321 lines
6.1 KiB
Markdown
321 lines
6.1 KiB
Markdown
# OpenWrt 管理指令
|
||
|
||
**目標設備**：`192.168.42.10`（OpenWrt 24.10.4）
|
||
**WAN IP**：`125.229.110.50`（PPPoE）
|
||
|
||
---
|
||
|
||
## 系統狀態確認
|
||
|
||
```sh
|
||
# 開機時間與負載
|
||
uptime
|
||
|
||
# 記憶體用量
|
||
free -m
|
||
|
||
# 磁碟空間
|
||
df -h
|
||
|
||
# 近期系統紀錄
|
||
logread -l 50
|
||
|
||
# 即時追蹤紀錄
|
||
logread -f
|
||
```
|
||
|
||
---
|
||
|
||
## 套件管理
|
||
|
||
```sh
|
||
# 更新套件列表
|
||
opkg update
|
||
|
||
# 安裝套件
|
||
opkg install <package_name>
|
||
|
||
# 移除套件
|
||
opkg remove <package_name>
|
||
|
||
# 列出已安裝套件
|
||
opkg list-installed
|
||
|
||
# 升級所有套件
|
||
opkg list-upgradable | cut -f 1 -d ' ' | xargs -r opkg upgrade
|
||
```
|
||
|
||
---
|
||
|
||
## 防火牆（nftables / fw4）
|
||
|
||
```sh
|
||
# 列出所有規則
|
||
nft list ruleset
|
||
|
||
# 列出特定 table
|
||
nft list table inet fw4
|
||
|
||
# 重新載入防火牆設定
|
||
fw4 restart
|
||
|
||
# 備份目前規則
|
||
nft list ruleset > /etc/nftables.backup
|
||
|
||
# 清除特定集合
|
||
nft flush set inet fw4 taiwan_ips
|
||
|
||
# 查看 Taiwan IP 集合（元素數量）
|
||
nft list set inet fw4 taiwan_ips | grep -c elements
|
||
```
|
||
|
||
---
|
||
|
||
## 網路診斷
|
||
|
||
```sh
|
||
# 介面清單與狀態
|
||
ip -br addr
|
||
|
||
# 路由表
|
||
ip route show
|
||
|
||
# 測試對外網路
|
||
ping -c 4 8.8.8.8
|
||
|
||
# DNS 查詢
|
||
nslookup google.com
|
||
|
||
# 查看監聽 Port
|
||
netstat -tuln
|
||
|
||
# 測試指定 Port 是否可到達
|
||
nc -zv -w 5 <target_ip> <port>
|
||
```
|
||
|
||
---
|
||
|
||
## 日誌
|
||
|
||
```sh
|
||
# 查看系統紀錄
|
||
logread
|
||
|
||
# 即時監控
|
||
logread -f
|
||
|
||
# 最近 50 筆
|
||
logread -l 50
|
||
|
||
# 過濾防火牆相關
|
||
logread | grep -i firewall
|
||
```
|
||
|
||
---
|
||
|
||
## 服務管理
|
||
|
||
```sh
|
||
# 啟動 / 停止 / 重啟
|
||
/etc/init.d/<service> start
|
||
/etc/init.d/<service> stop
|
||
/etc/init.d/<service> restart
|
||
|
||
# 查看狀態
|
||
/etc/init.d/<service> status
|
||
|
||
# 開機自動啟動 / 停用
|
||
/etc/init.d/<service> enable
|
||
/etc/init.d/<service> disable
|
||
```
|
||
|
||
---
|
||
|
||
## 設定備份與還原
|
||
|
||
```sh
|
||
# 備份整個系統設定
|
||
sysupgrade -b /tmp/backup-$(date +%Y%m%d).tar.gz
|
||
|
||
# 還原設定
|
||
sysupgrade -r /tmp/backup-YYYYMMDD.tar.gz
|
||
|
||
# 備份防火牆設定
|
||
cp /etc/config/firewall /etc/config/firewall.bak
|
||
|
||
# 編輯設定檔
|
||
vi /etc/config/firewall
|
||
```
|
||
|
||
---
|
||
|
||
## Taiwan IP 集合管理
|
||
|
||
```sh
|
||
# 重新抓取並更新 Taiwan IP 清單
|
||
sh /root/42_10/update_tw_ip.sh
|
||
|
||
# 確認目前集合內容
|
||
nft list set inet fw4 taiwan_ips
|
||
|
||
# 手動補充單一 IP（如 VPS 未被涵蓋）
|
||
nft add element inet fw4 taiwan_ips { <ip_address> }
|
||
```
|
||
|
||
**資料來源**：`https://www.ipdeny.com/ipblocks/data/countries/tw.zone`
|
||
|
||
建議搭配 cron 定期執行 `update_tw_ip.sh`，例如每月一次：
|
||
|
||
```sh
|
||
# crontab -e
|
||
0 3 1 * * sh /root/42_10/update_tw_ip.sh
|
||
```
|
||
|
||
---
|
||
|
||
## 防火牆規則驗證
|
||
|
||
```sh
|
||
# 本機執行：SSH 進路由器並格式化輸出規則
|
||
sh /root/42_10/show_nft_rules.sh
|
||
|
||
# 驗證台灣 IP 通行、非台灣 IP 攔截
|
||
sh /root/42_10/test_connection.sh
|
||
```
|
||
|
||
`test_connection.sh` 會：
|
||
1. 查詢目前出口 IP 所在地（透過 `https://ip.lotimmy.com/json`）
|
||
2. 對 `125.229.110.50` 的指定 Port（`51433`, `31433`）發起測試
|
||
3. 判斷結果是否符合預期（台灣 IP 應通過，非台灣 IP 應被攔截）
|
||
|
||
---
|
||
|
||
## 轉發規則調整
|
||
|
||
若需移除已失效的 Port 轉發（如原本指向不存在主機），執行：
