ungleich-tools/openwrt/viwib-2-configure.sh

#!/bin/sh
# 2020-06-13, Nico Schottelius
# See https://ungleich.ch/u/products/viwib-wifi-ipv6-box/

if [ $# -lt 2 ]; then
    echo "$0 viwib-ip-address viwib-id [wgprivkey]"
    echo "    viwib-ip-address: where to find the viwib"
    echo "    viwib-id: number in decimal format"
    echo "    wgprivkey: if specified, use this private key"
    exit 1
fi


set -x
viwib_ip=$1; shift
id=$1; shift
hex_id=$(printf "%0.2x\n" "$id")
viwib_hostname=viwib${id}

prefix_base=2a0a:e5c1:6
my_prefix=${prefix_base}${hex_id}
my_network=${my_prefix}::/48

my_wireguard_ip=${my_prefix}::42
my_lan_ip=${my_prefix}:cafe::42
my_wifi_ip=${my_prefix}:7ea::42

# wireguard
if [ $# -eq 1 ]; then
    private_key=$1; shift
else
    private_key=$(wg genkey)
fi
public_key=$(echo $private_key | wg pubkey)

vpn_endpoint_host=vpn-2a0ae5c1600.ungleich.ch
vpn_endpoint_pubkey=ygZQW3OSiMJl/RpKyaJVE0GSt6bjEDnoxdMJsNiloRE=

i=0
found=""
while [ $i -lt 30 ]; do
    echo "Trying to reach ${viwib_ip} ($i)"
    if ping -c1 ${viwib_ip} >/dev/null; then
        found="yes"
        break
    fi
    i=$((i+1))
done

if [ -z "$found" ]; then
    echo "Unable to contact viwib. Exiting"
    exit 1
fi


cat <<EOF | ssh -t "root@${viwib_ip}"
set -x

# Check connection - otherwise abort
ping -c5 ungleich.ch || exit 1

# 1. install packages
# update the sources
opkg update

# install packages: wireguard + gui
opkg install luci-app-wireguard luci-proto-wireguard


# DO NOT Adjust LAN to be IPv6 only
# uci delete network.lan.ipaddr
# uci delete network.lan.netmask

uci set network.lan.ip6addr='${my_lan_ip}/64'

# Do not announce ULA - we have GUA
uci delete network.globals.ula_prefix

# Setup Router Advertisements / DO NOT remove IPv4 dhcp
uci set dhcp.lan.ra='server'
#uci set dhcp.lan.dynamicdhcp='0'
#uci delete dhcp.@dnsmasq[0].authoritative
# uci delete dhcp.lan.start
# uci delete dhcp.lan.limit
# uci delete dhcp.lan.leasetime

# We do stateless by default everywhere, however we can keep dhcp on ...
# uci delete dhcp.lan.dhcpv6

# Fix DNS: make dnsmasq NOT use a resolv.conf
# so that it only reads from our servers with DNS64 enabled
uci set dhcp.@dnsmasq[0].noresolv='1'

# Fix DNS: make the OS use the locally provided DNS servers
# otherwise the VPN tunnel cannot be established
uci set dhcp.@dnsmasq[0].localuse='0'

# DNS upstream over VPN gives DNS64
uci delete dhcp.@dnsmasq[0].server
uci add_list dhcp.@dnsmasq[0].server='2a0a:e5c0:0:a::a'
uci add_list dhcp.@dnsmasq[0].server='2a0a:e5c0:2:a::a'

uci set system.@system[0].hostname="${viwib_hostname}"

# wifi ip address
# uci set network.wifi=interface
# uci set network.wifi.proto='static'
# uci set network.wifi.ip6addr='${my_wifi_ip}/64'

# Wifi configuration
uci set wireless.radio0=wifi-device
uci set wireless.radio0.htmode='HT40'
uci set wireless.radio0.country='CH'
uci set wireless.radio0.channel='6'
uci set wireless.default_radio0.encryption='psk2'
uci set wireless.default_radio0.key='iloveipv6'
uci set wireless.default_radio0.ssid='IPv6 everywhere ${viwib_hostname}'

# Ensure it is not disabled
uci delete wireless.radio0.disabled

uci commit



# VPN / Wireguard
uci set network.wg0=interface
uci set network.wg0.proto='wireguard'
uci set network.wg0.private_key='${private_key}'
uci set network.wg0.listen_port='51820'
uci set network.wg0.addresses='${my_wireguard_ip}/64'

if ! uci get network.@wireguard_wg0[0]; then
   uci add network wireguard_wg0
fi

uci set network.@wireguard_wg0[0]=wireguard_wg0
uci set network.@wireguard_wg0[0].persistent_keepalive='25'
uci set network.@wireguard_wg0[0].public_key="${vpn_endpoint_pubkey}"
uci set network.@wireguard_wg0[0].description="IPv6VPN.ch by ungleich"
uci set network.@wireguard_wg0[0].allowed_ips='::/0'
uci set network.@wireguard_wg0[0].endpoint_host="${vpn_endpoint_host}"
uci set network.@wireguard_wg0[0].endpoint_port='51820'
uci set network.@wireguard_wg0[0].route_allowed_ips='1'

# Firewall configuration
if ! uci show firewall | grep "name='Allow-SSH'"; then
uci add firewall rule
uci set firewall.@rule[-1].name='Allow-SSH'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].dest='lan'
uci set firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].dest_port='22'
uci set firewall.@rule[-1].target='ACCEPT'
fi

if ! uci show firewall | grep "name='Allow-HTTPS'"; then
uci add firewall rule
uci set firewall.@rule[-1].name='Allow-HTTPS'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].dest='lan'
uci set firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].dest_port='443'
uci set firewall.@rule[-1].target='ACCEPT'
fi

if ! uci show firewall | grep "name='Allow-HTTP'"; then
uci add firewall rule
uci set firewall.@rule[-1].name='Allow-HTTP'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].dest='lan'
uci set firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].dest_port='80'
uci set firewall.@rule[-1].target='ACCEPT'
fi

if ! uci show firewall | grep "name='Allow-SSH-in'"; then
uci add firewall rule
uci set firewall.@rule[-1].name='Allow-SSH-in'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].dest_port='22'
uci set firewall.@rule[-1].target='ACCEPT'
fi

# Add interfaces to the right network zone
uci set firewall.@zone[1].network='wan wan6 wg0'

uci commit

reboot
EOF

echo "Wireguard public key and id: ${id} ${public_key}"

# change to ipv6
viwib_ip=${my_lan_ip}

while ! ping6 -c5 ${viwib_ip}; do
    echo "Waiting for viwib ${id}"
    sleep 2
done

echo "Wireguard public key and id: ${id} ${public_key}"