feat: guest traffic via GRE6→VPS→Mullvad, OWE, DNS security, SSH key

- GRE6 tunnel over Yggdrasil to VPS gateway (172.16.0.0/24)
- Kill switch: guest→vpn_tunnel only (no guest→wan)
- OWE transition mode on Parahub_Free (encrypted + open fallback)
- DNS-over-HTTPS via https-dns-proxy (Cloudflare 1.1.1.1)
- Guest DNS hijacked via firewall DNAT redirect
- IPv6 blocked for guest zone (leak prevention)
- SQM 128→512 kbps
- Added kmod-gre6, https-dns-proxy to PACKAGES_CORE
- SSH authorized key for passwordless root access

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

files/etc/dropbear/authorized_keys

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILcethx5tVJWXTj4GjG7h75Fr3IKrwdkpBRc8sN6uRrA andrey.perliev@gmail.com

files/etc/uci-defaults/99-parahub-mesh

@@ -47,8 +47,9 @@ GUEST_IP="10.${GUEST_O1}.${GUEST_O2}.1"
 # 3. KEY GENERATION
 # ============================================================================
 
-PRIVATE_KEY=$(head -c 64 /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 12)
-MESH_KEY=$(head -c 64 /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 16)
+PRIVATE_KEY=$(head -c 128 /dev/urandom | tr -dc 'A-Za-z0-9' | head -c 12)
+# Shared mesh SAE key — same across all Parahub nodes for auto-peering
+MESH_KEY="ndIPclyqSn9LaCki"
 
 mkdir -p /etc/parahub
 cat > /etc/parahub/keys <<KEYS_EOF
@@ -122,6 +123,15 @@ set network.guest.netmask='255.255.255.0'
 set network.wan=interface
 set network.wan.device='eth1'
 set network.wan.proto='dhcp'
+
+# --- GRE6 tunnel (guest traffic → VPS gateway via Yggdrasil) ---
+set network.vpn_tunnel=interface
+set network.vpn_tunnel.proto='grev6'
+set network.vpn_tunnel.peeraddr='200:39f1:6a26:328a:d901:fbd2:d30d:faef'
+set network.vpn_tunnel.ipaddr='172.16.0.2'
+set network.vpn_tunnel.netmask='255.255.255.0'
+set network.vpn_tunnel.gateway='172.16.0.1'
+set network.vpn_tunnel.mtu='1400'
 NET_EOF
 uci commit network
 
@@ -185,13 +195,15 @@ set wireless.mesh_2g.key='${MESH_KEY}'
 set wireless.mesh_2g.network='bat0_hardif_mesh0'
 WIFI_2G_MESH
 
-    # Public AP on 2.4GHz (better range)
+    # Public AP on 2.4GHz (better range) — OWE transition mode
+    # Devices that support OWE get encrypted; legacy devices fall back to open
     uci batch <<-WIFI_2G_PUB
 set wireless.public_2g=wifi-iface
 set wireless.public_2g.device='${RADIO_2G}'
 set wireless.public_2g.mode='ap'
 set wireless.public_2g.ssid='${PUBLIC_SSID}'
-set wireless.public_2g.encryption='none'
+set wireless.public_2g.encryption='owe'
+set wireless.public_2g.owe_transition='1'
 set wireless.public_2g.isolate='1'
 set wireless.public_2g.network='guest'
 WIFI_2G_PUB
@@ -233,6 +245,7 @@ uci commit wireless
 while uci -q delete firewall.@zone[0]; do :; done
 while uci -q delete firewall.@forwarding[0]; do :; done
 while uci -q delete firewall.@rule[0]; do :; done
+while uci -q delete firewall.@redirect[0]; do :; done
 
 uci batch <<-FW_EOF
 # --- Zone: lan (private network) ---
@@ -243,12 +256,13 @@ set firewall.@zone[-1].output='ACCEPT'
 set firewall.@zone[-1].forward='ACCEPT'
 add_list firewall.@zone[-1].network='private'
 
-# --- Zone: guest ---
+# --- Zone: guest (IPv4 only — IPv6 blocked) ---
 add firewall zone
 set firewall.@zone[-1].name='guest'
 set firewall.@zone[-1].input='REJECT'
 set firewall.@zone[-1].output='ACCEPT'
 set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].family='ipv4'
 add_list firewall.@zone[-1].network='guest'
 
