OpenWRT
安装与配置
Ref: https://github.com/aporetic/aporetic.github.io/blob/main/raspberry-pi-router/router.md
Notes
安装
上网
irqbalance
编辑 /etc/config/irqbalance
config irqbalance 'irqbalance'
option enabled '1' # 将 0 修改为 1 以启用
...
软件包
由于安装配置繁琐、与IPv6和AdGuardHome存在不同程度冲突、使用不灵活、资源占用高等原因，我已在OpenWRT上弃用它，这里不再记录配置过程
AdGuard Home
Ref: https://openwrt.org/docs/guide-user/services/dns/adguard-home
opkg update
opkg install adguardhome
service adguardhome enable
service adguardhome start
# Get the first IPv4 and IPv6 Address of router and store them in following variables for use during the script.
NET_ADDR=$(/sbin/ip -o -4 addr list br-lan | awk 'NR==1{ split($4, ip_addr, "/"); print ip_addr[1] }')
NET_ADDR6=$(/sbin/ip -o -6 addr list br-lan scope global | awk 'NR==1{ split($4, ip_addr, "/"); print ip_addr[1] }')
echo "Router IPv4 : ""${NET_ADDR}"
echo "Router IPv6 : ""${NET_ADDR6}"
# 1. Enable dnsmasq to do PTR requests.
# 2. Reduce dnsmasq cache size as it will only provide PTR/rDNS info.
# 3. Disable rebind protection. Filtered DNS service responses from blocked domains are 0.0.0.0 which causes dnsmasq to fill the system log with possible DNS-rebind attack detected messages.
# 4. Move dnsmasq to port 54.
# 5. Set Ipv4 DNS advertised by option 6 DHCP
# 6. Set Ipv6 DNS advertised by DHCP
uci set dhcp.@dnsmasq[0].noresolv="0"
uci set dhcp.@dnsmasq[0].cachesize="1000"
uci set dhcp.@dnsmasq[0].rebind_protection='0'
uci set dhcp.@dnsmasq[0].port="54"
uci -q delete dhcp.@dnsmasq[0].server
uci add_list dhcp.@dnsmasq[0].server="${NET_ADDR}"
#Delete existing config ready to install new options.
uci -q delete dhcp.lan.dhcp_option
uci -q delete dhcp.lan.dns
# DHCP option 6: which DNS (Domain Name Server) to include in the IP configuration for name resolution
uci add_list dhcp.lan.dhcp_option='6,'"${NET_ADDR}"
#DHCP option 3: default router or last resort gateway for this interface
uci add_list dhcp.lan.dhcp_option='3,'"${NET_ADDR}"
#Set IPv6 Announced DNS
for OUTPUT in $(ip -o -6 addr list br-lan scope global | awk '{ split($4, ip_addr, "/"); print ip_addr[1] }')
do
echo "Adding $OUTPUT to IPV6 DNS"
uci add_list dhcp.lan.dns=$OUTPUT
done
uci commit dhcp
/etc/init.d/dnsmasq restart
Setup AGH through the web interface:
On first time setup the default web interface port is TCP 3000.
Go to http://192.168.1.1:3000/ (If your router IP is not 192.168.1.1, change this accordingly)
Setup the Admin Web Interface to listen on 192.168.1.1 at port 8080. (Changing the web interface port is optional)
Set DNS server to listen on 192.168.1.1 at port 53.
Note: DNS 服务器监听配置
亲测需要配置为 any:53，不知为何配置为 192.168.1.1 (路由器局域网IP) 会导致路由器本机无法上网
这样配置不是很安全，最好增加防火墙配置以防止DNS服务器从WAN被访问
LuCI –> 网络 –> 防火墙 –> 添加，Deny-DNS-for-WAN, TCP UDP, 源区域 WAN, 目标区域 任意区域(转发), 目标端口 53, Action Drop
展开 iptables命令
```
# 允许本地网络访问DNS服务器
iptables -A INPUT -i lan_interface -p udp --dport 53 -j ACCEPT
iptables -A INPUT -i lan_interface -p tcp --dport 53 -j ACCEPT
# 拒绝外部网络访问DNS服务器
iptables -A INPUT -i wan_interface -p udp --dport 53 -j DROP
iptables -A INPUT -i wan_interface -p tcp --dport 53 -j DROP
```
Create an user and choose a strong password.
