Compare commits

...

106 Commits

Author SHA1 Message Date
garywill 60d4b53236 version 0.8.1 2025-09-13 10:33:03 +08:00
garywill bef65d4b2b add some quotes 2025-09-13 10:33:03 +08:00
garywill 1158b8b337 use approach better than '-gt 0' for writing hostapd.conf 2025-09-13 10:33:03 +08:00
garywill 8b3ebd8f67 text 2025-09-13 10:33:03 +08:00
garywill 73aac55c34 refractor hostapd.conf wifi4-6 part 2025-09-13 10:33:03 +08:00
garywill 317de635d2 readme 2025-09-13 10:33:03 +08:00
garywill cf9bc306c4 version 0.8.0 2025-08-17 16:21:56 +08:00
garywill 3f8415a103 Merge branch 'wifi6' 2025-08-17 12:12:25 +08:00
garywill 7ffd74d4eb fix if interface already in a firewalld zone 2025-08-17 11:08:02 +08:00
garywill 3b036f4781 readme 2025-08-17 11:07:21 +08:00
garywill c6d704e3aa readme 2025-08-17 10:32:48 +08:00
garywill a511219b50 hostapd.conf: separate ieee80211n=1 and ht_capab= 2025-08-17 10:32:48 +08:00
garywill 7ecc846459 alias: --req-wifi4 = --req-ht . Same for wifi5/6 2025-08-17 10:32:48 +08:00
garywill bbb70b99ba update wifi options description 2025-08-17 10:32:48 +08:00
garywill 3ebbf37428 Rename --idle-timeout to --sta-timeout. No default value 2025-08-17 10:32:48 +08:00
garywill 958ebffd7f rename --enable-twt to --p2ptwt 2025-08-17 10:32:48 +08:00
garywill ff15c19383 wifi options sequence 2025-08-17 10:32:48 +08:00
garywill bc8bfb5cab wifi 4~6 options sequence 2025-08-17 10:32:48 +08:00
Phani Pavan K d288b8f0ed bump unstable version 2025-08-16 11:01:12 +08:00
Phani Pavan K 13a1654b91 added p2p twt and idle timeout, remove random spaces 2025-08-16 11:00:30 +08:00
Phani Pavan K a18d4e75a4 add he beamform(er/ee) options 2025-08-16 11:00:27 +08:00
garywill b4cbcbdbbb is_same_netns: handle if not same pidns 2025-08-16 10:09:08 +08:00
Phani Pavan K 205814a2ea lint remove stray spaces 2025-07-28 14:21:56 +08:00
Phani Pavan Kambhampati b6fe527472
WiFi 6 Support (#82)
* add options for wifi66

* rebase to 0.7.6 and upgrade version to 0.8.0-unstable0

* fix channel detection

* can_transmit_to_channel: fix 5GHz and 6GHz freq range

* can_transmit_to_channel: limit freq integer part to 4 digits

* enable wmm when wifi 6 is enabled

* lint remove stray spaces

* Revert "lint remove stray spaces"

This reverts commit 8830b95cff.