 # --- Zone: wan ---
@@ -261,15 +275,25 @@ set firewall.@zone[-1].masq='1'
 set firewall.@zone[-1].mtu_fix='1'
 add_list firewall.@zone[-1].network='wan'
 
+# --- Zone: vpn_tunnel (GRE6 → VPS → Mullvad) ---
+add firewall zone
+set firewall.@zone[-1].name='vpn_tunnel'
+set firewall.@zone[-1].input='REJECT'
+set firewall.@zone[-1].output='ACCEPT'
+set firewall.@zone[-1].forward='REJECT'
+set firewall.@zone[-1].masq='1'
+set firewall.@zone[-1].mtu_fix='1'
+add_list firewall.@zone[-1].network='vpn_tunnel'
+
 # --- Forwarding: lan → wan (internet for owner) ---
 add firewall forwarding
 set firewall.@forwarding[-1].src='lan'
 set firewall.@forwarding[-1].dest='wan'
 
-# --- Forwarding: guest → wan (internet for guests) ---
+# --- Forwarding: guest → vpn_tunnel ONLY (kill switch: no wan!) ---
 add firewall forwarding
 set firewall.@forwarding[-1].src='guest'
-set firewall.@forwarding[-1].dest='wan'
+set firewall.@forwarding[-1].dest='vpn_tunnel'
 
 # --- Rule: guest DHCP (allow guests to get IP) ---
 add firewall rule
@@ -278,14 +302,16 @@ set firewall.@rule[-1].src='guest'
 set firewall.@rule[-1].proto='udp'
 set firewall.@rule[-1].dest_port='67'
 set firewall.@rule[-1].target='ACCEPT'
+set firewall.@rule[-1].family='ipv4'
 
-# --- Rule: guest DNS (allow guests to resolve) ---
+# --- Rule: guest DNS to router only (hijacked to DoH) ---
 add firewall rule
 set firewall.@rule[-1].name='Guest DNS'
 set firewall.@rule[-1].src='guest'
 set firewall.@rule[-1].proto='tcpudp'
 set firewall.@rule[-1].dest_port='53'
 set firewall.@rule[-1].target='ACCEPT'
+set firewall.@rule[-1].family='ipv4'
 
 # --- Rule: block guest → lan (isolation) ---
 add firewall rule
@@ -295,6 +321,25 @@ set firewall.@rule[-1].dest='lan'
 set firewall.@rule[-1].proto='all'
 set firewall.@rule[-1].target='REJECT'
 
+# --- Rule: block ALL IPv6 from guest (leak prevention) ---
+add firewall rule
+set firewall.@rule[-1].name='Block guest IPv6'
+set firewall.@rule[-1].src='guest'
+set firewall.@rule[-1].proto='all'
+set firewall.@rule[-1].family='ipv6'
+set firewall.@rule[-1].target='REJECT'
+
+# --- DNS hijack: redirect guest DNS to local DoH resolver ---
+add firewall redirect
+set firewall.@redirect[-1].name='Guest DNS hijack'
+set firewall.@redirect[-1].src='guest'
+set firewall.@redirect[-1].src_dport='53'
+set firewall.@redirect[-1].proto='tcpudp'
+set firewall.@redirect[-1].target='DNAT'
+set firewall.@redirect[-1].dest='lan'
+set firewall.@redirect[-1].dest_port='53'
+set firewall.@redirect[-1].family='ipv4'
+
 # --- Standard WAN input rules ---
 add firewall rule
 set firewall.@rule[-1].name='Allow-DHCP-Renew'
@@ -339,7 +384,7 @@ DHCP_EOF
 uci commit dhcp
 
 # ============================================================================
-# 8. SQM TRAFFIC SHAPING (guest 128 kbps limit)
+# 8. SQM TRAFFIC SHAPING (guest 512 kbps limit)
 # ============================================================================
 
 # Find the guest interface device name (will be set after network restart)
@@ -349,8 +394,8 @@ uci batch <<-SQM_EOF
 set sqm.guest=queue
 set sqm.guest.enabled='1'
 set sqm.guest.interface='br-guest'
-set sqm.guest.download='128'
-set sqm.guest.upload='128'
+set sqm.guest.download='512'
+set sqm.guest.upload='512'
 set sqm.guest.qdisc='cake'
 set sqm.guest.script='piece_of_cake.qos'
 set sqm.guest.linklayer='ethernet'
@@ -359,7 +404,35 @@ SQM_EOF
 uci commit sqm
 
