2 # Copyright (C) 2016 Ian Kelling
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
19 f
=/usr
/local
/lib
/bash-bear
;test -r $f ||
{ echo "error: $0 no $f" >&2;exit 1;}; .
$f
23 usage: ${0##*/} [-h] [-t 2|3|test|client] [-m WIRELESS_MAC] [hostname]
24 setup my router in general: dhcp, dns, etc.
26 Type 2 or 3 is for setting up a backup device, there are two kinds so
27 that you can switch the main device to a backup, then a backup to the
28 main. Type test is for setting up a testing device.
30 Passing an empty string for WIRELESS_MAC, or if none is defined in the
31 secrets file, will cause the device's native mac to be used.
41 if [[ -e /root
/zblock
]]; then
47 firewall_restart
=false
54 while getopts hm
:t
:yz opt
; do
61 libremanage_host
=$hostname
82 *) echo "$0: unexpected arg to -t: $*" >&2; usage
1 ;;
94 *) echo "$0: Internal error! unexpected args: $*" >&2 ; usage
1 ;;
97 shift "$((OPTIND-1))" # Discard the options and sentinel --
101 elif [[ $hostname ]]; then
107 if [[ ! $hostname ]]; then
113 if [[ -e /root
/router-secrets
]]; then
115 source /root
/router-secrets
118 if [[ ! $mac ]] && ! $test && $secrets; then
119 # if we wanted to increment it
120 #mac=${mac:0: -1}$((${mac: -1} + 2))
124 if (( $# != 0 )); then
138 # background: upgrading all packages is not recommended because it
139 # doesn't go into the firmware. build new firmware if you want
140 # lots of upgrades. I think /tmp/opkg-lists is a pre openwrt 14 location.
141 f
=(/var
/opkg-lists
/*)
142 if ! (( $
(date -r $f +%s
) + 60*60*24 > $
(date +%s
) )); then
143 if ! opkg update
; then
144 echo "$0: warning: opkg update failed" >&2
155 if [[ ! $
(opkg list-installed
"$pname") ]]; then
160 if [[ $to_install ]]; then
161 opkg
install ${to_install[@]}
170 ######### uci example:#######
171 # # https://wiki.openwrt.org/doc/uci
172 # wan_index=$(uci show firewall | sed -rn 's/firewall\.@zone\[([0-9])+\]\.name=wan/\1/p')
173 # wan="firewall.@zone[$wan_index]"
174 # if [[ $(uci get firewall.@forwarding[0].dest) != $forward_dest ]]; then
176 # v uci set firewall.@forwarding[0].dest=$forward_dest
177 # uci commit firewall
178 # firewall_restart=true
180 ####### end uci example #####
183 printf "+ uset %s\n" "$*"
186 local service
="${key%%.*}"
187 restart_var
=${service}_restart
188 if [[ ! ${!restart_var} ]]; then
189 eval $restart_var=false
191 if [[ $
(uci get
"$key") != "$val" ]]; then
192 v uci
set "$key"="$val"
194 eval $restart_var=true
199 printf "+ udel %s\n" "$*"
202 local service
="${key%%.*}"
203 restart_var
=${service}_restart
204 if [[ ! ${!restart_var} ]]; then
205 eval $restart_var=false
207 if uci get
"$key" &>/dev
/null
; then
208 v uci
set "$key"="$val"
210 eval $restart_var=true
214 v
command cedit
-v "$@"
223 elif [[ $hostname == cmc ||
$hostname == cmcap
]]; then
241 : ${key:=pictionary49}
247 # why did we lock this? i don't know
248 #passwd -l root ||: #already locked fails
250 sed -ibak '/^root:/d' /etc
/shadow
251 # /root/router created by manually running passwd then copying the resulting
252 # line. We have no mkpasswd on wrt/librecmc, then we scp it in.
253 cat /root
/router
>>/etc
/shadow
254 # otherwise, serial console gets root login with no password
255 uset system.@system
[0].ttylogin
1
259 cat >/usr
/bin
/archlike-pxe-mount
<<'EOFOUTER'
261 # symlinks are collapsed for nfs mount points, so use a bind mount.
