=== STEP_033H3 WGPAY EXACT PEER PLAN === timestamp=20260708-112956 mode=read-only / package only goal: confirm exact wg_paid peer count and prepare correct canary source model note: DHCP leases are intentionally irrelevant for WGPay === VM100 wg_paid exact state === date=Wed Jul 8 11:29:57 UTC 2026 === ip -br addr === lo UNKNOWN 127.0.0.1/8 ::1/128 eth0 UP 10.201.0.1/24 fe80::be24:11ff:fe94:bbfb/64 eth1 UP eth2 UP 10.200.0.1/24 fe80::be24:11ff:fee4:6cfb/64 br-lan UP 10.71.100.1/24 fe80::be24:11ff:feee:7d14/64 wg_paid UNKNOWN 10.253.1.1/16 wg_remote UNKNOWN 10.250.100.1/24 === wg_paid show === interface: wg_paid public key: FD1J+KVZ965pCjgtO0YWxJsKANY9uz6v1P54JLkiZzY= private key: (hidden) listening port: 51830 === wg_paid dump === 4HdlxlrT3zfHmoWXFYrbsPLlrNf/baQGIVRizcqCvW0= FD1J+KVZ965pCjgtO0YWxJsKANY9uz6v1P54JLkiZzY= 51830 off === exact peer counts === wgpaid_peers_raw= wgpaid_runtime_peer_count=0 wgpaid_uci_peer_count=0 === UCI wg_paid only === network.wg_paid=interface network.wg_paid.proto='wireguard' network.wg_paid.private_key='4HdlxlrT3zfHmoWXFYrbsPLlrNf/baQGIVRizcqCvW0=' network.wg_paid.listen_port='51830' network.wg_paid.addresses='10.253.1.1/16' === route/firewall relevant === default via 10.200.0.2 dev eth2 proto static metric 20 10.200.0.0/24 dev eth2 proto static scope link metric 20 10.253.0.0/16 dev wg_paid proto kernel scope link src 10.253.1.1 firewall.@zone[0]=zone firewall.@zone[0].name='lan' firewall.@zone[0].input='ACCEPT' firewall.@zone[0].output='ACCEPT' firewall.@zone[0].forward='ACCEPT' firewall.@zone[0].network='lan' firewall.@zone[1]=zone firewall.@zone[1].name='transit_direct' firewall.@zone[1].input='ACCEPT' firewall.@zone[1].output='ACCEPT' firewall.@zone[1].forward='REJECT' firewall.@zone[1].network='transit_direct' firewall.@zone[1].masq='1' firewall.@zone[1].mtu_fix='1' firewall.@forwarding[0]=forwarding firewall.@forwarding[0].src='lan' firewall.@forwarding[0].dest='transit_direct' firewall.@zone[2]=zone firewall.@zone[2].name='transit_vpn' firewall.@zone[2].input='ACCEPT' firewall.@zone[2].output='ACCEPT' firewall.@zone[2].forward='REJECT' firewall.@zone[2].masq='1' firewall.@zone[2].mtu_fix='1' firewall.@zone[2].network='transit_vpn' firewall.@forwarding[1]=forwarding firewall.@forwarding[1].src='lan' firewall.@forwarding[1].dest='transit_vpn' firewall.@zone[3]=zone firewall.@zone[3].name='remote_in' firewall.@zone[3].input='ACCEPT' firewall.@zone[3].output='ACCEPT' firewall.@zone[3].forward='ACCEPT' firewall.@zone[3].network='wg_remote' firewall.@forwarding[2]=forwarding firewall.@forwarding[2].src='remote_in' firewall.@forwarding[2].dest='lan' firewall.@forwarding[3]=forwarding firewall.@forwarding[3].src='remote_in' firewall.@forwarding[3].dest='transit_direct' firewall.@forwarding[4]=forwarding firewall.@forwarding[4].src='remote_in' firewall.@forwarding[4].dest='transit_vpn' firewall.@rule[0].src='transit_direct' firewall.@rule[1].src='remote_in' firewall.@rule[2].src='remote_in' firewall.@rule[2].dest='lan' firewall.@rule[3].src='remote_in' firewall.@rule[4].src='remote_in' firewall.@rule[4].dest='lan' firewall.@rule[5].src='remote_in' firewall.@rule[5].dest='lan' firewall.@rule[6].src='remote_in' firewall.@rule[6].dest='lan' firewall.wg_paid=zone firewall.wg_paid.name='wg_paid' firewall.wg_paid.input='ACCEPT' firewall.wg_paid.output='ACCEPT' firewall.wg_paid.forward='REJECT' firewall.wg_paid.network='wg_paid' firewall.wg_paid_to_transit_direct=forwarding firewall.wg_paid_to_transit_direct.src='wg_paid' firewall.wg_paid_to_transit_direct.dest='transit_direct' firewall.wg_paid_to_transit_vpn=forwarding firewall.wg_paid_to_transit_vpn.src='wg_paid' firewall.wg_paid_to_transit_vpn.dest='transit_vpn' firewall.allow_wg_paid_51830=rule firewall.allow_wg_paid_51830.name='Allow-WG-Paid-51830' firewall.allow_wg_paid_51830.proto='udp' firewall.allow_wg_paid_51830.dest_port='51830' firewall.allow_wg_paid_51830.target='ACCEPT' === nft relevant wg_paid / DSCP / mark / NAT === 122.10.164.0-122.10.195.255, 122.10.200.0-122.10.219.255, 194.110.253.0/24, 194.113.34.0/23, 10.252.100.0/24, 10.253.0.0/16 } chain wg_remote_snat_to_pc { type nat hook postrouting priority srcnat - 1; policy accept; ip saddr 10.250.0.0/24 ip daddr 192.168.30.64 oifname "br-lan" counter packets 0 bytes 0 snat ip to 192.168.30.1 comment "wg_remote_to_pc64_snat" iifname "wg_paid" jump input_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 input traffic" chain forward { type filter hook forward priority filter; policy drop; ct state vmap { established : accept, related : accept } comment "!fw4: Handle