Search Results for UBNT | @sskaje

Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite

参考：https://help.ubnt.com/hc/en-us/articles/204949694-EdgeMAX-OpenVPN-Site-to-Site 不同的是，我一端是Ubuntu Linux，另一端是EdgeRouter Lite。实现的目的也是让EdgeRouter连上远程vpn实现XXXX。 PPTP的方案参考：EdgeOS PPTP VPN客户端配置环境 Ubuntu Linux, 10.99.99.2 EdgeRouter Lite, 10.99.99.1 配置EdgeRouter Lite SSH到Ubnt EdgeRouter Lite 生成共享密钥文件

generate vpn openvpn-key /config/auth/secret

1	generate vpn openvpn-key /config/auth/secret

执行命令创建VPN

configure
set interfaces openvpn vtun0
set interfaces openvpn vtun0 mode site-to-site
set interfaces openvpn vtun0 remote-host 服务器公网地址
set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret
set interfaces openvpn vtun0 local-address 10.99.99.1 
set interfaces openvpn vtun0 remote-address 10.99.99.2
set interfaces openvpn vtun0 local-port 1194
set interfaces openvpn vtun0 remote-port 1194
set interfaces openvpn vtun0 openvpn-option --comp-lzo
set interfaces openvpn vtun0 openvpn-option --float
set interfaces openvpn vtun0 openvpn-option "--ping 10"
set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"
set interfaces openvpn vtun0 openvpn-option --ping-timer-rem
set interfaces openvpn vtun0 openvpn-option --persist-tun
set interfaces openvpn vtun0 openvpn-option --persist-key
set interfaces openvpn vtun0 openvpn-option "--user nobody"
set interfaces openvpn vtun0 openvpn-option "--group nogroup"
commit
save
exit

configure

set interfaces openvpn vtun0

set interfaces openvpn vtun0 mode site-to-site

set interfaces openvpn vtun0 remote-host 服务器公网地址

set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret

set interfaces openvpn vtun0 local-address 10.99.99.1

set interfaces openvpn vtun0 remote-address 10.99.99.2

set interfaces openvpn vtun0 local-port 1194

set interfaces openvpn vtun0 remote-port 1194

set interfaces openvpn vtun0 openvpn-option --comp-lzo

set interfaces openvpn vtun0 openvpn-option --float

set interfaces openvpn vtun0 openvpn-option "--ping 10"

set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"

set interfaces openvpn vtun0 openvpn-option --ping-timer-rem

set interfaces openvpn vtun0 openvpn-option --persist-tun

set interfaces openvpn vtun0 openvpn-option --persist-key

set interfaces openvpn vtun0 openvpn-option "--user nobody"

set interfaces openvpn vtun0 openvpn-option "--group nogroup"

commit

save

exit

执行命令启用NAT

configure
set service nat rule 5020 outbound-interface vtun0
set service nat rule 5020 type masquerade
commit
save
exit

configure

set service nat rule 5020 outbound-interface vtun0

set service nat rule 5020 type masquerade

commit

save

exit

如果需要重启tunnel

reset openvpn interface vtun0

1	reset openvpn interface vtun0

配置Linux 安装openvpn

apt-get install openvpn

1	apt-get install openvpn

把EdgeRouter的 /config/auth/secret 复制到 /etc/openvpn/er-site2site-static.key 编辑 /etc/openvpn/server.conf

dev tun
ifconfig 10.99.99.2 10.99.99.1 
secret /etc/openvpn/er-site2site-static.key
lport 1194
rport 1194
user nobody
group nogroup
comp-lzo
ping 10
ping-restart 20
ping-timer-rem
persist-tun
persist-key
verb 3
status /var/log/openvpn/openvpn-status.log
log-append  /var/log/openvpn/openvpn.log

dev tun

ifconfig 10.99.99.2 10.99.99.1

secret /etc/openvpn/er-site2site-static.key

lport 1194

rport 1194

user nobody

group nogroup

comp-lzo

ping 10

ping-restart 20

ping-timer-rem

persist-tun

persist-key

verb 3

status /var/log/openvpn/openvpn-status.log

log-append /var/log/openvpn/openvpn.log

启动openvpn

/etc/init.d/openvpn start

1	/etc/init.d/openvpn start

测试在EdgeRouter ping Linux

ping 10.99.99.2

1	ping 10.99.99.2

在Linux ping EdgeRouter

ping 10.99.99.1

1	ping 10.99.99.1

如果还有问题，可以看日志配置路由参考下一篇文章 UBNT EdgeOS 配置设备路由(interface-route)的方法 … Continue reading “Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite”

