Ubnt | @sskaje

Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite

By @sskaje
Link: https://sskaje.me/2016/02/set-openvpn-site-to-site-ubnt-edgerouter-lite/

参考：https://help.ubnt.com/hc/en-us/articles/204949694-EdgeMAX-OpenVPN-Site-to-Site
不同的是，我一端是Ubuntu Linux，另一端是EdgeRouter Lite。

实现的目的也是让EdgeRouter连上远程vpn实现XXXX。
PPTP的方案参考：EdgeOS PPTP VPN客户端配置

环境

Ubuntu Linux, 10.99.99.2
EdgeRouter Lite, 10.99.99.1

配置EdgeRouter Lite

SSH到Ubnt EdgeRouter Lite
生成共享密钥文件

generate vpn openvpn-key /config/auth/secret

1	generate vpn openvpn-key /config/auth/secret

执行命令创建VPN

configure
set interfaces openvpn vtun0
set interfaces openvpn vtun0 mode site-to-site
set interfaces openvpn vtun0 remote-host 服务器公网地址
set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret
set interfaces openvpn vtun0 local-address 10.99.99.1 
set interfaces openvpn vtun0 remote-address 10.99.99.2
set interfaces openvpn vtun0 local-port 1194
set interfaces openvpn vtun0 remote-port 1194
set interfaces openvpn vtun0 openvpn-option --comp-lzo
set interfaces openvpn vtun0 openvpn-option --float
set interfaces openvpn vtun0 openvpn-option "--ping 10"
set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"
set interfaces openvpn vtun0 openvpn-option --ping-timer-rem
set interfaces openvpn vtun0 openvpn-option --persist-tun
set interfaces openvpn vtun0 openvpn-option --persist-key
set interfaces openvpn vtun0 openvpn-option "--user nobody"
set interfaces openvpn vtun0 openvpn-option "--group nogroup"
commit
save
exit

configure

set interfaces openvpn vtun0

set interfaces openvpn vtun0 mode site-to-site

set interfaces openvpn vtun0 remote-host 服务器公网地址

set interfaces openvpn vtun0 shared-secret-key-file /config/auth/secret

set interfaces openvpn vtun0 local-address 10.99.99.1

set interfaces openvpn vtun0 remote-address 10.99.99.2

set interfaces openvpn vtun0 local-port 1194

set interfaces openvpn vtun0 remote-port 1194

set interfaces openvpn vtun0 openvpn-option --comp-lzo

set interfaces openvpn vtun0 openvpn-option --float

set interfaces openvpn vtun0 openvpn-option "--ping 10"

set interfaces openvpn vtun0 openvpn-option "--ping-restart 20"

set interfaces openvpn vtun0 openvpn-option --ping-timer-rem

set interfaces openvpn vtun0 openvpn-option --persist-tun

set interfaces openvpn vtun0 openvpn-option --persist-key

set interfaces openvpn vtun0 openvpn-option "--user nobody"

set interfaces openvpn vtun0 openvpn-option "--group nogroup"

commit

save

exit

执行命令启用NAT

configure
set service nat rule 5020 outbound-interface vtun0
set service nat rule 5020 type masquerade
commit
save
exit

configure

set service nat rule 5020 outbound-interface vtun0

set service nat rule 5020 type masquerade

commit

save

exit

如果需要重启tunnel

reset openvpn interface vtun0

1	reset openvpn interface vtun0

配置Linux

安装openvpn

apt-get install openvpn

1	apt-get install openvpn

把EdgeRouter的 /config/auth/secret 复制到 /etc/openvpn/er-site2site-static.key

编辑 /etc/openvpn/server.conf

dev tun
ifconfig 10.99.99.2 10.99.99.1 
secret /etc/openvpn/er-site2site-static.key
lport 1194
rport 1194
user nobody
group nogroup
comp-lzo
ping 10
ping-restart 20
ping-timer-rem
persist-tun
persist-key
verb 3
status /var/log/openvpn/openvpn-status.log
log-append  /var/log/openvpn/openvpn.log

