iankelling.org Git - automated-distro-installer/blob - wrt-setup-local

   1 #!/bin/bash
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # This program is free software; you can redistribute it and/or
   5 # modify it under the terms of the GNU General Public License
   6 # as published by the Free Software Foundation; either version 2
   7 # of the License, or (at your option) any later version.
   8
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU General Public License for more details.
  13
  14 # You should have received a copy of the GNU General Public License
  15 # along with this program; if not, write to the Free Software
  16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  17
  18 set -eE -o pipefail
  19 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  20
  21
  22 usage() {
  23   cat <<EOF
  24 usage: ${0##*/} [-h] [-t 2|test] [-m WIRELESS_MAC]
  25 setup my router in general: dhcp, dns, etc.
  26
  27 Type 2 or 3 is for setting up a backup device, there are two kinds so
  28 that you can switch the main device to a backup, then a backup to the
  29 main. Type test is for setting up a testing device.
  30
  31 Passing an empty string for WIRELESS_MAC will cause the device's native
  32 mac to be used.
  33
  34 EOF
  35
  36   exit $1
  37 }
  38
  39
  40 dev2=false
  41 test=false
  42 hostname=wrt
  43 libremanage_host=wrt2
  44
  45 lanip=1
  46 while getopts hm:t: opt; do
  47   case $opt in
  48     h) usage ;;
  49     t)
  50       case $2 in
  51         2|3)
  52           dev2=true
  53           libremanage_host=wrt
  54           ;;&
  55         2)
  56           lanip=4
  57           hostname=wrt2
  58           ;;
  59         3)
  60           lanip=14
  61           hostname=wrt3
  62           ;;
  63         test)
  64           test=true
  65           ;;
  66         *) echo "$0: unexpected arg to -t: $*" >&2; usage 1 ;;
  67       esac
  68       ;;
  69     m)  mac=$OPTARG ;;
  70     *) echo "$0: Internal error! unexpected args: $*" >&2 ; usage 1 ;;
  71   esac
  72 done
  73 shift "$((OPTIND-1))"   # Discard the options and sentinel --
  74
  75 if [[ ! $mac ]] && ! $test; then
  76   # if we wanted to increment it
  77   #WIRELESSMAC=${WIRELESSMAC:0: -1}$((${WIRELESSMAC: -1} + 2))
  78   mac=$WIRELESSMAC
  79 fi
  80
  81 if (( $# != 0 )); then
  82   usage 1
  83 fi
  84
  85
  86 macpre=${mac:0: -1}
  87 macsuf=${mac: -1}
  88
  89
  90 p_updated=false
  91 pmirror() {
  92   if $p_updated; then
  93     return
  94   fi
  95   # background: upgrading all packages is not recommended because it
  96   # doesn't go into the firmware. build new firmware if you want
  97   # lots of upgrades. I think /tmp/opkg-lists is a pre openwrt 14 location.
  98   f=(/var/opkg-lists/*)
  99   if ! (( $(date -r $f +%s) + 60*60*24 > $(date +%s) )); then
 100     if ! opkg update; then
 101       echo "$0: warning: opkg update failed" >&2
 102     fi
 103     p_updated=true
 104   fi
 105 }
 106
 107 pi() {
 108   to_install=()
 109   for p in "$@"; do
 110     pname=${p##*/}
 111     pname=${pname%%_*}
 112     if [[ ! $(opkg list-installed "$pname") ]]; then
 113       to_install+=($p)
 114       pmirror
 115     fi
 116   done
 117   if [[ $to_install ]]; then
 118     opkg install ${to_install[@]}
 119   fi
 120 }
 121
 122 v() {
 123   printf "+ %s\n" "$*"
 124   "$@"
 125 }
 126
 127 ######### uci example:#######
 128 # # https://wiki.openwrt.org/doc/uci
 129 # wan_index=$(uci show firewall | sed -rn 's/firewall\.@zone\[([0-9])+\]\.name=wan/\1/p')
 130 # wan="firewall.@zone[$wan_index]"
 131 # if [[ $(uci get firewall.@forwarding[0].dest) != $forward_dest ]]; then
 132 #     # default is wan
 133 #     v uci set firewall.@forwarding[0].dest=$forward_dest
 134 #     uci commit firewall
 135 #     firewall_restart=true
 136 # fi
 137 ####### end uci example #####
 138
 139 uset() {
 140   printf "+ uset %s\n" "$*"
 141   local key="$1"
 142   local val="$2"
 143   local service="${key%%.*}"
 144   restart_var=${service}_restart
 145   if [[ ! ${!restart_var} ]]; then
 146     eval $restart_var=false
 147   fi
 148   if [[ $(uci get "$key") != "$val" ]]; then
 149     v uci set "$key"="$val"
 150     uci commit $service
 151     eval $restart_var=true
 152   fi
 153 }
 154
 155
 156 ### network config
 157 ###
 158 ssid="check out gnu.org"
 159 lan=10.0.0.0
 160 if $test; then
 161   ssid="gnuv3"
 162   lan=10.1.0.0
 163 fi
 164 mask=255.255.0.0
 165 cidr=16
 166 l=${lan%.0}
 167
 168 passwd -l root ||: #already locked fails
 169
 170 sed -ibak '/^root:/d' /etc/shadow
 171 # /root/router created by manually running passwd then copying the resulting
 172 # line. We have no mkpasswd on wrt/librecmc, then we scp it in.
