Pokazywanie postów oznaczonych etykietą EdgeMax. Pokaż wszystkie posty
Pokazywanie postów oznaczonych etykietą EdgeMax. Pokaż wszystkie posty

niedziela, 5 lutego 2017

[Ubiquity] Router EdgeMax Lite - Powrót do żywych

Witajcie jak tytuł wpisu mówi będziemy dzisiaj wskrzeszać router. Tak to nie są żarty. Zakupiłem router za 50zł który jak się okazało nie odpowiada na PING oraz nie ładuje się GUI. Resetowanie do ustawień fabrycznych też na nic się nie zdało. Co tu zrobić myślę... Ostatnią rzeczą jaką mogłem zrobić to dostać się do routera przez port "console". Na szczęście razem z routerem kupiłem przewód RJ45 do RS232. OK wszystko mam ale gdzie go podłączyć? Przypomniałem sobie że chyba na płycie głównej w komputerze posiadam taki port ale potrzebuje gniazda którego niestety nie znalazłem. Z pomocą przyszedł mój serwer wirtualizacji w domu. Pierwsze co zrobiłem to przypisałem znajdujące się w serwerze "serial porty" do wirtualnego Linuxa. Kolejnym krokiem było znaleźć jakiś program do połączenia konsolowego. Padło na minicom który instalujemy poleceniem:

apt-get install minicom

Uruchamiamy program w trybie konfiguracji.

sudo minicom -s

Rysunek 1 - Program minicom
 Następnie należy przejść do konfiguracji portu szeregowego. W moim przypadku jest to /dev/ttyS0.

Rysunek 2 - Konfiguracja portu szeregowego
Aby wylistować dostępne porty szeregowe należy użyć komendy "sudo dmesg | grep tty".

Rysunek 3 - Listowanie portów szeregowych.

Teraz podłączamy nasz router przewodem console do komputera. W moim przypadku jest to wirtualny Linux Debian. Jeżeli wszystko dobrze ustawiłeś po uruchomieniu programu komendą "sudo minicom" powinieneś uzyskać połączenie z konsolą EdgeMax.

Looking for valid bootloader image....
Jumping to start of image at address 0xbfc80000

U-Boot 1.1.1 (UBNT Build ID: 4493936-g009d77b) (Build time: Sep 20 2012 - 15:48:51)
BIST check passed.
UBNT_E100 r1:2, r2:14, serial #: DC9FDB286268
Core clock: 500 MHz, DDR clock: 266 MHz (532 Mhz data rate)
DRAM:  512 MB
Clearing DRAM....... done
Flash:  4 MB
Net:   octeth0, octeth1, octeth2
USB:   (port 0) scanning bus for devices... 1 USB Devices found
       scanning bus for storage devices...
  Device 0: Vendor:          Prod.: USB DISK 2.0     Rev: PMAP
            Type: Removable Hard Disk
            Capacity: 3700.6 MB = 3.6 GB (7579008 x 512)
 0 
reading vmlinux.64
........................................
8081560 bytes read
argv[2]: coremask=0x3
argv[3]: root=/dev/sda2
argv[4]: rootdelay=15
argv[5]: rw
argv[6]: rootsqimg=squashfs.img
argv[7]: rootsqwdir=w
argv[8]: mtdparts=phys_mapped_flash:512k(boot0),512k(boot1),64k@3072k(eeprom)
ELF file is 64 bit
Allocating memory for ELF segment: addr: 0xffffffff81100000 (adjusted to: 0x1100000), size 0x7f2a90
Allocated memory for ELF segment: addr: 0xffffffff81100000, size 0x7f2a90
Processing PHDR 0
  Loading 79a980 bytes at ffffffff81100000
  Clearing 58110 bytes at ffffffff8189a980
## Loading Linux kernel with entry point: 0xffffffff81105cd0 ...
Bootloader: Done loading app on coremask: 0x3
Linux version 2.6.32.13-UBNT (ancheng@ubnt-builder2) (gcc version 4.3.3 (Cavium Networks Version: 2_0_0 build 99) ) #1 SMP Wed Oct 24 01:08:06 PDT 2012
CVMSEG size: 2 cache lines (256 bytes)
Cavium Networks SDK-2.0
CPU revision is: 000d0601 (Cavium Octeon+)
Checking for the multiply/shift bug... no.
Checking for the daddiu bug... no.
Determined physical RAM map:
 memory: 0000000000034000 @ 000000000186c000 (usable after init)
 memory: 0000000006800000 @ 0000000001900000 (usable)
 memory: 0000000007c00000 @ 0000000008200000 (usable)
 memory: 000000000fc00000 @ 0000000410000000 (usable)
Wasting 350112 bytes for tracking 6252 unused pages
Zone PFN ranges:
  DMA32    0x0000186c -> 0x00100000
  Normal   0x00100000 -> 0x0041fc00
Movable zone start PFN for each node
early_node_map[4] active PFN ranges
    0: 0x0000186c -> 0x000018a0
    0: 0x00001900 -> 0x00008100
    0: 0x00008200 -> 0x0000fe00
    0: 0x00410000 -> 0x0041fc00
Cavium Hotplug: Available coremask 0x0
PERCPU: Embedded 10 pages/cpu @a8000000020b8000 s10624 r8192 d22144 u65536
pcpu-alloc: s10624 r8192 d22144 u65536 alloc=16*4096
pcpu-alloc: [0] 0 [0] 1 
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 63895
Kernel command line:  bootoctlinux $loadaddr coremask=0x3 root=/dev/sda2 rootdelay=15 rw rootsqimg=squashfs.img rootsqwdir=w mtdparts=phys_mapped_flash:512k(boot0),512k(boot1),64k@3072k(eeprom) console=ttyS0,115200
PID hash table entries: 1024 (order: 1, 8192 bytes)
Dentry cache hash table entries: 32768 (order: 6, 262144 bytes)
Inode-cache hash table entries: 16384 (order: 5, 131072 bytes)
Primary instruction cache 32kB, virtually tagged, 4 way, 64 sets, linesize 128 bytes.
Primary data cache 16kB, 64-way, 2 sets, linesize 128 bytes.
Memory: 483444k/491728k available (3478k kernel code, 8064k reserved, 4118k data, 208k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:152
Calibrating delay loop (skipped) preset value.. 1000.00 BogoMIPS (lpj=5000000)
Security Framework initialized
Mount-cache hash table entries: 256
Checking for the daddi bug... no.
SMP: Booting CPU01 (CoreId  1)...
CPU revision is: 000d0601 (Cavium Octeon+)
Brought up 2 CPUs
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource OCTEON_CVMCOUNT
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 2, 16384 bytes)
TCP established hash table entries: 8192 (order: 5, 131072 bytes)
TCP bind hash table entries: 8192 (order: 5, 131072 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
NET: Registered protocol family 1
/proc/octeon_perf: Octeon performace counter interface loaded
octeon_wdt: Initial granularity 5 Sec.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering unionfs 2.5.11 (for 2.6.32.55)
msgmni has been set to 944
alg: No test for stdrng (krng)
io scheduler noop registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x1180000000800 (irq = 58) is a OCTEON
console [ttyS0] enabled
loop: module loaded
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
OcteonUSB: Detected 1 ports
OcteonUSB OcteonUSB.0: Octeon Host Controller
OcteonUSB OcteonUSB.0: new USB bus registered, assigned bus number 1
OcteonUSB OcteonUSB.0: irq 80, io mem 0x00000000
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
OcteonUSB: Registered HCD for port 0 on irq 80
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver libusual
Probing USB hub...
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
TCP cubic registered
NET: Registered protocol family 17
NET: Registered protocol family 15
L2 lock: TLB refill 256 bytes
L2 lock: General exception 128 bytes
L2 lock: low-level interrupt 128 bytes
L2 lock: interrupt 640 bytes
L2 lock: memcpy 1152 bytes
Bootbus flash: Setting flash for 4MB flash at 0x1f800000
phys_mapped_flash: Found 1 x16 devices at 0x0 in 8-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
phys_mapped_flash: Swapping erase regions for broken CFI table.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
3 cmdlinepart partitions found on MTD device phys_mapped_flash
Creating 3 MTD partitions on "phys_mapped_flash":
0x000000000000-0x000000080000 : "boot0"
0x000000080000-0x000000100000 : "boot1"
0x000000300000-0x000000310000 : "eeprom"
Waiting 15sec before mounting root device...
hub 1-0:1.0: activate --> -22
usb 1-1: new high speed USB device using OcteonUSB and address 2
usb 1-1: configuration #1 chosen from 1 choice
scsi0 : SCSI emulation for USB Mass Storage devices
scsi 0:0:0:0: Direct-Access              USB DISK 2.0     PMAP PQ: 0 ANSI: 4
sd 0:0:0:0: [sda] 7579008 512-byte logical blocks: (3.88 GB/3.61 GiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Assuming drive cache: write through
 sda: sda1 sda2
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Attached SCSI removable disk
kjournald starting.  Commit interval 5 seconds
EXT3-fs warning: maximal mount count reached, running e2fsck is recommended
EXT3 FS on sda2, internal journal
EXT3-fs: recovery complete.
EXT3-fs: mounted filesystem with writeback data mode.
VFS: Mounted root (unionfs filesystem) on device 0:12.
Freeing unused kernel memory: 208k freed
Algorithmics/MIPS FPU Emulator v1.5
INIT: version 2.88 booting
SQUASHFS error: zlib_inflate error, data probably corrupt
SQUASHFS error: squashfs_read_data failed to read block 0x60
SQUASHFS error: Unable to read data cache entry [60]
SQUASHFS error: Unable to read page, block 60, size d10d
SQUASHFS error: Unable to read data cache entry [60]
SQUASHFS error: Unable to read page, block 60, size d10d
SQUASHFS error: Unable to read data cache entry [60]
SQUASHFS error: Unable to read page, block 60, size d10d
SQUASHFS error: Unable to read data cache entry [60]
SQUASHFS error: Unable to read page, block 60, size d10d
SQUASHFS error: Unable to read data cache entry [60]
SQUASHFS error: Unable to read page, block 60, size d10d