 # ============================================================================
-# 9. SYSTEM SETTINGS
+# 9. DNS-OVER-HTTPS (guest DNS privacy)
+# ============================================================================
+
+# https-dns-proxy: local DoH resolver for guest DNS queries
+# Guest DNS is hijacked via firewall redirect to this resolver
+uci batch <<-DOH_EOF
+set https-dns-proxy.main=main
+set https-dns-proxy.main.doh_paramters='-4'
+set https-dns-proxy.main.listen_addr='0.0.0.0'
+set https-dns-proxy.main.listen_port='5053'
+
+set https-dns-proxy.cloudflare=https-dns-proxy
+set https-dns-proxy.cloudflare.resolver_url='https://1.1.1.1/dns-query'
+set https-dns-proxy.cloudflare.listen_addr='127.0.0.1'
+set https-dns-proxy.cloudflare.listen_port='5053'
+DOH_EOF
+uci commit https-dns-proxy
+
+# Configure dnsmasq to use DoH for upstream
+uci -q delete dhcp.@dnsmasq[0].server 2>/dev/null || true
+uci add_list dhcp.@dnsmasq[0].server='127.0.0.1#5053'
+uci set dhcp.@dnsmasq[0].noresolv='1'
+uci commit dhcp
+
+# Enable https-dns-proxy service
+/etc/init.d/https-dns-proxy enable 2>/dev/null || true
+
+# ============================================================================
+# 10. SYSTEM SETTINGS
 # ============================================================================
 
 uci batch <<-SYS_EOF
@@ -373,7 +446,36 @@ SYS_EOF
 uci commit system
 
 # ============================================================================
-# 10. FINAL
+# 11. YGGDRASIL OVERLAY NETWORK
+# ============================================================================
+
+# Generate unique keys for this node
+yggdrasil -genconf | sed 's/IfName: .*/IfName: ygg0/' > /etc/yggdrasil.conf
+
+# Add VPS gateway as static Yggdrasil peer (for GRE6 tunnel)
+sed -i 's|Peers: \[\]|Peers: ["tls://91.98.123.238:443"]|' /etc/yggdrasil.conf
+
+# UCI network interface for yggdrasil TUN
+uci batch <<-YGG_EOF
+set network.yggdrasil=interface
+set network.yggdrasil.device='ygg0'
+set network.yggdrasil.proto='none'
+YGG_EOF
+uci commit network
+
+# Add yggdrasil to LAN zone (mesh nodes trust each other)
+uci add_list firewall.@zone[0].network='yggdrasil'
+uci commit firewall
+
+# Enable yggdrasil service
+/etc/init.d/yggdrasil enable
+
+# Save yggdrasil address to node keys file
+YGG_ADDR=$(yggdrasil -address -useconffile /etc/yggdrasil.conf 2>/dev/null || echo "unknown")
+echo "YGGDRASIL_ADDRESS=${YGG_ADDR}" >> /etc/parahub/keys
+
+# ============================================================================
+# 12. FINAL
 # ============================================================================
 
 # Log completion
@@ -382,5 +484,8 @@ logger -t parahub-mesh "Hostname: ${HOSTNAME}"
 logger -t parahub-mesh "Private: ${PRIVATE_SSID} @ ${PRIV_IP}/24"
 logger -t parahub-mesh "Guest: ${PUBLIC_SSID} @ ${GUEST_IP}/24"
 logger -t parahub-mesh "Mesh ID: ${MESH_ID}"
+logger -t parahub-mesh "Yggdrasil: ${YGG_ADDR}"
+logger -t parahub-mesh "GRE tunnel: 172.16.0.2 → VPS gateway (Mullvad Portugal)"
+logger -t parahub-mesh "Kill switch: guest→vpn_tunnel only (no wan)"
 
 exit 0

scripts/build.sh

@@ -2,54 +2,80 @@
 # Parahub Mesh Firmware Builder
 # Uses OpenWrt Image Builder to create custom firmware with mesh packages.
 #
-# Usage: ./scripts/build.sh <profile>
-# Example: ./scripts/build.sh glinet_gl-axt1800
+# Usage: ./scripts/build.sh <device>
+# Example: ./scripts/build.sh axt1800
 
