Hostapd example

 

interface=wlan0       # the interface used by the AP
hw_mode=a             # a simply means 5GHz
channel=0             # the channel to use, 

                      # 0 means the AP will search for the channel with the 

                      # least interferences 

ieee80211d=1          # limit the frequencies used to those allowed in the country
country_code=TW       # the country code
ieee80211n=1          # 802.11n support
ieee80211ac=1         # 802.11ac support
wmm_enabled=1         # QoS support

ssid=SSID             # the name of the AP
auth_algs=1           # 1=wpa, 2=wep, 3=both
wpa=2                 # WPA2 only
wpa_key_mgmt=WPA-PSK 
rsn_pairwise=CCMP
wpa_passphrase=passwd

wpa_cli-setup-example

sudo wpa_cli -i wlp2s0 scan
sudo wpa_cli -i wlp2s0 scan_result
sudo wpa_cli -i wlp2s0 add_network
sudo wpa_cli -i wlp2s0 set_network 0 ssid '"bk5"'
sudo wpa_cli -i wlp2s0 set_network 0 psk '"nxp12345678"'
sudo wpa_cli -i wlp2s0 enable_network 0
sudo wpa_cli -i wlp2s0 list_network
sudo wpa_cli -i wlp2s0 select_network 0
sudo wpa_cli -i wlp2s0 status
sudo dhclient -i wlp2s0
ip a
## list all network
sudo wpa_cli -i wlp2s0 list_network
## disconnect
sudo wpa_cli -i wlp2s0 disable_network 0
## delete network
sudo wpa_cli -i wlp2s0 remove_network 0

Why `clear` do not clear whole screen?

tmux.conf
set -as terminal-overrides ',*:indn@'



https://github.com/tmux/tmux/issues/1235

mldonkey/transmission PORT Redirection

       
#Enable the module proxy for http
a2enmod proxy
a2enmod proxy_http  

#Restart apache2
systemctl restart apache2

-----------------------------------
#/etc/apache2/sites-available/000-default.conf


       # The ServerName directive sets the request scheme, hostname and port that
       # the server uses to identify itself. This is used when creating
       # redirection URLs. In the context of virtual hosts, the ServerName
       # specifies what hostname must appear in the request's Host: header to
       # match this virtual host. For the default virtual host (this file) this
       # value is not decisive as it is used as a last resort host regardless.
       # However, you must set it for any further virtual host explicitly.
       #ServerName www.example.com

       ServerAdmin webmaster@localhost
       DocumentRoot /var/www/html

       # Available loglevels: trace8, ..., trace1, debug, info, notice, warn,
       # error, crit, alert, emerg.
       # It is also possible to configure the loglevel for particular
       # modules, e.g.
       #LogLevel info ssl:warn

       ErrorLog ${APACHE_LOG_DIR}/error.log
       CustomLog ${APACHE_LOG_DIR}/access.log combined

       # For most configuration files from conf-available/, which are
       # enabled or disabled at a global level, it is possible to
       # include a line for only one particular virtual host. For example the
       # following line enables the CGI configuration for this host only
       # after it has been globally disabled with "a2disconf".
       #Include conf-available/serve-cgi-bin.conf

       # Allow port 4080
               Allow from all
       # Redirection
       RewriteEngine On
       RewriteRule ^/mldonkey$ /mldonkey/ [R]
       RewriteRule ^/mldonkey/(.*) http://localhost:4080/$1 [P]

       RewriteEngine On
       ### BELOW FOR TRANSMISSION WEB INTERFACE ###

       # Redirect requests to /transmission/ to /transmission/web/
       RewriteRule /transmission[/]?$ /transmission/web/ [R=permanent]

       # Forward all requests for /transmission to transmission-daemon
       ProxyPass /transmission http://127.0.0.1:9091/transmission
       ProxyPassReverse /transmission http://127.0.0.1:9091/transmission
       redirect 301 /transmission/transmission/web/ /transmission/web/
       redirect 301 /transmission/ /transmission/web/
       redirect 301 /transmission /transmission/
       ### END TRANSMISSION WEB INTERFACE ###


# vim: syntax=apache ts=4 sw=4 sts=4 sr noet

Debian rootfs for Arm64

https://wiki.debian.org/Arm64Port

sudo qemu-debootstrap --arch=arm64 --keyring /usr/share/keyrings/debian-archive-keyring.gpg --variant=buildd --exclude=debfoster stretch  debian-arm64
http://ftp.debian.org/debian

Ubuntu rootfs howto

1. Preparing the packages in host
sudo apt-get install  debootstrap qemu-user-static

2. Download the packages for ubuntu rootfs
debootstrap_dir=ubuntu-arm64-bonic
sudo debootstrap --arch arm64 --foreign bionic "$debootstrap_dir" \
 http://ports.ubuntu.com/ubuntu-ports \

3. Install the packages/ second-stage
sudo mkdir -p "${debootstrap_dir}/usr/bin"
sudo cp "$(which qemu-aarch64-static)" "${debootstrap_dir}/usr/bin"
sudo chroot "$debootstrap_dir" /debootstrap/debootstrap --second-stage

4. Remove the passwd of root
sudo chroot "$debootstrap_dir"
Edit /etc/passwd and /etc/shadow, remove the "*" in between ":" and ":" in root:....