262 # tried putting this in /etc/config/fstab,
263 # then doing block mount, it didn't work. This doesn't persist across reboots,
264 # todo: figure that out
266 for d in /run/{arch,parabola}iso/bootmnt; do
267 cat >>/etc/fstab <<EOF
268 /mnt/usb/tftpboot $d none bind 0 0
270 mount | grep $d &>/dev/null || mount $d
272 /etc/init.d/nfsd restart
274 chmod +x
/usr
/bin
/archlike-pxe-mount
276 sed -i '/^root:/s,/bin/ash$,/bin/bash,' /etc
/passwd
280 uset dropbear.@dropbear
[0].PasswordAuth
0
281 uset dropbear.@dropbear
[0].RootPasswordAuth
0
282 uset dropbear.@dropbear
[0].Port
2220
283 if ! cmp -s /root
/dropbear_rsa_host_key
/etc
/dropbear
/dropbear_rsa_host_key
; then
284 cp /root
/dropbear_rsa_host_key
/etc
/dropbear
/dropbear_rsa_host_key
285 dropbear_restart
=true
288 if $dropbear_restart; then
289 v
/etc
/init.d
/dropbear restart
293 uset network.lan.ipaddr
$l.
$lanip
294 uset network.lan.netmask
$mask
295 if $dev2 ||
$client ||
$ap; then
296 if $dev2 ||
$ap; then
297 uset network.lan.gateway
$l.1
298 uset network.wan.proto none
299 uset network.wan6.proto none
301 /etc
/init.d
/dnsmasq stop
302 /etc
/init.d
/dnsmasq disable
303 /etc
/init.d
/odhcpd stop
304 /etc
/init.d
/odhcpd disable
305 rm -f /etc
/resolv.conf
307 cat >/etc
/resolv.conf
<<EOF
311 cat >/etc
/resolv.conf
<<'EOF'
317 # things i tried to keep dnsmasq running but not enabled except local dns,
318 # but it didnt work right and i dont need it anyways.
319 # uset dhcp.wan.ignore $dev2 # default is false
320 # uset dhcp.lan.ignore $dev2 # default is false
321 # uset dhcp.@dnsmasq[0].interface lo
322 # uset dhcp.@dnsmasq[0].localuse 0
323 # uset dhcp.@dnsmasq[0].resolvfile /etc/dnsmasq.conf
324 # uset dhcp.@dnsmasq[0].noresolv 1
325 # todo: populate /etc/resolv.conf with a static value
328 # these are the defaults
330 # this is not needed unless switching from the above condition.
331 # disabling just to debug
332 #uset network.lan.gateway ''
334 uset network.wan.proto dhcp
335 uset network.wan6.proto dhcpv6
336 /etc
/init.d
/dnsmasq start
337 # todo: figure out why this returns 1
338 /etc
/init.d
/dnsmasq
enable ||
:
339 /etc
/init.d
/odhcpd start
340 /etc
/init.d
/odhcpd
enable
343 wireless_restart
=false
346 uset wireless.default_radio0.network
'wwan'
347 uset wireless.default_radio0.ssid
${rclientssid[$h]}
348 uset wireless.default_radio0.encryption
'psk2'
349 uset wireless.default_radio0.device
'radio0'
350 uset wireless.default_radio0.mode
'sta'
351 uset wireless.default_radio0.bssid
${rclientbssid[$h]}
352 # todo: look into whether 5g network is available.
353 uset wireless.default_radio0.key
${rclientkey[$h]}
354 uset wireless.radio0.disabled false
355 uset wireless.radio1.disabled true
357 # defaults, just reseting in case client config ran
358 uset wireless.default_radio0.network lan
359 uset wireless.default_radio0.mode ap
361 uset wireless.default_radio
$x.ssid
"$ssid"
362 uset wireless.default_radio
$x.key
$key
363 uset wireless.default_radio
$x.encryption psk2
365 uset wireless.default_radio
$x.macaddr
$macpre$
((macsuf
+ 2*x
))
367 # disable/enable. secondary device has wireless disabled
368 uset wireless.radio
$x.disabled
$dev2
372 if grep '^OPENWRT_BOARD="mvebu/cortexa9"' /etc
/os-release
&>/dev
/null
; then
373 # todo, I also enabled irqbalance, didnt script it though
374 # https://forum.openwrt.org/t/wrt1900acs-wifi-issue-after-upgrade-from-19-07-to-21-02-vacuum-cleaner-legacy-rate-support/113311/28
375 cat >/etc
/rc.
