RaspberryPi/July 2020 - Revision history

Unknown user: /* Possibly Required - Delete Existing WPA Startup Service */

2020-08-16T23:19:13Z

Possibly Required - Delete Existing WPA Startup Service

← Older revision		Revision as of 23:19, 16 August 2020
Line 75:		Line 75:
	<pre>		<pre>
	/lib/systemd/system/multi-user.target.wants/wpa_supplicant.service		/lib/systemd/system/multi-user.target.wants/wpa_supplicant.service
			</pre>

			==Definitely Required - Delete dhcpcd Startup Service==

			The dhcpcd startup service doesn't want anything in the <code>/etc/network/interfaces</code> file, but we need to use that file to configure the wifi, so ditch the dhcpcd startup service by removing the file:

			<pre>
			/etc/systemd/system/multi-user.target.wants/dhcpcd.service
	</pre>		</pre>

Unknown user: /* Installing Stuff */

2020-07-28T21:35:10Z

Installing Stuff

← Older revision		Revision as of 21:35, 28 July 2020
Line 114:		Line 114:

	<pre>		<pre>
	apt-get -y install vim dnsutils		apt-get -y install vim dnsutils tcpdump
	</pre>		</pre>

Unknown user: /* Thing 1 */

2020-07-28T21:06:33Z

Thing 1

← Older revision		Revision as of 21:06, 28 July 2020
Line 110:		Line 110:

	=Thing 1=		=Thing 1=

			==Installing Stuff==

			<pre>
			apt-get -y install vim dnsutils
			</pre>

	==Installing PIA on Thing 1==		==Installing PIA on Thing 1==

Unknown user: /* Thing 1 Iptables */

2020-07-28T18:37:46Z

Thing 1 Iptables

← Older revision		Revision as of 18:37, 28 July 2020
Line 559:		Line 559:
	</pre>		</pre>

	Now here is the iptables script to set up the routing described above:		Now here is the iptables script to set up the routing described above. Note that we are permissive with packets (accept by default) because the Pi is behind a firewall.

	<pre>		<pre>
Line 568:		Line 568:

	# Set default policies		# Set default policies
	$ipt -P INPUT ~~DROP~~		$ipt -P INPUT ACCEPT
	$ipt -P FORWARD ~~DROP~~		$ipt -P FORWARD ACCEPT
	$ipt -P OUTPUT ACCEPT		$ipt -P OUTPUT ACCEPT

Unknown user: /* Thing 1 Iptables */

2020-07-28T17:55:33Z

Thing 1 Iptables

← Older revision		Revision as of 17:55, 28 July 2020
Line 579:		Line 579:

	# Name of PIA VPN tunnel device		# Name of PIA VPN tunnel device
	PIATUN="~~tun1"~~		PIATUN="tun0"
	~~# Name of loopback interface for PiHole DNS server~~
	~~PHDNS="lo:1~~"
	# Name of loopback interface for dnsmasq DNS server		# Name of loopback interface for dnsmasq DNS server
	DDNS="lo"		DDNS="lo"
			# Name of wifi
			WLAN="wlan0"
	# Name of hostapd AP device		# Name of hostapd AP device
	AP="wlan1"		AP="wlan1"
Line 601:		Line 601:
	# Allow incoming VPN traffic coming from 1194, part of established conversation		# Allow incoming VPN traffic coming from 1194, part of established conversation
	$ipt -A INPUT -p udp --sport 1194 -m conntrack --ctstate ESTABLISHED -j ACCEPT		$ipt -A INPUT -p udp --sport 1194 -m conntrack --ctstate ESTABLISHED -j ACCEPT


	~~########### HTTP/HTTPS ########~~
	~~# Allow incoming HTTP/HTTPS traffic, part of established conversation~~
	~~$ipt -A INPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT~~
	~~$ipt -A INPUT -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT~~

	########### DHCP ##############		########### DHCP ##############
Line 614:		Line 608:

	########### PIA VPN ##############		########### PIA VPN ##############
	~~# This is a PIA VPN tunnel that handles traffic from APs~~
	# Accept all traffic coming in from tunnel		# Accept all traffic coming in from tunnel
	$ipt -A INPUT -i ${PIATUN} -j ACCEPT		$ipt -A INPUT -i ${PIATUN} -j ACCEPT
Line 623:		Line 616:
	PROTOCOLS="tcp udp"		PROTOCOLS="tcp udp"
	for prot in $PROTOCOLS; do		for prot in $PROTOCOLS; do
	~~# General DNS Traffic:~~		# Allow incoming DNS traffic coming from 53
	# Allow incoming DNS traffic coming from 53~~, part of established conversation~~
	$ipt -A INPUT -p $prot --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT		$ipt -A INPUT -p $prot --sport 53 --dport 1024:65535 -m state --state ESTABLISHED -j ACCEPT
			# Allow external DNS queries from dnsmasq to be sent out via PIA tunnel
	# ~~PiHole DNS (lo:1) <-> PIA VPN Tunnel (tun0):~~		$ipt -A FORWARD -p $prot -i ${LO} -o ${PIATUN} --dport 53 -j ACCEPT
	~~# PiHole can always send~~ DNS queries out ~~through~~ tunnel		# Responses to DNS queries can always return via tunnel
	$ipt -A FORWARD -p $prot -i ${~~PHDNS~~} -o ${PIATUN} --dport 53 -j ACCEPT		$ipt -A FORWARD -p $prot -i ${PIATUN} -o ${LO} --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT
	# Responses to ~~PiHole~~ can always return via tunnel		# Allow loopback traffic
	$ipt -A FORWARD -p $prot -i ${PIATUN} -o ${~~PHDNS~~} --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT		$ipt -A FORWARD -p $prot -i ${LO} -o ${LO} -j ACCEPT
			# Allow DNS traffic to travel between AP and loopback
	~~# dnsmasq DNS (lo) <-> PiHole DNS (lo:1)~~
	# Allow ~~all DNS~~ traffic ~~from local dnsmasq DNS server to local PiHole DNS server~~
	$ipt -A FORWARD -p $prot -i ${~~DDNS~~} -o ${~~PHDNS~~} ~~--dport 53~~ -j ACCEPT
	~~# Allow responses to dnsmasq to return via the PiHole DNS server~~
	~~$ipt -A FORWARD -p $prot -i ${PHDNS} -o ${DDNS} --dport 53 -m state --state ESTABLISHED,RELATED -j ACCEPT~~

