8b53702f3a0eb8eeebff81791a902be47fd242f2
[automated-distro-installer] / wrt-setup-local
1 #!/bin/bash
2 # Copyright (C) 2016 Ian Kelling
3
4 # This program is free software; you can redistribute it and/or
5 # modify it under the terms of the GNU General Public License
6 # as published by the Free Software Foundation; either version 2
7 # of the License, or (at your option) any later version.
8
9 # This program is distributed in the hope that it will be useful,
10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 # GNU General Public License for more details.
13
14 # You should have received a copy of the GNU General Public License
15 # along with this program; if not, write to the Free Software
16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
17
18
19 f=/usr/local/lib/err;test -r $f || { echo "error: $0 no $f" >&2;exit 1;}; . $f
20
21 usage() {
22 cat <<EOF
23 usage: ${0##*/} [-h] [-t 2|3|test|client] [-m WIRELESS_MAC] [hostname]
24 setup my router in general: dhcp, dns, etc.
25
26 Type 2 or 3 is for setting up a backup device, there are two kinds so
27 that you can switch the main device to a backup, then a backup to the
28 main. Type test is for setting up a testing device.
29
30 Passing an empty string for WIRELESS_MAC, or if none is defined in the
31 secrets file, will cause the device's native mac to be used.
32
33 EOF
34
35 exit $1
36 }
37
38
39
40 zblock=false
41 if [[ -e /root/zblock ]]; then
42 zblock=true
43 fi
44
45 dnsmasq_restart=false
46 unbound_restart=false
47 firewall_restart=false
48 dev2=false
49 test=false
50 client=false
51 ap=false
52 libremanage_host=wrt2
53 lanip=1
54 while getopts hm:t:yz opt; do
55 case $opt in
56 h) usage ;;
57 t)
58 case $2 in
59 2|3)
60 dev2=true
61 libremanage_host=$hostname
62 ;;&
63 2)
64 lanip=4
65 hostname=wrt2
66 ;;
67 3)
68 lanip=14
69 hostname=wrt3
70 ;;
71 test)
72 test=true
73 ;;
74 client)
75 client=true
76 ;;
77 ap)
78 ap=true
79 lanip=53
80 hostname=cmcap
81 ;;
82 *) echo "$0: unexpected arg to -t: $*" >&2; usage 1 ;;
83 esac
84 ;;
85 y)
86 zblock=false
87 rm -f /root/zblock
88 ;;
89 z)
90 zblock=true
91 touch /root/zblock
92 ;;
93 m) mac=$OPTARG ;;
94 *) echo "$0: Internal error! unexpected args: $*" >&2 ; usage 1 ;;
95 esac
96 done
97 shift "$((OPTIND-1))" # Discard the options and sentinel --
98
99 if [[ $1 ]]; then
100 h=$1
101 elif [[ $hostname ]]; then
102 h=$hostname
103 else
104 h=cmc
105 fi
106
107 if [[ ! $hostname ]]; then
108 hostname=$h
109 fi
110
111
112 secrets=false
113 if [[ -e /root/router-secrets ]]; then
114 secrets=true
115 source /root/router-secrets
116 fi
117
118 if [[ ! $mac ]] && ! $test && $secrets; then
119 # if we wanted to increment it
120 #mac=${mac:0: -1}$((${mac: -1} + 2))
121 mac=${rwmac[$h]}
122 fi
123
124 if (( $# != 0 )); then
125 usage 1
126 fi
127
128
129 macpre=${mac:0: -1}
130 macsuf=${mac: -1}
131
132
133 p_updated=false
134 pmirror() {
135 if $p_updated; then
136 return
137 fi
138 # background: upgrading all packages is not recommended because it
139 # doesn't go into the firmware. build new firmware if you want
140 # lots of upgrades. I think /tmp/opkg-lists is a pre openwrt 14 location.
141 f=(/var/opkg-lists/*)
142 if ! (( $(date -r $f +%s) + 60*60*24 > $(date +%s) )); then
143 if ! opkg update; then
144 echo "$0: warning: opkg update failed" >&2
145 fi
146 p_updated=true
147 fi
148 }
149
150 pi() {
151 to_install=()
152 for p in "$@"; do
153 pname=${p##*/}
154 pname=${pname%%_*}
155 if [[ ! $(opkg list-installed "$pname") ]]; then
156 to_install+=($p)
157 pmirror
158 fi
159 done
160 if [[ $to_install ]]; then
161 opkg install ${to_install[@]}
162 fi
163 }
164
165 v() {
166 printf "+ %s\n" "$*"
167 "$@"
168 }
169
170 ######### uci example:#######
171 # # https://wiki.openwrt.org/doc/uci
172 # wan_index=$(uci show firewall | sed -rn 's/firewall\.@zone\[([0-9])+\]\.name=wan/\1/p')
173 # wan="firewall.@zone[$wan_index]"
174 # if [[ $(uci get firewall.@forwarding[0].dest) != $forward_dest ]]; then
175 # # default is wan
176 # v uci set firewall.@forwarding[0].dest=$forward_dest
177 # uci commit firewall
178 # firewall_restart=true
179 # fi
180 ####### end uci example #####
181
182 uset() {
183 printf "+ uset %s\n" "$*"
184 local key="$1"
185 local val="$2"
186 local service="${key%%.*}"
187 restart_var=${service}_restart
188 if [[ ! ${!restart_var} ]]; then
189 eval $restart_var=false
190 fi
191 if [[ $(uci get "$key") != "$val" ]]; then
192 v uci set "$key"="$val"
193 uci commit $service
194 eval $restart_var=true
195 fi
196 }
197
198 udel() {
199 printf "+ udel %s\n" "$*"
200 local key="$1"
201 local val="$2"
202 local service="${key%%.*}"
203 restart_var=${service}_restart
204 if [[ ! ${!restart_var} ]]; then
205 eval $restart_var=false
206 fi
207 if uci get "$key" &>/dev/null; then
208 v uci set "$key"="$val"
209 uci commit $service
210 eval $restart_var=true
211 fi
212 }
213 cedit() {
214 v command cedit -v "$@"
215 }
216
217
218 ### network config
219 ###
220 lan=10.0.0.0
221 if $test; then
222 lan=10.1.0.0
223 elif [[ $hostname == cmc || $hostname == cmcap ]]; then
224 lan=10.2.0.0
225 elif $client; then
226 lan=10.3.0.0
227 fi
228
229 if $test; then
230 ssid="gnuv3"
231 elif $secrets; then
232 ssid=${rssid[$h]}
233 fi
234
235 : ${ssid:=librecmc}
236
237
238 if $secrets; then
239 key=${rkey[$h]}
240 fi
241 : ${key:=pictionary49}
242
243 mask=255.255.0.0
244 cidr=16
245 l=${lan%.0}
246
247 # why did we lock this? i don't know
248 #passwd -l root ||: #already locked fails
249
250 sed -ibak '/^root:/d' /etc/shadow
251 # /root/router created by manually running passwd then copying the resulting
252 # line. We have no mkpasswd on wrt/librecmc, then we scp it in.