INIT: cannot execute "/etc/init.d/rcS"
INIT: Entering runlevel: 2
SQUASHFS error: Unable to read data cache entry [60]
SQUASHFS error: Unable to read page, block 60, size d10d

INIT: cannot execute "/etc/init.d/rc"
Welcome to EdgeOS (none) ttyS0
By logging in, accessing, or using the Ubiquiti product, you
acknowledge that you have read and understood the Ubiquiti
License Agreement (available in the Web UI at, by default,
http://192.168.1.1) and agree to be bound by its terms.
(none) login: 

Na czerwono zaznaczyłem wpisy informujące o tym że nie można odczytać danych. Sprawa jest prosta, pendrive jest uszkodzony. Rozwiązaniem jest wymiana pendrive. Aby sprawdzić kompatybilność urządzenie wystarczy zainstalować nowy penndrive i zobaczyć czy go wykrywa. Jeżeli tak to przystępujemy do działania.

Restartujemy router i podczas ładowania systemu naciskamy dowolny klawisz kilkukrotnie aby przejść do lini poleceń.


Ustawiamy adres IP naszego routera:
Octeon ubnt_e100# set ipaddr 10.10.1.70
Octeon ubnt_e100# set netmask 255.255.255.0

Ustawiamy adres IP servera TFTPD (http://tftpd32.jounin.net/) oraz emrk (EdgeMax Rescue Kit!) :
Octeon ubnt_e100# set serverip 10.10.1.9
Octeon ubnt_e100# set bootfile emrk-0.9c.bin

Opcjonalnie możemy ustawić naszą bramę internetową:
Octeon ubnt_e100# set gatewayip 10.10.1.254

Uruchamiamy pobieranie pliku z servera TFTPD oraz start:
Octeon ubnt_e100# tftpboot;bootoctlinux $loadaddr


