Search Results for edgerouter x

EdgeRouter X 安装KMS服务

注意：以下内容仅供已购买 Microsoft Office Volume Licensing 的机构的网络管理员参考。个人用户请购买零售版或Office 365订阅。由于非法使用KMS服务带来的法律风险请自担。我看到很多地方都有人给了各种教程，安装KMS服务。但是，总违背了我的一个原则，不执行未知来源的可执行文件。而且，可能大多数人都不知道用root跑这些程序意味着什么，尤其是在路由器上。所以我找了一个python的版本，github地址在 https://github.com/SystemRage/py-kms 。由于ERX的存储空间限制，大部分操作都没法直接在路由上执行。所以接下来的笔记分两部分，第一部分在本地电脑上，第二部分在路由器上。环境路由器 Ubnt EdgeRouter X，IP 192.168.1.1，SSH端口 2345 EdgeRouter X, 固件 1.10.5 假设网络里没有配置domain，临时设置成 beijing.local Incoming search terms:basis73xforwardquupn pptp remote-access local-ipLink to this post!

Ubnt EdgeRouter Lite 和 EdgeRouter X 上安装使用SNIProxy

EdgerRouter Lite和EdgerRouter X使用的固件版本 1.9.0 是基于debian wheezy的，但是debian wheezy现在已经进入LTS了，mips和mipsel不在官方的维护架构里，以至于现在无法使用官方的apt更新debian-security，而且在ubnt的路由上，安装很多开发库都没法搞了。 EdgerRoute Lite 使用的是mips64，debian源里需要用 mips 的包；而 EdgeRoute X 使用的是mipsel。使用lscpu看CPU的信息： EdgeRouter Lite

Architecture:          mips64
Byte Order:            Big Endian
CPU(s):                2
On-line CPU(s) list:   0,1
Thread(s) per core:    1
Core(s) per socket:    1
Socket(s):             2
L1d cache:             16K
L1i cache:             32K
L2 cache:              128K

Architecture: mips64

Byte Order: Big Endian

CPU(s): 2

On-line CPU(s) list: 0,1

Thread(s) per core: 1

Core(s) per socket: 1

Socket(s): 2

L1d cache: 16K

L1i cache: 32K

L2 cache: 128K

EdgeRouter X

Architecture:          mips
Byte Order:            Little Endian
CPU(s):                4
On-line CPU(s) list:   0-3
Thread(s) per core:    2
Core(s) per socket:    2
Socket(s):             1

Architecture: mips

Byte Order: Little Endian

CPU(s): 4

On-line CPU(s) list: 0-3

Thread(s) per core: 2

Core(s) per socket: 2

Socket(s): 1

准备编译libudns和sniproxy 待补充。我已经把构建好的包发到了 http://dl.sskaje.me/debian/。 SSH登录ER

ubnt@ubnt:~$ sudo su
root@ubnt:/home/ubnt# cd /tmp/
root@ubnt:/tmp#

ubnt@ubnt:~$ sudo su

root@ubnt:/home/ubnt# cd /tmp/

root@ubnt:/tmp#

下载软件 EdgeRouter Lite 请使用mips

# 下载编译好的mips库
wget http://dl.sskaje.me/debian/mips/libudns0_0.4-1_mips.deb http://dl.sskaje.me/debian/mips/udns-utils_0.4-1_mips.deb http://dl.sskaje.me/debian/mips/sniproxy_0.4.0_mips.deb
# 下载 libev4
wget https://ftp2.cn.debian.org/debian/pool/main/libe/libev/libev4_4.11-1_mips.deb

# 下载编译好的mips库

wget http://dl.sskaje.me/debian/mips/libudns0_0.4-1_mips.deb http://dl.sskaje.me/debian/mips/udns-utils_0.4-1_mips.deb http://dl.sskaje.me/debian/mips/sniproxy_0.4.0_mips.deb

# 下载 libev4

wget https://ftp2.cn.debian.org/debian/pool/main/libe/libev/libev4_4.11-1_mips.deb

EdgeRouter X 请使用mipsel

# 下载编译好的mipsel库
wget http://dl.sskaje.me/debian/mipsel/libudns0_0.4-1_mipsel.deb http://dl.sskaje.me/debian/mipsel/udns-utils_0.4-1_mipsel.deb http://dl.sskaje.me/debian/mipsel/sniproxy_0.4.0_mipsel.deb
# 下载 libev4 
wget https://ftp2.cn.debian.org/debian/pool/main/libe/libev/libev4_4.11-1_mipsel.deb

