Absurditas Demens

Collection of personal tips, documentation, and more.


Project maintained by compenguy Hosted on GitHub Pages — Theme by mattgraham

Lede/OpenWRT

Hardware

I built my own x86-64 router from the following:

System Setup

For reasons I don’t completely understand, the kernel couldn’t find the root partition when my hard drive was attached to anything other than the primary sata port. Whether EFI or CSM (BIOS), specifying the root partition by sdx# or partition UUID, nothing worked. Moving the hard drive to sata port 0 made everything magically start working.

Quick Guide to Legacy BIOS Boot Install

  1. Download a LEDE release combined ext4 image
    • ...-combined-squashfs.img for wear-intolerant storage like USB, SD card, etc
    • ...-combined-ext4.img for high-wear storage like SSDs
  2. Gunzip the image, and copy the resulting file into /mnt/<usbkey>/data/lede (if using SystemRescueCD)
  3. Boot the router with the USB key
  4. Write the selected image file to the router’s hard drive: `cat /livemnt/boot/data/lede/lede-…-x86-64-combined-ext4.img > /dev/sda
  5. Resize the root partition to fill the disk:
    • Make note of the start sector of partition 2: parted /dev/sda unit s p
    • Delete the second partition: parted /dev/sda rm 2
    • Make the new partition, using the same starting sector: parted /dev/sda unit s mkpart primary ext4 <start sector> 100%
      • If prompted about improper alignment, Ignore
    • Resize the filesystem to fill the partition: resize2fs /dev/sda2
    • reboot

References:

Full Guide to EFI Install

Preparing the bootable USB key

Options:

I used SystemRescueCD for my bootable linux USB key.

  1. Put a bootable linux OS on a USB key
  2. Mount the USB key
  3. Download a LEDE release rootfs ext4 image and vmlinuz
    • pick a release: targets/x86/64/
    • see this page for more on the subject of combined images
  4. Gunzip the image, and copy the resulting file into /mnt/<usbkey>/data/lede-efi (if using SystemRescueCD)
  5. Copy the vmlinuz into /mnt/<usbkey>/data/lede-efi

References:

systemd-boot (gummiboot)
  1. Install systemd build deps: sudo apt install meson gnu-efi gperf libcap-dev libmount-dev docbook-xsl
  2. Clone the systemd git repo: git clone https://github.com/systemd/systemd.git && cd systemd
  3. Configure the build: meson -D gnu-efi=true build/
  4. Build the efi bootloader: ninja -C build src/boot/efi/systemd-bootx64.efi
  5. Copy the bootloader into a temporary EFI staging area: install -D build/src/boot/efi/systemd-bootx64.efi systemd-boot/EFI/BOOT/bootx64.efi
  6. Copy the kernel into the EFI kernel staging area: install -D /mnt/<usbkey>/data/lede-efi/lede-17.01.2-x86-64-vmlinuz systemd-boot/linux/
  7. Create the basic bootloader configuration: install -d systemd-boot/loader && vi systemd-boot/loader/loader.conf
      default lede-*
      timeout 3
      editor 0
    
  8. Create the boot entry for the kernel we added: install -d systemd-boot/loader/entries && vi systemd-boot/loader/entries/lede-17.01.2.conf
      title    LEDE 17.01.2
      efi      /linux/lede-17.01.2-x86-64-vmlinuz
      options root=/dev/sda2 rootfstype=ext4 rootwait console=tty0 noinitrd
    
  9. Copy the entire systemd-boot directory tree into/mnt/<usbkey>/data/lede-efi

References:

Installation

  1. On router computer, boot from the USB key
  2. Change directories to where you put the image: cd /livemnt/boot/data
  3. Convert from MBR to GPT
    • using parted: parted /dev/sda mklabel gpt
    • using gdisk: gdisk /dev/sda, then write the changes and exit
  4. Using cgdisk, or some other gpt-enabled partitioning tool:
    • create an ESI partition (ef00) of between 64 and 256MB, and label it BOOT
    • create a linux partition (8300) using the rest of the disk, and label it ROOT
  5. Format the partitions:
    • mkfs.vfat -F 32 -n BOOT /dev/sda1 (-F 32 => FAT32, -n BOOT => set volume name to BOOT)
    • mkfs.ext4 -L ROOT /dev/sda2 (-L ROOT => set volume name to ROOT)
  6. Set up the EFI boot partition:
    • Mount to BOOT partition: mount /dev/sda /mnt/bootfs`
    • Create the EFI boot image directory: mkdir -p /mnt/bootfs/EFI/BOOT
    • If doing a bare kernel install:
      • Copy the kernel into the boot image directory: cp /livemnt/boot/data/lede-efi/lede-...-x86-64-vmlinuz /mnt/bootfs/EFI/BOOT/bootx64.efi
      • Create the EFI startup script to pass the necessary kernel params: echo 'fs:\\EFI\\BOOT\\bootx64.efi root=/dev/sda2 rootfstype=ext4 rootwait console=tty0 noinitrd" > /mnt/bootfs/startup.nsh
    • If doing a systemd-boot install:
      • Copy the systemd-boot files into the boot image directory: cp -R /livemnt/boot/data/lede-efi/systemd-boot/* /mnt/bootfs/
  7. Set up the root partition:
    • Mount the ROOT partition: mount /dev/sda2 /mnt/rootfs
    • Mount the rootfs image: mount -o loop /livemnt/boot/data/lede-...-x86-64-rootfs-ext4.img /mnt/ledefs
    • Copy all the files over: rsync -avxHAWX --numeric-ids --info=progress2 /mnt/ledefs/ /mnt/rootfs/
  8. Reboot the system
  9. NOTHING WILL DISPLAY WHEN THE SYSTEM STARTS BOOTING. DON’T PANIC: LEDE 17.0x KERNELS DON’T HAVE EFI FRAMEBUFFER CONFIGURED.

References:

Configuration

  1. From a system connected to the LAN port of the router, ssh into 192.168.1.1
  2. Set a password: passwd
  3. If the router is being setup with a private network connect to the WAN port, specifically if the upstream network is 192.168.1.x:
    • change the router’s IP to a different subnet: uci set network.lan.ipaddr=192.168.2.1 && uci commit network && reload_config
    • disconnect and reconnect the client computer to the router to get an ip on the new network (either physically, or run sudo ifdown eth0 && sudo ifup eth0)
    • In the rest of the guide, substitute 192.168.2.x for references to 192.168.1.x
  4. Install the luci web interface: opkg update; opkg install luci
  5. Open a web browser, and type http://lede/ into the navigation bar
  6. System => System
    • Set a Hostname
    • Set the Timezone
  7. Network => DHCP and DNS
    • Set a Local server
    • Set a Local domain (should generally have the same value as Local server)

References:

Bonus Round

Cisco/Fortigate/etc IPSEC VPN

OpenConnect SSL VPN