海运的博客

安装编译环境：

apt-get install build-essential libncurses5-dev zlib1g-dev

下载交叉编译环境及sshpass源码：

wget http://downloads.openwrt.org/backfire/10.03.1/brcm63xx/OpenWrt-SDK-brcm63xx-for-Linux-i686-gcc-4.3.3%2bcs_uClibc-0.9.30.1.tar.bz2
tar jxvf OpenWrt-SDK-brcm63xx-for-Linux-i686-gcc-4.3.3+cs_uClibc-0.9.30.1.tar.bz2 
mkdir -p OpenWrt-SDK-brcm63xx-for-Linux-i686-gcc-4.3.3+cs_uClibc-0.9.30.1/package/sshpass
cd OpenWrt-SDK-brcm63xx-for-Linux-i686-gcc-4.3.3+cs_uClibc-0.9.30.1/package/sshpass
wget http://sourceforge.net/projects/sshpass/files/sshpass/1.05/sshpass-1.05.tar.gz
tar zxvf sshpass-1.05.tar.gz
mv sshpass-1.05 src

sshpass目录新建Makefile文件：

include $(TOPDIR)/rules.mk

# Name and release number of this package
PKG_NAME:=sshpass
PKG_RELEASE:=1.05

PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)

include $(INCLUDE_DIR)/package.mk

define Package/sshpass
    SECTION:=utils
    CATEGORY:=Utilities
    TITLE:=sshpass
endef

define Package/sshpass/description
    Sshpass is a tool for non-interactivly performing password authentication with SSH's
endef

# Specify what needs to be done to prepare for building the package.
define Build/Prepare
    mkdir -p $(PKG_BUILD_DIR)
    $(CP) ./src/* $(PKG_BUILD_DIR)/
endef


# Specify where and how to install the program.
define Package/sshpass/install
    $(INSTALL_DIR) $(1)/bin
    $(INSTALL_BIN) $(PKG_BUILD_DIR)/sshpass $(1)/bin/
endef

# This line executes the necessary commands to compile our program.
$(eval $(call BuildPackage,sshpass))

编译sshpass：

cd ../
make package/sshpass/compile

编译成功的程序文件：

ls bin/brcm63xx/packages/
Packages  Packages.gz  sshpass_1.05_brcm63xx.ipk

编译过程中如遇到以下错误：

staging_dir/toolchain-mips_r2_gcc-4.3.3+cs_uClibc-0.9.30.1/usr/lib/libc.so: undefined reference to `_dl_app_init_array’

需修改：

TARGET_LDFLAGS:=-L$(STAGING_DIR)/usr/lib -L$(STAGING_DIR)/lib

为：

TARGET_LDFLAGS+= -L$(TOOLCHAIN_DIR)/usr/lib -L$(TOOLCHAIN_DIR)/lib -Wl,-rpath=$(TOOLCHAIN_DIR)/lib

sshpass使用：

sshpass -p pass ssh -p 22 -o StrictHostKeyChecking=no root@haiyun.me 'uptime'

OpenWRT安装PPPoe服务器，当客户端连接或断开时通过ip-down.d/ip-up.d执行ROS命令，ROS需配置使用SSH Key验证。
当系统拨号断开时停止PPPoe：

mkdir /etc/ppp/ip-down.d
cat >/etc/ppp/ip-down.d/pppoe-down.sh << EOF
#!/bin/sh
ssh admin@192.168.1.21 "/interface pppoe-client disable pppoe-out1"
EOF
chmod +x /etc/ppp/ip-down.d/pppoe-down.sh 

当连接系统拨号连接时开启PPPoe：

mkdir /etc/ppp/ip-up.d
cat >/etc/ppp/ip-up.d/pppoe-up.sh << EOF
#!/bin/sh
ssh admin@192.168.1.21 "/interface pppoe-client enable pppoe-out1"
EOF
chmod +x /etc/ppp/ip-up.d/pppoe-up.sh 

2015.03.17更新：
ros重新拨号只需enable就行，无需先disable：

ssh admin@192.168.1.21 "/interface pppoe-client enable pppoe-out1"

OpenWRT更新到14.07安装的pppoe不执行ip-down.d或up目录下脚本，需添加相应脚本，PPPD连接时会执行此脚本：

cat >/etc/ppp/ip-up << EOF
#!/bin/sh
[ -d /etc/ppp/ip-up.d ] && {
        for SCRIPT in /etc/ppp/ip-up.d/*
        do
                [ -x "$SCRIPT" ] && "$SCRIPT" "$@"
        done
}
EOF
chmod +x /etc/ppp/ip-up

