Replace tarball with un-tarred ImmortalWrt patch tree (package/feeds/files overrides)
This commit is contained in:
@@ -0,0 +1,35 @@
|
||||
config dnsmasq
|
||||
option domainneeded '1'
|
||||
option boguspriv '1'
|
||||
option filterwin2k '0'
|
||||
option localise_queries '1'
|
||||
option rebind_protection '1'
|
||||
option rebind_localhost '1'
|
||||
option local '/lan/'
|
||||
option domain 'lan'
|
||||
option expandhosts '1'
|
||||
option nonegcache '0'
|
||||
option cachesize '1000'
|
||||
option authoritative '1'
|
||||
option readethers '1'
|
||||
option leasefile '/tmp/dhcp.leases'
|
||||
option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
|
||||
option nonwildcard '1'
|
||||
option localservice '1'
|
||||
option ednspacket_max '1232'
|
||||
option filter_aaaa '0'
|
||||
option filter_a '0'
|
||||
|
||||
config dhcp 'lan'
|
||||
option interface 'lan'
|
||||
option ignore '1'
|
||||
|
||||
config dhcp 'wan'
|
||||
option interface 'wan'
|
||||
option ignore '1'
|
||||
|
||||
config odhcpd 'odhcpd'
|
||||
option maindhcp '0'
|
||||
option leasefile '/tmp/hosts/odhcpd'
|
||||
option leasetrigger '/usr/sbin/odhcpd-update'
|
||||
option loglevel '4'
|
||||
@@ -0,0 +1,4 @@
|
||||
config dropbear
|
||||
option PasswordAuth 'on'
|
||||
option RootPasswordAuth 'on'
|
||||
option Port '22'
|
||||
@@ -0,0 +1,122 @@
|
||||
config defaults
|
||||
option input 'REJECT'
|
||||
option output 'ACCEPT'
|
||||
option forward 'REJECT'
|
||||
option synflood_protect '1'
|
||||
option fullcone '1'
|
||||
option flow_offloading '0'
|
||||
|
||||
config zone
|
||||
option name 'lan'
|
||||
option input 'ACCEPT'
|
||||
option output 'ACCEPT'
|
||||
option forward 'ACCEPT'
|
||||
list network 'lan'
|
||||
list network 'wg0'
|
||||
|
||||
config zone
|
||||
option name 'wan'
|
||||
option input 'REJECT'
|
||||
option output 'ACCEPT'
|
||||
option forward 'REJECT'
|
||||
option masq '1'
|
||||
option mtu_fix '1'
|
||||
list network 'wan'
|
||||
list network 'wan6'
|
||||
|
||||
config forwarding
|
||||
option src 'lan'
|
||||
option dest 'wan'
|
||||
|
||||
config rule
|
||||
option name 'Allow-DHCP-Renew'
|
||||
option src 'wan'
|
||||
option proto 'udp'
|
||||
option dest_port '68'
|
||||
option target 'ACCEPT'
|
||||
option family 'ipv4'
|
||||
|
||||
config rule
|
||||
option name 'Allow-Ping'
|
||||
option src 'wan'
|
||||
option proto 'icmp'
|
||||
option icmp_type 'echo-request'
|
||||
option family 'ipv4'
|
||||
option target 'ACCEPT'
|
||||
|
||||
config rule
|
||||
option name 'Allow-IGMP'
|
||||
option src 'wan'
|
||||
option proto 'igmp'
|
||||
option family 'ipv4'
|
||||
option target 'ACCEPT'
|
||||
|
||||
config rule
|
||||
option name 'Allow-DHCPv6'
|
||||
option src 'wan'
|
||||
option proto 'udp'
|
||||
option dest_port '546'
|
||||
option family 'ipv6'
|
||||
option target 'ACCEPT'
|
||||
|
||||
config rule
|
||||
option name 'Allow-MLD'
|
||||
option src 'wan'
|
||||
option proto 'icmp'
|
||||
option src_ip 'fe80::/10'
|
||||
list icmp_type '130/0'
|
||||
list icmp_type '131/0'
