diff options
Diffstat (limited to 'inventory/host_vars/mz-router.yml')
| -rw-r--r-- | inventory/host_vars/mz-router.yml | 152 |
1 files changed, 95 insertions, 57 deletions
diff --git a/inventory/host_vars/mz-router.yml b/inventory/host_vars/mz-router.yml index f79de2b1..23fd2931 100644 --- a/inventory/host_vars/mz-router.yml +++ b/inventory/host_vars/mz-router.yml @@ -1,17 +1,24 @@ --- -openwrt_variant: openwrt -openwrt_release: 18.06.2 -openwrt_arch: ar71xx +## TOOD: +# After router upgrade run this command to generate a new dyndns ssh key +# $ dropbearkey -t ed25519 -f /etc/dyndns/id_ed25519 +# Then replace the key at the dyndns server (/var/lib/dyndns/.ssh/authorized_keys) +# after that run the dnydns update script once to accept the ssh host key + +openwrt_arch: ath79 openwrt_target: generic -openwrt_profile: tl-wdr4300-v1 +openwrt_profile: tplink_tl-wdr4300-v1 openwrt_output_image_suffixes: - - "generic-{{ openwrt_profile }}-squashfs-sysupgrade.bin" + - "{{ openwrt_target }}-{{ openwrt_profile }}-squashfs-sysupgrade.bin" openwrt_packages_remove: - ppp - ppp-mod-pppoe - firewall + - firewall4 + - wpad-basic-wolfssl openwrt_packages_add: + - hostapd-wolfssl - haveged - htop - ip @@ -21,8 +28,8 @@ openwrt_packages_add: - iperf - mtr - usbutils - - kmod-ipt-nat - - kmod-ipt-conntrack + - nftables + - kmod-nft-nat openwrt_mixin: @@ -32,54 +39,77 @@ openwrt_mixin: /etc/htoprc: file: "{{ global_files_dir }}/common/htoprc" - /etc/rc.d/S22network-fw: - link: "../init.d/network-fw" + /usr/bin/list-stations: + mode: "0755" + file: "{{ global_files_dir }}/common/openwrt/list-stations" + + /etc/rc.d/S21nftables: + link: "../init.d/nftables" - /etc/rc.d/K91network-fw: - link: "../init.d/network-fw" + /etc/rc.d/K89nftables: + link: "../init.d/nftables" - /etc/init.d/network-fw: + /etc/init.d/nftables: mode: "0755" content: | #!/bin/sh /etc/rc.common - START=22 - STOP=91 + START=21 + STOP=89 start() { - LAN_IP=$(uci get network.lan.ipaddr) - LAN_MASK=$(uci get network.lan.netmask) - - WAN_IF=$(uci get network.wan.ifname) - - iptables -A INPUT -i lo -j ACCEPT - iptables -A INPUT -i br-lan -j ACCEPT - - iptables -A INPUT -i "$WAN_IF" -p icmp -j ACCEPT - iptables -A INPUT -i "$WAN_IF" -p tcp --dport {{ ansible_port | default(22) }} -j ACCEPT - iptables -A INPUT -i "$WAN_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT - - iptables -A FORWARD -i br-lan -o "$WAN_IF" -j ACCEPT - iptables -A FORWARD -i "$WAN_IF" -o br-lan -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT - iptables -t nat -A POSTROUTING -o "$WAN_IF" -s "$LAN_IP/$LAN_MASK" -j MASQUERADE - - iptables -P INPUT DROP - iptables -P FORWARD DROP + nft -f /etc/nftables.conf } stop() { - iptables -P INPUT ACCEPT - iptables -F INPUT - iptables -P FORWARD ACCEPT - iptables -F FORWARD - iptables -t nat -F POSTROUTING + nft flush ruleset + } + + /etc/nftables.conf: + content: | + flush ruleset + + define nic_wan = eth0.2 + define nic_lan = br-lan + define prefix_lan = 192.168.2.0/24 + + table inet global { + ## INPUT + chain input_lan { + ip saddr $prefix_lan accept + } + + chain input_wan { + ip protocol icmp accept + ip6 nexthdr ipv6-icmp accept + tcp dport { {{ ansible_port }} } accept + } + + chain input { + type filter hook input priority filter; policy drop; + ct state vmap { established: accept, related: accept, invalid: drop } + iifname vmap { lo: accept, $nic_lan: jump input_lan, $nic_wan: jump input_wan } + } + + + ## FORWARD + chain forward { + type filter hook forward priority filter; policy drop; + ct state vmap { established: accept, related: accept, invalid: drop } + iifname $nic_lan ip saddr $prefix_lan oifname $nic_wan accept + } + + chain postrouting { + type nat hook postrouting priority srcnat; policy accept; + ip saddr $prefix_lan oifname $nic_wan masquerade + } } /etc/dyndns/update.sh: mode: "0755" content: | #!/bin/sh - /usr/bin/ssh -i /etc/dyndns/id_rsa -p 222 dyndns@dyn.schaaas.at mzl | logger -t dyndns + /usr/bin/ssh -i /etc/dyndns/id_ed25519 -p 222 dyndns@dyn.schaaas.at mzl | logger -t dyndns /etc/crontabs/root: mode: "0755" @@ -101,19 +131,19 @@ openwrt_uci: - name: timeserver 'ntp' options: enabled: '1' - enable_server: '0' + enable_server: '1' server: - - '0.lede.pool.ntp.org' - - '1.lede.pool.ntp.org' - - '2.lede.pool.ntp.org' - - '3.lede.pool.ntp.org' + - '0.at.pool.ntp.org' + - '1.at.pool.ntp.org' + - '2.at.pool.ntp.org' + - '3.at.pool.ntp.org' dropbear: - name: dropbear options: PasswordAuth: 'off' RootPasswordAuth: 'off' - Port: '{{ ansible_port | default(22) }}' + Port: '{{ ansible_port }}' network: - name: globals 'globals' @@ -122,7 +152,7 @@ openwrt_uci: - name: interface 'loopback' options: - ifname: lo + device: lo proto: static ipaddr: 127.0.0.1 netmask: 255.0.0.0 @@ -145,11 +175,16 @@ openwrt_uci: vlan: 2 ports: 1 0t - - name: interface 'lan' + - name: device options: - ifname: eth0.1 - force_link: 1 + name: br-lan type: bridge + ports: + - eth0.1 + + - name: interface 'lan' + options: + device: br-lan proto: static ipaddr: 192.168.2.254 netmask: 255.255.255.0 @@ -163,20 +198,23 @@ openwrt_uci: - name: wifi-device 'radio5g' options: type: mac80211 + channel: 40 + band: 5g + country: AT path: "pci0000:00/0000:00:00.0" - hwmode: 11a htmode: HT20 - country: AT + cell_density: 0 txpower: 19 - - name: wifi-device 'radio2g4' + - name: wifi-device 'radio2g' options: type: mac80211 - path: "platform/ar934x_wmac" - hwmode: 11g - htmode: HT20 - channel: 4 + channel: 11 + band: 2g country: AT + path: "platform/ahb/18100000.wmac" + htmode: HT20 + cell_density: 0 txpower: 20 - name: wifi-iface wds5g @@ -202,9 +240,9 @@ openwrt_uci: encryption: 'psk2+ccmp' key: '{{ vault_wifi_keys.lan }}' - - name: wifi-iface lan2g4 + - name: wifi-iface lan2g options: - device: radio2g4 + device: radio2g network: lan mode: ap disassoc_low_ack: 1 |