diff --git a/README.txt b/README.txt index 53ff98d..570ff5d 100644 --- a/README.txt +++ b/README.txt @@ -6,7 +6,6 @@ Automatically logs into a captive portal ### Python script - ``` $ sudo apt install python3 python3-pip python-virtualenv python3-virtualenv $ sudo python3 -m pip install --upgrade setuptools @@ -21,7 +20,8 @@ $ pip install -r requirements.txt ``` $ sudo apt install supervisor -$ sudo vim /etc/supervisor/conf.d/pushcards.conf +$ sudo touch /etc/supervisor/conf.d/pushcards.conf +$ sudoedit /etc/supervisor/conf.d/pushcards.conf $ sudo supervisorctl reread $ sudo supervisorctl update ``` diff --git a/config/before.rules b/config/before.rules new file mode 100644 index 0000000..ea904f3 --- /dev/null +++ b/config/before.rules @@ -0,0 +1,88 @@ +# +# rules.before +# +# Rules that should be run before the ufw command line added rules. Custom +# rules should be added to one of these chains: +# ufw-before-input +# ufw-before-output +# ufw-before-forward +# + +# nat +*nat +-A POSTROUTING -o wlx503eaab62bc4 -j MASQUERADE +#-A POSTROUTING -o wlx503eaab62bc4 -s 192.168.1.0/24 -j SNAT --to 10.10.14.152 +#-A PREROUTING -i enxb827eb4bfae9 -j DNAT --to 192.168.1.2 +COMMIT + +# Don't delete these required lines, otherwise there will be errors +*filter +:ufw-before-input - [0:0] +:ufw-before-output - [0:0] +:ufw-before-forward - [0:0] +:ufw-not-local - [0:0] +# End required lines + +# packet forwarding +#-A FORWARD -i wlx503eaab62bc4 -o enxb827eb4bfae9 -m state --state RELATED,ESTABLISHED -j ACCEPT +#-A FORWARD -i enxb827eb4bfae9 -o wlx503eaab62bc4 -j ACCEPT +-A FORWARD -i enxb827eb4bfae9 -j ACCEPT + +# allow all on loopback +-A ufw-before-input -i lo -j ACCEPT +-A ufw-before-output -o lo -j ACCEPT + +# quickly process packets for which we already have a connection +-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT +-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT + +# drop INVALID packets (logs these in loglevel medium and higher) +-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny +-A ufw-before-input -m conntrack --ctstate INVALID -j DROP + +# ok icmp codes for INPUT +-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT +-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT +-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT +-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT +-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT + +# ok icmp code for FORWARD +-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT +-A ufw-before-forward -p icmp --icmp-type source-quench -j ACCEPT +-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT +-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT +-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT + +# allow dhcp client to work +-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT + +# +# ufw-not-local +# +-A ufw-before-input -j ufw-not-local + +# if LOCAL, RETURN +-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN + +# if MULTICAST, RETURN +-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN + +# if BROADCAST, RETURN +-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN + +# all other non-local packets are dropped +-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny +-A ufw-not-local -j DROP + +# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above +# is uncommented) +-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT + +# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above +# is uncommented) +-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT + +# don't delete the 'COMMIT' line or these rules won't be processed +COMMIT diff --git a/config/dhcpcd.conf b/config/dhcpcd.conf new file mode 100644 index 0000000..3a3eb4c --- /dev/null +++ b/config/dhcpcd.conf @@ -0,0 +1,67 @@ +# A sample configuration for dhcpcd. +# See dhcpcd.conf(5) for details. + +# Allow users of this group to interact with dhcpcd via the control socket. +#controlgroup wheel + +# Inform the DHCP server of our hostname for DDNS. +hostname + +# Use the hardware address of the interface for the Client ID. +clientid +# or +# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361. +# Some non-RFC compliant DHCP servers do not reply with this set. +# In this case, comment out duid and enable clientid above. +#duid + +# Persist interface configuration when dhcpcd exits. +persistent + +# Rapid commit support. +# Safe to enable by default because it requires the equivalent option set +# on the server to actually work. +option rapid_commit + +# A list of options to request from the DHCP server. +option