diff --git a/files/etc/init.d/parahub-vpn-tunnel b/files/etc/init.d/parahub-vpn-tunnel deleted file mode 100755 index 2aab66e..0000000 --- a/files/etc/init.d/parahub-vpn-tunnel +++ /dev/null @@ -1,97 +0,0 @@ -#!/bin/sh /etc/rc.common -# Parahub VPN Tunnel — Creates GRE6 tunnel over Yggdrasil for guest traffic -# Runs after yggdrasil (START=95). OpenWrt 25.x lacks the netifd grev6 protocol -# handler, so we create the tunnel manually with ip6gre. -# -# Tunnel IP is assigned by Django and stored in /etc/parahub/tunnel_ip. -# If the file doesn't exist (first boot), heartbeat is called synchronously to get it. -# -# IMPORTANT: encaplimit must be "none" — Yggdrasil drops IPv6 packets with -# Destination Options extension headers (added by default encaplimit 4). - -START=96 -STOP=10 - -VPS_YGG="200:39f1:6a26:328a:d901:fbd2:d30d:faef" -GRE_GATEWAY="172.16.0.1" -TUNNEL_IP_FILE="/etc/parahub/tunnel_ip" - -start() { - # Only for Bumblebee role - [ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || return 0 - - # Wait for Yggdrasil address (up to 60s) - local ygg_addr="" attempts=0 - while [ $attempts -lt 30 ]; do - ygg_addr=$(ip -6 addr show dev ygg0 scope global 2>/dev/null | awk '/inet6/{print $2}' | cut -d/ -f1 | head -1) - [ -n "$ygg_addr" ] && break - attempts=$((attempts + 1)) - sleep 2 - done - - if [ -z "$ygg_addr" ]; then - logger -t parahub-vpn "No Yggdrasil address after 60s, skipping GRE6 tunnel" - return 1 - fi - - # Get tunnel IP — from file, or request via heartbeat on first boot - local gre_local_ip - gre_local_ip=$(cat "$TUNNEL_IP_FILE" 2>/dev/null) - - if [ -z "$gre_local_ip" ]; then - logger -t parahub-vpn "No tunnel IP file, calling heartbeat to get assignment..." - HEARTBEAT_CURL_TIMEOUT=30 /usr/bin/parahub-heartbeat - gre_local_ip=$(cat "$TUNNEL_IP_FILE" 2>/dev/null) - fi - - if [ -z "$gre_local_ip" ]; then - logger -t parahub-vpn "Failed to get tunnel IP from heartbeat, falling back to 172.16.0.2" - gre_local_ip="172.16.0.2" - fi - - # Create GRE6 tunnel (encaplimit none — critical for Yggdrasil compatibility) - ip -6 tunnel add gre6-vpn mode ip6gre \ - remote "$VPS_YGG" \ - local "$ygg_addr" \ - encaplimit none - ip addr add ${gre_local_ip}/24 dev gre6-vpn - ip link set gre6-vpn mtu 1400 up - - # Default route through GRE (table 100 — used by guest policy routing) - ip route add default via "$GRE_GATEWAY" table 100 - - # Guest subnet direct route in table 100 (background — WiFi may not be up yet) - # Without this, router's own replies (source IP in guest subnet) go through - # GRE instead of back to the guest client (ip rule matches source-based) - local guest_subnet - guest_subnet=$(awk -F= '/GUEST_SUBNET/{print $2}' /etc/parahub/keys 2>/dev/null) - if [ -n "$guest_subnet" ]; then - # WiFi interfaces take time to come up at boot — retry in background - ( - local guest_dev="" ga=0 - while [ $ga -lt 30 ]; do - guest_dev=$(ip route | grep "^${guest_subnet} " | awk '{print $3}') - [ -n "$guest_dev" ] && break - ga=$((ga + 1)) - sleep 2 - done - if [ -n "$guest_dev" ]; then - ip route add "$guest_subnet" dev "$guest_dev" table 100 2>/dev/null - logger -t parahub-vpn "Guest route: $guest_subnet via $guest_dev in table 100" - else - logger -t parahub-vpn "Warning: guest device not found for $guest_subnet after 60s" - fi - ) & - fi - - # Reload firewall so vpn_tunnel zone picks up