253 cat /root/router >>/etc/shadow
254 # otherwise, serial console gets root login with no password
255 uset system.@system[0].ttylogin 1
256
257
258
259 cat >/usr/bin/archlike-pxe-mount <<'EOFOUTER'
260 #!/bin/bash
261 # symlinks are collapsed for nfs mount points, so use a bind mount.
262 # tried putting this in /etc/config/fstab,
263 # then doing block mount, it didn't work. This doesn't persist across reboots,
264 # todo: figure that out
265 rm -f /etc/fstab
266 for d in /run/{arch,parabola}iso/bootmnt; do
267 cat >>/etc/fstab <<EOF
268 /mnt/usb/tftpboot $d none bind 0 0
269 EOF
270 mount | grep $d &>/dev/null || mount $d
271 done
272 /etc/init.d/nfsd restart
273 EOFOUTER
274 chmod +x /usr/bin/archlike-pxe-mount
275
276 sed -i '/^root:/s,/bin/ash$,/bin/bash,' /etc/passwd
277
278
279
280 uset dropbear.@dropbear[0].PasswordAuth 0
281 uset dropbear.@dropbear[0].RootPasswordAuth 0
282 uset dropbear.@dropbear[0].Port 2220
283 if ! cmp -s /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key; then
284 cp /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key
285 dropbear_restart=true
286 fi
287
288 if $dropbear_restart; then
289 v /etc/init.d/dropbear restart
290 fi
291
292
293 uset network.lan.ipaddr $l.$lanip
294 uset network.lan.netmask $mask
295 if $dev2 || $client || $ap; then
296 if $dev2 || $ap; then
297 uset network.lan.gateway $l.1
298 uset network.wan.proto none
299 uset network.wan6.proto none
300 fi
301 /etc/init.d/dnsmasq stop
302 /etc/init.d/dnsmasq disable
303 /etc/init.d/odhcpd stop
304 /etc/init.d/odhcpd disable
305 rm -f /etc/resolv.conf
306 if $ap; then
307 cat >/etc/resolv.conf <<EOF
308 nameserver $l.1
309 EOF
310 else
311 cat >/etc/resolv.conf <<'EOF'
312 nameserver 8.8.8.8
313 nameserver 8.8.4.4
314 EOF
315 fi
316
317 # things i tried to keep dnsmasq running but not enabled except local dns,
318 # but it didnt work right and i dont need it anyways.
319 # uset dhcp.wan.ignore $dev2 # default is false
320 # uset dhcp.lan.ignore $dev2 # default is false
321 # uset dhcp.@dnsmasq[0].interface lo
322 # uset dhcp.@dnsmasq[0].localuse 0
323 # uset dhcp.@dnsmasq[0].resolvfile /etc/dnsmasq.conf
324 # uset dhcp.@dnsmasq[0].noresolv 1
325 # todo: populate /etc/resolv.conf with a static value
326
327 else
328 # these are the defaults
329
330 # this is not needed unless switching from the above condition.
331 # disabling just to debug
332 #uset network.lan.gateway ''
333
334 uset network.wan.proto dhcp
335 uset network.wan6.proto dhcpv6
336 /etc/init.d/dnsmasq start
337 # todo: figure out why this returns 1
338 /etc/init.d/dnsmasq enable ||:
339 /etc/init.d/odhcpd start
340 /etc/init.d/odhcpd enable
341 fi
342
343 wireless_restart=false
344
345 if $client; then
346 uset wireless.default_radio0.network 'wwan'
347 uset wireless.default_radio0.ssid ${rclientssid[$h]}
348 uset wireless.default_radio0.encryption 'psk2'
349 uset wireless.default_radio0.device 'radio0'
350 uset wireless.default_radio0.mode 'sta'
351 uset wireless.default_radio0.bssid ${rclientbssid[$h]}
352 # todo: look into whether 5g network is available.
353 uset wireless.default_radio0.key ${rclientkey[$h]}
354 uset wireless.radio0.disabled false
355 uset wireless.radio1.disabled true
356 else
357 # defaults, just reseting in case client config ran
358 uset wireless.default_radio0.network lan
359 uset wireless.default_radio0.mode ap
360 for x in 0 1; do
361 uset wireless.default_radio$x.ssid "$ssid"
362 uset wireless.default_radio$x.key $key
363 uset wireless.default_radio$x.encryption psk2
364 if [[ $mac ]]; then
365 uset wireless.default_radio$x.macaddr $macpre$((macsuf + 2*x))
366 fi
367 # disable/enable. secondary device has wireless disabled
368 uset wireless.radio$x.disabled $dev2
369 done
370 fi
371
372 if grep '^OPENWRT_BOARD="mvebu/cortexa9"' /etc/os-release &>/dev/null; then
373 # todo, I also enabled irqbalance, didnt script it though
374 # https://forum.openwrt.org/t/wrt1900acs-wifi-issue-after-upgrade-from-19-07-to-21-02-vacuum-cleaner-legacy-rate-support/113311/28
375 cat >/etc/rc.local <<'EOF'
376 echo "0" >> /sys/kernel/debug/ieee80211/phy0/mwlwifi/tx_amsdu
377 echo "0" >> /sys/kernel/debug/ieee80211/phy1/mwlwifi/tx_amsdu
378 exit 0
379 EOF
380 chmod +x /etc/rc.local
381 /etc/rc.local
382 uset wireless.radio0.disassoc_low_ack 0
383 uset wireless.radio1.disassoc_low_ack 0
384 fi
385
386
387 # found with https://openwrt.org/docs/guide-user/network/wifi/iwchan.
