Search Results for edgerouter sniproxy

Build SNIProxy Debian Package for EdgeRouter

SNIProxy的最新版0.4.0，上一次提交已经很久以前了，建议直接使用github库里的代码。官方github：https://github.com/dlundquist/sniproxy 我的fork：https://github.com/sskaje/sniproxy 如前文所说，Debian Wheezy已经LTS了，所以从依赖开始。不过，我没有去配交叉编译的环境，而是直接qemu装了两个虚拟机，一个mips（给EdgeRouter Lite），一个mipsel（给EdgeRouter X），具体方法可以参考之前的blog：Install Debian MIPS and Debian PowerPC on OSX。好处是，闭着眼睛就可以配构件环境；坏处是，慢慢慢慢慢慢慢慢慢慢慢慢慢慢慢慢慢慢慢慢慢慢慢慢到死了。以mips为例，mipsel一模一样。构件环境不说了。先编译 libudns。 udns的官方包里没有debian的打包配置，所以我直接从debian官方包列表的链接里下载，下载地址在：https://packages.debian.org/source/sid/udns 三个文件都下，用到的是两个tarball。

# tar xvf udns-0.4.tar.gz 
# cd udns-0.4/
# tar xvf ../udns_0.4-1.debian.tar.gz 
# dpkg-buildpackage -us -uc

# tar xvf udns-0.4.tar.gz

# cd udns-0.4/

# tar xvf ../udns_0.4-1.debian.tar.gz

# dpkg-buildpackage -us -uc

按上述命令执行完之后，deb包会出现在上一级目录，生成的文件包括： libudns0_0.4-1_mips.deb libudns-dev_0.4-1_mips.deb udns-utils_0.4-1_mips.deb udns_0.4-1_mips.changes 其中，libudns-dev_0.4-1_mips.deb 直接安装在开发环境，libudns0_0.4-1_mips.deb 装在路由上。

dpkg -i libudns-dev_0.4-1_mips.deb

1	dpkg -i libudns-dev_0.4-1_mips.deb

然后编译sniproxy git clone 之后，同样进目录执行

dpkg-buildpackage -us -uc

1	dpkg-buildpackage -us -uc

Link to this post!

Ubnt EdgeRouter Lite 和 EdgeRouter X 上安装使用SNIProxy

EdgerRouter Lite和EdgerRouter X使用的固件版本 1.9.0 是基于debian wheezy的，但是debian wheezy现在已经进入LTS了，mips和mipsel不在官方的维护架构里，以至于现在无法使用官方的apt更新debian-security，而且在ubnt的路由上，安装很多开发库都没法搞了。 EdgerRoute Lite 使用的是mips64，debian源里需要用 mips 的包；而 EdgeRoute X 使用的是mipsel。使用lscpu看CPU的信息： EdgeRouter Lite

Architecture:          mips64
Byte Order:            Big Endian
CPU(s):                2
On-line CPU(s) list:   0,1
Thread(s) per core:    1
Core(s) per socket:    1
Socket(s):             2
L1d cache:             16K
L1i cache:             32K
L2 cache:              128K

Architecture: mips64

Byte Order: Big Endian

CPU(s): 2

On-line CPU(s) list: 0,1

Thread(s) per core: 1

Core(s) per socket: 1

Socket(s): 2

L1d cache: 16K

L1i cache: 32K

L2 cache: 128K

EdgeRouter X

Architecture:          mips
Byte Order:            Little Endian
CPU(s):                4
On-line CPU(s) list:   0-3
Thread(s) per core:    2
Core(s) per socket:    2
Socket(s):             1