Dalsza część logu:
Using octeth0 device
TFTP from server 10.10.1.9; our IP address is 10.10.1.70
Filename 'emrk-0.9c.bin'.
Load address: 0x9f00000
Loading: #################################################################
         #################################################################
         #################################################################
         #################################################################
         ##############################################
done
Bytes transferred = 15665511 (ef0967 hex), 2233 Kbytes/sec
ELF file is 64 bit
Allocating memory for ELF segment: addr: 0xffffffff81100000 (adjusted to: 0x1100000), size 0xe83940
Allocated memory for ELF segment: addr: 0xffffffff81100000, size 0xe83940
Processing PHDR 0
  Loading e23d80 bytes at ffffffff81100000
  Clearing 5fbc0 bytes at ffffffff81f23d80
## Loading Linux kernel with entry point: 0xffffffff81105ca0 ...
Bootloader: Done loading app on coremask: 0x1
#### ERROR: Unable to close pipe handle: 7
#### ERROR: Unable to shutdown usb block
Linux version 2.6.32.13-wau (dmbaturin@v-dev) (gcc version 4.3.3 (Cavium Networks Version: 2_0_0 build 95) ) #81 SMP Tue Jul 23 13:51:58 PDT 2013
CVMSEG size: 2 cache lines (256 bytes)
Cavium Networks SDK-2.0
bootconsole [early0] enabled
CPU revision is: 000d0601 (Cavium Octeon+)
Checking for the multiply/shift bug... no.
Checking for the daddiu bug... no.
Determined physical RAM map:
 memory: 000000000067b000 @ 00000000018b5000 (usable after init)
 memory: 0000000006000000 @ 0000000002000000 (usable)
 memory: 0000000007c00000 @ 0000000008200000 (usable)
 memory: 000000000fc00000 @ 0000000410000000 (usable)
Wasting 354200 bytes for tracking 6325 unused pages
Initrd not found or empty - disabling initrd
Zone PFN ranges:
  DMA32    0x000018b5 -> 0x00100000
  Normal   0x00100000 -> 0x0041fc00
Movable zone start PFN for each node
early_node_map[4] active PFN ranges
    0: 0x000018b5 -> 0x00001f30
    0: 0x00002000 -> 0x00008000
    0: 0x00008200 -> 0x0000fe00
    0: 0x00410000 -> 0x0041fc00
Cavium Hotplug: Available coremask 0x2
PERCPU: Embedded 8 pages/cpu @a8000000027b8000 s11648 r0 d21120 u65536
pcpu-alloc: s11648 r0 d21120 u65536 alloc=16*4096
pcpu-alloc: [0] 0
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 63455
Kernel command line:  bootoctlinux $loadaddr console=ttyS0,115200
PID hash table entries: 1024 (order: 1, 8192 bytes)
Dentry cache hash table entries: 32768 (order: 6, 262144 bytes)
Inode-cache hash table entries: 16384 (order: 5, 131072 bytes)
Primary instruction cache 32kB, virtually tagged, 4 way, 64 sets, linesize 128 bytes.
Primary data cache 16kB, 64-way, 2 sets, linesize 128 bytes.
Memory: 475308k/489964k available (3808k kernel code, 14444k reserved, 4082k data, 6636k init, 0k highmem)
Hierarchical RCU implementation.
NR_IRQS:152
Calibrating delay loop (skipped) preset value.. 1000.00 BogoMIPS (lpj=5000000)
Security Framework initialized
Mount-cache hash table entries: 256
Checking for the daddi bug... no.
Brought up 1 CPUs
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource OCTEON_CVMCOUNT
NET: Registered protocol family 2
IP route cache hash table entries: 2048 (order: 2, 16384 bytes)
IPv4 FIB: Using LC-trie version 0.409
TCP established hash table entries: 8192 (order: 5, 131072 bytes)
TCP bind hash table entries: 8192 (order: 5, 131072 bytes)
TCP: Hash tables configured (established 8192 bind 8192)
TCP reno registered
NET: Registered protocol family 1
/proc/octeon_perf: Octeon performace counter interface loaded
octeon_wdt: Initial granularity 5 Sec.
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering unionfs 2.5.11 (for 2.6.32.55)
msgmni has been set to 928
alg: No test for cipher_null (cipher_null-generic)
alg: No test for ecb(cipher_null) (ecb-cipher_null)
alg: No test for digest_null (digest_null-generic)
alg: No test for compress_null (compress_null-generic)
alg: No test for stdrng (krng)
alg: No test for ghash (ghash-generic)
io scheduler noop registered
io scheduler cfq registered (default)
octeon_rng octeon_rng: Octeon Random Number Generator
Serial: 8250/16550 driver, 2 ports, IRQ sharing disabled
serial8250.0: ttyS0 at MMIO 0x1180000000800 (irq = 58) is a OCTEON
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
loop: module loaded
mdio-octeon: probed
mdio-octeon mdio-octeon.0: Version 1.0

ERROR: You must specify a broadcast group mask.
octeon-ethernet 2.0
Interface 0 has 3 ports (RGMII)
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
OcteonUSB: Detected 1 ports
OcteonUSB OcteonUSB.0: Octeon Host Controller
OcteonUSB OcteonUSB.0: new USB bus registered, assigned bus number 1
OcteonUSB OcteonUSB.0: irq 80, io mem 0x00000000
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
OcteonUSB: Registered HCD for port 0 on irq 80
Initializing USB Mass Storage driver...
usbcore: registered new interface driver usb-storage
USB Mass Storage support registered.
usbcore: registered new interface driver libusual
Probing USB hub...
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
TCP cubic registered
Initializing XFRM netlink socket
NET: Registered protocol family 10
lo: Disabled Privacy Extensions
Mobile IPv6
IPv6 over IPv4 tunneling driver
sit0: Disabled Privacy Extensions
ip6tnl0: Disabled Privacy Extensions
NET: Registered protocol family 17
NET: Registered protocol family 15
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
L2 lock: TLB refill 256 bytes
L2 lock: General exception 128 bytes
L2 lock: low-level interrupt 128 bytes
L2 lock: interrupt 640 bytes
L2 lock: memcpy 1152 bytes
Bootbus flash: Setting flash for 4MB flash at 0x1f800000
phys_mapped_flash: Found 1 x16 devices at 0x0 in 8-bit bank
 Amd/Fujitsu Extended Query Table at 0x0040
phys_mapped_flash: Swapping erase regions for broken CFI table.
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Freeing unused kernel memory: 6636k freed
Algorithmics/MIPS FPU Emulator v1.5
init started: BusyBox v1.17.1 (Debian 1:1.17.1-8)
starting pid 203, tty '': '/etc/init.d/rcS'
hub 1-0:1.0: activate --> -22
usb 1-1: new high speed USB device using OcteonUSB and address 2
usb 1-1: configuration #1 chosen from 1 choice
scsi0 : SCSI emulation for USB Mass Storage devices
eth0: 1000 Mbps Full duplex, port  0, queue  0
scsi 0:0:0:0: Direct-Access     TOSHIBA  TransMemory      PMAP PQ: 0 ANSI: 0 CCS
sd 0:0:0:0: [sda] 15240576 512-byte logical blocks: (7.80 GB/7.26 GiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Assuming drive cache: write through
 sda:
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Attached SCSI removable disk
Loading EMRK 0.9a
Mounting filesystems
Bringing up eth0
Checking boot partition
Boot partition looks intact
Attempting to mount boot partition
mount: mounting /dev/sda1 on /mnt/boot failed: No such device or address
Could not mount boot partition!
Checking root partition
Root partition is missing or has wrong filesystem type!
**********************************************
Welcome to EdgeMax Rescue Kit!
This tool is distributed under the terms of
GNU General Public License and other licenses
Brought to you by SO3 Group
WARNING: This tool is not developed, officially
supported or endorsed by Ubiquiti Networks!
Using it may lead to destroying your router
configuration or operating system
Ubiquiti Networks support will not help you
with using it or fixing consequences of
using it.
This tool itself is distributed without any
warranty and authors are not liable for
any damage it may cause
By using this tool you agree you are doing
it at your own risk and understand what
you are doing
*********************************************
Enter 'Yes' to proceed, 'No' to reboot
yes or no: Yes

