mirror of
https://github.com/dragonlock2/matthewtran.com.git
synced 2025-10-11 20:17:54 +00:00
115 lines
3.8 KiB
Python
Executable File
115 lines
3.8 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
|
|
import hashlib
|
|
import subprocess
|
|
|
|
ETH = "enp5s0"
|
|
IPV4 = "192.168.1.69"
|
|
IPV6 = "69"
|
|
WG_IPV4 = "192.168.2.1"
|
|
WG_IPV6 = "fd32:76a6:ec61:577a::1"
|
|
|
|
def run(cmds):
|
|
# ssh-keygen -t ed25519
|
|
subprocess.run(["ssh", "root@OpenWrt.lan", ";".join(cmds)], check=True)
|
|
|
|
def mac():
|
|
return open(f"/sys/class/net/{ETH}/address", "r").read().strip()
|
|
|
|
def duid():
|
|
# adapted from https://github.com/mss/nm-duid
|
|
id = bytes.fromhex(open("/etc/machine-id", "r").read().strip())
|
|
return "0004" + hashlib.sha256(id).digest()[:16].hex()
|
|
|
|
def key():
|
|
priv = subprocess.check_output(["wg", "genkey"]).strip()
|
|
pub = subprocess.check_output(["wg", "pubkey"], input=priv).strip()
|
|
return (pub.decode("utf-8"), priv.decode("utf-8"))
|
|
|
|
if __name__ == "__main__":
|
|
# prevent access using WAN addresses
|
|
run([
|
|
"uci set dropbear.main.Interface='lan'",
|
|
])
|
|
|
|
# static IP
|
|
run([
|
|
"uci add dhcp host",
|
|
"uci set dhcp.@host[-1].name='matt-ryzen'",
|
|
f"uci set dhcp.@host[-1].mac='{mac()}'",
|
|
f"uci set dhcp.@host[-1].ip='{IPV4}'",
|
|
f"uci set dhcp.@host[-1].duid='{duid()}'",
|
|
f"uci set dhcp.@host[-1].hostid='{IPV6}'",
|
|
"uci commit dhcp",
|
|
"service dnsmasq restart",
|
|
"service odhcpd restart",
|
|
])
|
|
|
|
# forward traffic
|
|
PORTS = {
|
|
"http" : "80",
|
|
"https" : "443",
|
|
"git" : "2222",
|
|
"monerod" : "18080-18081",
|
|
"p2pool" : "3333",
|
|
"p2pool2" : "37888-37889",
|
|
"minecraft" : "25565",
|
|
"minecraft_be": "19132-19133",
|
|
"terraria" : "7777",
|
|
}
|
|
for name in PORTS:
|
|
run([
|
|
# IPv4 port forward
|
|
"uci add firewall redirect",
|
|
f"uci set firewall.@redirect[-1].name='{name}'",
|
|
"uci set firewall.@redirect[-1].target='DNAT'",
|
|
"uci set firewall.@redirect[-1].family='IPv4'",
|
|
"uci set firewall.@redirect[-1].src='wan'",
|
|
f"uci set firewall.@redirect[-1].src_dport='{PORTS[name]}'",
|
|
"uci set firewall.@redirect[-1].dest='lan'",
|
|
f"uci set firewall.@redirect[-1].dest_ip='{IPV4}'",
|
|
f"uci set firewall.@redirect[-1].dest_port='{PORTS[name]}'",
|
|
|
|
# IPv6 traffic rules
|
|
"uci add firewall rule",
|
|
f"uci set firewall.@rule[-1].name='allow-{name}'",
|
|
"uci set firewall.@rule[-1].src='wan'",
|
|
"uci set firewall.@rule[-1].dest='lan'",
|
|
f"uci set firewall.@rule[-1].dest_ip='::{IPV6}/-64'", # xfinity provides /64 => /-64 match
|
|
f"uci set firewall.@rule[-1].dest_port='{PORTS[name]}'",
|
|
"uci set firewall.@rule[-1].target='ACCEPT'",
|
|
])
|
|
run([
|
|
"uci commit firewall",
|
|
"service firewall restart",
|
|
])
|
|
|
|
# wireguard setup
|
|
pub, priv = key()
|
|
run([
|
|
# install packages
|
|
"opkg update",
|
|
"opkg install luci-proto-wireguard",
|
|
|
|
# create interface
|
|
"uci set network.wg0=interface",
|
|
"uci set network.wg0.proto='wireguard'",
|
|
f"uci set network.wg0.private_key='{priv}'",
|
|
"uci set network.wg0.listen_port='51820'",
|
|
f"uci add_list network.wg0.addresses='{WG_IPV4}/24'",
|
|
f"uci add_list network.wg0.addresses='{WG_IPV6}/64'",
|
|
"uci commit network",
|
|
|
|
# allow traffic
|
|
"uci del firewall.@zone[0].network",
|
|
"uci add_list firewall.@zone[0].network='lan'",
|
|
"uci add_list firewall.@zone[0].network='wg0'",
|
|
"uci add firewall rule",
|
|
"uci set firewall.@rule[-1].name='allow-wireguard'",
|
|
"uci add_list firewall.@rule[-1].proto='udp'",
|
|
"uci set firewall.@rule[-1].src='wan'",
|
|
"uci set firewall.@rule[-1].dest_port='51820'",
|
|
"uci set firewall.@rule[-1].target='ACCEPT'",
|
|
"uci commit firewall",
|
|
])
|