dev tun

ifconfig 10.99.99.2 10.99.99.1

secret /etc/openvpn/er-site2site-static.key

lport 1194

rport 1194

user nobody

group nogroup

comp-lzo

ping 10

ping-restart 20

ping-timer-rem

persist-tun

persist-key

verb 3

status /var/log/openvpn/openvpn-status.log

log-append /var/log/openvpn/openvpn.log

启动openvpn

/etc/init.d/openvpn start

1	/etc/init.d/openvpn start

测试

在EdgeRouter ping Linux

ping 10.99.99.2

1	ping 10.99.99.2

在Linux ping EdgeRouter

ping 10.99.99.1

1	ping 10.99.99.1

如果还有问题，可以看日志

配置路由

参考下一篇文章 UBNT EdgeOS 配置设备路由(interface-route)的方法

Set up OpenVPN Site-to-Site on UBNT EdgeRouter Lite by @sskaje: https://sskaje.me/2016/02/set-openvpn-site-to-site-ubnt-edgerouter-lite/

Incoming search terms:

UBNT EdgeOS 配置设备路由(interface-route)的方法

By @sskaje
Link: https://sskaje.me/2016/02/ubnt-edgeos-set-interface-route/

之前 EdgeOS PPTP VPN客户端配置里，配置VPN后，需要按需配置路由。由于自用的路由下一跳IP不确定，所以用了 interface-route。

配置命令如下：

set protocols static interface-route 10.1.1.0/24 next-hop-interface pptpc0

1	set protocols static interface-route 10.1.1.0/24 next-hop-interface pptpc0

按这种方式配置路由的麻烦在于，每次输入都需要把目标网段后边配上一个interface，万一哪天需要改这个interface，要不一个一个改，要不重新导入配置文件。

另外一个方法是用路由表＋防火墙
路由表如下：

root@ubnt# show protocols static table 
 table 1 {
     description "route table via eth1: default internet access"
     interface-route 0.0.0.0/0 {
         next-hop-interface eth1 {
         }
     }
 }
 table 2 {
     description "route table via vtun0: openvpn  access"
     interface-route 0.0.0.0/0 {
         next-hop-interface vtun0 {
         }
     }
 }
[edit]

root@ubnt# show protocols static table

table 1 {

description "route table via eth1: default internet access"

interface-route 0.0.0.0/0 {

next-hop-interface eth1 {

}

table 2 {

description "route table via vtun0: openvpn access"

interface-route 0.0.0.0/0 {

next-hop-interface vtun0 {

}

[edit]

防火墙里配置一个地址组，并配好modify规则

firewall {
     group {
         network-group FORBIDDEN_ZONE {
             network 8.8.0.0/16
             network 8.25.0.0/16
         }
     }

     modify AUTO_VPN {
         description "Auto route to vpn based on destination"
         enable-default-log
         rule 1 {
             action modify
             description "route to table 2"
             destination {
                 group {
                     network-group FORBIDDEN_ZONE
                 }
             }
             log enable
             modify {
                 table 2
             }
         }
         rule 2 {
             action modify
             description "default route to table 1 "
             disable
             log enable
             modify {
                 table 1
             }
         }
     }
 }

firewall {

group {

network-group FORBIDDEN_ZONE {

network 8.8.0.0/16

network 8.25.0.0/16

}

modify AUTO_VPN {

description "Auto route to vpn based on destination"

enable-default-log

rule 1 {

action modify

description "route to table 2"

destination {

group {

network-group FORBIDDEN_ZONE

}

log enable

modify {

table 2

}

rule 2 {

action modify

description "default route to table 1 "

disable

log enable

modify {

table 1

}

再把内外网口的防火墙规则改一下

set interfaces ethernet eth0 firewall in modify AUTO_VPN

1	set interfaces ethernet eth0 firewall in modify AUTO_VPN

就行了。这里我的eth1连的外网，eth0是LAN。

不过这里有个case我没试过，直接配置interface-route的方法，如果目标网段的interface掉了，会回落到默认的出口上，不知道modify的效果如何。