|
||||
list icmp_type '132/0'
|
||||
list icmp_type '143/0'
|
||||
option family 'ipv6'
|
||||
option target 'ACCEPT'
|
||||
|
||||
config rule
|
||||
option name 'Allow-ICMPv6-Input'
|
||||
option src 'wan'
|
||||
option proto 'icmp'
|
||||
list icmp_type 'echo-request'
|
||||
list icmp_type 'echo-reply'
|
||||
list icmp_type 'destination-unreachable'
|
||||
list icmp_type 'packet-too-big'
|
||||
list icmp_type 'time-exceeded'
|
||||
list icmp_type 'bad-header'
|
||||
list icmp_type 'unknown-header-type'
|
||||
list icmp_type 'router-solicitation'
|
||||
list icmp_type 'neighbour-solicitation'
|
||||
list icmp_type 'router-advertisement'
|
||||
list icmp_type 'neighbour-advertisement'
|
||||
option limit '1000/sec'
|
||||
option family 'ipv6'
|
||||
option target 'ACCEPT'
|
||||
|
||||
config rule
|
||||
option name 'Allow-ICMPv6-Forward'
|
||||
option src 'wan'
|
||||
option dest '*'
|
||||
option proto 'icmp'
|
||||
list icmp_type 'echo-request'
|
||||
list icmp_type 'echo-reply'
|
||||
list icmp_type 'destination-unreachable'
|
||||
list icmp_type 'packet-too-big'
|
||||
list icmp_type 'time-exceeded'
|
||||
list icmp_type 'bad-header'
|
||||
list icmp_type 'unknown-header-type'
|
||||
option limit '1000/sec'
|
||||
option family 'ipv6'
|
||||
option target 'ACCEPT'
|
||||
|
||||
config rule
|
||||
option name 'Allow-IPSec-ESP'
|
||||
option src 'wan'
|
||||
option dest 'lan'
|
||||
option proto 'esp'
|
||||
option target 'ACCEPT'
|
||||
|
||||
config rule
|
||||
option name 'Allow-ISAKMP'
|
||||
option src 'wan'
|
||||
option dest 'lan'
|
||||
option dest_port '500'
|
||||
option proto 'udp'
|
||||
option target 'ACCEPT'
|
||||
@@ -0,0 +1,49 @@
|
||||
config interface 'loopback'
|
||||
option device 'lo'
|
||||
option proto 'static'
|
||||
option ipaddr '127.0.0.1'
|
||||
option netmask '255.0.0.0'
|
||||
|
||||
config globals 'globals'
|
||||
option ula_prefix 'fdab:c3fc:a55d::/48'
|
||||
|
||||
config device
|
||||
option name 'br-lan'
|
||||
option type 'bridge'
|
||||
list ports 'eth1'
|
||||
|
||||
config interface 'lan'
|
||||
option device 'br-lan'
|
||||
option proto 'static'
|
||||
option ipaddr '192.168.1.2'
|
||||
option netmask '255.255.255.0'
|
||||
option ip6assign '60'
|
||||
|
||||
config interface 'wan'
|
||||
option device 'eth0'
|
||||
option proto 'dhcp'
|
||||
|
||||
config interface 'wan6'
|
||||
option device 'eth0'
|
||||
option proto 'dhcpv6'
|
||||
|
||||
config interface 'wg0'
|
||||
option proto 'wireguard'
|
||||
option private_key '<REDACTED-YOUR-WG-PRIVATE-KEY'
|
||||
option listen_port '51820'
|
||||
list addresses '10.99.0.2/32'
|
||||
option mtu '1420'
|
||||
option route_allowed_ips '1'
|
||||
|
||||
config wireguard_wg0 'wgpeer'
|
||||
option public_key 'GPrZqc8t7F3DG/D0ks+GcZQeUYy+3ClFnbSftSqiygQ='
|
||||
option preshared_key '<REDACTED-YOUR-WG-PSK'
|
||||
option endpoint_host '10.200.80.93'
|
||||
option endpoint_port '51820'
|
||||
option persistent_keepalive '25'
|
||||
list allowed_ips '10.99.0.1/32'
|
||||
|
||||
config route