 173 cat /root/router >>/etc/shadow
 174 # otherwise, serial console gets root login with no password
 175 uset system.@system[0].ttylogin 1
 176
 177
 178 cat >/usr/bin/archlike-pxe-mount <<'EOFOUTER'
 179 #!/bin/bash
 180 # symlinks are collapsed for nfs mount points, so use a bind mount.
 181 # tried putting this in /etc/config/fstab,
 182 # then doing block mount, it didn't work. This doesn't persist across reboots,
 183 # todo: figure that out
 184 rm -f /etc/fstab
 185 for d in /run/{arch,parabola}iso/bootmnt; do
 186 cat >>/etc/fstab <<EOF
 187 /mnt/usb/tftpboot $d none bind 0 0
 188 EOF
 189 mount | grep $d &>/dev/null || mount $d
 190 done
 191 /etc/init.d/nfsd restart
 192 EOFOUTER
 193 chmod +x /usr/bin/archlike-pxe-mount
 194
 195 sed -i '/^root:/s,/bin/ash$,/bin/bash,' /etc/passwd
 196 # usb, screen, relay are for libremanage
 197 v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \
 198   tcpdump openvpn-openssl adblock libusb-compat /root/relay_1.0-1_mips_24kc.ipk \
 199   screen kmod-usb-serial-cp210x kmod-usb-serial-ftdi
 200
 201 cat >/etc/libremanage.conf <<EOF
 202 ${libremanage_host}_type=switch
 203 ${libremanage_host}_channel=1
 204 EOF
 205
 206
 207
 208 v /etc/init.d/fstab enable ||:
 209
 210 # rebooting makes mounting work, but comparing lsmod,
 211 # i'm guessing this will too. todo, test it.
 212 # 255 == module already loaded
 213 for mod in scsi_mod sd_mod; do v modprobe $mod || [[ $? == 255 ]]; done
 214
 215 # for archlike pxe. The default settings in the installer expect to find
 216 # the NFS at one of these dirs
 217 mkdir -p /run/archiso/bootmnt
 218 mkdir -p /run/parabolaiso/bootmnt
 219
 220 # todo: at some later time, i found /mnt/usb not mounted, watch to see if
 221 # that is the case after running this or rebooting.
 222 # wiki says safe to do in case of fstab changes:
 223
 224 ## ian: usb broke on old router. if that happens, can just comment this to disable problems
 225 # echo | cedit /etc/config/fstab ||:
 226 v cedit /etc/config/fstab <<EOF || { v block umount; v block mount; }
 227 config global automount
 228       option from_fstab 1
 229       option anon_mount 1
 230
 231 config mount
 232 # /overlay is an / overlay mount for installing extra packages, etc.
 233 # https://openwrt.org/docs/guide-user/additional-software/extroot_configuration
 234       option target     /mnt/usb
 235 #      option target    /overlay
 236       option device     /dev/sda1
 237       option fstype     ext4
 238       option options    rw,async,noatime,nodiratime
 239       option enabled    0
 240 EOF
 241
 242
 243 # ian: disabled because afaik I don't need it, no benefit.
 244 # config global autoswap
 245 #       option from_fstab 1
 246 #       option anon_swap 1
 247
 248 # config swap
 249 #       option device   /dev/sda1
 250 #       option enabled  1
 251
 252
 253
 254
 255 # exportfs -ra wont cut it when its the same path, but now a bind mount
 256 # todo: restart nfs when nfs is enabled?