388 # However, the default also chooses 11, and better to let it choose in case things change.
389 # case $HOSTNAME in
390 # cmc)
391 # uset wireless.radio0.channel 11
392 # ;;
393 # esac
394
395
396 # usb, screen, relay are for libremanage
397 # rsync is for brc
398 #
399 # relay package temporarily disabled
400 # /root/relay_1.0-1_mips_24kc.ipk
401 #
402 # note: prometheus-node-exporter-lua-openwrt seems to be a dependency of
403 # prometheus-node-exporter-lua in practice.
404
405 pkgs=(
406 tcpdump
407 screen
408 rsync
409 kmod-usb-storage
410 block-mount
411 kmod-fs-ext4
412 prometheus-node-exporter-lua-openwrt
413 prometheus-node-exporter-lua
414 )
415
416 if ! $ap; then
417 pkgs+=(
418 unbound-daemon
419 unbound-checkconf
420 )
421 fi
422
423 v pi "${pkgs[@]}"
424 # nfs-kernel-server \
425 # openvpn-openssl adblock libusb-compat \
426 # kmod-usb-serial-cp210x kmod-usb-serial-ftdi \
427
428
429 cat >/etc/libremanage.conf <<EOF
430 ${libremanage_host}_type=switch
431 ${libremanage_host}_channel=1
432 EOF
433
434
435
436 v /etc/init.d/fstab enable ||:
437
438 # rebooting makes mounting work, but comparing lsmod,
439 # i'm guessing this will too. todo, test it.
440 # 255 == module already loaded
441 for mod in scsi_mod sd_mod; do v modprobe $mod || [[ $? == 255 ]]; done
442
443 # for archlike pxe. The default settings in the installer expect to find
444 # the NFS at one of these dirs
445 mkdir -p /run/archiso/bootmnt
446 mkdir -p /run/parabolaiso/bootmnt
447
448 # todo: at some later time, i found /mnt/usb not mounted, watch to see if
449 # that is the case after running this or rebooting.
450 # wiki says safe to do in case of fstab changes:
451
452 ## ian: usb broke on old router. if that happens, can just comment this to disable problems
453 # echo | cedit /etc/config/fstab ||:
454 cedit /etc/config/fstab <<EOF || { v block umount; v block mount; }
455 config global automount
456 option from_fstab 1
457 option anon_mount 1
458
459 config mount
460 # /overlay is an / overlay mount for installing extra packages, etc.
461 # https://openwrt.org/docs/guide-user/additional-software/extroot_configuration
462 option target /mnt/usb
463 # option target /overlay
464 option device /dev/sda1
465 option fstype ext4
466 option options rw,async,noatime,nodiratime
467 option enabled 0
468 EOF
469
470
471 # ian: disabled because afaik I don't need it, no benefit.
472 # config global autoswap
473 # option from_fstab 1
474 # option anon_swap 1
475
476 # config swap
477 # option device /dev/sda1
478 # option enabled 1
479
480
481
482
483 # exportfs -ra wont cut it when its the same path, but now a bind mount
484 # todo: restart nfs when nfs is enabled?
485 #cedit /etc/exports <<EOF || v /etc/init.d/nfsd restart ||:
486 cedit /etc/exports <<EOF ||:
487 /mnt/usb $lan/$cidr(rw,no_root_squash,insecure,sync,no_subtree_check)
488 # for arch pxe
489 /run/archiso/bootmnt $lan/$cidr(rw,no_root_squash,insecure,sync,no_subtree_check)
490 /run/parabolaiso/bootmnt $lan/$cidr(rw,no_root_squash,insecure,sync,no_subtree_check)
491 EOF
492
493
494 # todo: enable nfs when we need it only.
495 # v /etc/init.d/portmap start
496 # v /etc/init.d/nfsd start
497 # v /etc/init.d/portmap enable
498 # v /etc/init.d/nfsd enable
499
500
501 cedit /etc/config/prometheus-node-exporter-lua <<'EOF' || /etc/init.d/prometheus-node-exporter-lua restart
502 config prometheus-node-exporter-lua 'main'
503 option listen_ipv6 '0'
504 option listen_interface 'lan'
505 option listen_port '9100
506 EOF
507
508 # default, as of this writing is:
509 # config prometheus-node-exporter-lua 'main'
510 # option listen_interface 'loopback'
511 # option listen_port '9100'
512
513
514
515
516
517 ########## openvpn exampl
518 ########## missing firewall settings for routing lan
519 ########## traffic
520 # v /etc/init.d/openvpn start
521 # v /etc/init.d/openvpn enable
522
523 # # from https://wiki.openwrt.org/doc/uci/firewall
524 # # todo: not sure if /etc/init.d/network needs restarting.
525 # # I did, and I had to restart the vpn afterwards.
526 # # This maps a uci interface to a real interface which is
527 # # managed outside of uci.
