mfahampshire
142 lines
6.4 KiB
Plaintext
142 lines
6.4 KiB
Plaintext
import { Steps } from 'nextra/components';
|
||
import { Callout } from 'nextra/components';
|
||
import { AccordionTemplate } from 'components/accordion-template.tsx';
|
||
|
||
<Callout type="info" emoji="ℹ️">
|
||
**QUIC bridge is a requirement for all nodes which enable Wireguard functionality. Note that it this feature is compatible with nodes from `v1.18.0` (platform release [`v2025.17-isabirra`](https://github.com/nymtech/nym/releases/tag/nym-binaries-v2025.17-isabirra)) and newer!**
|
||
</ Callout>
|
||
|
||
Nym Network uses various [transport bridges](https://github.com/nymtech/nym-bridges/blob/main/README.md) for routing the packets. Right now operators need to configure [our implementation](https://github.com/nymtech/nym-bridges/tree/main/nym-bridge) of general-purpose transport layer network protocol called [QUIC](https://en.wikipedia.org/wiki/QUIC).
|
||
|
||
Operators can use [Nym Bridge Configuration Tool](https://github.com/nymtech/nym-bridges/tree/main/bridge-cfg) and compile the [Bridge Runner binary](https://github.com/nymtech/nym-bridges/tree/main/nym-bridge) themselves.
|
||
|
||
**We recommend a more convenient QUIC bridge deployment using a script [`quic_bridge_deployment.sh`](https://github.com/nymtech/nym/blob/develop/scripts/nym-node-setup/quic_bridge_deployment.sh), following the steps below.**
|
||
|
||
<Steps>
|
||
###### 1. Download [`quic_bridge_deployment.sh`](https://github.com/nymtech/nym/blob/develop/scripts/nym-node-setup/quic_bridge_deployment.sh) script
|
||
- SSH to your server
|
||
- Download the script and make executable
|
||
```sh
|
||
wget https://raw.githubusercontent.com/nymtech/nym/refs/heads/develop/scripts/nym-node-setup/quic_bridge_deployment.sh && \
|
||
chmod +x quic_bridge_deployment.sh
|
||
```
|
||
|
||
|
||
###### 2. Run the script with `full_bridge_setup` command
|
||
- Optional: open `tmux` in case you will need to run another commands on the VPS
|
||
- Run the script with a command `full_bridge_setup`
|
||
```sh
|
||
./nym-node-setup/quic_bridge_deployment.sh full_bridge_setup
|
||
```
|
||
|
||
###### 3. Follow the interactive prompts
|
||
- When you are asked for bridge binary URL, look here for one to match your system: [builds.ci.nymte.ch/QUIC](https://builds.ci.nymte.ch/QUIC/)
|
||
- When you are asked to enter forward address, it's your IPv4 used for bonding the node, alongside port `:51822` (an example: `172.232.238.161:51822`)
|
||
- To find out your IP address you can always run:
|
||
- IPv4: `curl -4 https://ifconfig.co/ip`
|
||
- IPv6: `curl -6 https://ifconfig.co/ip`
|
||
- **For all prompts with default options, we highly recommend to stick to default (press enter)**
|
||
|
||
###### 4. Restart the node service
|
||
- When done with the deployment, please restart your node systemd service
|
||
```sh
|
||
service nym-node restart && journalctl -u nym-node.service -f --all
|
||
```
|
||
</Steps>
|
||
|
||
Congratulation, you deployed QUIC transport bridge! The script offers a standalone tweaks and checks, you can always run it without any argument to see all the options:
|
||
```sh
|
||
./quic_bridge_deployment.sh
|
||
```
|
||
<br/>
|
||
<AccordionTemplate name="Command output">
|
||
```shell
|
||
root@localhost:~# ./quic_bridge_deployment.sh
|
||
iptables-persistent is already installed.
