refactor: Remove GRE tunnels, add Mullvad gateway health check
Radical simplification — no more VPS data plane: - Delete parahub-vpn-tunnel init script (GRE6 no longer used) - Revert heartbeat to clean version (no tunnel_ip parsing) - Add parahub-gw-check: monitors WireGuard handshake, switches batman-adv gw_mode between server/client (cron every 2 min) - Update uci-defaults: remove vpn_tunnel zone/interface, start bumblebee as gw_mode=client (health check promotes to server) Guest internet now requires Mullvad — kill switch by design. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
@@ -1,97 +0,0 @@
|
||||
#!/bin/sh /etc/rc.common
|
||||
# Parahub VPN Tunnel — Creates GRE6 tunnel over Yggdrasil for guest traffic
|
||||
# Runs after yggdrasil (START=95). OpenWrt 25.x lacks the netifd grev6 protocol
|
||||
# handler, so we create the tunnel manually with ip6gre.
|
||||
#
|
||||
# Tunnel IP is assigned by Django and stored in /etc/parahub/tunnel_ip.
|
||||
# If the file doesn't exist (first boot), heartbeat is called synchronously to get it.
|
||||
#
|
||||
# IMPORTANT: encaplimit must be "none" — Yggdrasil drops IPv6 packets with
|
||||
# Destination Options extension headers (added by default encaplimit 4).
|
||||
|
||||
START=96
|
||||
STOP=10
|
||||
|
||||
VPS_YGG="200:39f1:6a26:328a:d901:fbd2:d30d:faef"
|
||||
GRE_GATEWAY="172.16.0.1"
|
||||
TUNNEL_IP_FILE="/etc/parahub/tunnel_ip"
|
||||
|
||||
start() {
|
||||
# Only for Bumblebee role
|
||||
[ "$(cat /etc/parahub/role 2>/dev/null)" = "bumblebee" ] || return 0
|
||||
|
||||
# Wait for Yggdrasil address (up to 60s)
|
||||
local ygg_addr="" attempts=0
|
||||
while [ $attempts -lt 30 ]; do
|
||||
ygg_addr=$(ip -6 addr show dev ygg0 scope global 2>/dev/null | awk '/inet6/{print $2}' | cut -d/ -f1 | head -1)
|
||||
[ -n "$ygg_addr" ] && break
|
||||
attempts=$((attempts + 1))
|
||||
sleep 2
|
||||
done
|
||||
|
||||
if [ -z "$ygg_addr" ]; then
|
||||
logger -t parahub-vpn "No Yggdrasil address after 60s, skipping GRE6 tunnel"
|
||||
return 1
|
||||
fi
|
||||
|
||||
# Get tunnel IP — from file, or request via heartbeat on first boot
|
||||
local gre_local_ip
|
||||
gre_local_ip=$(cat "$TUNNEL_IP_FILE" 2>/dev/null)
|
||||
|
||||
if [ -z "$gre_local_ip" ]; then
|
||||
logger -t parahub-vpn "No tunnel IP file, calling heartbeat to get assignment..."
|
||||
HEARTBEAT_CURL_TIMEOUT=30 /usr/bin/parahub-heartbeat
|
||||
gre_local_ip=$(cat "$TUNNEL_IP_FILE" 2>/dev/null)
|
||||
fi
|
||||
|
||||
if [ -z "$gre_local_ip" ]; then
|
||||
logger -t parahub-vpn "Failed to get tunnel IP from heartbeat, falling back to 172.16.0.2"
|
||||
gre_local_ip="172.16.0.2"
|
||||
fi
|
||||
|
||||
# Create GRE6 tunnel (encaplimit none — critical for Yggdrasil compatibility)
|
||||
ip -6 tunnel add gre6-vpn mode ip6gre \
|
||||
remote "$VPS_YGG" \
|
||||
local "$ygg_addr" \
|
||||
encaplimit none
|
||||
ip addr add ${gre_local_ip}/24 dev gre6-vpn
|
||||
ip link set gre6-vpn mtu 1400 up
|
||||
|
||||
# Default route through GRE (table 100 — used by guest policy routing)
|
||||
ip route add default via "$GRE_GATEWAY" table 100
|
||||
|
||||
# Guest subnet direct route in table 100 (background — WiFi may not be up yet)
|
||||
# Without this, router's own replies (source IP in guest subnet) go through
|
||||
# GRE instead of back to the guest client (ip rule matches source-based)
|
||||
local guest_subnet
|
||||
guest_subnet=$(awk -F= '/GUEST_SUBNET/{print $2}' /etc/parahub/keys 2>/dev/null)
|
||||
if [ -n "$guest_subnet" ]; then
|
||||
# WiFi interfaces take time to come up at boot — retry in background
|
||||
(
|
||||
local guest_dev="" ga=0
|
||||
while [ $ga -lt 30 ]; do
|
||||
guest_dev=$(ip route | grep "^${guest_subnet} " | awk '{print $3}')
|
||||
[ -n "$guest_dev" ] && break
|
||||
ga=$((ga + 1))
|
||||
sleep 2
|
||||
done
|
||||
if [ -n "$guest_dev" ]; then
|
||||
ip route add "$guest_subnet" dev "$guest_dev" table 100 2>/dev/null
|
||||
logger -t parahub-vpn "Guest route: $guest_subnet via $guest_dev in table 100"
|
||||
else
|
||||
logger -t parahub-vpn "Warning: guest device not found for $guest_subnet after 60s"
|
||||
fi
|
||||
) &
|
||||
fi
|
||||
|
||||
# Reload firewall so vpn_tunnel zone picks up gre6-vpn device
|
||||
/etc/init.d/firewall reload 2>/dev/null &
|
||||
|
||||
logger -t parahub-vpn "GRE6 tunnel up: ${gre_local_ip} → ${VPS_YGG} via $ygg_addr (encaplimit none)"
|
||||
}
|
||||
|
||||
stop() {
|
||||
ip route flush table 100 2>/dev/null
|
||||
ip -6 tunnel del gre6-vpn 2>/dev/null
|
||||
logger -t parahub-vpn "GRE6 tunnel down"