---------

Co-authored-by: garywill <garywill@disroot.org>
Co-authored-by: Phani Pavan K <kphanipavan+goose@gmail.com>
2025-07-28 06:16:57 +00:00
garywill 94949ba40b show freq band and channel 2025-07-27 14:12:21 +08:00
garywill 9df05cd81a dependency: crda ,regdb 2025-07-27 13:42:50 +08:00
garywill 01c99f8e4c show config dir at start 2025-07-27 13:03:47 +08:00
garywill 3900871977 add --keep-confdir 2025-07-27 12:55:28 +08:00
garywill cfeadeb3bd start/exit time in temp config dir 2025-07-27 12:52:59 +08:00
garywill 702c4f28f5 global variable PHY 2025-07-26 10:50:10 +08:00
garywill 3e23e0bd0c refractor freq to channel function (for 2.4G, 5G, 6G) 2025-07-26 10:17:26 +08:00
garywill fe2348a725 some aa-complain improve 2024-12-18 20:52:53 +08:00
ByteSnipers GmbH 7b374d1ee1 Fix a bug with complian command
added support for aa-complian.
2024-12-18 12:50:44 +00:00
garywill e7ecf8707d 0.7.6 2024-10-04 12:17:39 +08:00
garywill fbad56f05c get_pid_by_dbus_name() : fix stderr show 2024-04-20 20:48:05 +08:00
garywill c376609896 readme text 2024-04-20 20:46:05 +08:00
garywill a8ae765f03 fix type #73 2024-04-20 20:45:53 +08:00
garywill d39b438161 0.7.6b 2024-02-25 10:00:00 +08:00
garywill 6aabef278b Detect firewalld and make sure it won't interfere 2024-02-25 10:00:00 +08:00
garywill 8b57dcef1a judge netns 2024-02-25 10:00:00 +08:00
garywill 1def3deb96 improve nm running judgement. use dbus also 2024-02-25 10:00:00 +08:00
garywill 04f473dc64 call disable_unwanted_forward() early 2024-02-25 10:00:00 +08:00
garywill c1bb2668dd 0.7.5b 2024-02-25 10:00:00 +08:00
garywill a4e3089e69 disable unwanted forwarding 2024-02-25 10:00:00 +08:00
garywill 8c9e16dd17 explictly ban unwanted forwardings in start_nat() 2024-02-25 10:00:00 +08:00
garywill 40872ebb9e exclude 6 if not enabled 2024-02-25 10:00:00 +08:00
garywill 97b1ef5bd0 merge for start_redsocks() 2024-02-25 10:00:00 +08:00
garywill 9fc74d4bdb add missing local vars 2024-02-25 10:00:00 +08:00
garywill 8759ee43f1 merge for start_catch_dns() 2024-02-25 10:00:00 +08:00
garywill 5f24246e85 merge for allow_dns_port() 2024-02-25 10:00:00 +08:00
garywill 508fefa48f rename GATEWAY to GATEWAY4 2024-02-25 10:00:00 +08:00
garywill 791f6c314b merge for start_ban_lan() 2024-02-25 10:00:00 +08:00
garywill 4db9dcbdb0 merge iptables operation 4 and 6 for start_nat() 2024-02-25 10:00:00 +08:00
garywill 97269da898 use var SUBNET_NET4 , SUBNET_NET6 2024-02-25 10:00:00 +08:00
garywill 9c9b3afde6 use array for iptables custom chain 2024-02-25 10:00:00 +08:00
garywill 3d3a63d53b version 0.7.3 2024-01-19 14:33:25 +08:00
garywill 0274cd339b Merge branch 2024-01-19 14:26:36 +08:00
garywill 32f168ec8c can_transmit_to_channel() ignores freq value just focus on channel number 2024-01-19 13:50:34 +08:00
Zehka f42dc4314d regex fixes 2024-01-16 13:26:52 +01:00
Zehka 78d481d083 also ignore trailing \.0+ for iw phy info 2024-01-16 00:59:41 +01:00
Zehka 34e326f303 Remove trailing .0 from iw reported frequency
Signed-off-by: Zehka <git@zehka.net>
2024-01-16 00:32:56 +01:00
garywill cbaa19db72 improve pci info format 2024-01-14 20:25:06 +08:00
garywill a86517294b readme 2024-01-14 20:20:50 +08:00
garywill 9790d3117b show current pci driver 2024-01-14 09:27:36 +08:00
