X-Git-Url: https://iankelling.org/git/?p=automated-distro-installer;a=blobdiff_plain;f=wrt-setup;h=1c4a033c3f3c4cf9c92ab70bd1aa612920db6379;hp=0ee30092eca7b078e15719d80c6dd15ecc5edc58;hb=05e47f6734e5a9354a3243686ae55fe4ab2b72c7;hpb=afabe0c27af744200aa6b6e05c5b2ab7d7518c1e diff --git a/wrt-setup b/wrt-setup index 0ee3009..1c4a033 100755 --- a/wrt-setup +++ b/wrt-setup @@ -1,17 +1,29 @@ #!/bin/bash +# Copyright (C) 2016 Ian Kelling + +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. + +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR -# ssh - pmirror() { # background: upgrading all packages is not recommended because it # doesn't go into the firmware. build new firmware if you want # lots of upgrades. f=(/tmp/opkg-lists/*) - f=${f[0]} if ! (( $(date -r $f +%s) + 60*60*24 > $(date +%s) )); then opkg update fi @@ -55,7 +67,8 @@ cat >.profile <<'EOF' exit } EOF -v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server tcpdump +v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \ + tcpdump openvpn-openssl @@ -78,37 +91,40 @@ mkdir -p /run/archiso/bootmnt # todo: at some later time, i found /mnt/usb not mounted, watch to see if # that is the case after running this or rebooting. # wiki says safe to do in case of fstab changes: -cedit /etc/config/fstab <<'EOF' || { v block umount; v block mount; } -config global automount - option from_fstab 1 - option anon_mount 1 - -config global autoswap - option from_fstab 1 - option anon_swap 1 - -config mount - option target /mnt/usb - option device /dev/sda2 - option fstype ext4 - option options rw,async,noatime,nodiratime - option enabled 1 - option enabled_fsck 0 - -config swap - option device /dev/sda1 - option enabled 1 -EOF +## ian: commented and replaced with just an echo +## since usb port seems to be busted. +echo | cedit /etc/config/fstab ||: +# cedit /etc/config/fstab <<'EOF' || { v block umount; v block mount; } +# config global automount +# option from_fstab 1 +# option anon_mount 1 + +# config global autoswap +# option from_fstab 1 +# option anon_swap 1 + +# config mount +# option target /mnt/usb +# option device /dev/sda2 +# option fstype ext2 +# option options rw,async,noatime,nodiratime +# option enabled 1 +# option enabled_fsck 0 +# config swap +# option device /dev/sda1 +# option enabled 1 +# EOF - # exportfs -ra won't cut it when its the same path, but now a bind mount + + +# exportfs -ra wont cut it when its the same path, but now a bind mount cedit /etc/exports <<'EOF' || v /etc/init.d/nfsd restart ||: /mnt/usb 192.168.1.0/255.255.255.0(rw,no_root_squash,insecure,sync,no_subtree_check) # for arch pxe /run/archiso/bootmnt 192.168.1.0/255.255.255.0(rw,no_root_squash,insecure,sync,no_subtree_check) - EOF @@ -117,132 +133,198 @@ v /etc/init.d/nfsd start v /etc/init.d/portmap enable v /etc/init.d/nfsd enable -# default is 250, but my switch wants a high static address by default, -# and I don't need that many, so lets just reduce it. -sed -ri 's/^(.*option limit ).*/\1100/' /etc/config/dhcp -cedit /etc/config/firewall <<'EOF' || /etc/init.d/firewall restart -# port forwarding -config redirect -option name bittorrent -option src wan -option src_dport 63324 -option dest_ip 192.168.1.2 -option dest lan -# making the port open (not sure if this is actually needed) -config rule -option src wan -option target ACCEPT -option dest_port 63324 -config redirect -option name frodobittorrent -option src wan -option src_dport 63326 -option dest_ip 192.168.1.3 -option dest lan -config rule -option src wan -option target ACCEPT -option dest_port 63326 -config redirect -option name treetowlsyncthing -option src wan -option src_dport 22000 -option dest_ip 192.168.1.2 -option dest lan -option proto tcp +######### uci example:####### +# # https://wiki.openwrt.org/doc/uci +# wan_index=$(uci show firewall | sed -rn 's/firewall\.