Import new install script for Debian 10 and a SOHO routerHEADmaster

1 files changed, 216 insertions, 0 deletions

diff --git a/d10-nuc-as-soho-router.sh b/d10-nuc-as-soho-router.sh
new file mode 100755
index 0000000..549cab5
--- /dev/null
+++ b/d10-nuc-as-soho-router.sh
@@ -0,0 +1,216 @@
+#!/bin/bash 
+# Successfully used on Intel NUC 7CJYH and Debian 10 to replace a 
+#  Bouygues BBox for French FFTH with external fiber-to-RJ45 module (ONT)
+
+# Edit the following configuration constants to fit your environment
+#  If you want eth0, eth1... names, set GRUB_CMDLINE_LINUX="net.ifnames=0"
+#   in /etc/default/grub then run update-grub && reboot before running this script.
+#
+#  For RT_WAN_MAC snif original box mac address by plugging box WAN port
+#   to a linux computer and with something like "sudo tcpdump -nei eno1 udp".
+#   It happened to work for me with a fake ac:3b:77:01:02:03.
+
+DHCPD_DNSLIST="80.67.169.12,91.224.149.254" # FDN and TTN recursive open-dns
+DHCPD_RANGE="192.168.42.10 192.168.42.254"  # Choose min/max IP within RT_LAN_IP/RT_LAN_MASK 
+PKGS="isc-dhcp-server ssh vlan"
+RT_LAN_IFACE=eth0 # I prefer disabling interface renaming, "stable names" are painful for me
+RT_LAN_IP=192.168.42.1
+RT_LAN_MASK=255.255.255.0
+RT_LAN_NET=192.168.42.0
+RT_WAN_IFACE=eth1 # eth1 is my USB network adapter. I don't want Intel NIC on WAN (security).
+RT_WAN_MAC=ac:3b:77:01:02:03
+RT_WAN_VLAN=100   # Always 100 on Bouygues FTTH network
+#SSH_KEY="ssh-rsa AAAA...................ffsU5 lpouzenc@lud-hp1" # no carriage return allowed at all here
+
+ccommand=`tput setaf 3`
+ccomment=`tput setaf 6`
+crst=`tput sgr0`
+
+overwrite() {
+	echo "${ccommand}editor $1${crst}"
+	cat > $1
+}
+
+trace() {
+	echo "${ccommand}$@${crst}"
+	"$@"
+}
+
+info() {
+	echo "${ccomment}# $@${crst}"
+}
+
+codename=$(sed -ne 's/^VERSION_CODENAME=//p' /etc/os-release)
+if [[ "buster" != "$codename" ]]; then
+	read -p "Warning: this script has only be tested on Debian Buster. Enter to continue anyway or Ctrl+C to cancel " unused
+fi
+
+set -e
+
+info "apt: install needed packages to have a complete SOHO router"
+trace apt update
+trace apt install -y $PKGS
+
+info "ssh: will potentially listen on WAN port, disable Password Authentification"
+trace sed --in-place \
+ -e 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/'\
+ /etc/ssh/sshd_config
+trace mkdir -p /root/.ssh
+[ -n "$SSH_KEY" ] && echo $SSH_KEY | overwrite /root/.ssh/authorized_keys
+trace systemctl reload ssh
+
+info "systemd: please don't block for ages, this hardware have normal IO delays"
+trace sed --in-place \
+ -e 's/^#\?DefaultTimeoutStartSec=.*/DefaultTimeoutStartSec=5s/' \
+ -e 's/^#\?DefaultTimeoutStopSec=.*/DefaultTimeoutStopSec=5s/' \
+ /etc/systemd/{system,user}.conf
+trace mkdir -p /etc/systemd/system/networking.service.d
+overwrite /etc/systemd/system/networking.service.d/override.conf <<EOT
+[Service]
+TimeoutStartSec=20s
+EOT
+
+info "ifupdown: start firewall then routing at boot, configure ifaces' IP"
+info " Humans should use iptables-apply and ip6tables-apply commands"
+overwrite /etc/network/interfaces <<EOT 
+# This file describes the network interfaces available on your system
+# and how to activate them. For more information, see interfaces(5).