	~~# hostapd AP (wlan1) <-> dnsmasq DNS (lo)~~
	# Allow DNS traffic to travel ~~both ways~~ between AP and ~~dnsmasq~~
	$ipt -A FORWARD -p $prot -i ${AP} -o ${DDNS} --dport 53 -j ACCEPT		$ipt -A FORWARD -p $prot -i ${AP} -o ${DDNS} --dport 53 -j ACCEPT
	$ipt -A FORWARD -p $prot -o ${AP} -i ${DDNS} --sport 53 -j ACCEPT		$ipt -A FORWARD -p $prot -o ${AP} -i ${DDNS} --sport 53 -j ACCEPT

Unknown user: /* Connecting Hostapd and PIA */

2020-07-28T17:42:31Z

Connecting Hostapd and PIA

← Older revision		Revision as of 17:42, 28 July 2020
Line 543:		Line 543:
	To continue on the description of the setup provided above, this section describes how to achieve the following setup:		To continue on the description of the setup provided above, this section describes how to achieve the following setup:

	* ~~The main internet connection for the Pi is a physical ethernet cable~~ <code>~~eth0~~</code> ~~connected to a network~~ at <code>192.168.0.0/24</code>		* <code>wlan0</code> provides main wifi internet connection at <code>192.168.0.0/24</code>
	* ~~The hostapd wifi network is provided through a wifi card~~ <code>~~wlan0~~</code> ~~and providing a~~ network at <code>192.168.10.0/24</code>		* <code>wlan1</code> is the hostapd network, with dnsmasq handing out IPs in <code>192.168.10.0/24</code>
	* ~~The Pi runs a VPN tunnel to a PIA server, which creates the virtual device~~ <code>tun0</code>		* <code>tun0</code> is the PIA VPN tunnel
	* Traffic from ~~the~~ hostapd ~~wifi network <code>wlan0</code>~~ is tunneled through ~~the~~ PIA tunnel ~~<code>~~tun0~~</code>~~		* Traffic from hostapd wlan1 is tunneled through PIA tunnel tun0
	* NO traffic passes ~~directly~~ between ~~<code>~~wlan0~~</code>~~ and ~~<code>eth0</code>~~		* no traffic passes between wlan0 and wlan1

	To connect the hostapd network to the PIA tunnel, we need to use iptables to forward packets from one network interface to another.		To connect the hostapd network to the PIA tunnel, we need to use iptables to forward packets from one network interface to another.

Unknown user: /* Thing 1 Iptables */

2020-07-28T03:59:52Z

Thing 1 Iptables

← Older revision		Revision as of 03:59, 28 July 2020
Line 653:		Line 653:
	# Make rules persistent		# Make rules persistent
	sudo netfilter-persistent save		sudo netfilter-persistent save

	~~# Restore docker iptables rules~~
	~~sudo service docker restart~~
	</pre>		</pre>

Unknown user: /* Thing 1 Iptables */

2020-07-28T03:57:41Z

Thing 1 Iptables

@@ Line 553: / Line 553: @@
 ===Thing 1 Iptables===
-Here is the iptables script for thing 1:
+Start by installing the netfilter-persistent tool, which will make it easy to save the iptables configuration:
 <pre>
 </pre>
 =Thing 2=

Unknown user: /* Connecting Hostapd and PIA */

2020-07-28T03:53:20Z

Connecting Hostapd and PIA

← Older revision		Revision as of 03:53, 28 July 2020
Line 550:		Line 550:

	To connect the hostapd network to the PIA tunnel, we need to use iptables to forward packets from one network interface to another.		To connect the hostapd network to the PIA tunnel, we need to use iptables to forward packets from one network interface to another.

			===Thing 1 Iptables===

			Here is the iptables script for thing 1:

			<pre>
			</pre>

	=Thing 2=		=Thing 2=

Unknown user: /* Connecting Hostapd and PIA */

2020-07-28T03:51:17Z

Connecting Hostapd and PIA

@@ Line 528: / Line 528: @@
 sudo systemctl start hostapd
 </pre>
 ==Connecting Hostapd and PIA==