garywill e65228750b apply some spellcheck 2024-01-14 08:49:38 +08:00
garywill 718a1752f1 version 0.7.1 2023-12-30 22:31:32 +08:00
garywill 5dcfacc418 0.7.1b readme 2023-10-04 22:02:49 +08:00
garywill 0c85f00297 version 0.7.1b 2023-10-04 21:48:37 +08:00
garywill a2fcbc4781 aliases 2023-10-04 21:48:27 +08:00
garywill 63cd88b5fc version 0.7.0b 2023-10-04 11:54:49 +08:00
garywill 957ed25f07 rename some options 2023-10-04 11:43:24 +08:00
garywill 183cf44934 remove duplicated hostapd.conf path info (will show after) 2023-10-04 11:21:50 +08:00
garywill 4e92b3ebf5 -c will not fallback automatically 2023-10-04 11:21:00 +08:00
garywill 992ad00ca1 Revert "Add force channel flag"
This reverts commit 73441c4ed3.
2023-10-04 10:41:13 +08:00
Phani Pavan Kambhampati 9d874dbe88
Fix variables 2023-10-02 13:04:41 +05:30
Phani Pavan K b94cf7c43f 5GHz Fat Channel Support 2023-09-28 12:16:59 +05:30
Phani Pavan K 0acb16dbaa Add Hotspot 2.0 Support flag 2023-09-28 11:42:00 +05:30
Phani Pavan K 73441c4ed3 Add force channel flag 2023-09-28 11:19:29 +05:30
garywill 8527e1a9b6 add link to web doc reader 2023-04-23 14:36:37 +08:00
garywill 18a57119b9 readme 2023-04-23 14:05:41 +08:00
garywill 7f1ae6282e readme 2023-04-23 14:01:35 +08:00
garywill 4515dde9b4 readme 2023-04-23 10:17:41 +08:00
garywill 45ad35d29f 0.6.7 2023-01-07 20:55:20 +08:00
garywill a663d9052b update readme 2023-01-07 09:10:05 +08:00
garywill e3941c560f text 2023-01-07 09:08:18 +08:00
garywill 7ec589b1c2 add some notice 2023-01-07 09:07:18 +08:00
Cabbache 10ca7249cb Updated --virt-name to make interface name predictable 2023-01-07 01:02:04 +00:00
lukescerri a414ac035b Added --virt-name option 2022-09-26 21:26:50 +02:00
lukescerri b51a2d2349 renamed virtual interface 2022-09-24 17:32:28 +02:00
garywill 9e1d985623 move 'qrencode' from readme dependency to cli usage note 2022-04-03 18:05:05 +08:00
garywill 433b3b8d39 add --dns-nocache option 2022-04-03 18:03:51 +08:00
garywill e8284c5398 add "Install" section in readme 2022-04-03 17:46:48 +08:00
garywill c2da43250e typo 2022-04-03 17:46:24 +08:00
garywill f6995bc30c get device pci info 2022-01-05 20:01:38 +08:00
garywill f8cbf5eded don't use PGID to do clean up 2021-11-20 20:32:38 +08:00
garywill 15a2e0ce53 0.6.6 2021-11-07 10:31:15 +08:00
garywill 083cd42afd new iptables function 2021-11-07 10:30:56 +08:00
garywill 7c6113f1d2 0.6.5 2021-11-07 10:29:12 +08:00
garywill 0ccdcf647a correct description about '--dhcp-dns(6)' 2021-11-07 10:28:36 +08:00
garywill 61a5af2202 more text 2021-10-23 10:56:51 +08:00
garywill d2bc2d9460 readme fold 2021-10-23 10:16:12 +08:00
garywill 2468b5a415 Version 0.6.3. Tested nftables
Stop judging xt_comment by lsmod, which wasn't reliable
Users who want to disable iptables comment should set env var
2021-08-29 10:27:17 +08:00
garywill 3b71515e07 hostapd in apparmor complain mode
to solve problem that openSUSE users meet
2021-08-29 10:24:50 +08:00
garywill c2b21bb391 0.6.2 2021-08-22 09:27:49 +08:00
garywill e5fc9efe48 support short gateway ip expression
fix dnsmasq pid not get
watchdog zombie judgement
iptables nft and comment judgement
use fifo for dnsmasq log
2021-04-17 12:29:53 +08:00
garywill 1e3c5004c3 some improvements
add '-l'