+
+source /etc/network/interfaces.d/*
+
+# The loopback network interface
+auto lo
+iface lo inet loopback
+	up iptables-restore /etc/network/iptables.up.rules
+	up sysctl -w net.ipv4.ip_forward=1
+	up sysctl -w net.ipv4.conf.all.accept_redirects=0
+	up ip6tables-restore /etc/network/ip6tables.up.rules
+	up sysctl -w net.ipv6.conf.all.forwarding=1
+	up sysctl -w net.ipv6.conf.all.autoconf=0
+	up sysctl -w net.ipv6.conf.all.accept_ra=0
+	up sysctl -w net.ipv6.conf.default.autoconf=0
+	up sysctl -w net.ipv6.conf.default.accept_ra=0
+
+auto eth0
+iface eth0 inet static
+	address $RT_LAN_IP
+	netmask $RT_LAN_MASK
+
+allow-hotplug $RT_WAN_IFACE
+iface $RT_WAN_IFACE inet manual
+	pre-up ip link set $RT_WAN_IFACE address $RT_WAN_MAC
+
+allow-hotplug $RT_WAN_IFACE.$RT_WAN_VLAN
+iface $RT_WAN_IFACE.$RT_WAN_VLAN inet dhcp
+EOT
+
+info "iptables: I left here my rules"
+info " drop by default what came from WAN + self-hosting on my NUC + BitTorrent redirect to a host"
+info " network doesn't provide IPv6 yet here, ip6tables should be okay but untested"
+info " iptables-save and ip6tables-save commands generate this exact file format"
+overwrite /etc/network/iptables.up.rules <<EOT 
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:ICMP4 - [0:0]
+:LOGDROP - [0:0]
+:LOGACCEPT - [0:0]
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -p icmp -j ICMP4
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -m conntrack ! --ctstate NEW -j LOGDROP
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -p tcp -m tcp --dport 22 -j ACCEPT
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -p tcp -m tcp --dport 25 -j ACCEPT
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -p tcp -m tcp --dport 80 -j ACCEPT
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -p tcp -m tcp --dport 443 -j ACCEPT
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -p udp -m udp --dport 53 -j ACCEPT
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -j DROP
+-A INPUT -i $RT_WAN_IFACE -j LOGDROP
+-A FORWARD -i $RT_WAN_IFACE.$RT_WAN_VLAN -p icmp -j ICMP4
+-A FORWARD -i $RT_WAN_IFACE.$RT_WAN_VLAN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A FORWARD -i $RT_WAN_IFACE.$RT_WAN_VLAN -m conntrack --ctstate DNAT -j LOGACCEPT
+-A FORWARD -i $RT_WAN_IFACE.$RT_WAN_VLAN -j LOGDROP
+-A FORWARD -i $RT_WAN_IFACE -j LOGDROP
+-A ICMP4 -p icmp -m limit --limit 10/sec -m icmp --icmp-type 0 -j ACCEPT
+-A ICMP4 -p icmp -m limit --limit 10/sec -m icmp --icmp-type 3 -j ACCEPT
+-A ICMP4 -p icmp -m limit --limit 10/sec -m icmp --icmp-type 8 -j ACCEPT
+-A ICMP4 -p icmp -m limit --limit 10/sec -m icmp --icmp-type 11 -j ACCEPT
+-A ICMP4 -m limit --limit 1/sec -j LOG --log-prefix "ICMP4-RATELIMIT "
+-A ICMP4 -j DROP
+-A LOGDROP -m limit --limit 1/sec -j LOG --log-prefix "LOGDROP "
+-A LOGDROP -j DROP
+-A LOGACCEPT -m limit --limit 1/sec -j LOG --log-prefix "LOGACCEPT "
+-A LOGACCEPT -j ACCEPT
+COMMIT
+*nat
+:PREROUTING ACCEPT [0:0]
+:INPUT ACCEPT [0:0]
+:POSTROUTING ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+-A PREROUTING -i $RT_WAN_IFACE.$RT_WAN_VLAN -p tcp -m tcp --dport 51413 -j DNAT --to-destination 192.168.42.10:51413