|
||||
option interface 'wg0'
|
||||
option target '10.99.0.1'
|
||||
option netmask '255.255.255.255'
|
||||
@@ -0,0 +1,14 @@
|
||||
config turboacc 'config'
|
||||
option fastpath 'mediatek_hnat'
|
||||
option fastpath_mh_eth_hnat '1'
|
||||
option fastpath_mh_eth_hnat_v6 '1'
|
||||
option fastpath_mh_eth_hnat_bind_rate '30'
|
||||
option fastpath_mh_eth_hnat_bind_trap '0'
|
||||
option fullcone_nat '2'
|
||||
option hal 'none'
|
||||
option sw_flow '0'
|
||||
option hw_flow '0'
|
||||
option sfe_bridge '0'
|
||||
option bbr_cca '1'
|
||||
option dns_caching '0'
|
||||
option dns_caching_dns '223.5.5.5,223.6.6.6'
|
||||
@@ -0,0 +1,43 @@
|
||||
config wifi-device 'MT7981_1_1'
|
||||
option type 'mtwifi'
|
||||
option phy 'ra0'
|
||||
option hwmode '11a'
|
||||
option band '5g'
|
||||
option dbdc_main '1'
|
||||
option channel '36'
|
||||
option txpower '100'
|
||||
option htmode 'HE160'
|
||||
option country 'CN'
|
||||
option mu_beamformer '1'
|
||||
option noscan '0'
|
||||
option serialize '1'
|
||||
|
||||
config wifi-iface 'default_MT7981_1_1'
|
||||
option device 'MT7981_1_1'
|
||||
option network 'lan'
|
||||
option mode 'ap'
|
||||
option ssid 'ImmortalWrt-5G'
|
||||
option encryption 'none'
|
||||
option uapsd '0'
|
||||
|
||||
config wifi-device 'MT7981_1_2'
|
||||
option type 'mtwifi'
|
||||
option phy 'rax0'
|
||||
option hwmode '11g'
|
||||
option band '2g'
|
||||
option dbdc_main '0'
|
||||
option channel 'auto'
|
||||
option txpower '100'
|
||||
option htmode 'HE40'
|
||||
option country 'CN'
|
||||
option mu_beamformer '1'
|
||||
option noscan '1'
|
||||
option serialize '1'
|
||||
|
||||
config wifi-iface 'default_MT7981_1_2'
|
||||
option device 'MT7981_1_2'
|
||||
option network 'lan'
|
||||
option mode 'ap'
|
||||
option ssid 'ImmortalWrt-2.4G'
|
||||
option encryption 'none'
|
||||
option uapsd '0'
|
||||
@@ -0,0 +1,11 @@
|
||||
#!/bin/sh
|
||||
# === MSS clamp persistence (坑 #12 part 3) ===
|
||||
# fw4 reload (triggered by any ifup) wipes the nft rule added by 20-vxlan hotplug.
|
||||
# This iface hotplug re-adds the rule after every interface ifup event,
|
||||
# but only if the rule is missing (idempotent).
|
||||
# Idempotency: grep for the unique "set 1360" string before adding.
|
||||
[ "$ACTION" = "ifup" ] || exit 0
|
||||
sleep 2 # wait for fw4 reload to complete
|
||||
nft list chain inet fw4 mangle_forward 2>/dev/null | grep -q 'set 1360' || \
|
||||
nft add rule inet fw4 mangle_forward 'iifname "br-lan" tcp flags syn tcp option maxseg size set 1360' 2>/dev/null
|
||||
exit 0
|
||||
@@ -0,0 +1,33 @@
|
||||
#!/bin/sh
|
||||
# /etc/hotplug.d/iface/40-wg-track
|
||||
# 触发: 小路由 WAN iface 起来时 (boot / DHCP renew / link bounce)
|
||||
# 目的: 跟踪 WG 隧道自动恢复状态,验证坑 #15 是否真根除
|
||||
# 安装: scp 到 /etc/hotplug.d/iface/40-wg-track + chmod +x
|
||||
|
||||
[ "$ACTION" = "ifup" ] || exit 0
|
||||
case "$INTERFACE" in
|
||||
wan) ;;
|
||||
*) exit 0 ;;
|
||||
esac
|
||||
|
||||
WAN_IP=$(ip -4 addr show eth0 2>/dev/null | awk '/inet / {print $2; exit}' | cut -d/ -f1)
