iankelling.org Git - automated-distro-installer/blob - wrt-setup-local

   1 #!/bin/bash
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # This program is free software; you can redistribute it and/or
   5 # modify it under the terms of the GNU General Public License
   6 # as published by the Free Software Foundation; either version 2
   7 # of the License, or (at your option) any later version.
   8
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU General Public License for more details.
  13
  14 # You should have received a copy of the GNU General Public License
  15 # along with this program; if not, write to the Free Software
  16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  17
  18 set -eE -o pipefail
  19 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  20
  21 dev2=false
  22 if [[ $1 == -2 ]]; then
  23   dev2=true
  24 fi
  25
  26 pmirror() {
  27   # background: upgrading all packages is not recommended because it
  28   # doesn't go into the firmware. build new firmware if you want
  29   # lots of upgrades. I think /tmp/opkg-lists is a pre openwrt 14 location.
  30   f=(/var/opkg-lists/*)
  31   if ! (( $(date -r $f +%s) + 60*60*24 > $(date +%s) )); then
  32     opkg update
  33   fi
  34 }
  35
  36 pi() {
  37   for x in "$@"; do
  38     if [[ ! $(opkg list-installed "$x") ]]; then
  39       pmirror
  40       opkg install "$@"
  41     fi
  42   done
  43 }
  44
  45 v() {
  46   printf "+ %s\n" "$*"
  47   "$@"
  48 }
  49
  50 ### network config
  51 ###
  52 ssid="check out gnu.org"
  53 lan=10.0.0.0
  54 if $dev2; then
  55   ssid="test1"
  56   lan=10.1.0.0
  57 fi
  58 mask=255.255.0.0
  59 l=${lan%.0}
  60
  61 passwd -l root ||: #already locked fails
  62
  63 cat >/usr/bin/archlike-pxe-mount <<'EOFOUTER'
  64 #!/bin/bash
  65 # symlinks are collapsed for nfs mount points, so use a bind mount.
  66 # tried putting this in /etc/config/fstab,
  67 # then doing block mount, it didn't work. This doesn't persist across reboots,
  68 # todo: figure that out
  69 rm -f /etc/fstab
  70 for d in /run/{arch,parabola}iso/bootmnt; do
  71 cat >>/etc/fstab <<EOF
  72 /mnt/usb/tftpboot $d none bind 0 0
  73 EOF
  74 mount | grep $d &>/dev/null || mount $d
  75 done
  76 /etc/init.d/nfsd restart
  77 EOFOUTER
  78 chmod +x /usr/bin/archlike-pxe-mount
  79
  80 sed -i '/^root:/s,/bin/ash$,/bin/bash,' /etc/passwd
  81 v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \
  82   tcpdump openvpn-openssl adblock libusb-compat /root/relay_1.0-1_mips_24kc.ipk
  83
  84
  85
  86
  87
  88 v /etc/init.d/fstab enable ||:
  89
  90 # rebooting makes mounting work, but comparing lsmod,
  91 # i'm guessing this will too. todo, test it.
  92 # 255 == module already loaded
  93 for mod in scsi_mod sd_mod; do v modprobe $mod || [[ $? == 255 ]]; done
  94
  95 # for archlike pxe. The default settings in the installer expect to find
  96 # the NFS at one of these dirs
  97 mkdir -p /run/archiso/bootmnt
  98 mkdir -p /run/parabolaiso/bootmnt
  99
 100 # todo: at some later time, i found /mnt/usb not mounted, watch to see if
 101 # that is the case after running this or rebooting.
 102 # wiki says safe to do in case of fstab changes:
 103
 104 ## ian: usb broke on old router. if that happens, can just comment this to disable problems
 105 echo | cedit /etc/config/fstab ||:
 106 cedit /etc/config/fstab <<EOF || { v block umount; v block mount; }
 107 config global automount
 108       option from_fstab 1
 109       option anon_mount 1
 110
 111 config mount
 112 # /overlay is an / overlay mount for installing extra packages, etc.
 113 # https://openwrt.org/docs/guide-user/additional-software/extroot_configuration
 114       option target     /mnt/usb
 115 #      option target    /overlay
 116       option device     /dev/sda1
 117       option fstype     ext4
 118       option options    rw,async,noatime,nodiratime
 119       option enabled    0
 120 EOF
 121
 122
 123 # ian: disabled because afaik I don't need it, no benefit.
