Changes between Version 61 and Version 62 of WikiStart

Timestamp:

May 17, 2013, 2:41:37 PM (12 years ago)

Author:

walter

Comment:

2 server volgens handleiding nagebouwd en klopt nu, 1 AP's nagebouwd volgens handleiding en zou nu ook moeten kloppen?

WikiStart

@@ -148 +148 @@
 
 touch customize/sbin/wifi-update
+touch customize/sbin/openvpn-update
 touch customize/usr/sbin/iopenvpn
 
@@ -179 +180 @@
 config dhcp lan #! I doubt this one is even used... <---
         option interface        lan
-        option start    100
-        option limit    150
-        option leasetime        12h
+        option ignore   1
+#!      option start    100
+#!      option limit    150
+#!      option leasetime        12h
 
 config dhcp wan
@@ -357 +359 @@
         option ifname   wlan0
         option type     bridge
+#       option proto    dhcp #!TODO by this the AP's also get a real dhcp lease from the server, mac prefix range?
+        
 
 #!Add this interface if you internally NAT/Route the 2nd multiSSID instead of bridge <---
@@ -372 +376 @@
         option  hostname  eduroam-bullet #!Unique name differ! <---
         option  timezone  CET-1CEST,M3.5.0,M10.5.0/3 #!correct timezone Amsterdam Netherlands <---
-        option  log_ip    192.168.4.100 #! destination of syslog-ng server <---
+        option  log_ip    192.168.4.1 #! destination of syslog-ng server <---
         option  log_port  514        
 
@@ -529 +533 @@
 }}}
 
+#example code# /sbin/openvpn-update
+{{{
+#!/bin/sh
+
+MAC=$(/sbin/wifi detect | /usr/bin/awk '/macaddr/ { print $3 }')
+
+/bin/sed -i "s/MACADDRESS/$MAC/g" /etc/openvpn/client.conf
+}}}
+
 #example code# /usr/sbin/iopenvpn
 {{{
@@ -547 +560 @@
 }}}
 
+#example code# /etc/openvpn/up.sh
+{{{
+#!/bin/sh
+#tap interface in openvpn/kernel generates unique new MAC address!!!
+#TODO don't understand how ip of AP for the tunnel is created/assigned?
+#Multiple AP devices work, but may conflict with dhcplease range of wireless clients?
+#remove ${IP} and add proto dhcp to lan /etc/config/network
+
+FROM=3
+TO=4
+
+brctl addif br-lan $1
+IP=$(echo $4 | sed "s/\.$FROM\./\.$TO\./g" )
+ifconfig br-lan ${IP} up
+echo "Using: $IP"
+}}}
+
 Setup openvpn key/certificates/config for the AP, skip to section 3.2 of this howto when you don't have a *.tar file with keys&config for your individual unique AP, comeback if you have a *.tar and continue.
 
@@ -558 +588 @@
 {{{
 chmod +x customize/usr/sbin/iopenvpn
-
 chmod +x customize/sbin/wifi-update
-
 chmod +x customize/etc/init.d/sysntpd
-
 chmod +x customize/etc/init.d/openvpn
-
 chmod +x customize/etc/openvpn/up.sh
-
 chmod +x customize/etc/rc.local
-
 chmod +x customize/etc/firewall.user
-
 chmod +x customize/etc/inittab
 }}}
@@ -582 +605 @@
 ssh root@192.168.1.20
 
-## enable openvpn
-chmod +x /usr/sbin/iopenvpn
-chmod +x /etc/openvpn/up.sh
+## enable / activate at boottime openvpn
 /etc/init.d/openvpn enable
 
 ## activate wifi to add MACadress to /etc/config/wireless file
-/sbin/wifi stop
+#/sbin/wifi stop
 #/sbin/wifi start
 #/bin/sleep 5
 /sbin/wifi detect
 /bin/sleep 10
-chmod +x /sbin/wifi-update
 /sbin/wifi-update
 #/bin/sleep 5
-# check / correct following in chmod+x /etc /sbin /usr/sbin
 reboot;exit
 