528 # cedit /etc/config/network <<'EOF' ||:
529 # config interface 'tun0'
530 # option ifname 'tun0'
531 # option proto 'none'
532 # EOF
533 # cedit /etc/config/openvpn <<'EOF' || v /etc/init.d/openvpn restart
534 # config openvpn my_client_config
535 # option enabled 1
536 # option config /etc/openvpn/client.conf
537 # EOF
538
539 wgip4=10.3.0.1/24
540 wgip6=fdfd::1/64
541 wgport=26000
542
543 network_restart=false
544 if $client; then
545 cedit wific /etc/config/network <<EOF || network_restart=true
546 # https://openwrt.org/docs/guide-user/network/wifi/connect_client_wifi
547 config interface 'wwan'
548 option proto 'dhcp'
549 EOF
550 fi
551
552 cedit /etc/config/network <<EOF || network_restart=true
553 config 'route' 'transmission'
554 option 'interface' 'lan'
555 option 'target' '10.174.0.0'
556 option 'netmask' '255.255.0.0'
557 option 'gateway' '$l.2'
558
559 option interface 'wg0'
560 option proto 'wireguard'
561 option private_key '$(cat /root/wg.key)'
562 option listen_port $wgport
563 list addresses '10.3.0.1/24'
564 list addresses 'fdfd::1/64'
565
566 # tp
567 config wireguard_wg0 'wgclient'
568 option public_key '3q+WJGrm85r59NgeXOIvppxoW4ux/+koSw6Fee1c1TI='
569 option preshared_key '$(cat /root/wg.psk)'
570 list allowed_ips '10.3.0.2/24'
571 list allowed_ips 'fdfd::2/64'
572 EOF
573
574 # Need to reload before we change dnsmasq to give out
575 # static ips in our new range.
576 if $network_restart; then
577 v /etc/init.d/network reload
578 fi
579
580 firewall-cedit() {
581
582 if $client; then
583 cedit wific /etc/config/firewall <<EOF
584 config zone
585 option name wwan
586 option input REJECT
587 option output ACCEPT
588 option forward REJECT
589 option masq 1
590 option mtu_fix 1
591 option network wwan
592 EOF
593 fi
594
595 case $hostname in
596 wrt)
597 cedit host /etc/config/firewall <<EOF
598 config redirect
599 option name ssh
600 option src wan
601 option src_dport 22
602 option dest_ip $l.3
603 option dest lan
604 EOF
605 ;;
606 cmc)
607 cedit host /etc/config/firewall <<EOF
608 config redirect
609 option name ssh
610 option src wan
611 option src_dport 22
612 option dest_ip $l.2
613 option dest lan
614 EOF
615 ;;
616 esac
617
618
619 cedit /etc/config/firewall <<EOF
620 ## begin no external dns for ziva
621 config rule
622 option src lan
623 option src_ip 10.2.0.23
624 option dest_port 53
625 option dest wan
626 option target REJECT
627
628
629 config rule
630 option src wan
631 option dest_ip 10.2.0.23
632 option src_port 53
633 option dest lan
634 option target REJECT
635
636
637 config rule
638 option src lan
639 option src_ip 10.2.0.31
640 option dest_port 53
641 option dest wan
642 option target REJECT
643
644
645 config rule
646 option src wan
647 option dest_ip 10.2.0.31
648 option src_port 53
649 option dest lan
650 option target REJECT
651
652
653 config rule
654 option src lan
655 option src_ip 10.2.0.32
656 option dest_port 53
657 option dest wan
658 option target REJECT
659
660
661 config rule
662 option src wan
663 option dest_ip 10.2.0.32
664 option src_port 53
665 option dest lan
666 option target REJECT
667 ## end no external dns for ziva
668
669
670 config rule
671 option src wan
672 option target ACCEPT
673 option dest_port 22
674
675 config redirect
676 option name promkd
677 option src wan
678 option src_dport 9091
679 option dest_port 9091
680 option dest_ip $l.2
681 option dest lan
682 config rule
683 option src wan
684 option target ACCEPT
685 option dest_port 9091
686
687
688 config redirect
689 option name nagioskd
690 option src wan
691 option src_dport 3005
692 option dest_port 3005
693 option dest_ip $l.2
694 option dest lan
695 config rule
696 option src wan
697 option target ACCEPT
698 option dest_port 3005
699
700
701 config redirect
702 option name sshkd
703 option src wan
704 option src_dport 2202
705 option dest_port 22
706 option dest_ip $l.2
707 option dest lan
708 config rule
709 option src wan
710 option target ACCEPT
711 option dest_port 2202
712
713 # was working on an openvpn server, didn't finish
714 # config redirect
715 # option name vpnkd
716 # option src wan
717 # option src_dport 1196
718 # option dest_port 1196
719 # option dest_ip $l.2
720 # option dest lan
721 # config rule
722 # option src wan
723 # option target ACCEPT
724 # option dest_port 1196
725
726
727 config redirect
728 option name sshkdalt
729 option src wan
730 option src_dport 8989
731 option dest_port 8989
732 option dest_ip $l.2
733 option dest lan
734 config rule
735 option src wan
736 option target ACCEPT
737 option dest_port 8989
738
739
740 config redirect
741 option name sshx2
742 option src wan
743 option src_dport 2205
744 option dest_port 22
745 option dest_ip $l.5
746 option dest lan
747 config rule
748 option src wan
749 option target ACCEPT
750 option dest_port 2205
751
752 config redirect
753 option name sshx3
754 option src wan
755 option src_dport 2207
756 option dest_port 22
757 option dest_ip $l.7
758 option dest lan
759 config rule
760 option src wan
761 option target ACCEPT
762 option dest_port 2207
763
764 config redirect
765 option name sshtp
766 option src wan
767 option src_dport 2208
768 option dest_port 22
769 option dest_ip $l.8
770 option dest lan
771 config rule
772 option src wan
773 option target ACCEPT
774 option dest_port 2208
775
776 config redirect
777 option name sshbb8
778 option src wan
779 option src_dport 2209
780 option dest_port 22
781 option dest_ip $l.9
782 option dest lan
783 config rule
784 option src wan
785 option target ACCEPT
786 option dest_port 2209
787
788
789 config redirect
790 option name sshfrodo
791 option src wan
792 option src_dport 2228
793 option dest_port 22
794 option dest_ip $l.28
795 option dest lan
796 config rule
797 option src wan
798 option target ACCEPT
799 option dest_port 2228
800
801
802 config redirect
803 option name icecast
804 option src wan
805 option src_dport 8000
806 option dest_port 8000
807 option dest_ip $l.2
808 option dest lan
809 config rule
810 option src wan
811 option target ACCEPT
812 option dest_port 8000
813
814 config rule
815 option name sshcmc
816 option src wan
817 option target ACCEPT
818 option dest_port 2220
819
820 config rule
821 option name wg
822 option src wan
823 option target ACCEPT
824 option dest_port $wgport
825 option proto udp
826
827 config redirect
828 option name navidrome
829 option src wan
830 option src_dport 4533
831 option dest_port 4533
832 option dest_ip $l.2
833 option dest lan
834 config rule
835 option src wan
836 option target ACCEPT
837 option dest_port 4533
838
839 # So a client can just have i.b8.nz dns even when they
840 # are on the lan.