Architecture: mips

Byte Order: Little Endian

CPU(s): 4

On-line CPU(s) list: 0-3

Thread(s) per core: 2

Core(s) per socket: 2

Socket(s): 1

准备编译libudns和sniproxy 待补充。我已经把构建好的包发到了 http://dl.sskaje.me/debian/。 SSH登录ER

ubnt@ubnt:~$ sudo su
root@ubnt:/home/ubnt# cd /tmp/
root@ubnt:/tmp#

ubnt@ubnt:~$ sudo su

root@ubnt:/home/ubnt# cd /tmp/

root@ubnt:/tmp#

下载软件 EdgeRouter Lite 请使用mips

# 下载编译好的mips库
wget http://dl.sskaje.me/debian/mips/libudns0_0.4-1_mips.deb http://dl.sskaje.me/debian/mips/udns-utils_0.4-1_mips.deb http://dl.sskaje.me/debian/mips/sniproxy_0.4.0_mips.deb
# 下载 libev4
wget https://ftp2.cn.debian.org/debian/pool/main/libe/libev/libev4_4.11-1_mips.deb

# 下载编译好的mips库

wget http://dl.sskaje.me/debian/mips/libudns0_0.4-1_mips.deb http://dl.sskaje.me/debian/mips/udns-utils_0.4-1_mips.deb http://dl.sskaje.me/debian/mips/sniproxy_0.4.0_mips.deb

# 下载 libev4

wget https://ftp2.cn.debian.org/debian/pool/main/libe/libev/libev4_4.11-1_mips.deb

EdgeRouter X 请使用mipsel

# 下载编译好的mipsel库
wget http://dl.sskaje.me/debian/mipsel/libudns0_0.4-1_mipsel.deb http://dl.sskaje.me/debian/mipsel/udns-utils_0.4-1_mipsel.deb http://dl.sskaje.me/debian/mipsel/sniproxy_0.4.0_mipsel.deb
# 下载 libev4 
wget https://ftp2.cn.debian.org/debian/pool/main/libe/libev/libev4_4.11-1_mipsel.deb

# 下载编译好的mipsel库

wget http://dl.sskaje.me/debian/mipsel/libudns0_0.4-1_mipsel.deb http://dl.sskaje.me/debian/mipsel/udns-utils_0.4-1_mipsel.deb http://dl.sskaje.me/debian/mipsel/sniproxy_0.4.0_mipsel.deb

# 下载 libev4

wget https://ftp2.cn.debian.org/debian/pool/main/libe/libev/libev4_4.11-1_mipsel.deb

安装

root@ubnt:/tmp# dpkg -i *.deb
(Reading database ... 37513 files and directories currently installed.)
Preparing to replace libev4 1:4.11-1 (using libev4_4.11-1_mips.deb) ...
Unpacking replacement libev4 ...
Selecting previously unselected package libudns0:mips.
Unpacking libudns0:mips (from libudns0_0.4-1_mips.deb) ...
Selecting previously unselected package sniproxy.
Unpacking sniproxy (from sniproxy_0.4.0_mips.deb) ...
Selecting previously unselected package udns-utils.
Unpacking udns-utils (from udns-utils_0.4-1_mips.deb) ...
Setting up libev4 (1:4.11-1) ...
Setting up libudns0:mips (0.4-1) ...
Setting up sniproxy (0.4.0) ...
Setting up udns-utils (0.4-1) ...

root@ubnt:/tmp# dpkg -i *.deb

(Reading database ... 37513 files and directories currently installed.)

Preparing to replace libev4 1:4.11-1 (using libev4_4.11-1_mips.deb) ...

Unpacking replacement libev4 ...

Selecting previously unselected package libudns0:mips.

Unpacking libudns0:mips (from libudns0_0.4-1_mips.deb) ...

Selecting previously unselected package sniproxy.

Unpacking sniproxy (from sniproxy_0.4.0_mips.deb) ...

Selecting previously unselected package udns-utils.

Unpacking udns-utils (from udns-utils_0.4-1_mips.deb) ...

Setting up libev4 (1:4.11-1) ...

Setting up libudns0:mips (0.4-1) ...

Setting up sniproxy (0.4.0) ...

Setting up udns-utils (0.4-1) ...