UBNT EdgeOS 配置设备路由(interface-route)的方法

之前 EdgeOS PPTP VPN客户端配置里，配置VPN后，需要按需配置路由。由于自用的路由下一跳IP不确定，所以用了 interface-route。配置命令如下：

set protocols static interface-route 10.1.1.0/24 next-hop-interface pptpc0

1	set protocols static interface-route 10.1.1.0/24 next-hop-interface pptpc0

按这种方式配置路由的麻烦在于，每次输入都需要把目标网段后边配上一个interface，万一哪天需要改这个interface，要不一个一个改，要不重新导入配置文件。另外一个方法是用路由表＋防火墙路由表如下：

root@ubnt# show protocols static table 
 table 1 {
     description "route table via eth1: default internet access"
     interface-route 0.0.0.0/0 {
         next-hop-interface eth1 {
         }
     }
 }
 table 2 {
     description "route table via vtun0: openvpn  access"
     interface-route 0.0.0.0/0 {
         next-hop-interface vtun0 {
         }
     }
 }
[edit]

root@ubnt# show protocols static table

table 1 {

description "route table via eth1: default internet access"

interface-route 0.0.0.0/0 {

next-hop-interface eth1 {

}

table 2 {

description "route table via vtun0: openvpn access"

interface-route 0.0.0.0/0 {

next-hop-interface vtun0 {

}

[edit]

防火墙里配置一个地址组，并配好modify规则

firewall {
     group {
         network-group FORBIDDEN_ZONE {
             network 8.8.0.0/16
             network 8.25.0.0/16
         }
     }

     modify AUTO_VPN {
         description "Auto route to vpn based on destination"
         enable-default-log
         rule 1 {
             action modify
             description "route to table 2"
             destination {
                 group {
                     network-group FORBIDDEN_ZONE
                 }
             }
             log enable
             modify {
                 table 2
             }
         }
         rule 2 {
             action modify
             description "default route to table 1 "
             disable
             log enable
             modify {
                 table 1
             }
         }
     }
 }

firewall {

group {

network-group FORBIDDEN_ZONE {

network 8.8.0.0/16

network 8.25.0.0/16

}

modify AUTO_VPN {

description "Auto route to vpn based on destination"

enable-default-log

rule 1 {

action modify

description "route to table 2"

destination {

group {

network-group FORBIDDEN_ZONE

}

log enable

modify {

table 2

}

rule 2 {

action modify

description "default route to table 1 "

disable

log enable

modify {

table 1

}

再把内外网口的防火墙规则改一下

set interfaces ethernet eth0 firewall in modify AUTO_VPN

1	set interfaces ethernet eth0 firewall in modify AUTO_VPN

就行了。这里我的eth1连的外网，eth0是LAN。不过这里有个case我没试过，直接配置interface-route的方法，如果目标网段的interface掉了，会回落到默认的出口上，不知道modify的效果如何。 EdgeOS 1.8b3下firewall的log记录在 /var/log/messages 里，可以看到请求命中了哪个规则。 Incoming search terms:EDGEOSedgeos设置edgeroute4 配置路由edgeos 设置dnsdrawna4ledgeos 设置EdgeOS iptableswhitex9gedge os 旁路由eaten4u4driveraccadditionqiydonkeyz67decideem6circusv4mchoiceo8abasicg1qarrangementi75apple7clanotherhm6Link to this post!

UBNT EdgeRouter Lite 更换U盘

本文需要Linux基础，不会的还是找人帮忙吧。 EdgeRoute Lite 的磁盘性能实在不敢恭维，而且稳定性也堪忧。之前出现过好几次IO错误，都没当回事，凑合就不管了，最近一次重启，结果直接就起不来了。拆机拆机很简单，底下的两个螺丝卸掉就行。地线那个不用动。拆完之后就能看到一个小U盘了。算了下USB口和pcb板之间的缝隙大小，最后京东上能买的还有点名气的U盘也就一个台电的而已。我没买USB 3.0的，觉得用不上，现在有点后悔了。后来帮同事刷机，买了3个3.0的，都没遇到下边挑U盘的情况。。。创建新USB磁盘下一步是要把固件写到U盘上。参考的项目是 https://github.com/vyos/emrk。相关操作是在Linux PC上执行的。从官网下载固件：http://www.ubnt.com.cn/download/ 下载得到的是一个tarball. 我找了个U盘，装了个debian的live cd. 装好U盘之后，先分区。我的U盘磁盘设备是 sdc。 debian的live cd默认没有parted，所以直接用fdisk了。基本命令如下（仅做示意，没有截图）：

