iankelling.org Git - automated-distro-installer/blob - wrt-setup-local

   1 #!/bin/bash
   2 # Copyright (C) 2016 Ian Kelling
   3
   4 # This program is free software; you can redistribute it and/or
   5 # modify it under the terms of the GNU General Public License
   6 # as published by the Free Software Foundation; either version 2
   7 # of the License, or (at your option) any later version.
   8
   9 # This program is distributed in the hope that it will be useful,
  10 # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 # GNU General Public License for more details.
  13
  14 # You should have received a copy of the GNU General Public License
  15 # along with this program; if not, write to the Free Software
  16 # Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
  17
  18 set -eE -o pipefail
  19 trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR
  20
  21
  22 usage() {
  23   cat <<EOF
  24 usage: ${0##*/} [-h] [-t 2|test] [-m WIRELESS_MAC]
  25 setup my router in general: dhcp, dns, etc.
  26
  27 Type 2 or 3 is for setting up a backup device, there are two kinds so
  28 that you can switch the main device to a backup, then a backup to the
  29 main. Type test is for setting up a testing device.
  30
  31 Passing an empty string for WIRELESS_MAC will cause the device's native
  32 mac to be used.
  33
  34 EOF
  35
  36   exit $1
  37 }
  38
  39
  40 dev2=false
  41 test=false
  42 hostname=wrt
  43 libremanage_host=wrt2
  44
  45 lanip=1
  46 while getopts hm:t: opt; do
  47   case $opt in
  48     h) usage ;;
  49     t)
  50       case $2 in
  51         2|3)
  52           dev2=true
  53           libremanage_host=wrt
  54           ;;&
  55         2)
  56           lanip=4
  57           hostname=wrt2
  58           ;;
  59         3)
  60           lanip=14
  61           hostname=wrt3
  62           ;;
  63         test)
  64           test=true
  65           ;;
  66         *) echo "$0: unexpected arg to -t: $*" >&2; usage 1 ;;
  67       esac
  68       ;;
  69     m)  mac=$OPTARG ;;
  70     *) echo "$0: Internal error! unexpected args: $*" >&2 ; usage 1 ;;
  71   esac
  72 done
  73 shift "$((OPTIND-1))"   # Discard the options and sentinel --
  74
  75 if [[ ! $mac ]] && ! $test; then
  76   # if we wanted to increment it
  77   #WIRELESSMAC=${WIRELESSMAC:0: -1}$((${WIRELESSMAC: -1} + 2))
  78   mac=$WIRELESSMAC
  79 fi
  80
  81 if (( $# != 0 )); then
  82   usage 1
  83 fi
  84
  85
  86 macpre=${mac:0: -1}
  87 macsuf=${mac: -1}
  88
  89
  90 p_updated=false
  91 pmirror() {
  92   if $p_updated; then
  93     return
  94   fi
  95   # background: upgrading all packages is not recommended because it
  96   # doesn't go into the firmware. build new firmware if you want
  97   # lots of upgrades. I think /tmp/opkg-lists is a pre openwrt 14 location.
