![](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48"><rect fill-opacity="0"/></svg>){kind=small}
Once upon a time I had a router from a good company with the letter “Dead”. Well, that's what actually happened to him..
I looked at the prices of new ones, at the pile of computer junk in the corner, at the list of connections on my home computer... And I realized that I didn’t need a router. I'll build my own, with normal routing, DNS, WINS, i2p,blackjack and so on.
After a short excavation in iron deposits, they brought to light:
• Processor Intel Core 2 Duo E8400 @ 3GHz
• He also has an Asus P5Q motherboard with him.
• 2 DDR2 2Gb strips
• PCI-e network card TP-Link TG-3468
• Unidentified WiFi network card (b/g/n) based on Ralink RT3060
• Seagate 250Gb hard drive
The output of lshw can be viewed here.
All this was cleaned of dust, mounted in a case with a power supply, launched and tested in memtest and mhdd. Having found no defects, I began installing everything I needed.
As a basis, I took the Debian Testing distribution, rolled out through Debootstrap. openssh-server, firmware-ralink and pppoe/pppoeconf were immediately installed on top.
Having rebooted into the newly installed system, I immediately transferred SSH to 192.168.1.1 and disabled password authorization (having previously installed my own key).
To begin with, pppoeconf was launched. A network card named eth1 was connected to the DOCSIS modem, as a result the following config was obtained /etc/ppp/peers/rt:
But that's not all - you also need to configure /etc/network/interfaces as follows:
The original idea was to make 2 WiFi networks: one for their computers and laptops, with a strong password and connection to all the necessary resources, and the second for guests who wanted to access the Internet, but did not need to know about it. what's going on on my network.
As a result, hostapd was installed on the server with the following config (all network names and passwords were changed):
Here we also install a bridge for eth0 and wlan0 - this will allow those connected to our network to see it as a whole, and not the wireless segment. Modifying networks:
A little about the magic in the pre-up for wlan0: to work with multiple APs we need to use more than one MAC address. Hostapd assigns a MAC for virtual interfaces (wlan0_0 in our case) automatically, but for this to happen, the address of the first access point must have several “empty” bits at the end. I didn’t waste time on trifles and freed 4 pieces at once. Homework task - calculate how many maximum APs can now be run on one card.
Unfortunately, all computers on the network must be given IP addresses. Yes, yes, this is what we will do.
Without thinking twice, a DHCP server with the following configuration was launched on the server:
It can be seen that for 192.168.1.1/24 DNS, WINS, NTP and gateway 192.168.1.1 are also issued - it’s time to configure them.
Everything is simple with the gateway, I think only the lazy don’t know these commands:
Of course, we set iptables-persistent to save our settings, and we also write the corresponding parameters in /etc/sysctl.conf.
Now our server is a full-fledged Chinese router for $10. What? Does it seem a little weak to you? Me too. Let's move on.
I don't think anyone has forgotten that we need DNS? The simplest forwarding is ridiculously simple to set up, but we are making a full-fledged server with resolution and reverse zones... We install bind9 and configure:
Now we need forward and reverse zone files:
Just? Now let’s make sure that every computer on the network can be seen not by IP, but by DNS name.
To do this we need to configure DDNS. This technology allows you to link the DHCP server that issues addresses and the DNS server.
First, let's create a key for our DDNS:
This command will create 2 files with a DDNS key. We need the contents of the key:
«HEyb0FU9+aOXnYFQiXfiVA==" is our key.
Let's edit our DHCP config a little by adding the following options to it::
We'll do the same with DNS.:
Voila - and this killer feature works.
It so happened historically © that my provider (a contemptuous look towards Rostelecom) does not issue IPv6 (although promised).
Well, let's fix this misunderstanding. As a broker I chose sixxs.net – they have tunnel servers in Russia and their tunnel is easy to configure for dynamic IP cases.
I will omit the process of registering and obtaining tunnel/subnet settings - everything is quite simple there. I'll focus on the settings.
Configuring IPv6 on the server itself is carried out in 2 stages. First, let's install the aiccu package - this is the tunneling program. During installation, we will be asked for sixxs login and password, and some other data. After launch we will have a new interface:
The server now has access to the v6 network - why not share it with others?
First, let's enable IPv6-forwarding (don't forget to write it in /etc/sysctl.conf):
There is no need to make any settings with iptables - hello, 21st century!
Next, on the sixxs website we get the subnet. Its address will be very similar to the address of our tunnel - be careful, they are different!