|
||||
}
|
||||
@@ -4,7 +4,7 @@
|
||||
# It configures: batman-adv mesh, dual-band WiFi (private+public), firewall zones, SQM shaping.
|
||||
#
|
||||
# Roles:
|
||||
# bumblebee (L3 Gateway) — full stack: yggdrasil, GRE6, VPN, guest isolation, SQM, DoH
|
||||
# bumblebee (L3 Gateway) — full stack: yggdrasil, Mullvad VPN, guest isolation, speed control, DoH
|
||||
# bee (L2 Transport) — minimal: batman-adv mesh relay, heartbeat
|
||||
|
||||
# Read firmware role (written by build.sh)
|
||||
@@ -175,7 +175,7 @@ NET_EOF
|
||||
done
|
||||
|
||||
else
|
||||
# --- Bumblebee: full network (gw_mode=server, GRE6, guest, policy routing) ---
|
||||
# --- Bumblebee: full network (gw_mode starts as client, promoted to server by gw-check when Mullvad is up) ---
|
||||
uci batch <<-NET_EOF
|
||||
# --- loopback ---
|
||||
set network.loopback=interface
|
||||
@@ -184,14 +184,14 @@ set network.loopback.proto='static'
|
||||
set network.loopback.ipaddr='127.0.0.1'
|
||||
set network.loopback.netmask='255.0.0.0'
|
||||
|
||||
# --- bat0 (batman-adv, server mode — acts as gateway for Bee nodes) ---
|
||||
# --- bat0 (batman-adv, starts as client — gw-check promotes to server when Mullvad is active) ---
|
||||
set network.bat0=interface
|
||||
set network.bat0.proto='batadv'
|
||||
set network.bat0.routing_algo='BATMAN_V'
|
||||
set network.bat0.aggregated_ogms='1'
|
||||
set network.bat0.bridge_loop_avoidance='1'
|
||||
set network.bat0.distributed_arp_table='1'
|
||||
set network.bat0.gw_mode='server'
|
||||
set network.bat0.gw_mode='client'
|
||||
set network.bat0.hop_penalty='15'
|
||||
set network.bat0.orig_interval='1000'
|
||||
|
||||
@@ -229,12 +229,7 @@ set network.wan=interface
|
||||
set network.wan.device='${WAN_DEV}'
|
||||
set network.wan.proto='dhcp'
|
||||
|
||||
# --- VPN tunnel interface (device created by parahub-vpn-tunnel init script) ---
|
||||
set network.vpn_tunnel=interface
|
||||
set network.vpn_tunnel.device='gre6-vpn'
|
||||
set network.vpn_tunnel.proto='none'
|
||||
|
||||
# --- Policy routing: guest traffic → VPN table 100 ---
|
||||
# --- Policy routing: guest traffic → Mullvad table 100 ---
|
||||
add network rule
|
||||
set network.@rule[-1].src='${GUEST_SUBNET}/24'
|
||||
set network.@rule[-1].lookup='100'
|
||||
@@ -448,7 +443,7 @@ set firewall.@rule[-1].target='ACCEPT'
|
||||
FW_EOF
|
||||
|
||||
else
|
||||
# --- Bumblebee: full firewall (4 zones, guest isolation, kill switch) ---
|
||||
# --- Bumblebee: full firewall (3 zones + mullvad_local added by parahub-mullvad, guest kill switch) ---
|
||||
uci batch <<-FW_EOF
|
||||
# --- Zone: lan (private network) ---
|
||||
add firewall zone
|
||||
@@ -476,25 +471,14 @@ set firewall.@zone[-1].masq='1'
|
||||
set firewall.@zone[-1].mtu_fix='1'
|
||||
add_list firewall.@zone[-1].network='wan'
|
||||
|
||||
# --- Zone: vpn_tunnel (GRE6 → VPS → Mullvad) ---
|
||||
add firewall zone
|
||||
set firewall.@zone[-1].name='vpn_tunnel'
|
||||
set firewall.@zone[-1].input='REJECT'
|
||||
set firewall.@zone[-1].output='ACCEPT'
|
||||
set firewall.@zone[-1].forward='REJECT'
|
||||
set firewall.@zone[-1].masq='1'
|
||||
set firewall.@zone[-1].mtu_fix='1'
|
||||
add_list firewall.@zone[-1].network='vpn_tunnel'
|
||||
|
||||
# --- Forwarding: lan → wan (internet for owner) ---
|
||||
add firewall forwarding
|
||||
set firewall.@forwarding[-1].src='lan'
|
||||
set firewall.@forwarding[-1].dest='wan'
|
||||
|
||||
# --- Forwarding: guest → vpn_tunnel ONLY (kill switch: no wan!) ---
|
||||
add firewall forwarding
|
||||
set firewall.@forwarding[-1].src='guest'
|
||||
set firewall.@forwarding[-1].dest='vpn_tunnel'
