Tunnel HNA mit OpenWrt White Russian

A c h t u n g noch nicht getestet!!!

Getestet es geht so nicht !!!

1. WAN-Default-Route entfernen in den Einstellungen WAN

2. Statische Routen setzen im Bereich LAN

85.214.81.232:255.255.255.255:x.x.x.x:0:vlan1 81.10.154.38:255.255.255.255:x.x.x.x:0:vlan1 192.53.103.108:255.255.255.255:x.x.x.x:0:vlan1 
192.53.103.104:255.255.255.255:x.x.x.x:0:vlan1 128.138.140.44:255.255.255.255:x.x.x.x:0:vlan1 8.8.8.8:255.255.255.255:x.x.x.x:0:vlan1 

x.x.x.x ist durch die IP zu ersetzen, welche vorher bei WAN bei WAN-Default-Route stand.

vlan1 ist in der Regel der WANPORT des Routers. Ist bei Deinem Gerät der WANPORT nicht vlan1, dann gib den entsprechenden Port an. Die 1 Route zeigt zum halleschen VPN-Server (freifunk-halle.net), die 2 Route zeigt zum wels VPN-Server (wels.funkfeuer.at), die 3 Route zeigt auf einen Zeit-Server, die 4 Route zeigt auf einen Zeit-Server, die 5 Route zeigt auf einen Zeit-Server, die 6 Route zeigt auf einen DNS-Server.

3. ändern der Firewall /etc/local.fw und noch dises 104.62.X.X auf Deine Node-IP-Adresse ändern.

#!/bin/sh

# Place your firewall addons here or use /etc/local.fw-xxx

#MACS="00:00:01:00:00:01 0c:68:0b:02:a3:1e"

case $1 in
	start)
		for i in $MACS; do
			# You can also add "-I INPUT", but it is sufficient
			# to block forwarding, since the delinquent will get
			# the routing but no (internet) connectivity.
			iptables -I FORWARD -m mac --mac-source $i -j DROP
		done
		iptables -I INPUT -i tap+ -j ACCEPT
		iptables -I OUTPUT -o tap+ -j ACCEPT
		iptables -I FORWARD -i tap+ -j ACCEPT
		iptables -I FORWARD -o tap+ -j ACCEPT

		iptables -I INPUT -p tcp --dport 1195 -j ACCEPT
		iptables -I INPUT -p tcp --dport 1196 -j ACCEPT
		iptables -I INPUT -p udp --dport 1199 -j ACCEPT

		iptables -I POSTROUTING -t nat -o tap+ -s 192.168.1.0/24 -j SNAT --to-source 104.62.X.X


	;;
	stop)
		for i in $MACS; do
			iptables -D FORWARD -m mac --mac-source $i -j DROP
		done
	;;
esac

4. ändern der DNS-Abfrage /etc/init.d/S60dnsmasq (S = starten | Zahl = Startreihenfolge)

#!/bin/sh

. /etc/functions.sh

write_config()
{

	WAN_DOMAIN_LOCAL=
	WAN_DOMAIN_DOMAIN=
	test -n "$WAN_DOMAIN" && WAN_DOMAIN_LOCAL="local=/.$WAN_DOMAIN/"
	test -n "$WAN_DOMAIN" && WAN_DOMAIN_DOMAIN="domain=$WAN_DOMAIN"

	cat>/var/etc/dnsmasq.conf<<EOF
# filter what we send upstream
#domain-needed
bogus-priv
filterwin2k

# To speed up ssh, all lookups throug dnsmasq
no-resolv

# allow /etc/hosts and dhcp lookups via *.lan
addn-hosts=/etc/local.hosts
$WAN_DOMAIN_LOCAL
$WAN_DOMAIN_DOMAIN
expand-hosts

##############################################
# new ff root server ips (intranet)
##############################################
server=104.62.28.36
server=104.62.28.35
server=104.62.2.131
server=104.62.1.129
server=104.62.16.1
server=104.62.16.37
##############################################
# new ff root server ips (internet)
##############################################
server=85.214.81.232
server=81.10.154.38
##############################################
# reverse dns
##############################################
server=8.8.8.8
server=8.8.4.4
##############################################


EOF

	IFS=\;
	for i in $WAN_DNS;do
		echo "server=$i">>/var/etc/dnsmasq.conf
	done

	unset IFS

	if [ -z "$WANOLSR" ]; then
		cat>>/var/etc/dnsmasq.conf<<EOF
# no dns queries from the wan
except-interface=$(nvram get wan_ifname)

EOF
	fi

	DHCPEND=$(nvram get dhcp_num)
	test -z "$DHCPEND" && DHCPEND=4
	if [ $DHCPEND -gt 0 ]; then
		DHCPLEASE=$(nvram get dhcp_lease)
		test -z "$DHCPLEASE" && DHCPLEASE=12h
		test "$DHCPLEASE" = "0" && DHCPLEASE=12h
		DHCPNET=$(echo $LANNET|cut -d'.' -f1-3)
		DHCPBEG=$(nvram get dhcp_start)
		DHCPBEG=${DHCPBEG##*.}
		test -z "$DHCPBEG" && DHCPBEG=100
		DHCPEND=$(( $DHCPBEG + $DHCPEND - 1 ))
		echo "dhcp-range=wired,$DHCPNET.$DHCPBEG,$DHCPNET.$DHCPEND,$LANMSK,$DHCPLEASE">>/var/etc/dnsmasq.conf
	else
		echo "no-dhcp-interface=$(nvram get lan_ifname)">>/var/etc/dnsmasq.conf
	fi