# 下载编译好的mipsel库

wget http://dl.sskaje.me/debian/mipsel/libudns0_0.4-1_mipsel.deb http://dl.sskaje.me/debian/mipsel/udns-utils_0.4-1_mipsel.deb http://dl.sskaje.me/debian/mipsel/sniproxy_0.4.0_mipsel.deb

# 下载 libev4

wget https://ftp2.cn.debian.org/debian/pool/main/libe/libev/libev4_4.11-1_mipsel.deb

安装

root@ubnt:/tmp# dpkg -i *.deb
(Reading database ... 37513 files and directories currently installed.)
Preparing to replace libev4 1:4.11-1 (using libev4_4.11-1_mips.deb) ...
Unpacking replacement libev4 ...
Selecting previously unselected package libudns0:mips.
Unpacking libudns0:mips (from libudns0_0.4-1_mips.deb) ...
Selecting previously unselected package sniproxy.
Unpacking sniproxy (from sniproxy_0.4.0_mips.deb) ...
Selecting previously unselected package udns-utils.
Unpacking udns-utils (from udns-utils_0.4-1_mips.deb) ...
Setting up libev4 (1:4.11-1) ...
Setting up libudns0:mips (0.4-1) ...
Setting up sniproxy (0.4.0) ...
Setting up udns-utils (0.4-1) ...

root@ubnt:/tmp# dpkg -i *.deb

(Reading database ... 37513 files and directories currently installed.)

Preparing to replace libev4 1:4.11-1 (using libev4_4.11-1_mips.deb) ...

Unpacking replacement libev4 ...

Selecting previously unselected package libudns0:mips.

Unpacking libudns0:mips (from libudns0_0.4-1_mips.deb) ...

Selecting previously unselected package sniproxy.

Unpacking sniproxy (from sniproxy_0.4.0_mips.deb) ...

Selecting previously unselected package udns-utils.

Unpacking udns-utils (from udns-utils_0.4-1_mips.deb) ...

Setting up libev4 (1:4.11-1) ...

Setting up libudns0:mips (0.4-1) ...

Setting up sniproxy (0.4.0) ...

Setting up udns-utils (0.4-1) ...

配置请参考官方文档。按我的需求，官方的功能没法满足，所以我对官方的源码做了一些改动，具体可见 https://github.com/sskaje/sniproxy。使用首先修改 /etc/default/sniproxy，这样才可以使用init的脚本启动

# Defaults for sniproxy initscript

# This file has two functions:
# 1) to completely disable starting sniproxy,
# 2) to select an alternative config file
#    by setting DAEMON_ARGS to -c <file>

# Additional options that are passed to the Daemon.
DAEMON_ARGS="-c /etc/sniproxy.conf"

# Whether or not to run the sniproxy daemon; set to 0 to disable, 1 to enable.
ENABLED=1

# Defaults for sniproxy initscript

# This file has two functions:

# 1) to completely disable starting sniproxy,

# 2) to select an alternative config file

# by setting DAEMON_ARGS to -c <file>

# Additional options that are passed to the Daemon.

DAEMON_ARGS="-c /etc/sniproxy.conf"

# Whether or not to run the sniproxy daemon; set to 0 to disable, 1 to enable.

ENABLED=1

启动

/etc/init.d/sniproxy start

1	/etc/init.d/sniproxy start

Incoming search terms:unknowngx9Link to this post!

北京联通EdgeRouter开启IPv6

看到说北京联通的pppoe也开始启用ipv6了，在EdgeRouter Lite上开了一下设置。联通给了个 /56 的prefix。我的eth1接了上行，pppoe拨号，eth0是lan。

set interfaces ethernet eth1 pppoe 0 ipv6 address autoconf
set interfaces ethernet eth1 pppoe 0 ipv6 enable
set interfaces ethernet eth1 pppoe 0 ipv6 dup-addr-detect-transmits 1 

set interfaces ethernet eth1 pppoe 0 dhcpv6-pd pd 0 interface eth0 service slaac
set interfaces ethernet eth1 pppoe 0 dhcpv6-pd pd 0 prefix-length /56

set interfaces ethernet eth1 pppoe 0 ipv6 address autoconf

set interfaces ethernet eth1 pppoe 0 ipv6 enable

set interfaces ethernet eth1 pppoe 0 ipv6 dup-addr-detect-transmits 1

set interfaces ethernet eth1 pppoe 0 dhcpv6-pd pd 0 interface eth0 service slaac

set interfaces ethernet eth1 pppoe 0 dhcpv6-pd pd 0 prefix-length /56

lan

interface {
  ethernet eth0 {
    ipv6 {
      router-advert {
          cur-hop-limit 64
          link-mtu 0
          managed-flag false
          max-interval 600
          other-config-flag false
          prefix ::/64 {
              autonomous-flag true
              on-link-flag true
              valid-lifetime 2592000
          }
          reachable-time 0
          retrans-timer 0
          send-advert false
      }
    }
  }
}