|
||
|
||
```sh
|
||
sh /root/42_10/remove_mysql_forward.sh
|
||
```
|
||
|
||
手動移除流程：
|
||
```sh
|
||
# 找出目標規則
|
||
ssh root@192.168.42.10 "uci show firewall | grep <port>"
|
||
|
||
# 刪除並提交
|
||
ssh root@192.168.42.10 "uci delete firewall.<rule_id> && uci commit firewall"
|
||
|
||
# 重載防火牆
|
||
ssh root@192.168.42.10 "fw4 restart"
|
||
|
||
# 確認規則已移除
|
||
ssh root@192.168.42.10 "nft list chain inet fw4 dstnat_wan | grep <port>"
|
||
```
|
||
|
||
---
|
||
|
||
## WireGuard VPN
|
||
|
||
**架構**：路由器作為 server，外部裝置以 client 身份連入，取得對 LAN（`192.168.42.0/24`）的存取權。
|
||
|
||
```
|
||
外部裝置
|
||
│ UDP 51820
|
||
▼
|
||
192.168.42.10 wg0: 10.0.0.1/24 ← server
|
||
├── 10.0.0.2 Workstation
|
||
└── 10.0.0.3 iPhone 15 Pro Max
|
||
```
|
||
|
||
### 狀態查看
|
||
|
||
```sh
|
||
# 查看所有 peer 連線狀況（last handshake、傳輸量）
|
||
wg show
|
||
|
||
# 只看介面摘要
|
||
wg show wg0
|
||
```
|
||
|
||
### 新增 Peer
|
||
|
||
```sh
|
||
# 1. 在路由器上產生新的 keypair
|
||
wg genkey | tee /tmp/peer_private.key | wg pubkey > /tmp/peer_public.key
|
||
cat /tmp/peer_private.key
|
||
cat /tmp/peer_public.key
|
||
|
||
# 2. 加入 peer 設定（以 10.0.0.4 為例）
|
||
uci add network wireguard_wg0
|
||
uci set network.@wireguard_wg0[-1].public_key='<peer_public_key>'
|
||
uci set network.@wireguard_wg0[-1].private_key='<peer_private_key>'
|
||
uci set network.@wireguard_wg0[-1].persistent_keepalive='25'
|
||
uci add_list network.@wireguard_wg0[-1].allowed_ips='10.0.0.4/32'
|
||
uci add_list network.@wireguard_wg0[-1].allowed_ips='192.168.42.0/24'
|
||
uci set network.@wireguard_wg0[-1].dns='1.1.1.1'
|
||
uci set network.@wireguard_wg0[-1].description='<裝置名稱>'
|
||
uci commit network
|
||
service network restart
|
||
```
|
||
|
||
### 移除 Peer
|
||
|
||
```sh
|
||
# 找出目標 peer 的索引
|
||
uci show network | grep -n '<peer_public_key>'
|
||
|
||
# 刪除（假設是 @wireguard_wg0[2]）
|
||
uci delete network.@wireguard_wg0[2]
|
||
uci commit network
|
||
service network restart
|
||
```
|
||
|
||
### Client 設定檔範本
|
||
|
||
將以下內容存為 `.conf` 檔匯入裝置（WireGuard app 或 `wg-quick`）：
|
||
|
||
```ini
|
||
[Interface]
|
||
PrivateKey = <peer_private_key>
|
||
Address = 10.0.0.x/24
|
||
DNS = 1.1.1.1
|
||
|
||
[Peer]
|
||
PublicKey = s7fZj/dlgcjc1q4Pd1EaeoCOgq8EStyS30h30hOL1RI=
|
||
Endpoint = 125.229.110.50:51820
|
||
AllowedIPs = 192.168.42.0/24, 10.0.0.0/24
|
||
PersistentKeepalive = 25
|
||
```
|
||
|
||
> `AllowedIPs` 只填 `192.168.42.0/24, 10.0.0.0/24` 表示 split tunnel（只有內網流量走 VPN）。
|
||
> 若要讓所有流量都走 VPN，改為 `0.0.0.0/0, ::/0`。
|
||
|
||
### 現有 Peer 一覽
|
||
|
||
| 描述 | VPN IP | Public Key（前 8 碼） |
|
||
|---|---|---|
|
||
| Workstation | `10.0.0.2` | `daM1BFUS` |
|
||
| iPhone 15 Pro Max | `10.0.0.3` | `PZVrUwd1` |
|
||
|
||
### 防火牆規則說明
|
||
|
||
| 規則 | 說明 |
|
||
|---|---|
|
||
| WAN UDP 51820 → ACCEPT | 允許外部 client 建立 VPN tunnel |
|
||
| vpn → lan ACCEPT + masq | VPN client 可存取內網，並做 NAT |
|
||
|
||
若防火牆規則遺失，手動補回：
|
||
|
||
```sh
|
||
# 允許 WireGuard 進入
|
||
uci add firewall rule
|
||
uci set firewall.@rule[-1].name='Allow-WireGuard'
|
||
uci set firewall.@rule[-1].src='wan'
|
||
uci set firewall.@rule[-1].dest_port='51820'
|
||
uci set firewall.@rule[-1].proto='udp'
|
||
uci set firewall.@rule[-1].target='ACCEPT'
|
||
uci commit firewall
|
||
fw4 restart
|
||
```
|