change MAC addr backking up and restoring judgement to OLD_MACADDR ==
now

filter --lc STATUS==FAILED line

fix iw and iwconfig availability not checked

not use die() before trap
2021-02-22 09:20:41 +08:00
3 changed files with 1365 additions and 771 deletions

42
NOTICE
View File

@ -1,42 +0,0 @@
Copyright (c) 2013, oblique
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
================================================================================
linux-router
Copyright (C) 2018 garywill
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA

369
README.md
View File

@ -1,10 +1,11 @@
# Linux-router # Linux-router
Set Linux as router in one command. Able to Provide Internet, or create Wifi hotspot. Support transparent proxy (redsocks). Also useful for routing VM/containers. Set Linux as router in one command. Able to provide Internet, or create WiFi hotspot. Support transparent proxy (redsocks). Also useful for routing VM/containers.
It wraps `iptables`, `dnsmasq` etc. stuff. Use in one command, restore in one command or by `control-c` (or even by closing terminal window). It wraps `iptables`, `dnsmasq` etc. stuff. Use in one command, restore in one command or by `control-c` (or even by closing terminal window).
[Buy me a coffee](https://github.com/garywill/receiving/blob/master/receiving_methods.md) :) [More tools and projects 🛠️](https://garywill.github.io) | [🍻 Buy me a coffee ❤️](https://github.com/garywill/receiving/blob/master/receiving_methods.md)
## Features ## Features
@ -12,16 +13,23 @@ Basic features:
- Create a NATed sub-network - Create a NATed sub-network
- Provide Internet - Provide Internet
- DHCP server and RA - DHCP server (and RA)
- Specify what DNS the DHCP server assigns to clients
- DNS server - DNS server
- Specify upstream DNS (kind of a plain DNS proxy)
- IPv6 (behind NATed LAN, like IPv4) - IPv6 (behind NATed LAN, like IPv4)
- Creating Wifi hotspot: - Creating WiFi hotspot:
- Wifi 3/4/5/6
- 2.4GHz, 5GHz
- Channel selecting - Channel selecting
- Choose encryptions: WPA2/WPA, WPA2, WPA, No encryption - Choose encryptions: WPA2/WPA, WPA2, WPA, No encryption
- Create AP on the same interface you are getting Internet (require same channel) - Create AP on the same interface you are getting Internet (Need hardware support. Usually require same channel)
- Transparent proxy (redsocks) - Transparent proxy (redsocks)
- DNS proxy - Transparent DNS proxy (hijack port 53 packets)
- Compatible with NetworkManager (automatically set interface as unmanaged) - Detect and prevent interference from following Linux system daemons:
- NetworkManager (handle interface (un)managed status)
- firewalld (use temporary `trusted` zone)
- Instances managing. You can run multiple instances, to create different sub-networks.
**For many other features, see below [CLI usage](#cli-usage-and-other-features)** **For many other features, see below [CLI usage](#cli-usage-and-other-features)**
@ -35,7 +43,7 @@ Internet----(eth0/wlan0)-Linux-(wlanX)AP
``` ```
Internet Internet
Wifi AP(no DHCP) | WiFi AP(no DHCP) |
|----(wlan1)-Linux-(eth0/wlan0)------ |----(wlan1)-Linux-(eth0/wlan0)------
| (DHCP) | (DHCP)
|--client |--client
@ -58,42 +66,87 @@ Internet----(eth0/wlan0)-Linux-(eth1)------Another PC
Internet----(eth0/wlan0)-Linux-(virtual interface)-----VM/container Internet----(eth0/wlan0)-Linux-(virtual interface)-----VM/container
``` ```
## Install
1-file-script. Release on [Linux-router repo on Github](https://github.com/garywill/linux-router). Just download and run the bash script (meet the dependencies). In this case use without installation.
I'm currently not packaging for any distro. If you do, open a PR and add the link (can be with a version badge) to list here
| Linux distro | |
| ------------ | ---------------------------------------------------------------------------------------------------------- |
| Any | download [1-file-script](https://raw.githubusercontent.com/garywill/linux-router/master/lnxrouter) and run without installation |
### Dependencies
- bash
- procps or procps-ng
- iproute2
- dnsmasq
- iptables (or nftables with `iptables-nft` translation linked)
- WiFi hotspot dependencies
- hostapd
- iw (or iwconfig, when iw can not recognize adapter)
- haveged (optional)
- crda and wireless-regdb (optional)
## Usage ## Usage
### Provide Internet to an interface ### Provide Internet to an interface
``` ```bash