gre6-vpn device - /etc/init.d/firewall reload 2>/dev/null & - - logger -t parahub-vpn "GRE6 tunnel up: ${gre_local_ip} → ${VPS_YGG} via $ygg_addr (encaplimit none)" -} - -stop() { - ip route flush table 100 2>/dev/null - ip -6 tunnel del gre6-vpn 2>/dev/null - logger -t parahub-vpn "GRE6 tunnel down" -} diff --git a/files/etc/uci-defaults/99-parahub-mesh b/files/etc/uci-defaults/99-parahub-mesh index ded4778..b22a653 100755 --- a/files/etc/uci-defaults/99-parahub-mesh +++ b/files/etc/uci-defaults/99-parahub-mesh @@ -4,7 +4,7 @@ # It configures: batman-adv mesh, dual-band WiFi (private+public), firewall zones, SQM shaping. # # Roles: -# bumblebee (L3 Gateway) — full stack: yggdrasil, GRE6, VPN, guest isolation, SQM, DoH +# bumblebee (L3 Gateway) — full stack: yggdrasil, Mullvad VPN, guest isolation, speed control, DoH # bee (L2 Transport) — minimal: batman-adv mesh relay, heartbeat # Read firmware role (written by build.sh) @@ -175,7 +175,7 @@ NET_EOF done else - # --- Bumblebee: full network (gw_mode=server, GRE6, guest, policy routing) --- + # --- Bumblebee: full network (gw_mode starts as client, promoted to server by gw-check when Mullvad is up) --- uci batch <<-NET_EOF # --- loopback --- set network.loopback=interface @@ -184,14 +184,14 @@ set network.loopback.proto='static' set network.loopback.ipaddr='127.0.0.1' set network.loopback.netmask='255.0.0.0' -# --- bat0 (batman-adv, server mode — acts as gateway for Bee nodes) --- +# --- bat0 (batman-adv, starts as client — gw-check promotes to server when Mullvad is active) --- set network.bat0=interface set network.bat0.proto='batadv' set network.bat0.routing_algo='BATMAN_V' set network.bat0.aggregated_ogms='1' set network.bat0.bridge_loop_avoidance='1' set network.bat0.distributed_arp_table='1' -set network.bat0.gw_mode='server' +set network.bat0.gw_mode='client' set network.bat0.hop_penalty='15' set network.bat0.orig_interval='1000' @@ -229,12 +229,7 @@ set network.wan=interface set network.wan.device='${WAN_DEV}' set network.wan.proto='dhcp' -# --- VPN tunnel interface (device created by parahub-vpn-tunnel init script) --- -set network.vpn_tunnel=interface -set network.vpn_tunnel.device='gre6-vpn' -set network.vpn_tunnel.proto='none' - -# --- Policy routing: guest traffic → VPN table 100 --- +# --- Policy routing: guest traffic → Mullvad table 100 --- add network rule set network.@rule[-1].src='${GUEST_SUBNET}/24' set network.@rule[-1].lookup='100' @@ -448,7 +443,7 @@ set firewall.@rule[-1].target='ACCEPT' FW_EOF else - # --- Bumblebee: full firewall (4 zones, guest isolation, kill switch) --- + # --- Bumblebee: full firewall (3 zones + mullvad_local added by parahub-mullvad, guest kill switch) --- uci batch <<-FW_EOF # --- Zone: lan (private network) --- add firewall zone @@ -476,25 +471,14 @@ set firewall.@zone[-1].masq='1' set firewall.@zone[-1].mtu_fix='1' add_list firewall.@zone[-1].network='wan' -# --- Zone: vpn_tunnel (GRE6 → VPS → Mullvad) --- -add firewall zone -set firewall.@zone[-1].name='vpn_tunnel' -set firewall.@zone[-1].input='REJECT' -set firewall.@zone[-1].output='ACCEPT' -set firewall.@zone[-1].forward='REJECT' -set firewall.@zone[-1].masq='1' -set firewall.@zone[-1].mtu_fix='1' -add_list firewall.@zone[-1].network='vpn_tunnel' - # --- Forwarding: lan → wan (internet for owner) --- add firewall forwarding set firewall.