  98   f=(/var/opkg-lists/*)
  99   if ! (( $(date -r $f +%s) + 60*60*24 > $(date +%s) )); then
 100     if ! opkg update; then
 101       echo "$0: warning: opkg update failed" >&2
 102     fi
 103     p_updated=true
 104   fi
 105 }
 106
 107 pi() {
 108   to_install=()
 109   for p in "$@"; do
 110     pname=${p##*/}
 111     pname=${pname%%_*}
 112     if [[ ! $(opkg list-installed "$pname") ]]; then
 113       to_install+=($p)
 114       pmirror
 115     fi
 116   done
 117   if [[ $to_install ]]; then
 118     opkg install ${to_install[@]}
 119   fi
 120 }
 121
 122 v() {
 123   printf "+ %s\n" "$*"
 124   "$@"
 125 }
 126
 127 ######### uci example:#######
 128 # # https://wiki.openwrt.org/doc/uci
 129 # wan_index=$(uci show firewall | sed -rn 's/firewall\.@zone\[([0-9])+\]\.name=wan/\1/p')
 130 # wan="firewall.@zone[$wan_index]"
 131 # if [[ $(uci get firewall.@forwarding[0].dest) != $forward_dest ]]; then
 132 #     # default is wan
 133 #     v uci set firewall.@forwarding[0].dest=$forward_dest
 134 #     uci commit firewall
 135 #     firewall_restart=true
 136 # fi
 137 ####### end uci example #####
 138
 139 uset() {
 140   printf "+ uset %s\n" "$*"
 141   local key="$1"
 142   local val="$2"
 143   local service="${key%%.*}"
 144   restart_var=${service}_restart
 145   if [[ ! ${!restart_var} ]]; then
 146     eval $restart_var=false
 147   fi
 148   if [[ $(uci get "$key") != "$val" ]]; then
 149     v uci set "$key"="$val"
 150     uci commit $service
 151     eval $restart_var=true
 152   fi
 153 }
 154
 155
 156 ### network config
 157 ###
 158 ssid="check out gnu.org"
 159 lan=10.0.0.0
 160 if $test; then
 161   ssid="gnuv3"
 162   lan=10.1.0.0
 163 fi
 164 mask=255.255.0.0
 165 cidr=16
 166 l=${lan%.0}
 167
 168 passwd -l root ||: #already locked fails
 169
 170 sed -ibak '/^root:/d' /etc/shadow
 171 # /root/router created by manually running passwd then copying the resulting
 172 # line. We have no mkpasswd on wrt/librecmc, then we scp it in.
 173 cat /root/router >>/etc/shadow
 174 # otherwise, serial console gets root login with no password
 175 uset system.@system[0].ttylogin 1
 176
 177
 178 cat >/usr/bin/archlike-pxe-mount <<'EOFOUTER'
 179 #!/bin/bash
 180 # symlinks are collapsed for nfs mount points, so use a bind mount.
 181 # tried putting this in /etc/config/fstab,
 182 # then doing block mount, it didn't work. This doesn't persist across reboots,
 183 # todo: figure that out
 184 rm -f /etc/fstab
 185 for d in /run/{arch,parabola}iso/bootmnt; do
 186 cat >>/etc/fstab <<EOF
 187 /mnt/usb/tftpboot $d none bind 0 0
 188 EOF
 189 mount | grep $d &>/dev/null || mount $d
 190 done
 191 /etc/init.d/nfsd restart
 192 EOFOUTER
 193 chmod +x /usr/bin/archlike-pxe-mount
 194
 195 sed -i '/^root:/s,/bin/ash$,/bin/bash,' /etc/passwd
 196 # usb, screen, relay are for libremanage
 197 v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \
 198   tcpdump openvpn-openssl adblock libusb-compat /root/relay_1.0-1_mips_24kc.ipk \
 199   screen kmod-usb-serial-cp210x kmod-usb-serial-ftdi
 200
 201 cat >/etc/libremanage.conf <<EOF
 202 ${libremanage_host}_type=switch
 203 ${libremanage_host}_channel=1
 204 EOF
 205
 206
 207
 208 v /etc/init.d/fstab enable ||:
 209
 210 # rebooting makes mounting work, but comparing lsmod,
 211 # i'm guessing this will too. todo, test it.
 212 # 255 == module already loaded
 213 for mod in scsi_mod sd_mod; do v modprobe $mod || [[ $? == 255 ]]; done
 214
 215 # for archlike pxe. The default settings in the installer expect to find
 216 # the NFS at one of these dirs
 217 mkdir -p /run/archiso/bootmnt
 218 mkdir -p /run/parabolaiso/bootmnt
 219
 220 # todo: at some later time, i found /mnt/usb not mounted, watch to see if
 221 # that is the case after running this or rebooting.