Potwierdzamy działanie narzędzia na własną odpowiedzialność wpisując Yes.

Czy chcesz skonfigurować połączenie za pomocą serwera DHCP?
Do you want to configure network via DHCP?yes or no: Yes


udhcpc (v1.17.1) started
Sending discover...
Sending select for 10.10.1.108...
Lease of 10.10.1.108 obtained, lease time 86400
/usr/share/udhcpc/default.script: Resetting default routes
route: SIOCDELRT: No such process
/usr/share/udhcpc/default.script: Adding DNS 10.10.1.254
EMRK provides some scripts for automated
recovery procedures:
emrk-factory-reset -- reset config to factory default
emrk-remove-user-data -- remove all the user data including
    config and everything
emrk-reinstall -- reinstall EdgeOS from scratch
    (wipes any user data too)
Enter 'reboot' to reboot your router

BusyBox v1.17.1 (Debian 1:1.17.1-8) built-in shell (ash)
Enter 'help' for a list of built-in commands.
/bin/ash: can't access tty; job control turned off
EMRK>emrk-reinstall 
Wpisujemy emrk-reinstall aby przeinstalować nasz system od zera.


WARNING: This script will reinstall EdgeOS from scratch
If you have any usable data on your router storage,
it will be irrecoverably destroyed!
Do you want to continue?
yes or no: yes
Re-creating partition table
Creating boot partition
Formatting boot partition
mkfs.vfat 3.0.9 (31 Jan 2010)
Creating root partition
Formatting root partition
Mounting boot parition
Mounting root partition
kjournald starting.  Commit interval 5 seconds
EXT3 FS on sda2, internal journal
EXT3-fs: mounted filesystem with writeback data mode.
Enter EdgeOS image url: http://dl.ubnt.com/firmwares/edgemax/v1.9.1/ER-e100.v1.9.1.4939093.tar
Podajemy adres do najnowszej wersji oprogramowania ze strony:
https://www.ubnt.com/download/edgemax/edgerouter-lite/erlite3 
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 82.9M  100 82.9M    0     0  13.2M      0  0:00:06  0:00:06 --:--:-- 14.2M
Unpacking EdgeOS release image
Verifying EdgeOS kernel
Copying EdgeOS kernel to boot partition
Verifying EdgeOS system image
Copying EdgeOS system image to root partition
Copying version file to the root partition
Creating EdgeOS writable data directory
Cleaning up
Installation finished
Please reboot your router
EMRK>reboot
Restartujemy router wpisując reboot.

starting pid 280, tty '': '/bin/umount -a -r'
The system is going down NOW!
Sent SIGTERM to all processes
Sent SIGKILL to all processes
Requesting system reboot
Restarting system.
Looking for valid bootloader image....
Jumping to start of image at address 0xbfc80000

