arcad/emissary-firmware
17
0
Fork 0
Code Issues 1 Pull Requests Projects Releases 3 Wiki Activity

feat(bpi-r3): add default firewall rules

Browse Source
This commit is contained in:
wpetit 2023-10-11 08:57:33 +02:00
parent ce0b211bfa
commit 4b5f2b63d0
3 changed files with 42 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
install/bananapi.mk
View File

@ -1,3 +1,7 @@
install-bpi-r3-network-config:
mkdir -p files/etc/config
cp misc/bpi-r3/uci/network files/etc/config/network
install-bpi-r3-uci-defaults:
mkdir -p files/etc/uci-defaults
cp misc/bpi-r3/uci-defaults/* files/etc/uci-defaults/

37
misc/bpi-r3/uci-defaults/99-x86-uci-custom.sh Normal file
View File

@ -0,0 +1,37 @@
#/bin/sh
set -e
main() {
# Update default firewall ruleset
uci add firewall rule
uci set firewall.@rule[-1].name='Allow SSH on WAN'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].dest_port='22'
uci set firewall.@rule[-1].target='ACCEPT'
uci add firewall rule
uci set firewall.@rule[-1].name='Allow HTTP on WAN'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].dest_port='80'
uci set firewall.@rule[-1].target='ACCEPT'
uci add firewall rule
uci set firewall.@rule[-1].name='Allow HTTPS on WAN'
uci set firewall.@rule[-1].src='wan'
uci set firewall.@rule[-1].proto='tcp'
uci set firewall.@rule[-1].dest_port='443'
uci set firewall.@rule[-1].target='ACCEPT'
uci commit firewall
# Disable DNS-rebind protection
uci set dhcp.@dnsmasq[0].rebind_protection='0'
uci commit dhcp
reload_config
}
main

2
targets/bananapi.mk
View File

@ -4,7 +4,7 @@ bpi-r3:
$(MAKE) \
OPENWRT_VERSION="23.05.0-rc3" \
IMAGEBUILDER_URL=https://downloads.openwrt.org/releases/23.05.0-rc3/targets/mediatek/filogic/openwrt-imagebuilder-23.05.0-rc3-mediatek-filogic.Linux-x86_64.tar.xz \
ADDITIONAL_INSTALL="install-bpi-r3-network-config" \
ADDITIONAL_INSTALL="install-bpi-r3-network-config install-bpi-r3-uci-defaults" \
ADDITIONAL_OPENWRT_PACKAGES="block-mount kmod-fs-ext4 kmod-usb-storage kmod-usb2" \
OPENWRT_TARGET="mediatek/filogic" \
EMISSARY_ARCH="arm64" \