Server/ratbert: Unterschied zwischen den Versionen
John (Diskussion | Beiträge) Keine Bearbeitungszusammenfassung |
John (Diskussion | Beiträge) Keine Bearbeitungszusammenfassung |
||
Zeile 131: | Zeile 131: | ||
option encryption none | option encryption none | ||
</pre> | </pre> | ||
=== Firewall === | |||
/etc/config/firewall : | |||
<pre> | |||
root@ratbert:/etc/config# cat firewall | |||
config defaults | |||
option syn_flood 1 | |||
option input ACCEPT | |||
option output ACCEPT | |||
option forward REJECT | |||
# Uncomment this line to disable ipv6 rules | |||
# option disable_ipv6 1 | |||
config zone | |||
option name lan | |||
option network 'lan' | |||
option input ACCEPT | |||
option output ACCEPT | |||
option forward REJECT | |||
config zone | |||
option name wan | |||
option network 'wan' | |||
option input REJECT | |||
option output ACCEPT | |||
option forward REJECT | |||
option masq 1 | |||
option mtu_fix 1 | |||
config forwarding | |||
option src lan | |||
option dest wan | |||
# We need to accept udp packets on port 68, | |||
# see https://dev.openwrt.org/ticket/4108 | |||
config rule | |||
option name Allow-DHCP-Renew | |||
option src wan | |||
option proto udp | |||
option dest_port 68 | |||
option target ACCEPT | |||
option family ipv4 | |||
# Allow IPv4 ping | |||
config rule | |||
option name Allow-Ping | |||
option src wan | |||
option proto icmp | |||
option icmp_type echo-request | |||
option family ipv4 | |||
option target ACCEPT | |||
# Allow DHCPv6 replies | |||
# see https://dev.openwrt.org/ticket/10381 | |||
config rule | |||
option name Allow-DHCPv6 | |||
option src wan | |||
option proto udp | |||
option src_ip fe80::/10 | |||
option src_port 547 | |||
option dest_ip fe80::/10 | |||
option dest_port 546 | |||
option family ipv6 | |||
option target ACCEPT | |||
# Allow essential incoming IPv6 ICMP traffic | |||
config rule | |||
option name Allow-ICMPv6-Input | |||
option src wan | |||
option proto icmp | |||
list icmp_type echo-request | |||
list icmp_type destination-unreachable | |||
list icmp_type packet-too-big | |||
list icmp_type time-exceeded | |||
list icmp_type bad-header | |||
list icmp_type unknown-header-type | |||
list icmp_type router-solicitation | |||
list icmp_type neighbour-solicitation | |||
option limit 1000/sec | |||
option family ipv6 | |||
option target ACCEPT | |||
# Allow essential forwarded IPv6 ICMP traffic | |||
config rule | |||
option name Allow-ICMPv6-Forward | |||
option src wan | |||
option dest * | |||
option proto icmp | |||
list icmp_type echo-request | |||
list icmp_type destination-unreachable | |||
list icmp_type packet-too-big | |||
list icmp_type time-exceeded | |||
list icmp_type bad-header | |||
list icmp_type unknown-header-type | |||
option limit 1000/sec | |||
option family ipv6 | |||
option target ACCEPT | |||
# include a file with users custom iptables rules | |||
config include | |||
option path /etc/firewall.user | |||
</pre> | |||
=== DNSmasq === | === DNSmasq === |
Version vom 8. Februar 2012, 17:47 Uhr
Ratbert Setup
Nach der erfolgreichen Wiederbelebung von Ratbert konnte der Ersatzrouter Wormbert wieder im Schrank verschwinden. Was dazu alles nötig war sei im Folgenden hier dokumentiert.
