2012-02-08 18:10:09 +01:00
= Ratbert Setup =
Nach der erfolgreichen Wiederbelebung von Ratbert konnte der Ersatzrouter Wormbert wieder im Schrank verschwinden. Was dazu alles nötig war sei im Folgenden hier dokumentiert.
== Debricking ==
Von Lateinich debricere - der Verziegelsteinigung entziehen.... oder so..
Da der Bootloader noch vollkommen intakt war, gab es bei der Wiederherstellung von einer lauffähigen OpenWRT Firmware keine größeren Hindernisse zu überwinden.
Mithilfe eines eingelöteten Pinheaders lässt sich die serielle Schnittstelle von Ratbert nun leicht mit einer USB UART bridge benutzen.
Die dazu nötigen Schritte sind unter :http://wiki.openwrt.org/toh/tp-link/tl-wr1043nd und besonders in dem Log unter :http://wiki.openwrt.org/toh/tp-link/tl-wr1043nd/flashlog zu finden.
== Pakete ==
2012-02-08 18:20:03 +01:00
Durch geschickte Benutzung des Paketmanagers opkg hat Astro folgende Pakete zur Menge der Installierten gemacht:
2012-02-08 18:10:09 +01:00
<pre>
aiccu avahi-daemon base-files base-files-network busybox crda dbus dnsmasq
dropbear firewall hotplug2 ip iptables iptables-mod-conntrack iptables-mod-nat
iw kernel kmod-ath kmod-ath9k kmod-ath9k-common kmod-button-hotplug kmod-cfg80211
kmod-crypto-aes kmod-crypto-arc4 kmod-crypto-core kmod-input-core kmod-input-gpio-keys-polled
kmod-input-polldev kmod-ipt-conntrack kmod-ipt-core kmod-ipt-nat kmod-ipt-nathelper
kmod-iptunnel4 kmod-ipv6 kmod-leds-gpio kmod-ledtrig-usbdev kmod-lib-crc-ccitt kmod-mac80211
kmod-nls-base kmod-ppp kmod-pppoe kmod-sit kmod-tun kmod-usb-core kmod-usb-ohci kmod-usb2
libavahi libc libcap libdaemon libdbus libexpat libgcc libgdbm libip4tc libncurses
libnl-tiny libpcap libpthread libreadline librt libuci libxtables mtd ntpd opkg ppp
ppp-mod-pppoe quagga quagga-bgpd quagga-libospf quagga-libzebra quagga-ospfd
quagga-vtysh swconfig tcpdump terminfo uboot-envtools uci wireless-tools wpad-mini
</pre>
2012-02-08 18:20:03 +01:00
-> fileliste mit versionen: [[{{ns:media}}:Inst_pkgs.txt.gzfake.jpg]]
2012-02-08 18:10:09 +01:00
== Einstellungen einzelner Services ==
Hier nun die wichtigstsen Konfigurationsanpassungen für einzelne Services:
2012-02-08 18:27:25 +01:00
=== Basissystemeinstellungen ===
In /etc/config/system ist lediglich der hostname anzupassen:
<pre>
root@ratbert:/etc/config# cat system
config 'system'
option 'hostname' 'ratbert'
option 'timezone' 'UTC'
config 'timeserver' 'ntp'
list 'server' '0.openwrt.pool.ntp.org'
list 'server' '1.openwrt.pool.ntp.org'
list 'server' '2.openwrt.pool.ntp.org'
list 'server' '3.openwrt.pool.ntp.org'
config 'led' 'led_usb'
option 'name' 'USB'
option 'sysfs' 'tp-link:green:usb'
option 'trigger' 'usbdev'
option 'dev' '1-1'
option 'interval' '50'
config 'led' 'led_wlan'
option 'name' 'WLAN'
option 'sysfs' 'tp-link:green:wlan'
option 'trigger' 'phy0tpt'
</pre>
2012-02-08 18:10:09 +01:00
=== Netzconfig ===
In /etc/config/network findet sich die Basiskonfiguration für Netzwerk unter OpenWRT:
<pre>
root@ratbert:/etc/config# cat network
</pre> ---->
<pre>
config 'interface' 'loopback'
option 'ifname' 'lo'
option 'proto' 'static'
option 'ipaddr' '127.0.0.1'
option 'netmask' '255.0.0.0'
config 'interface' 'lan'
option 'ifname' 'eth0.1'
#option 'type' 'bridge'
option 'proto' 'static'
option ipaddr 172.22.99.4
option 'netmask' '255.255.255.0'
option netmask 255.255.255.0
config 'interface' 'wan'
option 'ifname' 'eth0.2'
option 'proto' 'pppoe'
option username "HIERUNSEREGEHEIMENUMMER@t-online.de"
option password "GEHEIMESPASSWORT"
option peerdns 0
option ipv6 1
config 'switch'
option 'name' 'rtl8366rb'
option 'reset' '1'
option 'enable_vlan' '1'
config 'switch_vlan'
option 'device' 'rtl8366rb'
option 'vlan' '1'
option 'ports' '1 2 3 4 5t'
config 'switch_vlan'
option 'device' 'rtl8366rb'
option 'vlan' '2'
option 'ports' '0 5t'
config interface wifi
option proto static
option ipaddr 172.22.101.1
</pre>
2012-02-08 18:20:03 +01:00
2012-02-08 18:22:31 +01:00
=== Wireless Network ===
