Re-organise repo (subdirs per project)

openwrt/viwib-2-configure.sh

@@ -0,0 +1,225 @@
+#!/bin/sh
+# 2020-06-13, Nico Schottelius
+# See https://ungleich.ch/u/products/viwib-wifi-ipv6-box/
+
+if [ $# -lt 2 ]; then
+    echo "$0 viwib-ip-address viwib-id [wgprivkey]"
+    echo "    viwib-ip-address: where to find the viwib"
+    echo "    viwib-id: number in decimal format"
+    echo "    wgprivkey: if specified, use this private key"
+    exit 1
+fi
+
+
+set -x
+viwib_ip=$1; shift
+id=$1; shift
+hex_id=$(printf "%0.2x\n" "$id")
+viwib_hostname=viwib${id}
+
+prefix_base=2a0a:e5c1:3
+my_prefix=${prefix_base}${hex_id}
+my_network=${my_prefix}::/48
+
+my_wireguard_ip=${my_prefix}::42
+my_lan_ip=${my_prefix}:cafe::42
+my_wifi_ip=${my_prefix}:7ea::42
+
+# wireguard
+if [ $# -eq 1 ]; then
+    private_key=$1; shift
+else
+    private_key=$(wg genkey)
+fi
+public_key=$(echo $private_key | wg pubkey)
+
+vpn_endpoint_host=vpn-2a0ae5c1300.ungleich.ch
+vpn_endpoint_pubkey=ft68G2RID7gZ6PXjFCSCOdJ9yspRg+tUw0YrNK9cTxE=
+
+ping -c3 ${viwib_ip}
+if [ $? -ne 0 ]; then
+    echo "Cannot reach ${viwib_ip}, aborting"
+    exit 1
+fi
+
+cat <<EOF | ssh -t "root@${viwib_ip}"
+set -x
+# Setup lan to also retrieve an ip address via dhcp
+
+# This stays in the final setup
+uci set network.lan.proto='dhcp'
+uci delete network.lan.ipaddr
+uci delete network.lan.netmask
+
+# The IPv6 lan configuration
+uci set network.lanv6=interface
+uci set network.lanv6.proto='static'
+uci set network.lanv6.ip6addr='${my_lan_ip}/64'
+uci set network.lanv6.ifname='br-lan'
+
+# LAN / Router advertisements / DHCP
+# DHCP: we are not authoratative
+uci delete dhcp.@dnsmasq[0].authoritative
+uci delete dhcp.lan.dhcpv6
+uci delete dhcp.lan.start
+uci delete dhcp.lan.limit
+uci delete dhcp.lan.leasetime
+
+# Do not announce ULA - we have GUA
+uci delete network.globals.ula_prefix
+
+# This is configuring the dhcp IPv4 client
+uci set dhcp.lan=dhcp
+
+# Setup Router Advertisements
+uci set dhcp.lan.interface='lanv6'
+uci set dhcp.lan.ra='server'
+uci set dhcp.lan.dynamicdhcp='0'
+
+# Fix DNS: make dnsmasq NOT use a resolv.conf
+# so that it only reads from our servers with DNS64 enabled
+uci set dhcp.@dnsmasq[0].noresolv='1'
+
+# Fix DNS: make the OS use the locally provided DNS servers
+# otherwise the VPN tunnel cannot be established
+dhcp.@dnsmasq[0].localuse='0'
+
+# DNS upstream over VPN gives DNS64
+uci delete dhcp.@dnsmasq[0].server
+uci add_list dhcp.@dnsmasq[0].server='2a0a:e5c0:0:a::a'
+uci add_list dhcp.@dnsmasq[0].server='2a0a:e5c0:2:a::a'
+
+# wifi ip address
+uci set network.wifi=interface
+uci set network.wifi.proto='static'
+uci set network.wifi.ip6addr='${my_wifi_ip}/64'
+
+# Wifi configuration
+uci set wireless.radio0=wifi-device
+uci set wireless.radio0.type='mac80211'
+uci set wireless.radio0.hwmode='11g'
+uci set wireless.radio0.path='platform/10300000.wmac'
+uci set wireless.radio0.htmode='HT40'
+uci set wireless.radio0.country='CH'
+uci set wireless.radio0.channel='6'
+
+uci set wireless.default_radio0=wifi-iface
+uci set wireless.default_radio0.device='radio0'
+uci set wireless.default_radio0.mode='ap'
+uci set wireless.default_radio0.encryption='psk2'
+uci set wireless.default_radio0.key='iloveipv6'
+uci set wireless.default_radio0.ssid='IPv6 everywhere ${viwib_hostname}'
+uci set wireless.default_radio0.network='wifi'
+
+# Wifi / Router advertisements
+uci set dhcp.wifi=dhcp
+uci set dhcp.wifi.interface='wifi'
+uci set dhcp.wifi.ra='server'
+uci set dhcp.wifi.dynamicdhcp='0'
+
+# Ensure it is not disabled
+uci delete wireless.radio0.disabled
+
+# This is temporary - keeping it until the config process is through
+# Probably not needet - we can connect to the final IPv6 address!