Login AGH:
http://192.168.1.1:8080/ (or whatever listening port you set)
Feel free to change upstream DNS servers to whatever you like (Adguard Home supports DoH, DoT and DoQ out of the box), add the blacklists of your preference and enjoy ad-free browsing on all of your devices.
配置
安装 Docker
Preparation: 扩容 rootfs
Ref: https://nowboy4.gitee.io/2021/01/07/openwrt3/
Ref: https://openwrt.org/docs/guide-user/virtualization/docker_host
opkg update
opkg install dockerd
opkg install docker luci-app-dockerman luci-i18n-dockerman-zh-cn
verify if all packages were installed
root@OpenWrt:~# opkg list-installed | grep docker
docker - 20.10.22-1
dockerd - 20.10.22-1
luci-app-dockerman - v0.5.13-20230114
luci-i18n-dockerman-zh-cn - git-23.222.62173-d7922c4
luci-lib-docker - git-21.166.52164-fe795d5
r
reboot
重启之后如果出现
- LuCI –> Docker 菜单 只有 配置 一项
- 执行
docker version 等命令出现 unix:///var/run/docker.sock. Is the docker daemon running? 报错
是由于 dockerd 没有启动
（绝大多数情况下这步没用）先尝试在 LuCI –> 系统 –> 启动项 –> dockerd –> 启用、启动
如果不行，重装: https://forum.openwrt.org/t/getting-docker-to-work-first-try/132252/12
# 全部数据及配置文件将会被删除!
opkg remove docker luci-app-dockerman docker-compose dockerd --autoremove --force-remove
opkg install docker luci-app-dockerman docker-compose dockerd --force-maintainer
备用解决方案: https://blog.csdn.net/u010857736/article/details/124128444
配置 Docker
Docker 容器默认 bridge 模式无法访问外部网络
Ref: #1760#issuecomment-542985373 and #1760#issuecomment-1193027470
更新： 1：vim /etc/sysctl.conf，添加下列内容：
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-arptables = 1
2：Luci>网络>防火墙>转发：接受 3：Luci>状态>防火墙>重启防火墙 4：ssh执行service dockerd restart 故障排除。
改成
net.bridge.bridge-nf-call-ip6tables = 1
net.bridge.bridge-nf-call-iptables = 1
net.bridge.bridge-nf-call-arptables = 1
之后会引入新的问题，就是nat回环失效。简单说就是设备在内网（该路由器下面）无法通过路由器公网IP+端口（比如DDNS）访问内网映射出去的另一个设备，比如监控摄像机.
20220723 更新
实测，
net.bridge.bridge-nf-call-arptables = 0
net.bridge.bridge-nf-call-ip6tables = 0
net.bridge.bridge-nf-call-iptables = 0
的情况下，只要开启Luci>网络>防火墙>转发：接受 即可使bridge模式的容器联网
Docker Hub 镜像
OpenWRT –> Docker –> 配置 –> 注册表镜像
Ref: https://gist.github.com/y0ngb1n/7e8f16af3242c7815e7ca2f0833d3ea6
- https://docker.m.daocloud.io
- https://dockerproxy.com
- https://docker.nju.edu.cn
- https://docker.mirrors.sjtug.sjtu.edu.cn
安装 USB 硬盘相关软件包
opkg update
# USB挂载
opkg install block-mount blockd
# USB驱动支持
opkg install kmod-usb2 kmod-usb3
# 文件系统支持
opkg install kmod-fs-ext4 kmod-fs-msdos kmod-fs-nfs kmod-fs-ntfs kmod-usb-storage-uas
# 其他
opkg install fdisk cfdisk hd-idle hdparm smartmontools
# ntfs-3g
opkg install ntfs-3g
挂载 NTFS 硬盘
方法1
Tips for NTFS: https://openwrt.org/docs/guide-user/storage/writable_ntfs
Mount a partition to an existing directory. You can create one with mkdir, for example mkdir -p /mnt/sda1.