841 #config redirect
842 # option name navidromelan
843 # option src lan
844 # option src_dport 4533
845 # option dest_port 4533
846 # option dest_ip $l.2
847 # option dest lan
848
849
850 # config redirect
851 # option name icecast
852 # option src wan
853 # option src_dport 8000
854 # option dest_port 8000
855 # option dest_ip $l.2
856 # option dest lan
857 # config rule
858 # option src wan
859 # option target ACCEPT
860 # option dest_port 8000
861
862 config redirect
863 option name http
864 option src wan
865 option src_dport 80
866 option dest lan
867 option dest_ip $l.2
868 option proto tcp
869 config rule
870 option src wan
871 option target ACCEPT
872 option dest_port 80
873 option proto tcp
874
875 config redirect
876 option name https
877 option src wan
878 option src_dport 443
879 option dest lan
880 option dest_ip $l.2
881 option proto tcp
882 config rule
883 option src wan
884 option target ACCEPT
885 option dest_port 443
886 option proto tcp
887
888 # config redirect
889 # option name httpskd8448
890 # option src wan
891 # option src_dport 8448
892 # option dest lan
893 # option dest_ip $l.2
894 # option proto tcp
895 # config rule
896 # option src wan
897 # option target ACCEPT
898 # option dest_port 8448
899 # option proto tcp
900
901 config redirect
902 option name syncthing
903 option src wan
904 option src_dport 22001
905 option dest_ip $l.8
906 option dest lan
907 config rule
908 option src wan
909 option target ACCEPT
910 option dest_port 22001
911
912
913 #config redirect
914 # option name i2p
915 # option src wan
916 # option src_dport $i2pport
917 # option dest_ip $l.178
918 # option dest lan
919 #config rule
920 # option src wan
921 # option target ACCEPT
922 # option dest_port $i2pport
923
924 config rule
925 option name ssh-ipv6
926 option src wan
927 option dest lan
928 # note, using mac transform, we could allow all traffic to a host like this,
929 # replacing 1 as appropriate
930 #option dest_ip ::111:11ff:fe11:1111/::ffff:ffff:ffff:ffff
931 option dest_port 22
932 option target ACCEPT
933 option family ipv6
934
935 # config rule
936 # option name http-ipv6
937 # option src wan
938 # option dest lan
939 # option dest_port 80
940 # option target ACCEPT
941 # option family ipv6
942
943 # config rule
944 # option name https-ipv6
945 # option src wan
946 # option dest lan
947 # option dest_port 443
948 # option target ACCEPT
949 # option family ipv6
950
951 config rule
952 option name node-exporter
953 option src wan
954 option dest lan
955 option dest_port 9101
956 option target ACCEPT
957 option family ipv6
958
959 config rule
960 option name mail587-ipv6
961 option src wan
962 option dest lan
963 option dest_port 587
964 option target ACCEPT
965 option family ipv6
966
967 EOF
968 }
969 firewall-cedit || firewall_restart=true
970
971 # firewall comment:
972 # not using and in newer wrt, fails, probably due to nonexistent file, error output
973 # on:
974
975 # Reference error: left-hand side expression is not an array or object
976 # In [anonymous function](), file /usr/share/ucode/fw4.uc, line 3137, byte 12:
977 # called from function [arrow function] (/usr/share/ucode/fw4.uc:733:71)
978 # called from function foreach ([C])
979 # called from function [anonymous function] (/usr/share/ucode/fw4.uc:733:72)
980 # called from function render_ruleset (/usr/share/firewall4/main.uc:56:24)
981 # called from anonymous function (/usr/share/firewall4/main.uc:143:29)
982 #
983 # ` if (!inc.enabled) {`
984 # Near here -------^
985 #
986 #
987 # The rendered ruleset contains errors, not doing firewall restart.
988 # /usr/bin/wrt-setup-local:160:error: ""$@"" returned 1
989
990 ## include a file with users custom iptables rules
991 #config include
992 # option path /etc/firewall.user
993 # option type 'restore'
994 # option family 'ipv4'
995
996
997
998 # not using wireguard for now
999 # if ! uci get firewall.@zone[1].network | grep wg0 &>/dev/null; then
1000 # # cant mix cedit plus uci
1001 # echo | cedit /etc/config/firewall ||:
1002 # uci add_list firewall.@zone[1].network=wg0
1003 # uci commit firewall
1004 # firewall-cedit ||:
1005 # firewall_restart=true
1006 # fi
1007
1008
1009
1010 cedit /etc/hosts <<EOF ||:
1011 127.0.1.1 $hostname
1012 EOF
1013
1014
1015 #mail_host=$(grep -F mail.iankelling.org /etc/hosts | awk '{print $1}')
1016 # if [[ $mail_host ]]; then
1017 # sed -i '/^$mail_host/a mail.iankelling.org' /etc/hosts
1018 # fi
1019
1020
1021 uset dhcp.@dnsmasq[0].domain b8.nz
1022 uset system.@system[0].hostname $hostname
1023 uset dhcp.@dnsmasq[0].local
1024
1025 # uci doesnt seem to have a way to set an empty value,
1026 # if you delete it, it goes back to the default. this seems
1027 # to be a decent workaround.