 257 #cedit /etc/exports <<EOF || v /etc/init.d/nfsd restart ||:
 258 cedit /etc/exports <<EOF ||:
 259 /mnt/usb  $lan/$cidr(rw,no_root_squash,insecure,sync,no_subtree_check)
 260 # for arch pxe
 261 /run/archiso/bootmnt    $lan/$cidr(rw,no_root_squash,insecure,sync,no_subtree_check)
 262 /run/parabolaiso/bootmnt        $lan/$cidr(rw,no_root_squash,insecure,sync,no_subtree_check)
 263 EOF
 264
 265
 266 # todo: enable nfs when we need it only.
 267 # v /etc/init.d/portmap start
 268 # v /etc/init.d/nfsd start
 269 # v /etc/init.d/portmap enable
 270 # v /etc/init.d/nfsd enable
 271
 272
 273
 274
 275
 276
 277
 278 uset dropbear.@dropbear[0].PasswordAuth 0
 279 uset dropbear.@dropbear[0].RootPasswordAuth 0
 280 uset dropbear.@dropbear[0].Port 2220
 281 if ! cmp -s /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key; then
 282   cp /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key
 283   dropbear_restart=true
 284 fi
 285
 286 wireless_restart=false
 287 key=pictionary49
 288 for x in 0 1; do
 289   uset wireless.default_radio$x.ssid "$ssid"
 290   uset wireless.default_radio$x.key $key
 291   uset wireless.default_radio$x.encryption psk2
 292   if [[ $mac ]]; then
 293     uset wireless.default_radio$x.macaddr $macpre$((macsuf + 2*x))
 294   fi
 295   # secondary device has wireless disabled
 296   uset wireless.radio$x.disabled $dev2
 297 done
 298
 299 if $wireless_restart; then
 300   v wifi
 301 fi
 302
 303
 304 ########## openvpn exampl
 305 ########## missing firewall settings for routing lan
 306 ########## traffic
 307 # v /etc/init.d/openvpn start
 308 # v /etc/init.d/openvpn enable
 309
 310 # # from https://wiki.openwrt.org/doc/uci/firewall
 311 # # todo: not sure if /etc/init.d/network needs restarting.
 312 # # I did, and I had to restart the vpn afterwards.
 313 # # This maps a uci interface to a real interface which is
 314 # # managed outside of uci.
 315 # v cedit /etc/config/network <<'EOF' ||:
 316 # config interface 'tun0'
 317 #         option ifname 'tun0'
 318 #         option proto 'none'
 319 # EOF
 320 # v cedit /etc/config/openvpn <<'EOF' || v /etc/init.d/openvpn restart
 321 # config openvpn my_client_config
 322 #         option enabled 1
 323 #         option config /etc/openvpn/client.conf
 324 # EOF
 325
 326
 327
 328 v cedit /etc/config/network <<EOF || v /etc/init.d/network reload
 329 config 'route' 'transmission'
 330         option 'interface' 'lan'
 331         option 'target' '10.173.0.0'
 332         option 'netmask' '255.255.0.0'
 333         option 'gateway' '$l.3'
 334 EOF
 335
 336 firewall_restart=false
 337 v cedit /etc/config/firewall <<EOF || firewall_restart=true
 338
 339
 340 config redirect
 341  option name ssh
 342  option src              wan
 343  option src_dport        22
 344  option dest_ip          $l.8
 345  option dest             lan
 346 config rule
 347  option src              wan
 348  option target           ACCEPT
 349  option dest_port        22
 350
 351 config redirect
 352  option name sshalt
 353  option src              wan
 354  option src_dport        2222
 355  option dest_port        22
 356  option dest_ip          $l.3
 357  option dest             lan
 358 config rule
 359  option src              wan
 360  option target           ACCEPT
 361  option dest_port        2222
 362
 363 config rule
 364  option src              wan
 365  option target           ACCEPT
 366  option dest_port        2220
 367
 368
 369 config redirect
 370  option src              wan
 371  option src_dport        443
 372  option dest             lan
 373  option dest_ip          $l.8
 374  option proto            tcp
 375 config rule
 376  option src              wan
 377  option target           ACCEPT
 378  option dest_port        443
 379  option proto            tcp
 380
 381 config redirect