EdgeOS 1.8b3下firewall的log记录在 /var/log/messages 里，可以看到请求命中了哪个规则。

UBNT EdgeOS 配置设备路由(interface-route)的方法 by @sskaje: https://sskaje.me/2016/02/ubnt-edgeos-set-interface-route/

Incoming search terms:

UBNT EdgeRouter Lite 更换U盘

By @sskaje
Link: https://sskaje.me/2016/01/ubnt-edgerouter-lite-%e6%9b%b4%e6%8d%a2u%e7%9b%98/

本文需要Linux基础，不会的还是找人帮忙吧。

EdgeRoute Lite 的磁盘性能实在不敢恭维，而且稳定性也堪忧。之前出现过好几次IO错误，都没当回事，凑合就不管了，最近一次重启，结果直接就起不来了。

拆机

拆机很简单，底下的两个螺丝卸掉就行。地线那个不用动。

拆完之后就能看到一个小U盘了。

算了下USB口和pcb板之间的缝隙大小，最后京东上能买的还有点名气的U盘也就一个台电的而已。我没买USB 3.0的，觉得用不上，现在有点后悔了。
后来帮同事刷机，买了3个3.0的，都没遇到下边挑U盘的情况。。。

创建新USB磁盘

下一步是要把固件写到U盘上。参考的项目是 https://github.com/vyos/emrk。相关操作是在Linux PC上执行的。

从官网下载固件：http://www.ubnt.com.cn/download/

下载得到的是一个tarball.

我找了个U盘，装了个debian的live cd.

装好U盘之后，先分区。
我的U盘磁盘设备是 sdc。
debian的live cd默认没有parted，所以直接用fdisk了。基本命令如下（仅做示意，没有截图）：

# fdisk /dev/sdc
> d -------- 删除所有分区表
> n -------- 创建第一个primary分区，大小至少150MB，我分了4GB
> t -------- 修改第一个分区的类型标志，改为 b FAT32
> n -------- 创建第二个primary分区，至少1900MB，我分了快11个G，默认已经是Linux了。
> w -------- 保存分区表

# fdisk /dev/sdc

> d -------- 删除所有分区表

> n -------- 创建第一个primary分区，大小至少150MB，我分了4GB

> t -------- 修改第一个分区的类型标志，改为 b FAT32

> n -------- 创建第二个primary分区，至少1900MB，我分了快11个G，默认已经是Linux了。

> w -------- 保存分区表

fdisk操作之前务必把已挂载的分区全下掉。

下一步格式化：
如果你没有 mkfs.vfat，可能需要安装 dosfstools

apt-get install dosfstools

1	apt-get install dosfstools

格式化命令如下：

# mkfs.vfat /dev/sdc1
# mkfs.ext3 /dev/sdc2

1 2	# mkfs.vfat /dev/sdc1 # mkfs.ext3 /dev/sdc2

最后一步，释放文件
命令文件：https://github.com/sskaje/emrk/blob/master/bin/emrk-extract-to-usb

操作命令

./emrk-extract-to-usb /dev/sdc ERLitexx.tar

1	./emrk-extract-to-usb /dev/sdc ERLitexx.tar

Console

我拿MacBook Pro＋USB Console线搞的。推荐 OS X 下的串口工具 CoolTerm，下载地址：CoolTerm

需要配置 bit rates 为 115200。

进去之后看到如下错误信息

U-Boot 1.1.1 (UBNT Build ID: 4493936-g009d77b) (Build time: Sep 20 2012 - 15:48:51)