local <<'EOF'
376 echo "0" >> /sys/kernel/debug/ieee80211/phy0/mwlwifi/tx_amsdu
377 echo "0" >> /sys/kernel/debug/ieee80211/phy1/mwlwifi/tx_amsdu
380 chmod +x
/etc
/rc.
local
382 uset wireless.radio0.disassoc_low_ack
0
383 uset wireless.radio1.disassoc_low_ack
0
387 # found with https://openwrt.org/docs/guide-user/network/wifi/iwchan.
388 # However, the default also chooses 11, and better to let it choose in case things change.
391 # uset wireless.radio0.channel 11
396 # usb, screen, relay are for libremanage
399 # relay package temporarily disabled
400 # /root/relay_1.0-1_mips_24kc.ipk
402 # note: prometheus-node-exporter-lua-openwrt seems to be a dependency of
403 # prometheus-node-exporter-lua in practice.
412 prometheus-node-exporter-lua-openwrt
413 prometheus-node-exporter-lua
424 # nfs-kernel-server \
425 # openvpn-openssl adblock libusb-compat \
426 # kmod-usb-serial-cp210x kmod-usb-serial-ftdi \
429 cat >/etc
/libremanage.conf
<<EOF
430 ${libremanage_host}_type=switch
431 ${libremanage_host}_channel=1
436 v
/etc
/init.d
/fstab
enable ||
:
438 # rebooting makes mounting work, but comparing lsmod,
439 # i'm guessing this will too. todo, test it.
440 # 255 == module already loaded
441 for mod
in scsi_mod sd_mod
; do v modprobe
$mod ||
[[ $?
== 255 ]]; done
443 # for archlike pxe. The default settings in the installer expect to find
444 # the NFS at one of these dirs
445 mkdir
-p /run
/archiso
/bootmnt
446 mkdir
-p /run
/parabolaiso
/bootmnt
448 # todo: at some later time, i found /mnt/usb not mounted, watch to see if
449 # that is the case after running this or rebooting.
450 # wiki says safe to do in case of fstab changes:
452 ## ian: usb broke on old router. if that happens, can just comment this to disable problems
453 # echo | cedit /etc/config/fstab ||:
454 cedit
/etc
/config
/fstab
<<EOF || { v block umount; v block mount; }
455 config global automount
460 # /overlay is an / overlay mount for installing extra packages, etc.
461 # https://openwrt.org/docs/guide-user/additional-software/extroot_configuration
462 option target /mnt/usb
463 # option target /overlay
464 option device /dev/sda1
466 option options rw,async,noatime,nodiratime
471 # ian: disabled because afaik I don't need it, no benefit.
472 # config global autoswap
473 # option from_fstab 1
477 # option device /dev/sda1
483 # exportfs -ra wont cut it when its the same path, but now a bind mount
484 # todo: restart nfs when nfs is enabled?
485 #cedit /etc/exports <<EOF || v /etc/init.d/nfsd restart ||:
486 cedit
/etc
/exports
<<EOF ||:
487 /mnt/usb $lan/$cidr(rw,no_root_squash,insecure,sync,no_subtree_check)
489 /run/archiso/bootmnt $lan/$cidr(rw,no_root_squash,insecure,sync,no_subtree_check)
490 /run/parabolaiso/bootmnt $lan/$cidr(rw,no_root_squash,insecure,sync,no_subtree_check)
494 # todo: enable nfs when we need it only.
495 # v /etc/init.d/portmap start
496 # v /etc/init.d/nfsd start
497 # v /etc/init.d/portmap enable
498 # v /etc/init.d/nfsd enable
501 cedit
/etc
/config
/prometheus-node-exporter-lua
<<'EOF' || /etc/init.d/prometheus-node-exporter-lua restart
502 config prometheus-node-exporter-lua 'main'
503 option listen_ipv6 '0'
504 option listen_interface 'lan'
505 option listen_port '9100
508 # default, as of this writing is:
509 # config prometheus-node-exporter-lua 'main'
510 # option listen_interface 'loopback'
511 # option listen_port '9100'
517 ########## openvpn exampl
518 ########## missing firewall settings for routing lan
520 # v /etc/init.d/openvpn start
521 # v /etc/init.d/openvpn enable
523 # # from https://wiki.openwrt.org/doc/uci/firewall
524 # # todo: not sure if /etc/init.d/network needs restarting.