|
||
Usage: ./quic_bridge_deployment.sh [command] [options]
|
||
|
||
Nym QUIC Bridge Deployment Helper Script
|
||
|
||
Bridge Installation & Configuration:
|
||
check_bridge_installation - Check bridge installation status
|
||
show_bridge_config - Display bridge configuration files
|
||
show_bridge_keys - Display bridge key information
|
||
show_bridge_info - Show comprehensive bridge information
|
||
verify_bridge_prerequisites - Verify all prerequisites are met
|
||
|
||
Bridge Setup Commands:
|
||
install_bridge_binary - Download and install nym-bridge binary
|
||
generate_bridge_keys - Generate ED25519 bridge identity keys
|
||
create_client_params - Create client_bridge_params.json
|
||
create_bridge_config - Create bridges.toml configuration
|
||
create_bridge_service - Create systemd service file
|
||
full_bridge_setup - Interactive full bridge setup wizard
|
||
|
||
Network Configuration Commands:
|
||
adjust_ip_forwarding - Enable IPv4 and IPv6 forwarding
|
||
apply_bridge_iptables_rules - Apply iptables rules for QUIC bridge (nymwg)
|
||
configure_dns_and_icmp - Allow ICMP ping tests and configure DNS
|
||
remove_duplicate_bridge_rules - Remove duplicate iptables rules for nymwg
|
||
|
||
Network Inspection Commands:
|
||
fetch_and_display_ipv6 - Show IPv6 on default network device
|
||
fetch_wg_ipv6_address - Fetch IPv6 for nymwg interface
|
||
check_bridge_iptables - Check iptables rules for nymwg
|
||
check_ipv6_ipv4_forwarding - Check IPv4 and IPv6 forwarding status
|
||
check_ip_routing - Display IP routing tables
|
||
|
||
Testing Commands:
|
||
perform_pings - Test IPv4 and IPv6 connectivity
|
||
test_bridge_connectivity - Comprehensive bridge connectivity test
|
||
|
||
Service Management Commands:
|
||
check_bridge_service_status - Check nym-bridge and nym-node service status
|
||
show_bridge_logs [lines] - Show recent nym-bridge logs (default: 50 lines)
|
||
|
||
Quick Start:
|
||
1. Run 'verify_bridge_prerequisites' to check prerequisites
|
||
2. Run 'check_bridge_installation' to verify installation
|
||
3. Run 'test_bridge_connectivity' to test connectivity
|
||
```
|
||
</AccordionTemplate>
|
||
|
||
### Fixing Metadata Port Showing Not Open in Probe Results
|
||
If you have followed the steps outlined above, but the metadata port is not shown as open in either the Node Status API's probe results or an explorer that gets its data from the API, see below:
|
||
|
||
<Steps>
|
||
###### 1.
|
||
Ensure that in your `config.toml` file, this value is set to the default one - any other value here will cause the metadata endpoint to fail:
|
||
|
||
```
|
||
# Private IP address of the wireguard gateway.
|
||
# default: '10.1.0.1'
|
||
private_ipv4 = '10.1.0.1'
|
||
```
|
||
|
||
Then restart your node.
|
||
|
||
###### 2.
|
||
Run this command if not already done:
|
||
```
|
||
ufw allow in on nymwg to any port 51830 proto tcp
|
||
```
|
||
|
||
Check if the port is open with:
|
||
```
|
||
iptables -S | grep 51830
|
||
```
|
||
|
||
Then ensure the metadata endpoint is listening from the correct address with:
|
||
```
|
||
netstat -an | egrep LISTEN | egrep "51830"
|
||
```
|
||
|
||
###### 3.
|
||
Once the Node Status API has run a probe on your node, the probe results will reflect this - `can_query_metadata_v4` will have `true` as a value.
|
||
|
||
The quickest way to check this is by using the [NymVPN API](https://nymvpn.com/api/public/v1/directory/gateways?show_vpn_only=true) and checking the same field:
|
||
|
||
|
||
|
||
</Steps>
|