BIST check passed.
UBNT_E100 r1:2, r2:14, serial #: XXXXXXXXXX
Core clock: 500 MHz, DDR clock: 266 MHz (532 Mhz data rate)
DRAM:  512 MB
Clearing DRAM....... done
Flash:  4 MB
Net:   octeth0, octeth1, octeth2

USB:   (port 0) scanning bus for devices... 
      USB device not responding, giving up (status=0)
1 USB Devices found
       scanning bus for storage devices...
No device found. Not initialized?
... 0 
** Can't read from device 0 **

** Unable to use usb 0:1 for fatload **
argv[2]: coremask=0x3
argv[3]: root=/dev/sda2
argv[4]: rootdelay=15
argv[5]: rw
argv[6]: rootsqimg=squashfs.img
argv[7]: rootsqwdir=w
argv[8]: mtdparts=phys_mapped_flash:512k(boot0),512k(boot1),64k@3072k(eeprom)
## No elf image at address 0x09f00000
Octeon ubnt_e100#

U-Boot 1.1.1 (UBNT Build ID: 4493936-g009d77b) (Build time: Sep 20 2012 - 15:48:51)

BIST check passed.

UBNT_E100 r1:2, r2:14, serial #: XXXXXXXXXX

Core clock: 500 MHz, DDR clock: 266 MHz (532 Mhz data rate)

DRAM: 512 MB

Clearing DRAM....... done

Flash: 4 MB

Net: octeth0, octeth1, octeth2

USB: (port 0) scanning bus for devices...

USB device not responding, giving up (status=0)

1 USB Devices found

scanning bus for storage devices...

No device found. Not initialized?

... 0

** Can't read from device 0 **

** Unable to use usb 0:1 for fatload **

argv[2]: coremask=0x3

argv[3]: root=/dev/sda2

argv[4]: rootdelay=15

argv[5]: rw

argv[6]: rootsqimg=squashfs.img

argv[7]: rootsqwdir=w

argv[8]: mtdparts=phys_mapped_flash:512k(boot0),512k(boot1),64k@3072k(eeprom)

## No elf image at address 0x09f00000

Octeon ubnt_e100#

搜了搜解决方案

Octeon ubnt_e100# usb reset

(Re)start USB...
USB:   (port 0) scanning bus for devices... 1 USB Devices found
       scanning bus for storage devices...
  Device 0: Vendor: Teclast  Prod.: CoolFlash        Rev: 1100
            Type: Removable Hard Disk
            Capacity: 15300.0 MB = 14.9 GB (31334400 x 512)
Octeon ubnt_e100# 

(Re)start USB...
USB:   (port 0) scanning bus for devices... 1 USB Devices found
       scanning bus for storage devices...
  Device 0: Vendor: Teclast  Prod.: CoolFlash        Rev: 1100
            Type: Removable Hard Disk
            Capacity: 15300.0 MB = 14.9 GB (31334400 x 512)
Octeon ubnt_e100#

Octeon ubnt_e100# usb reset

(Re)start USB...

USB: (port 0) scanning bus for devices... 1 USB Devices found

scanning bus for storage devices...

Device 0: Vendor: Teclast Prod.: CoolFlash Rev: 1100

Type: Removable Hard Disk

Capacity: 15300.0 MB = 14.9 GB (31334400 x 512)

Octeon ubnt_e100#

(Re)start USB...

USB: (port 0) scanning bus for devices... 1 USB Devices found

scanning bus for storage devices...