525 # # I did, and I had to restart the vpn afterwards.
526 # # This maps a uci interface to a real interface which is
527 # # managed outside of uci.
528 # cedit /etc/config/network <<'EOF' ||:
529 # config interface 'tun0'
530 # option ifname 'tun0'
531 # option proto 'none'
533 # cedit /etc/config/openvpn <<'EOF' || v /etc/init.d/openvpn restart
534 # config openvpn my_client_config
536 # option config /etc/openvpn/client.conf
543 network_restart
=false
545 cedit wific
/etc
/config
/network
<<EOF || network_restart=true
546 # https://openwrt.org/docs/guide-user/network/wifi/connect_client_wifi
547 config interface 'wwan'
552 cedit
/etc
/config
/network
<<EOF || network_restart=true
553 config 'route' 'transmission'
554 option 'interface' 'lan'
555 option 'target' '10.174.0.0'
556 option 'netmask' '255.255.0.0'
557 option 'gateway' '$l.2'
559 option interface 'wg0'
560 option proto 'wireguard'
561 option private_key '$(cat /root/wg.key)'
562 option listen_port $wgport
563 list addresses '10.3.0.1/24'
564 list addresses 'fdfd::1/64'
567 config wireguard_wg0 'wgclient'
568 option public_key '3q+WJGrm85r59NgeXOIvppxoW4ux/+koSw6Fee1c1TI='
569 option preshared_key '$(cat /root/wg.psk)'
570 list allowed_ips '10.3.0.2/24'
571 list allowed_ips 'fdfd::2/64'
574 # Need to reload before we change dnsmasq to give out
575 # static ips in our new range.
576 if $network_restart; then
577 v
/etc
/init.d
/network reload
583 cedit wific
/etc
/config
/firewall
<<EOF
588 option forward REJECT
597 cedit
host /etc
/config
/firewall
<<EOF
607 cedit
host /etc
/config
/firewall
<<EOF
619 cedit
/etc
/config
/firewall
<<EOF
620 ## begin no external dns for ziva
623 option src_ip 10.2.0.23
631 option dest_ip 10.2.0.23
639 option src_ip 10.2.0.31
647 option dest_ip 10.2.0.31
655 option src_ip 10.2.0.32
663 option dest_ip 10.2.0.32
667 ## end no external dns for ziva
669 $(. /root/cmc-firewall-data)
679 option src_dport 9091
680 option dest_port 9091
686 option dest_port 9091
688 # was working on an openvpn server, didn't finish
692 # option src_dport 1196
693 # option dest_port 1196
694 # option dest_ip $l.2
698 # option target ACCEPT
699 # option dest_port 1196
705 option src_dport 8989
706 option dest_port 8989
712 option dest_port 8989
719 option src_dport 8000
720 option dest_port 8000
726 option dest_port 8000
732 option dest_port 2220
738 option dest_port $wgport
742 option name navidromehttps
744 option src_dport 4500
745 option dest_port 4500
751 option dest_port 4500
754 option name navidrome
756 option src_dport 4533
757 option dest_port 4533
763 option dest_port 4533
765 # So a client can just have b8.nz dns even when they
768 # option name navidromelan
770 # option src_dport 4533
771 # option dest_port 4533
772 # option dest_ip $l.2
777 # option name icecast
779 # option src_dport 8000
780 # option dest_port 8000
781 # option dest_ip $l.2
785 # option target ACCEPT
786 # option dest_port 8000
815 # option name httpskd8448
817 # option src_dport 8448
819 # option dest_ip $l.2
823 # option target ACCEPT
824 # option dest_port 8448
828 option name syncthing
830 option src_dport 22001
836 option dest_port 22001
842 # option src_dport $i2pport
843 # option dest_ip $l.178
847 # option target ACCEPT
848 # option dest_port $i2pport
854 # note, using mac transform, we could allow all traffic to a host like this,
855 # replacing 1 as appropriate
856 #option dest_ip ::111:11ff:fe11:1111/::ffff:ffff:ffff:ffff
862 # option name http-ipv6
865 # option dest_port 80
866 # option target ACCEPT
870 # option name https-ipv6
873 # option dest_port 443
874 # option target ACCEPT
878 option name node-exporter
881 option dest_port 9101
886 option name mail587-ipv6
895 firewall-cedit || firewall_restart
=true
898 # not using and in newer wrt, fails, probably due to nonexistent file, error output
901 # Reference error: left-hand side expression is not an array or object
902 # In [anonymous function](), file /usr/share/ucode/fw4.uc, line 3137, byte 12:
903 # called from function [arrow function] (/usr/share/ucode/fw4.uc:733:71)
904 # called from function foreach ([C])
905 # called from function [anonymous function] (/usr/share/ucode/fw4.uc:733:72)
906 # called from function render_ruleset (/usr/share/firewall4/main.uc:56:24)
907 # called from anonymous function (/usr/share/firewall4/main.uc:143:29)
909 # ` if (!inc.enabled) {`
913 # The rendered ruleset contains errors, not doing firewall restart.
