root@XiaoQiang:~# cat /etc/os-release
NAME="OpenWrt"
VERSION="18.06-SNAPSHOT"
ID="openwrt"
ID_LIKE="lede openwrt"
PRETTY_NAME="OpenWrt 18.06-SNAPSHOT"
VERSION_ID="18.06-snapshot"
HOME_URL="http://openwrt.org/"
BUG_URL="http://bugs.openwrt.org/"
SUPPORT_URL="http://forum.lede-project.org/"
BUILD_ID="unknown"
LEDE_BOARD="mediatek/mt7622"
LEDE_ARCH="aarch64_cortex-a53_neon-vfpv4"
LEDE_TAINTS="no-all glibc busybox"
LEDE_DEVICE_MANUFACTURER="OpenWrt"
LEDE_DEVICE_MANUFACTURER_URL="http://openwrt.org/"
LEDE_DEVICE_PRODUCT="Generic"
LEDE_DEVICE_REVISION="v0"
LEDE_RELEASE="OpenWrt 18.06-SNAPSHOT unknown"

root@ax6s:~# cat /etc/os-release
NAME="OpenWrt"
VERSION="22.03.2"
ID="openwrt"
ID_LIKE="lede openwrt"
PRETTY_NAME="OpenWrt 22.03.2"
VERSION_ID="22.03.2"
HOME_URL="https://openwrt.org/"
BUG_URL="https://bugs.openwrt.org/"
SUPPORT_URL="https://forum.openwrt.org/"
BUILD_ID="r19803-9a599fee93"
OPENWRT_BOARD="mediatek/mt7622"
OPENWRT_ARCH="aarch64_cortex-a53"
OPENWRT_TAINTS=""
OPENWRT_DEVICE_MANUFACTURER="OpenWrt"
OPENWRT_DEVICE_MANUFACTURER_URL="https://openwrt.org/"
OPENWRT_DEVICE_PRODUCT="Generic"
OPENWRT_DEVICE_REVISION="v0"
OPENWRT_RELEASE="OpenWrt 22.03.2 r19803-9a599fee93"

nvram set ssh_en=1  # 不是1也退出1
/etc/init.d/dropbear start # 脚本start段里增加了判断,稳定版不让启动直接退出
netstat -n # 查看22端口

src/gz openwrt_core https://mirrors.ustc.edu.cn/openwrt/releases/22.03.3/targets/x86/64/packages
src/gz openwrt_base https://mirrors.ustc.edu.cn/openwrt/releases/22.03.3/packages/x86_64/base
src/gz openwrt_luci https://mirrors.ustc.edu.cn/openwrt/releases/22.03.3/packages/x86_64/luci
src/gz openwrt_packages https://mirrors.ustc.edu.cn/openwrt/releases/22.03.3/packages/x86_64/packages
src/gz openwrt_routing https://mirrors.ustc.edu.cn/openwrt/releases/22.03.3/packages/x86_64/routing
src/gz openwrt_telephony https://mirrors.ustc.edu.cn/openwrt/releases/22.03.3/packages/x86_64/telephony

[root@ax6s ~]$ cat /etc/opkg/distfeeds.conf
src/gz openwrt_core https://downloads.openwrt.org/releases/22.03.2/targets/mediatek/mt7622/packages
src/gz openwrt_base https://downloads.openwrt.org/releases/22.03.2/packages/aarch64_cortex-a53/base
src/gz openwrt_luci https://downloads.openwrt.org/releases/22.03.2/packages/aarch64_cortex-a53/luci
src/gz openwrt_packages https://downloads.openwrt.org/releases/22.03.2/packages/aarch64_cortex-a53/packages
src/gz openwrt_routing https://downloads.openwrt.org/releases/22.03.2/packages/aarch64_cortex-a53/routing
src/gz openwrt_telephony https://downloads.openwrt.org/releases/22.03.2/packages/aarch64_cortex-a53/telephony

#iptables
opkg update
opkg install coreutils-nohup bash iptables dnsmasq-full curl ca-certificates ipset ip-full iptables-mod-tproxy iptables-mod-extra libcap libcap-bin ruby ruby-yaml kmod-tun kmod-inet-diag unzip luci-compat luci luci-base