Device 0: Vendor: Teclast Prod.: CoolFlash Rev: 1100

Type: Removable Hard Disk

Capacity: 15300.0 MB = 14.9 GB (31334400 x 512)

Octeon ubnt_e100#

比较不爽的是，重启后依旧会’Unable to use usb 0:1 for fatload‘。

解决方案是改bootcmd的env参数，使用setenv改完后，务必使用saveenv保存。

Octeon ubnt_e100# setenv bootcmd 'sleep 10;usb reset; fatload usb 0 $loadaddr vmlinux.64;bootoctlinux $loadaddr coremask=0x3 root=/dev/sda2 rootdelay=15 rw rootsqimg=squashfs.img rootsqwdir=w mtdparts=phys_mapped_flash:512k(boot0),512k(boot1),64k@3072k(eeprom)'

Octeon ubnt_e100# saveenv 

Saving Environment to Flash...
Un-Protected 1 sectors
Erasing Flash...
. done
Erased 1 sectors
Writing to Flash... 4....3....2....1....done
Protected 1 sectors
Octeon ubnt_e100#

Octeon ubnt_e100# setenv bootcmd 'sleep 10;usb reset; fatload usb 0 $loadaddr vmlinux.64;bootoctlinux $loadaddr coremask=0x3 root=/dev/sda2 rootdelay=15 rw rootsqimg=squashfs.img rootsqwdir=w mtdparts=phys_mapped_flash:512k(boot0),512k(boot1),64k@3072k(eeprom)'

Octeon ubnt_e100# saveenv

Saving Environment to Flash...

Un-Protected 1 sectors

Erasing Flash...

. done

Erased 1 sectors

Writing to Flash... 4....3....2....1....done

Protected 1 sectors

Octeon ubnt_e100#

操作完成后就放心大胆地使用新的EdgeRouter Lite吧。

参考链接：https://community.ubnt.com/t5/EdgeMAX/New-U-Boot-image-for-better-USB-drive-compatibility/m-p/851038#M31382

UBNT EdgeRouter Lite 更换U盘 by @sskaje: https://sskaje.me/2016/01/ubnt-edgerouter-lite-%e6%9b%b4%e6%8d%a2u%e7%9b%98/

Incoming search terms:

EdgeRouter同时更新TunnelBroker和HE.NET DDNS

By @sskaje
Link: https://sskaje.me/2015/06/edgerouter%e5%90%8c%e6%97%b6%e6%9b%b4%e6%96%b0tunnelbroker%e5%92%8che-net-ddns/

之前文章里TunnelBroker for EdgeRouter Lite提及TunnelBroker和He.net DDNS同时更新的解决方案，后来证实不是那么稳定。

其实TunnelBroker.net里提供了解决方案。
在TunnelBroker.net的Tunnel Details里，选择Advanced，最下边的一组配置是HE Dynamic DNS Settings。
Hostname填入HE.NET的DDNS域名，API Key填DDNS域名的更新key。

然后修改EdgeRouter的配置：

delete service dns dynamic interface pppoe0 service dyndns 
set service dns dynamic interface pppoe0 service dyndns host-name TB_TUNNELID
set service dns dynamic interface pppoe0 service dyndns login TB_USER
set service dns dynamic interface pppoe0 service dyndns password  TB_PASS
set service dns dynamic interface pppoe0 service dyndns server ipv4.tunnelbroker.net

delete service dns dynamic interface pppoe0 service dyndns

set service dns dynamic interface pppoe0 service dyndns host-name TB_TUNNELID

set service dns dynamic interface pppoe0 service dyndns login TB_USER

set service dns dynamic interface pppoe0 service dyndns password TB_PASS

set service dns dynamic interface pppoe0 service dyndns server ipv4.tunnelbroker.net

EdgeRouter同时更新TunnelBroker和HE.NET DDNS by @sskaje: https://sskaje.me/2015/06/edgerouter%e5%90%8c%e6%97%b6%e6%9b%b4%e6%96%b0tunnelbroker%e5%92%8che-net-ddns/

Incoming search terms:

TunnelBroker for EdgeRouter Lite

By @sskaje
Link: https://sskaje.me/2015/05/tunnelbroker-edgerouter-lite/

创建隧道

在北京联通这种不给IPv6网络的ISP下生存，总有走v6翻墙的欲望。
免费的Tunnel服务很多，最出名莫过HE.net的TunnelBroker

首先申请一个Tunnel。
访问：

https://tunnelbroker.net/new_tunnel.php

1	https://tunnelbroker.net/new_tunnel.php

注册登录之后，创建并输入当前路由公网IP “YOUR.ROUTER.INTERNET.IP”。

创建成功后会被跳转到

https://tunnelbroker.net/tunnel_detail.php?tid=XXXXX

1	https://tunnelbroker.net/tunnel_detail.php?tid=XXXXX

XXXXX的部分是一串数字，所谓的Tunnel ID.