914 # /usr/bin/wrt-setup-local:160:error: ""$@"" returned 1
916 ## include a file with users custom iptables rules
918 # option path /etc/firewall.user
919 # option type 'restore'
920 # option family 'ipv4'
924 # not using wireguard for now
925 # if ! uci get firewall.@zone[1].network | grep wg0 &>/dev/null; then
926 # # cant mix cedit plus uci
927 # echo | cedit /etc/config/firewall ||:
928 # uci add_list firewall.@zone[1].network=wg0
929 # uci commit firewall
931 # firewall_restart=true
936 cedit
/etc
/hosts
<<EOF ||:
941 #mail_host=$(grep -F mail.iankelling.org /etc/hosts | awk '{print $1}')
942 # if [[ $mail_host ]]; then
943 # sed -i '/^$mail_host/a mail.iankelling.org' /etc/hosts
947 uset dhcp.@dnsmasq
[0].domain b8.nz
948 uset system.@system
[0].hostname
$hostname
949 uset dhcp.@dnsmasq
[0].
local
951 # uci doesnt seem to have a way to set an empty value,
952 # if you delete it, it goes back to the default. this seems
953 # to be a decent workaround.
954 # todo: setup /etc/resolv.conf to point to 127.0.0.1
955 # later note: disabled, I dunno why I set this.
956 # uset dhcp.@dnsmasq[0].resolvfile /dev/null
958 # if dnsmasq happens to not send out a dns server,
959 # odhcpd will send one out like this:
960 # NetworkManager[953]: <info> [1614982580.5192] dhcp6 (wlan0): option dhcp6_name_servers => 'fd58:5801:8e02::1'
961 # but i dont want ipv6 dns, just keep it simple to ipv4.
962 # I know my isp doesnt have ipv6 right now,
963 # so just stop this thing.
964 # note: tried this, it didn't do anything:
965 # uset dhcp.@odhcpd[0].dns 10.2.0.1
967 # iank, disablde while debugging.
968 #/etc/init.d/odhcpd stop
969 #/etc/init.d/odhcpd disable
971 # todo: make the above conditional on which server this is.
973 ## left commented in case we have ipv6 problems in the future
974 # avoid errors in log. current isp doesnt have ipv6
975 #uset unbound.@unbound[0].protocol ip4_only
977 # todo: im not sure all these are needed, but they all look
979 # https://blog.cloudflare.com/dns-over-tls-for-openwrt/
980 # https://gist.github.com/vqiu/7b32d3a19a7a09d32e108d998de166c2
981 #https://blog.thestateofme.com/2018/04/04/howto-secure-your-dns-with-a-raspberry-pi-unbound-and-cloudflare-1-1-1-1/
983 # # i found that the zone example was having no effect on the config
985 # https://github.com/openwrt/packages/blob/openwrt-19.07/net/unbound/files/README.md
987 # # todo: unbound-control, i'm not sure what the purpose of that thing is, some
988 # # kind of coordination with dhcp of dnsmasq, but what?
