X-Git-Url: https://iankelling.org/git/?p=automated-distro-installer;a=blobdiff_plain;f=wrt-setup;h=86e82cfd128c78beb2cad792db041b3bb5f07ec0;hp=777eafdfbe092196e7fa784a0fd3d6be5322e8e8;hb=efcfb463ceda4de1d9953da31a2c0737471e5cf8;hpb=cbdfb4aeffe56f5a1f00a006e94d328653957770 diff --git a/wrt-setup b/wrt-setup index 777eafd..86e82cf 100755 --- a/wrt-setup +++ b/wrt-setup @@ -1,9 +1,23 @@ #!/bin/bash +# Copyright (C) 2016 Ian Kelling + +# This program is free software; you can redistribute it and/or +# modify it under the terms of the GNU General Public License +# as published by the Free Software Foundation; either version 2 +# of the License, or (at your option) any later version. + +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. + +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. set -eE -o pipefail trap 'echo "$0:$LINENO:error: \"$BASH_COMMAND\" returned $?" >&2' ERR - # ssh pmirror() { @@ -11,7 +25,6 @@ pmirror() { # doesn't go into the firmware. build new firmware if you want # lots of upgrades. f=(/tmp/opkg-lists/*) - f=${f[0]} if ! (( $(date -r $f +%s) + 60*60*24 > $(date +%s) )); then opkg update fi @@ -55,7 +68,8 @@ cat >.profile <<'EOF' exit } EOF -v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server tcpdump +v pi kmod-usb-storage block-mount kmod-fs-ext4 nfs-kernel-server \ + tcpdump openvpn-openssl @@ -103,12 +117,11 @@ EOF - # exportfs -ra won't cut it when its the same path, but now a bind mount +# exportfs -ra wont cut it when its the same path, but now a bind mount cedit /etc/exports <<'EOF' || v /etc/init.d/nfsd restart ||: /mnt/usb 192.168.1.0/255.255.255.0(rw,no_root_squash,insecure,sync,no_subtree_check) # for arch pxe /run/archiso/bootmnt 192.168.1.0/255.255.255.0(rw,no_root_squash,insecure,sync,no_subtree_check) - EOF @@ -117,132 +130,243 @@ v /etc/init.d/nfsd start v /etc/init.d/portmap enable v /etc/init.d/nfsd enable -# default is 250, but my switch wants a high static address by default, -# and I don't need that many, so lets just reduce it. -sed -ri 's/^(.*option limit ).*/\1100/' /etc/config/dhcp -cedit /etc/config/firewall <<'EOF' || /etc/init.d/firewall restart -# port forwarding -config redirect -option name bittorrent -option src wan -option src_dport 63324 -option dest_ip 192.168.1.2 -option dest lan -# making the port open (not sure if this is actually needed) -config rule -option src wan -option target ACCEPT -option dest_port 63324 -config redirect -option name frodobittorrent -option src wan -option src_dport 63326 -option dest_ip 192.168.1.3 -option dest lan -config rule -option src wan -option target ACCEPT -option dest_port 63326 -config redirect -option name treetowlsyncthing -option src wan -option src_dport 22000 -option dest_ip 192.168.1.2 -option dest lan -option proto tcp +######### uci example:####### +# # https://wiki.openwrt.org/doc/uci +# wan_index=$(uci show firewall | sed -rn 's/firewall\.@zone\[([0-9])+\]\.name=wan/\1/p') +# wan="firewall.@zone[$wan_index]" +# if [[ $(uci get firewall.@forwarding[0].dest) != $forward_dest ]]; then +# # default is wan +# v uci set firewall.@forwarding[0].dest=$forward_dest +# uci commit firewall +# firewall_restart=true +# fi -config rule -option src wan -option target ACCEPT -option dest_port 22000 +########## openvpn exampl +########## missing firewall settings for routing lan +########## traffic +# v /etc/init.d/openvpn start +# v /etc/init.d/openvpn enable + +# # from https://wiki.openwrt.org/doc/uci/firewall +# # todo: not sure if /etc/init.d/network needs restarting. +# # I did, and I had to restart the vpn afterwards. +# # This maps a uci interface to a real interface which is +# # managed outside of uci. +# v cedit /etc/config/network <<'EOF' ||: +# config interface 'tun0' +# option ifname 'tun0' +# option proto 'none' +# EOF +# v cedit /etc/config/openvpn <<'EOF' || v /etc/init.d/openvpn restart +# config openvpn my_client_config +# option enabled 1 +# option config /etc/openvpn/client.conf +# EOF + + +v cedit /etc/config/network <<'EOF' || v /etc/init.d/network reload +config 'route' 'transmission' + option 'interface' 'lan' + option 'target' '10.173.0.0' + option 'netmask' '255.255.0.0' + option 'gateway' '192.168.1.2' +EOF + +v cedit /etc/config/firewall <<'EOF' || firewall_restart=true config redirect -option name bithtpc -option src wan -option src_dport 63325 -option dest_ip 192.168.1.4 -option dest lan + option name ssh + option src wan + option src_dport 22 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 22 +config redirect + option name sshalt + option src wan + option src_dport 2222 + option dest_port 22 + option dest_ip 192.168.1.3 + option dest lan config rule -option src wan -option target ACCEPT -option dest_port 63325 + option src wan + option target ACCEPT + option dest_port 2222 +config redirect + option src wan + option src_dport 443 + option dest lan + option dest_ip 192.168.1.2 + option proto tcp +config rule + option src wan + option target ACCEPT + option dest_port 443 + option proto tcp config redirect -option name ssh -option src wan -#uncomment the 2 lines for security of using a non-standard port -# and comment out the 22 port line -# option src_dport 63321 -option src_dport 22 -option dest_ip 192.168.1.2 -option dest lan -# option dest_port 22 # already default + option src wan + option src_dport 80 + option dest lan + option dest_ip 192.168.1.2 + option proto tcp +config rule + option src wan + option target ACCEPT + option dest_port 80 + option proto tcp +config redirect + option name syncthing + option src wan + option src_dport 22001 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 22001 + +#### begin rules for nfs #### +# https://serverfault.com/questions/377170/which-ports-do-i-need-to-open-in-the-firewall-to-use-nfs +# https://wiki.debian.org/SecuringNFS +# I had no /etc/default/quota, or any process named quota anything, +# so, assumed that was unneeded. seems to work. +config redirect + option src wan + option src_dport 111 + option dest_ip 192.168.1.2 + option dest lan config rule -option src wan -option target ACCEPT -option dest_port 22 + option src wan + option target ACCEPT + option dest_port 111 +config redirect + option src wan + option src_dport 2049 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 2049 +config redirect + option src wan + option src_dport 32764 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 32764 +config redirect + option src wan + option src_dport 32765 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 32765 +config redirect + option src wan + option src_dport 32766 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 32766 +config redirect + option src wan + option src_dport 32767 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 32767 +config redirect + option src wan + option src_dport 32768 + option dest_ip 192.168.1.2 + option dest lan +config rule + option src wan + option target ACCEPT + option dest_port 32768 +#### end rules for nfs #### -# for https config redirect - option src wan - option src_dport 443 - option dest lan - option dest_ip 192.168.1.2 - option proto tcp - + option name mariadb + option src wan + option src_dport 3306 + option dest lan + option dest_ip 192.168.1.2 + option proto tcp config rule - option src wan - option target ACCEPT - option dest_port 443 - option proto tcp - -# not using http server atm, so disable it. -# config redirect -# option src wan -# option src_dport 80 -# option dest lan -# option dest_ip 192.168.1.2 -# option proto tcp - -# config rule -# option src wan -# option target ACCEPT -# option dest_port 80 -# option proto tcp + option src wan + option target ACCEPT + option dest_port 3306 + option proto tcp + + EOF + + dnsmasq_restart=false -cedit /etc/hosts <