X-Git-Url: https://iankelling.org/git/?a=blobdiff_plain;f=wrt-setup-local;h=2c28dca69bfcf247c25dc52e1d8b74d8ca29b899;hb=refs%2Fheads%2Flvm-wip;hp=4dbdc0456085a099a7f2cbcce38520c356811a05;hpb=61c3a58fcfadab7c333487f887b3f9f3a53bb93a;p=automated-distro-installer diff --git a/wrt-setup-local b/wrt-setup-local index 4dbdc04..2c28dca 100755 --- a/wrt-setup-local +++ b/wrt-setup-local @@ -38,9 +38,6 @@ EOF } - - - secrets=false if [[ -e /root/router-secrets ]]; then secrets=true @@ -53,14 +50,20 @@ fi : ${hostname:=wrt} +zblock=false +if [[ -e /root/zblock ]]; then + zblock=true +fi + dnsmasq_restart=false +unbound_restart=false firewall_restart=false dev2=false test=false client=false libremanage_host=wrt2 lanip=1 -while getopts hm:t: opt; do +while getopts hm:t:yz opt; do case $opt in h) usage ;; t) @@ -86,6 +89,14 @@ while getopts hm:t: opt; do *) echo "$0: unexpected arg to -t: $*" >&2; usage 1 ;; esac ;; + y) + zblock=false + rm -f /root/zblock + ;; + z) + zblock=true + touch /root/zblock + ;; m) mac=$OPTARG ;; *) echo "$0: Internal error! unexpected args: $*" >&2 ; usage 1 ;; esac @@ -187,7 +198,9 @@ udel() { eval $restart_var=true fi } - +cedit() { + v command cedit -v "$@" +} ### network config @@ -344,7 +357,8 @@ fi # /root/relay_1.0-1_mips_24kc.ipk v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \ tcpdump openvpn-openssl adblock libusb-compat \ - screen kmod-usb-serial-cp210x kmod-usb-serial-ftdi rsync + screen kmod-usb-serial-cp210x kmod-usb-serial-ftdi rsync\ + unbound-daemon-heavy unbound-checkconf cat >/etc/libremanage.conf < [1614982580.5192] dhcp6 (wlan0): option dhcp6_name_servers => 'fd58:5801:8e02::1' +# but i dont want ipv6 dns, just keep it simple to ipv4. +# I know my isp doesnt have ipv6 right now, +# so just stop this thing. +# note: tried this, it didn't do anything: +# uset dhcp.@odhcpd[0].dns 10.2.0.1 +/etc/init.d/odhcpd stop +/etc/init.d/odhcpd disable +# todo: make the above conditional on which server this is. + +# avoid errors in log. current isp doesnt have ipv6 +uset unbound.@unbound[0].protocol ip4_only + +# todo: im not sure all these are needed, but they all look +# like good options. +# https://blog.cloudflare.com/dns-over-tls-for-openwrt/ +# https://gist.github.com/vqiu/7b32d3a19a7a09d32e108d998de166c2 +#https://blog.thestateofme.com/2018/04/04/howto-secure-your-dns-with-a-raspberry-pi-unbound-and-cloudflare-1-1-1-1/ +# +# # i found that the zone example was having no effect on the config +# # here: +# https://github.com/openwrt/packages/blob/openwrt-19.07/net/unbound/files/README.md +# +# # todo: unbound-control, i'm not sure what the purpose of that thing is, some +# # kind of coordination with dhcp of dnsmasq, but what? +# +# note: for debugging, edit /etc/init.d/unbound, change +# procd_set_param command $PROG -d -c $UB_TOTAL_CONF +# to: +# procd_set_param command $PROG -vvv -d -c $UB_TOTAL_CONF + +{ + cat <<'EOF' +do-tcp: yes +prefetch: yes +qname-minimisation: yes +rrset-roundrobin: yes +use-caps-for-id: yes +do-ip6: no +private-domain: b8.nz +local-zone: "10.in-addr.arpa." transparent +access-control-view: 10.2.0.31/32 "youtube" +EOF + + if $zblock; then + cat <<'EOF' +# amy, amyw, samsungtab +access-control-view: 10.2.0.8/32 "youtube" +access-control-view: 10.2.0.23/32 "youtube" +access-control-view: 10.2.0.32/32 "youtube" +EOF + fi +} | cedit /etc/unbound/unbound_srv.conf || restart_unbound=true + + +# dns based blocking vs ip based. with ip, same +# server can have multiple domains. in dns, +# you have to make sure clients to use the local dns. +# https dns will need to be blocked by ip in +# order to be comprehensive + +cedit /etc/unbound/unbound_ext.conf <<'EOF' || restart_unbound=true +local-data-ptr: "10.2.0.1 cmc.b8.nz" +local-data-ptr: "10.2.0.2 kd.b8.nz" +local-data-ptr: "10.2.0.3 sy.b8.nz" +local-data-ptr: "10.2.0.4 wrt2.b8.nz" +local-data-ptr: "10.2.0.5 x2.b8.nz" +local-data-ptr: "10.2.0.6 x2w.b8.nz" +local-data-ptr: "10.2.0.7 syw.b8.nz" +local-data-ptr: "10.2.0.8 amy.b8.nz" +local-data-ptr: "10.2.0.9 bb8.b8.nz" +local-data-ptr: "10.2.0.12 demohost.b8.nz" +local-data-ptr: "10.2.0.14 wrt3.b8.nz" +local-data-ptr: "10.2.0.19 brother.b8.nz" +local-data-ptr: "10.2.0.23 amyw.b8.nz" +local-data-ptr: "10.2.0.25 hp.b8.nz" +local-data-ptr: "10.2.0.31 amazontab.b8.nz" +local-data-ptr: "10.2.0.32 samsungtab.b8.nz" +local-data-ptr: "10.173.0.2 transmission.b8.nz" +local-data-ptr: "10.173.8.1 defaultnn.b8.nz" +local-data-ptr: "10.173.8.2 nn.b8.nz" + +forward-zone: + name: "." +# https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-families/setup-instructions/dns-over-https + forward-addr: 1.1.1.3@853#family.cloudflare-dns.com + forward-addr: 1.0.0.3@853#family.cloudflare-dns.com + forward-ssl-upstream: yes + forward-first: no + +view: + name: "youtube" + local-zone: "googlevideo.com." refuse + local-zone: "video.google.com." refuse + local-zone: "youtu.be." refuse + local-zone: "youtube-nocookie.com." refuse + local-zone: "youtube-ui.l.google.com." refuse + local-zone: "youtube.com." refuse + local-zone: "youtube.googleapis.com." refuse + local-zone: "youtubeeducation.com." refuse + local-zone: "youtubei.googleapis.com." refuse + local-zone: "yt3.ggpht.com." refuse + local-zone: "youtubekids.com." refuse + # try global if no match in view + view-first: yes +EOF + + +if $restart_unbound; then + /etc/init.d/unbound restart + if ! unbound-checkconf; then + echo $0: error: unbound-checkconf failed >&2 + exit 1 + fi +fi + # disabled for now. i want to selectively enable it # for specific hosts. @@ -769,32 +987,21 @@ EOF # so make sure we have this dir or else dnsmasq will fail # to start. mkdir -p /mnt/usb/tftpboot -v cedit /etc/dnsmasq.conf < +# or on cmc, +# /etc/init.d/dnsmasq stop +# vi /tmp/dhcp.leases +# /etc/init.d/dnsmasq start + # default dhcp range is 100-150 # bottom port, iPXE (PCI 03:00.0) in seabios boot menu @@ -848,13 +1061,18 @@ dhcp-host=80:fa:5b:1c:6e:cf,set:amy,$l.8,amy # and copying the generated mac, so it should be randomish. dhcp-host=52:54:00:9c:ef:ad,set:demohost,$l.12,demohost dhcp-host=62:03:cb:a8:3e:a3,set:trp,$1.13,trp +# 14 = wrt3 dhcp-host=00:1f:16:14:01:d8,set:x3,$l.18,x3 # BRN001BA98CA823 in dhcp logs dhcp-host=00:1b:a9:8c:a8:23,set:brother,$l.19,brother dhcp-host=00:26:b6:f7:d4:d8,set:amyw,$l.23,amyw +dhcp-host=9a:c6:52:6f:ce:7c,set:onep9,$l.24,onep9 dhcp-host=38:63:bb:07:5a:f9,set:hp,$l.25,hp dhcp-host=00:26:b6:f6:0f:e9,set:frodow,$l.28,frodow +dhcp-host=6c:56:97:88:7b:74,set:amazontab,$l.31,amazontab +dhcp-host=0a:8a:9b:cf:b5:ec,set:samsungtab,$l.32,samsungtab + # faiserver vm @@ -884,14 +1102,14 @@ if $dnsmasq_restart && ! $dev2; then # due to the other settings, but will be used for ptr? then maybe # we dont have to restart dnsmasq for a dns update? # - # todo: according to this + # interesing link: # https://www.redpill-linpro.com/techblog/2019/08/27/evaluating-local-dnssec-validators.html#toggling-dnssec-validation-1 - # we should turn on dnssec validation when wrt gets version > 2.80. currently at 2.80. - # todo: download https://downloads.openwrt.org/snapshots/packages/mipsel_24kc/base/dnsmasq-full_2.84-1_mipsel_24kc.ipk - # and install it. then we can turn off dnssec in systemd-resolved + # we could turn on dnssec validation when wrt gets dnsmasq > 2.80. currently at 2.80. + # also we can turn off dnssec in systemd-resolved if we know the router is doing it. # # Also, reload of dnsmasq seems to break things, wifi # clients were not getting internet connectivity. + v /etc/init.d/dnsmasq restart fi