parent
7b6f5afc2c
commit
f4650a61d4
8 changed files with 235 additions and 2 deletions
@ -0,0 +1,88 @@ |
|||||||
|
# |
||||||
|
# rules.before |
||||||
|
# |
||||||
|
# Rules that should be run before the ufw command line added rules. Custom |
||||||
|
# rules should be added to one of these chains: |
||||||
|
# ufw-before-input |
||||||
|
# ufw-before-output |
||||||
|
# ufw-before-forward |
||||||
|
# |
||||||
|
|
||||||
|
# nat |
||||||
|
*nat |
||||||
|
-A POSTROUTING -o wlx503eaab62bc4 -j MASQUERADE |
||||||
|
#-A POSTROUTING -o wlx503eaab62bc4 -s 192.168.1.0/24 -j SNAT --to 10.10.14.152 |
||||||
|
#-A PREROUTING -i enxb827eb4bfae9 -j DNAT --to 192.168.1.2 |
||||||
|
COMMIT |
||||||
|
|
||||||
|
# Don't delete these required lines, otherwise there will be errors |
||||||
|
*filter |
||||||
|
:ufw-before-input - [0:0] |
||||||
|
:ufw-before-output - [0:0] |
||||||
|
:ufw-before-forward - [0:0] |
||||||
|
:ufw-not-local - [0:0] |
||||||
|
# End required lines |
||||||
|
|
||||||
|
# packet forwarding |
||||||
|
#-A FORWARD -i wlx503eaab62bc4 -o enxb827eb4bfae9 -m state --state RELATED,ESTABLISHED -j ACCEPT |
||||||
|
#-A FORWARD -i enxb827eb4bfae9 -o wlx503eaab62bc4 -j ACCEPT |
||||||
|
-A FORWARD -i enxb827eb4bfae9 -j ACCEPT |
||||||
|
|
||||||
|
# allow all on loopback |
||||||
|
-A ufw-before-input -i lo -j ACCEPT |
||||||
|
-A ufw-before-output -o lo -j ACCEPT |
||||||
|
|
||||||
|
# quickly process packets for which we already have a connection |
||||||
|
-A ufw-before-input -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT |
||||||
|
-A ufw-before-output -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT |
||||||
|
-A ufw-before-forward -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT |
||||||
|
|
||||||
|
# drop INVALID packets (logs these in loglevel medium and higher) |
||||||
|
-A ufw-before-input -m conntrack --ctstate INVALID -j ufw-logging-deny |
||||||
|
-A ufw-before-input -m conntrack --ctstate INVALID -j DROP |
||||||
|
|
||||||
|
# ok icmp codes for INPUT |
||||||
|
-A ufw-before-input -p icmp --icmp-type destination-unreachable -j ACCEPT |
||||||
|
-A ufw-before-input -p icmp --icmp-type source-quench -j ACCEPT |
||||||
|
-A ufw-before-input -p icmp --icmp-type time-exceeded -j ACCEPT |
||||||
|
-A ufw-before-input -p icmp --icmp-type parameter-problem -j ACCEPT |
||||||
|
-A ufw-before-input -p icmp --icmp-type echo-request -j ACCEPT |
||||||
|
|
||||||
|
# ok icmp code for FORWARD |
||||||
|
-A ufw-before-forward -p icmp --icmp-type destination-unreachable -j ACCEPT |
||||||
|
-A ufw-before-forward -p icmp --icmp-type source-quench -j ACCEPT |
||||||
|
-A ufw-before-forward -p icmp --icmp-type time-exceeded -j ACCEPT |
||||||
|
-A ufw-before-forward -p icmp --icmp-type parameter-problem -j ACCEPT |
||||||
|
-A ufw-before-forward -p icmp --icmp-type echo-request -j ACCEPT |
||||||
|
|
||||||
|
# allow dhcp client to work |
||||||
|
-A ufw-before-input -p udp --sport 67 --dport 68 -j ACCEPT |
||||||
|
|
||||||
|
# |
||||||
|
# ufw-not-local |
||||||
|
# |
||||||
|
-A ufw-before-input -j ufw-not-local |
||||||
|
|
||||||
|
# if LOCAL, RETURN |
||||||
|
-A ufw-not-local -m addrtype --dst-type LOCAL -j RETURN |
||||||
|
|
||||||
|
# if MULTICAST, RETURN |
||||||
|
-A ufw-not-local -m addrtype --dst-type MULTICAST -j RETURN |
||||||
|
|
||||||
|
# if BROADCAST, RETURN |
||||||
|
-A ufw-not-local -m addrtype --dst-type BROADCAST -j RETURN |
||||||
