Commit Graph

33 Commits

Author SHA1 Message Date
Tim Wilkinson df77276075
Disable WAN access to node by default. (#854) 2023-05-29 11:22:09 -05:00
Tim Wilkinson 6aee2e1305 Block DHCP server traffic from every going to the WAN interface 2023-03-23 23:06:42 -04:00
Tim Wilkinson 8817b70b52 Remove firewall counters except for specific ports 2023-01-24 23:16:42 -08:00
Tim Wilkinson 2423bdd152
fix xlink firewall rule inserted incorrectly (#671) 2023-01-24 20:35:15 -06:00
Tim Wilkinson 93ba4ca367 Revert a forwarding rule which was changed in error 2023-01-06 20:40:51 -08:00
Tim Wilkinson d2364b83ad Fix tunnel firewall
Data destined for the firewall endpoint was being blocked by
bad rule ordering.
2023-01-05 13:02:40 -08:00
Tim Wilkinson 9ee849eb3f
More xlink firewall fixes (#581) 2022-12-23 23:00:35 -06:00
Tim Wilkinson cbbd8f81ee
Fix xlink firewall rule (#576) 2022-12-22 23:35:21 -06:00
Tim Wilkinson 6950479bf1
Update AREDN to OpenWRT 22.3.2 (Major Upgrade) (#574)
* Update to Openwrt 21.02 and add support for the CPE710 v1
Update scripts to change references to ifname to device due to a change in Openwrt naming
reverse-wpad-basic-wolfssl and disable SSL on Curl

NOTE: The compile host must have python3-distutils installed for gpsd to build

* aredn: initial working upgrade to openwrt 21.02.1

* aredn: update 1 to working upgrade to openwrt 21.02.1

* aredn: add cpe710v1 to build config

* Andrew's patches

* Remove duplicates + display perl

* Temp disable wifi extension patch

* ifname/ports support

* Add spectrum patch back in

* Generic function to extra interfaces

* New api to get wifi ifname

* Disables jails

* Style link

* aredn: partial upgrade to openwrt 22.0.3.0

added AC device images and partial migration to 22.0.3.0
firewall upgrade pending

* aredn:  update mesh-release and revert config.mk

* Unused

* NFT firewall rewrite

* Common-isze configs

* Fix network layout for hap2

* Use local packages dev (new firewall rules)

* Add HAP2

* Add pause after network restart to let bridge reinitialize

* Various lua fixes for new lua version

* Tweak config

* Re-fix networking (lost patch change)

* Add new radio names

* Tolerate missing wifi

* Fix hap-lite switch setup

* More devices

* New radio id

* Build Rocket 5AC lite

* Remove need for luci.sys

* Remove need for luci.sys

* Explicitly name wlan interfaces

* Handle different compatibility verisoning

* Update networking for switches

* ipref version bump

* Extra flag for curl

* Better compat_version fix

* Remove wolfssl

* Fix dns server

* Fix device name

* Unused

* Remove things we dont need

* Remove unused packages

* Generic macaddr overrides

* Fix uci commit

* Fix luci.template.parser to avoid luci.http loading the real thing

* Rocket-M build

* Add search-domain dhcp option

* Turn of ipv6

* No IPV6 in dnsmasq

* Override mac addresses if devices all  the same

* Working from master (for now)

* Put back hostap

* Disable old ethmac fixup

* Tweak configs

* Move back to v22.03.2
Leave ipq4019 builds to master

* Need IPV6 to compile nft firewall

* Rocket-M fixes

* Before we start

* WIP

* Working snapshot

* Cleaned patches

* Merged patch

* Single patch to support HAP2

* Fix typo

* Add nanostation-m

* 5/10Mhz patch

* 5+10MHz patch for ath10k-ct driver

* Extend 2Ghz channel check to include -4 to -1

* Add chanbw setup for ath10k (like ath9k)