To mount a partition to above directory:
ntfs-3g /dev/sda1 /mnt/sda1 -o rw,big_writes
To auto mount a partition at startup (with drive plugged in) edit /etc/rc.local:
sleep 1
ntfs-3g /dev/sda1 /mnt/sda1 -o rw,lazytime,noatime,big_writes
exit 0
To unmount:
umount /dev/sda1
To be able to mount it automatically:
ln -s /usr/bin/ntfs-3g /sbin/mount.ntfs
For details about mounting options used above see man page.
方法2 (无效, 仅做归档)
LuCI –> 系统 –> 挂载点 –> 挂载点 –> 选择你的硬盘 –> 编辑
Tip: 更改将被写入 /etc/config/fstab
保存并应用，短接GPIO3与GND重启 (Ref: https://www.huoyijie.cn/article/cbe654a050e711ecadb78975e8b95c91/)
Samba 文件共享
参见 ## dperson/samba in #My Workstation/Windows/Docker.md
docker run --name samba --restart=always -it -p 139:139 -p 445:445 \
-e TZ=Asia/Shanghai -m 512m \
-v /mnt:/mount \
-d dperson/samba -p \
-u "admin;password" \
-s "sda1;/mount/sda1/;no;no;no;admin"
（安全警告！）配置防火墙，允许来自WAN的请求
LuCI –> 网络 –> 防火墙 –> 添加，Allow-Samba, TCP UDP, 源区域 WAN, 目标区域 任意区域(转发), 目标端口 137 138 139 445, Action Drop
smartd 硬盘检测与告警
opkg update && opkg install smartd smartd-mail
查看 源代码中的Makefile 可了解到其配置等文件的所在位置
程序拥有启动项 smartd，可用 service smartd 或 /etc/init.d/smartd 命令管理
Ref: https://linux.die.net/man/5/smartd.conf
编辑 /etc/smartd.conf，删除掉原有内容，
/dev/sda -a -m xxx@139.com,xxx@qq.com -M test
查看 /etc/smartd_warning.sh，可知其会调用可执行文件 mailx。继续查找smartd-mail的依赖项得知软件包名称为nail，继续查看其 源代码中的Makefile 可得知其配置文件位于 /etc/nail.rc
编辑 /etc/nail.rc，参考此文完成配置
set smtp-auth=login
set smtp-use-starttls
set smtp='smtp://smtp.qq.com:587'
set smtp-auth-user='xxx@foxmail.com'
set smtp-auth-password='xxxxxx'
set from='smartd daemon <xxx@foxmail.com>'
配置完毕后，参考上文发送测试邮件
完成配置，运行 smartd -d (-d 代表 debug)，观察调试输出
root@OpenWrt:~# smartd -d
smartd 7.2 2020-12-30 r5155 [aarch64-linux-5.10.176] (localbuild)
Copyright (C) 2002-20, Bruce Allen, Christian Franke, www.smartmontools.org
Opened configuration file /etc/smartd.conf
Configuration file /etc/smartd.conf parsed.
Device: /dev/sda, unable to autodetect device type
Unable to register device /dev/sda (no Directive -d removable). Exiting.
读取 smart 时出现了问题，运行smartctl --all /dev/sda，查看错误信息
root@OpenWrt:~# smartctl --all /dev/sda
smartctl 7.2 2020-12-30 r5155 [aarch64-linux-5.10.176] (localbuild)
Copyright (C) 2002-20, Bruce Allen, Christian Franke, www.smartmontools.org
/dev/sda: Unknown USB bridge [0x174c:0x55aa (0x100)]
Please specify device type with the -d option.
Use smartctl -h to get a usage summary
Please specify device type with the -d option.