domain_name_servers, domain_name, domain_search, host_name +option classless_static_routes +# Most distributions have NTP support. +option ntp_servers +# Respect the network MTU. This is applied to DHCP routes. +option interface_mtu + +# A ServerID is required by RFC2131. +require dhcp_server_identifier + +# Generate Stable Private IPv6 Addresses instead of hardware based ones +slaac private + +# Example static IP configuration: +#interface eth0 +#static ip_address=192.168.0.10/24 +#static ip6_address=fd51:42f8:caae:d92e::ff/64 +#static routers=192.168.0.1 +#static domain_name_servers=192.168.0.1 8.8.8.8 fd51:42f8:caae:d92e::1 + +# It is possible to fall back to a static IP if DHCP fails: +# define static profile +#profile static_eth0 +#static ip_address=192.168.1.23/24 +#static routers=192.168.1.1 +#static domain_name_servers=192.168.1.1 + +# fallback to static profile on eth0 +#interface eth0 +#fallback static_eth0 + +#denyinterfaces lo +#denyinterfaces eth0 +#denyinterfaces wlan1 + +interface wlan0 + static ip_address=192.168.4.1/24 + nohook wpa_supplicant + +interface enxb827eb4bfae9 + static ip_address=192.168.1.1/24 diff --git a/config/dnsmasq.conf b/config/dnsmasq.conf new file mode 100644 index 0000000..ba888c0 --- /dev/null +++ b/config/dnsmasq.conf @@ -0,0 +1,9 @@ +interface=wlan0 +listen-address=192.168.4.1 +bind-dynamic +dhcp-range=192.168.4.2,192.168.4.30,255.255.255.0,24h + +#interface=enxb827eb4bfae9 +#listen-address=192.168.1.1 +#bind-dynamic +#dhcp-range=192.168.1.3,192.168.1.30,255.255.255.0,24h diff --git a/config/hostapd b/config/hostapd new file mode 100644 index 0000000..00d38f1 --- /dev/null +++ b/config/hostapd @@ -0,0 +1,22 @@ +# Defaults for hostapd initscript +# +# See /usr/share/doc/hostapd/README.Debian for information about alternative +# methods of managing hostapd. +# +# Uncomment and set DAEMON_CONF to the absolute path of a hostapd configuration +# file and hostapd will be started during system boot. An example configuration +# file can be found at /usr/share/doc/hostapd/examples/hostapd.conf.gz +# +#DAEMON_CONF="" + +DAEMON_CONF="/etc/hostapd/hostapd.conf" + +# Additional daemon options to be appended to hostapd command:- +# -d show more debug messages (-dd for even more) +# -K include key data in debug messages +# -t include timestamps in some debug messages +# +# Note that -B (daemon mode) and -P (pidfile) options are automatically +# configured by the init.d script and must not be added to DAEMON_OPTS. +# +#DAEMON_OPTS="" diff --git a/config/hostapd.conf b/config/hostapd.conf new file mode 100644 index 0000000..9325bdd --- /dev/null +++ b/config/hostapd.conf @@ -0,0 +1,14 @@ +interface=wlan0 +driver=nl80211 +ssid=Grand Forks Admin +hw_mode=g +channel=4 +wmm_enabled=0 +macaddr_acl=0 +auth_algs=1 +ignore_broadcast_ssid=0 +wpa=2 +wpa_passphrase=point cloud truck dust +wpa_key_mgmt=WPA-PSK +wpa_pairwise=TKIP +rsn_pairwise=CCMP diff --git a/config/wpa_supplicant.conf b/config/wpa_supplicant.conf new file mode 100644 index 0000000..e61a9fb --- /dev/null +++ b/config/wpa_supplicant.conf @@ -0,0 +1,9 @@ +country=US +ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev +update_config=1 + +network={ + ssid="Centara Residence & Suites" + key_mgmt=NONE +} + diff --git a/ip_addr.txt b/ip_addr.txt new file mode 100644 index 0000000..8b31992 --- /dev/null +++ b/ip_addr.txt @@ -0,0 +1,24 @@ +1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 + link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 + inet 127.0.0.1/8 scope host lo + valid_lft forever preferred_lft forever + inet6 ::1/128 scope host + valid_lft forever preferred_lft forever +2: enxb827eb4bfae9: mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 + link/ether b8:27:eb:4b:fa:e9 brd ff:ff:ff:ff:ff:ff + inet 192.168.1.1/24 brd 192.168.1.255 scope global enxb827eb4bfae9 + valid_lft forever preferred_lft forever + inet6 fe80::ce48:1ede:7476:5a8c/64 scope link + valid_lft forever preferred_lft forever +3: wlx503eaab62bc4: mtu 1500 qdisc mq state UP group default qlen 1000 + link/ether 50:3e:aa:b6:2b:c4 brd ff:ff:ff:ff:ff:ff + inet 10.10.14.152/20 brd 10.10.15.255 scope global wlx503eaab62bc4 + valid_lft forever preferred_lft forever + inet6 fe80::9856:fc7c:53e1:cb8f/64 scope link + valid_lft forever preferred_lft forever +4: wlan0: mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 + link/ether b8:27:eb:1e:af:bc brd ff:ff:ff:ff:ff:ff + inet 192.168.4.1/24 brd 192.168.4.255 scope global wlan0 + valid_lft forever preferred_lft forever + inet6 fe80::87bf:46db:ebbd:34a5/64 scope link + valid_lft forever preferred_lft forever