|
|
||||||
|
# all other non-local packets are dropped |
||||||
|
-A ufw-not-local -m limit --limit 3/min --limit-burst 10 -j ufw-logging-deny |
||||||
|
-A ufw-not-local -j DROP |
||||||
|
|
||||||
|
# allow MULTICAST mDNS for service discovery (be sure the MULTICAST line above |
||||||
|
# is uncommented) |
||||||
|
-A ufw-before-input -p udp -d 224.0.0.251 --dport 5353 -j ACCEPT |
||||||
|
|
||||||
|
# allow MULTICAST UPnP for service discovery (be sure the MULTICAST line above |
||||||
|
# is uncommented) |
||||||
|
-A ufw-before-input -p udp -d 239.255.255.250 --dport 1900 -j ACCEPT |
||||||
|
|
||||||
|
# don't delete the 'COMMIT' line or these rules won't be processed |
||||||
|
COMMIT |
@ -0,0 +1,67 @@ |
|||||||
|
# A sample configuration for dhcpcd. |
||||||
|
# See dhcpcd.conf(5) for details. |
||||||
|
|
||||||
|
# Allow users of this group to interact with dhcpcd via the control socket. |
||||||
|
#controlgroup wheel |
||||||
|
|
||||||
|
# Inform the DHCP server of our hostname for DDNS. |
||||||
|
hostname |
||||||
|
|
||||||
|
# Use the hardware address of the interface for the Client ID. |
||||||
|
clientid |
||||||
|
# or |
||||||
|
# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361. |
||||||
|
# Some non-RFC compliant DHCP servers do not reply with this set. |
||||||
|
# In this case, comment out duid and enable clientid above. |
||||||
|
#duid |
||||||
|
|
||||||
|
# Persist interface configuration when dhcpcd exits. |
||||||
|
persistent |
||||||
|
|
||||||
|
# Rapid commit support. |
||||||
|
# Safe to enable by default because it requires the equivalent option set |
||||||
|
# on the server to actually work. |
||||||
|
option rapid_commit |
||||||
|
|
||||||
|
# A list of options to request from the DHCP server. |
||||||
|
option domain_name_servers, domain_name, domain_search, host_name |
||||||
|
option classless_static_routes |
||||||
|
# Most distributions have NTP support. |
||||||
|
option ntp_servers |
||||||
|
# Respect the network MTU. This is applied to DHCP routes. |
||||||
|
option interface_mtu |
||||||
|
|
||||||
|
# A ServerID is required by RFC2131. |
||||||
|
require dhcp_server_identifier |
||||||
|
|
||||||
|
# Generate Stable Private IPv6 Addresses instead of hardware based ones |
||||||
|
slaac private |
||||||
|
|
||||||
|
# Example static IP configuration: |
||||||
|
#interface eth0 |
||||||
|
#static ip_address=192.168.0.10/24 |
||||||
|
#static ip6_address=fd51:42f8:caae:d92e::ff/64 |
||||||
|
#static routers=192.168.0.1 |
||||||
|
#static domain_name_servers=192.168.0.1 8.8.8.8 fd51:42f8:caae:d92e::1 |
||||||
|
|
||||||
|
# It is possible to fall back to a static IP if DHCP fails: |
||||||
|
# define static profile |
||||||
|
#profile static_eth0 |
||||||
|
#static ip_address=192.168.1.23/24 |
||||||
|
#static routers=192.168.1.1 |
||||||
|
#static domain_name_servers=192.168.1.1 |
||||||
|
|
||||||
|
# fallback to static profile on eth0 |
||||||
|
#interface eth0 |
||||||
|
#fallback static_eth0 |
||||||
|
|
||||||
|
#denyinterfaces lo |
||||||
|
#denyinterfaces eth0 |
||||||
|
#denyinterfaces wlan1 |
||||||
|
|
||||||
|
interface wlan0 |
||||||
|
static ip_address=192.168.4.1/24 |
||||||
|
nohook wpa_supplicant |
||||||
|
|
||||||
|
interface enxb827eb4bfae9 |
||||||
|
static ip_address=192.168.1.1/24 |
@ -0,0 +1,9 @@ |
|||||||
|
interface=wlan0 |
||||||
|
listen-address=192.168.4.1 |
||||||
|
bind-dynamic |
||||||
|
