lbhost/wrt-bj-setup.sh

   1 #!/usr/bin/env sh
   2
   3
   4 opkg update && opkg install \
   5         luci-app-ddns curl ca-bundle \
   6         luci-app-ocserv
   7
   8
   9 # Solving dnsmasq failures, https://github.com/openwrt/openwrt/issues/9346
  10 echo "Fixing dnsmasq errors"
  11 uci add_list dhcp.@dnsmasq[0].notinterface='pppoe-wan'
  12
  13
  14 echo "Basic system configuration initializing"
  15 # System
  16 uci batch << EOI
  17 set system.@system[].hostname="wrt-bj"
  18 set system.@system[].timezone="CST-8"
  19 set dropbear.@dropbear[].Interface="lan"
  20 EOI
  21 # Interface
  22 uci batch << EOI
  23 set network.lan.ipaddr="192.168.132.1"
  24 EOI
  25 # DHCP
  26 uci batch << EOI
  27 set dhcp.lan.start="50"
  28 set dhcp.lan.limit="50"
  29 EOI
  30 # Wireless
  31 uci batch << EOI
  32 set wireless.radio0.channel="auto"
  33 set wireless.default_radio0.encryption="psk2"
  34 set wireless.radio1.channel="auto"
  35 set wireless.default_radio1.encryption="psk2"
  36 EOI
  37 # Firewall
  38 if [ ! "$(uci get firewall.@zone[0].name)" = "lan" ]; then
  39         echo "expecting firewall zone[0] is lan" >&2
  40         exit 1
  41 fi
  42 uci rename firewall.@zone[0]="lan"
  43 if [ ! "$(uci get firewall.@zone[1].name)" = "wan" ]; then
  44         echo "expecting firewall zone[1] is wan" >&2
  45         exit 1
  46 fi
  47 uci rename firewall.@zone[1]="wan"
  48
  49
  50 # Allow-IPv6
  51 echo "Allowing all IPv6 incoming to lan"
  52 uci batch << EOI
  53 add firewall rule
  54 set firewall.@rule[-1].name="Allow-IPv6"
  55 set firewall.@rule[-1].family="ipv6"
  56 set firewall.@rule[-1].proto="all"
  57 set firewall.@rule[-1].src="wan"
  58 set firewall.@rule[-1].dest="lan"
  59 set firewall.@rule[-1].target="ACCEPT"
  60 EOI
  61 # Allow-OpenConnect
  62 echo "Allowing OpenConnect incoming to device"
  63 uci batch << EOI
  64 add_list firewall.lan.device="vpns+"
  65 add firewall rule
  66 set firewall.@rule[-1].name="Allow-OpenConnect"
  67 set firewall.@rule[-1].src="wan"
  68 set firewall.@rule[-1].dest_port="4443"
  69 set firewall.@rule[-1].proto="tcp udp"
  70 set firewall.@rule[-1].target="ACCEPT"
  71 EOI
  72
  73
  74 # Port Forwards
  75 echo "Forwarding local lan ports"
  76 add_dnat() {
  77         uci batch << EOI
  78         add firewall redirect
  79         set firewall.@redirect[-1].dest="lan"
  80         set firewall.@redirect[-1].target="DNAT"
  81         set firewall.@redirect[-1].src="wan"
  82         set firewall.@redirect[-1].src_dport="${3}"
  83         set firewall.@redirect[-1].dest_port="${3}"
  84         set firewall.@redirect[-1].dest_ip="${2}"
  85         set firewall.@redirect[-1].name="${1}"
  86 EOI
  87 }
  88 add_dnat "aria2://nuc-pri.internal" "192.168.132.213" 51413
  89 add_dnat "http://nuc-pri.internal" "192.168.132.213" 80
  90 add_dnat "https://nuc-pri.internal" "192.168.132.213" 443
  91
  92
  93 # OpenConnect
  94 echo "OpenConnect service basic configuration initializing"
  95 while uci -q delete ocserv.@routes[]; do :; done
  96 while uci -q delete ocserv.@dns[]; do :; done
  97 uci batch << EOI
  98 set ocserv.config.port="4443"
  99 set ocserv.config.ipaddr="192.168.133.1"
 100 set ocserv.config.netmask="255.255.255.0"
 101 add ocserv routes
 102 set ocserv.@routes[-1].ip="192.168.132.0"
 103 set ocserv.@routes[-1].netmask="255.255.255.0"
 104 add ocserv routes
 105 set ocserv.@routes[-1].ip="192.168.133.0"
 106 set ocserv.@routes[-1].netmask="255.255.255.0"
 107 EOI
 108
 109
 110 # DDNS
 111 echo "DDNS service basic configuration initializing"
 112 uci batch << EOI
 113 set ddns.global.use_curl="1"
 114 EOI
 115 # DDNS duckdns_ipv4
 116 uci batch << EOI
 117 rename ddns.myddns_ipv4="duckdns_ipv4"
 118 set ddns.duckdns_ipv4.service_name="duckdns.org"
 119 set ddns.duckdns_ipv4.use_ipv6="0"
 120 set ddns.duckdns_ipv4.ip_source="interface"
 121 set ddns.duckdns_ipv4.ip_interface="pppoe-wan"
 122 set ddns.duckdns_ipv4.interface="pppoe-wan"
 123 set ddns.duckdns_ipv4.use_https="1"
 124 set ddns.duckdns_ipv4.cacert="/etc/ssl/certs/ca-certificates.crt"
 125 EOI
 126 # DDNS duckdns_ipv6
 127 uci batch << EOI
 128 rename ddns.myddns_ipv6="duckdns_ipv6"
 129 set ddns.duckdns_ipv6.service_name="duckdns.org"
 130 set ddns.duckdns_ipv6.use_ipv6="1"
 131 set ddns.duckdns_ipv6.ip_source="interface"
 132 set ddns.duckdns_ipv6.ip_interface="pppoe-wan"
 133 set ddns.duckdns_ipv6.interface="pppoe-wan"
 134 set ddns.duckdns_ipv6.use_https="1"
 135 set ddns.duckdns_ipv6.cacert="/etc/ssl/certs/ca-certificates.crt"
 136 EOI
 137
 138 uci changes
 139 echo "ALL DONE, waiting to commit"