对着smartctl --help给出的所有设备类型一个个试，哪个又准又全就是最适合你的硬盘盒的
-d TYPE, --device=TYPE
Specify device type to one of:
ata, scsi[+TYPE], nvme[,NSID], sat[,auto][,N][+TYPE], usbcypress[,X], usbjmicron[,p][,x][,N], usbprolific, usbsunplus, sntjmicron[,NSID], sntrealtek, intelliprop,N[+TYPE], jmb39x[-q],N[,sLBA][,force][+TYPE], jms56x,N[,sLBA][,force][+TYPE], marvell, areca,N/E, 3ware,N, hpt,L/M/N, megaraid,N, aacraid,H,L,ID, cciss,N, auto, test
适合我的设备类型是 sat，对应的smartctl命令是 smartctl -d sat --all /dev/sda
参考 smartd.conf(5) 修改/etc/smartd.conf：
/dev/sda -a -d sat -m xxx@139.com,xxx@qq.com -M test
再次运行smartd -d，测试邮件成功发送
root@OpenWrt:~# smartd -d
smartd 7.2 2020-12-30 r5155 [aarch64-linux-5.10.176] (localbuild)
Copyright (C) 2002-20, Bruce Allen, Christian Franke, www.smartmontools.org
Opened configuration file /etc/smartd.conf
Configuration file /etc/smartd.conf parsed.
Device: /dev/sda [SAT], opened
Device: /dev/sda [SAT], ST4000VX000-xxxxxx, S/N:xxxxxxxx, WWN:x-xxxxxx-xxxxxxxxx, FW:HK11, 4.00 TB
Device: /dev/sda [SAT], not found in smartd database.
Device: /dev/sda [SAT], is SMART capable. Adding to "monitor" list.
Monitoring 1 ATA/SATA, 0 SCSI/SAS and 0 NVMe devices
Executing test of <mail> to xxx@139.com xxx@qq.com ...
Test of <mail> to xxx@139.com xxx@qq.com: successful
Device: /dev/sda [SAT], opened ATA device
Device: /dev/sda [SAT], previous self-test completed without error
kill掉它，修改/etc/smartd.conf，把测试邮件的选项-M test删掉，重启smartd，完成配置！
/dev/sda -a -d sat -m xxx@139.com,xxx@qq.com
展开 smartd.conf参数解释
> -a
>
> Equivalent to turning on all of the following Directives: '-H' to check the SMART health status, '-f' to report failures of Usage (rather than Prefail) Attributes, '-t' to track changes in both Prefailure and Usage Attributes, '-l error' to report increases in the number of ATA errors, '-l selftest' to report increases in the number of Self-Test Log errors, '-l selfteststs' to report changes of Self-Test execution status, '-C 197' to report nonzero values of the current pending sector count, and '-U 198' to report nonzero values of the offline pending sector count.
> 相当于打开以下所有指令：“-H”检查 SMART 运行状况，“-f”报告使用失败（而不是故障前）属性，“-t”跟踪故障前和使用属性的更改, '-l error' 报告 ATA 错误数量的增加， '-l selftest' 报告自检日志错误数量的增加， '-l selfteststs' 报告自检执行状态的变化， ' -C 197' 报告当前挂起扇区计数的非零值，'-U 198' 报告脱机挂起扇区计数的非零值。
> -m ADD
>
> Send a warning email to the email address ADD if the '-H', '-l', '-f', '-C', or '-O' Directives detect a failure or a new error, or if a SMART command to the disk fails. This Directive only works in conjunction with these other Directives (or with the equivalent default '-a' Directive).
> 如果“-H”、“-l”、“-f”、“-C”或“-O”指令检测到故障或新错误，或者 SMART 命令，则向电子邮件地址 ADD 发送警告电子邮件到磁盘失败。该指令仅与这些其他指令（或等效的默认“-a”指令）结合使用。
>
> To prevent your email in-box from getting filled up with warning messages, by default only a single warning will be sent for each of the enabled alert types, '-H', '-l', '-f', '-C', or '-O' even if more than one failure or error is detected or if the failure or error persists. [This behavior can be modified; see the '-M' Directive below.]
