Network2/Experiments/OpenWRT: Difference between revisions
< Network2 | Experiments
Jump to navigation
Jump to search
mNo edit summary |
mNo edit summary |
||
Line 3: | Line 3: | ||
Installed OpenWRT. |
Installed OpenWRT. |
||
=== iptables === |
|||
Found that I could no longer ping my IP address from crank. |
Found that I could no longer ping my IP address from crank. |
||
Revision as of 04:04, 15 January 2010
OpenWRT
Installed OpenWRT.
iptables
Found that I could no longer ping my IP address from crank.
Examined firewall:
iptables -t mangle -L
Good, no mangling.
iptables -t nat -L
Some NAT, but just a couple of MASQUERADE rules.
iptables -t filter -L
Lots of filtering. In more detail:
iptables -t filter -L INPUT
Some complicated chains:
- syn_flood rate-limits TCP connection control packets.
- input_rule is empty
- input has subchains for zone_wan and zone_lan.
- zone_lan accepts everything.
- zone_wan rejects everything not accepted by input_wan.
Okay, let's add an accept rule to input_wan:
iptables -t filter -A input_wan -p icmp -j ACCEPT
Alternately, add:
config 'rule' option 'target' 'ACCEPT' option '_name' 'ping' option 'src' 'wan' option 'proto' 'icmp'
to /etc/config/firewall (or to /etc/firewall.user?)
radvd
Note that the prefix here that we want to advertise is called the 'routed /64' by tunnelbroker.
cat > /etc/config/radvd <<EOF config interface option interface 'lan' option AdvSendAdvert 1 option AdvManagedFlag 0 option AdvOtherConfigFlag 0 option AdvHomeAgentFlag 0 option ignore 0 config prefix option interface 'lan' option prefix '2001:470:1f07:6f7::/64' option AdvOnLink 1 option AdvAutonomous 1 option AdvRouterAddr 0 option ignore 0 EOF /etc/init.d/radvd start
OpenVPN
OpenVPN is a pain to install on OpenWRT because it depends on OpenSSL, which is too big.
Fortunately, we can hack around that:
cd /tmp opkg download libopenssl mkdir ssl tar Ozxf libopenssl* ./data.tar.gz | tar zxC ./ssl mv ssl/usr/lib/* ssl; rm -rf ssl/usr
To use:
cd /tmp/ssl LD_LIBRARY_PATH=. openvpn
Then edit /tmp/opkg-lists/snapshots to remove the dependency of openvpn.
...
Follow CA instructions. Make sure you put the right CN in your server cert.
...
openssl dhparam -out dh1024.pem 1024
Server:
ntpclient -h pool.ntp.org -s openvpn --mode server --client-to-client --dev tap --user nobody --group nogroup --tls-server --ca ./ca.pem --cert server.pem --key server.pem --dh dh1024.pem --proto tcp-server & ip link set tap0 up brctl addif br-lan tap0
Client:
openvpn --user nobody --group nobody --dev tap --tls-remote openwrt --tls-client --ca ca.cert --cert ./client.pem --key client.pem --proto tcp-client --remote openwrt & ip link set tap0 up