在这个页面上选择第二个标签页 “Example Configurations”
选择 “Vyatta / Ubiquiti EdgeMAX”

文本框会自动生成如下配置：

configure
edit interfaces tunnel tun0
set encapsulation sit
set local-ip YOUR.ROUTER.INTERNET.IP
set remote-ip 74.82.46.6
set address 2001:470:23:XXXX::XX/64
set description "HE.NET IPv6 Tunnel"
exit
set protocols static interface-route6 ::/0 next-hop-interface tun0
commit

configure

edit interfaces tunnel tun0

set encapsulation sit

set local-ip YOUR.ROUTER.INTERNET.IP

set remote-ip 74.82.46.6

set address 2001:470:23:XXXX::XX/64

set description "HE.NET IPv6 Tunnel"

exit

set protocols static interface-route6 ::/0 next-hop-interface tun0

commit

remote-ip是创建时选择的远端服务器IP，local-ip是本地当前的出口IP。
鉴于ISP给的IP都是动态的，所以local-ip改成如下‘0.0.0.0’。

如果之前有配置过tunnel，需要重新配置，则先删除既有的：

delete interfaces tunnel tun0

1	delete interfaces tunnel tun0

下面开始命令配置tunnel

configure
# tun to ipv6
edit interfaces tunnel tun0
set encapsulation sit
set local-ip 0.0.0.0
set remote-ip 74.82.46.6
set address 2001:470:23:XXXX::XX/64
set description "HE.NET IPv6 Tunnel"
exit
set protocols static interface-route6 ::/0 next-hop-interface tun0
commit
save

configure

# tun to ipv6

edit interfaces tunnel tun0

set encapsulation sit

set local-ip 0.0.0.0

set remote-ip 74.82.46.6

set address 2001:470:23:XXXX::XX/64

set description "HE.NET IPv6 Tunnel"

exit

set protocols static interface-route6 ::/0 next-hop-interface tun0

commit

save

Router Advert

配置完tunnel，就得配局域网内的配置了，毕竟只有路由能上v6是不够的

interfaces {
    ethernet eth0 {               
        address 192.168.11.1/24   
        duplex auto               
        ipv6 {                    
            address {             
                autoconf           
            }                     
            dup-addr-detect-transmits 1
            router-advert {                        
                cur-hop-limit 64  
                link-mtu 0        
                managed-flag false
                max-interval 600  
                other-config-flag false
                prefix 2001:470:24:xxx::/64 {
                    autonomous-flag true
                    on-link-flag true       
                    valid-lifetime 2592000         
                }                 
                radvd-options "RDNSS 2001:470:20::2  {} ;"
                reachable-time 0  
                retrans-timer 0   
                send-advert true  
            }                     
        }                         
        speed auto                          
    } 
...
}

interfaces {

ethernet eth0 {

address 192.168.11.1/24

duplex auto

ipv6 {

address {

autoconf

}

dup-addr-detect-transmits 1

router-advert {

cur-hop-limit 64

link-mtu 0

managed-flag false

max-interval 600

other-config-flag false

prefix 2001:470:24:xxx::/64 {

autonomous-flag true

on-link-flag true

valid-lifetime 2592000

}

radvd-options "RDNSS 2001:470:20::2 {} ;"

reachable-time 0

retrans-timer 0

send-advert true

}

speed auto

}

...