/etc/config/wireless :
<pre>
config wifi-device radio0
option type mac80211
option channel 6
option macaddr f4:ec:38:ba:1d:ac
option hwmode 11ng
option htmode HT20
list ht_capab SHORT-GI-40
list ht_capab DSSS_CCK-40
config wifi-iface
option device radio0
option network wifi
option mode ap
option ssid C3D2.n
option encryption none
</pre>
2012-02-08 18:47:30 +01:00
=== Firewall ===
/etc/config/firewall :
<pre>
root@ratbert:/etc/config# cat firewall
config defaults
option syn_flood 1
option input ACCEPT
option output ACCEPT
option forward REJECT
# Uncomment this line to disable ipv6 rules
# option disable_ipv6 1
config zone
option name lan
option network 'lan'
option input ACCEPT
option output ACCEPT
option forward REJECT
config zone
option name wan
option network 'wan'
option input REJECT
option output ACCEPT
option forward REJECT
option masq 1
option mtu_fix 1
config forwarding
option src lan
option dest wan
# We need to accept udp packets on port 68,
# see https://dev.openwrt.org/ticket/4108
config rule
option name Allow-DHCP-Renew
option src wan
option proto udp
option dest_port 68
option target ACCEPT
option family ipv4
# Allow IPv4 ping
config rule
option name Allow-Ping
option src wan
option proto icmp
option icmp_type echo-request
option family ipv4
option target ACCEPT
# Allow DHCPv6 replies
# see https://dev.openwrt.org/ticket/10381
config rule
option name Allow-DHCPv6
option src wan
option proto udp
option src_ip fe80::/10
option src_port 547
option dest_ip fe80::/10
option dest_port 546
option family ipv6
option target ACCEPT
# Allow essential incoming IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Input
option src wan
option proto icmp
list icmp_type echo-request
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
list icmp_type router-solicitation
list icmp_type neighbour-solicitation
option limit 1000/sec
option family ipv6
option target ACCEPT
# Allow essential forwarded IPv6 ICMP traffic
config rule
option name Allow-ICMPv6-Forward
option src wan
option dest *
option proto icmp
list icmp_type echo-request
list icmp_type destination-unreachable
list icmp_type packet-too-big
list icmp_type time-exceeded
list icmp_type bad-header
list icmp_type unknown-header-type
option limit 1000/sec
option family ipv6
option target ACCEPT
# include a file with users custom iptables rules
config include
option path /etc/firewall.user
</pre>
2012-02-08 18:27:25 +01:00
=== DNSmasq ===
Der combinierte DNS und DHCP Server dnsmasq ist in /etc/config/dhcp so eingestellt:
2012-02-08 18:22:31 +01:00
2012-02-08 18:27:25 +01:00
<pre>
root@ratbert:/etc/config# cat dhcp
config dnsmasq
option domainneeded 1
option boguspriv 1
option filterwin2k 0 # enable for dial on demand
option localise_queries 1
option rebind_protection 1 # disable if upstream must serve RFC1918 addresses
option rebind_localhost 1 # enable for RBL checking and similar services
#list rebind_domain example.lan # whitelist RFC1918 responses for domains
option local '/lan/'
option domain 'lan'
option expandhosts 1
option nonegcache 0
option authoritative 1
option readethers 1
option leasefile '/tmp/dhcp.leases'
option resolvfile '/tmp/resolv.conf.auto'
#list server '/mycompany.local/1.2.3.4'
#option nonwildcard 1
#list interface br-lan
#list notinterface lo
#list bogusnxdomain '64.94.110.11'
config dhcp wifi
option interface wifi
option start 100
option limit 150
option leasetime 12h
config dhcp lan
option interface lan
option ignore 1
config dhcp wan
option interface wan
option ignore 1
</pre>
2012-02-08 18:22:31 +01:00
2012-02-08 18:20:03 +01:00
=== aiccu ===
Der Sixxs Tunnel ist in /etc/config/aiccu configuriert:
<pre>
root@ratbert:/etc/config# cat aiccu
config aiccu
option username '****************'
option password '****************'
option protocol ''
option server 'tic.sixxs.net'
option interface ''
option tunnel_id ''
option requiretls ''
option defaultroute '1'
option nat '0'
option heartbeat '1'
</pre>