interface {

ethernet eth0 {

ipv6 {

router-advert {

cur-hop-limit 64

link-mtu 0

managed-flag false

max-interval 600

other-config-flag false

prefix ::/64 {

autonomous-flag true

on-link-flag true

valid-lifetime 2592000

}

reachable-time 0

retrans-timer 0

send-advert false

}

记住配置防火墙 Incoming search terms:blowla3straightkhqLink to this post!

OpenVPN Site-to-Site VPN between Asus Merlin And Ubnt EdgeRouter

前言 Network Topology RT-AC68U 使用PPPoE拨号上网，但是分配的IP是100.64.204.111, 看着像公网IP实际却是Carrier-grade NAT. 现在需要将RT-AC68U与一台在公网的EdgeRouter使用OpenVPN Site-to-Site连接起来，并在RT-AC68U端实现policy-based routing。需要让RT-AC68U下的所有设备能访问EdgeRouter LAN的网络，并根据需求透过VPS访问指定互联网。本实验参考下列文章： Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite EdgeRouter OpenVPN Connectivity Monitor EdgeRouter 策略路由实现分析 EdgeRouter Policy Based Routing Using DNSMASQ IPSET Incoming search terms:leadp9hstripjqgLink to this post!

EdgeRouter 部署 WireGuard

安装从 https://github.com/Lochnair/vyatta-wireguard/releases 下载对应的包 ERL, ER等 mips架构的，下载 octeon 版本 ERX 下载 ralink版本。可以选择上传到路由上，或者ssh登录路由，sudo su到root，执行类似如下的命令

curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-octeon-0.0.20170612-2.deb -o wireguard-octeon-0.0.20170612-2.deb

1	curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-octeon-0.0.20170612-2.deb -o wireguard-octeon-0.0.20170612-2.deb

或

curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-ralink-0.0.20170612-2.deb -o wireguard-ralink-0.0.20170612-2.deb

1	curl https://github.com/Lochnair/vyatta-wireguard/releases/download/0.0.20170612-2/wireguard-ralink-0.0.20170612-2.deb -o wireguard-ralink-0.0.20170612-2.deb

下载完成后

dpkg -i xxx.deb

1	dpkg -i xxx.deb

配置执行下列命令生成私钥、共享密钥，公钥

wg genkey > /config/auth/wg.private
wg genpsk > /config/auth/wg.psk
chmod 0600 /config/auth/wg.*
wg pubkey < /config/auth/wg.private

wg genkey > /config/auth/wg.private

wg genpsk > /config/auth/wg.psk

chmod 0600 /config/auth/wg.*

wg pubkey < /config/auth/wg.private

将最后一个命令的输出复制下来，配置到服务器端获取服务器端的公钥，替换下文的“公钥”并执行命令

configure
set interfaces wireguard wg0 address 192.168.10.40/24
set interfaces wireguard wg0 listen-port 本地端口
set interfaces wireguard wg0 peer 公钥 allowed-ips 0.0.0.0/0
set interfaces wireguard wg0 peer 公钥 endpoint '服务器IP:端口'
set interfaces wireguard wg0 peer 公钥 preshared-key /config/auth/wg-eos.psk
set interfaces wireguard wg0 private-key /config/auth/wg.private
set interfaces wireguard wg0 route-allowed-ips false
commit
save

configure

set interfaces wireguard wg0 address 192.168.10.40/24

set interfaces wireguard wg0 listen-port 本地端口

set interfaces wireguard wg0 peer 公钥 allowed-ips 0.0.0.0/0

set interfaces wireguard wg0 peer 公钥 endpoint '服务器IP:端口'

set interfaces wireguard wg0 peer 公钥 preshared-key /config/auth/wg-eos.psk

set interfaces wireguard wg0 private-key /config/auth/wg.private

set interfaces wireguard wg0 route-allowed-ips false

commit

save

配置好设备后，配置nat服务

configure
set service nat rule 5032 outbound-interface wg0
set service nat rule 5032 type masquerade
commit 
save

configure

set service nat rule 5032 outbound-interface wg0

set service nat rule 5032 type masquerade

commit

save

剩下就是配置路由规则了，可以参考我的其他blog. Incoming search terms:wireguardedgeos wireguardLink to this post!