+-A PREROUTING -i $RT_WAN_IFACE.$RT_WAN_VLAN -p udp -m udp --dport 51413 -j DNAT --to-destination 192.168.42.10:51413
+-A POSTROUTING -o $RT_WAN_IFACE.$RT_WAN_VLAN -j MASQUERADE
+COMMIT
+EOT
+
+overwrite /etc/network/ip6tables.up.rules <<EOT 
+*filter
+:INPUT ACCEPT [0:0]
+:FORWARD ACCEPT [0:0]
+:OUTPUT ACCEPT [0:0]
+:ICMP6 - [0:0]
+:LOGDROP - [0:0]
+:LOGACCEPT - [0:0]
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -p ipv6-icmp -j ICMP6
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -m conntrack ! --ctstate NEW -j LOGDROP
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -p tcp -m tcp --dport 22 -j ACCEPT
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -p tcp -m tcp --dport 25 -j ACCEPT
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -p tcp -m tcp --dport 80 -j ACCEPT
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -p tcp -m tcp --dport 443 -j ACCEPT
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -p udp -m udp --dport 53 -j ACCEPT
+-A INPUT -i $RT_WAN_IFACE.$RT_WAN_VLAN -j DROP
+-A INPUT -i $RT_WAN_IFACE -j LOGDROP
+-A FORWARD -i $RT_WAN_IFACE.$RT_WAN_VLAN -p ipv6-icmp -j ICMP6
+-A FORWARD -i $RT_WAN_IFACE.$RT_WAN_VLAN -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A FORWARD -i $RT_WAN_IFACE.$RT_WAN_VLAN -m conntrack ! --ctstate NEW -j LOGDROP
+# Put custom IPv6 WAN to LAN forward rules here
+-A FORWARD -i $RT_WAN_IFACE.$RT_WAN_VLAN -j LOGDROP
+-A FORWARD -i $RT_WAN_IFACE -j LOGDROP
+-A ICMP6 -p ipv6-icmp -m limit --limit 10/sec -m ipv6-icmp --icmpv6-type 1 -j ACCEPT
+-A ICMP6 -p ipv6-icmp -m limit --limit 10/sec -m ipv6-icmp --icmpv6-type 2 -j ACCEPT
+-A ICMP6 -p ipv6-icmp -m limit --limit 10/sec -m ipv6-icmp --icmpv6-type 3 -j ACCEPT
+-A ICMP6 -p ipv6-icmp -m limit --limit 10/sec -m ipv6-icmp --icmpv6-type 4 -j ACCEPT
+-A ICMP6 -p ipv6-icmp -m limit --limit 10/sec -m ipv6-icmp --icmpv6-type 128 -j ACCEPT
+-A ICMP6 -p ipv6-icmp -m limit --limit 10/sec -m ipv6-icmp --icmpv6-type 129 -j ACCEPT
+# ICMP rules allowing for NDP or RA from the ISP are probably missing here (untested)
+-A ICMP6 -m limit --limit 1/sec -j LOG --log-prefix "ICMP6-RATELIMIT "
+-A ICMP6 -j DROP
+-A LOGDROP -m limit --limit 1/sec -j LOG --log-prefix "LOGDROP "
+-A LOGDROP -j DROP
+-A LOGACCEPT -m limit --limit 1/sec -j LOG --log-prefix "LOGACCEPT "
+-A LOGACCEPT -j ACCEPT
+COMMIT
+EOT
+
+info "dhcp: upstream files are full pages of comments, not very usefull in this basic case"
+overwrite /etc/dhcp/dhclient.conf <<EOT
+send vendor-class-identifier "BYGTELIAD";
+request subnet-mask, broadcast-address, routers, domain-name-servers;
+EOT
+
+overwrite /etc/dhcp/dhcpd.conf <<EOT
+option domain-name-servers $DHCPD_DNSLIST;
+default-lease-time 600;
+max-lease-time 7200;
+ddns-update-style none;
+authoritative;
+subnet $RT_LAN_NET netmask $RT_LAN_MASK {
+  range $DHCPD_RANGE;
+  option routers $RT_LAN_IP;
+}
+EOT
+
+info "Please review modified files and reboot with a screen attached to see if it is going ok"
+info "You should tweak BIOS to have no 'Press F1 to continue' on POST errors and Power On when AC come back"
+info "Test hard power cutoff and check if everything came back online without interaction after that"