forwarded flows" iifname "br-lan" jump forward_lan comment "!fw4: Handle lan IPv4/IPv6 forward traffic" iifname "eth0" jump forward_transit_direct comment "!fw4: Handle transit_direct IPv4/IPv6 forward traffic" iifname "eth2" jump forward_transit_vpn comment "!fw4: Handle transit_vpn IPv4/IPv6 forward traffic" iifname "wg_remote" jump forward_remote_in comment "!fw4: Handle remote_in IPv4/IPv6 forward traffic" iifname "wg_paid" jump forward_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 forward traffic" oifname "wg_paid" jump output_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 output traffic" chain prerouting { type filter hook prerouting priority filter; policy accept; iifname "wg_paid" jump helper_wg_paid comment "!fw4: Handle wg_paid IPv4/IPv6 helper assignment" chain forward_lan { jump accept_to_transit_direct comment "!fw4: Accept lan to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept lan to transit_vpn forwarding" chain forward_transit_direct { chain forward_transit_vpn { chain forward_remote_in { jump accept_to_lan comment "!fw4: Accept remote_in to lan forwarding" jump accept_to_transit_direct comment "!fw4: Accept remote_in to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept remote_in to transit_vpn forwarding" chain input_wg_paid { jump accept_from_wg_paid chain output_wg_paid { jump accept_to_wg_paid chain forward_wg_paid { jump accept_to_transit_direct comment "!fw4: Accept wg_paid to transit_direct forwarding" jump accept_to_transit_vpn comment "!fw4: Accept wg_paid to transit_vpn forwarding" jump reject_to_wg_paid chain helper_wg_paid { chain accept_from_wg_paid { iifname "wg_paid" counter packets 0 bytes 0 accept comment "!fw4: accept wg_paid IPv4/IPv6 traffic" chain accept_to_wg_paid { oifname "wg_paid" counter packets 0 bytes 0 accept comment "!fw4: accept wg_paid IPv4/IPv6 traffic" chain reject_to_wg_paid { oifname "wg_paid" counter packets 0 bytes 0 jump handle_reject comment "!fw4: reject wg_paid IPv4/IPv6 traffic" type nat hook prerouting priority dstnat; policy accept; type nat hook postrouting priority srcnat; policy accept; meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_direct traffic" meta nfproto ipv4 masquerade comment "!fw4: Masquerade IPv4 transit_vpn traffic" chain raw_prerouting { type filter hook prerouting priority raw; policy accept; chain mangle_prerouting { type filter hook prerouting priority mangle; policy accept; jump pbr_prerouting chain mangle_postrouting { type filter hook postrouting priority mangle; policy accept; chain mangle_forward { type filter hook forward priority mangle; policy accept; jump pbr_forward chain pbr_forward { meta mark & 0x00ff0000 != 0x00000000 return meta mark & 0x00ff0000 != 0x00000000 return chain pbr_prerouting { meta mark & 0x00ff0000 != 0x00000000 return ip daddr @pbr_transit_direct_4_dst_ip_user goto pbr_mark_0x010000 ip saddr @pbr_transit_direct_4_src_ip_user goto pbr_mark_0x010000 ether saddr @pbr_transit_direct_4_src_mac_user goto pbr_mark_0x010000 ip daddr @pbr_transit_vpn_4_dst_ip_user goto pbr_mark_0x020000 ip saddr @pbr_transit_vpn_4_src_ip_user goto pbr_mark_0x020000 ether saddr @pbr_transit_vpn_4_src_mac_user goto pbr_mark_0x020000 chain pbr_mark_0x010000 { meta mark set meta mark & 0xff01ffff | 0x00010000 chain pbr_mark_0x020000 { meta mark set meta mark & 0xff02ffff | 0x00020000 === UCI pending VM100 === === VM101 policy receiving side === date=Wed Jul 8 11:29:58 UTC 2026 === canary tables should be absent === router_egress_canary_absent router_egress_dscp_lab_absent === ip rule === 0: from all lookup local 10013: from all fwmark 0x203 lookup 203 10014: from all fwmark 0x204 lookup 204 10015: from all fwmark 0x205 lookup 205 10019: from all iif eth1 lookup 200 10020: from 10.200.0.0/24 lookup 200 32766: from all lookup main 32767: from all lookup default === tables 200/203/204/205 === TABLE 200 default dev vpn1 scope link 10.200.0.0/24 dev eth1 scope link src 10.200.0.2 10.201.0.0/24 dev eth3 scope link src 10.201.0.2 TABLE 203 default dev vpn3 scope link TABLE 204 default dev vpn4 scope link TABLE 205 default dev vpn5 scope link === marked route check === 1.1.1.1 from 10.200.0.1 dev vpn3 table 203 mark 0x203 cache iif eth1 === UCI pending VM101 === === STEP_033H3 RESULT === wgpaid_runtime_peer_count=0 wgpaid_uci_peer_count=0 canary_absent_lines=1 dscp_lab_absent_lines=1 fwmark_rule203_lines=1 table200_default_vpn1_lines=1 table203_default_vpn3_lines=1 uci_pending_lines=0 package=/opt/router-ops/apply-packages/20260708-112956_step033h3_wgpaid_exact_peer_plan decision=PASS_WGPAID_EXACT_PEER_PLAN