OpenWRT安装PPPoe：

opkg update
opkg install rp-pppoe-server

配置PPPoe：

cat > pppoe-server-options << EOF
# PPP options for the PPPoE server
# LIC: GPL
require-chap
login
lcp-echo-interval 10
lcp-echo-failure 2
ms-dns 8.8.8.8
EOF

设置PPPoe账号、密码：

cat >/etc/ppp/chap-secrets << EOF
#USERNAME  PROVIDER  PASSWORD  IPADDRESS
www.haiyun.me * www.haiyun.me *
EOF

启动PPPoe服务脚本：

cat >/etc/init.d/pppoe-server << EOF
#!/bin/sh /etc/rc.common
# Copyright (C) 2006 OpenWrt.org
START=50

start() {
        echo 1 > /proc/sys/net/ipv4/ip_forward
        iptables -t nat -A POSTROUTING -s 10.0.1.0/24 -j MASQUERADE
        /usr/sbin/pppoe-server -k -T 60 -I eth1.1 -N 100 -L 10.0.1.1 -R 10.0.1.2
}

stop() {
        iptables -t nat -D POSTROUTING -s 10.0.1.0/24 -j MASQUERADE
    killall pppoe-server
}
EOF
chmod +x /etc/init.d/pppoe-server

遇到的问题1，客户端连接错误代码619，使用tcpdump监听数据包：

Generic-Error "RP-PPPoE: Child pppd process terminated"

查看pppoe错误日志：

May 26 13:31:07 OpenWrt daemon.notice pppd[4972]: Connect: ppp0 <--> /dev/pts/1
May 26 13:31:07 OpenWrt daemon.notice pppd[4972]: Modem hangup
May 26 13:31:07 OpenWrt daemon.notice pppd[4972]: Connection terminated.

解决方法：启动参数加-k，加载内核pppoe模块启动。
遇到的问题2，客户端连接错误代码691，原因：

用户名或密码填写错误
require-chap账号密码文件确认为chap-secrets

操作系统下都有hosts文件可自定单个域名指向IP，要将特定域名下所有子域名都指向特定IP就需要转发DNS服务器来解决了，Dnsmasq就是比较轻量级的一个，很多第三方路由固件都自带Dnsmasq。
Dnsmasq域名泛解析配置：

address=/.www.haiyun.me/8.8.8.8
address=/.google.com/203.208.46.200
#这样所有www.haiyun.me子域名都解析到8.8.8.8

Dnsmasq禁止域名被劫持：

bogus-nxdomain=8.8.8.8
#8.8.8.8为劫持IP地址

之前有介绍OpenWrt下ADSL多拨使用nexthop负载均衡，负载不是很理想，本次使用iptable标记数据包并配合策略路由实现负载均衡。
WAN1数据标记：

iptables -t mangle -N WAN1
#标记数据包
iptables -t mangle -A WAN1 -j MARK --set-mark 1 
#把数据包中的mark设置到整个连接中
iptables -t mangle -A WAN1 -j CONNMARK --save-mark 

WAN2数据标记：

iptables -t mangle -N WAN2
iptables -t mangle -A WAN2 -j MARK --set-mark 1 
iptables -t mangle -A WAN2 -j CONNMARK --save-mark 

把已存在连接中的mark设置到数据包中，实现同个连接同个宽带IP出：

iptables -t mangle -N RESTORE
iptables -t mangle -A RESTORE -j CONNMARK --restore-mark
iptables -t mangle -A PREROUTING -m state --state ESTABLISHED,RELATED -j RESTORE

使用NTH模块公平分发新数据包到WAN1和WAN2：

iptables -t mangle -A PREROUTING -m state --state NEW -m statistic --mode nth --every 2 --packet 0 -j WAN1
iptables -t mangle -A PREROUTING -m state --state NEW -m statistic --mode nth --every 2 --packet 1 -j WAN2

设置路由表：

cat /etc/iproute2/rt_tables 
#https://www.haiyun.me
255    local
254    main
253    default
0    unspec
252 WAN1
251 WAN2

设置路由表默认路由：

ip route flush table WAN1
ip route add table WAN1 default via 2.2.2.2 dev ppp0
ip route flush table WAN2
ip route add table WAN2 default via 1.1.1.1 dev ppp1

根据iptables标记应用路由：

ip rule del from all fwmark 2 2>/dev/null
ip rule del from all fwmark 1 2>/dev/null
ip rule add fwmark 1 table my_wan0
ip rule add fwmark 2 table my_wan1
ip route flush cache

禁用源地址验证：

cat /etc/sysctl.conf 
net.ipv4.conf.default.rp_filter = 0