sudo lnxrouter -i eth1 sudo lnxrouter -i eth1
``` ```
### Provide an interface's Internet to another interface no matter which interface (other than `eth1`) you're getting Internet from.
``` ### Create WiFi hotspot
sudo lnxrouter -i eth1 -o vpn0 --dhcp-dns 1.1.1.1 -6 --dhcp-dns6 [2606:4700:4700::1111]
```
> Read _Notice 1_
### Create Wifi hotspot ```bash
```
sudo lnxrouter --ap wlan0 MyAccessPoint -p MyPassPhrase sudo lnxrouter --ap wlan0 MyAccessPoint -p MyPassPhrase
``` ```
### LAN without Internet no matter which interface you're getting Internet from (even from `wlan0`). Will create virtual Interface `x0wlan0` for hotspot.
### Provide an interface's Internet to another interface
Clients access Internet through only `isp5`
<details>
```bash
sudo lnxrouter -i eth1 -o isp5 --no-dns --dhcp-dns 1.1.1.1 -6 --dhcp-dns6 [2606:4700:4700::1111]
``` ```
> In this case of usage, it's recommended to:
>
> 1. Stop serving local DNS
> 2. Tell clients which DNS to use (ISP5's DNS. Or, a safe public DNS, like above example)
</details>
### Create LAN without providing Internet
<details>
```bash
sudo lnxrouter -n -i eth1 sudo lnxrouter -n -i eth1
```
```bash
sudo lnxrouter -n --ap wlan0 MyAccessPoint -p MyPassPhrase sudo lnxrouter -n --ap wlan0 MyAccessPoint -p MyPassPhrase
``` ```
> Read _Notice 1_ </details>
### Internet for LXC ### Internet for LXC
<details>
Create a bridge Create a bridge
``` ```bash
sudo brctl addbr lxcbr5 sudo brctl addbr lxcbr5
``` ```
@ -106,14 +159,20 @@ lxc.network.link = lxcbr5
lxc.network.hwaddr = xx:xx:xx:xx:xx:xx lxc.network.hwaddr = xx:xx:xx:xx:xx:xx
``` ```
``` ```bash
sudo lnxrouter -i lxcbr5 sudo lnxrouter -i lxcbr5
``` ```
### Transparent proxy with Tor </details>
``` ### Transparent proxy
sudo lnxrouter -i eth1 --tp 9040 --dns 9053 -g 192.168.55.1 --p6 fd00:5:6:7::
All clients' Internet traffic go through, for example, Tor (notice this example is NOT an anonymity use)
<details>
```bash
sudo lnxrouter -i eth1 --tp 9040 --dns 9053 -g 192.168.55.1 -6 --p6 fd00:5:6:7::
``` ```
In `torrc` In `torrc`
@ -125,11 +184,19 @@ TransPort [fd00:5:6:7::1]:9040
DNSPort [fd00:5:6:7::1]:9053 DNSPort [fd00:5:6:7::1]:9053
``` ```
> **Warn**: Tor's anonymity relies on a purpose-made browser. Using Tor like this (sharing Tor's network to LAN clients) will NOT ensure anonymity.
>
> Although we use Tor as example here, Linux-router does NOT ensure nor is NOT aiming at anonymity.
</details>
### Clients-in-sandbox network ### Clients-in-sandbox network
To not give our infomation to clients: To not give our infomation to clients. Clients can still access Internet.
``` <details>
```bash
sudo lnxrouter -i eth1 \ sudo lnxrouter -i eth1 \
--tp 9040 --dns 9053 \ --tp 9040 --dns 9053 \
--random-mac \ --random-mac \
@ -137,20 +204,23 @@ sudo lnxrouter -i eth1 \
--catch-dns --log-dns # optional --catch-dns --log-dns # optional
``` ```
> This script comes with no warrenty, use on your own risk </details>
> Linux-router comes with no warranty. Use on your own risk
### Use as transparent proxy for LXD ### Use as transparent proxy for LXD
<details>
Create a bridge Create a bridge
``` ```bash
sudo brctl addbr lxdbr5 sudo brctl addbr lxdbr5
``` ```
Create and add a new LXD profile overriding container's `eth0` Create and add a new LXD profile overriding container's `eth0`
``` ```bash
lxc profile create profile5 lxc profile create profile5
lxc profile edit profile5 lxc profile edit profile5
@ -168,13 +238,13 @@ name: profile5
lxc profile add <container> profile5 lxc profile add <container> profile5
``` ```
``` ```bash
sudo lnxrouter -i lxdbr5 --tp 9040 --dns 9053 sudo lnxrouter -i lxdbr5 --tp 9040 --dns 9053
``` ```
To remove that new profile from container To remove that new profile from container
``` ```bash
lxc profile remove <container> profile5 lxc profile remove <container> profile5
``` ```
@ -182,39 +252,55 @@ lxc profile remove <container> profile5
Add new `eth0` to container overriding default `eth0` Add new `eth0` to container overriding default `eth0`
``` ```bash
lxc config device add <container> eth0 nic name=eth0 nictype=bridged parent=lxdbr5 lxc config device add <container> eth0 nic name=eth0 nictype=bridged parent=lxdbr5
``` ```
To remove the customized `eth0` to restore default `eth0` To remove the customized `eth0` to restore default `eth0`
``` ```bash