配置请参考官方文档。按我的需求，官方的功能没法满足，所以我对官方的源码做了一些改动，具体可见 https://github.com/sskaje/sniproxy。使用首先修改 /etc/default/sniproxy，这样才可以使用init的脚本启动

# Defaults for sniproxy initscript

# This file has two functions:
# 1) to completely disable starting sniproxy,
# 2) to select an alternative config file
#    by setting DAEMON_ARGS to -c <file>

# Additional options that are passed to the Daemon.
DAEMON_ARGS="-c /etc/sniproxy.conf"

# Whether or not to run the sniproxy daemon; set to 0 to disable, 1 to enable.
ENABLED=1

# Defaults for sniproxy initscript

# This file has two functions:

# 1) to completely disable starting sniproxy,

# 2) to select an alternative config file

# by setting DAEMON_ARGS to -c <file>

# Additional options that are passed to the Daemon.

DAEMON_ARGS="-c /etc/sniproxy.conf"

# Whether or not to run the sniproxy daemon; set to 0 to disable, 1 to enable.

ENABLED=1

启动

/etc/init.d/sniproxy start

1	/etc/init.d/sniproxy start

Incoming search terms:ubnt er-xflies8stwantn67slidei2ksafeibaqueenn3npracticeps1opportunitygcoluckrcfits742interiori97adult2syfather8v7ER-X 安装软件edge修改sniedgerouterx ipv6edgerouterxedgerouter … Continue reading “Ubnt EdgeRouter Lite 和 EdgeRouter X 上安装使用SNIProxy”

EdgeRouter Policy Based Routing Using DNSMASQ IPSET

之前用SNIProxy按域名区分流量，着实麻烦。尤其是后期发现路由表莫名其妙出问题。 EdgeRouter的Policy Based Routing(PBR)使用的是自带配置语法的firewall modify功能。官方有两篇教程： EdgeRouter – Policy-based routing for destination port EdgeRouter – Policy-based routing (source address based) 第二篇文章顺带提了network-group。之前在配置VPN时，使用过network-group，还比较过使用firewall modify + network-group 与配置一堆interface-route的区别。而，这里的network-group的实现，使用了netfilter的ipset。Man pages可以看这里，命令在edgerouter上也附带了。 dnsmasq支持 ‘–ipset‘ 参数，把对配置域名解析的IP存入到指定的ipset。具体细节可以看dnsmasq的文档。 dnsmasq配置的语法比较简单。

--ipset=/<domain>/[domain/]<ipset>[,<ipset>]

1	--ipset=/<domain>/[domain/]<ipset>[,<ipset>]

domain 部分参考 address 的语法。例如：

ipset=/.sskaje.me/MY_SET
ipset=/test.com/MY_SET

1 2	ipset=/.sskaje.me/MY_SET ipset=/test.com/MY_SET

配置好所有自己需要的域名，重启dnsmasq即可。 ipset本身支持timeout，但是edge os的network-group不支持，所以在配置dnsmasq之前，最好创建一个新的network-group。假定新建的ipset名叫 MY_SET，edge router的主要相关配置如下：

set firewall group network-group MY_SET

set firewall modify AUTO_VPN rule 20 action modify
set firewall modify AUTO_VPN rule 20 destination group network-group MY_SET
set firewall modify AUTO_VPN rule 20 modify table 4
set firewall modify AUTO_VPN rule 20 protocol all

set firewall group network-group MY_SET

set firewall modify AUTO_VPN rule 20 action modify

set firewall modify AUTO_VPN rule 20 destination group network-group MY_SET

set firewall modify AUTO_VPN rule 20 modify table 4

set firewall modify AUTO_VPN rule 20 protocol all

其他诸如配置 static table, interface firewall 可以参考最前边的文档。 Incoming search terms:edgemax Source Based … Continue reading “EdgeRouter Policy Based Routing Using DNSMASQ IPSET”