 382  option src              wan
 383  option src_dport        1196
 384  option dest             lan
 385  option dest_ip          $l.8
 386  option proto            udp
 387 config rule
 388  option src              wan
 389  option target           ACCEPT
 390  option dest_port        1196
 391  option proto            udp
 392
 393
 394 config redirect
 395  option src              wan
 396  option src_dport        80
 397  option dest             lan
 398  option dest_ip          $l.8
 399  option proto            tcp
 400 config rule
 401  option src              wan
 402  option target           ACCEPT
 403  option dest_port        80
 404  option proto            tcp
 405
 406 config redirect
 407  option name syncthing
 408  option src              wan
 409  option src_dport        22001
 410  option dest_ip          $l.8
 411  option dest             lan
 412 config rule
 413  option src              wan
 414  option target           ACCEPT
 415  option dest_port        22001
 416
 417
 418 config rule
 419  option name ssh-ipv6
 420  option src wan
 421  option dest lan
 422  # note, using mac transform, we could allow all traffic to a host like this,
 423  # replacing 1 as appropriate
 424  #option dest_ip ::111:11ff:fe11:1111/::ffff:ffff:ffff:ffff
 425  option dest_port 22
 426  option target ACCEPT
 427  option family ipv6
 428
 429 config rule
 430  option name http-ipv6
 431  option src wan
 432  option dest lan
 433  option dest_port 80
 434  option target ACCEPT
 435  option family ipv6
 436
 437 config rule
 438  option name https-ipv6
 439  option src wan
 440  option dest lan
 441  option dest_port 443
 442  option target ACCEPT
 443  option family ipv6
 444
 445 config rule
 446  option name node-exporter
 447  option src wan
 448  option dest lan
 449  option dest_port 9101
 450  option target ACCEPT
 451  option family ipv6
 452
 453 config rule
 454  option name mail587-ipv6
 455  option src wan
 456  option dest lan
 457  option dest_port 587
 458  option target ACCEPT
 459  option family ipv6
 460
 461
 462 EOF
 463
 464
 465
 466
 467 dnsmasq_restart=false
 468 v cedit /etc/hosts <<EOF || dnsmasq_restart=true
 469 127.0.1.1 wrt
 470 $l.1 wrt
 471 $l.2 kd
 472 $l.3 frodo
 473 $l.4 wrt2
 474 $l.5 x2
 475 $l.6 demohost
 476 $l.7 x3
 477 $l.8 tp b8.nz faiserver
 478 $l.9 bb8
 479 $l.14 wrt3
 480 72.14.176.105 li
 481 172.105.84.95 l2
 482
 483 # netns creation looks for next free subnet starting at 10.173, but I only
 484 # use one, and I would keep this one as the first created.
 485 10.173.0.2 transmission
 486 EOF
 487
 488 #mail_host=$(grep -F mail.iankelling.org /etc/hosts | awk '{print $1}')
 489 # if [[ $mail_host ]]; then
 490 #     sed -i '/^$mail_host/a mail.iankelling.org' /etc/hosts
 491 # fi
 492
 493
 494 # avoid using the dns servers that my isp tells me about.
 495 if [[ $(uci get dhcp.@dnsmasq[0].resolvfile 2>/dev/null) ]]; then
 496   # default is '/tmp/resolv.conf.auto', we switch to the dnsmasq default of
 497   # /etc/resolv.conf. not sure why I did this.
 498   v uci delete dhcp.@dnsmasq[0].resolvfile
 499   uci commit dhcp
 500   dnsmasq_restart=true
 501 fi
 502
 503 uset dhcp.@dnsmasq[0].domain b8.nz
 504 uset dhcp.@dnsmasq[0].local /b8.nz/
 505 uset system.@system[0].hostname $hostname
 506
 507 if [[ $(uci get adblock.global.adb_enabled) != 1 ]]; then
 508   v uci set adblock.global.adb_enabled=1
 509   uci commit adblock
 510   /etc/init.d/adblock restart
 511 fi
 512 # https://github.com/openwrt/packages/tree/master/net/adblock/files
 513 cat >/etc/crontabs/root <<'EOF'
 514 0 06 * * *    /etc/init.d/adblock reload
 515 EOF
 516
 517
 518 # useful: http://wiki.openwrt.org/doc/howto/dhcp.dnsmasq
 519
 520 # sometimes /mnt/usb fails, cuz it's just a flash drive,
 521 # so make sure we have this dir or else dnsmasq will fail
 522 # to start.