1028 # todo: setup /etc/resolv.conf to point to 127.0.0.1
1029 # later note: disabled, I dunno why I set this.
1030 # uset dhcp.@dnsmasq[0].resolvfile /dev/null
1031
1032 # if dnsmasq happens to not send out a dns server,
1033 # odhcpd will send one out like this:
1034 # NetworkManager[953]: <info> [1614982580.5192] dhcp6 (wlan0): option dhcp6_name_servers => 'fd58:5801:8e02::1'
1035 # but i dont want ipv6 dns, just keep it simple to ipv4.
1036 # I know my isp doesnt have ipv6 right now,
1037 # so just stop this thing.
1038 # note: tried this, it didn't do anything:
1039 # uset dhcp.@odhcpd[0].dns 10.2.0.1
1040
1041 # iank, disablde while debugging.
1042 #/etc/init.d/odhcpd stop
1043 #/etc/init.d/odhcpd disable
1044
1045 # todo: make the above conditional on which server this is.
1046
1047 ## left commented in case we have ipv6 problems in the future
1048 # avoid errors in log. current isp doesnt have ipv6
1049 #uset unbound.@unbound[0].protocol ip4_only
1050
1051 # todo: im not sure all these are needed, but they all look
1052 # like good options.
1053 # https://blog.cloudflare.com/dns-over-tls-for-openwrt/
1054 # https://gist.github.com/vqiu/7b32d3a19a7a09d32e108d998de166c2
1055 #https://blog.thestateofme.com/2018/04/04/howto-secure-your-dns-with-a-raspberry-pi-unbound-and-cloudflare-1-1-1-1/
1056 #
1057 # # i found that the zone example was having no effect on the config
1058 # # here:
1059 # https://github.com/openwrt/packages/blob/openwrt-19.07/net/unbound/files/README.md
1060 #
1061 # # todo: unbound-control, i'm not sure what the purpose of that thing is, some
1062 # # kind of coordination with dhcp of dnsmasq, but what?
1063 #
1064 # note: for debugging, edit /etc/init.d/unbound, change
1065 # procd_set_param command $PROG -d -c $UB_TOTAL_CONF
1066 # to:
1067 # procd_set_param command $PROG -vvv -d -c $UB_TOTAL_CONF
1068
1069 if ! $ap; then
1070 {
1071 cat <<'EOF'
1072 do-tcp: yes
1073 prefetch: yes
1074 qname-minimisation: yes
1075 rrset-roundrobin: yes
1076 use-caps-for-id: yes
1077 do-ip6: no
1078 private-domain: b8.nz
1079 local-zone: "10.in-addr.arpa." transparent
1080 access-control-view: 10.2.0.31/32 "youtube"
1081 EOF
1082
1083 if $zblock; then
1084 cat <<'EOF'
1085 # no sy until that dongle is used by ziva
1086
1087 # syw
1088 #access-control-view: 10.2.0.7/32 "youtube"
1089 # bow
1090 access-control-view: 10.2.0.29/32 "youtube"
1091 # samsungtab
1092 access-control-view: 10.2.0.32/32 "youtube"
1093 EOF
1094 fi
1095 } | cedit /etc/unbound/unbound_srv.conf || unbound_restart=true
1096
1097
1098 # dns based blocking vs ip based. with ip, same
1099 # server can have multiple domains. in dns,
1100 # you have to make sure clients to use the local dns.
1101 # https dns will need to be blocked by ip in
1102 # order to be comprehensive
1103
1104 cedit /etc/unbound/unbound_ext.conf <<EOF || unbound_restart=true
1105
1106 $(cat /root/ptr-data)
1107
1108 local-data-ptr: "10.2.0.1 cmc.b8.nz"
1109 local-data-ptr: "10.2.0.4 wrt2.b8.nz"
1110 local-data-ptr: "10.2.0.6 x2w.b8.nz"
1111 local-data-ptr: "10.2.0.7 syw.b8.nz"
1112 local-data-ptr: "10.2.0.9 bb8.b8.nz"
1113 local-data-ptr: "10.2.0.14 wrt3.b8.nz"
1114 local-data-ptr: "10.2.0.17 x3w.b8.nz"
1115 local-data-ptr: "10.2.0.18 tp.b8.nz"
1116 local-data-ptr: "10.2.0.19 brother.b8.nz"
1117 local-data-ptr: "10.2.0.23 tpw.b8.nz"
1118 local-data-ptr: "10.2.0.24 one9p.b8.nz"
1119 local-data-ptr: "10.2.0.25 hp.b8.nz"
1120 local-data-ptr: "10.2.0.29 bow.b8.nz"
1121 local-data-ptr: "10.2.0.31 amazontab.b8.nz"
1122 local-data-ptr: "10.2.0.32 samsungtab.b8.nz"
1123 local-data-ptr: "10.2.0.38 x8.b8.nz"
1124 local-data-ptr: "10.2.0.48 bigs.b8.nz"
1125 local-data-ptr: "10.2.0.49 pi4.b8.nz"
1126 local-data-ptr: "10.2.0.50 pi4w.b8.nz"
1127 local-data-ptr: "10.2.0.52 s22.b8.nz"
1128 local-data-ptr: "10.2.0.53 cmcap.b8.nz"
1129 local-data-ptr: "10.2.0.88 demohost.b8.nz"
1130 local-data-ptr: "10.174.2.2 transmission.b8.nz"
1131 local-data-ptr: "10.173.8.1 defaultnn.b8.nz"
1132 local-data-ptr: "10.173.8.2 nn.b8.nz"
1133
1134 forward-zone:
1135 name: "."