# fdisk /dev/sdc
> d -------- 删除所有分区表
> n -------- 创建第一个primary分区，大小至少150MB，我分了4GB
> t -------- 修改第一个分区的类型标志，改为 b FAT32
> n -------- 创建第二个primary分区，至少1900MB，我分了快11个G，默认已经是Linux了。
> w -------- 保存分区表

# fdisk /dev/sdc

> d -------- 删除所有分区表

> n -------- 创建第一个primary分区，大小至少150MB，我分了4GB

> t -------- 修改第一个分区的类型标志，改为 b FAT32

> n -------- 创建第二个primary分区，至少1900MB，我分了快11个G，默认已经是Linux了。

> w -------- 保存分区表

fdisk操作之前务必把已挂载的分区全下掉。下一步格式化：如果你没有 mkfs.vfat，可能需要安装 dosfstools

apt-get install dosfstools

1	apt-get install dosfstools

格式化命令如下：

# mkfs.vfat /dev/sdc1
# mkfs.ext3 /dev/sdc2

1 2	# mkfs.vfat /dev/sdc1 # mkfs.ext3 /dev/sdc2

最后一步，释放文件命令文件：https://github.com/sskaje/emrk/blob/master/bin/emrk-extract-to-usb 操作命令

./emrk-extract-to-usb /dev/sdc ERLitexx.tar

1	./emrk-extract-to-usb /dev/sdc ERLitexx.tar

Console 我拿MacBook Pro＋USB Console线搞的。推荐 OS X 下的串口工具 CoolTerm，下载地址：CoolTerm 需要配置 bit rates 为 115200。进去之后看到如下错误信息

U-Boot 1.1.1 (UBNT Build ID: 4493936-g009d77b) (Build time: Sep 20 2012 - 15:48:51)

BIST check passed.
UBNT_E100 r1:2, r2:14, serial #: XXXXXXXXXX
Core clock: 500 MHz, DDR clock: 266 MHz (532 Mhz data rate)
DRAM:  512 MB
Clearing DRAM....... done
Flash:  4 MB
Net:   octeth0, octeth1, octeth2

USB:   (port 0) scanning bus for devices... 
      USB device not responding, giving up (status=0)
1 USB Devices found
       scanning bus for storage devices...
No device found. Not initialized?
... 0 
** Can't read from device 0 **

** Unable to use usb 0:1 for fatload **
argv[2]: coremask=0x3
argv[3]: root=/dev/sda2
argv[4]: rootdelay=15
argv[5]: rw
argv[6]: rootsqimg=squashfs.img
argv[7]: rootsqwdir=w
argv[8]: mtdparts=phys_mapped_flash:512k(boot0),512k(boot1),64k@3072k(eeprom)
## No elf image at address 0x09f00000
Octeon ubnt_e100#

U-Boot 1.1.1 (UBNT Build ID: 4493936-g009d77b) (Build time: Sep 20 2012 - 15:48:51)

BIST check passed.

UBNT_E100 r1:2, r2:14, serial #: XXXXXXXXXX

Core clock: 500 MHz, DDR clock: 266 MHz (532 Mhz data rate)

DRAM: 512 MB

Clearing DRAM....... done

Flash: 4 MB

Net: octeth0, octeth1, octeth2

USB: (port 0) scanning bus for devices...

USB device not responding, giving up (status=0)

1 USB Devices found

scanning bus for storage devices...

No device found. Not initialized?

... 0

** Can't read from device 0 **

** Unable to use usb 0:1 for fatload **

argv[2]: coremask=0x3

argv[3]: root=/dev/sda2

argv[4]: rootdelay=15

argv[5]: rw

argv[6]: rootsqimg=squashfs.img

argv[7]: rootsqwdir=w

argv[8]: mtdparts=phys_mapped_flash:512k(boot0),512k(boot1),64k@3072k(eeprom)

## No elf image at address 0x09f00000

Octeon ubnt_e100#

搜了搜解决方案

Octeon ubnt_e100# usb reset

(Re)start USB...
USB:   (port 0) scanning bus for devices... 1 USB Devices found
       scanning bus for storage devices...
  Device 0: Vendor: Teclast  Prod.: CoolFlash        Rev: 1100
            Type: Removable Hard Disk
            Capacity: 15300.0 MB = 14.9 GB (31334400 x 512)
Octeon ubnt_e100# 

(Re)start USB...
USB:   (port 0) scanning bus for devices... 1 USB Devices found
       scanning bus for storage devices...
  Device 0: Vendor: Teclast  Prod.: CoolFlash        Rev: 1100
            Type: Removable Hard Disk
            Capacity: 15300.0 MB = 14.9 GB (31334400 x 512)
Octeon ubnt_e100#

Octeon ubnt_e100# usb reset

(Re)start USB...