}

如果你本地的DNS规则有过配置，radvd-options 的配置一定要把ipv6地址设成路由器的v6地址

实践证明，我之前折腾了好久的dhcpv6没用，但是配置也可以贴出来

...
service { 
...                     
    dhcpv6-server {                              
        shared-network-name LAN_DEAD {   
            name-server 2001:4860:4860::8888
            name-server 2001:4860:4860::8844 
            subnet 2001:470:23:xxxx:dead::/80 {   
                address-range {         
                    start 2001:470:23:xxxx:dead::1000 {
                        stop 2001:470:23:xxxx:dead::8000
                    }                            
                }                       
                name-server 2001:4860:4860::8888 
                name-server 2001:4860:4860::8844
                prefix-delegation {              
                    start 2001:470:23:xxxx:dead::1000 {
                        prefix-length 80
                    }                  
                }                          
            }                           
        }                               
    }  
}

...

service {

...

dhcpv6-server {

shared-network-name LAN_DEAD {

name-server 2001:4860:4860::8888

name-server 2001:4860:4860::8844

subnet 2001:470:23:xxxx:dead::/80 {

address-range {

start 2001:470:23:xxxx:dead::1000 {

stop 2001:470:23:xxxx:dead::8000

}

name-server 2001:4860:4860::8888

name-server 2001:4860:4860::8844

prefix-delegation {

start 2001:470:23:xxxx:dead::1000 {

prefix-length 80

}

自动更新IP

之前一片EdgeRouter Lite相关的配置文章里，我把He.net提供的DDNS配置好了。Dynamic DNS on HE.net, HE.net Dynamic DNS on Ubiquiti Router.

脚本更新

首先按如下路径生成ddns专用的key

TunnelBroker.net -> Tunnel Details -> Advanced -> Update Key

1	TunnelBroker.net -> Tunnel Details -> Advanced -> Update Key

尝试过好多次，EdgeRouter Lite无法通过配置参数添加多个同类型的ddns配置。所以先提供一个简单粗暴的方法。

参考 https://forums.he.net/index.php?topic=1994.0 的说明，有如下的客户端语法：

https://<USERNAME>:<PASSWORD>@ipv4.tunnelbroker.net/nic/update?hostname=<TUNNEL_ID>
https://ipv4.tunnelbroker.net/nic/update?username=<USERNAME>&password=<PASSWORD>&hostname=<TUNNEL_ID>

https://<USERNAME>:<PASSWORD>@ipv4.tunnelbroker.net/nic/update?hostname=<TUNNEL_ID>&myip=<IP ADDRESS>
https://ipv4.tunnelbroker.net/nic/update?username=<USERNAME>&password=<PASSWORD>&hostname=<TUNNEL_ID>&myip=<IP ADDRESS>

http[s]://[TB_USER:TB_PASS@]tunnelbroker.net/nic/update?[username=TB_USER&password=TB_PASS&]hostname=<TUNNEL_ID|tunnelTUNNEL_ID.tunnelbroker.net|TB_USER-TUNNEL_LABEL.tserv#.LOC#.ipv6.he.net>[&myip=IPV4]

https://<USERNAME>:<PASSWORD>@ipv4.tunnelbroker.net/nic/update?hostname=<TUNNEL_ID>

https://ipv4.tunnelbroker.net/nic/update?username=<USERNAME>&password=<PASSWORD>&hostname=<TUNNEL_ID>

https://<USERNAME>:<PASSWORD>@ipv4.tunnelbroker.net/nic/update?hostname=<TUNNEL_ID>&myip=<IP ADDRESS>

https://ipv4.tunnelbroker.net/nic/update?username=<USERNAME>&password=<PASSWORD>&hostname=<TUNNEL_ID>&myip=<IP ADDRESS>

http[s]://[TB_USER:TB_PASS@]tunnelbroker.net/nic/update?[username=TB_USER&password=TB_PASS&]hostname=<TUNNEL_ID|tunnelTUNNEL_ID.tunnelbroker.net|TB_USER-TUNNEL_LABEL.tserv#.LOC#.ipv6.he.net>[&myip=IPV4]