@forwarding[-1].src='lan' set firewall.@forwarding[-1].dest='wan' -# --- Forwarding: guest → vpn_tunnel ONLY (kill switch: no wan!) --- -add firewall forwarding -set firewall.@forwarding[-1].src='guest' -set firewall.@forwarding[-1].dest='vpn_tunnel' +# NOTE: guest → mullvad_local forwarding is added by parahub-mullvad setup. +# Without Mullvad configured, guests have NO internet (kill switch by design). +# parahub-gw-check monitors Mullvad and sets gw_mode accordingly. # --- Rule: guest DHCP (allow guests to get IP) --- add firewall rule @@ -681,7 +665,7 @@ if [ "$ROLE" != "bee" ]; then # Generate unique keys for this node yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf - # Add VPS gateway as static Yggdrasil peer (for GRE6 tunnel) + # Add VPS as static Yggdrasil peer (management plane: remote access, heartbeat) sed -i 's|Peers: \[\]|Peers: ["tls://91.98.123.238:443"]|' /etc/yggdrasil.conf # UCI network interface for yggdrasil TUN @@ -717,13 +701,6 @@ set firewall.@rule[-1].proto='tcp' set firewall.@rule[-1].dest_port='80' set firewall.@rule[-1].target='ACCEPT' -# Allow GRE6 protocol input (tunnel endpoint) -add firewall rule -set firewall.@rule[-1].name='Allow GRE6 input' -set firewall.@rule[-1].src='yggdrasil' -set firewall.@rule[-1].proto='47' -set firewall.@rule[-1].target='ACCEPT' - # Allow ICMPv6 on Yggdrasil add firewall rule set firewall.@rule[-1].name='Allow ICMPv6 Ygg' @@ -748,9 +725,8 @@ set firewall.@forwarding[-1].dest='yggdrasil' YGG_FW_EOF uci commit firewall - # Enable yggdrasil service + VPN tunnel (creates GRE6 after yggdrasil starts) + # Enable yggdrasil service /etc/init.d/yggdrasil enable 2>/dev/null || true - /etc/init.d/parahub-vpn-tunnel enable 2>/dev/null || true # Save yggdrasil address to node keys file YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown") @@ -796,9 +772,11 @@ fi chmod +x /usr/bin/parahub-heartbeat chmod +x /usr/bin/parahub-autoupdate +chmod +x /usr/bin/parahub-gw-check -# Cron: heartbeat every 5 minutes + OTA update nightly at 3am +# Cron: heartbeat every 5 min, gateway health check every 2 min, OTA nightly echo "*/5 * * * * /usr/bin/parahub-heartbeat" >> /etc/crontabs/root +echo "*/2 * * * * /usr/bin/parahub-gw-check" >> /etc/crontabs/root echo "0 3 * * * /usr/bin/parahub-autoupdate" >> /etc/crontabs/root /etc/init.d/cron enable @@ -819,10 +797,10 @@ else logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24" logger -t parahub-mesh "Mesh ID: ${MESH_ID}" logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}" - logger -t parahub-mesh "GRE tunnel: 172.16.0.2 → VPS gateway (Mullvad Portugal)" - logger -t parahub-mesh "Kill switch: guest→vpn_tunnel only (no wan)" + logger -t parahub-mesh "Guest internet: via local Mullvad (parahub-mullvad setup required)" + logger -t parahub-mesh "Kill switch: guest blocked without Mullvad (by design)" logger -t parahub-mesh "Guest IPv6: Yggdrasil SLAAC (full speed, firewall restricted)" - logger -t parahub-mesh "bat0 gw_mode: server (gateway for Bee nodes)" + logger -t parahub-mesh "bat0 gw_mode: client (promoted to server by gw-check when Mullvad active)" fi exit 0 diff --git a/files/usr/bin/parahub-gw-check b/files/usr/bin/parahub-gw-check new file mode 100644 index 0000000..43b7010 --- /dev/null +++ b/files/usr/bin/parahub-gw-check @@ -0,0 +1,36 @@ +#!