Debricking
Von Lateinich debricere - der Verziegelsteinigung entziehen.... oder so.. Da der Bootloader noch vollkommen intakt war, gab es bei der Wiederherstellung von einer lauffähigen OpenWRT Firmware keine größeren Hindernisse zu überwinden. Mithilfe eines eingelöteten Pinheaders lässt sich die serielle Schnittstelle von Ratbert nun leicht mit einer USB UART bridge benutzen. Die dazu nötigen Schritte sind unter :http://wiki.openwrt.org/toh/tp-link/tl-wr1043nd und besonders in dem Log unter :http://wiki.openwrt.org/toh/tp-link/tl-wr1043nd/flashlog zu finden.
Pakete
Durch geschickte Benutzung des Paketmanagers opkg hat Astro folgende Pakete zur Menge der Installierten gemacht:
aiccu avahi-daemon base-files base-files-network busybox crda dbus dnsmasq dropbear firewall hotplug2 ip iptables iptables-mod-conntrack iptables-mod-nat iw kernel kmod-ath kmod-ath9k kmod-ath9k-common kmod-button-hotplug kmod-cfg80211 kmod-crypto-aes kmod-crypto-arc4 kmod-crypto-core kmod-input-core kmod-input-gpio-keys-polled kmod-input-polldev kmod-ipt-conntrack kmod-ipt-core kmod-ipt-nat kmod-ipt-nathelper kmod-iptunnel4 kmod-ipv6 kmod-leds-gpio kmod-ledtrig-usbdev kmod-lib-crc-ccitt kmod-mac80211 kmod-nls-base kmod-ppp kmod-pppoe kmod-sit kmod-tun kmod-usb-core kmod-usb-ohci kmod-usb2 libavahi libc libcap libdaemon libdbus libexpat libgcc libgdbm libip4tc libncurses libnl-tiny libpcap libpthread libreadline librt libuci libxtables mtd ntpd opkg ppp ppp-mod-pppoe quagga quagga-bgpd quagga-libospf quagga-libzebra quagga-ospfd quagga-vtysh swconfig tcpdump terminfo uboot-envtools uci wireless-tools wpad-mini
-> fileliste mit versionen: Medium:Inst_pkgs.txt.gzfake.jpg
Einstellungen einzelner Services
Hier nun die wichtigstsen Konfigurationsanpassungen für einzelne Services:
Basissystemeinstellungen
In /etc/config/system ist lediglich der hostname anzupassen:
root@ratbert:/etc/config# cat system config 'system' option 'hostname' 'ratbert' option 'timezone' 'UTC' config 'timeserver' 'ntp' list 'server' '0.openwrt.pool.ntp.org' list 'server' '1.openwrt.pool.ntp.org' list 'server' '2.openwrt.pool.ntp.org' list 'server' '3.openwrt.pool.ntp.org' config 'led' 'led_usb' option 'name' 'USB' option 'sysfs' 'tp-link:green:usb' option 'trigger' 'usbdev' option 'dev' '1-1' option 'interval' '50' config 'led' 'led_wlan' option 'name' 'WLAN' option 'sysfs' 'tp-link:green:wlan' option 'trigger' 'phy0tpt'
Netzconfig
In /etc/config/network findet sich die Basiskonfiguration für Netzwerk unter OpenWRT:
root@ratbert:/etc/config# cat network
---->
config 'interface' 'loopback' option 'ifname' 'lo' option 'proto' 'static' option 'ipaddr' '127.0.0.1' option 'netmask' '255.0.0.0' config 'interface' 'lan' option 'ifname' 'eth0.1' #option 'type' 'bridge' option 'proto' 'static' option ipaddr 172.22.99.4 option 'netmask' '255.255.255.0' option netmask 255.255.255.0 config 'interface' 'wan' option 'ifname' 'eth0.2' option 'proto' 'pppoe' option username "HIERUNSEREGEHEIMENUMMER@t-online.de" option password "GEHEIMESPASSWORT" option peerdns 0 option ipv6 1 config 'switch' option 'name' 'rtl8366rb' option 'reset' '1' option 'enable_vlan' '1' config 'switch_vlan' option 'device' 'rtl8366rb' option 'vlan' '1' option 'ports' '1 2 3 4 5t' config 'switch_vlan' option 'device' 'rtl8366rb' option 'vlan' '2' option 'ports' '0 5t' config interface wifi option proto static option ipaddr 172.22.101.1
Wireless Network
/etc/config/wireless :
config wifi-device radio0 option type mac80211 option channel 6 option macaddr f4:ec:38:ba:1d:ac option hwmode 11ng option htmode HT20 list ht_capab SHORT-GI-40 list ht_capab DSSS_CCK-40 config wifi-iface option device radio0 option network wifi option mode ap option ssid C3D2.n option encryption none
