HOWTO_SNMP_and_MRTG_Made_Easy<\/a> for the lazy ones.<\/p>\nC) Syslog activation.
\nA syslog daemon is also included but not started in netroute2. It is primarily thought to be logging remotely to another machine. But netroute2 has 10Mb of free space at \/tmp…so we can make it store some logs there. On reboot these logs are lost, so it’s only usefull if you netroute is on a UPS or if you want to monitor what’s going on while netroute is working. It’s not for watching what happened and your netroute2 crashed. If you want such behaviour you must activate remote syslog logging, and if you want that you must be able to easily find out how to do it, you don’t need my advice \ud83d\ude42<\/p>\n
First of all fire up vi and edit \/etc\/syslog.conf. Change all entries that start with \/var\/log to \/tmp\/var\/log\/. Then go find \/etc\/init.d\/rc-syslog and edit it with vi. Find line 13. It should say something like this:
\n
\n \/bin\/echo \"Invalid Syslog Server IP!\"
\n exit 1
\n<\/code><\/p>\nChange it to:
\n
\n \/bin\/echo \"Invalid Syslog Server IP!\"
\n \/bin\/echo \"Logging Locally!\"
\n mkdir -p \/tmp\/var\/log\/
\n #exit 1
\n<\/code><\/p>\nWhat happens here is this, the script searches \/etc\/net.conf for a variable named SYSLOG_SERVER_IP. If it finds it it enables remote syslogging to that IP (damn!.. I’ve said it), but we want to enable local logging so we have to bypass it. We first create the \/tmp\/var\/log directory and then put a “#” in front of the exit command so the script does not stop when it can’t find SYSLOG_SERVER_IP.<\/p>\n
\/etc\/init.d\/checkpoint again….reboot…and if all went fine if you “ps aux” you should see something like:
\n
\n 166 root 336 S \/sbin\/syslogd
\n 169 root 264 S \/sbin\/klogd -c 3 -x
\n<\/code><\/p>\nIf you cd to \/tmp\/var\/log you can find the log files. You can more them, tail them, grep them, whatever…it’s up to you now.<\/p>\n
D) Enable iptables logging.
\nNetroute2 features iptables firewalling and tc for QoS!!! You can easily modify the firewall script to make it suit your needs better. What I am going to describe here is how to make iptables log to syslog so you can view what is being blocked by iptables.<\/p>\n
First thing you have to do is go to the web interface (yes it IS sloooooooow but who cares ? You won’t be needing much anyway \ud83d\ude42 ), go to “Wan Connections” and click on Firewall. Go where it says “Expert Configuration” (don’t you already feel l33t ? heh) and add a dummy line like this:
\n
\niptables -A INPUT -i ppp0 -p tcp --dport 135 -j DROP
\n<\/code>
\nClick on apply and wait a bit until it refreshes the firewall webpage.
\nThis line, even it is totally useless (if you know a bit of iptables and see the rest of the firewall listing I am sure you already know why), it will force netroute2 to create a seperate firewall file for your connection and not use its default one.<\/p>\nNow go back to netroute2's shell. If you don't know\/remember the name of your connection do an
\n<\/code>ls \/etc\/wan\/current\/<\/code>
\nand it will show you it's name. Then go to \/etc\/wan\/firewall\/ and edit the file with your connection name. You will see inside it the full listing of iptables rules.<\/p>\nLines 25-27 should a bit like these:
\n<\/code>
\n:INPUT ACCEPT [0:0]
\n:FORWARD ACCEPT [43:9993]
\n:OUTPUT ACCEPT [73:33579]
\n<\/code>
\nAdd below the last one a line like the following:
\n
\n:LOG_DROP - [0:0]
\n<\/code><\/p>\nAround line 65 there should be something like this:
\n
\n-A INPUT -i ppp0 -j DROP
\n<\/code><\/p>\nchange it to:
\n
\n-A INPUT -i ppp0 -j LOG_DROP
\n<\/code><\/p>\nThen finally find the last line of the file that says COMMIT and add above it these two lines:
\n
\n-A LOG_DROP -j LOG
\n-A LOG_DROP -j DROP
\n<\/code><\/p>\nThe editing is finished. DON’T forget to \/etc\/init.d\/checkpoint….reboot and you are ready.<\/p>\n
If you had previously enabled syslog logging correctly you can do a:
\n tail -f \/tmp\/var\/log\/kernel.log<\/code><\/p>\nand if you firewall blocks something you might see a line that looks like this:
\nSep 24 02:16:57 (none) kernel: IN=ppp0 OUT= MAC= SRC=XX.XX.XX.XX DST=YY.YY.YY.YY LEN=48 TOS=0x00 PREC=0x00 TTL=128 ID=30976 DF PROTO=TCP SPT=3935 DPT=135 WINDOW=65535 RES=0x00 SYN URGP=0
\n<\/code><\/p>\nYou can change all the other “-j DROP” settings inside your firewall config with “-j LOG_DROP” to gather more information about what gets dropped. If you do that though it might be necessary to refine your \/etc\/syslog.conf to create more accurate log files..Which log files keeps what kinds of logs…play with it.<\/p>\n
E) Netroute has some advanced commands that are not inside the PATH.
\nLook for some very interesting binaries like tcpdump, tc, etc inside \/usr\/sbin<\/p>\n
F) Public key auth with dropbear:
\non client machine:
\n
\nssh-keygen -t rsa
\nscp .ssh\/id_rsa.pub root@netroute.ip:
\n<\/code>
\non netroute2:
\n
\nmkdir .ssh
\nmv id_rsa.pub .ssh\/authorized_keys
\nchmod 400 ~\/.ssh\/authorized_keys
\nchmod 700 ~\/.ssh
\n\/etc\/init.d\/checkpoint
\n<\/code><\/p>\nIf everything is done properly you will now be able to ssh from your client to netroute2 without password.<\/p>\n
I wish I could find more of these great machines. 2 Ethernet ports, usb, serial console, 2 FXS, it’s own small sip compatible PBX … what else can one need ? A usb port for an external disk and a torrent client probably… \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"
Since I now own my own dsl I am using an intracom netroute2 as a dsl modem\/router. What really rocks about it is that it is linux (busybox) based, so one can change a lot of how stuff works in it. The bad news about it is that Intracom no longer produces it! The good […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"footnotes":""},"categories":[3,8],"tags":[],"class_list":["post-222","post","type-post","status-publish","format-standard","hentry","category-linux","category-networking"],"aioseo_notices":[],"views":7406,"_links":{"self":[{"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/posts\/222","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/comments?post=222"}],"version-history":[{"count":0,"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/posts\/222\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/media?parent=222"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/categories?post=222"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.void.gr\/kargig\/blog\/wp-json\/wp\/v2\/tags?post=222"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}