#nftables
opkg update
opkg install kmod-nft-tproxy

wget https://github.com/vernesong/OpenClash/releases/download/v0.45.59-beta/luci-app-openclash_0.45.59-beta_all.ipk
root@ax6s:/tmp# opkg install luci.ipk
Installing luci-app-openclash (0.45.59-beta) to root...
Configuring luci-app-openclash.
cfg117882

Collected errors:
 * check_data_file_clashes: Package dnsmasq-full wants to install file /etc/hotplug.d/ntp/25-dnsmasqsec
        But that file is already provided by package  * dnsmasq
 * check_data_file_clashes: Package dnsmasq-full wants to install file /etc/init.d/dnsmasq
        But that file is already provided by package  * dnsmasq
 * check_data_file_clashes: Package dnsmasq-full wants to install file /usr/lib/dnsmasq/dhcp-script.sh
        But that file is already provided by package  * dnsmasq
 * check_data_file_clashes: Package dnsmasq-full wants to install file /usr/sbin/dnsmasq
        But that file is already provided by package  * dnsmasq
 * check_data_file_clashes: Package dnsmasq-full wants to install file /usr/share/acl.d/dnsmasq_acl.json
        But that file is already provided by package  * dnsmasq
 * check_data_file_clashes: Package dnsmasq-full wants to install file /usr/share/dnsmasq/dhcpbogushostname.conf
        But that file is already provided by package  * dnsmasq
 * check_data_file_clashes: Package dnsmasq-full wants to install file /usr/share/dnsmasq/rfc6761.conf
        But that file is already provided by package  * dnsmasq
 * opkg_install_cmd: Cannot install package luci-app-openclash.

opkg update
opkg remove dnsmasq && opkg install dnsmasq-full 

[root@ax6s ~]$ cat ddns.sh
#!/bin/bash

Network=wan@eth0

Date=`echo $'\n\n' >> /tmp/ddns_ipv4`
Date=`echo "$(date)" >> /tmp/ddns_ipv4`
IPv4=`ip a|grep -A 2 ${Network}|sed -n '3p'|awk  '{print $2}' |sed -e 's/\/[0-9]*//'`
echo $IPv4 >> /tmp/ddns_ipv4
IPv6=`ip a|grep -A 4 ${Network}|sed -n '5p'|awk  '{print $2}' |sed -e 's/\/[0-9]*//'`
echo $IPv6 >> /tmp/ddns_ipv4

curl -v http://v6.sync.afraid.org/u/4TY5…………tKF/?address=${IPv6} 2>&1 >> /tmp/ddns_ipv4
curl -v http://sync.afraid.org/u/M8uh9Zf…………ryjxs/?address=${IPv4} 2>&1 >> /tmp/ddns_ipv4

PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
4,9,14,19,24,29,34,39,44,49,54,59 * * * * sleep 11 ; /root/ddns.sh

[root@ax6s ~]$ ip -6 neigh | grep 2c:f0:5d
2001:da8:d800:611:1818:61b6:6422:56a1 dev br-lan lladdr 2c:f0:5d:ac:1d:2c DELAY
2001:da8:d800:611:5464:f7ab:9560:a646 dev br-lan lladdr 2c:f0:5d:ac:1d:2c STALE
2001:da8:d800:611:4d13:ead8:9aaf:bfc4 dev br-lan lladdr 2c:f0:5d:ac:1d:2c REACHABLE
2001:da8:d800:611:a063:863f:caa3:4a73 dev br-lan lladdr 2c:f0:5d:ac:1d:2c STALE
2001:da8:d800:611:8c75:4f49:f9d0:42b6 dev br-lan lladdr 2c:f0:5d:ac:1d:2c STALE

#!/bin/sh
 
get_ip(){
    MAC=$1
    if [ "$MAC" = "" ]
    then
        exit 0
    fi
    IP=$(ip -6 neigh | grep -i $MAC | grep -v "fe80:" | grep -E "REACHABLE|STALE" | cut -d" " -f1 | grep -m 1 -E -o "([0-9a-fA-F]{1,4}(:?)){8}")
    if [ "$IP" = "" ]
    then
        IP=$(mac_to_ipv6_ll $MAC $(get_ip_prefix))
    fi
    echo $IP
}
 