 ## done
 #check your working "eduroam" accesspoint!
-##TODO check all execute writes on uploaded scripts!
 }}}
 
@@ -845 +863 @@
 default-lease-time 600;
 max-lease-time 7200;
+#subnet 192.168.4.0 netmask 255.255.255.0 {
+#       range 192.168.4.100 192.168.4.150;
+#       option routers 192.168.4.1;
+
+#ap's different lease
+class "ubntaps" {
+        match if (substring (hardware, 1, 3) = DC:9F:DB);
+}
+
+class "eduroamusers" {
+        match if not (substring (hardware, 1, 3) = DC:9F:DB);
+}
+
 subnet 192.168.4.0 netmask 255.255.255.0 {
-        range 192.168.4.100 192.168.4.150;
         option routers 192.168.4.1;
+
+pool {
+        allow members of "ubntaps";
+        range 192.168.4.3 192.168.4.66;
+}
+
+pool {
+        allow members of "eduroamusers";
+        range 192.168.4.150 192.168.4.250;
+}
+
+}
+
+
 }
 }}}
@@ -909 +953 @@
 }}}
 
-To allow nat/routing and function as a local gateway/concentrator for the tunneld traffic from eduroam accesspoints (openvpn clients) the following config must be set once.
-{{{
-## Allows forwarding
-cat /proc/sys/net/ipv4/ip_forward #shows current off state
+To allow nat/routing and function as a local gateway/concentrator for the tunneld traffic from eduroam accesspoints (openvpn clients) the following config must be set every boot.
+{{{
+## add the following firewall masquerade code "quick and dirty" at the end of the rc.local file before exit0!
+nano /etc/rc.local
+}}}
+
+#example code# /etc/rc.local
+{{{
+
+#enable forwarding at ip level
 echo "1" > /proc/sys/net/ipv4/ip_forward
-cat /proc/sys/net/ipv4/ip_forward #shows current on state ?
-
-## add the following firewall masquerade code "quick and dirty" at the end of the file before exit0!
-nano /etc/rc.local
-}}}
-
-#example code# /etc/rc.local
-{{{
-#!/bin/sh
+
+#enable nat/routing from eth0
 /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
-#/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
-#/sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
+
+#enable nat/routing to eth0 directly
+/sbin/iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
+/sbin/iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
+
+#enable nat/routing to tap0 openvpn
 /sbin/iptables -A FORWARD -i eth0 -o tap0 -m state --state RELATED,ESTABLISHED -j ACCEPT
 /sbin/iptables -A FORWARD -i tap0 -o eth0 -j ACCEPT
+
+#before exit 0
 }}}
 
@@ -1058 +1107 @@
 script-security 2
 keepalive 10 180 #! these settings keep the tunnel alive on the W.L. network <---
+#! run /bin/openvpnupdate update before uncommenting lladdress
+#! lladdress MACADDRESS #! overides random MAC adress of the br-lan interface for controlled dhcp lease! <---
+
 }}}
 
@@ -1309 +1361 @@
         default AIROS reboot into tftp mode parameter 5.5.4 mtd cat /proc/mtd
 
+DHCP range for openwrt AP's fixen classes mac prefix?
+        DHCPD.conf hoeft alleen nog een aanpassing voor andere lease time per klasse!
+        op ieder ap, moet het openvpn fake mac address op dezelfde manier als het wifi-update script vervangen worden
+        anders weet de dhcp server niet het juiste mac prefix te herkennen om de ap's in een andere interface te doen.
+        ook een vraag is of die interface uberhaubt wel een ip hoeft te hebben?
+
 TODO Verzin leuke manier om dit in een batch workflow voor veel AP's clients in te passen... denken we vanuit dit concept met tar bestand of moeten we iets maken dat meteen meedere parameters zoals multiSSID ip-adres hostname wifichannel etc meeneemt op basis van MAC adres? Nog uitzoeken welk deel er naar de server moet 4 bestanden ca dh1024 server.crt/key?
 
@@ -1315 +1373 @@
 testen broadcast AP's onderling onmogelijk?
 Filteren / dhcp bdup/stp requests
-DHCP range for ubnt AP's fixen 
+
 
 Veiligheid aspect, VLAN/ radius authenticatie over zelfde tunnels als de clients... isolation tussen openvpn clients de AP's zelf is actief maar isolate van de wireless users op de client nog teste?