Firewall
/etc/config/firewall :
root@ratbert:/etc/config# cat firewall config defaults option syn_flood 1 option input ACCEPT option output ACCEPT option forward REJECT # Uncomment this line to disable ipv6 rules # option disable_ipv6 1 config zone option name lan option network 'lan' option input ACCEPT option output ACCEPT option forward REJECT config zone option name wan option network 'wan' option input REJECT option output ACCEPT option forward REJECT option masq 1 option mtu_fix 1 config forwarding option src lan option dest wan # We need to accept udp packets on port 68, # see https://dev.openwrt.org/ticket/4108 config rule option name Allow-DHCP-Renew option src wan option proto udp option dest_port 68 option target ACCEPT option family ipv4 # Allow IPv4 ping config rule option name Allow-Ping option src wan option proto icmp option icmp_type echo-request option family ipv4 option target ACCEPT # Allow DHCPv6 replies # see https://dev.openwrt.org/ticket/10381 config rule option name Allow-DHCPv6 option src wan option proto udp option src_ip fe80::/10 option src_port 547 option dest_ip fe80::/10 option dest_port 546 option family ipv6 option target ACCEPT # Allow essential incoming IPv6 ICMP traffic config rule option name Allow-ICMPv6-Input option src wan option proto icmp list icmp_type echo-request list icmp_type destination-unreachable list icmp_type packet-too-big list icmp_type time-exceeded list icmp_type bad-header list icmp_type unknown-header-type list icmp_type router-solicitation list icmp_type neighbour-solicitation option limit 1000/sec option family ipv6 option target ACCEPT # Allow essential forwarded IPv6 ICMP traffic config rule option name Allow-ICMPv6-Forward option src wan option dest * option proto icmp list icmp_type echo-request list icmp_type destination-unreachable list icmp_type packet-too-big list icmp_type time-exceeded list icmp_type bad-header list icmp_type unknown-header-type option limit 1000/sec option family ipv6 option target ACCEPT # include a file with users custom iptables rules config include option path /etc/firewall.user
DNSmasq
Der combinierte DNS und DHCP Server dnsmasq ist in /etc/config/dhcp so eingestellt:
root@ratbert:/etc/config# cat dhcp config dnsmasq option domainneeded 1 option boguspriv 1 option filterwin2k 0 # enable for dial on demand option localise_queries 1 option rebind_protection 1 # disable if upstream must serve RFC1918 addresses option rebind_localhost 1 # enable for RBL checking and similar services #list rebind_domain example.lan # whitelist RFC1918 responses for domains option local '/lan/' option domain 'lan' option expandhosts 1 option nonegcache 0 option authoritative 1 option readethers 1 option leasefile '/tmp/dhcp.leases' option resolvfile '/tmp/resolv.conf.auto' #list server '/mycompany.local/1.2.3.4' #option nonwildcard 1 #list interface br-lan #list notinterface lo #list bogusnxdomain '64.94.110.11' config dhcp wifi option interface wifi option start 100 option limit 150 option leasetime 12h config dhcp lan option interface lan option ignore 1 config dhcp wan option interface wan option ignore 1
aiccu
Der Sixxs Tunnel ist in /etc/config/aiccu configuriert:
root@ratbert:/etc/config# cat aiccu config aiccu option username '****************' option password '****************' option protocol '' option server 'tic.sixxs.net' option interface '' option tunnel_id '' option requiretls '' option defaultroute '1' option nat '0' option heartbeat '1'