mac_to_ipv6_ll() {
    PREFIX="fe80::"
    if [ "$#" = 2 ]; then
        PREFIX=$2
    fi
    IFS=':'; set $1; unset IFS
    echo "$PREFIX$(printf %02x $((0x$1 ^ 2)))$2:${3}ff:fe$4:$5$6"
}
 
get_ip_prefix() {
    IP_PREFIX=$(ip -6 addr | awk '{print $2}' | grep '::1' | grep -m 1 -E -o "([0-9a-fA-F]{1,4}(:?)){4}")
    echo $IP_PREFIX
}
 
if [ "$1" != "" ]; then
    echo `get_ip $1`
fi

#!/bin/sh
 
. /usr/lib/ddns/dynamic_dns_iphelper.sh
# 遵循 EUI-64 的设备使用这个方式 可以获取到静态后缀的IPv6地址
# 00:00:00:00:00:00修改为目标设备的MAC地址
echo $(mac_to_ipv6_ll "00:00:00:00:00:00" $(get_ip_prefix))

# 或者
#!/bin/sh
 
. /usr/lib/ddns/dynamic_dns_iphelper.sh
# 00:00:00:00:00:00修改为目标设备的MAC地址
# 不遵循 EUI-64 的设备 可以获取到动态IPv6地址
echo `get_ip "00:00:00:00:00:00"`

ftp ip
lftp user@site:port

# shaojiemike @ node5 in ~ [23:53:42] C:125
$ export OVPN_DATA="ovpn-data-tsj"

# shaojiemike @ node5 in ~ [23:54:10]
$ docker volume create --name $OVPN_DATA
ovpn-data-example

# shaojiemike @ node5 in ~ [23:54:11]
$ docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_genconfig -u udp://node5.xydustc.me
Unable to find image 'kylemanna/openvpn:latest' locally
latest: Pulling from kylemanna/openvpn
188c0c94c7c5: Pull complete
e470f824352c: Pull complete
d6ed0c7c142e: Pull complete
74586f3c5cd4: Pull complete
cb26244a2b2a: Pull complete
Digest: sha256:643531abb010a088f1e23a1c99d44f0bd417a3dbb483f809caf4396b5c9829a0
Status: Downloaded newer image for kylemanna/openvpn:latest
Processing PUSH Config: 'block-outside-dns'
Processing Route Config: '192.168.254.0/24'
Processing PUSH Config: 'dhcp-option DNS 8.8.8.8'
Processing PUSH Config: 'dhcp-option DNS 8.8.4.4'
Processing PUSH Config: 'comp-lzo no'
Successfully generated config
Cleaning up before Exit ...

# shaojiemike @ node5 in ~ [23:55:47]
$ docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn ovpn_initpki

init-pki complete; you may now create a CA or requests.
Your newly created PKI dir is: /etc/openvpn/pki


Using SSL: openssl OpenSSL 1.1.1g  21 Apr 2020

Enter New CA Key Passphrase:
Re-Enter New CA Key Passphrase:
Generating RSA private key, 2048 bit long modulus (2 primes)
.........+++++
...................+++++
e is 65537 (0x010001)
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Common Name (eg: your user, host, or server name) [Easy-RSA CA]:tsj-node5

CA creation complete and you may now import and sign cert requests.
Your new CA certificate file for publishing is at:
/etc/openvpn/pki/ca.crt

Using SSL: openssl OpenSSL 1.1.1g  21 Apr 2020
Generating DH parameters, 2048 bit long safe prime, generator 2
This is going to take a long time
......................+.......................+..........................................................+........................................................................................................+........................................+...................................................................................................................................+.....................................................................................................................+......................................................................................................................................................................................................................................+......++*++*++*++*

DH parameters of size 2048 created at /etc/openvpn/pki/dh.pem


Using SSL: openssl OpenSSL 1.1.1g  21 Apr 2020
Generating a RSA private key
.......................................+++++
.........................................+++++
writing new private key to '/etc/openvpn/pki/easy-rsa-73.EeNnaB/tmp.jhHaaF'
-----
Using configuration from /etc/openvpn/pki/easy-rsa-73.EeNnaB/tmp.LGnDjB
Enter pass phrase for /etc/openvpn/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'node5.xydustc.me'
Certificate is to be certified until Jan  1 15:58:37 2025 GMT (825 days)

Write out database with 1 new entries
Data Base Updated

Using SSL: openssl OpenSSL 1.1.1g  21 Apr 2020
Using configuration from /etc/openvpn/pki/easy-rsa-148.CDCEmf/tmp.iJCIGL
Enter pass phrase for /etc/openvpn/pki/private/ca.key:

An updated CRL has been created.