U-Boot 1.1.1 (UBNT Build ID: 4493936-g009d77b) (Build time: Sep 20 2012 - 15:48:51)
BIST check passed.
UBNT_E100 r1:2, r2:14, serial #: DC9FDB286268
Core clock: 500 MHz, DDR clock: 266 MHz (532 Mhz data rate)
DRAM:  512 MB
Clearing DRAM....... done
Flash:  4 MB
Net:   octeth0, octeth1, octeth2
USB:   (port 0) scanning bus for devices... 1 USB Devices found
       scanning bus for storage devices...
  Device 0: Vendor: TOSHIBA  Prod.: TransMemory      Rev: PMAP
            Type: Removable Hard Disk
            Capacity: 7441.6 MB = 7.2 GB (15240576 x 512)
 0
reading vmlinux.64
..................................
6882440 bytes read
argv[2]: coremask=0x3
argv[3]: root=/dev/sda2
argv[4]: rootdelay=15
argv[5]: rw
argv[6]: rootsqimg=squashfs.img
argv[7]: rootsqwdir=w
argv[8]: mtdparts=phys_mapped_flash:512k(boot0),512k(boot1),64k@3072k(eeprom)
ELF file is 64 bit
Allocating memory for mapped kernel segment, alignment: 0x400000
Allocated memory for ELF segment: addr: 0x400000, size 0x7de180
Processing PHDR 0
  Loading 68ee80 bytes at 400000
  Clearing 14f300 bytes at a8ee80
## Loading Linux kernel with entry point: 0x008ec0c0 ...
Bootloader: Done loading app on coremask: 0x3
Linux version 3.10.20-UBNT (root@ubnt-builder2) (gcc version 4.7.0 (Cavium Inc. Version: SDK_3_1_0_p2 build 34) ) #1 SMP Fri Dec 2 02:30:08 PST 2016
CVMSEG size: 2 cache lines (256 bytes)
Cavium Inc. SDK-3.1
bootconsole [early0] enabled
CPU revision is: 000d0601 (Cavium Octeon+)
Checking for the multiply/shift bug... no.
Checking for the daddiu bug... no.
Determined physical RAM map:
 memory: 0000000007400000 @ 0000000000c00000 (usable)
 memory: 0000000007c00000 @ 0000000008200000 (usable)
 memory: 000000000fc00000 @ 0000000410000000 (usable)
 memory: 000000000064c000 @ 0000000000400000 (usable)
 memory: 0000000000044000 @ 0000000000a4c000 (usable after init)
Wasting 57344 bytes for tracking 1024 unused pages
software IO TLB [mem 0x01707000-0x01747000] (0MB) mapped at [8000000001707000-8000000001746fff]
Zone ranges:
  DMA32    [mem 0x00400000-0xefffffff]
  Normal   [mem 0xf0000000-0x41fbfffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x00400000-0x00a8ffff]
  node   0: [mem 0x00c00000-0x07ffffff]
  node   0: [mem 0x08200000-0x0fdfffff]
  node   0: [mem 0x410000000-0x41fbfffff]
Primary instruction cache 32kB, virtually tagged, 4 way, 64 sets, linesize 128 bytes.
Primary data cache 16kB, 64-way, 2 sets, linesize 128 bytes.
Secondary unified cache 128kB, 8-way, 128 sets, linesize 128 bytes.
PERCPU: Embedded 10 pages/cpu @8000000001784000 s11904 r8192 d20864 u40960
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 125887
Kernel command line:  bootoctlinux $loadaddr coremask=0x3 root=/dev/sda2 rootdelay=15 rw rootsqimg=squashfs.img rootsqwdir=w mtdparts=phys_mapped_flash:512k(boot0),512k(boot1),64k@3072k(eeprom) console=ttyS0,115200
PID hash table entries: 2048 (order: 2, 16384 bytes)
Dentry cache hash table entries: 65536 (order: 7, 524288 bytes)
Inode-cache hash table entries: 32768 (order: 6, 262144 bytes)
Memory: 495244k/510528k available (5090k kernel code, 15284k reserved, 1354k data, 272k init, 0k highmem)
Hierarchical RCU implementation.
        Additional per-CPU info printed with stalls.
NR_IRQS:255
Calibrating delay loop (skipped) preset value.. 1000.00 BogoMIPS (lpj=5000000)
pid_max: default: 32768 minimum: 501
Security Framework initialized
Mount-cache hash table entries: 256
Checking for the daddi bug... no.
SMP: Booting CPU01 (CoreId  1)...
CPU revision is: 000d0601 (Cavium Octeon+)
Brought up 2 CPUs
NET: Registered protocol family 16
bio: create slab <bio-0> at 0
SCSI subsystem initialized
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Switching to clocksource OCTEON_CVMCOUNT
NET: Registered protocol family 2
TCP established hash table entries: 4096 (order: 4, 65536 bytes)
TCP bind hash table entries: 4096 (order: 4, 65536 bytes)
TCP: Hash tables configured (established 4096 bind 4096)
TCP: reno registered
UDP hash table entries: 256 (order: 1, 8192 bytes)
UDP-Lite hash table entries: 256 (order: 1, 8192 bytes)
NET: Registered protocol family 1
octeon_pci_console: Console not created.
/proc/octeon_perf: Octeon performance counter interface loaded
HugeTLB registered 2 MB page size, pre-allocated 0 pages
squashfs: version 4.0 (2009/01/31) Phillip Lougher
Registering unionfs 2.5.13 (for 3.10.34)
msgmni has been set to 967
io scheduler noop registered
io scheduler cfq registered (default)
Serial: 8250/16550 driver, 6 ports, IRQ sharing disabled
1180000000800.serial: ttyS0 at MMIO 0x1180000000800 (irq = 34) is a OCTEON
console [ttyS0] enabled, bootconsole disabled
console [ttyS0] enabled, bootconsole disabled
1180000000c00.serial: ttyS1 at MMIO 0x1180000000c00 (irq = 35) is a OCTEON
loop: module loaded
ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver
ohci_hcd: USB 1.1 'Open' Host Controller (OHCI) Driver
OcteonUSB 16f0010000000.usbc: Octeon Host Controller
OcteonUSB 16f0010000000.usbc: new USB bus registered, assigned bus number 1
OcteonUSB 16f0010000000.usbc: irq 56, io mem 0x00000000
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
OcteonUSB: Registered HCD for port 0 on irq 56
usbcore: registered new interface driver usb-storage
octeon_wdt: Initial granularity 5 Sec
TCP: cubic registered
NET: Registered protocol family 17
NET: Registered protocol family 15
Bootbus flash: Setting flash for 4MB flash at 0x1f800000
phys_mapped_flash: Found 1 x16 devices at 0x0 in 8-bit bank. Manufacturer ID 0x0000c2 Chip ID 0x0000a7
Amd/Fujitsu Extended Query Table at 0x0040
  Amd/Fujitsu Extended Query version 1.1.
phys_mapped_flash: Swapping erase regions for top-boot CFI table.
number of CFI chips: 1
3 cmdlinepart partitions found on MTD device phys_mapped_flash
Creating 3 MTD partitions on "phys_mapped_flash":
0x000000000000-0x000000080000 : "boot0"
0x000000080000-0x000000100000 : "boot1"
0x000000300000-0x000000310000 : "eeprom"
Waiting 15sec before mounting root device...
usb 1-1: new high-speed USB device number 2 using OcteonUSB
usb-storage 1-1:1.0: USB Mass Storage device detected
scsi0 : usb-storage 1-1:1.0
scsi 0:0:0:0: Direct-Access     TOSHIBA  TransMemory      PMAP PQ: 0 ANSI: 0 CCS
sd 0:0:0:0: [sda] 15240576 512-byte logical blocks: (7.80 GB/7.26 GiB)
sd 0:0:0:0: [sda] Write Protect is off
sd 0:0:0:0: [sda] No Caching mode page found
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] No Caching mode page found
sd 0:0:0:0: [sda] Assuming drive cache: write through
 sda: sda1 sda2
sd 0:0:0:0: [sda] No Caching mode page found
sd 0:0:0:0: [sda] Assuming drive cache: write through
sd 0:0:0:0: [sda] Attached SCSI removable disk
kjournald starting.  Commit interval 3 seconds
EXT3-fs (sda2): using internal journal
EXT3-fs (sda2): mounted filesystem with journal data mode
VFS: Mounted root (unionfs filesystem) on device 0:11.
Freeing unused kernel memory: 272K (ffffffffc064c000 - ffffffffc0690000)
Algorithmics/MIPS FPU Emulator v1.5
INIT: version 2.88 booting
INIT: Entering runlevel: 2
[....] Starting routing daemon: rib nsm ribd. ok
[....] Starting EdgeOS router: migrate rl-system configure. ok
Welcome to EdgeOS ubnt ttyS0
By logging in, accessing, or using the Ubiquiti product, you
acknowledge that you have read and understood the Ubiquiti
License Agreement (available in the Web UI at, by default,
http://192.168.1.1) and agree to be bound by its terms.
ubnt login: ubnt
Password: 
Logujemy się używając domyślnego loginu i hasła ubnt/ubnt. Konfigurujemy przydział adresu na porcie eth0 z DHCP.