dhcp-range=192.168.4.2,192.168.4.30,255.255.255.0,24h |
||||||
|
|
||||||
|
#interface=enxb827eb4bfae9 |
||||||
|
#listen-address=192.168.1.1 |
||||||
|
#bind-dynamic |
||||||
|
#dhcp-range=192.168.1.3,192.168.1.30,255.255.255.0,24h |
@ -0,0 +1,22 @@ |
|||||||
|
# Defaults for hostapd initscript |
||||||
|
# |
||||||
|
# See /usr/share/doc/hostapd/README.Debian for information about alternative |
||||||
|
# methods of managing hostapd. |
||||||
|
# |
||||||
|
# Uncomment and set DAEMON_CONF to the absolute path of a hostapd configuration |
||||||
|
# file and hostapd will be started during system boot. An example configuration |
||||||
|
# file can be found at /usr/share/doc/hostapd/examples/hostapd.conf.gz |
||||||
|
# |
||||||
|
#DAEMON_CONF="" |
||||||
|
|
||||||
|
DAEMON_CONF="/etc/hostapd/hostapd.conf" |
||||||
|
|
||||||
|
# Additional daemon options to be appended to hostapd command:- |
||||||
|
# -d show more debug messages (-dd for even more) |
||||||
|
# -K include key data in debug messages |
||||||
|
# -t include timestamps in some debug messages |
||||||
|
# |
||||||
|
# Note that -B (daemon mode) and -P (pidfile) options are automatically |
||||||
|
# configured by the init.d script and must not be added to DAEMON_OPTS. |
||||||
|
# |
||||||
|
#DAEMON_OPTS="" |
@ -0,0 +1,14 @@ |
|||||||
|
interface=wlan0 |
||||||
|
driver=nl80211 |
||||||
|
ssid=Grand Forks Admin |
||||||
|
hw_mode=g |
||||||
|
channel=4 |
||||||
|
wmm_enabled=0 |
||||||
|
macaddr_acl=0 |
||||||
|
auth_algs=1 |
||||||
|
ignore_broadcast_ssid=0 |
||||||
|
wpa=2 |
||||||
|
wpa_passphrase=point cloud truck dust |
||||||
|
wpa_key_mgmt=WPA-PSK |
||||||
|
wpa_pairwise=TKIP |
||||||
|
rsn_pairwise=CCMP |
@ -0,0 +1,9 @@ |
|||||||
|
country=US |
||||||
|
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev |
||||||
|
update_config=1 |
||||||
|
|
||||||
|
network={ |
||||||
|
ssid="Centara Residence & Suites" |
||||||
|
key_mgmt=NONE |
||||||
|
} |
||||||
|
|
@ -0,0 +1,24 @@ |
|||||||
|
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 |
||||||
|
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 |
||||||
|
inet 127.0.0.1/8 scope host lo |
||||||
|
valid_lft forever preferred_lft forever |
||||||
|
inet6 ::1/128 scope host |
||||||
|
valid_lft forever preferred_lft forever |
||||||
|
2: enxb827eb4bfae9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 |
||||||
|
link/ether b8:27:eb:4b:fa:e9 brd ff:ff:ff:ff:ff:ff |
||||||
|
inet 192.168.1.1/24 brd 192.168.1.255 scope global enxb827eb4bfae9 |
||||||
|
valid_lft forever preferred_lft forever |
||||||
|
inet6 fe80::ce48:1ede:7476:5a8c/64 scope link |
||||||
|
valid_lft forever preferred_lft forever |
||||||
|
3: wlx503eaab62bc4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000 |
||||||
|
link/ether 50:3e:aa:b6:2b:c4 brd ff:ff:ff:ff:ff:ff |
||||||
|
inet 10.10.14.152/20 brd 10.10.15.255 scope global wlx503eaab62bc4 |
||||||
|
valid_lft forever preferred_lft forever |
||||||
|
inet6 fe80::9856:fc7c:53e1:cb8f/64 scope link |
||||||
|
valid_lft forever preferred_lft forever |
||||||
|
4: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000 |
||||||
|
link/ether b8:27:eb:1e:af:bc brd ff:ff:ff:ff:ff:ff |
||||||
|
inet 192.168.4.1/24 brd 192.168.4.255 scope global wlan0 |
||||||
|
valid_lft forever preferred_lft forever |
||||||
|
inet6 fe80::87bf:46db:ebbd:34a5/64 scope link |
||||||
|
valid_lft forever preferred_lft forever |
Loading…
Reference in new issue