After receiving an address like 2a02:578:5002:xxxx::/64, let's start setting it up. First, let's set the address 2a02:578:5002:xxxx::1 to our server by adding the following lines to interfaces:
Secondly, we will allow IPv6 to be issued to computers on the network. Let's install the radvd package and configure it as follows:
Let's add IPv6 DNS to the settings of our bind - for complete feng shui:
That's all - now we have access to, for example, ipv6.google.com, or, what is much more valuable - to ipv6.nnm-club.me ;)
I love it when everything on my network is beautiful. And this is only possible in case of complete harmony. For example, when all computers see each other. For Windows workstations, it’s fair to remember about WINS (remember, we even issued this setting in DHCP).
Setting it up is extremely simple: install the samba package. The default config needs to be changed a little:
Checking the results... Oh, everything is fine here!
By the way, since we have samba, we can immediately set up a file dump. But this is already such a hackneyed topic that I leave it on the shoulders of Google. In fact, everything should work out of the box anyway - except that read only for homes is turned off yes smbpasswd -a user…
Let's set up time distribution on the server: install ntp. With configs everything is ridiculously simple:
And here is the result:
We are already very close to microtik level routers for $150-$200. But that's not all? Of course not.
Why not have access to this network without any settings, without proxy servers, and so on? So I think “why”. First, let's install a sane version of Java:
And we’ll install the router itself:
Now let's create a zone that directs all requests to *.i2p to our server. In the bind config:
The zone itself:
Great, but how to process this now? It was trite that I couldn’t turn all the traffic to the router port - the proxy swore that it couldn’t work like that. I had to set up nginx+php5-fpm and write a small script. How to do the first part - you don’t need to search for a long time, fortunately there are plenty of manuals on the Internet. Second part:
The script itself can be seen here.
This is all! Now we have access to i2p even from our phone - no problems.
It so happened historically © that I am a remote system administrator in several companies at once. And it is very useful to have access to them from any computer on the network. We configure OpenVPN (or any other) for the server as for any other client. For example, after these steps we now have a tap0 interface with IP 10.0.0.7/24. But if we access address 10.0.0.1 from the local network, then the traffic will go to the provider’s default gateway. Let's fix this shortcoming:
We do the same for all networks on the server.
We have a full-fledged server that we can use at our discretion. DNS, nginx, IPv6, i2p... You can also set up a zone for local development, for example, *.dev, and test your sites from any device on the local network. Since each computer on the network has its own permanent IPv6 address, you can access it from anywhere in the world (Security warning! Configure firewalls correctly!).
And this is all just the tip of the iceberg. What will be its underwater part is up to you to decide.
I will be glad to hear comments, suggestions, sound criticism, etc. Thank you.
I looked at the prices of new ones, at the pile of computer junk in the corner, at the list of connections on my home computer... And I realized that I didn’t need a router. I'll build my own, with normal routing, DNS, WINS, i2p,
How it was?
After a short excavation in iron deposits, they brought to light:
• Processor Intel Core 2 Duo E8400 @ 3GHz
• He also has an Asus P5Q motherboard with him.
• 2 DDR2 2Gb strips
• PCI-e network card TP-Link TG-3468
• Unidentified WiFi network card (b/g/n) based on Ralink RT3060
• Seagate 250Gb hard drive
The output of lshw can be viewed here.
All this was cleaned of dust, mounted in a case with a power supply, launched and tested in memtest and mhdd. Having found no defects, I began installing everything I needed.
Basics
As a basis, I took the Debian Testing distribution, rolled out through Debootstrap. openssh-server, firmware-ralink and pppoe/pppoeconf were immediately installed on top.
Having rebooted into the newly installed system, I immediately transferred SSH to 192.168.1.1 and disabled password authorization (having previously installed my own key).
Let there be a network!
To begin with, pppoeconf was launched. A network card named eth1 was connected to the DOCSIS modem, as a result the following config was obtained /etc/ppp/peers/rt:
noipdefault
defaultroute
replacedefaultroute
hide-password
noauth
persist
plugin rp-pppoe.so eth1
user "ptn"
usepeerdns
But that's not all - you also need to configure /etc/network/interfaces as follows:
auto rt
iface rt inet ppp
pre-up /sbin/ifconfig eth1 up
provider rt
Turning the router into WiFi-AP
The original idea was to make 2 WiFi networks: one for their computers and laptops, with a strong password and connection to all the necessary resources, and the second for guests who wanted to access the Internet, but did not need to know about it. what's going on on my network.