|
||||
# NOTE: guest → mullvad_local forwarding is added by parahub-mullvad setup.
|
||||
# Without Mullvad configured, guests have NO internet (kill switch by design).
|
||||
# parahub-gw-check monitors Mullvad and sets gw_mode accordingly.
|
||||
|
||||
# --- Rule: guest DHCP (allow guests to get IP) ---
|
||||
add firewall rule
|
||||
@@ -681,7 +665,7 @@ if [ "$ROLE" != "bee" ]; then
|
||||
# Generate unique keys for this node
|
||||
yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf
|
||||
|
||||
# Add VPS gateway as static Yggdrasil peer (for GRE6 tunnel)
|
||||
# Add VPS as static Yggdrasil peer (management plane: remote access, heartbeat)
|
||||
sed -i 's|Peers: \[\]|Peers: ["tls://91.98.123.238:443"]|' /etc/yggdrasil.conf
|
||||
|
||||
# UCI network interface for yggdrasil TUN
|
||||
@@ -717,13 +701,6 @@ set firewall.@rule[-1].proto='tcp'
|
||||
set firewall.@rule[-1].dest_port='80'
|
||||
set firewall.@rule[-1].target='ACCEPT'
|
||||
|
||||
# Allow GRE6 protocol input (tunnel endpoint)
|
||||
add firewall rule
|
||||
set firewall.@rule[-1].name='Allow GRE6 input'
|
||||
set firewall.@rule[-1].src='yggdrasil'
|
||||
set firewall.@rule[-1].proto='47'
|
||||
set firewall.@rule[-1].target='ACCEPT'
|
||||
|
||||
# Allow ICMPv6 on Yggdrasil
|
||||
add firewall rule
|
||||
set firewall.@rule[-1].name='Allow ICMPv6 Ygg'
|
||||
@@ -748,9 +725,8 @@ set firewall.@forwarding[-1].dest='yggdrasil'
|
||||
YGG_FW_EOF
|
||||
uci commit firewall
|
||||
|
||||
# Enable yggdrasil service + VPN tunnel (creates GRE6 after yggdrasil starts)
|
||||
# Enable yggdrasil service
|
||||
/etc/init.d/yggdrasil enable 2>/dev/null || true
|
||||
/etc/init.d/parahub-vpn-tunnel enable 2>/dev/null || true
|
||||
|
||||
# Save yggdrasil address to node keys file
|
||||
YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")
|
||||
@@ -796,9 +772,11 @@ fi
|
||||
|
||||
chmod +x /usr/bin/parahub-heartbeat
|
||||
chmod +x /usr/bin/parahub-autoupdate
|
||||
chmod +x /usr/bin/parahub-gw-check
|
||||
|
||||
# Cron: heartbeat every 5 minutes + OTA update nightly at 3am
|
||||
# Cron: heartbeat every 5 min, gateway health check every 2 min, OTA nightly
|
||||
echo "*/5 * * * * /usr/bin/parahub-heartbeat" >> /etc/crontabs/root
|
||||
echo "*/2 * * * * /usr/bin/parahub-gw-check" >> /etc/crontabs/root
|
||||
echo "0 3 * * * /usr/bin/parahub-autoupdate" >> /etc/crontabs/root
|
||||
/etc/init.d/cron enable
|
||||
|
||||
@@ -819,10 +797,10 @@ else
|
||||
logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24"
|
||||
logger -t parahub-mesh "Mesh ID: ${MESH_ID}"
|
||||
logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}"
|
||||
logger -t parahub-mesh "GRE tunnel: 172.16.0.2 → VPS gateway (Mullvad Portugal)"
|
||||
logger -t parahub-mesh "Kill switch: guest→vpn_tunnel only (no wan)"
|
||||
logger -t parahub-mesh "Guest internet: via local Mullvad (parahub-mullvad setup required)"
|
||||
logger -t parahub-mesh "Kill switch: guest blocked without Mullvad (by design)"
|
||||
logger -t parahub-mesh "Guest IPv6: Yggdrasil SLAAC (full speed, firewall restricted)"
|
||||
logger -t parahub-mesh "bat0 gw_mode: server (gateway for Bee nodes)"
|
||||
logger -t parahub-mesh "bat0 gw_mode: client (promoted to server by gw-check when Mullvad active)"
|
||||
fi
|
||||
|
||||
exit 0
|
||||
|
||||
Reference in New Issue
Block a user