> 为了防止您的电子邮件收件箱充满警告消息，默认情况下，只会为每个启用的警报类型“-H”、“-l”、“-f”、“-C”发送一条警告'，或'-O'，即使检测到多个故障或错误或者故障或错误仍然存在。 [此行为可以修改；请参阅下面的“-M”指令。]
>
> To send email to more than one user, please use the following "comma separated" form for the address: user1@add1,user2@add2,...,userN@addN (with no spaces).
> 要向多个用户发送电子邮件，请使用以下“逗号分隔”形式作为地址：user1@add1,user2@add2,...,userN@addN（不含空格）。
>
> To test that email is being sent correctly, use the '-M test' Directive described below to send one test email message on smartd startup.
> 要测试电子邮件是否正确发送，请使用下面描述的“-M test”指令在 smartd 启动时发送一封测试电子邮件。
>
> By default, email is sent using the system mail command. In order that smartd find the mail command (normally /bin/mail) an executable named 'mail' must be in the path of the shell or environment from which smartd was started. If you wish to specify an explicit path to the mail executable (for example /usr/local/bin/mail) or a custom script to run, please use the '-M exec' Directive below.
> 默认情况下，使用系统邮件命令发送电子邮件。为了让 smartd 找到 mail 命令（通常是 /bin/mail），名为“mail”的可执行文件必须位于启动 smartd 的 shell 或环境的路径中。如果您希望指定邮件可执行文件的显式路径（例如 /usr/local/bin/mail）或要运行的自定义脚本，请使用下面的“-M exec”指令。
>
> Note also that there is a special argument \<nomailer\> which can be given to the '-m' Directive in conjunction with the '-M exec' Directive. Please see below for an explanation of its effect.
> 另请注意，有一个特殊参数\<nomailer\>，可以将其与“-M exec”指令一起赋予“-m”指令。请参阅下文了解其效果的说明。
>
> If the mailer or the shell running it produces any STDERR/STDOUT output, then a snippet of that output will be copied to SYSLOG. The remainder of the output is discarded. If problems are encountered in sending mail, this should help you to understand and fix them. If you have mail problems, we recommend running smartd in debug mode with the '-d' flag, using the '-M test' Directive described below.
> 如果邮件程序或运行它的 shell 产生任何 STDERR/STDOUT 输出，则该输出的片段将被复制到 SYSLOG。输出的其余部分将被丢弃。如果在发送邮件时遇到问题，这应该可以帮助您理解并解决这些问题。如果您遇到邮件问题，我们建议使用下面描述的“-M test”指令在带有“-d”标志的调试模式下运行 smartd。
hd-idle 硬盘休眠
smartd 定期读取 smart 似乎会唤醒正在休眠的硬盘，hd-idle 理论上应该会与 smartd 发生冲突
程序拥有启动项 hd-idle，可用 service hd-idle 或 /etc/init.d/hd-idle 命令管理
To be continued.
Docker 镜像
参见: #My Documents/#My Workstaions/Windows/Docker.md
Note: 安装Git opkg update && opkg install git git-http
iperf3 吞吐量测试
Ref: https://zhuanlan.zhihu.com/p/314727150
Note: Opkg 以及 MSYS2, Cygwin 都有 iperf3
安全
防火墙配置参考
https://www.bilibili.com/video/av987042614/
安全测试
Ref: https://wiki.wgpsec.org/knowledge/tools/nmap.html
在 OpenWRT 上执行如下命令以获得其公网IP地址
curl 'https://ipv4.ams2.test-ipv6.com/ip/?callback=_jqjsp&testdomain=test-ipv6.com&testname=test_a'
curl 'https://ipv6.ams2.test-ipv6.com/ip/?callback=_jqjsp&testdomain=test-ipv6.com&testname=test_aaaa'
非内网设备（比如手机用移动数据）执行如下命令进行端口扫描
nmap -T4 -A -v -Pn <ipv4>
nmap -6 -T4 -A -v -Pn <ipv6>
~ $ nmap -T4 -A -v -Pn ***.***.***.***
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-28 00:57 CST
NSE: Loaded 156 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 00:57
Completed NSE at 00:57, 0.00s elapsed
Initiating NSE at 00:57
Completed NSE at 00:57, 0.00s elapsed
Initiating NSE at 00:57
Completed NSE at 00:57, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 00:57
Completed Parallel DNS resolution of 1 host. at 00:57, 0.33s elapsed
Initiating Connect Scan at 00:57
Scanning ***.***.***.*** [1000 ports]
Connect Scan Timing: About 30.05% done; ETC: 00:59 (0:01:12 remaining)
Connect Scan Timing: About 60.05% done; ETC: 00:59 (0:00:41 remaining)
Completed Connect Scan at 00:59, 101.18s elapsed (1000 total ports)
Initiating Service scan at 00:59
NSE: Script scanning ***.***.***.***.
