optional[int] = 100 class ContainerLogsRequest(BaseModel): @@ -2792,6 +2804,7 @@ async def api_cascade_get(request: Request, server_id: int): return { 'cascade': cascade, 'live': live, + 'defaults': CASCADE_DEFAULT_SETTINGS, 'servers': [ { 'id': i, @@ -2822,12 +2835,28 @@ async def api_cascade_setup(request: Request, server_id: int, req: CascadeSetupR if server_id >= len(data['servers']): return JSONResponse({'error': 'Server not found'}, status_code=404) entry = data['servers'][server_id] + settings = normalize_settings({ + 'pin_exit_route': req.pin_exit_route, + 'remove_eth_masquerade': req.remove_eth_masquerade, + 'force_forward': req.force_forward, + 'mss_clamp': req.mss_clamp, + 'wait_handshake': req.wait_handshake, + 'handshake_timeout_sec': req.handshake_timeout_sec, + 'allowed_ips': req.allowed_ips, + 'keep_exit_dns': req.keep_exit_dns, + 'vpn_subnet_override': req.vpn_subnet_override, + 'table_id': req.table_id, + 'rule_priority': req.rule_priority, + }) if not req.enabled: def _disable(): ssh = get_ssh(entry) ssh.connect() try: - return CascadeManager(ssh).disable(req.entry_protocol) + return CascadeManager(ssh).disable( + req.entry_protocol, + settings=dict((entry.get('cascade') or {}).get('settings') or settings), + ) finally: ssh.disconnect() @@ -2840,6 +2869,7 @@ async def api_cascade_setup(request: Request, server_id: int, req: CascadeSetupR 'entry_protocol': req.entry_protocol or prev.get('entry_protocol'), 'exit_server_id': prev.get('exit_server_id'), 'exit_protocol': prev.get('exit_protocol') or req.exit_protocol, + 'settings': settings, 'updated_at': datetime.now().isoformat(timespec='seconds'), } await save_data_async(data) @@ -2914,6 +2944,7 @@ async def api_cascade_setup(request: Request, server_id: int, req: CascadeSetupR req.entry_protocol, conf, exit_srv.get('host') or '', + settings=settings, ) finally: entry_ssh.disconnect() @@ -2928,6 +2959,7 @@ async def api_cascade_setup(request: Request, server_id: int, req: CascadeSetupR } info = await asyncio.to_thread(_enable) + applied = info.get('applied') or {} entry['cascade'] = { 'enabled': True, 'entry_protocol': req.entry_protocol, @@ -2935,12 +2967,15 @@ async def api_cascade_setup(request: Request, server_id: int, req: CascadeSetupR 'exit_protocol': req.exit_protocol, 'exit_client_id': info['client_id'], 'exit_client_name': info['client_name'], - 'up': bool((info.get('applied') or {}).get('up')), + 'settings': settings, + 'up': bool(applied.get('up')), + 'handshake': bool(applied.get('handshake')), 'updated_at': datetime.now().isoformat(timespec='seconds'), 'last_error': None, + 'diagnostics': applied.get('diagnostics') or '', } await save_data_async(data) - return {'status': 'success', 'cascade': entry['cascade'], 'applied': info.get('applied')} + return {'status': 'success', 'cascade': entry['cascade'], 'applied': applied} except Exception as e: logger.exception("Error setting up cascade") return JSONResponse({'error': str(e)}, status_code=500) diff --git a/managers/cascade_manager.py b/managers/cascade_manager.py index f8c3257..928b292 100644 --- a/managers/cascade_manager.py +++ b/managers/cascade_manager.py @@ -12,11 +12,50 @@ from __future__ import annotations import re import shlex from datetime import datetime +from typing import Any, Optional WG_FAMILY = {'awg', 'awg2', 'awg_legacy', 'wireguard'} CASCADE_MARKER = '# amnezia-web-panel-cascade' +DEFAULT_SETTINGS = { + 'pin_exit_route': True, # host route to exit IP via real gateway + 'remove_eth_masquerade': True, # stop NATing VPN clients out entry eth0/eth1 + 'force_forward': True, # FORWARD accept between awg0/wg0 and cascade + 'mss_clamp': True, # fix broken TCP / endless page load + 'wait_handshake': True, # fail if exit tunnel has no handshake + 'handshake_timeout_sec': 25, + 'allowed_ips': '0.0.0.0/0, ::/0', + 'keep_exit_dns': False, # keep DNS= from exit client config + 'vpn_subnet_override': '', # e.g. 10.8.1.0/24; empty = auto + 'table_id': 200, + 'rule_priority': 100, +} + + +def normalize_settings(raw: Optional[dict]) -> dict: + settings = dict(DEFAULT_SETTINGS) + if isinstance(raw, dict): + for key, default in DEFAULT_SETTINGS.items(): + if key not in raw or raw[key] is None: + continue + if isinstance(default, bool): + settings[key] = bool(raw[key]) + elif isinstance(default, int): + try: + settings[key] = int(raw[key]) + except (TypeError, ValueError): + settings[key] = default + else: + settings[key] = str(raw[key]).strip() + # Sanity clamps + settings['handshake_timeout_sec'] = max(5, min(120, int(settings['handshake_timeout_sec']))) + settings['table_id'] = max(1, min(252, int(settings['table_id']))) + settings['rule_priority'] = max(1, min(32765, int(settings['rule_priority']))) + if not settings.get('allowed_ips'): + settings['allowed_ips'] = DEFAULT_SETTINGS['allowed_ips'] + return settings + class CascadeManager: def __init__(self, ssh_manager): @@ -76,20 +115,27 @@ class CascadeManager: return '/opt/amnezia/awg/awg0.conf' @staticmethod - def prepare_exit_client_config(raw_config: str, endpoint_host: str) -> str: + def prepare_exit_client_config( + raw_config: str, + endpoint_host: str, + *, + keep_dns: bool = False, + allowed_ips: str = '0.0.0.0/0, ::/0', + ) -> str: """Adapt a normal client config for use as an entry→exit cascade tunnel.""" lines = [] in_interface = False + in_peer = False has_table = False for raw in (raw_config or '').splitlines(): - line = raw.rstrip('\n') - stripped = line.strip() + stripped = raw.strip() lower = stripped.lower() if stripped.startswith('[') and stripped.endswith(']'): in_interface = stripped.lower() == '[interface]' + in_peer = stripped.lower() == '[peer]' lines.append(stripped) continue - if in_interface and lower.startswith('dns'): + if in_interface and lower.startswith('dns') and not keep_dns: continue if in_interface and lower.startswith('table'): has_table = True @@ -107,6 +153,9 @@ class CascadeManager: else: lines.append(stripped) continue + if in_peer and lower.startswith('allowedips'): + lines.append(f'AllowedIPs = {allowed_ips}') + continue lines.append(stripped) if not has_table: @@ -131,29 +180,44 @@ class CascadeManager: def status(self, entry_protocol: str) -> dict: container = self._container_name(entry_protocol) if not container: - return {'enabled': False, 'up': False, 'error': 'Unsupported protocol'} + return {'enabled': False, 'up': False, 'handshake': False, 'error': 'Unsupported protocol'} conf = self._cascade_conf(entry_protocol) wg_bin = self._wg_binary(entry_protocol) out, _, _ = self.ssh.run_sudo_command( f"docker exec {shlex.quote(container)} bash -lc " - f"'test -f {shlex.quote(conf)} && echo HAS_CONF; " - f"ip -o link show cascade 2>/dev/null | head -1; " - f"{wg_bin} show interfaces 2>/dev/null'" + f"'echo HAS=$(test -f {shlex.quote(conf)} && echo 1 || echo 0); " + f"echo IFACES=$({wg_bin} show interfaces 2>/dev/null); " + f"echo HANDSHAKE=$({wg_bin} show cascade latest-handshakes 2>/dev/null | awk \"{{print \\$2}}\" | head -1); " + f"echo TRANSFER=$({wg_bin} show cascade transfer 2>/dev/null | head -1); " + f"ip rule show 2>/dev/null | head -20; " + f"ip route show table 200 2>/dev/null | head -10'" ) text = out or '' - ifaces = [] + has_conf = 'HAS=1' in text + ifaces_line = '' + handshake_ts = 0 for line in text.splitlines(): - if line.strip() == 'HAS_CONF': - continue - ifaces.extend(line.split()) - up = 'cascade' in ifaces or bool(re.search(r'\bcascade\b', text)) + if line.startswith('IFACES='): + ifaces_line = line.split('=', 1)[1].strip() + if line.startswith('HANDSHAKE='): + try: + handshake_ts = int(line.split('=', 1)[1].strip() or '0') + except ValueError: + handshake_ts = 0 + up = 'cascade' in ifaces_line.split() + # WireGuard reports unix timestamp; 0 means never + handshake_ok = handshake_ts > 0 return { - 'enabled': 'HAS_CONF' in text, + 'enabled': has_conf, 'up': up, - 'raw': text.strip()[:2000], + 'handshake': handshake_ok, + 'handshake_ts': handshake_ts, + 'raw': text.strip()[:3000], } - def _vpn_subnet(self, entry_protocol: str, container: str) -> str: + def _vpn_subnet(self, entry_protocol: str, container: str, override: str = '') -> str: + if override and re.match(r'^\d+\.\d+\.\d+\.\d+/\d+$', override.strip()): + return override.strip() conf = self._server_conf(entry_protocol) out, _, _ = self.ssh.run_sudo_command( f"docker exec {shlex.quote(container)} bash -lc " @@ -173,7 +237,14 @@ class CascadeManager: return f"{parts[0]}.{parts[1]}.{parts[2]}.0/24" return '10.8.1.0/24' - def apply(self, entry_protocol: str, exit_client_config: str, exit_host: str) -> dict: + def apply( + self, + entry_protocol: str, + exit_client_config: str, + exit_host: str, + settings: Optional[dict] = None, + ) -> dict: + opts = normalize_settings(settings) container = self._container_name(entry_protocol) if not container: return {'status': 'error', 'message': 'Unsupported entry protocol'} @@ -186,12 +257,87 @@ class CascadeManager: cascade_conf_path = self._cascade_conf(entry_protocol) cascade_up_path = self._cascade_up(entry_protocol) - cascade_conf = self.prepare_exit_client_config(exit_client_config, exit_host) + cascade_conf = self.prepare_exit_client_config( + exit_client_config, + exit_host, + keep_dns=bool(opts['keep_exit_dns']), + allowed_ips=str(opts['allowed_ips']), + ) endpoint_host = self._extract_endpoint_host(cascade_conf) or exit_host - subnet = self._vpn_subnet(entry_protocol, container) + subnet = self._vpn_subnet(entry_protocol, container, opts.get('vpn_subnet_override') or '') wg_bin = self._wg_binary(entry_protocol) quick_bin = self._quick_binary(entry_protocol) conf_dir = self._conf_dir(entry_protocol) + table_id = int(opts['table_id']) + prio = int(opts['rule_priority']) + hs_timeout = int(opts['handshake_timeout_sec']) + + pin_block = '' + if opts['pin_exit_route']: + pin_block = f""" +EXIT_IP="$EXIT_HOST" +if ! printf '%s' "$EXIT_IP" | grep -Eq '^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$'; then + EXIT_IP=$(getent ahostsv4 "$EXIT_HOST" 2>/dev/null | awk '{{print $1; exit}}') + if [ -z "$EXIT_IP" ]; then + EXIT_IP=$(python3 - <<'PY' 2>/dev/null || true +import socket +print(socket.gethostbyname("{endpoint_host}")) +PY +) + fi +fi +GW=$(ip route | awk '/default/ {{print $3; exit}}') +DEV=$(ip route | awk '/default/ {{print $5; exit}}') +if [ -n "$EXIT_IP" ] && [ -n "$GW" ] && [ -n "$DEV" ]; then + ip route replace "$EXIT_IP/32" via "$GW" dev "$DEV" 2>/dev/null || true +fi +""" + + remove_masq = '' + if opts['remove_eth_masquerade']: + remove_masq = f""" +# Stop leaking VPN clients out of the entry server NIC +for ETH in eth0 eth1 eth2 ens3 ens5 enp0s3 enp1s0; do + while iptables -t nat -D POSTROUTING -s "$SUBNET" -o "$ETH" -j MASQUERADE 2>/dev/null; do :; done +done +""" + + forward_block = '' + if opts['force_forward']: + forward_block = f""" +sysctl -w net.ipv4.ip_forward=1 >/dev/null 2>&1 || true +for SRC_IF in awg0 wg0; do + iptables -C FORWARD -i "$SRC_IF" -o "$IFACE" -j ACCEPT 2>/dev/null \\ + || iptables -I FORWARD 1 -i "$SRC_IF" -o "$IFACE" -j ACCEPT 2>/dev/null || true + iptables -C FORWARD -i "$IFACE" -o "$SRC_IF" -j ACCEPT 2>/dev/null \\ + || iptables -I FORWARD 1 -i "$IFACE" -o "$SRC_IF" -j ACCEPT 2>/dev/null || true +done +iptables -C FORWARD -i "$IFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null \\ + || iptables -I FORWARD 1 -i "$IFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT +""" + + mss_block = '' + if opts['mss_clamp']: + mss_block = """ +iptables -t mangle -C FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null \\ + || iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu +""" + + handshake_block = '' + if opts['wait_handshake']: + handshake_block = f""" +OK=0 +for i in $(seq 1 {hs_timeout}); do + HS=$({shlex.quote(wg_bin)} show "$IFACE" latest-handshakes 2>/dev/null | awk '{{print $2}}' | head -1) + if [ -n "$HS" ] && [ "$HS" != "0" ]; then OK=1; break; fi + sleep 1 +done +if [ "$OK" != "1" ]; then + echo "CASCADE_NO_HANDSHAKE" >&2 + echo "Tunnel interface is up but exit peer did not handshake. Check exit server / UDP port / keys." >&2 + exit 42 +fi +""" up_script = f"""#!/bin/bash {CASCADE_MARKER} @@ -201,35 +347,29 @@ QUICK={shlex.quote(quick_bin)} SUBNET={shlex.quote(subnet)} EXIT_HOST={shlex.quote(endpoint_host)} IFACE=cascade +TABLE={table_id} +PRIO={prio} "$QUICK" down "$CONF" 2>/dev/null || true ip link delete "$IFACE" 2>/dev/null || true +ip rule del from "$SUBNET" table "$TABLE" 2>/dev/null || true +ip route flush table "$TABLE" 2>/dev/null || true -# Resolve hostname to IP if needed (pin route must use IP) -EXIT_IP="$EXIT_HOST" -if ! printf '%s' "$EXIT_IP" | grep -Eq '^[0-9]+\\.[0-9]+\\.[0-9]+\\.[0-9]+$'; then - EXIT_IP=$(getent ahostsv4 "$EXIT_HOST" 2>/dev/null | awk '{{print $1; exit}}') -fi -GW=$(ip route | awk '/default/ {{print $3; exit}}') -DEV=$(ip route | awk '/default/ {{print $5; exit}}') -if [ -n "$EXIT_IP" ] && [ -n "$GW" ] && [ -n "$DEV" ]; then - ip route replace "$EXIT_IP/32" via "$GW" dev "$DEV" 2>/dev/null || true -fi +{pin_block} "$QUICK" up "$CONF" -ip route replace default dev "$IFACE" table 200 2>/dev/null || ip route add default dev "$IFACE" table 200 -ip rule del from "$SUBNET" table 200 2>/dev/null || true -ip rule add from "$SUBNET" table 200 priority 100 +# Source-based routing: VPN clients go through cascade iface +ip route replace default dev "$IFACE" table "$TABLE" 2>/dev/null || ip route add default dev "$IFACE" table "$TABLE" +ip rule del from "$SUBNET" table "$TABLE" 2>/dev/null || true +ip rule add from "$SUBNET" table "$TABLE" priority "$PRIO" -for SRC_IF in awg0 wg0; do - iptables -C FORWARD -i "$SRC_IF" -o "$IFACE" -j ACCEPT 2>/dev/null \\ - || iptables -I FORWARD 1 -i "$SRC_IF" -o "$IFACE" -j ACCEPT 2>/dev/null || true -done -iptables -C FORWARD -i "$IFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT 2>/dev/null \\ - || iptables -I FORWARD 1 -i "$IFACE" -m state --state RELATED,ESTABLISHED -j ACCEPT +{remove_masq} +{forward_block} iptables -t nat -C POSTROUTING -s "$SUBNET" -o "$IFACE" -j MASQUERADE 2>/dev/null \\ || iptables -t nat -A POSTROUTING -s "$SUBNET" -o "$IFACE" -j MASQUERADE +{mss_block} +{handshake_block} echo CASCADE_UP_OK """ @@ -249,12 +389,21 @@ echo CASCADE_UP_OK out, err, code = self.ssh.run_sudo_command( f"docker exec {shlex.quote(container)} bash {shlex.quote(cascade_up_path)}", - timeout=90, + timeout=max(90, hs_timeout + 40), ) + combined = ((out or '') + '\n' + (err or '')).strip() if code != 0 or 'CASCADE_UP_OK' not in (out or ''): + msg = combined + if 'CASCADE_NO_HANDSHAKE' in combined: + msg = ( + 'Туннель к серверу выхода поднят, но handshake не прошёл. ' + 'Проверьте, что на выходе открыт UDP-порт, протокол совпадает, ' + 'и входной сервер может достучаться до IP выхода.' + ) return { 'status': 'error', - 'message': (err or out or 'Failed to bring cascade interface up').strip()[:800], + 'message': (msg or 'Failed to bring cascade interface up').strip()[:900], + 'log': combined[:2000], } st = self.status(entry_protocol) @@ -264,7 +413,10 @@ echo CASCADE_UP_OK 'endpoint': endpoint_host, 'container': container, 'up': bool(st.get('up')), + 'handshake': bool(st.get('handshake')), + 'settings': opts, 'applied_at': datetime.now().isoformat(timespec='seconds'), + 'diagnostics': st.get('raw', '')[:1500], } def _ensure_start_hook(self, container: str, cascade_up_path: str) -> None: @@ -285,24 +437,26 @@ printf '%s\\n' 'if [ -x {cascade_up_path} ]; then bash {cascade_up_path} || true ) self.ssh.run_command('rm -f /tmp/_amnz_cascade_hook.sh') - def disable(self, entry_protocol: str) -> dict: + def disable(self, entry_protocol: str, settings: Optional[dict] = None) -> dict: + opts = normalize_settings(settings) container = self._container_name(entry_protocol) if not container: return {'status': 'error', 'message': 'Unsupported entry protocol'} conf = self._cascade_conf(entry_protocol) up = self._cascade_up(entry_protocol) quick_bin = self._quick_binary(entry_protocol) - # Avoid nested quotes issues: upload a small script + table_id = int(opts['table_id']) script = f"""#!/bin/bash set +e QUICK={shlex.quote(quick_bin)} CONF={shlex.quote(conf)} UP={shlex.quote(up)} +TABLE={table_id} "$QUICK" down "$CONF" 2>/dev/null ip link delete cascade 2>/dev/null -ip rule del table 200 2>/dev/null -ip rule del table 200 2>/dev/null -ip route flush table 200 2>/dev/null +ip rule del table "$TABLE" 2>/dev/null +ip rule del table "$TABLE" 2>/dev/null +ip route flush table "$TABLE" 2>/dev/null rm -f "$CONF" "$UP" echo CASCADE_DOWN_OK """ diff --git a/templates/server.html b/templates/server.html index fe6043d..f43664f 100644 --- a/templates/server.html +++ b/templates/server.html @@ -522,6 +522,84 @@
{{ _('cascade_hint') }}
+ +
+ {{ _('cascade_settings_title') }} +

{{ _('cascade_settings_desc') }}

+
+ + + + + + +
+
+
+ + +
+
+ + +
+
+ + +
+
+
+
+ + + {{ _('cascade_opt_allowed_ips_hint') }} +
+
+ + + {{ _('cascade_opt_vpn_subnet_hint') }} +
+
+
+ + +