 222 # wiki says safe to do in case of fstab changes:
 223
 224 ## ian: usb broke on old router. if that happens, can just comment this to disable problems
 225 # echo | cedit /etc/config/fstab ||:
 226 v cedit /etc/config/fstab <<EOF || { v block umount; v block mount; }
 227 config global automount
 228       option from_fstab 1
 229       option anon_mount 1
 230
 231 config mount
 232 # /overlay is an / overlay mount for installing extra packages, etc.
 233 # https://openwrt.org/docs/guide-user/additional-software/extroot_configuration
 234       option target     /mnt/usb
 235 #      option target    /overlay
 236       option device     /dev/sda1
 237       option fstype     ext4
 238       option options    rw,async,noatime,nodiratime
 239       option enabled    0
 240 EOF
 241
 242
 243 # ian: disabled because afaik I don't need it, no benefit.
 244 # config global autoswap
 245 #       option from_fstab 1
 246 #       option anon_swap 1
 247
 248 # config swap
 249 #       option device   /dev/sda1
 250 #       option enabled  1
 251
 252
 253
 254
 255 # exportfs -ra wont cut it when its the same path, but now a bind mount
 256 # todo: restart nfs when nfs is enabled?
 257 #cedit /etc/exports <<EOF || v /etc/init.d/nfsd restart ||:
 258 cedit /etc/exports <<EOF ||:
 259 /mnt/usb  $lan/$cidr(rw,no_root_squash,insecure,sync,no_subtree_check)
 260 # for arch pxe
 261 /run/archiso/bootmnt    $lan/$cidr(rw,no_root_squash,insecure,sync,no_subtree_check)
 262 /run/parabolaiso/bootmnt        $lan/$cidr(rw,no_root_squash,insecure,sync,no_subtree_check)
 263 EOF
 264
 265
 266 # todo: enable nfs when we need it only.
 267 # v /etc/init.d/portmap start
 268 # v /etc/init.d/nfsd start
 269 # v /etc/init.d/portmap enable
 270 # v /etc/init.d/nfsd enable
 271
 272
 273
 274
 275
 276
 277
 278 uset dropbear.@dropbear[0].PasswordAuth 0
 279 uset dropbear.@dropbear[0].RootPasswordAuth 0
 280 uset dropbear.@dropbear[0].Port 2220
 281 if ! cmp -s /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key; then
 282   cp /root/dropbear_rsa_host_key /etc/dropbear/dropbear_rsa_host_key
 283   dropbear_restart=true
 284 fi
 285
 286 wireless_restart=false
 287 key=pictionary49
 288 for x in 0 1; do
 289   uset wireless.default_radio$x.ssid "$ssid"
 290   uset wireless.default_radio$x.key $key
 291   uset wireless.default_radio$x.encryption psk2
 292   if [[ $mac ]]; then
 293     uset wireless.default_radio$x.macaddr $macpre$((macsuf + 2*x))
 294   fi
 295   # secondary device has wireless disabled
 296   uset wireless.radio$x.disabled $dev2
 297 done
 298
 299 if $wireless_restart; then
 300   v wifi
 301 fi
 302
 303
 304 ########## openvpn exampl
 305 ########## missing firewall settings for routing lan
 306 ########## traffic
 307 # v /etc/init.d/openvpn start
 308 # v /etc/init.d/openvpn enable
 309
 310 # # from https://wiki.openwrt.org/doc/uci/firewall
 311 # # todo: not sure if /etc/init.d/network needs restarting.
 312 # # I did, and I had to restart the vpn afterwards.
 313 # # This maps a uci interface to a real interface which is
 314 # # managed outside of uci.