 124 # config global autoswap
 125 #       option from_fstab 1
 126 #       option anon_swap 1
 127
 128 # config swap
 129 #       option device   /dev/sda1
 130 #       option enabled  1
 131
 132
 133
 134
 135 # exportfs -ra wont cut it when its the same path, but now a bind mount
 136 # todo: restart nfs when nfs is enabled?
 137 #cedit /etc/exports <<EOF || v /etc/init.d/nfsd restart ||:
 138 cedit /etc/exports <<EOF ||:
 139 /mnt/usb  $lan/$netmask(rw,no_root_squash,insecure,sync,no_subtree_check)
 140 # for arch pxe
 141 /run/archiso/bootmnt    $lan/$netmask(rw,no_root_squash,insecure,sync,no_subtree_check)
 142 /run/parabolaiso/bootmnt        $lan/$netmask(rw,no_root_squash,insecure,sync,no_subtree_check)
 143 EOF
 144
 145
 146 # todo: enable nfs when we need it only.
 147 # v /etc/init.d/portmap start
 148 # v /etc/init.d/nfsd start
 149 # v /etc/init.d/portmap enable
 150 # v /etc/init.d/nfsd enable
 151
 152
 153
 154
 155
 156
 157 ######### uci example:#######
 158 # # https://wiki.openwrt.org/doc/uci
 159 # wan_index=$(uci show firewall | sed -rn 's/firewall\.@zone\[([0-9])+\]\.name=wan/\1/p')
 160 # wan="firewall.@zone[$wan_index]"
 161 # if [[ $(uci get firewall.@forwarding[0].dest) != $forward_dest ]]; then
 162 #     # default is wan
 163 #     v uci set firewall.@forwarding[0].dest=$forward_dest
 164 #     uci commit firewall
 165 #     firewall_restart=true
 166 # fi
 167
 168
 169 uset() {
 170   local key="$1"
 171   local val="$2"
 172   local service="${key%%.*}"
 173   restart_var=${service}_restart
 174   if [[ ! ${!restart_var} ]]; then
 175     eval $restart_var=false
 176   fi
 177   if [[ $(uci get "$key") != "$val" ]]; then
 178     v uci set "$key"="$val"
 179     uci commit $service
 180     eval $restart_var=true
 181   fi
 182 }
 183
 184 uset dropbear.@dropbear[0].PasswordAuth 0
 185 uset dropbear.@dropbear[0].RootPasswordAuth 0
 186 uset dropbear.@dropbear[0].Port 2220
 187
 188 wireless_restart=false
 189 key=pictionary49
 190 for x in 0 1; do
 191   uset wireless.default_radio$x.ssid "$ssid"
 192   uset wireless.default_radio$x.key $key
 193   uset wireless.default_radio$x.encryption psk2
 194   if [[ $(uci get wireless.radio$x.disabled 2>/dev/null) ]]; then
 195     v uci delete wireless.radio$x.disabled
 196     wireless_restart=true
 197   fi
 198 done
 199
 200 if $wireless_restart; then
 201   v wifi
 202 fi
 203
 204
 205 ########## openvpn exampl
 206 ########## missing firewall settings for routing lan
 207 ########## traffic
 208 # v /etc/init.d/openvpn start
 209 # v /etc/init.d/openvpn enable
 210
 211 # # from https://wiki.openwrt.org/doc/uci/firewall
 212 # # todo: not sure if /etc/init.d/network needs restarting.
 213 # # I did, and I had to restart the vpn afterwards.
 214 # # This maps a uci interface to a real interface which is
 215 # # managed outside of uci.