Linux ubnt 3.10.20-UBNT #1 SMP Fri Dec 2 02:30:08 PST 2016 mips64
Welcome to EdgeOS

ubnt@ubnt:~$ configure
ubnt@ubnt# delete interfaces ethernet eth0 address 192.168.1.1/24
ubnt@ubnt# set interfaces ethernet eth0 address dhcp
ubnt@ubnt# commit

[ interfaces ethernet eth0 address dhcp ]
Starting DHCP client on eth0 ...

ubnt@ubnt# save

Saving configuration to '/config/config.boot'...
Done

ubnt@ubnt# run show interfaces ethernet
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface    IP Address                        S/L  Description                
---------    ----------                        ---  -----------                
eth0         10.10.1.103/24                    u/u                            
eth1         -                                 u/D                            
eth2         -                                 u/D        
Logujemy się na nasz router z adresu otrzymanego za pomocą serwera DHCP.

Rysunek 4 - Strona startowa EdgeMAX
Wszystko zostało pomyślnie zainstalowane teraz tylko trzeba przerobić pendrive aby się schował w obudowie. U mnie wygląda to tak:

Rysunek 5 - Router EdgeMAX od środka z zmodyfikowanym pendrive.
Podsumowując kupiłem uszkodzony router za 50zł + przewód consolowy RJ45->RS232 10zł + pendrive 8GB Toshiba (posiadałem) zyskałem sprzęt wart kilkaset złotych.

Rysunek 6 - EdgeMAX Lite po reanimacji

wtorek, 21 czerwca 2016

[Ubiquity] EdgeMax Firmware Upgrade via CLI

W tym wpisie pokażę wam jak szybko zaktualizować wasz router do najnowszej wersji oprogramowania z linii poleceń. Według mnie jest to najszybsza i najwygodniejsza metoda aktualizacji. Jako pierwszy krok musimy wejść na stronę Ubiquity i skopiować link do pobierania.

Rysunek 1 - Strona pobierania

W moim przypadku jest to zakreślony link który kopiujemy do schowka. Logujemy się do naszego routera przez SSH za pomocą klienta (np. Putty lub Xshell). 

Lista przydatnych komend:

 Rysunek 2 - show version - pokazuje aktualną wersję firmware


Rysunek 3 - add system image *adres_url* - dodajemy adres naszego pliku z firmware


Rysunek 4 - show system image - pokazuje wersje systemów które posiadamy 

Teraz musimy wykonać restart routera aby nasz aktualnie uruchomiony obraz został zamieniony nowym. Po ponownym rozruchu należy sprawdzić aktualnie używaną wersję i usunąć starą.

 Rysunek 5 - Sprawdzamy wersję firmware po restarcie routera

 Rysunek 6 - Kasujemy stary obraz systemu

Jeżeli nie jesteśmy pewni nowej aktualizacji możemy zostawić stary obraz aby wrazie problemów do niego powrócić. Wystarczy użyć komendy "set system image default-boot"

Rysunek 7 - Przełączanie pomiędzy dostępnymi wersjami firmware

Mam nadzieję że ten wpis pomógł Ci uporać się z aktualizacją firmware. Dla mnie jest to najwygodniejszy sposób aktualizacji gdyż z poziomu GUI miewałem problemy.

piątek, 5 grudnia 2014

[Ubiquity] EdgeMax Lite Router - OpenVPN Remote Access

1. Wstęp
2. Wygenerowanie certyfikatu CA
3. Wygenerowanie klucza dla serwera CA
4. Wygenerowanie klucza dla klienta który będzie się łączyć do serwera OpenVPN z własnym certyfikatem
5. Wygenerowanie pliku szyfrującego w oparciu o protokół  Diffiego-Hellmana
6. Konfiguracja interfejsu vtun1 na urządzeniu Ubiquiti EdgeRouter
7. Konfiguracja protokołu SSH z poziomu Linuxa Ubiquiti EdgeRouter oraz ściągniecie plików dla klienta w celu zdalnego połączenia.
8. Test połączenia
9. Firewall

1. Wstęp
Logujemy się do naszego routera poprzez klienta SSH.



Wchodzimy w tryb powłoki systemu.

sudo su

Kopiujemy pliki OpenVPN’a do /config/auth/ca, oraz tworzymy folder „keys”

cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0 /config/auth/ca
cd /config/auth/ca/
mkdir keys
source vars
(Konsola zwróci nam taki komunikat):
NOTE: If you run ./clean-all, I will be doing a rm -rf on /config/auth/ca/keys

Używamy zatem komendy
./clean-all

2. Wygenerowanie certyfikatu CA
./build-ca

Generating a 1024 bit RSA private key
.......................................++++++
...........++++++
writing new private key to 'ca.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:PL
State or Province Name (full name) [CA]:Kujawsko-Pomorskie
Locality Name (eg, city) [SanFrancisco]:Bydgoszcz
Organization Name (eg, company) [Fort-Funston]:KlimasStudio
Organizational Unit Name (eg, section) [changeme]:Octopus
Common Name (eg, your name or your server's hostname) [changeme]:ERL05-Bydgoszcz-Gajowa-PL
Name [changeme]:Octopus
Email Address [mail@host.domain]:host@name.com.pl