 315 # v cedit /etc/config/network <<'EOF' ||:
 316 # config interface 'tun0'
 317 #         option ifname 'tun0'
 318 #         option proto 'none'
 319 # EOF
 320 # v cedit /etc/config/openvpn <<'EOF' || v /etc/init.d/openvpn restart
 321 # config openvpn my_client_config
 322 #         option enabled 1
 323 #         option config /etc/openvpn/client.conf
 324 # EOF
 325
 326
 327
 328 v cedit /etc/config/network <<EOF || v /etc/init.d/network reload
 329 config 'route' 'transmission'
 330         option 'interface' 'lan'
 331         option 'target' '10.173.0.0'
 332         option 'netmask' '255.255.0.0'
 333         option 'gateway' '$l.3'
 334 EOF
 335
 336 firewall_restart=false
 337 v cedit /etc/config/firewall <<EOF || firewall_restart=true
 338
 339
 340 config redirect
 341  option name ssh
 342  option src              wan
 343  option src_dport        22
 344  option dest_ip          $l.8
 345  option dest             lan
 346 config rule
 347  option src              wan
 348  option target           ACCEPT
 349  option dest_port        22
 350
 351 config redirect
 352  option name sshkd
 353  option src              wan
 354  option src_dport        2202
 355  option dest_port        22
 356  option dest_ip          $l.2
 357  option dest             lan
 358 config rule
 359  option src              wan
 360  option target           ACCEPT
 361  option dest_port        2202
 362
 363 config redirect
 364  option name sshfrodo
 365  option src              wan
 366  option src_dport        2203
 367  option dest_port        22
 368  option dest_ip          $l.3
 369  option dest             lan
 370 config rule
 371  option src              wan
 372  option target           ACCEPT
 373  option dest_port        2203
 374
 375 config redirect
 376  option name sshx2
 377  option src              wan
 378  option src_dport        2205
 379  option dest_port        22
 380  option dest_ip          $l.5
 381  option dest             lan
 382 config rule
 383  option src              wan
 384  option target           ACCEPT
 385  option dest_port        2205
 386
 387 config redirect
 388  option name sshx3
 389  option src              wan
 390  option src_dport        2207
 391  option dest_port        22
 392  option dest_ip          $l.7
 393  option dest             lan
 394 config rule
 395  option src              wan
 396  option target           ACCEPT
 397  option dest_port        2207
 398
 399 config redirect
 400  option name sshtp
 401  option src              wan
 402  option src_dport        2208
 403  option dest_port        22
 404  option dest_ip          $l.8
 405  option dest             lan
 406 config rule
 407  option src              wan
 408  option target           ACCEPT
 409  option dest_port        2208
 410
 411
 412 config rule
 413  option name sshwrt
 414  option src              wan
 415  option target           ACCEPT
 416  option dest_port        2220
 417
 418
 419 config redirect
 420  option name vpntp
 421  option src              wan
 422  option src_dport        1196
 423  option dest             lan
 424  option dest_ip          $l.8
 425  option proto            udp
 426 config rule
 427  option src              wan
 428  option target           ACCEPT
 429  option dest_port        1196
 430  option proto            udp
 431
 432
 433 config redirect
 434  option name httptp
 435  option src              wan
 436  option src_dport        80
 437  option dest             lan
 438  option dest_ip          $l.8
 439  option proto            tcp
 440 config rule
 441  option src              wan
 442  option target           ACCEPT
 443  option dest_port        80
 444  option proto            tcp
 445
 446 config redirect
 447  option name httpstp
 448  option src              wan
 449  option src_dport        443
 450  option dest             lan
 451  option dest_ip          $l.8
 452  option proto            tcp
 453 config rule
 454  option src              wan