 216 # v cedit /etc/config/network <<'EOF' ||:
 217 # config interface 'tun0'
 218 #         option ifname 'tun0'
 219 #         option proto 'none'
 220 # EOF
 221 # v cedit /etc/config/openvpn <<'EOF' || v /etc/init.d/openvpn restart
 222 # config openvpn my_client_config
 223 #         option enabled 1
 224 #         option config /etc/openvpn/client.conf
 225 # EOF
 226
 227
 228
 229 v cedit /etc/config/network <<EOF || v /etc/init.d/network reload
 230 config 'route' 'transmission'
 231         option 'interface' 'lan'
 232         option 'target' '10.173.0.0'
 233         option 'netmask' '255.255.0.0'
 234         option 'gateway' '$l.3'
 235 EOF
 236
 237 firewall_restart=false
 238 v cedit /etc/config/firewall <<EOF || firewall_restart=true
 239 config redirect
 240     option name ssh
 241     option src              wan
 242     option src_dport        22
 243     option dest_ip          $l.8
 244     option dest             lan
 245 config rule
 246     option src              wan
 247     option target           ACCEPT
 248     option dest_port        22
 249
 250 config redirect
 251     option name sshalt
 252     option src              wan
 253     option src_dport        2222
 254     option dest_port        22
 255     option dest_ip          $l.3
 256     option dest             lan
 257 config rule
 258     option src              wan
 259     option target           ACCEPT
 260     option dest_port        2222
 261
 262 config rule
 263     option src              wan
 264     option target           ACCEPT
 265     option dest_port        2220
 266
 267
 268 config redirect
 269     option src              wan
 270     option src_dport        443
 271     option dest             lan
 272     option dest_ip          $l.8
 273     option proto            tcp
 274 config rule
 275     option src              wan
 276     option target           ACCEPT
 277     option dest_port        443
 278     option proto            tcp
 279
 280 config redirect
 281     option src              wan
 282     option src_dport        1196
 283     option dest             lan
 284     option dest_ip          $l.8
 285     option proto            udp
 286 config rule
 287     option src              wan
 288     option target           ACCEPT
 289     option dest_port        1196
 290     option proto            udp
 291
 292
 293 config redirect
 294     option src              wan
 295     option src_dport        80
 296     option dest             lan
 297     option dest_ip          $l.8
 298     option proto            tcp
 299 config rule
 300     option src              wan
 301     option target           ACCEPT
 302     option dest_port        80
 303     option proto            tcp
 304
 305 config redirect
 306     option name syncthing
 307     option src              wan
 308     option src_dport        22001
 309     option dest_ip          $l.8
 310     option dest             lan
 311 config rule
 312     option src              wan
 313     option target           ACCEPT
 314     option dest_port        22001
 315
 316
 317
 318 EOF
 319
 320
 321
 322
 323 dnsmasq_restart=false
 324 v cedit /etc/hosts <<EOF || dnsmasq_restart=true
 325 127.0.1.1 wrt
 326 $l.1 wrt
 327 $l.2 kd
 328 $l.3 frodo
 329 $l.4 htpc
 330 $l.5 x2
 331 $l.6 demohost
 332 $l.7 x3
 333 $l.8 tp faiserver b8.nz
 334 72.14.176.105 li
 335
 336 # netns creation looks for next free subnet starting at 10.173, but I only
 337 # use one, and I would keep this one as the first created.
 338 10.173.0.2 transmission
 339 EOF
 340
 341 #mail_host=$(grep -F mail.iankelling.org /etc/hosts | awk '{print $1}')
 342 # if [[ $mail_host ]]; then
 343 #     sed -i '/^$mail_host/a mail.iankelling.org' /etc/hosts
 344 # fi
 345
 346
 347 # avoid using the dns servers that my isp tells me about.
 348 if [[ $(uci get dhcp.@dnsmasq[0].resolvfile 2>/dev/null) ]]; then
 349   # default is '/tmp/resolv.conf.auto', we switch to the dnsmasq default of
 350   # /etc/resolv.conf. not sure why I did this.
 351   v uci delete dhcp.@dnsmasq[0].resolvfile
 352   uci commit dhcp
 353   dnsmasq_restart=true
 354 fi
 355
 356 uset dhcp.@dnsmasq[0].domain b8.nz
 357 uset dhcp.@dnsmasq[0].local /b8.nz/
 358 uset system.@system[0].hostname wrt
 359
 360 if [[ $(uci get adblock.global.adb_enabled) != 1 ]]; then
 361   v uci set adblock.global.adb_enabled=1
 362   uci commit adblock
 363   /etc/init.d/adblock restart
 364 fi
 365 # https://github.com/openwrt/packages/tree/master/net/adblock/files
 366 cat >/etc/crontabs/root <<'EOF'
 367 0 06 * * *    /etc/init.d/adblock reload
 368 EOF
 369
 370
 371 # useful: http://wiki.openwrt.org/doc/howto/dhcp.dnsmasq
 372
 373 # sometimes /mnt/usb fails, cuz it's just a flash drive,
 374 # so make sure we have this dir or else dnsmasq will fail
 375 # to start.
