203 lines
5.4 KiB
Bash
Executable file
203 lines
5.4 KiB
Bash
Executable file
#!/bin/sh
|
|
# 2020-06-13, Nico Schottelius
|
|
# See https://ungleich.ch/u/products/viwib-wifi-ipv6-box/
|
|
|
|
if [ $# -lt 2 ]; then
|
|
echo "$0 viwib-ip-address viwib-id [wgprivkey]"
|
|
echo " viwib-ip-address: where to find the viwib"
|
|
echo " viwib-id: number in decimal format"
|
|
echo " wgprivkey: if specified, use this private key"
|
|
exit 1
|
|
fi
|
|
|
|
|
|
set -x
|
|
viwib_ip=$1; shift
|
|
id=$1; shift
|
|
hex_id=$(printf "%0.2x\n" "$id")
|
|
viwib_hostname=viwib${id}
|
|
|
|
prefix_base=2a0a:e5c1:6
|
|
my_prefix=${prefix_base}${hex_id}
|
|
my_network=${my_prefix}::/48
|
|
|
|
my_wireguard_ip=${my_prefix}::42
|
|
my_lan_ip=${my_prefix}:cafe::42
|
|
my_wifi_ip=${my_prefix}:7ea::42
|
|
|
|
# wireguard
|
|
if [ $# -eq 1 ]; then
|
|
private_key=$1; shift
|
|
else
|
|
private_key=$(wg genkey)
|
|
fi
|
|
public_key=$(echo $private_key | wg pubkey)
|
|
|
|
vpn_endpoint_host=vpn-2a0ae5c1600.ungleich.ch
|
|
vpn_endpoint_pubkey=ygZQW3OSiMJl/RpKyaJVE0GSt6bjEDnoxdMJsNiloRE=
|
|
|
|
ping -c3 ${viwib_ip}
|
|
if [ $? -ne 0 ]; then
|
|
echo "Cannot reach ${viwib_ip}, aborting"
|
|
exit 1
|
|
fi
|
|
|
|
root_password=$(pwgen -1 32)
|
|
echo $root_password > ${viwib_hostname}.rootpw
|
|
|
|
|
|
cat <<EOF | ssh -t "root@${viwib_ip}"
|
|
set -x
|
|
# Setup lan to also retrieve an ip address via dhcp
|
|
|
|
# Adjust LAN to be IPv6 only
|
|
uci delete network.lan.ipaddr
|
|
uci delete network.lan.netmask
|
|
uci set network.lan.ip6addr='${my_lan_ip}/64'
|
|
|
|
# Do not announce ULA - we have GUA
|
|
uci delete network.globals.ula_prefix
|
|
|
|
# Setup Router Advertisements / remove IPv4 dhcp
|
|
uci set dhcp.lan.ra='server'
|
|
uci set dhcp.lan.dynamicdhcp='0'
|
|
|
|
uci delete dhcp.@dnsmasq[0].authoritative
|
|
|
|
uci delete dhcp.lan.start
|
|
uci delete dhcp.lan.limit
|
|
uci delete dhcp.lan.leasetime
|
|
|
|
# We do stateless by default everywhere
|
|
uci delete dhcp.lan.dhcpv6
|
|
|
|
# Fix DNS: make dnsmasq NOT use a resolv.conf
|
|
# so that it only reads from our servers with DNS64 enabled
|
|
uci set dhcp.@dnsmasq[0].noresolv='1'
|
|
|
|
# Fix DNS: make the OS use the locally provided DNS servers
|
|
# otherwise the VPN tunnel cannot be established
|
|
uci set dhcp.@dnsmasq[0].localuse='0'
|
|
|
|
# DNS upstream over VPN gives DNS64
|
|
uci delete dhcp.@dnsmasq[0].server
|
|
uci add_list dhcp.@dnsmasq[0].server='2a0a:e5c0:0:a::a'
|
|
uci add_list dhcp.@dnsmasq[0].server='2a0a:e5c0:2:a::a'
|
|
|
|
uci set system.@system[0].hostname="${viwib_hostname}"
|
|
|
|
# wifi ip address
|
|
# uci set network.wifi=interface
|
|
# uci set network.wifi.proto='static'
|
|
# uci set network.wifi.ip6addr='${my_wifi_ip}/64'
|
|
|
|
# Wifi configuration
|
|
uci set wireless.radio0=wifi-device
|
|
uci set wireless.radio0.htmode='HT40'
|
|
uci set wireless.radio0.country='CH'
|
|
uci set wireless.radio0.channel='6'
|
|
uci set wireless.default_radio0.encryption='psk2'
|
|
uci set wireless.default_radio0.key='iloveipv6'
|
|
uci set wireless.default_radio0.ssid='IPv6 everywhere ${viwib_hostname}'