 455  option target           ACCEPT
 456  option dest_port        443
 457  option proto            tcp
 458
 459 config redirect
 460  option name syncthing
 461  option src              wan
 462  option src_dport        22001
 463  option dest_ip          $l.8
 464  option dest             lan
 465 config rule
 466  option src              wan
 467  option target           ACCEPT
 468  option dest_port        22001
 469
 470
 471 config rule
 472  option name ssh-ipv6
 473  option src wan
 474  option dest lan
 475  # note, using mac transform, we could allow all traffic to a host like this,
 476  # replacing 1 as appropriate
 477  #option dest_ip ::111:11ff:fe11:1111/::ffff:ffff:ffff:ffff
 478  option dest_port 22
 479  option target ACCEPT
 480  option family ipv6
 481
 482 config rule
 483  option name http-ipv6
 484  option src wan
 485  option dest lan
 486  option dest_port 80
 487  option target ACCEPT
 488  option family ipv6
 489
 490 config rule
 491  option name https-ipv6
 492  option src wan
 493  option dest lan
 494  option dest_port 443
 495  option target ACCEPT
 496  option family ipv6
 497
 498 config rule
 499  option name node-exporter
 500  option src wan
 501  option dest lan
 502  option dest_port 9101
 503  option target ACCEPT
 504  option family ipv6
 505
 506 config rule
 507  option name mail587-ipv6
 508  option src wan
 509  option dest lan
 510  option dest_port 587
 511  option target ACCEPT
 512  option family ipv6
 513
 514
 515 EOF
 516
 517
 518
 519
 520 dnsmasq_restart=false
 521 v cedit /etc/hosts <<EOF || dnsmasq_restart=true
 522 127.0.1.1 wrt
 523 $l.1 wrt
 524 $l.2 kd
 525 $l.3 frodo
 526 $l.4 wrt2
 527 $l.5 x2
 528 $l.6 demohost
 529 $l.7 x3
 530 $l.8 tp b8.nz faiserver
 531 $l.9 bb8
 532 $l.14 wrt3
 533 72.14.176.105 li
 534 172.105.84.95 l2
 535
 536 # netns creation looks for next free subnet starting at 10.173, but I only
 537 # use one, and I would keep this one as the first created.
 538 10.173.0.2 transmission
 539 EOF
 540
 541 #mail_host=$(grep -F mail.iankelling.org /etc/hosts | awk '{print $1}')
 542 # if [[ $mail_host ]]; then
 543 #     sed -i '/^$mail_host/a mail.iankelling.org' /etc/hosts
 544 # fi
 545
 546
 547 # avoid using the dns servers that my isp tells me about.
 548 if [[ $(uci get dhcp.@dnsmasq[0].resolvfile 2>/dev/null) ]]; then
 549   # default is '/tmp/resolv.conf.auto', we switch to the dnsmasq default of
 550   # /etc/resolv.conf. not sure why I did this.
 551   v uci delete dhcp.@dnsmasq[0].resolvfile
 552   uci commit dhcp
 553   dnsmasq_restart=true
 554 fi
 555
 556 uset dhcp.@dnsmasq[0].domain b8.nz
 557 uset dhcp.@dnsmasq[0].local /b8.nz/
 558 uset system.@system[0].hostname $hostname
 559
 560 if [[ $(uci get adblock.global.adb_enabled) != 1 ]]; then
 561   v uci set adblock.global.adb_enabled=1
 562   uci commit adblock
 563   /etc/init.d/adblock restart
 564 fi
 565 # https://github.com/openwrt/packages/tree/master/net/adblock/files
 566 cat >/etc/crontabs/root <<'EOF'
 567 0 06 * * *    /etc/init.d/adblock reload
 568 EOF
 569
 570
 571 # useful: http://wiki.openwrt.org/doc/howto/dhcp.dnsmasq
 572
 573 # sometimes /mnt/usb fails, cuz it's just a flash drive,
 574 # so make sure we have this dir or else dnsmasq will fail
 575 # to start.
 576 mkdir -p /mnt/usb/tftpboot
 577 v cedit /etc/dnsmasq.conf <<EOF || dnsmasq_restart=true
 578 server=/dmarctest.b8.nz/#
 579 server=/_domainkey.b8.nz/#
 580 server=/_dmarc.b8.nz/#
 581 server=/ns1.b8.nz/#
 582 server=/ns2.b8.nz/#
 583 mx-host=b8.nz,mail.iankelling.org,10
 584 txt-record=b8.nz,"v=spf1 a ?all"
 585
 586
 587 # https://ret2got.wordpress.com/2018/01/19/how-your-ethereum-can-be-stolen-using-dns-rebinding/
 588 stop-dns-rebind
 589
 590 # this says the ip of default gateway and dns server,
 591 # but I think they are unneded and default
 592 #dhcp-option=3,$l.1
 593 #dhcp-option=6,$l.1
 594
 595
 596
 597 # results from googling around dnsmasq optimizations
 598 # about 50k in memory. router has 62 megs.
