diff options
Diffstat (limited to 'minikrebs/profiles/rickroller/customfiles/etc/config')
6 files changed, 206 insertions, 0 deletions
diff --git a/minikrebs/profiles/rickroller/customfiles/etc/config/dhcp b/minikrebs/profiles/rickroller/customfiles/etc/config/dhcp new file mode 100644 index 00000000..b058f08f --- /dev/null +++ b/minikrebs/profiles/rickroller/customfiles/etc/config/dhcp @@ -0,0 +1,25 @@ +config dnsmasq + option domainneeded 1 + option boguspriv 1 + option filterwin2k 0 # enable for dial on demand + option localise_queries 1 + option rebind_protection 1 # disable if upstream must serve RFC191 +8 addresses + option rebind_localhost 1 # enable for RBL checking and similar se +rvices + #list rebind_domain example.lan # whitelist RFC1918 responses for +domains + option local '/lan/' + option domain 'lan' + option expandhosts 1 + option nonegcache 0 + option authoritative 1 + option readethers 1 + option leasefile '/tmp/dhcp.leases' + option resolvfile '/tmp/resolv.conf.auto' + +config dhcp wlan + option interface lan + option start 100 + option limit 150 + option leasetime 12h diff --git a/minikrebs/profiles/rickroller/customfiles/etc/config/firewall b/minikrebs/profiles/rickroller/customfiles/etc/config/firewall new file mode 100644 index 00000000..6e95b5cd --- /dev/null +++ b/minikrebs/profiles/rickroller/customfiles/etc/config/firewall @@ -0,0 +1,110 @@ +config defaults + option syn_flood 1 + option input ACCEPT + option output ACCEPT + option forward REJECT + +config zone + option name lan + option network 'lan' + option input ACCEPT + option output ACCEPT + option forward REJECT + +config zone + option name wan + option network 'wan' + option input ACCEPT + option output ACCEPT + option forward REJECT + option masq 1 + option mtu_fix 1 + +config forwarding + option src lan + option dest wan + +# We need to accept udp packets on port 68, +# see https://dev.openwrt.org/ticket/4108 +config rule + option name Allow-DHCP-Renew + option src wan + option proto udp + option dest_port 68 + option target ACCEPT + option family ipv4 + +# Allow IPv4 ping +config rule + option name Allow-Ping + option src wan + option proto icmp + option icmp_type echo-request + option family ipv4 + option target ACCEPT + +# Allow DHCPv6 replies +# see https://dev.openwrt.org/ticket/10381 +config rule + option name Allow-DHCPv6 + option src wan + option proto udp + option src_ip fe80::/10 + option src_port 547 + option dest_ip fe80::/10 + option dest_port 546 + option family ipv6 + option target ACCEPT + +# Allow essential incoming IPv6 ICMP traffic +config rule + option name Allow-ICMPv6-Input + option src wan + option proto icmp + list icmp_type echo-request + list icmp_type echo-reply + list icmp_type destination-unreachable + list icmp_type packet-too-big + list icmp_type time-exceeded + list icmp_type bad-header + list icmp_type unknown-header-type + list icmp_type router-solicitation + list icmp_type neighbour-solicitation + list icmp_type router-advertisement + list icmp_type neighbour-advertisement + option limit 1000/sec + option family ipv6 + option target ACCEPT + +# Allow essential forwarded IPv6 ICMP traffic +config rule + option name Allow-ICMPv6-Forward + option src wan + option dest * + option proto icmp + list icmp_type echo-request + list icmp_type echo-reply + list icmp_type destination-unreachable + list icmp_type packet-too-big + list icmp_type time-exceeded + list icmp_type bad-header + list icmp_type unknown-header-type + option limit 1000/sec + option family ipv6 + option target ACCEPT + +# does not seem to work for some reason: +#config redirect +# option src lan +# option proto tcp +# option src_dport 80 +# option dest_port 80 + +config redirect + option src lan + option proto tcp + option src_dport 80 + option src_ip !192.168.23.1 + option dest_port 80 + option dest_ip 192.168.23.1 + option target DNAT diff --git a/minikrebs/profiles/rickroller/customfiles/etc/config/network b/minikrebs/profiles/rickroller/customfiles/etc/config/network new file mode 100644 index 00000000..7ac322a7 --- /dev/null +++ b/minikrebs/profiles/rickroller/customfiles/etc/config/network @@ -0,0 +1,15 @@ +config interface 'loopback' + option ifname 'lo' + option proto 'static' + option ipaddr '127.0.0.1' + option netmask '255.0.0.0' + +config interface 'wan' + option ifname 'eth0' + option proto 'dhcp' + +config interface 'lan' + option ifname 'wlan0' + option proto 'static' + option ipaddr 192.168.23.1 + option netmask 255.255.255.0 diff --git a/minikrebs/profiles/rickroller/customfiles/etc/config/system b/minikrebs/profiles/rickroller/customfiles/etc/config/system new file mode 100644 index 00000000..55aeb7aa --- /dev/null +++ b/minikrebs/profiles/rickroller/customfiles/etc/config/system @@ -0,0 +1,11 @@ +config system + option hostname rickroller + option timezone UTC + +config 'led' 'lan_led' + option 'name' 'LAN' + option 'sysfs' 'tp-link:blue:system' + option 'trigger' 'netdev' + option 'dev' 'eth0' + option 'mode' 'link tx rx' + diff --git a/minikrebs/profiles/rickroller/customfiles/etc/config/uhttpd b/minikrebs/profiles/rickroller/customfiles/etc/config/uhttpd new file mode 100644 index 00000000..0767269b --- /dev/null +++ b/minikrebs/profiles/rickroller/customfiles/etc/config/uhttpd @@ -0,0 +1,26 @@ +config uhttpd main + list listen_http 0.0.0.0:80 + list listen_https 0.0.0.0:443 + option home /www + option rfc1918_filter 1 + option max_requests 3 + option cert /etc/uhttpd.crt + option key /etc/uhttpd.key + option cgi_prefix /cgi-bin + option script_timeout 60 + option network_timeout 30 + option tcp_keepalive 1 + option error_page /index.html + +# Certificate defaults for px5g key generator +config cert px5g + + option days 730 + + option bits 1024 + + option country DE + option state shackspace + option location shackspace + + option commonname krebs-rickroller diff --git a/minikrebs/profiles/rickroller/customfiles/etc/config/wireless b/minikrebs/profiles/rickroller/customfiles/etc/config/wireless new file mode 100644 index 00000000..bce01a9e --- /dev/null +++ b/minikrebs/profiles/rickroller/customfiles/etc/config/wireless @@ -0,0 +1,19 @@ +config wifi-device radio0 + option type mac80211 + option channel 11 + option macaddr 14:e6:e4:e6:e4:e0 + option hwmode 11ng + option htmode HT20 + list ht_capab SHORT-GI-20 + list ht_capab SHORT-GI-40 + list ht_capab RX-STBC1 + list ht_capab DSSS_CCK-40 + # REMOVE THIS LINE TO ENABLE WIFI: + option disabled 0 + +config wifi-iface + option device radio0 + option network lan + option mode ap + option ssid default + option encryption none |