/bin/sh +# Parahub Gateway Health Check +# Monitors Mullvad WireGuard status and switches batman-adv gw_mode: +# - Mullvad active (recent handshake) → gw_mode=server (advertise as gateway) +# - Mullvad down or not configured → gw_mode=client (relay only) +# +# Run via cron every 2 minutes. Bumblebee only. + +[ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || exit 0 + +# Check if Mullvad WireGuard interface exists and has recent handshake +MULLVAD_OK=0 +if command -v wg >/dev/null 2>&1; then + # Get latest handshake timestamp from any WireGuard interface + LAST_HS=$(wg show all latest-handshakes 2>/dev/null | awk '{print $NF}' | sort -rn | head -1) + if [ -n "$LAST_HS" ] && [ "$LAST_HS" -gt 0 ] 2>/dev/null; then + NOW=$(date +%s) + AGE=$((NOW - LAST_HS)) + # Handshake within last 5 minutes = alive + [ "$AGE" -lt 300 ] && MULLVAD_OK=1 + fi +fi + +CURRENT_MODE=$(batctl gw_mode 2>/dev/null | awk '{print $1}') + +if [ "$MULLVAD_OK" = "1" ]; then + if [ "$CURRENT_MODE" != "server" ]; then + batctl gw_mode server + logger -t parahub-gw "Mullvad active, switched to gw_mode=server" + fi +else + if [ "$CURRENT_MODE" != "client" ]; then + batctl gw_mode client + logger -t parahub-gw "Mullvad down, switched to gw_mode=client" + fi +fi diff --git a/files/usr/bin/parahub-heartbeat b/files/usr/bin/parahub-heartbeat index a0611da..e6b647f 100755 --- a/files/usr/bin/parahub-heartbeat +++ b/files/usr/bin/parahub-heartbeat @@ -37,12 +37,9 @@ PAYLOAD="{\"mac\":\"${MAC}\",\"hostname\":\"${HOSTNAME}\",\"yggdrasil_address\": RESPONSE="" -# Use longer timeout if called from vpn-tunnel init (first boot) -CURL_TIMEOUT="${HEARTBEAT_CURL_TIMEOUT:-10}" - if [ "$ROLE" = "bee" ]; then # Bee: no yggdrasil, use public URL only - RESPONSE=$(curl -s -m "$CURL_TIMEOUT" -X POST \ + RESPONSE=$(curl -s -m 10 -X POST \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${HEARTBEAT_KEY}" \ -d "$PAYLOAD" \ @@ -50,13 +47,13 @@ if [ "$ROLE" = "bee" ]; then else # Bumblebee: try yggdrasil first, fallback to public if ping6 -c 1 -W 3 200:abb9:5810:37d3:8a4c:98a6:b82b:969a >/dev/null 2>&1; then - RESPONSE=$(curl -s -m "$CURL_TIMEOUT" -X POST \ + RESPONSE=$(curl -s -m 10 -X POST \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${HEARTBEAT_KEY}" \ -d "$PAYLOAD" \ "${PARAHUB_API_YGG}" 2>/dev/null) else - RESPONSE=$(curl -s -m "$CURL_TIMEOUT" -X POST \ + RESPONSE=$(curl -s -m 10 -X POST \ -H "Content-Type: application/json" \ -H "Authorization: Bearer ${HEARTBEAT_KEY}" \ -d "$PAYLOAD" \ @@ -64,22 +61,6 @@ else fi fi -# Parse tunnel_ip from response and update local config (Bumblebee only) -if [ "$ROLE" != "bee" ] && [ -n "$RESPONSE" ]; then - NEW_TUNNEL_IP=$(echo "$RESPONSE" | jsonfilter -e '$.tunnel_ip' 2>/dev/null) - if [ -n "$NEW_TUNNEL_IP" ]; then - OLD_TUNNEL_IP=$(cat /etc/parahub/tunnel_ip 2>/dev/null) - if [ "$OLD_TUNNEL_IP" != "$NEW_TUNNEL_IP" ]; then - echo "$NEW_TUNNEL_IP" > /etc/parahub/tunnel_ip - logger -t parahub-heartbeat "Tunnel IP updated: ${OLD_TUNNEL_IP:-none} → $NEW_TUNNEL_IP" - # Restart vpn-tunnel if it's running (IP changed) - if [ -n "$OLD_TUNNEL_IP" ]; then - /etc/init.d/parahub-vpn-tunnel restart 2>/dev/null & - fi - fi - fi -fi - # Sync paid_clients to speed control (Bumblebee only) if [ "$ROLE" != "bee" ] && [ -x /usr/bin/parahub-speed-control ] && [ -n "$RESPONSE" ]; then PAID_IPS=$(echo "$RESPONSE" | jsonfilter -e '$.paid_clients[*]' 2>/dev/null)