* Added TP-Link CPE710 v1

* Override firmwares

* Missing patch

* Dropbear config like 3.22.8.0

* Add Ubiquiti Rocket 5AC Lite

* Fix c6

* Update

* Need more scan channels

* Remove IPV6

* Improve mac fixups

* Put back missing nft app

* IPv6 removed so dont have to disable it

* Fix rocket-m flash bug

* Fix nanostation-m

* Nanobridge is tiny

* Fix wifi order for ar750

* Rocket M5 XW support

* New rates

* Fix firewall4 so we don't need IPv6

* Allow channel width to be restricted

* Move channel list into library

* Fix naming

* Mechanism to block specific channels on specific radios

* Refresh buttons

* routerboard-sxt-5nd

* CPE605 v1.0

* Improve rocket m xw

* tpink

* Update patch

* Update to remove disable

* Remove BW restrictions on cpe710

* Restrict to what has been tested

* Remove test BW restrictions

* sxtsq-5-ac

* Update

* Update

* powerbeam-m5-300 support

* Fix

* Fix hap2

* Tidy unused patches

* Remove limit

* Add ubnt_bullet-m-ar7241

* Added ubnt_nanobeam-ac-gen2

* Fix typo

* Tolerate missing dtd ip

* Explicitly gix hap2 mac addresses

* Fix some broken patches

* Hap2 wont work at 5MHz

* Ubiquiti LiteBeam 5AC Gen2

* Fix compat_version for sxt 5ac

* Update patch

* Unused

* Fix lan configuration for some devices

* Rolling average of noise level

* Unused

* Split out the ath10k rssi monitor (its very simple at the moment)

* Ignore .DS_Store

* Reboot if ethernet doesnt come up (but only once!)

* reboot returns - add exit

* Add some logging info

* Fix ]

* Check all possibly ethernet bridges

* Improve mac fixing

* Remove HostAP on small memory devices

* Reduce dropbear footprint

* Add setsid

* Kill hostap when upgrading to save memory

* Different way to detect hostapd unavailable

* New build steps

* Improve manager logging

* Fix name conflict for the two monitors

* Try to improve test mesh name resolve problem

* Migrate tiny to generic (tiny doesnt work properly)

* Typo

* Another attempt to fix macs for Mikrotik

* Protect against missing trackers

* Fix wpad for ipq40xx

* Remove old tunnel check code

* Enable ZRAM swap to aid low memory devices

* ath10k noise can something be out of range - protect against that

* Updated with current devices and status

* Update firmware which has been tested

* Updated with more builds

* More binary/README

* Fix css error

* Start noise at sensible base level

* Unfix the css so it looks how it use to.

* Save as much memory as we can on lowmem nodes

* Hide some options on low memory devices

* Add "eol" to 32MB devices

* Restart network rather than reboot node if it seems to be broken

* Fixes

* Revert network reset

* Fix ar750 networking

* Continue to trim tiny configs

* More devices

* Dump IW output messages

* Fix Rocket 5AC intermittent ethernet issue

* Ethernet fix for PowerBeam 5AC 500

* More tiny size reduction

* More support data

* Fixed POE and USB power features

* Add Ubiquiti NanoBeam AC (gen1)

* NanoStation (not NanoBeam)

* Add mii-tool package

* Device updates

* Bump update time to 5 minutes

* Fix ethernet negotiation for rocker-5ac and nanobeam

* Fix iplookup

* Config changes based on call feedback

* Radio listing fixes

* Update with more untested builds

* Fallback TxMbps extracted from iw station dump

* Fix tunnel detection for low memory nodes

* Remove unused feed packages

* snapshot build

* Update stability info

* Add powerbeam-5ac-500

* Typo

* Add missing 3.22.1.0

* Add MikroTik LHG 5 AC

* Fix permissions

* Fix permissions

* AirGrid's take Bullet builds

* Mikrotik AC3

* Improve supportdata structure a little to make it easier to find things

* Restore WAN VLAN overrides

* Fix vlan regex for hap2 and hap3

* Support old and new style poe controls

* hap-ac3 is version 1.1

* Handle typo in some openwrt config files

* Fix HAP AC3 install

* Update hap ac3 status

* Support user overrides for network ports (non-swconfig devices)

