Fimeg/SouveraineOS
Watch
1
0
Fork
You've already forked SouveraineOS
 0
Code Releases Activity

VPN: correct the port, the peer, and the keepalive

Browse source 
51822 not 51820; the phone has its own peer (10.8.0.6) rather than sharing
the laptop's key; keepalive 25 not 0. Records that the autonomous gate is
dead and why a full tunnel that cannot handshake takes the machine with it.
This commit is contained in:
Fimeg 2026-07-31 07:57:30 -04:00
commit 25bb99c850
1 changed files with 26 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

27
docs/substrate/VPN-WIUF.md
View file

@ -1,4 +1,29 @@
# Wiuf VPN — phone split-tunnel + semi-intelligent gate
# Wiuf VPN — phone split-tunnel
> **Corrected 2026-07-30 evening, proven working off-LAN.** Three things below
> were wrong and cost an hour:
>
> - **The port is 51822 (or 51821), NOT 51820.** A generated
> `SouveraineOS-Phone.conf` said 51820; it sends and never receives.
> - **The phone has its OWN peer now: `wiufph`, address 10.8.0.6.** The old
> `wiuf` profile shared its address *and private key* with the laptop, so
> WireGuard could only ever hold one of them, and that key is no longer
> listed server-side.
> - **`persistent-keepalive` must be 25**, not the `0` the generated conf
> carries, or the tunnel dies behind carrier NAT.
>
> Verified from a foreign network (`10.10.30.x`): handshake in 8 s, gitea
> `HTTP 200` in 0.126 s, Pi-hole reachable, internet unaffected.
>
> **The autonomous gate described below is DEAD** — it recycled the tunnel 652
> times in 90 minutes and could not be switched off. Replaced by a deliberate
> quick toggle in the shell's right panel. Never reinstate a timer or an NM
> dispatcher hook here; if posture must be automatic it belongs in sessiond as
> an Action (DEVICE-STATE-MACHINE §12).
>
> **Also note:** `allowed-ips=0.0.0.0/0` is a full tunnel — bringing that up
> when it cannot handshake black-holes the whole machine. Split-tunnel
> (`10.10.0.0/16` + `never-default=true`) fails safe instead.
Status: deployed on the Pixel 3 (blueline) 2026-07-30. Laptop profile removed
(same keys — see Caveats); it gets a fresh Wiuf peer of its own.