As a result, hostapd was installed on the server with the following config (all network names and passwords were changed):
interface=wlan0
driver=nl80211
country_code=RU
ieee80211d=1
hw_mode=g
channel=9
ssid=Private
bridge=br0
preamble=1
ignore_broadcast_ssid=0
wpa=3
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
rsn_pairwise=CCMP
wpa_passphrase=MyVeryStrongPassword
wmm_enabled=1
ieee80211n=1
ht_capab=[HT40-][SHORT-GI-20][SHORT-GI-40]
internet=1
bss=wlan0_0
ssid=Guest
preamble=1
ignore_broadcast_ssid=0
wpa=3
wpa_key_mgmt=WPA-PSK
wpa_pairwise=TKIP CCMP
rsn_pairwise=CCMP
wpa_passphrase=passw0rd
wmm_enabled=1
ieee80211n=1
ht_capab=[HT40-][SHORT-GI-20][SHORT-GI-40]
internet=1
Here we also install a bridge for eth0 and wlan0 - this will allow those connected to our network to see it as a whole, and not the wireless segment. Modifying networks:
auto eth0 wlan0 wlan0_0 br0
iface eth0 inet manual
allow-hotplug wlan0
allow-hotplug wlan0_0
iface wlan0 inet manual
pre-up ifconfig wlan0 hw ether f2:7d:68:6d:51:30
iface br0 inet static
bridge_ports eth0 wlan0
address 192.168.1.1
netmask 24
iface wlan0_0 inet static
address 192.168.254.1
netmask 24
A little about the magic in the pre-up for wlan0: to work with multiple APs we need to use more than one MAC address. Hostapd assigns a MAC for virtual interfaces (wlan0_0 in our case) automatically, but for this to happen, the address of the first access point must have several “empty” bits at the end. I didn’t waste time on trifles and freed 4 pieces at once. Homework task - calculate how many maximum APs can now be run on one card.
Fly in - IP for everyone, free of charge!
Unfortunately, all computers on the network must be given IP addresses. Yes, yes, this is what we will do.
Without thinking twice, a DHCP server with the following configuration was launched on the server:
update-static-leases on;
authoritative;
allow unknown-clients;
use-host-decl-names on;
log-facility local7;
subnet 192.168.1.0 netmask 255.255.255.0 {
interface br0;
authoritative;
range 192.168.1.2 192.168.1.254;
option subnet-mask 255.255.255.0;
option ntp-servers 192.168.1.1;
option domain-name-servers 192.168.1.1;
option netbios-name-servers 192.168.1.1;
option routers 192.168.1.1;
option domain-name "local";
}
subnet 192.168.254.0 netmask 255.255.255.0 {
interface wlan0_0;
authoritative;
range 192.168.254.2 192.168.254.254;
option subnet-mask 255.255.255.0;
option domain-name-servers 8.8.8.8, 8.8.4.4;
option routers 192.168.254.1;
}
local-address 192.168.1.1;
It can be seen that for 192.168.1.1/24 DNS, WINS, NTP and gateway 192.168.1.1 are also issued - it’s time to configure them.
Everything is simple with the gateway, I think only the lazy don’t know these commands:
sysctl net.ipv4.ip_forward=1
iptables –t nat -A POSTROUTING -o ppp0 -j MASQUERADE
Of course, we set iptables-persistent to save our settings, and we also write the corresponding parameters in /etc/sysctl.conf.
Now our server is a full-fledged Chinese router for $10. What? Does it seem a little weak to you? Me too. Let's move on.
How do I get to the library?
I don't think anyone has forgotten that we need DNS? The simplest forwarding is ridiculously simple to set up, but we are making a full-fledged server with resolution and reverse zones... We install bind9 and configure:
options {
directory "/var/cache/bind";
forwarders {
8.8.8.8;
8.8.4.4;
};
dnssec-validation auto;
auth-nxdomain no;
listen-on { 127.0.0.1; 192.168.1.1; };
allow-transfer { none; };
version none;
};
zone "local" IN {
type master;
file "/var/lib/bind/db.localnet";
};
zone "1.168.192.in-addr.arpa" IN {
type master;
file "/var/lib/bind/db.localnet-rev";
};
Now we need forward and reverse zone files:
/var/lib/bind/db.localnet
$ORIGIN .
$TTL 86400 ; 1 day
local IN SOA ns.local. router.local. (
200216990 ; serial
28800 ; refresh (8 hours)
7200 ; retry (2 hours)
604800 ; expire (1 week)
86400 ; minimum (1 day)
)
NS ns.local.
$ORIGIN local.
$TTL 86400 ; 1 day
ns A 192.168.1.1
server A 192.168.1.1
router A 192.168.1.1
/var/lib/bind/db.localnet-rev
$ORIGIN .