* LHG 5AC support

* Remove -nand

* Remove non-working platform.sh change

* tunnel weight override

* Omit LinkQualityMult when value is 1

* Add mANTBox 19s and 15s

* Support ath79 mikrotik devices which require ath10k in the initramfs

Co-authored-by: apcameron <apcameron@softhome.net>
Co-authored-by: Joe AE6XE <ae6xe@arrl.net>
Co-authored-by: Joe Ayers <joe@arrl.net>
2022-12-22 14:22:49 -06:00
Tim Wilkinson 41b5040102
Improve xlink integration (#545) 2022-11-14 22:45:58 -06:00
Tim Wilkinson 806f137ae0 Add xlinks to vpn firewall zone 2022-10-04 22:06:04 -07:00
Tim Wilkinson e1ddbabb85 Migrate LAN-to-WAN options to advance configuration 2022-08-15 11:16:24 -07:00
Tim Wilkinson ac012ae7b2 Improve non-WAN firewalling 2022-08-15 11:16:24 -07:00
Tim Wilkinson c240d8a4a9 Block forwarding between LAN and WAN when necessary.
When "Prevent LAN devices from accessing WAN" is enabled
2022-08-15 11:16:24 -07:00
Tim Wilkinson b23ab5ee8a
Link Quality Management (#360)
* Link Quality Management experiment (built in)

* Protect LQM pages

* Omit "empty" mac addresses

* Integrate LQM v0.2
Includes proposed UI if this were built-in.
When LQM is enabled (advanced settings) the usual distance inputs are
replaced with "min snr' and "max distance" inputs which are the major
ones you might tweak, as well as a link to the LQM status page.
Other controls are now available (so protected) in advanced settings.

* Improve LQM updating

* Use running snr averages

* Merge app changes

* AREDN-ize the UI

* Improve status language

* Improved DtD detection

* Improve quality reporting

* Link Quality category

* Enable by default

* Better intergration

* Link => Neighbor

* Formatting

* Make sure initial page is populated without extra fetch

* Handle empty lqm.info

* Update with latest experiment algorithm changes

* Validate LQM settings before applying them

* Algorithm updates

* Improve quality reporting

* %% -> %

* Default max distance now 50 miles

* Get actual noise if radio will provide it

* low_snr => min_snr

* Dont print node description if we dont have one

* Remove properties duplicated from setup page

* Localize max distance. Miles in GB and US, Kilometers everywhere else.

* Ping link quality testing

* UDP 'ping' for quality check

* Change Active Settings title

* Expand ping test

* Improve messaging

* Add a ping penalty for neighbors which cannot be contacted in a timely manner.

* Remove user_blocks config option. No one needs to use this anymore.

* Localize distances on lqm page

* Improve status reporting

* First run emergency node setup.
When a node first runs LQM, if the default settings fail to connect to
a node we will now adjust them so that at least one node is viable.

* Restore blocking of mac addresses

* LQM now off by default
fixed #47
2022-05-18 12:49:00 -05:00
dman776 02ffc1e1b9
Revert "Prevent mesh from accessing internal LAN (#175)" (#240)
This reverts commit 86473b642e.
2022-02-28 15:45:46 -06:00
battlehax 86473b642e
Prevent mesh from accessing internal LAN (#175) 2022-02-28 14:41:22 -06:00
Joe AE6XE b53ce1e817
bugfix: aredn firewall blocking traffic when using tunnel feature (#524)
fixes #522
tested by: Matthew KB9OIV <Matthew.annen@gmail.com>
tested by: Chris K3ADA <sutehk.cs@gmail.com>

Resolves 2 issues with tunnel iptable rules.  A rule needed to be
shifted down by 1 position in chain given upgrade to openwrt 19.07.
Reload of rules was not correctly retaining chain order and creating
duplicate entries, inadvertantly blocking intended traffic.
2020-04-29 20:54:29 -05:00
Joe AE6XE 9ce76e1e7e aredn: preserve custom firewall rules across sysupgrade
groups with custom rules created in /etc/local/mesh-firewall
for echolink, ampr.net, and other integrations with internet
based appications can preserve rules across a firmware
upgrade by locating the custom rules in this directory
using a file named 59-custom-rules
2018-09-06 19:45:42 -07:00
Trevor Paskett af0e26dd84 config change to make uhttpd listen on port 80 and 8080 (#142)
* config change to make uhttpd listen on port 80 and 8080