990 # note: for debugging, edit /etc/init.d/unbound, change
991 # procd_set_param command $PROG -d -c $UB_TOTAL_CONF
993 # procd_set_param command $PROG -vvv -d -c $UB_TOTAL_CONF
1000 qname-minimisation: yes
1001 rrset-roundrobin: yes
1002 use-caps-for-id: yes
1004 private-domain: b8.nz
1005 local-zone: "10.in-addr.arpa." transparent
1006 access-control-view: 10.2.0.31/32 "youtube"
1011 # no sy until that dongle is used by ziva
1014 #access-control-view: 10.2.0.7/32 "youtube"
1016 access-control-view: 10.2.0.29/32 "youtube"
1018 access-control-view: 10.2.0.32/32 "youtube"
1021 } | cedit
/etc
/unbound
/unbound_srv.conf || unbound_restart
=true
1024 # dns based blocking vs ip based. with ip, same
1025 # server can have multiple domains. in dns,
1026 # you have to make sure clients to use the local dns.
1027 # https dns will need to be blocked by ip in
1028 # order to be comprehensive
1031 cedit
/etc
/unbound
/unbound_ext.conf
<<EOF || unbound_restart=true
1035 local-data-ptr: "10.2.0.1 cmc.b8.nz"
1037 local-data-ptr: "10.174.2.2 transmission.b8.nz"
1038 local-data-ptr: "10.173.8.1 defaultnn.b8.nz"
1039 local-data-ptr: "10.173.8.2 nn.b8.nz"
1043 # forward-addr: 8.8.8.8
1044 # forward-addr: 8.8.8.8
1046 # ssl disabled due to this error:
1047 #Sat Dec 24 03:34:44 2022 daemon.err unbound: [6568:0] error: ssl handshake failed crypto error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
1048 #Sat Dec 24 03:34:44 2022 daemon.notice unbound: [6568:0] notice: ssl handshake failed 1.0.0.3 port 853
1049 # on OPENWRT_RELEASE="OpenWrt SNAPSHOT r18639-f5865452ac"
1050 # from about feb 2022
1052 # https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-families/setup-instructions/dns-over-https
1053 # forward-addr: 1.1.1.3@853#family.cloudflare-dns.com
1054 # forward-addr: 1.0.0.3@853#family.cloudflare-dns.com
1055 # forward-ssl-upstream: yes
1057 forward-addr: 1.1.1.3
1058 forward-addr: 1.0.0.3
1062 local-zone: "googlevideo.com." refuse
1063 local-zone: "video.google.com." refuse
1064 local-zone: "youtu.be." refuse
1065 local-zone: "youtube-nocookie.com." refuse
1066 local-zone: "youtube-ui.l.google.com." refuse
1067 local-zone: "youtube.com." refuse
1068 local-zone: "youtube.googleapis.com." refuse
1069 local-zone: "youtubeeducation.com." refuse
1070 local-zone: "youtubei.googleapis.com." refuse
1071 local-zone: "yt3.ggpht.com." refuse
1072 local-zone: "youtubekids.com." refuse
1073 # try global if no match in view
1078 if $unbound_restart; then
1079 /etc
/init.d
/unbound restart
1080 if ! unbound-checkconf
; then
1081 echo $0: error
: unbound-checkconf failed
>&2
1087 # # disabled for now. i want to selectively enable it
1088 # # for specific hosts.
1089 # if [[ $(uci get adblock.global.adb_enabled) != 0 ]]; then
1090 # v uci set adblock.global.adb_enabled=0
1091 # uci commit adblock
1092 # /etc/init.d/adblock restart
1094 # # https://github.com/openwrt/packages/tree/master/net/adblock/files
1095 # cat >/etc/crontabs/root <<'EOF'
1096 # 0 06 * * * /etc/init.d/adblock reload
1100 # useful: http://wiki.openwrt.org/doc/howto/dhcp.dnsmasq
1102 # sometimes /mnt/usb fails, cuz it's just a flash drive,
1103 # so make sure we have this dir or else dnsmasq will fail
1105 mkdir
-p /mnt
/usb
/tftpboot
1106 cedit
/etc
/dnsmasq.conf
<<EOF || dnsmasq_restart=true
1111 ptr-record=1.0.2.10.in-addr.arpa.,cmc.b8.nz
1113 # generated with host-info-update
1114 $(. /root/dnsmasq-data)
1116 # https://ret2got.wordpress.com/2018/01/19/how-your-ethereum-can-be-stolen-using-dns-rebinding/
1118 rebind-domain-ok=b8.nz
1120 # This says the ip of dns server.
