#!/bin/bash # Successfully used on Intel NUC 7CJYH and Debian 10 to replace a # Bouygues BBox for French FFTH with external fiber-to-RJ45 module (ONT) # Edit the following configuration constants to fit your environment # If you want eth0, eth1... names, set GRUB_CMDLINE_LINUX="net.ifnames=0" # in /etc/default/grub then run update-grub && reboot before running this script. # # For RT_WAN_MAC snif original box mac address by plugging box WAN port # to a linux computer and with something like "sudo tcpdump -nei eno1 udp". # It happened to work for me with a fake ac:3b:77:01:02:03. DHCPD_DNSLIST="80.67.169.12,91.224.149.254" # FDN and TTN recursive open-dns DHCPD_RANGE="192.168.42.10 192.168.42.254" # Choose min/max IP within RT_LAN_IP/RT_LAN_MASK PKGS="isc-dhcp-server ssh vlan" RT_LAN_IFACE=eth0 # I prefer disabling interface renaming, "stable names" are painful for me RT_LAN_IP=192.168.42.1 RT_LAN_MASK=255.255.255.0 RT_LAN_NET=192.168.42.0 RT_WAN_IFACE=eth1 # eth1 is my USB network adapter. I don't want Intel NIC on WAN (security). RT_WAN_MAC=ac:3b:77:01:02:03 RT_WAN_VLAN=100 # Always 100 on Bouygues FTTH network #SSH_KEY="ssh-rsa AAAA...................ffsU5 lpouzenc@lud-hp1" # no carriage return allowed at all here ccommand=`tput setaf 3` ccomment=`tput setaf 6` crst=`tput sgr0` overwrite() { echo "${ccommand}editor $1${crst}" cat > $1 } trace() { echo "${ccommand}$@${crst}" "$@" } info() { echo "${ccomment}# $@${crst}" } codename=$(sed -ne 's/^VERSION_CODENAME=//p' /etc/os-release) if [[ "buster" != "$codename" ]]; then read -p "Warning: this script has only be tested on Debian Buster. Enter to continue anyway or Ctrl+C to cancel " unused fi set -e info "apt: install needed packages to have a complete SOHO router" trace apt update trace apt install -y $PKGS info "ssh: will potentially listen on WAN port, disable Password Authentification" trace sed --in-place \ -e 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/'\ /etc/ssh/sshd_config trace mkdir -p /root/.ssh [ -n "$SSH_KEY" ] && echo $SSH_KEY | overwrite /root/.ssh/authorized_keys trace systemctl reload ssh info "systemd: please don't block for ages, this hardware have normal IO delays" trace sed --in-place \ -e 's/^#\?DefaultTimeoutStartSec=.*/DefaultTimeoutStartSec=5s/' \ -e 's/^#\?DefaultTimeoutStopSec=.*/DefaultTimeoutStopSec=5s/' \ /etc/systemd/{system,user}.conf trace mkdir -p /etc/systemd/system/networking.service.d overwrite /etc/systemd/system/networking.service.d/override.conf <