+# This code commented out == The address vanishes due to above reconfiguration
+# uci set network.lanv4temp=interface
+# uci set network.lanv4temp.proto='static'
+# uci set network.lanv4temp.ifname='br-lan'
+# uci set network.lanv4temp.ipaddr='192.168.61.1'
+# uci set network.lanv4temp.netmask='255.255.255.0'
+
+uci commit
+
+# Need to reboot to restore /etc/resolv.conf
+reboot
+
+#/etc/init.d/network restart
+EOF
+
+# ensure viwib is back
+# ensure viwib network is up and running - bridge takes a bit of time
+# ensure viwib gives out ipv6 address
+# Found: 30s is not enough for full reconfiguration
+echo "Public VPN key: ${id} ${public_key}"
+sleep 60
+
+# change to ipv6
+viwib_ip=${my_lan_ip}
+
+ping -c5 ${viwib_ip}
+
+cat <<EOF | ssh -t "root@${viwib_ip}"
+ping -c5 ungleich.ch || exit 1
+
+# update the sources
+opkg update
+
+# install wireguard + gui
+opkg install wireguard
+opkg install luci-app-wireguard
+
+# VPN / Wireguard
+uci set network.wg0=interface
+uci set network.wg0.proto='wireguard'
+uci set network.wg0.private_key='${private_key}'
+uci set network.wg0.listen_port='51820'
+uci set network.wg0.addresses='${my_wireguard_ip}/64'
+
+if ! uci get network.@wireguard_wg0[0]; then
+   uci add network wireguard_wg0
+fi
+
+uci set network.@wireguard_wg0[0]=wireguard_wg0
+uci set network.@wireguard_wg0[0].persistent_keepalive='25'
+uci set network.@wireguard_wg0[0].public_key='${vpn_endpoint_pubkey}'
+uci set network.@wireguard_wg0[0].description='IPv6VPN.ch by ungleich'
+uci set network.@wireguard_wg0[0].allowed_ips='::/0'
+uci set network.@wireguard_wg0[0].endpoint_host='${vpn_endpoint_host}'
+uci set network.@wireguard_wg0[0].endpoint_port='51820'
+uci set network.@wireguard_wg0[0].route_allowed_ips='1'
+
+uci set system.@system[0].hostname="${viwib_hostname}"
+
+# Firewall configuration
+if ! uci show firewall | grep "name='Allow-SSH'"; then
+uci add firewall rule
+uci set firewall.@rule[-1].name='Allow-SSH'
+uci set firewall.@rule[-1].src='wan'
+uci set firewall.@rule[-1].dest='lan'
+uci set firewall.@rule[-1].proto='tcp'
+uci set firewall.@rule[-1].dest_port='22'
+uci set firewall.@rule[-1].target='ACCEPT'
+fi
+
+if ! uci show firewall | grep "name='Allow-HTTPS'"; then
+uci add firewall rule
+uci set firewall.@rule[-1].name='Allow-HTTPS'
+uci set firewall.@rule[-1].src='wan'
+uci set firewall.@rule[-1].dest='lan'
+uci set firewall.@rule[-1].proto='tcp'
+uci set firewall.@rule[-1].dest_port='443'
+uci set firewall.@rule[-1].target='ACCEPT'
+fi
+
+if ! uci show firewall | grep "name='Allow-HTTP'"; then
+uci add firewall rule
+uci set firewall.@rule[-1].name='Allow-HTTP'
+uci set firewall.@rule[-1].src='wan'
+uci set firewall.@rule[-1].dest='lan'
+uci set firewall.@rule[-1].proto='tcp'
+uci set firewall.@rule[-1].dest_port='80'
+uci set firewall.@rule[-1].target='ACCEPT'
+fi
+
+# Add interfaces to the right network zone
+uci set firewall.@zone[0].network='lan lanv6 wifi'
+uci set firewall.@zone[1].network='wg0'
+
+uci commit
+
+reboot
+EOF
+
+echo "Wireguard public key and id: ${id} ${public_key}"
+echo ${public_key} > ${viwib_hostname}.public_key