最後更新: 2024-06-28

目錄

• Install on OpenWrt
• Config fwknopd on Openwrt
• fwknopd CLI

Install on OpenWrt

# OpenWrt 21

opkg update

df -h | awk '$6=="/"{print $4}'     # 查看仍有多小空間可安軟件

opkg install fwknopd                     # 會安了 libfko, libpcap1

opkg install luci-app-fwknopd        # 不使用 GUI 的話不用安裝

Check Version

fwknopd -V

fwknopd server 2.6.10, compiled for firewall bin: /usr/sbin/iptables

Help

fwknopd -h

Config fwknopd on Openwrt

Main Config File:

/etc/config/fwknopd

此 config 檔一共有 3 部份

1)

config global
        option uci_enabled '1'

當是 1 時, 就會使用 /var/etc/fwknop 內的 config

2) 建立 fwknopd.conf

config config
        option ENABLE_UDP_SERVER 'Y'
        #option UDPSERV_PORT '62201'
        #option MAX_SPA_PACKET_AGE '60'
        option ENABLE_IPT_LOCAL_NAT 'Y'
        option ENABLE_IPT_FORWARDING 'N'
        option ENABLE_NAT_DNS 'N'

Notes

ENABLE_NAT_DNS         # Allow fwknopd to resolve hostnames in NAT access messages.

3) 建立 access.conf

config access
        option SOURCE 'ANY'
        option OPEN_PORTS 'tcp/2222'
        option FW_ACCESS_TIMEOUT '15'
        option KEY_BASE64 '...'
        option HMAC_KEY_BASE64 '...'

Show Config

uci show fwknopd

fwknopd.@global[0]=global
fwknopd.@global[0].uci_enabled=1
fwknopd.@access[0]=access
fwknopd.@access[0].SOURCE=ANY
fwknopd.@access[0].HMAC_KEY_BASE64='...'
fwknopd.@access[0].KEY_BASE64='...'
fwknopd.@access[0].OPEN_PORTS='tcp/2222'
fwknopd.@access[0].REQUIRE_SOURCE_ADDRESS='Y'
fwknopd.@access[0].FW_ACCESS_TIMEOUT='15'
fwknopd.@config[0]=config
fwknopd.@config[0].ENABLE_UDP_SERVER='Y'
fwknopd.@config[0].ENABLE_IPT_LOCAL_NAT='Y'
fwknopd.@config[0].ENABLE_IPT_FORWARDING='N'
fwknopd.@config[0].ENABLE_NAT_DNS='N'

Start

# 在 /etc/init.d/fwknopd 內有 function(generate_configuration) 建立 config 檔

FWKNOPD_CFGDIR=/var/etc/fwknop    # access.conf, fwknopd.conf

/etc/init.d/fwknopd start

Checking

netstat -nulp | grep fwknopd

ps | grep fwknopd

14162 root      1444 S    /usr/sbin/fwknopd --foreground \
                            --syslog-enable -c /var/etc/fwknop/fwknopd.conf \
                            -a /var/etc/fwknop/access.conf -i wan

Debug

cd /var/etc/fwknop

fwknopd -f -t -v -a access.conf -c fwknopd.conf

建議安裝 tcpdump 去 debug

TMP Files

/tmp/fwknop

• digest.cache
• fwknopd.pid

fwknopd CLI

cd /var/etc/fwknop

FWKNOPD='fwknopd -a access.conf -c fwknopd.conf'

詳見: CLI