|
|
|
|
# Ensure it is not disabled
|
|
uci delete wireless.radio0.disabled
|
|
|
|
# Create temporary IPV4 CLIENT on LAN
|
|
# This way we get Internet/upstream from the LAN port
|
|
# Can we do this via IPv6 instead?
|
|
# this breaks if multiple viwib are setup, as we have fake / wrong
|
|
# dhcp server configurations.
|
|
# easy solution: using two different networks...
|
|
|
|
uci commit
|
|
|
|
ping -c5 ungleich.ch || exit 1
|
|
|
|
# update the sources
|
|
opkg update
|
|
|
|
# install wireguard + gui
|
|
opkg install wireguard
|
|
opkg install luci-app-wireguard
|
|
|
|
# VPN / Wireguard
|
|
uci set network.wg0=interface
|
|
uci set network.wg0.proto='wireguard'
|
|
uci set network.wg0.private_key='${private_key}'
|
|
uci set network.wg0.listen_port='51820'
|
|
uci set network.wg0.addresses='${my_wireguard_ip}/64'
|
|
|
|
if ! uci get network.@wireguard_wg0[0]; then
|
|
uci add network wireguard_wg0
|
|
fi
|
|
|
|
uci set network.@wireguard_wg0[0]=wireguard_wg0
|
|
uci set network.@wireguard_wg0[0].persistent_keepalive='25'
|
|
uci set network.@wireguard_wg0[0].public_key="${vpn_endpoint_pubkey}"
|
|
uci set network.@wireguard_wg0[0].description="IPv6VPN.ch by ungleich"
|
|
uci set network.@wireguard_wg0[0].allowed_ips='::/0'
|
|
uci set network.@wireguard_wg0[0].endpoint_host="${vpn_endpoint_host}"
|
|
uci set network.@wireguard_wg0[0].endpoint_port='51820'
|
|
uci set network.@wireguard_wg0[0].route_allowed_ips='1'
|
|
|
|
# Firewall configuration
|
|
if ! uci show firewall | grep "name='Allow-SSH'"; then
|
|
uci add firewall rule
|
|
uci set firewall.@rule[-1].name='Allow-SSH'
|
|
uci set firewall.@rule[-1].src='wan'
|
|
uci set firewall.@rule[-1].dest='lan'
|
|
uci set firewall.@rule[-1].proto='tcp'
|
|
uci set firewall.@rule[-1].dest_port='22'
|
|
uci set firewall.@rule[-1].target='ACCEPT'
|
|
fi
|
|
|
|
if ! uci show firewall | grep "name='Allow-HTTPS'"; then
|
|
uci add firewall rule
|
|
uci set firewall.@rule[-1].name='Allow-HTTPS'
|
|
uci set firewall.@rule[-1].src='wan'
|
|
uci set firewall.@rule[-1].dest='lan'
|
|
uci set firewall.@rule[-1].proto='tcp'
|
|
uci set firewall.@rule[-1].dest_port='443'
|
|
uci set firewall.@rule[-1].target='ACCEPT'
|
|
fi
|
|
|
|
if ! uci show firewall | grep "name='Allow-HTTP'"; then
|
|
uci add firewall rule
|
|
uci set firewall.@rule[-1].name='Allow-HTTP'
|
|
uci set firewall.@rule[-1].src='wan'
|
|
uci set firewall.@rule[-1].dest='lan'
|
|
uci set firewall.@rule[-1].proto='tcp'
|
|
uci set firewall.@rule[-1].dest_port='80'
|
|
uci set firewall.@rule[-1].target='ACCEPT'
|
|
fi
|
|
|
|
# Add interfaces to the right network zone
|
|
uci set firewall.@zone[1].network='wan wan6 wg0'
|
|
|
|
uci commit
|
|
|
|
|
|
# Remove our ssh keys
|
|
rm -f /etc/dropbear/authorized_keys
|
|
|
|
# Setup root password
|
|
printf "${root_password}\n${root_password}\n" | passwd
|
|
|
|
|
|
reboot
|
|
EOF
|
|
|
|
echo "Wireguard public key and id: ${id} ${public_key}"
|
|
echo "Root password: ${root_password}"
|
|
echo ${public_key} > ${viwib_hostname}.public_key
|
|
|
|
# change to ipv6
|
|
viwib_ip=${my_lan_ip}
|
|
|
|
sleep 15
|
|
|
|
while ! ping -c5 ${viwib_ip}; do
|
|
echo "Waiting for viwib ${id}"
|
|
sleep 2
|
|
done
|