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
 
+OPENWRT_VERSION="${OPENWRT_VERSION:-25.12.0-rc4}"
+
 # ============================================================================
-# Configuration
+# Device Database (device → target/subtarget + Image Builder profile)
 # ============================================================================
 
-OPENWRT_VERSION="${OPENWRT_VERSION:-23.05.5}"
-OPENWRT_TARGET="${OPENWRT_TARGET:-mediatek/filogic}"
-BUILDER_URL="https://downloads.openwrt.org/releases/${OPENWRT_VERSION}/targets/${OPENWRT_TARGET}/openwrt-imagebuilder-${OPENWRT_VERSION}-${OPENWRT_TARGET//\//-}.Linux-x86_64.tar.xz"
-BUILDER_DIR="${PROJECT_DIR}/imagebuilder"
-
-# Profile mapping (friendly name → Image Builder profile)
-declare -A PROFILES=(
-    ["axt1800"]="glinet_gl-axt1800"
-    ["mt3000"]="glinet_gl-mt3000"
-    ["ax6s"]="xiaomi_redmi-router-ax6s"
-)
+device_config() {
+    local device="$1"
+    case "$device" in
+        axt1800)
+            OPENWRT_TARGET="qualcommax/ipq60xx"
+            PROFILE="glinet_gl-axt1800"
+            ;;
+        mt3000)
+            OPENWRT_TARGET="mediatek/filogic"
+            PROFILE="glinet_gl-mt3000"
+            ;;
+        mt6000)
+            OPENWRT_TARGET="mediatek/filogic"
+            PROFILE="glinet_gl-mt6000"
+            ;;
+        ax6s)
+            OPENWRT_TARGET="mediatek/filogic"
+            PROFILE="xiaomi_redmi-router-ax6s"
+            ;;
+        ax53u)
+            OPENWRT_TARGET="ramips/mt7621"
+            PROFILE="asus_rt-ax53u"
+            ;;
+        *)
+            return 1
+            ;;
+    esac
+}
 
 # ============================================================================
 # Packages
 # ============================================================================
 
-# Core mesh packages (always included)
 PACKAGES_CORE=(
     # batman-adv mesh
     kmod-batman-adv
     batctl-full
 
-    # 802.11s mesh support
+    # 802.11s mesh support (replace basic wpad, includes OWE)
     wpad-mesh-mbedtls
     -wpad-basic-mbedtls
 
+    # Yggdrasil overlay network
+    yggdrasil
+
+    # GRE6 tunnel (guest traffic → VPS gateway)
+    kmod-gre6
+
+    # DNS-over-HTTPS for guest privacy
+    https-dns-proxy
+
     # SQM traffic shaping
     sqm-scripts
     kmod-sched-cake
 
-    # Utilities
+    # Management
     luci
     luci-app-sqm
 )
 
-# Full package set
 PACKAGES_FULL=(
     "${PACKAGES_CORE[@]}"
 
@@ -65,49 +91,68 @@ PACKAGES_FULL=(
 # ============================================================================
 
 usage() {
-    echo "Usage: $0 <profile>"
+    echo "Usage: $0 <device>"
     echo ""
-    echo "Profiles:"
-    for key in "${!PROFILES[@]}"; do
-        echo "  ${key} → ${PROFILES[$key]}"
-    done
+    echo "Devices:"
+    echo "  axt1800   GL.iNet GL-AXT1800 (Slate AX)    qualcommax/ipq60xx"
+    echo "  mt3000    GL.iNet GL-MT3000 (Beryl AX)      mediatek/filogic"
+    echo "  mt6000    GL.iNet GL-MT6000 (Flint 2)       mediatek/filogic"
+    echo "  ax6s      Xiaomi Redmi AX6S                 mediatek/filogic"
+    echo "  ax53u     Asus RT-AX53U                    ramips/mt7621"
+    echo ""
+    echo "OpenWrt version: ${OPENWRT_VERSION} (override with OPENWRT_VERSION env var)"
     echo ""
     echo "Environment variables:"
     echo "  OPENWRT_VERSION  OpenWrt release (default: ${OPENWRT_VERSION})"
-    echo "  OPENWRT_TARGET   Target platform (default: ${OPENWRT_TARGET})"
     echo "  PACKAGES_EXTRA   Additional packages (space-separated)"
     exit 1
 }
 
