X-Git-Url: https://iankelling.org/git/?p=automated-distro-installer;a=blobdiff_plain;f=wrt-setup;h=86e82cfd128c78beb2cad792db041b3bb5f07ec0;hp=044bf826e5510f25541e908a77013dd4d291eeaf;hb=efcfb463ceda4de1d9953da31a2c0737471e5cf8;hpb=d9b78f72ce932fff58c4b031f35f8722d8dbae33 diff --git a/wrt-setup b/wrt-setup index 044bf82..86e82cf 100755 --- a/wrt-setup +++ b/wrt-setup @@ -1,4 +1,19 @@ #!/bin/bash +# Copyright (C) 2016 Ian Kelling + +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. + +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR @@ -10,7 +25,6 @@ pmirror() { # doesn't go into the firmware. build new firmware if you want # lots of upgrades. f=(/tmp/opkg-lists/*) - f=${f[0]} if ! (( $(date -r $f +%s) + 60*60*24 > $(date +%s) )); then opkg update fi @@ -157,6 +171,13 @@ v /etc/init.d/nfsd enable # EOF +v cedit /etc/config/network <<'EOF' || v /etc/init.d/network reload +config 'route' 'transmission' + option 'interface' 'lan' + option 'target' '10.173.0.0' + option 'netmask' '255.255.0.0' + option 'gateway' '192.168.1.2' +EOF v cedit /etc/config/firewall <<'EOF' || firewall_restart=true config redirect @@ -170,31 +191,137 @@ config rule option target ACCEPT option dest_port 22 +config redirect + option name sshalt + option src wan + option src_dport 2222 + option dest_port 22 + option dest_ip 192.168.1.3 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 2222 -#http/https config redirect - option src wan - option src_dport 443 - option dest lan - option dest_ip 192.168.1.2 - option proto tcp + option src wan + option src_dport 443 + option dest lan + option dest_ip 192.168.1.2 + option proto tcp config rule - option src wan - option target ACCEPT - option dest_port 443 - option proto tcp + option src wan + option target ACCEPT + option dest_port 443 + option proto tcp config redirect - option src wan - option src_dport 80 - option dest lan - option dest_ip 192.168.1.2 - option proto tcp + option src wan + option src_dport 80 + option dest lan + option dest_ip 192.168.1.2 + option proto tcp config rule - option src wan - option target ACCEPT - option dest_port 80 - option proto tcp + option src wan + option target ACCEPT + option dest_port 80 + option proto tcp + +config redirect + option name syncthing + option src wan + option src_dport 22001 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 22001 + +#### begin rules for nfs #### +# https://serverfault.com/questions/377170/which-ports-do-i-need-to-open-in-the-firewall-to-use-nfs +# https://wiki.debian.org/SecuringNFS +# I had no /etc/default/quota, or any process named quota anything, +# so, assumed that was unneeded. seems to work. +config redirect + option src wan + option src_dport 111 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 111 +config redirect + option src wan + option src_dport 2049 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 2049 +config redirect + option src wan + option src_dport 32764 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 32764 +config redirect + option src wan + option src_dport 32765 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 32765 +config redirect + option src wan + option src_dport 32766 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 32766 +config redirect + option src wan + option src_dport 32767 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 32767 +config redirect + option src wan + option src_dport 32768 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 32768 +#### end rules for nfs #### + + +config redirect + option name mariadb + option src wan + option src_dport 3306 + option dest lan + option dest_ip 192.168.1.2 + option proto tcp +config rule + option src wan + option target ACCEPT + option dest_port 3306 + option proto tcp + EOF @@ -204,20 +331,20 @@ EOF dnsmasq_restart=false v cedit /etc/hosts <