5. Enable UART console
sudo chroot ${debootstrap_dir}
ln  -sf /lib/systemd/system/serial-getty\@.service /lib/systemd/system/getty.target.wants/ 

6. /etc/network/interfaces
sudo apt install ifupdown
vi /etc/network/interface
-----
source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

auto eth0
iface eth0 inet dhcp

# The intranet network interface
auto eth1
iface eth1 inet static
      address 10.19.132.49
      netmask 255.255.254.0

7. Add locale
sudo vi /etc/locale.gen
umakrk en_US.UTF-8 UTF-8 and zh_TW.UTF-8 UTF-8
sudo locale-gen


source.list 
==================================================
deb http://tw.ports.ubuntu.com/ bionic main restricted universe multiverse
deb http://tw.ports.ubuntu.com/ bionic-updates main restricted universe multiverse

deb http://tw.ports.ubuntu.com/ubuntu-ports bionic main restricted
deb http://tw.ports.ubuntu.com/ubuntu-ports bionic-updates main restricted
deb-src http://tw.ports.ubuntu.com/ubuntu-ports bionic main restricted universe multiverse
deb-src http://tw.ports.ubuntu.com/ubuntu-ports bionic-updates main restricted universe multiverse
deb http://tw.ports.ubuntu.com/ubuntu-ports bionic universe
deb http://tw.ports.ubuntu.com/ubuntu-ports bionic-updates universe
deb http://tw.ports.ubuntu.com/ubuntu-ports bionic multiverse
deb http://tw.ports.ubuntu.com/ubuntu-ports bionic-updates multiverse

deb http://tw.ports.ubuntu.com/ bionic-security main restricted universe multiverse

SNAT
================================
echo "Setting IP Masquerading...."
echo 1 > /proc/sys/net/ipv4/ip_forward
WAN_IP=`ifconfig eth0 | grep "inet addr:" | cut -d ":" -f 2 | cut -d " " -f 1`

echo "Setting iptables..... "
/sbin/iptables -F
/sbin/iptables -t nat -F
/sbin/iptables -P FORWARD DROP

# Block access to 208.46.65.0/24
/sbin/iptables -A OUTPUT -d 208.48.65.0/24 -j DROP

/sbin/iptables -A FORWARD -s 192.168.0.0/24 -j ACCEPT
/sbin/iptables -A FORWARD -d 192.168.0.0/24 -j ACCEPT
/sbin/iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j SNAT --to-source ${WAN_IP}

#172.23.68.32
/sbin/iptables -A FORWARD -s 172.23.68.32 -j ACCEPT
/sbin/iptables -A FORWARD -d 172.23.68.32 -j ACCEPT
/sbin/iptables -t nat -A POSTROUTING -s 172.23.68.32 -j SNAT --to-source ${WAN_IP}

Route table
============================
ip route add 10.0.0.0/8 via 10.19.132.1
ip route del default
ip route add default via 10.19.132.49(Z2X)


rc.local
=============
ln -fs /lib/systemd/system/rc-local.service /etc/systemd/system/rc-local.service

touch /etc/rc.local

chmod 755 /etc/rc.local

EDIT /etc/rc.local
-----
#!/bin/bash

echo "test rc " > /var/test.log

exit 0

修改 MSS 解決 Linux PPPOE NAT 後部份網頁無法瀏覽問題

引用自 http://ppc52776.blogspot.com/2011/04/mss-linux-pppoe-nat.html
參考資料 http://www.akadia.com/services/pppoe_iptables.html
--------------------------
有用 Linux 當作家裡 ADSL 分享器/防火牆 的人應該會發現
有些網頁透過 NAT 後就是無法開啟
但是如果直接在 Linux 主機上卻又可以正常開啟
解決方法：
在 Linux Firewall 上增加以下 rule:

iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

搞定

為什麼呢？

這主要原因是因為 ppp 網路的 MTU 問題
MTU 的功能在於指定最大可傳輸的單一封包大小
當使用 ADSL(PPP) 時
會再封包裡另外增加 PPP 的 Header 導致單一封包會超過上限
為了解決此問題
一般會把 PPP 的 MTU 設定為原本 Ethernet MTU - 8 也就是 1492

TCP 傳輸方式有自動切割與組合封包的特性
MTU 的值就會被拿來當作 TCP 預設切割的大小(MSS)
MSS = Maximum Segment Size
每次建立 TCP 連線時
雙方會於 handshaking 時互相告知對方允許的 MSS 最後以小的為主
但 NAT 後的 PC 看到的是自己的 MTU 也就是 1500 而非 1492
因此會給對方過大的 MSS 建議
正常來說~當路由器收到大於自己可處理最大封包時
會透過 ICMP 回應給 sender
sender 接下來就會嘗試較小的 MSS
但大多數 ISP 會擋掉 ICMP 導致 sender 傻傻一直等待直到 timeout...