3. Wygenerowanie klucza dla serwera CA
./build-key-server ERL05-Bydgoszcz-Gajowa-PL-Server

Generating a 1024 bit RSA private key
........++++++
...........++++++
writing new private key to 'ERL05-Bydgoszcz-Gajowa-PL-Server.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:PL
State or Province Name (full name) [CA]:Kujawsko-Pomorskie
Locality Name (eg, city) [SanFrancisco]:Bydgoszcz
Organization Name (eg, company) [Fort-Funston]:KlimasStudio
Organizational Unit Name (eg, section) [changeme]:Octopus
Common Name (eg, your name or your server's hostname) [ERL05-Bydgoszcz-Gajowa-PL-Server]:
Name [changeme]:Octopus
Email Address [mail@host.domain]:host@name.com.pl

Please enter the following 'extra' attributes

to be sent with your certificate request
A challenge password []:**********
An optional company name []:KlimasStudio
Using configuration from /config/auth/ca/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'PL'
stateOrProvinceName   :PRINTABLE:'Kujawsko-Pomorskie'
localityName          :PRINTABLE:'Bydgoszcz'
organizationName      :PRINTABLE:'KlimasStudio'
organizationalUnitName:PRINTABLE:'Octopus'
commonName            :PRINTABLE:'ERL05-Bydgoszcz-Gajowa-PL-Server'
name                  :PRINTABLE:'Octopus'
emailAddress          :IA5STRING:'host@name.com.pl'
Certificate is to be certified until Dec  1 21:21:02 2024 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

4. Wygenerowanie klucza dla klienta który będzie się łączyć do serwera OpenVPN z własnym certyfikatem

source vars
NOTE: If you run ./clean-all, I will be doing a rm -rf on /config/auth/ca/keys

./build-key ERL05-Bydgoszcz-Gajowa-PL-Client
Generating a 1024 bit RSA private key
..................++++++
..............++++++
writing new private key to 'ERL05-Bydgoszcz-Gajowa-PL-Client.key'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [US]:PL
State or Province Name (full name) [CA]:Kujawsko-Pomorskie
Locality Name (eg, city) [SanFrancisco]:Bydgoszcz
Organization Name (eg, company) [Fort-Funston]:KlimasStudio
Organizational Unit Name (eg, section) [changeme]:Octopus
Common Name (eg, your name or your server's hostname) [ERL05-Bydgoszcz-Gajowa-PL-Client]:
Name [changeme]:Octopus
Email Address [mail@host.domain]:hostl@name.com.pl

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:**********
An optional company name []:KlimasStudio
Using configuration from /config/auth/ca/openssl-1.0.0.cnf
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
countryName           :PRINTABLE:'PL'
stateOrProvinceName   :PRINTABLE:'Kujawsko-Pomorskie'
localityName          :PRINTABLE:'Bydgoszcz'
organizationName      :PRINTABLE:'KlimasStudio'
organizationalUnitName:PRINTABLE:'Octopus'
commonName            :PRINTABLE:'ERL05-Bydgoszcz-Gajowa-PL-Client'
name                  :PRINTABLE:'Octopus'
emailAddress          :IA5STRING:'host@name.com.pl'
Certificate is to be certified until Dec  1 21:25:18 2024 GMT (3650 days)
Sign the certificate? [y/n]:y


1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated

5. Wygenerowanie pliku szyfrujacego w opaciu o protokół Diffiego-Hellmana
Ten proces może potrwać kilka minut 5-10.

./build-dh
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
.......................+............................................................................................................................................................................................................+....+......................................+............................................................................................................................................+.................................................................+.........................................................................................................................................................................+..................................................................................................+.............+........................................+.................................+..................................................................................................................................................................................................................................................................................................................+.......+..........................................+..............................+.....................................+...................................+...........................................................++*++*++*

6. Konfiguracja interfejsu vtun1 na urzadzeniu Ubiquiti EdgeRouterKopiujemy wygenerowane klucze z folderu /config/auth/ca/keys do /config/auth/openvpn/ERL05-Bydgoszcz-Gajowa-PL-Remote-Access.

cd /config/auth
mkdir openvpn
cd openvpn
mkdir ERL05-Bydgoszcz-Gajowa-PL-Remote-Access
cp /config/auth/ca/keys/* /config/auth/openvpn/ERL05-Bydgoszcz-Gajowa-PL-Remote-Access

Wychodzimy z trybu powłoki.
exit

Wchodzimy do konfiguracji. Ustawiamy opis tunelu, port. Ustawiamy tryb server i dodajemy wpisy o serwerze nazw, interfejsach które mają być dostępne w tunelu oraz podsieć w jakiej mają znajdować się urządzenia podłączane tunelem.

configure
set interfaces openvpn vtun1 description "ERL05-Bydgoszcz-Gajowa-PL"
set interfaces openvpn vtun1 local-port 1195
set interfaces openvpn vtun1 mode server
set interfaces openvpn vtun1 server name-server 10.10.1.12
set interfaces openvpn vtun1 server push-route 10.10.1.0/24
set interfaces openvpn vtun1 server push-route 10.10.2.0/24
set interfaces openvpn vtun1 server push-route 10.254.5.0/30
set interfaces openvpn vtun1 server subnet 192.168.5.0/24

Podajemy ścieżki do certyfikatów oraz kluczy.
set interfaces openvpn vtun1 tls ca-cert-file /config/auth/openvpn/ERL05-Bydgoszcz-Gajowa-PL-Remote-Access/ca.crt
set interfaces openvpn vtun1 tls cert-file /config/auth/openvpn/ERL05-Bydgoszcz-Gajowa-PL-Remote-Access/ERL05-Bydgoszcz-Gajowa-PL-Server.crt
set interfaces openvpn vtun1 tls dh-file /config/auth/openvpn/ERL05-Bydgoszcz-Gajowa-PL-Remote-Access/dh1024.pem
set interfaces openvpn vtun1 tls key-file /config/auth/openvpn/ERL05-Bydgoszcz-Gajowa-PL-Remote-Access/ERL05-Bydgoszcz-Gajowa-PL-Server.key