	WLDHCP=$(nvram get ff_wldhcp)
	IFS=\;
	for ENT in $WLDHCP; do
		NET=${ENT%[:,]*}
		MSK=${ENT#*[:,]}
		if [ -n "$NET" ] && [ -n "$MSK" ]; then
			DHCPLEASE=30m
			DHCPBEG=$(ipcalc -n $NET|cut -d'.' -f4)
			#DHCPBEG=$(( $DHCPBEG + 2 ))
			DHCPEND=$(ipcalc -b $NET|cut -d'.' -f4)
			#DHCPEND=$(( $DHCPEND - 1 ))
			DHCPNET=$(ipcalc -n $NET|cut -d'=' -f2|cut -d'.' -f1-3)
			echo "dhcp-range=wlnat,$DHCPNET.$DHCPBEG,$DHCPNET.$DHCPEND,$MSK,$DHCPLEASE">>/var/etc/dnsmasq.conf
		fi
	done

	WAN_HOSTNAME=$(nvram get wan_hostname)
	if test -n "$WAN_HOSTNAME" && test -n "$LANADR"; then
		echo "address=/$WAN_HOSTNAME/$LANADR">>/var/etc/dnsmasq.conf
		echo "address=/$WAN_HOSTNAME.$WAN_DOMAIN/$LANADR">>/var/etc/dnsmasq.conf
	fi

	cat>>/var/etc/dnsmasq.conf<<EOF
dhcp-leasefile=/var/run/dhcp.leases

# allow a /etc/ethers for static hosts
read-ethers

# other useful options:
#      subnet mask: dhcp-option=wired,1,255.255.255.0
# default route(s): dhcp-option=wired,3,192.168.1.1,192.168.1.2
#    dns server(s): dhcp-option=wired,6,192.168.1.1,192.168.1.2
#   broadcast addr: dhcp-option=wired,28,192.168.1.255
#   broadcast addr: dhcp-option=wlnat,28,172.31.255.255
EOF

	test -f /etc/local.dnsmasq.conf && cat>>/var/etc/dnsmasq.conf</etc/local.dnsmasq.conf
}

case $1 in
	start)
		# Compatibility with openwrt
		ln -sf /var/etc/resolv.conf /tmp/resolv.conf
		rm -f /var/etc/resolv.conf
		WAN_DNS=$(nvram get wan_dns)
		WAN_DOMAIN=$(nvram get wan_domain)
		# No DNS: Use well known DNS servers
		test -z "$WAN_DNS" && WAN_DNS="88.198.178.18;141.54.1.1;212.204.49.83;208.67.220.220;208.67.222.222"

		if [ "0" != "$(nvram get ff_dnsmasq)" ];then
			echo "Starting dnsmasq..."
			export NVRAM_wan_ifname
			export NVRAM_lan_ifname
			export NVRAM_lan_ifnames
			eval $(/usr/bin/netparam)
			write_config
			echo "search olsr">/var/etc/resolv.conf
			echo "nameserver 127.0.0.1">>/var/etc/resolv.conf

			/usr/sbin/dnsmasq
		else
			echo "Configure resolv..."
			:>/var/etc/resolv.conf
			IFS=\;
			for i in $WAN_DNS;do
				echo "nameserver $i">>/var/etc/resolv.conf
			done
			unset IFS
		fi
		test -n "$WAN_DOMAIN" && echo "search $WAN_DOMAIN">>/var/etc/resolv.conf
	;;
	stop)
		echo "Stopping dnsmasq..."
		killall dnsmasq
	;;
	restart)
		$0 stop
		$0 start
	;;
	*)
		echo "Usage: $0 start|stop|restart"
	;;
esac

5. ändern der Zeit-Abfrage /etc/init.d/S92rdate (S = starten | Zahl = Startreihenfolge)

#!/bin/sh
# Zeit und Datum Abgleich mit Zeitservern

ntp_pool="192.53.103.108 192.53.103.104 128.138.140.44 171.64.7.77 171.64.7.99 81.169.154.44"

test -n "$FAILSAFE" && exit
if [ ! -f ${0%/*}/*ntp* ]; then
	i=0
	while [ "$i" -le 6 ]; do
#		if [ -n "$(for t in main olsr 68; do ip route list exact 0/0 table $t; done)" ]; then
			sh -c "
				pool='$ntp_pool'
				i=0
				
				while [ \$i -lt 4 ]; do
					let i=\$i+1
					for n in \$pool; do
						rdate -s \$n 2>/dev/null 1>/dev/null && exit
						sleep 5
					done
				done
			"&			
			return
#		else 
#			let i=$i+1
#			sleep 30
#		fi
	done
fi