* add port 80 to tunnel firewall rules

* add port 80 to tunnel firewall rules in config, update help

* firewall rules for wan + dtdlink
2018-08-20 14:09:47 -05:00
Joe AE6XE 53fd55b345 aredn: tunnel firewall rules upgrade to openwrt 18.06
fixes: #68
2018-07-14 21:34:00 -07:00
Conrad Lara - KG6JEI c592f44ab0 Sourcecode license text spelling correction.
Inside the source files the word "contained" was mispelled
as "conained"

The website currently lists this correctly as "contained"

This was an error in the intial stamping of the source files in
changeset:5c3ee1d0686c6e6f2907fe4fc393d86d6c5a69b5/aredn_ar71xx

Line is part of "Additional Conditions" permitted by GPLv3.
Line does not impact coders prior to the AREDN setup date
as it was added by the AREDN team.

Change-Id: I3bc09aea548100f35c08aebe8686b8d4808d56d8
Signed-off-by: Conrad Lara - KG6JEI <KG6JEI@amsat.org>
Signed-off-by: Joe Ayers <ae6xe@arrl.net>
Signed-off-by: Darryl Quinn <k5dlq@arrl.net>
Signed-off-by: Trevor Paskett - K7FPV <snoopytjp@gmail.com>
2016-12-30 18:54:05 +00:00
Darryl Quinn 35b8278b34 bugfix: traffic generated from the tun client would not forward thru the server 2016-02-23 13:20:19 -06:00
Conrad Lara - KG6JEI 29ba1c0419 bugfix: Tunnel Firewall: Accept SNMP and default to block on input chain instead of accept 2016-01-21 20:39:59 -08:00
Conrad Lara - KG6JEI 0f837d601a bugfix: Tunnel firewall rules throw a chain does not exist on firewall restart.
This chain may not exist by design of the check.

Redirect the iptables error to /dev/null so it doesn't clog logs
2016-01-16 21:20:22 -08:00
Conrad Lara - KG6JEI 5663741cb1 bugfix: On firewall reload some tunnel rules were not being inserted into the default chains which are flushed on both reload and restart of firewall by OpenWRT fw scripts. 2016-01-16 21:20:22 -08:00
AE6XE 2be20cbde2 bugfix: Tunnel firewall rule chain names are incorrect.
Based on previously reverted commit 646702aab9
2016-01-16 21:20:16 -08:00
AE6XE 06eb7fa688 bugfix: Remove erroneous reference in license header of 01-tunnels script.
Script is a new file created after the split from BBHN and did not use code from a file BBHN worked on.
2016-01-16 19:58:38 -08:00
Conrad Lara - KG6JEI 921967d5f9 Revert "bugfix: resolve bad chain ref and port from hotplug to a firewall include"
This reverts commit 646702aab9.

Needs to be broken up into separate commits and doesn't cleanly fix issue with tunnel firewall
2016-01-16 19:55:20 -08:00
AE6XE 646702aab9 bugfix: resolve bad chain ref and port from hotplug to a firewall include 2016-01-16 13:26:14 -08:00
Conrad Lara - KG6JEI e8b2ffd7ea feature: FirewallIncludes: Migrate tunnel firewal rules to new include format.
These rules setup chains that may be needed by other firewall rules as such we need to set them up early to be sure includes work.
2016-01-09 16:24:54 -08:00
Conrad Lara - KG6JEI 477a20d55a feature: FirewallIncludes: Add program that will auto include firewall rules that are in a set directory.
This is the basis for allowing packages to contain firewall rules that can be just dropped in a folder at install time.
2016-01-09 16:24:45 -08:00
Conrad Lara - KG6JEI b948d97423 Merge SDWG Mesh progress with 1.0.0 BBHN
Includes removing files that are provided by packages instead
of being embedded as binaries.

Changes made for UBNT hardware AND for newer base openwrt (Backfire)
2013-12-02 12:04:54 -08:00