 376 mkdir -p /mnt/usb/tftpboot
 377 v cedit /etc/dnsmasq.conf <<EOF || dnsmasq_restart=true
 378
 379 # https://ret2got.wordpress.com/2018/01/19/how-your-ethereum-can-be-stolen-using-dns-rebinding/
 380 stop-dns-rebind
 381
 382 # this says the ip of default gateway and dns server,
 383 # but I think they are unneded and default
 384 #dhcp-option=3,$l.1
 385 #dhcp-option=6,$l.1
 386
 387
 388
 389 # results from googling around dnsmasq optimizations
 390 # about 50k in memory. router has 62 megs.
 391 # in a browsing session, I probably won't ever do 5000 lookups
 392 # before the ttl expiration or whatever does expiration.
 393 cache-size=10000
 394
 395 # ask all servers, use the one which responds first.
 396 # http://ma.ttwagner.com/make-dns-fly-with-dnsmasq-all-servers/
 397 all-servers
 398
 399 # namebench benchmarks dns servers. google's dns was only
 400 # slightly less fast than some others, and I trust it more
 401 # to give accurate results, stay relatively fast, and
 402 # not do anythin too malicious, so just use that.
 403 # download namebench and run it like this:
 404 # for x in all regional isp global preferred nearby; do ./namebench.py -s \$x -c US -i firefox -m weighted -J 10 -w; echo \$x; hr;  done
 405 # google
 406 server=8.8.4.4
 407 server=8.8.8.8
 408 server=2001:4860:4860::8888
 409 server=2001:4860:4860::8844
 410
 411
 412 # to fixup existin ips, on the client you can do
 413 # sudo dhclient -r; sudo dhclient <interface-name>
 414
 415 # default dhcp range is 100-150
 416 # bottom port,  iPXE (PCI 03:00.0) in seabios boot menu
 417 dhcp-host=c8:60:00:31:6b:75,set:kd,$l.2,kd
 418 # top port, iPXE (PCI 04:00.0) in seabios boot menu
 419 #dhcp-host=c8:60:00:2b:15:07,set:kd,$l.2,kd
 420 dhcp-host=00:26:18:97:bb:16,set:frodo,$l.3,frodo
 421 dhcp-host=10:78:d2:da:29:22,set:htpc,$l.4,htpc
 422 dhcp-host=00:1f:16:16:39:24,set:x2,$l.5,x2
 423 # This is so fai can have an explicit name to use for testing,
 424 # or else any random machine which did a pxe boot would get
 425 # reformatted. The mac is from doing a virt-install, cancelling it,
 426 # and copying the generated mac, so it should be randomish.
 427 dhcp-host=52:54:00:9c:ef:ad,set:demohost,$l.6,demohost
 428 dhcp-host=00:1f:16:14:01:d8,set:tp,$l.7,x3
 429 dhcp-host=80:fa:5b:1c:6e:cf,set:tp,$l.8,tp
 430
 431 # faiserver vm
 432 dhcp-host=52:54:00:56:09:f9,set:faiserver,$l.15,faiserver
 433
 434 # This is the ip it picks by default if dhcp fails,
 435 # so might as well use it.
 436 # hostname is the name it uses according to telnet
 437 dhcp-host=b4:75:0e:94:29:ca,set:switch9429ca,$l.251,switch9429ca
 438
 439 # template
 440 # dhcp-host=,$l.,
 441
 442 # Just leave the tftp server up even if we aren't doing pxe boot.
 443 # It has no sensitive info.
 444 enable-tftp=br-lan
 445 tftp-root=/mnt/usb/tftpboot
 446 EOF
 447
 448 if $dnsmasq_restart; then
 449   v /etc/init.d/dnsmasq restart
 450 fi
 451
 452 if $firewall_restart; then
 453   v /etc/init.d/firewall restart
 454 fi
 455
 456 uset network.lan.ipaddr $l.1
 457 uset network.lan.netmask $mask
 458
 459 if $network_restart; then
 460   reboot
 461 fi
 462 if $dropbear_restart; then
 463   v /etc/init.d/dropbear restart
 464 fi
 465
 466 exit 0