 523 mkdir -p /mnt/usb/tftpboot
 524 v cedit /etc/dnsmasq.conf <<EOF || dnsmasq_restart=true
 525 server=/dmarctest.b8.nz/#
 526 server=/_domainkey.b8.nz/#
 527 server=/_dmarc.b8.nz/#
 528 server=/ns1.b8.nz/#
 529 server=/ns2.b8.nz/#
 530 mx-host=b8.nz,mail.iankelling.org,10
 531 txt-record=b8.nz,"v=spf1 a ?all"
 532
 533
 534 # https://ret2got.wordpress.com/2018/01/19/how-your-ethereum-can-be-stolen-using-dns-rebinding/
 535 stop-dns-rebind
 536
 537 # this says the ip of default gateway and dns server,
 538 # but I think they are unneded and default
 539 #dhcp-option=3,$l.1
 540 #dhcp-option=6,$l.1
 541
 542
 543
 544 # results from googling around dnsmasq optimizations
 545 # about 50k in memory. router has 62 megs.
 546 # in a browsing session, I probably won't ever do 5000 lookups
 547 # before the ttl expiration or whatever does expiration.
 548 cache-size=10000
 549
 550 # ask all servers, use the one which responds first.
 551 # http://ma.ttwagner.com/make-dns-fly-with-dnsmasq-all-servers/
 552 all-servers
 553
 554 # namebench benchmarks dns servers. google's dns was only
 555 # slightly less fast than some others, and I trust it more
 556 # to give accurate results, stay relatively fast, and
 557 # not do anythin too malicious, so just use that.
 558 # download namebench and run it like this:
 559 # for x in all regional isp global preferred nearby; do ./namebench.py -s \$x -c US -i firefox -m weighted -J 10 -w; echo \$x; hr;  done
 560 # google
 561 server=8.8.4.4
 562 server=8.8.8.8
 563 server=2001:4860:4860::8888
 564 server=2001:4860:4860::8844
 565
 566
 567 # to fixup existin ips, on the client you can do
 568 # sudo dhclient -r; sudo dhclient <interface-name>
 569
 570 # default dhcp range is 100-150
 571 # bottom port,  iPXE (PCI 03:00.0) in seabios boot menu
 572 dhcp-host=c8:60:00:31:6b:75,set:kd,$l.2,kd
 573 # top port, iPXE (PCI 04:00.0) in seabios boot menu
 574 #dhcp-host=c8:60:00:2b:15:07,set:kd,$l.2,kd
 575 dhcp-host=00:26:18:97:bb:16,set:frodo,$l.3,frodo
 576 # 4 is reserved for a staticly configured host.
 577 dhcp-host=00:1f:16:16:39:24,set:x2,$l.5,x2
 578 # This is so fai can have an explicit name to use for testing,
 579 # or else any random machine which did a pxe boot would get
 580 # reformatted. The mac is from doing a virt-install, cancelling it,
 581 # and copying the generated mac, so it should be randomish.
 582 dhcp-host=52:54:00:9c:ef:ad,set:demohost,$l.6,demohost
 583 dhcp-host=00:1f:16:14:01:d8,set:tp,$l.7,x3
 584 dhcp-host=80:fa:5b:1c:6e:cf,set:tp,$l.8,tp
 585
 586 # faiserver vm
 587 dhcp-host=52:54:00:56:09:f9,set:faiserver,$l.15,faiserver
 588
 589 # This is the ip it picks by default if dhcp fails,
 590 # so might as well use it.
 591 # hostname is the name it uses according to telnet
 592 dhcp-host=b4:75:0e:94:29:ca,set:switch9429ca,$l.251,switch9429ca
 593
 594 # template
 595 # dhcp-host=,$l.,
 596
 597 # Just leave the tftp server up even if we aren't doing pxe boot.
 598 # It has no sensitive info.
 599 enable-tftp=br-lan
 600 tftp-root=/mnt/usb/tftpboot
 601 EOF
 602
 603 uset network.lan.ipaddr $l.$lanip
 604 uset network.lan.netmask $mask
 605 uset dhcp.wan.ignore $dev2 # default is false
 606 uset dhcp.lan.ignore $dev2 # default is false
 607 if $dev2; then
 608   uset network.lan.gateway $l.1
 609   uset network.wan.proto none
 610   uset network.wan6.proto none
 611 else
 612   # these are the defaults
 613   uset network.lan.gateway ''
 614   uset network.wan.proto dhcp
 615   uset network.wan6.proto dhcpv6
 616 fi
 617
 618
 619 if $dnsmasq_restart; then
 620   v /etc/init.d/dnsmasq restart
 621 fi
 622
 623 if $firewall_restart; then
 624   v /etc/init.d/firewall restart
 625 fi
 626
 627
 628
 629 if $network_restart; then
 630   reboot
 631 fi
 632 if $dropbear_restart; then
 633   v /etc/init.d/dropbear restart
 634 fi
 635
 636 exit 0