# shaojiemike @ node5 in ~ [0:02:06]
$ sudo lsof -i UDP:1194
COMMAND  PID   USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
openvpn 1834 nobody    6u  IPv4  56802      0t0  UDP node5:openvpn

 /usr/sbin/openvpn --status /run/openvpn-server/status-server.log --status-version 2 --suppress-timestamps --config server.conf

  sudo vim /etc/openvpn/server/server.conf

  改成7194等端口

# shaojiemike @ node5 in ~ [0:02:10]
$ sudo service openvpn status
● openvpn.service - OpenVPN service
     Loaded: loaded (/lib/systemd/system/openvpn.service; enabled; vendor preset: enabled)
     Active: active (exited) since Tue 2022-04-19 18:42:24 CST; 5 months 11 days ago
   Main PID: 1715 (code=exited, status=0/SUCCESS)
      Tasks: 0 (limit: 154181)
     Memory: 0B
     CGroup: /system.slice/openvpn.service

Apr 19 18:42:24 node5 systemd[1]: Starting OpenVPN service...
Apr 19 18:42:24 node5 systemd[1]: Finished OpenVPN service.

# shaojiemike @ node5 in ~ [0:15:49] C:125
$ sudo service openvpn stop

# shaojiemike @ node5 in ~ [0:16:30]
$ sudo kill -9 1834

# shaojiemike @ node5 in ~ [0:16:46]
$ docker run -v $OVPN_DATA:/etc/openvpn -d -p 1194:1194/udp --cap-add=NET_ADMIN kylemanna/openvpn
cb0f7e78f389f112c3c3b230d20d2b50818f6cf59eea2edfaa076c7e8fad7128

# shaojiemike @ node5 in ~ [0:06:01]
$ docker container list
CONTAINER ID   IMAGE                   COMMAND                  CREATED          STATUS                  PORTS                                                 NAMES
6c716b27b3f1   kylemanna/openvpn       "ovpn_run"               49 seconds ago   Up 48 seconds           1194/udp, 0.0.0.0:1195->1195/udp, :::1195->1195/udp   charming_zhukovsky

# 上面是错误的

# shaojiemike @ node5 in ~ [0:16:50]
$ docker ps
CONTAINER ID   IMAGE                   COMMAND                  CREATED              STATUS                  PORTS                                                 NAMES
cb0f7e78f389   kylemanna/openvpn       "ovpn_run"               About a minute ago   Up About a minute       0.0.0.0:1194->1194/udp, :::1194->1194/udp             pedantic_euler

# shaojiemike @ node5 in ~ [0:07:27] C:2
$ docker run -v $OVPN_DATA:/etc/openvpn --rm -it kylemanna/openvpn easyrsa build-client-full tsj-node5-client nopass
Using SSL: openssl OpenSSL 1.1.1g  21 Apr 2020
Generating a RSA private key
...............+++++
...............................+++++
writing new private key to '/etc/openvpn/pki/easy-rsa-1.olaINa/tmp.MfohAO'
-----
Using configuration from /etc/openvpn/pki/easy-rsa-1.olaINa/tmp.EMkEHF
Enter pass phrase for /etc/openvpn/pki/private/ca.key:
139775495048520:error:28078065:UI routines:UI_set_result_ex:result too small:crypto/ui/ui_lib.c:905:You must type in 4 to 1023 characters
Enter pass phrase for /etc/openvpn/pki/private/ca.key:
Check that the request matches the signature
Signature ok
The Subject's Distinguished Name is as follows
commonName            :ASN.1 12:'tsj-node5-client'
Certificate is to be certified until Jan  1 16:08:23 2025 GMT (825 days)

Write out database with 1 new entries
Data Base Updated


# shaojiemike @ node5 in ~ [0:08:24]
$ docker run -v $OVPN_DATA:/etc/openvpn --rm kylemanna/openvpn ovpn_getclient tsj-node5-client > tsj-node5-client.ovpn

# shaojiemike @ node5 in ~ [0:09:20]
$ ls tsj-node5-client.ovpn
tsj-node5-client.ovpn