SNIProxy 绑定设备后连接超时

edgerouter lite 我之前是tun模式的openvpn site-to-site，网络拓扑很简单，local tun remote tun，简单配个ip就行，edgerouter上直接使用interface-route 跳转到local tun就行了。后来换用了softether，tap模式，于是需要自己配置IP和路由表。我简单地把firewall modify的地址组切到新的设备上，但是之前的 google dns 和 sniproxy 都保留在openvpn侧。但是最近openvpn被查的厉害，ssh也是被盯上了，所以不得不切换设备到 softether 的 tap 上。

listen 192.168.12.2:3543 {
    proto tls
    table https_hosts
    device tap_vbr
}

listen 192.168.12.2:3543 {

proto tls

table https_hosts

device tap_vbr

}

测试，发现连接超时。测试使用的域名是 download.oracle.com，解析的ip是 106.187.61.57。路由上tcpdump

tcpdump -n -i tap_vbr

1	tcpdump -n -i tap_vbr

看到的请求却是：

14:22:04.471223 ARP, Request who-has 106.187.61.57 tell 192.168.99.50, length 28
14:22:05.471221 ARP, Request who-has 106.187.61.57 tell 192.168.99.50, length 28
14:22:06.475322 ARP, Request who-has 106.187.61.57 tell 192.168.99.50, length 28
...

14:22:04.471223 ARP, Request who-has 106.187.61.57 tell 192.168.99.50, length 28

14:22:05.471221 ARP, Request who-has 106.187.61.57 tell 192.168.99.50, length 28

14:22:06.475322 ARP, Request who-has 106.187.61.57 tell 192.168.99.50, length 28

...

所以。。。加路由吧。因为公司是固定IP，所以之前配的是 system gateway-address。这个时候直接配静态路由会报错：

root@ubnt# set protocols static route 0.0.0.0/0 next-hop 192.168.99.1 distance 100
Error: can not combine system gateway and static default route

1 2	root@ubnt# set protocols static route 0.0.0.0/0 next-hop 192.168.99.1 distance 100 Error: can not combine system gateway and static default route

先删后加

root@ubnt# delete system gateway-address 
[edit]
root@ubnt# commit
[edit]
root@ubnt# set protocols static route 0.0.0.0/0 next-hop my.static.gateway.address distance 10
[edit]
root@ubnt# set protocols static route 0.0.0.0/0 next-hop 192.168.99.1 distance 100
[edit]
root@uebnt# commit
[edit]
root@ubnt# save 
Saving configuration to '/config/config.boot'...
Done

root@ubnt# delete system gateway-address

[edit]

root@ubnt# commit

[edit]

root@ubnt# set protocols static route 0.0.0.0/0 next-hop my.static.gateway.address distance 10

[edit]

root@ubnt# set protocols static route 0.0.0.0/0 next-hop 192.168.99.1 distance 100

[edit]

root@uebnt# commit

[edit]

root@ubnt# save

Saving configuration to '/config/config.boot'...

Done

注意一下，delete执行完后需要先commit，否则还会报错。验证一下

root@ubnt# netstat -nr
Kernel IP routing table
Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface
0.0.0.0         my.st.gw.addr   0.0.0.0         UG        0 0          0 eth1
0.0.0.0         192.168.99.1    0.0.0.0         UG        0 0          0 tap_vbr

root@ubnt# netstat -nr

Kernel IP routing table

Destination Gateway Genmask Flags MSS Window irtt Iface

0.0.0.0 my.st.gw.addr 0.0.0.0 UG 0 0 0 eth1

0.0.0.0 192.168.99.1 0.0.0.0 UG 0 0 0 tap_vbr

如果执行命令前会纠结是否生效，简单 route add 测试一下即可。无比保证vpn的metric比默认网关的大。另，interface-route + route 的混合模式没测试。 Incoming search terms:sniproxy ip rangeLink to this post!

SoftEther Error 13 with HAProxy or SNIProxy

I set up an HAProxy (also tried SNIProxy) on my EdgeRouter, sharing port 443 for internal port forwarding and SoftEther Server on Router. When I connect to port 443 from another SoftEther Server, I got a Timeout error, my error message was in Simplified Chinese on my Windows box, I googled and found other ppl … Continue reading “SoftEther Error 13 with HAProxy or SNIProxy”