@zone\[([0-9])+\]\.name=wan/\1/p') +# wan="firewall.@zone[$wan_index]" +# if [[ $(uci get firewall.@forwarding[0].dest) != $forward_dest ]]; then +# # default is wan +# v uci set firewall.@forwarding[0].dest=$forward_dest +# uci commit firewall +# firewall_restart=true +# fi -config rule -option src wan -option target ACCEPT -option dest_port 22000 -config redirect -option name bithtpc -option src wan -option src_dport 63325 -option dest_ip 192.168.1.4 -option dest lan +########## openvpn exampl +########## missing firewall settings for routing lan +########## traffic +# v /etc/init.d/openvpn start +# v /etc/init.d/openvpn enable +# # from https://wiki.openwrt.org/doc/uci/firewall +# # todo: not sure if /etc/init.d/network needs restarting. +# # I did, and I had to restart the vpn afterwards. +# # This maps a uci interface to a real interface which is +# # managed outside of uci. +# v cedit /etc/config/network <<'EOF' ||: +# config interface 'tun0' +# option ifname 'tun0' +# option proto 'none' +# EOF +# v cedit /etc/config/openvpn <<'EOF' || v /etc/init.d/openvpn restart +# config openvpn my_client_config +# option enabled 1 +# option config /etc/openvpn/client.conf +# EOF + + +v cedit /etc/config/network <<'EOF' || v /etc/init.d/network reload +config 'route' 'transmission' + option 'interface' 'lan' + option 'target' '10.173.0.0' + option 'netmask' '255.255.0.0' + option 'gateway' '192.168.1.3' +EOF + +v cedit /etc/config/firewall <<'EOF' || firewall_restart=true +config redirect + option name ssh + option src wan + option src_dport 22 + option dest_ip 192.168.1.8 + option dest lan config rule -option src wan -option target ACCEPT -option dest_port 63325 + option src wan + option target ACCEPT + option dest_port 22 +config redirect + option name sshalt + option src wan + option src_dport 2222 + option dest_port 22 + option dest_ip 192.168.1.3 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 2222 config redirect -option name ssh -option src wan -#uncomment the 2 lines for security of using a non-standard port -# and comment out the 22 port line -# option src_dport 63321 -option src_dport 22 -option dest_ip 192.168.1.2 -option dest lan -# option dest_port 22 # already default + option src wan + option src_dport 443 + option dest lan + option dest_ip 192.168.1.8 + option proto tcp +config rule + option src wan + option target ACCEPT + option dest_port 443 + option proto tcp +config redirect + option src wan + option src_dport 1196 + option dest lan + option dest_ip 192.168.1.8 + option proto udp config rule -option src wan -option target ACCEPT -option dest_port 22 + option src wan + option target ACCEPT + option dest_port 1196 + option proto udp -# for https config redirect - option src wan - option src_dport 443 - option dest lan - option dest_ip 192.168.1.2 - option proto tcp + option src wan + option src_dport 80 + option dest lan + option dest_ip 192.168.1.8 + option proto tcp +config rule + option src wan + option target ACCEPT + option dest_port 80 + option proto tcp +config redirect + option name syncthing + option src wan + option src_dport 22001 + option dest_ip 192.168.1.8 + option dest lan config rule - option src wan - option target ACCEPT - option dest_port 443 - option proto tcp - -# not using http server atm, so disable it. -# config redirect -# option src wan -# option src_dport 80 -# option dest lan -# option dest_ip 192.168.1.2 -# option proto tcp - -# config rule -# option src wan -# option target ACCEPT -# option dest_port 80 -# option proto tcp + option src wan + option target ACCEPT + option dest_port 22001 + + + EOF + + dnsmasq_restart=false -cedit /etc/hosts <