1136 # forward-addr: 8.8.8.8
1137 # forward-addr: 8.8.8.8
1138
1139 # ssl disabled due to this error:
1140 #Sat Dec 24 03:34:44 2022 daemon.err unbound: [6568:0] error: ssl handshake failed crypto error:1416F086:SSL routines:tls_process_server_certificate:certificate verify failed
1141 #Sat Dec 24 03:34:44 2022 daemon.notice unbound: [6568:0] notice: ssl handshake failed 1.0.0.3 port 853
1142 # on OPENWRT_RELEASE="OpenWrt SNAPSHOT r18639-f5865452ac"
1143 # from about feb 2022
1144
1145 # https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-families/setup-instructions/dns-over-https
1146 # forward-addr: 1.1.1.3@853#family.cloudflare-dns.com
1147 # forward-addr: 1.0.0.3@853#family.cloudflare-dns.com
1148 # forward-ssl-upstream: yes
1149 forward-first: no
1150 forward-addr: 1.1.1.3
1151 forward-addr: 1.0.0.3
1152
1153 view:
1154 name: "youtube"
1155 local-zone: "googlevideo.com." refuse
1156 local-zone: "video.google.com." refuse
1157 local-zone: "youtu.be." refuse
1158 local-zone: "youtube-nocookie.com." refuse
1159 local-zone: "youtube-ui.l.google.com." refuse
1160 local-zone: "youtube.com." refuse
1161 local-zone: "youtube.googleapis.com." refuse
1162 local-zone: "youtubeeducation.com." refuse
1163 local-zone: "youtubei.googleapis.com." refuse
1164 local-zone: "yt3.ggpht.com." refuse
1165 local-zone: "youtubekids.com." refuse
1166 # try global if no match in view
1167 view-first: yes
1168 EOF
1169
1170
1171 if $unbound_restart; then
1172 /etc/init.d/unbound restart
1173 if ! unbound-checkconf; then
1174 echo $0: error: unbound-checkconf failed >&2
1175 exit 1
1176 fi
1177 fi
1178 fi # end if $ap
1179
1180 # # disabled for now. i want to selectively enable it
1181 # # for specific hosts.
1182 # if [[ $(uci get adblock.global.adb_enabled) != 0 ]]; then
1183 # v uci set adblock.global.adb_enabled=0
1184 # uci commit adblock
1185 # /etc/init.d/adblock restart
1186 # fi
1187 # # https://github.com/openwrt/packages/tree/master/net/adblock/files
1188 # cat >/etc/crontabs/root <<'EOF'
1189 # 0 06 * * * /etc/init.d/adblock reload
1190 # EOF
1191
1192
1193 # useful: http://wiki.openwrt.org/doc/howto/dhcp.dnsmasq
1194
1195 # sometimes /mnt/usb fails, cuz it's just a flash drive,
1196 # so make sure we have this dir or else dnsmasq will fail
1197 # to start.
1198 mkdir -p /mnt/usb/tftpboot
1199 cedit /etc/dnsmasq.conf <<EOF || dnsmasq_restart=true
1200 # no dns
1201 port=0
1202 server=/b8.nz/#
1203 ptr-record=1.0.2.10.in-addr.arpa.,cmc.b8.nz
1204
1205 # https://ret2got.wordpress.com/2018/01/19/how-your-ethereum-can-be-stolen-using-dns-rebinding/
1206 stop-dns-rebind
1207 rebind-domain-ok=b8.nz
1208
1209 # This says the ip of dns server.
1210 # It is default if dnsmasq is doing dns, otherwise, we have to specify it.
1211 # To see it in action, I ran this from a client machine:
1212 # sudo dhcpcd -o domain_name_servers -T
1213 dhcp-option=option:dns-server,$l.1
1214
1215 # use this when doing fai to get the right timezone, its nfsroot is
1216 # setup to use this dhcp option only and call ntpdate.
1217 # generate ips with:
1218 # for h in 0.ubuntu.pool.ntp.org 1.ubuntu.pool.ntp.org ntp.ubuntu.com; do host -t a $h | awk '{print $NF}'; done | while read -r l; do printf ,$l; done
1219 dhcp-option=option:ntp-server,188.165.3.28,202.12.97.45,91.236.251.13,50.205.244.23,78.30.254.80,31.131.0.123,202.65.114.202,94.228.220.14,185.125.190.57,185.125.190.58,91.189.91.157,185.125.190.56,91.189.94.4
1220
1221
1222 # results from googling around dnsmasq optimizations
1223 # about 50k in memory. router has 62 megs.
1224 # in a browsing session, I probably won't ever do 5000 lookups
1225 # before the ttl expiration or whatever does expiration.
1226 cache-size=10000
1227
1228 # ask all servers, use the one which responds first.
1229 # http://ma.ttwagner.com/make-dns-fly-with-dnsmasq-all-servers/
1230 all-servers
1231
1232 # namebench benchmarks dns servers. google's dns was only
1233 # slightly less fast than some others, and I trust it more
1234 # to give accurate results, stay relatively fast, and
1235 # not do anythin too malicious, so just use that.