Initiating NSE at 00:59
Completed NSE at 00:59, 5.01s elapsed
Initiating NSE at 00:59
Completed NSE at 00:59, 0.01s elapsed
Initiating NSE at 00:59
Completed NSE at 00:59, 0.00s elapsed
Nmap scan report for ***.***.***.***
Host is up.
All 1000 scanned ports on ***.***.***.*** are in ignored states.
Not shown: 1000 filtered tcp ports (no-response)
NSE: Script Post-scanning.
Initiating NSE at 00:59
Completed NSE at 00:59, 0.00s elapsed
Initiating NSE at 00:59
Completed NSE at 00:59, 0.01s elapsed
Initiating NSE at 00:59
Completed NSE at 00:59, 0.01s elapsed
Read data files from: /data/data/com.termux/files/usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 107.20 seconds
~ $ nmap -6 -T4 -A -v -Pn ****:****:****:****:****:****:****:****
Host discovery disabled (-Pn). All addresses will be marked 'up' and scan times may be slower.
Starting Nmap 7.94 ( https://nmap.org ) at 2023-09-28 01:00 CST
NSE: Loaded 156 scripts for scanning.
NSE: Script Pre-scanning.
Initiating NSE at 01:00
Completed NSE at 01:00, 0.00s elapsed
Initiating NSE at 01:00
Completed NSE at 01:00, 0.00s elapsed
Initiating NSE at 01:00
Completed NSE at 01:00, 0.00s elapsed
Initiating Parallel DNS resolution of 1 host. at 01:00
Completed Parallel DNS resolution of 1 host. at 01:00, 0.30s elapsed
Initiating Connect Scan at 01:00
Scanning ****:****:****:****:****:****:****:**** [1000 ports]
Increasing send delay for ****:****:****:****:****:****:****:**** from 0 to 5 due to 95 out of 237 dropped probes since last increase.
Increasing send delay for ****:****:****:****:****:****:****:**** from 5 to 10 due to 11 out of 19 dropped probes since last increase.
Completed Connect Scan at 01:01, 38.11s elapsed (1000 total ports)
Initiating Service scan at 01:01
NSE: Script scanning ****:****:****:****:****:****:****:****.
Initiating NSE at 01:01
Completed NSE at 01:01, 0.10s elapsed
Initiating NSE at 01:01
Completed NSE at 01:01, 0.00s elapsed
Initiating NSE at 01:01
Completed NSE at 01:01, 0.00s elapsed
Nmap scan report for ****:****:****:****:****:****:****:****
Host is up (0.037s latency).
All 1000 scanned ports on ****:****:****:****:****:****:****:**** are in ignored states.
Not shown: 1000 closed tcp ports (conn-refused)
Host script results:
| address-info:
| IPv6 EUI-64:
| MAC address:
| address: 00:e0:4c:68:01:6d
|_ manuf: Realtek Semiconductor
NSE: Script Post-scanning.
Initiating NSE at 01:01
Completed NSE at 01:01, 0.00s elapsed
Initiating NSE at 01:01
Completed NSE at 01:01, 0.00s elapsed
Initiating NSE at 01:01
Completed NSE at 01:01, 0.00s elapsed
Read data files from: /data/data/com.termux/files/usr/bin/../share/nmap
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 39.05 seconds
