--- ## TOOD: # After router upgrade run this command to generate a new dyndns ssh key # $ dropbearkey -t ed25519 -f /etc/dyndns/id_ed25519 # Then replace the key at the dyndns server (/var/lib/dyndns/.ssh/authorized_keys) # after that run the dnydns update script once to accept the ssh host key openwrt_arch: ath79 openwrt_target: generic openwrt_profile: tplink_tl-wdr4300-v1 openwrt_output_image_suffixes: - "{{ openwrt_target }}-{{ openwrt_profile }}-squashfs-sysupgrade.bin" openwrt_packages_remove: - ppp - ppp-mod-pppoe - firewall - firewall4 - wpad-basic-wolfssl openwrt_packages_add: - hostapd-wolfssl - haveged - htop - ip - less - nano - tcpdump-mini - iperf - mtr - usbutils - nftables - kmod-nft-nat openwrt_mixin: /etc/dropbear/authorized_keys: content: "{{ ssh_keys_root | join('\n') }}\n" /etc/htoprc: file: "{{ global_files_dir }}/common/htoprc" /usr/bin/list-stations: mode: "0755" file: "{{ global_files_dir }}/common/openwrt/list-stations" /etc/rc.d/S21nftables: link: "../init.d/nftables" /etc/rc.d/K89nftables: link: "../init.d/nftables" /etc/init.d/nftables: mode: "0755" content: | #!/bin/sh /etc/rc.common START=21 STOP=89 start() { nft -f /etc/nftables.conf } stop() { nft flush ruleset } /etc/nftables.conf: content: | flush ruleset define nic_wan = eth0.2 define nic_lan = br-lan define prefix_lan = 192.168.2.0/24 table inet global { ## INPUT chain input_wan { ip protocol icmp accept ip6 nexthdr ipv6-icmp accept tcp dport { {{ ansible_port }} } accept } chain input { type filter hook input priority filter; policy drop; ct state vmap { established: accept, related: accept, invalid: drop } iifname vmap { lo: accept, $nic_lan: accept, $nic_wan: jump input_wan } } ## FORWARD chain forward { type filter hook forward priority filter; policy drop; ct state vmap { established: accept, related: accept, invalid: drop } iifname $nic_lan ip saddr $prefix_lan oifname $nic_wan accept } chain postrouting { type nat hook postrouting priority srcnat; policy accept; ip saddr $prefix_lan oifname $nic_wan masquerade } } /etc/dyndns/update.sh: mode: "0755" content: | #!/bin/sh /usr/bin/ssh -i /etc/dyndns/id_ed25519 -p 222 dyndns@dyn.schaaas.at mzl | logger -t dyndns /etc/crontabs/root: mode: "0755" content: | # run dyndns update script every 10 minutes */10 * * * * /etc/dyndns/update.sh > /dev/null openwrt_uci: system: - name: system options: hostname: '{{ host_name }}' timezone: 'CET-1CEST,M3.5.0,M10.5.0/3' ttylogin: '0' log_size: '64' urandom_seed: '0' - name: timeserver 'ntp' options: enabled: '1' enable_server: '1' server: - '0.at.pool.ntp.org' - '1.at.pool.ntp.org' - '2.at.pool.ntp.org' - '3.at.pool.ntp.org' dropbear: - name: dropbear options: PasswordAuth: 'off' RootPasswordAuth: 'off' Port: '{{ ansible_port }}' network: - name: globals 'globals' options: ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48" - name: interface 'loopback' options: device: lo proto: static ipaddr: 127.0.0.1 netmask: 255.0.0.0 - name: switch options: name: switch0 reset: 1 enable_vlan: 1 - name: switch_vlan options: device: switch0 vlan: 1 ports: 2 3 4 5 0t - name: switch_vlan options: device: switch0 vlan: 2 ports: 1 0t - name: device options: name: br-lan type: bridge ports: - eth0.1 - name: interface 'lan' options: device: br-lan proto: static ipaddr: 192.168.2.254 netmask: 255.255.255.0 - name: interface 'wan' options: ifname: eth0.2 proto: dhcp wireless: - name: wifi-device 'radio5g' options: type: mac80211 channel: 40 band: 5g country: AT path: "pci0000:00/0000:00:00.0" htmode: HT20 cell_density: 0 txpower: 19 - name: wifi-device 'radio2g' options: type: mac80211 channel: 11 band: 2g country: AT path: "platform/ahb/18100000.wmac" htmode: HT20 cell_density: 0 txpower: 20 - name: wifi-iface wds5g options: device: radio5g network: lan mode: ap wds: 1 disassoc_low_ack: 1 rsn_preauth: 1 ssid: "chaosWDS" encryption: 'sae-mixed' key: '{{ vault_wifi_keys.wds_mz }}' - name: wifi-iface lan5g options: device: radio5g network: lan mode: ap disassoc_low_ack: 1 rsn_preauth: 1 ssid: "chaos at home" encryption: 'sae-mixed' key: '{{ vault_wifi_keys.lan }}' ieee80211r: '1' mobility_domain: 'ca00' ft_over_ds: '1' - name: wifi-iface lan5gl options: device: radio5g network: lan mode: ap disassoc_low_ack: 1 rsn_preauth: 1 ssid: "chaos at home" encryption: 'psk2' key: '{{ vault_wifi_keys.lan }}' ieee80211r: '1' mobility_domain: 'ca01' ft_over_ds: '1' - name: wifi-iface lan2g options: device: radio2g network: lan mode: ap disassoc_low_ack: 1 rsn_preauth: 1 ssid: "chaos at home" encryption: 'sae-mixed' key: '{{ vault_wifi_keys.lan }}' ieee80211r: '1' mobility_domain: 'ca00' ft_over_ds: '1' - name: wifi-iface lan2gl options: device: radio2g network: lan mode: ap disassoc_low_ack: 1 rsn_preauth: 1 ssid: "chaos at home (legacy)" encryption: 'psk2' key: '{{ vault_wifi_keys.lan }}' ieee80211r: '1' mobility_domain: 'ca01' ft_over_ds: '1'