 599 # in a browsing session, I probably won't ever do 5000 lookups
 600 # before the ttl expiration or whatever does expiration.
 601 cache-size=10000
 602
 603 # ask all servers, use the one which responds first.
 604 # http://ma.ttwagner.com/make-dns-fly-with-dnsmasq-all-servers/
 605 all-servers
 606
 607 # namebench benchmarks dns servers. google's dns was only
 608 # slightly less fast than some others, and I trust it more
 609 # to give accurate results, stay relatively fast, and
 610 # not do anythin too malicious, so just use that.
 611 # download namebench and run it like this:
 612 # for x in all regional isp global preferred nearby; do ./namebench.py -s \$x -c US -i firefox -m weighted -J 10 -w; echo \$x; hr;  done
 613 # google
 614 server=8.8.4.4
 615 server=8.8.8.8
 616 server=2001:4860:4860::8888
 617 server=2001:4860:4860::8844
 618
 619
 620 # to fixup existin ips, on the client you can do
 621 # sudo dhclient -r; sudo dhclient <interface-name>
 622
 623 # default dhcp range is 100-150
 624 # bottom port,  iPXE (PCI 03:00.0) in seabios boot menu
 625 dhcp-host=c8:60:00:31:6b:75,set:kd,$l.2,kd
 626 # top port, iPXE (PCI 04:00.0) in seabios boot menu
 627 #dhcp-host=c8:60:00:2b:15:07,set:kd,$l.2,kd
 628 dhcp-host=00:26:18:97:bb:16,set:frodo,$l.3,frodo
 629 # 4 is reserved for a staticly configured host.
 630 dhcp-host=00:1f:16:16:39:24,set:x2,$l.5,x2
 631 # This is so fai can have an explicit name to use for testing,
 632 # or else any random machine which did a pxe boot would get
 633 # reformatted. The mac is from doing a virt-install, cancelling it,
 634 # and copying the generated mac, so it should be randomish.
 635 dhcp-host=52:54:00:9c:ef:ad,set:demohost,$l.6,demohost
 636 dhcp-host=00:1f:16:14:01:d8,set:tp,$l.7,x3
 637 dhcp-host=80:fa:5b:1c:6e:cf,set:tp,$l.8,tp
 638
 639 # faiserver vm
 640 dhcp-host=52:54:00:56:09:f9,set:faiserver,$l.15,faiserver
 641
 642 # This is the ip it picks by default if dhcp fails,
 643 # so might as well use it.
 644 # hostname is the name it uses according to telnet
 645 dhcp-host=b4:75:0e:94:29:ca,set:switch9429ca,$l.251,switch9429ca
 646
 647 # template
 648 # dhcp-host=,$l.,
 649
 650 # Just leave the tftp server up even if we aren't doing pxe boot.
 651 # It has no sensitive info.
 652 enable-tftp=br-lan
 653 tftp-root=/mnt/usb/tftpboot
 654 EOF
 655
 656 uset network.lan.ipaddr $l.$lanip
 657 uset network.lan.netmask $mask
 658 uset dhcp.wan.ignore $dev2 # default is false
 659 uset dhcp.lan.ignore $dev2 # default is false
 660 if $dev2; then
 661   uset network.lan.gateway $l.1
 662   uset network.wan.proto none
 663   uset network.wan6.proto none
 664 else
 665   # these are the defaults
 666   uset network.lan.gateway ''
 667   uset network.wan.proto dhcp
 668   uset network.wan6.proto dhcpv6
 669 fi
 670
 671
 672 if $dnsmasq_restart; then
 673   v /etc/init.d/dnsmasq restart
 674 fi
 675
 676 if $firewall_restart; then
 677   v /etc/init.d/firewall restart
 678 fi
 679
 680
 681
 682 if $network_restart; then
 683   reboot
 684 fi
 685 if $dropbear_restart; then
 686   v /etc/init.d/dropbear restart
 687 fi
 688
 689 exit 0