$TTL 86400 ; 1 day
1.168.192.in-addr.arpa IN SOA ns.local. router.local. (
2001105214 ; serial
28800 ; refresh (8 hours)
14400 ; retry (4 hours)
3600000 ; expire (5 weeks 6 days 16 hours)
86400 ; minimum (1 day)
)
NS ns.local.
$ORIGIN 1.168.192.in-addr.arpa.
$TTL 3600 ; 1 hour
1 PTR router.local.
Just? Now let’s make sure that every computer on the network can be seen not by IP, but by DNS name.
To do this we need to configure DDNS. This technology allows you to link the DHCP server that issues addresses and the DNS server.
First, let's create a key for our DDNS:
dnssec-keygen -a HMAC-MD5 -b 128 -r /dev/urandom -n USER DDNS_UPDATE
This command will create 2 files with a DDNS key. We need the contents of the key:
cat Kddns_update.+157+36693.key
DDNS_UPDATE. IN KEY 0 3 157 HEyb0FU9+aOXnYFQiXfiVA==
«HEyb0FU9+aOXnYFQiXfiVA==" is our key.
Let's edit our DHCP config a little by adding the following options to it::
ddns-updates on;
ddns-update-style interim;
key rndc-key { algorithm HMAC-MD5; secret HEyb0FU9+aOXnYFQiXfiVA==; }
zone local. { primary 192.168.1.1; key rndc-key; }
zone 1.168.192.in-addr.arpa. { primary 192.168.1.1; key rndc-key; }
subnet 192.168.1.0 netmask 255.255.255.0 {
…
ddns-domainname "local.";
ddns-rev-domainname "in-addr.arpa.";
}
We'll do the same with DNS.:
key "rndc-key" {
algorithm hmac-md5;
secret "HEyb0FU9+aOXnYFQiXfiVA==";
};
zone "local" IN {
…
allow-update { key rndc-key; };
};
zone "1.168.192.in-addr.arpa" IN {
…
allow-update { key rndc-key; };
};
Voila - and this killer feature works.
The future is here after all. Sixth version
It so happened historically © that my provider (a contemptuous look towards Rostelecom) does not issue IPv6 (although promised).
Currently, throughout the entire length of the network, Rostelecom has provided the ability to work using the IPv6 protocol, the operator’s press service counters..
Well, let's fix this misunderstanding. As a broker I chose sixxs.net – they have tunnel servers in Russia and their tunnel is easy to configure for dynamic IP cases.
I will omit the process of registering and obtaining tunnel/subnet settings - everything is quite simple there. I'll focus on the settings.
Configuring IPv6 on the server itself is carried out in 2 stages. First, let's install the aiccu package - this is the tunneling program. During installation, we will be asked for sixxs login and password, and some other data. After launch we will have a new interface:
sixxs Link encap:IPv6-in-IPv4
inet6 addr: 2a02:578:5002:xxx::2/64 Scope:Global
UP POINTOPOINT RUNNING NOARP MTU:1280 Metric:1
…
The server now has access to the v6 network - why not share it with others?
First, let's enable IPv6-forwarding (don't forget to write it in /etc/sysctl.conf):
sysctl net.ipv6.conf.all.forwarding=1There is no need to make any settings with iptables - hello, 21st century!
Next, on the sixxs website we get the subnet. Its address will be very similar to the address of our tunnel - be careful, they are different!
After receiving an address like 2a02:578:5002:xxxx::/64, let's start setting it up. First, let's set the address 2a02:578:5002:xxxx::1 to our server by adding the following lines to interfaces:
iface br0 inet6 static
address 2a02:578:5002:xxxx::1
netmask 64
Secondly, we will allow IPv6 to be issued to computers on the network. Let's install the radvd package and configure it as follows:
interface br0
{
AdvSendAdvert on;
prefix 2a02:578:5002:xxxx::/64
{
AdvOnLink on;
AdvAutonomous on;
AdvRouterAddr on;
};
RDNSS 2a02:578:5002:xxxx::1 { };
};
Let's add IPv6 DNS to the settings of our bind - for complete feng shui:
options {
forwarders {
…
2001:4860:4860::8888;
2001:4860:4860::8844;
};
listen-on-v6 { ::1/128; 2a02:578:5002:xxxx::/64; };
…
};
That's all - now we have access to, for example, ipv6.google.com, or, what is much more valuable - to ipv6.nnm-club.me ;)
Penguin looking out the window
I love it when everything on my network is beautiful. And this is only possible in case of complete harmony. For example, when all computers see each other. For Windows workstations, it’s fair to remember about WINS (remember, we even issued this setting in DHCP).