Bardzo ważne jeżeli chcemy aby z certyfikatu korzystało więcej niż jeden klient należy dodać opcje do vpn, definiując argument openvpn-option –duplicate-cn. Dzięki temu wpisowi nie musimy tworzyć nowych certyfikatów dla klientów.
set interfaces openvpn vtun1 openvpn-option –duplicate-cn  Sprawdzamy jeszcze czy wszystko się zgadza wywołujemy polecenie show interfaces openvpn.

pawel.klimko@ERL05-Bydgoszcz-Gajowa-PL# show interfaces openvpn 
 openvpn vtun1 {
     description ERL05-Bydgoszcz-Gajowa-PL
     local-port 1195
     mode server
     server {
         max-connections 5
         name-server 10.10.1.12
         push-route 10.10.1.0/24
         push-route 10.10.2.0/24
         push-route 10.254.5.0/30
         subnet 192.168.5.0/24
     }
     tls {
         ca-cert-file /config/auth/openvpn/ERL05-Bydgoszcz-Gajowa-PL-Remote-Access/ca.crt
         cert-file /config/auth/openvpn/ERL05-Bydgoszcz-Gajowa-PL-Remote-Access/ERL05-Bydgoszcz-Gajowa-PL-Server.crt
         dh-file /config/auth/openvpn/ERL05-Bydgoszcz-Gajowa-PL-Remote-Access/dh1024.pem
         key-file /config/auth/openvpn/ERL05-Bydgoszcz-Gajowa-PL-Remote-Access/ERL05-Bydgoszcz-Gajowa-PL-Server.key
     }

 }

Zatwierdzamy konfigurację i zapisujemy.
commit
save

7. Konfiguracja protokolu SSH z poziomu linuxa Ubiquiti EdgeRouter oraz sciagniecie plikow dla klienta w celu zdalnego polaczenia.

W moim przypadku udało mi się skopiować klucze beż odblokowywania konta "root". Można pominąć ten krok i odrazu się logować za pomocą swojego konta administratora. Wrazie problemów postępować jak niżej.

root@ERL05-Bydgoszcz-Gajowa-PL:# cd /etc/ssh/
nano sshd_config


Jeżeli nie posiadamy "nano" instalujemy komendą "apt-get install nano".
Szukamy wartosci PermitRootLogin i zmieniamy parametr no na yes.

Zapisujemy, oraz na koniec restartujemy serwis ssh na ERL`u
service ssh restart
[ ok ] Restarting OpenBSD Secure Shell server: sshd.


Sciagamy WinSCP oraz instalujemy. Przed logowaniem do ERL`a za posrednictwem konta root, trzeba ustawić hasło dla konta "root". 

passwd root

Teraz tylko pobieramy certyfikaty i pliki potrzebne do zainicjowania połączenia ze strony klienta OpenVPN.

Pliki które nam są potrzebne znajdują się w wcześniej utworzonym folderze 

Pliku certyfikatu oraz klucza.


Kopiujemy je np. do folderu na Pulpicie. Do pełni szczęścia brakuje nam plik profilu połączenia OpenVPN. Tworzymy plik .ovpn z danymi poniżej:

client
dev tun1
proto udp
remote klimas.ddns.net  1195
nobind
ca ca.crt
cert ERL05-Bydgoszcz-Gajowa-PL-Client.crt
key ERL05-Bydgoszcz-Gajowa-PL-Client.key
verb 3


W sekcji remote podajemy adres IP naszego routera lub jak w moim przypadku domena DDNS.

Należy pamiętać aby w sshd_config PermitRootLogin spowrotem ustawić na no i zrestartować serwis sshd service ssh restart.

8.Test połączenia

Pokaż interfejs OpenVPN:
pawel.klimko@ERL05-Bydgoszcz-Gajowa-PL:~$ show interfaces openvpn
Codes: S - State, L - Link, u - Up, D - Down, A - Admin Down
Interface    IP Address                        S/L  Description                 
---------    ----------                        ---  -----------                 
vtun1        192.168.5.1/24                    u/u  ERL05-Bydgoszcz-Gajowa-PL   

Ping adresu serwera OpenVPN:
pawel.klimko@ERL05-Bydgoszcz-Gajowa-PL:~$ ping 192.168.5.1
PING 192.168.5.1 (192.168.5.1) 56(84) bytes of data.
64 bytes from 192.168.5.1: icmp_req=1 ttl=64 time=0.368 ms
64 bytes from 192.168.5.1: icmp_req=2 ttl=64 time=0.259 ms
64 bytes from 192.168.5.1: icmp_req=3 ttl=64 time=0.315 ms

3 packets transmitted, 3 received, 0% packet loss, time 2007ms

rtt min/avg/max/mdev = 0.259/0.314/0.368/0.044 ms

Pokaż podłączonych klientów:
pawel.klimko@ERL05-Bydgoszcz-Gajowa-PL:~$ show openvpn status server
OpenVPN server status on vtun1 [ERL05-Bydgoszcz-Gajowa-PL]

Client CN Remote IP Tunnel IP TX byte RX byte Connected Since
--------------- --------------- --------------- ------- ------- ------------------------
ERL05-Bydgoszcz-Gajowa-PL-Client 46.77.124.35 192.168.5.2 20.5K 12.0K Fri Dec 5 18:42:54 2014



Internetowy adres IP urządzenia oraz adres w tunelu OpenVPN.

9.Firewall
Aby wszystko działało musimy dodać wyjątek w firewallu oraz interfejs naszego tunelu. Mój router jest skonfigurowany w oparciu o "zone based" czyli strefy.

pawel.klimko@ERL05-Bydgoszcz-Gajowa-PL# show zone-policy zone ZONE:WAN 
 default-action drop
 description ZONE:WAN
 from ZONE:LAN {
     firewall {
         name ZONE:LAN_to_ZONE:WAN
     }
 }
 interface eth0
 interface tun5
 interface vti5
 interface vtun1

Wystarczy zatem użyć poniższej komendy:
pawel.klimko@ERL05-Bydgoszcz-Gajowa-PL# set zone-policy zone ZONE:WAN interface vtun1 
commit
save
exit


Artykuł powstał na podstawie opisu kolegi który mnie zaraził sieciami VPN oraz wspólnie tworzymy jedną wielką prywatną sieć. Mój artykuł został opisany dla osób które zaczynają przygodę z tak zaawansowanym w konfiguracji sprzętem.


Podziękowania dla Patryka - www.virtualolivia.com