1121 # It is default if dnsmasq is doing dns, otherwise, we have to specify it.
1122 # To see it in action, I ran this from a client machine:
1123 # sudo dhcpcd -o domain_name_servers -T
1124 dhcp-option=option:dns-server,$l.1
1126 # use this when doing fai to get the right timezone, its nfsroot is
1127 # setup to use this dhcp option only and call ntpdate.
1128 # generate ips with:
1129 # for h in 0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org ntp.ubuntu.com; do host -t a $h | awk '{print $NF}'; done | while read -r l; do printf ,$l; done
1130 dhcp-option=option:ntp-server,188.165.3.28,202.12.97.45,91.236.251.13,50.205.244.23,78.30.254.80,31.131.0.123,202.65.114.202,94.228.220.14,185.125.190.57,185.125.190.58,91.189.91.157,185.125.190.56,91.189.94.4
1133 # results from googling around dnsmasq optimizations
1134 # about 50k in memory. router has 62 megs.
1135 # in a browsing session, I probably won't ever do 5000 lookups
1136 # before the ttl expiration or whatever does expiration.
1139 # ask all servers, use the one which responds first.
1140 # http://ma.ttwagner.com/make-dns-fly-with-dnsmasq-all-servers/
1143 # namebench benchmarks dns servers. google's dns was only
1144 # slightly less fast than some others, and I trust it more
1145 # to give accurate results, stay relatively fast, and
1146 # not do anythin too malicious, so just use that.
1147 # download namebench and run it like this:
1148 # for x in all regional isp global preferred nearby; do ./namebench.py -s \$x -c US -i firefox -m weighted -J 10 -w; echo \$x; hr; done
1152 server=2606:4700:4700::1113
1153 server=2606:4700:4700::1003
1158 # server=2001:4860:4860::8888
1159 # server=2001:4860:4860::8844
1162 # to fixup existin ips, on the client you can do
1163 # sudo dhclient -r; sudo dhclient <interface-name>
1165 # /etc/init.d/dnsmasq stop
1166 # vi /tmp/dhcp.leases
1167 # /etc/init.d/dnsmasq start
1170 # default dhcp range is 100-150
1175 # pxe tftpboot for arch-like. todo: openwrt snapshot from 2022-01, it cant
1176 # access /mnt/usb/tftpboot due to ujail sandbox
1178 #tftp-root=/mnt/usb/tftpboot
1179 #tftp-root=/var/run/dnsmasq/tftpboot
1182 dhcp-optsfile=/var/run/dnsmasq/dhcpopts.conf
1184 # for debugging dhcp
1189 if $dnsmasq_restart && ! $dev2 && ! $ap; then
1190 # todo: can our ptr records be put in /etc/hosts?
1191 # eg: user normal /etc/hosts records, and they wont be used for A resolution
1192 # due to the other settings, but will be used for ptr? then maybe
1193 # we dont have to restart dnsmasq for a dns update?
1196 # https://www.redpill-linpro.com/techblog/2019/08/27/evaluating-local-dnssec-validators.html#toggling-dnssec-validation-1
1197 # we could turn on dnssec validation when wrt gets dnsmasq > 2.80. currently at 2.80.
1198 # also we can turn off dnssec in systemd-resolved if we know the router is doing it.
1200 # Also, reload of dnsmasq seems to break things, wifi
1201 # clients were not getting internet connectivity.
1203 v
/etc
/init.d
/dnsmasq restart
1207 v
/etc
/init.d
/firewall disable
1208 v
/etc
/init.d
/firewall stop
1209 elif $firewall_restart; then
1210 v
/etc
/init.d
/firewall restart
1214 # if already stopped, gives error we want to ignore
1215 /etc
/init.d
/uhttpd stop |
& sed '1{/^Command failed/d}'
1216 /etc
/init.d
/uhttpd disable |
& sed '1{/^Command failed/d}'
1218 # this may just restart the network and take care of the network_restart below.
1219 if $wireless_restart; then
1223 # todo: we should catch errors and still run this if needed
1224 if $network_restart; then