Setting it up is extremely simple: install the samba package. The default config needs to be changed a little:
workgroup = WORKGROUP
wins support = yes
dns proxy = yes
interfaces = lo br0
bind interfaces only = yes
server role = standalone server
Checking the results... Oh, everything is fine here!
By the way, since we have samba, we can immediately set up a file dump. But this is already such a hackneyed topic that I leave it on the shoulders of Google. In fact, everything should work out of the box anyway - except that read only for homes is turned off yes smbpasswd -a user…
What time is it now?
Let's set up time distribution on the server: install ntp. With configs everything is ridiculously simple:
server 0.ru.pool.ntp.org
server 1.ru.pool.ntp.org
server 2.ru.pool.ntp.org
server 3.ru.pool.ntp.org
…
broadcast 192.168.1.1
And here is the result:
We are already very close to microtik level routers for $150-$200. But that's not all? Of course not.
Killer feature #1: I2P
Why not have access to this network without any settings, without proxy servers, and so on? So I think “why”. First, let's install a sane version of Java:
echo "deb http://ppa.launchpad.net/webupd8team/java/ubuntu precise main" >> /etc/apt/sources.list
apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys EEA14886
apt-get update
apt-get install oracle-java7-installer
And we’ll install the router itself:
echo "deb http://deb.i2p2.no/ unstable main" >> /etc/apt/sources.list
wget "http://www.i2p2.de/_static/debian-repo.pub" -O- -q | apt-key add -
apt-get update
apt-get install i2p i2p-keyring
Now let's create a zone that directs all requests to *.i2p to our server. In the bind config:
zone "i2p" IN {
type master;
file "/etc/bind/db.i2p";
};
The zone itself:
$ORIGIN i2p
$TTL 7200
i2p. IN SOA ns.i2p. hostmaster.i2p. (
2010020701 ; serial
7200 ; refresh
1800 ; retry
7200 ; expire
7200 ; minimum
)
i2p. IN NS ns.i2p.
ns.i2p. IN A 192.168.1.1
*.i2p. IN A 192.168.1.1
*.i2p. IN AAAA 2a02:578:5002:xxxx::1
Great, but how to process this now? It was trite that I couldn’t turn all the traffic to the router port - the proxy swore that it couldn’t work like that. I had to set up nginx+php5-fpm and write a small script. How to do the first part - you don’t need to search for a long time, fortunately there are plenty of manuals on the Internet. Second part:
/etc/nginx/sites-enabled/i2p
server {
listen [2a02:578:5002:xxxx::1]:80;
listen 192.168.1.1:80;
# по этому адресу можно будет получить доступ к конфигам роутера
server_name localhost.i2p;
location / {
proxy_pass http://127.0.0.1:7657;
}
}
server {
listen [2a02:578:5002:xxxx::1]:80;
listen 192.168.1.1:80;
server_name *.i2p;
location / {
fastcgi_pass unix:/var/run/php5-fpm;
include fastcgi_params;
# принудительно задаём адрес скрипта
fastcgi_param SCRIPT_FILENAME /etc/nginx/proxy.php;
# передаём скрипту параметр с адресом HTTP proxy от i2p
fastcgi_param PROXY_PASS 127.0.0.1:4444;
}
}
The script itself can be seen here.
This is all! Now we have access to i2p even from our phone - no problems.
Killer-feature #2: turning the workplace into a work network
It so happened historically © that I am a remote system administrator in several companies at once. And it is very useful to have access to them from any computer on the network. We configure OpenVPN (or any other) for the server as for any other client. For example, after these steps we now have a tap0 interface with IP 10.0.0.7/24. But if we access address 10.0.0.1 from the local network, then the traffic will go to the provider’s default gateway. Let's fix this shortcoming:
iptables -t nat -A POSTROUTING -d 10.0.0.0/24 -o tap0 -j MASQUERADE
iptables-save > /etc/iptables/rules.v4
We do the same for all networks on the server.
Instead of a conclusion
We have a full-fledged server that we can use at our discretion. DNS, nginx, IPv6, i2p... You can also set up a zone for local development, for example, *.dev, and test your sites from any device on the local network. Since each computer on the network has its own permanent IPv6 address, you can access it from anywhere in the world (Security warning! Configure firewalls correctly!).
And this is all just the tip of the iceberg. What will be its underwater part is up to you to decide.
I will be glad to hear comments, suggestions, sound criticism, etc. Thank you.
![](data:image/svg+xml,<svg xmlns="http://www.w3.org/2000/svg" width="96" height="96"><rect fill-opacity="0"/></svg>){kind=small}