lxc config device remove <container> eth0 lxc config device remove <container> eth0
``` ```
</details>
### Use as transparent proxy for VirtualBox ### Use as transparent proxy for VirtualBox
<details>
In VirtualBox's global settings, create a host-only network `vboxnet5` with DHCP disabled. In VirtualBox's global settings, create a host-only network `vboxnet5` with DHCP disabled.
``` ```bash
sudo lnxrouter -i vboxnet5 --tp 9040 --dns 9053 sudo lnxrouter -i vboxnet5 --tp 9040 --dns 9053
``` ```
</details>
### Use as transparent proxy for firejail ### Use as transparent proxy for firejail
<details>
Create a bridge Create a bridge
``` ```bash
sudo brctl addbr firejail5 sudo brctl addbr firejail5
``` ```
``` ```bash
sudo lnxrouter -i firejail5 -g 192.168.55.1 --tp 9040 --dns 9053 sudo lnxrouter -i firejail5 -g 192.168.55.1 --tp 9040 --dns 9053
firejail --net=firejail5 --dns=192.168.55.1 --blacklist=/var/run/nscd firejail --net=firejail5 --dns=192.168.55.1 --blacklist=/var/run/nscd
``` ```
Firejail's `/etc/resolv.conf` doesn't obtain DNS from DHCP, so we need to assign.
nscd is domain name cache service, which shouldn't be accessed from in jail here.
</details>
### CLI usage and other features ### CLI usage and other features
<details>
``` ```
Usage: lnxrouter <options> Usage: lnxrouter <options>
@ -224,62 +310,67 @@ Options:
-i <interface> Interface to make NATed sub-network, -i <interface> Interface to make NATed sub-network,
and to provide Internet to and to provide Internet to
(To create Wifi hotspot use '--ap' instead) (To create WiFi hotspot use '--ap' instead)
-o <interface> Specify an inteface to provide Internet from. -o <interface> Specify an inteface to provide Internet from.
(Note using this with default DNS option may leak (Note using this with default DNS option may leak
queries to other interfaces) queries to other interfaces)
-n Do not provide Internet (See Notice 1) -n Do not provide Internet
--ban-priv Disallow clients to access my private network --ban-priv Disallow clients to access my private network
-g <ip> This host's IPv4 address in subnet (mask is /24) -g <ip> This host's IPv4 address in subnet (mask is /24)
(example: '192.168.5.1' or '5' shortly)
-6 Enable IPv6 (NAT) -6 Enable IPv6 (NAT)
--no4 Disable IPv4 Internet (not forwarding IPv4) --no4 Disable IPv4 Internet (not forwarding IPv4).
(See Notice 1). Usually used with '-6' Usually used with '-6'
--p6 <prefix> Set IPv6 LAN address prefix (length 64) --p6 <prefix> Set IPv6 LAN address prefix (length 64)
(example: fd00:1:2:3::) Using this enables '-6' (example: 'fd00:0:0:5::' or '5' shortly)
Using this enables '-6'
--dns <ip>|<port>|<ip:port> --dns <ip>|<port>|<ip:port>
DNS server's upstream DNS. DNS server's upstream DNS.
Use ',' to seperate multiple servers Use ',' to seperate multiple servers
(default: use /etc/resolve.conf) (default: use /etc/resolv.conf)
(Note IPv6 addresses need '[]' around) (Note IPv6 addresses need '[]' around)
--no-dns Do not serve DNS --no-dns Do not serve DNS
--no-dnsmasq Disable dnsmasq server (DHCP, DNS, RA) --no-dnsmasq Disable dnsmasq server (DHCP, DNS, RA)
--catch-dns Transparent DNS proxy, redirect packets(TCP/UDP) --catch-dns Transparent DNS proxy, redirect packets(TCP/UDP)
whose destination port is 53 to this host whose destination port is 53 to this host
--log-dns Show DNS query log --log-dns Show DNS query log (dnsmasq)
--dhcp-dns <IP1[,IP2]>|no --dhcp-dns <IP1[,IP2]>|no
Set IPv4 DNS offered by DHCP (default: this host) Set IPv4 DNS offered by DHCP (default: this host).
--dhcp-dns6 <IP1[,IP2]>|no --dhcp-dns6 <IP1[,IP2]>|no
Set IPv6 DNS offered by DHCP (RA) Set IPv6 DNS offered by DHCP (RA)
(default: this host) (default: this host)
(Note IPv6 addresses need '[]' around) (Note IPv6 addresses need '[]' around)
Using both above two will enable '--no-dns'
--hostname <name> DNS server associate this name with this host. --hostname <name> DNS server associate this name with this host.
Use '-' to read name from /etc/hostname Use '-' to read name from /etc/hostname
-d DNS server will take into account /etc/hosts -d DNS server will take into account /etc/hosts
-e <hosts_file> DNS server will take into account additional -e <hosts_file> DNS server will take into account additional
hosts file hosts file
--dns-nocache DNS server no cache
--mac <MAC> Set MAC address --mac <MAC> Set MAC address