新增文件 /etc/ppp/ip-up.d/update-tunnelbroker-ip
内容如下：

#!/bin/sh

TB_USER="sskaje"
TB_PASS="P4s5W0Rd"
TB_TUNNELID="xxxxx"

IFACE="$1"
if [[ $IFACE =~ ^pppoe ]];
then
        /usr/bin/curl --silent "https://ipv4.tunnelbroker.net/nic/update?username=${TB_USER}&password=${TB_PASS}&hostname=${TB_TUNNELID}" >/dev/null 2>&1 ;
fi

# EOF

#!/bin/sh

TB_USER="sskaje"

TB_PASS="P4s5W0Rd"

TB_TUNNELID="xxxxx"

IFACE="$1"

if [[ $IFACE =~ ^pppoe ]];

then

/usr/bin/curl --silent "https://ipv4.tunnelbroker.net/nic/update?username=${TB_USER}&password=${TB_PASS}&hostname=${TB_TUNNELID}" >/dev/null 2>&1 ;

# EOF

完成后给执行权限

chmod +x /etc/ppp/ip-up.d/update-tunnelbroker-ip

1	chmod +x /etc/ppp/ip-up.d/update-tunnelbroker-ip

复用ddclient配置

早先在配置DDNS的时候做过一些尝试，结果发现删除配置时 /etc/ddclient/ 目录下自动生成的配置并未被删除。
而tunnelbroker的IP更新协议跟ddns一样都是用了dyndns风格的。
所以第二个思路是自己写个配置文件（未验证）
参考模板

daemon=1m
syslog=yes
ssl=yes
pid=/var/run/ddclient/ddclient_pppoe0_.pid
cache=/var/cache/ddclient/ddclient_pppoe0_.cache
use=if, if=pppoe0


server=dyn.dns.he.net,protocol=dyndns2
max-interval=28d
login=sskaje
password='P4s5W0Rd'
xxxxx

daemon=1m

syslog=yes

ssl=yes

pid=/var/run/ddclient/ddclient_pppoe0_.pid

cache=/var/cache/ddclient/ddclient_pppoe0_.cache

use=if, if=pppoe0

server=dyn.dns.he.net,protocol=dyndns2

max-interval=28d

password='P4s5W0Rd'

xxxxx

奇葩问题

从开始配置Tunnel到最终写这篇文章，中间隔了估计有好几个月，一直在更新IP（手动或者自动）时被提示无法连接到我的路由，HE的测试IP是 66.220.2.74。
还发邮件问过那边，也怀疑了几种可能，但是确认中国的其他IP都没问题。

就在刚才，突然想到可能是路由表错了。
因为之前整理过 Google/Twitter/Facebook 的IP段(Google IP Address Ranges, EdgeOS PPTP VPN客户端配置)，简单粗暴地直接把零散的IP段合并成一个个CIDR 16的网段，然后指向了我的pptpc0。
其中就有

network 66.220.0.0/16

1	network 66.220.0.0/16

核对了一下FB的网段，调整了路由：

# change firewall network group
delete firewall group network-group GFW-IPv4 network 66.220.0.0/16 
set firewall group network-group GFW-IPv4 network 66.220.128.0/17

# change route
delete protocols static interface-route 66.220.0.0/16 
set protocols static interface-route 66.220.128.0/17 next-hop-interface pptpc0 distance 10

# change firewall network group

delete firewall group network-group GFW-IPv4 network 66.220.0.0/16

set firewall group network-group GFW-IPv4 network 66.220.128.0/17

# change route

delete protocols static interface-route 66.220.0.0/16

set protocols static interface-route 66.220.128.0/17 next-hop-interface pptpc0 distance 10

TunnelBroker for EdgeRouter Lite by @sskaje: https://sskaje.me/2015/05/tunnelbroker-edgerouter-lite/