+builder_dir() {
+    echo "${PROJECT_DIR}/imagebuilder-${OPENWRT_VERSION}-${OPENWRT_TARGET//\//-}"
+}
+
 download_builder() {
-    if [ -d "$BUILDER_DIR" ]; then
-        echo "Image Builder already downloaded, skipping..."
+    local dir
+    dir="$(builder_dir)"
+
+    if [ -d "$dir" ]; then
+        echo "Image Builder already downloaded at ${dir##*/}, skipping..."
         return
     fi
 
-    echo "Downloading OpenWrt Image Builder ${OPENWRT_VERSION}..."
-    mkdir -p "$BUILDER_DIR"
-    wget -q --show-progress -O- "$BUILDER_URL" | tar -xJ --strip-components=1 -C "$BUILDER_DIR"
+    # OpenWrt 25.x uses .tar.zst, older uses .tar.xz
+    local base_url="https://downloads.openwrt.org/releases/${OPENWRT_VERSION}/targets/${OPENWRT_TARGET}/openwrt-imagebuilder-${OPENWRT_VERSION}-${OPENWRT_TARGET//\//-}.Linux-x86_64"
+    echo "Downloading OpenWrt Image Builder ${OPENWRT_VERSION} for ${OPENWRT_TARGET}..."
+    mkdir -p "$dir"
+
+    if wget -q --spider "${base_url}.tar.zst" 2>/dev/null; then
+        wget -q --show-progress -O- "${base_url}.tar.zst" | zstd -d | tar -x --strip-components=1 -C "$dir"
+    else
+        wget -q --show-progress -O- "${base_url}.tar.xz" | tar -xJ --strip-components=1 -C "$dir"
+    fi
 }
 
 build_firmware() {
-    local profile="$1"
+    local dir
+    dir="$(builder_dir)"
     local packages="${PACKAGES_FULL[*]} ${PACKAGES_EXTRA:-}"
 
-    echo "Building firmware for profile: ${profile}"
+    echo "Building firmware for profile: ${PROFILE}"
     echo "Packages: ${packages}"
     echo "Custom files: ${PROJECT_DIR}/files"
 
-    make -C "$BUILDER_DIR" image \
-        PROFILE="$profile" \
+    make -C "$dir" image \
+        PROFILE="$PROFILE" \
         PACKAGES="$packages" \
         FILES="${PROJECT_DIR}/files" \
         BIN_DIR="${PROJECT_DIR}/output"
 
     echo ""
     echo "Build complete! Firmware images:"
-    ls -lh "${PROJECT_DIR}/output/"*.bin 2>/dev/null || echo "(no .bin files found)"
-    ls -lh "${PROJECT_DIR}/output/"*.img* 2>/dev/null || echo "(no .img files found)"
+    ls -lh "${PROJECT_DIR}/output/"*.bin 2>/dev/null || true
+    ls -lh "${PROJECT_DIR}/output/"*.img* 2>/dev/null || true
+    ls -lh "${PROJECT_DIR}/output/"*.itb 2>/dev/null || true
 }
 
 # ============================================================================
@@ -118,21 +163,20 @@ if [ $# -lt 1 ]; then
     usage
 fi
 
-INPUT_PROFILE="$1"
+INPUT="$1"
 
-# Resolve profile name
-if [ -n "${PROFILES[$INPUT_PROFILE]+x}" ]; then
-    PROFILE="${PROFILES[$INPUT_PROFILE]}"
-else
-    # Assume it's a raw Image Builder profile name
-    PROFILE="$INPUT_PROFILE"
+if ! device_config "$INPUT"; then
+    echo "Error: Unknown device '${INPUT}'"
+    echo ""
+    usage
 fi
 
 echo "=== Parahub Mesh Firmware Builder ==="
+echo "Device:  ${INPUT}"
 echo "OpenWrt: ${OPENWRT_VERSION}"
 echo "Target:  ${OPENWRT_TARGET}"
 echo "Profile: ${PROFILE}"
 echo ""
 
 download_builder
-build_firmware "$PROFILE"
+build_firmware