--random-mac Use random MAC address --random-mac Use random MAC address
--tp <port> Transparent proxy, --tp <port> Transparent proxy,
redirect non-LAN TCP and UDP traffic to port. redirect non-LAN TCP and UDP(not tested) traffic to
(usually used with '--dns') port. (usually used with '--dns')
Wifi hotspot options: WiFi hotspot options:
--ap <wifi interface> <SSID> --ap <wifi interface> <SSID>
Create Wifi access point Create WiFi access point
-p, --password <password> -p, --password <password>
Wifi password WiFi password
--qr Show Wifi QR code in terminal --qr Show WiFi QR code in terminal (need qrencode)
--hidden Hide access point (not broadcast SSID) --hidden Hide access point (not broadcast SSID)
--no-virt Do not create virtual interface --no-virt Do not create virtual interface
Using this you can't use same wlan interface Using this you can't use same wlan interface
for both Internet and AP for both Internet and AP
-c <channel> Channel number (default: 1) --virt-name <name> Set name of virtual interface
-c <channel> Specify channel (default: use current, or 1 / 36)
--country <code> Set two-letter country code for regularity --country <code> Set two-letter country code for regularity
(example: US) (example: US)
--freq-band <GHz> Set frequency band: 2.4 or 5 (default: 2.4) --freq-band <GHz> Set frequency band: 2.4 or 5 (default: 2.4)
@ -288,75 +379,159 @@ Options:
(default: 2) (default: 2)
--psk Use 64 hex digits pre-shared-key instead of --psk Use 64 hex digits pre-shared-key instead of
passphrase passphrase
--mac-filter Enable Wifi hotspot MAC address filtering --mac-filter Enable WiFi hotspot MAC address filtering
--mac-filter-accept Location of Wifi hotspot MAC address filter list --mac-filter-accept Location of WiFi hotspot MAC address filter list
(defaults to /etc/hostapd/hostapd.accept) (defaults to /etc/hostapd/hostapd.accept)
--hostapd-debug <level> 1 or 2. Passes -d or -dd to hostapd --hostapd-debug <level> 1 or 2. Passes -d or -dd to hostapd
--isolate-clients Disable wifi communication between clients --isolate-clients Disable wifi communication between clients
--sta-timeout <seconds> Timeout to disconnect a no-signal client
--ieee80211n Enable IEEE 802.11n (HT)
--ieee80211ac Enable IEEE 802.11ac (VHT)
--ht_capab <HT> HT capabilities (default: [HT40+])
--vht_capab <VHT> VHT capabilities
--no-haveged Do not run haveged automatically when needed --no-haveged Do not run haveged automatically when needed
--hs20 Enable Hotspot 2.0
WiFi 4 (802.11n) configs (2.4G/5GHz): (default: not enable)
--wifi4 Enable IEEE 802.11n (HT, High Throughput)
--ht-capab <HT caps> HT capabilities (example: '[HT40+][DSSS_CCK-40]')
(default: '[HT40+]')
--req-wifi4 Only support Wifi>=4 clients
WiFi 5 (802.11ac) configs (5GHz): (default: not enable)
--wifi5 Enable IEEE 802.11ac (VHT, Very High Thoughtput)
--vht-capab <VHT caps> VHT capabilities (example: '[VHT160][RXLDPC]')
--vht-ch-width <index> Index of VHT channel width:
0 for 20MHz or 40MHz (default)
1 for 80MHz
2 for 160MHz
3 for 80+80MHz (Non-contigous 160MHz)
--vht-seg0-ch <channel> Channel index of VHT center frequency for primary
segment. Use with '--vht-ch-width'
--vht-seg1-ch <channel> Channel index of VHT center frequency for secondary
(second 80MHz) segment. Use with '--vht-ch-width 3'
--req-wifi5 Only support Wifi>=5 clients
WiFi 6 (802.11ax) configs (2.4G/5GHz): (default: not enable)
--wifi6 Enable IEEE 802.11ax (HE, High Efficiency)
--he-ch-width <index> Index of HE channel width:
0 for 20MHz or 40MHz (default)
1 for 80MHz
2 for 160MHz
3 for 80+80MHz (Non-contigous 160MHz)
--he-seg0-ch <channel> Channel index of HE center frequency for primary
segment. Use with '--he-ch-width'
--he-seg1-ch <channel> Channel index of HE center frequency for secondary
(second 80MHz) segment. Use with '--he-ch-width 3'
--he-su-bfe HE Single User Beamformee support
--he-su-bfr HE Single User Beamformer support
--he-mu-bfr HE Multi User Beamformer support
--req-wifi6 Only support Wifi>=6 clients
--p2ptwt Peer-to-Peer Target Wake Time support
Note: Some cutting-edge Wifi features strongly depends on hostapd built
with specific flags enabled and compatible hardware
Instance managing: Instance managing:
--daemon Run in background --daemon Run in background
--list-running Show running instances --keep-confdir Don't delete the temporary config dir after exit
--lc, --list-clients <id>