1236 # download namebench and run it like this:
1237 # for x in all regional isp global preferred nearby; do ./namebench.py -s \$x -c US -i firefox -m weighted -J 10 -w; echo \$x; hr; done
1238 # google
1239 server=1.1.1.3
1240 server=1.0.0.3
1241 server=2606:4700:4700::1113
1242 server=2606:4700:4700::1003
1243
1244 server=10.2.0.1
1245 # server=8.8.4.4
1246 # server=8.8.8.8
1247 # server=2001:4860:4860::8888
1248 # server=2001:4860:4860::8844
1249
1250
1251 # to fixup existin ips, on the client you can do
1252 # sudo dhclient -r; sudo dhclient <interface-name>
1253 # or on cmc,
1254 # /etc/init.d/dnsmasq stop
1255 # vi /tmp/dhcp.leases
1256 # /etc/init.d/dnsmasq start
1257
1258
1259 # default dhcp range is 100-150
1260 # bottom port, iPXE (PCI 03:00.0) in seabios boot menu
1261 dhcp-host=c8:60:00:31:6b:75,set:kd,$l.2,kd
1262 #dhcp-host=94:05:bb:1e:2c:2e,set:bo,$l.38,bo
1263 # top port, iPXE (PCI 04:00.0) in seabios boot menu
1264 #dhcp-host=c8:60:00:2b:15:07,set:kd,$l.2,kd
1265 # 4 is reserved for a staticly configured host wrt2
1266
1267
1268 dhcp-host=c4:8e:8f:60:63:cb,set:x2w,$l.6,x2w
1269 dhcp-host=10:51:07:f5:f1:b8,set:syw,$l.7,syw
1270 dhcp-host=80:fa:5b:1c:6e:cf,set:amy,$l.8,amy
1271 dhcp-host=a0:ce:c8:9f:7a:f3,set:sy,$l.12,sy
1272 # alternate dongle
1273 #dhcp-host=94:05:bb:1e:2c:2e,set:sy,$l.12,sy
1274 dhcp-host=00:1f:16:16:39:24,set:x2,$l.13,x2
1275
1276 ## for using different dhcp server
1277 #dhcp-host=52:54:00:9c:ef:ad,ignore
1278 # 14 = wrt3
1279 dhcp-host=ac:d1:b8:5c:eb:d7,set:x3w,$l.17,x3w
1280 dhcp-host=00:1f:16:14:01:d8,set:x3,$l.18,x3
1281 # BRN001BA98CA823 in dhcp logs
1282 dhcp-host=00:1b:a9:8c:a8:23,set:brother,$l.19,brother
1283
1284 dhcp-host=00:26:b6:f7:d4:d8,set:amyw,$l.23,amyw
1285 dhcp-host=9a:c6:52:6f:ce:7c,set:onep9,$l.24,onep9
1286 dhcp-host=38:63:bb:07:5a:f9,set:hp,$l.25,hp
1287 dhcp-host=14:dd:a9:d5:31:7a,set:frodo,$l.28,frodo
1288 #dhcp-host=00:26:b6:f6:0f:e9,set:frodow,$l.28,frodow
1289 dhcp-host=70:a6:cc:3a:bb:b4,set:bow,$l.29,bow
1290 dhcp-host=6c:56:97:88:7b:74,set:amazontab,$l.31,amazontab
1291 dhcp-host=0a:8a:9b:cf:b5:ec,set:samsungtab,$l.32,samsungtab
1292 # server d16:
1293 dhcp-host=38:2c:4a:c9:33:13,set:bigs,$l.48,bigs
1294 dhcp-host=e4:5f:01:07:50:40,set:pi4,$l.49,pi4
1295 dhcp-host=e4:5f:01:07:50:3f,set:pi4w,$l.50,pi4w
1296 # samsung phone
1297 dhcp-host=a8:79:8d:71:54:68,set:s22,$l.52,s22
1298
1299 # This is so fai can have an explicit name to use for testing,
1300 # or else any random machine which did a pxe boot would get
1301 # reformatted. The mac is from doing a virt-install, cancelling it,
1302 # and copying the generated mac, so it should be randomish.
1303 dhcp-host=52:54:00:9c:ef:ad,set:demohost,$l.88,demohost
1304
1305
1306 # faiserver vm
1307 #dhcp-host=52:54:00:56:09:f9,set:faiserver,$l.15,faiserver
1308
1309 # template
1310 # dhcp-host=,$l.,
1311
1312 # pxe tftpboot for arch-like. todo: openwrt snapshot from 2022-01, it cant
1313 # access /mnt/usb/tftpboot due to ujail sandbox
1314 #enable-tftp=br-lan
1315 #tftp-root=/mnt/usb/tftpboot
1316 #tftp-root=/var/run/dnsmasq/tftpboot
1317
1318
1319 dhcp-optsfile=/var/run/dnsmasq/dhcpopts.conf
1320
1321 # for debugging dhcp
1322 #log-queries=extra
1323 EOF
1324
1325
1326 if $dnsmasq_restart && ! $dev2 && ! $ap; then
1327 # todo: can our ptr records be put in /etc/hosts?
1328 # eg: user normal /etc/hosts records, and they wont be used for A resolution
1329 # due to the other settings, but will be used for ptr? then maybe
1330 # we dont have to restart dnsmasq for a dns update?
1331 #
1332 # interesing link:
1333 # https://www.redpill-linpro.com/techblog/2019/08/27/evaluating-local-dnssec-validators.html#toggling-dnssec-validation-1
1334 # we could turn on dnssec validation when wrt gets dnsmasq > 2.80. currently at 2.80.
1335 # also we can turn off dnssec in systemd-resolved if we know the router is doing it.
1336 #
1337 # Also, reload of dnsmasq seems to break things, wifi
1338 # clients were not getting internet connectivity.
1339
1340 v /etc/init.d/dnsmasq restart
1341 fi
1342
1343 if $ap; then
1344 v /etc/init.d/firewall disable
1345 v /etc/init.d/firewall stop
1346 elif $firewall_restart; then
1347 v /etc/init.d/firewall restart
1348 fi
1349
1350 ## turn off luci
1351 # if already stopped, gives error we want to ignore
1352 /etc/init.d/uhttpd stop |& sed '1{/^Command failed/d}'
1353 /etc/init.d/uhttpd disable |& sed '1{/^Command failed/d}'
1354
1355 # this may just restart the network and take care of the network_restart below.
1356 if $wireless_restart; then
1357 v wifi
1358 fi
1359
1360 # todo: we should catch errors and still run this if needed
1361 if $network_restart; then
1362 reboot
1363 fi
1364
1365 v exit 0