USB: (port 0) scanning bus for devices... 1 USB Devices found

scanning bus for storage devices...

Device 0: Vendor: Teclast Prod.: CoolFlash Rev: 1100

Type: Removable Hard Disk

Capacity: 15300.0 MB = 14.9 GB (31334400 x 512)

Octeon ubnt_e100#

(Re)start USB...

USB: (port 0) scanning bus for devices... 1 USB Devices found

scanning bus for storage devices...

Device 0: Vendor: Teclast Prod.: CoolFlash Rev: 1100

Type: Removable Hard Disk

Capacity: 15300.0 MB = 14.9 GB (31334400 x 512)

Octeon ubnt_e100#

比较不爽的是，重启后依旧会’Unable to … Continue reading “UBNT EdgeRouter Lite 更换U盘”

UBNT Task Scheduler

DNSMASQ is not very stable on Ubnt EdgeRouter Lite with firmware 1.7. I was about to set up a crontab rebooting dnsmasq every morning. But here is another solution, using task-scheduler.

ubnt@ubnt:~$ configure
[edit]
ubnt@ubnt# set system task-scheduler task reboot-dnsmasq executable path /etc/init.d/dnsmasq
Warning: '/etc/init.d/dnsmasq' lies outside of /config/scripts directory. It will not get preserved during image upgrade.

[edit]
ubnt@ubnt# set system task-scheduler task reboot-dnsmasq executable arguments restart
[edit]
ubnt@ubnt# set system task-scheduler task reboot-dnsmasq crontab-spec "30 3 * * *"
[edit]
ubnt@ubnt# commit
[ system task-scheduler task reboot-dnsmasq executable path /etc/init.d/dnsmasq ]
Warning: '/etc/init.d/dnsmasq' lies outside of /config/scripts directory. It will not get preserved during image upgrade.

[ system task-scheduler ]
Restarting periodic command scheduler: cronStopping periodic command scheduler: cron.
Starting periodic command scheduler: cron.

[edit]
ubnt@ubnt# save
Saving configuration to '/config/config.boot'...
Done
[edit]
ubnt@ubnt# exit
exit

ubnt@ubnt:~$ configure

[edit]

ubnt@ubnt# set system task-scheduler task reboot-dnsmasq executable path /etc/init.d/dnsmasq

Warning: '/etc/init.d/dnsmasq' lies outside of /config/scripts directory. It will not get preserved during image upgrade.

[edit]

ubnt@ubnt# set system task-scheduler task reboot-dnsmasq executable arguments restart

[edit]

ubnt@ubnt# set system task-scheduler task reboot-dnsmasq crontab-spec "30 3 * * *"

[edit]

ubnt@ubnt# commit

[ system task-scheduler task reboot-dnsmasq executable path /etc/init.d/dnsmasq ]

Warning: '/etc/init.d/dnsmasq' lies outside of /config/scripts directory. It will not get preserved during image upgrade.

[ system task-scheduler ]

Restarting periodic command scheduler: cronStopping periodic command scheduler: cron.

Starting periodic command scheduler: cron.

[edit]

ubnt@ubnt# save

Saving configuration to '/config/config.boot'...

Done

[edit]

ubnt@ubnt# exit

exit

Incoming search terms:edgerouter scheduled jobsscheduled task ubiquiti edge routerLink to this post!

Hijack DnsPod HttpDNS

劫持DNS是个很简单的工作，家用路由器基本都自带dnsmasq，直接加解析就行。之前某次尝试劫持某视频App的广告接口解析到一个空的本地服务器上，发现该App使用了DnsPod的HttpDNS服务，所以传统的DNS劫持方案不好用。而EdgeRouter的DPI功能也没有对外开放墙一般的高级接口，所以这次用NAT来实现。 Incoming search terms:awaycx8characteristic4qqdnspod httpdnsdroveq2jguardp5yhomebhrimageemaimportance8eqinstrumentdbkmajorglcolderencsuggesthw8Surge使用dnspod httpdnstotalh7xzebraolbLink to this post!