-l, --list-running Show running instances
--lc, --list-clients <id|interface>
List clients of an instance. Or list neighbors of List clients of an instance. Or list neighbors of
any interface, even if it isn't handled by us an interface, even if it isn't handled by us.
(passive mode)
--stop <id> Stop a running instance --stop <id> Stop a running instance
For <id> you can use PID or subnet interface name. For <id> you can use PID or subnet interface name.
You can get them with '--list-running' You can get them with '--list-running'
Notice 1: This script assume your host's default policy won't forward
packets, so the script won't explictly ban forwarding in any
mode. In some unexpected case may cause unwanted packets
leakage between 2 networks, which you should be aware of if you
want isolated network
``` ```
> These changes to system will not be restored by script's cleanup: </details>
> 1. `/proc/sys/net/ipv4/ip_forward = 1` and `/proc/sys/net/ipv6/conf/all/forwarding = 1`
> 1. dnsmasq in Apparmor complain mode
> 1. Kernel module `nf_nat_pptp` loaded
> 1. The wifi device which is used to create hotspot is `rfkill unblock`ed
> 1. Wifi country code, if user specified
## What changes are done to Linux system
## Dependencies On exit of a linux-router instance, script **will do cleanup**, i.e. undo most changes to system. Though, **some** changes (if needed) will **not** be undone, which are:
- bash 1. `/proc/sys/net/ipv4/ip_forward = 1` and `/proc/sys/net/ipv6/conf/all/forwarding = 1`
- procps or procps-ng 2. dnsmasq in Apparmor complain mode
- iproute2 3. hostapd in Apparmor complain mode
- dnsmasq 4. Kernel module `nf_nat_pptp` loaded
- iptables 5. The wifi device which is used to create hotspot is `rfkill unblock`ed
- WiFi hotspot dependencies 6. WiFi country code, if user assigns
- hostapd
- iw ## Meet contributor(s) and become one of them
- iwconfig (you only need this if 'iw' can not recognize your adapter)
- haveged (optional) Visit [**my homepage** 🏡](https://garywill.github.io) to see **more tools and projects** 🛠️.
- qrencode (opional)
> [❤️ Buy me a coffee](https://github.com/garywill/receiving/blob/master/receiving_methods.md) , this project took me lots of time! ([❤️ 扫码领红包并打赏一个!](https://github.com/garywill/receiving/blob/master/receiving_methods.md))
>
> 🥂 ( ^\_^) o自自o (^_^ ) 🍻
🤝 Bisides, thank [create_ap](https://github.com/oblique/create_ap) by [oblique](https://github.com/oblique). This script was forked from create\_ap. Now they are quite different. 🤝 Also thank those people who contributed to that project.
👨‍💻 You can be contributor, too!
- 🍃 There're some TO-DOs listed, in both [readme TODO](#todo) and [in the code file](https://github.com/garywill/linux-router/search?q=TODO&type=code)
- 🍃 Also some [unfulfilled enhancements in the Issues](https://github.com/garywill/linux-router/issues?q=is%3Aissue+is%3Aopen+label%3Aenhancement)
- 🙋‍♂️ Contributions are not limited to coding. There're [some posts and questions](https://github.com/garywill/linux-router/issues) that need more people to answer
## TODO ## TODO
- WPA3 - WPA3
- Global IPv6 - Global IPv6
- Explictly ban forwarding if not needed
- Bring bridging method back
## Donate ## License
[Buy me a coffee](https://github.com/garywill/receiving/blob/master/receiving_methods.md) , this project took me lots of time! linux-router is LGPL licensed
^\_^o自自o^_^ <details>
No? Okay, or just give me a star! ```
linux-router
Copyright (C) 2018 garywill
## For developers This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
```
</details>
Upstream create_ap was BSD licensed
<details>
```
Copyright (c) 2013, oblique
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
* Redistributions of source code must retain the above copyright notice, this
list of conditions and the following disclaimer.
* Redistributions in binary form must reproduce the above copyright notice,
this list of conditions and the following disclaimer in the documentation
and/or other materials provided with the distribution.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
```
</details>
**Many thanks to project [create_ap](https://github.com/oblique/create_ap)**.
This script was forked from create\_ap. Now it's quite different from it. (See `history` branch for how I modified create_ap)

1497
lnxrouter

File diff suppressed because it is too large Load Diff