48 lines
1.9 KiB
Markdown
48 lines
1.9 KiB
Markdown
# MikroTik WISP Router Backup Pipeline
|
|
|
|
## Pipeline Architecture
|
|
|
|
```
|
|
Core (netcup) → L2TP/IPsec VPN → MikroTik Router (WireGuard tunnel interface)
|
|
↓
|
|
SSH export config → gzip → S3 upload (mikrotik-ccr-backups)
|
|
```
|
|
|
|
## Key Configuration
|
|
|
|
| Setting | Value |
|
|
|---------|-------|
|
|
| Router IP (via VPN tunnel) | 10.77.0.2 |
|
|
| LAN IP (NOT via VPN) | 192.168.88.1 |
|
|
| SSH port | 22 (restricted to 10.77.0.0/24) |
|
|
| Backup frequency | 6:00 AM daily |
|
|
| S3 bucket | `mikrotik-ccr-backups` |
|
|
| Script | `/root/.hermes/scripts/run-wisp-backup.sh` |
|
|
| Config | `/root/.hermes/scripts/wisp-backup/config.yaml` |
|
|
| Method | paramiko SSH → `/export` → gzip → S3 upload |
|
|
|
|
## Diagnosis
|
|
|
|
When the backup fails:
|
|
1. Check cron: `cronjob action=list` — look for `home-router-daily-backup` status
|
|
2. Check VPN: `ipsec status` or `xl2tpd` — tunnel must be up
|
|
3. Check IP: router must be reachable on `10.77.0.2` (tunnel), NOT `192.168.88.1` (LAN)
|
|
4. Check for stuck exports: SSH in and check for `.in_progress` files
|
|
5. Check paramiko: `python3 -c "import paramiko"`
|
|
|
|
## Pitfalls
|
|
|
|
- **Wrong IP in config** — The tower IP was set to `192.168.88.1` (LAN) instead of `10.77.0.2` (VPN tunnel). SSH is restricted to 10.77.0.0/24.
|
|
- **Missing paramiko** — `wisp-backup.py` requires paramiko. Install with `pip install paramiko`.
|
|
- **Missing VPN stack** — `xl2tpd` and `strongswan-starter` packages may not be installed on the backup server.
|
|
- **Stuck exports** — If a previous export failed, the router retains a `.in_progress` file. Clean it via SSH: `ssh admin@10.77.0.2 /file remove [filename].in_progress`
|
|
- **Wrong cron script** — The cron was using `home-router-backup.sh` (old WireGuard script) instead of `run-wisp-backup.sh`.
|
|
|
|
## Verification
|
|
|
|
```bash
|
|
aws s3 ls s3://mikrotik-ccr-backups/wisp-backups/configs/home/ \
|
|
--endpoint-url https://s3.us-east-1.wasabisys.com
|
|
```
|
|
Files are named: `home-gateway-YYYY-MM-DD.rsc.gz`
|