|
||||
[ -z "$WAN_IP" ] && exit 0
|
||||
|
||||
LOGFILE=/tmp/wg-tunnel-track.log
|
||||
|
||||
# 等 30s 让 tunnel 稳定 (handshake init + keepalive 至少跑两轮)
|
||||
sleep 30
|
||||
|
||||
TS=$(date '+%Y-%m-%d %H:%M:%S')
|
||||
ENDPOINT=$(wg show wg0 2>/dev/null | awk '/endpoint:/ {print $2; exit}')
|
||||
HANDSHAKE=$(wg show wg0 2>/dev/null | awk -F': ' '/latest handshake/ {print $2}')
|
||||
TRANSFER=$(wg show wg0 2>/dev/null | awk '/transfer:/ {print $2, $3, $4, $5}')
|
||||
PING_LOSS=$(ping -c 3 -W 2 10.99.0.1 2>&1 | awk '/packets transmitted/ {print $6}')
|
||||
|
||||
STATUS="OK"
|
||||
[ "$PING_LOSS" != "0%" ] && STATUS="FAIL"
|
||||
|
||||
echo "$TS | status=$STATUS | WAN=$WAN_IP | endpoint=$ENDPOINT | handshake=$HANDSHAKE | loss=$PING_LOSS | xfer=$TRANSFER" >> "$LOGFILE"
|
||||
|
||||
# Rotate: 只保留最后 200 行
|
||||
tail -200 "$LOGFILE" > "$LOGFILE.tmp" 2>/dev/null && mv "$LOGFILE.tmp" "$LOGFILE"
|
||||
@@ -0,0 +1,26 @@
|
||||
#!/bin/sh
|
||||
# RPS/RFS tuning for single-RX-queue devices (mtk_soc_eth)
|
||||
# Distributes softirq across all CPUs; without this, all eth RX runs on CPU0 only.
|
||||
# Pairs with sysctl tuning in /etc/sysctl.conf (BBR + buffer sizes).
|
||||
|
||||
[ -d /sys/class/net/eth1/queues ] && echo 3 > /sys/class/net/eth1/queues/rx-0/rps_cpus
|
||||
[ -d /sys/class/net/eth0/queues ] && echo 3 > /sys/class/net/eth0/queues/rx-0/rps_cpus
|
||||
[ -d /sys/class/net/br-lan/queues ] && echo 3 > /sys/class/net/br-lan/queues/rx-0/rps_cpus
|
||||
[ -d /sys/class/net/ra0/queues ] && echo 3 > /sys/class/net/ra0/queues/rx-0/rps_cpus
|
||||
[ -d /sys/class/net/rax0/queues ] && echo 3 > /sys/class/net/rax0/queues/rx-0/rps_cpus
|
||||
|
||||
echo 32768 > /proc/sys/net/core/rps_sock_flow_entries 2>/dev/null
|
||||
[ -f /sys/class/net/eth1/queues/rx-0/rps_flow_cnt ] && echo 32768 > /sys/class/net/eth1/queues/rx-0/rps_flow_cnt
|
||||
[ -f /sys/class/net/br-lan/queues/rx-0/rps_flow_cnt ] && echo 32768 > /sys/class/net/br-lan/queues/rx-0/rps_flow_cnt
|
||||
|
||||
# === VXLAN boot fallback (keng #12 part 2) ===
|
||||
# Hotplug 20-vxlan sometimes misses wg0 ifup at boot (no 10.99 route, no log entry).
|
||||
# If we got here without vxlan0, manually re-trigger the same script.
|
||||
[ -e /sys/class/net/vxlan0 ] || ACTION=ifup INTERFACE=wg0 /etc/hotplug.d/net/20-vxlan
|
||||
|
||||
# === WiFi band label verifier (v28, log-only) ===
|
||||
# Aligns UCI wifi labels with physical broadcast once driver is stable.
|
||||
# Log-only (no uci mutation); see /etc/wifi-band-verify.sh for rationale.
|
||||
( /etc/wifi-band-verify.sh >/dev/null 2>&1 & )
|
||||
|
||||
exit 0
|
||||
@@ -0,0 +1,3 @@
|
||||
net.bridge.bridge-nf-call-ip6tables=1
|
||||
net.bridge.bridge-nf-call-iptables=1
|
||||
net.bridge.bridge-nf-call-arptables=1
|
||||
@@ -0,0 +1,66 @@
|
||||
#!/bin/sh
|
||||
# 99-custom-config - Apply TR3000-specific defaults on first boot
|
||||
# Sets LAN IP, WiFi SSID/htmode/uapsd, dnsmasq, IPv6 RA, turboacc BBR
|
||||
# Runs once (uci-defaults scripts auto-delete after running)
|
||||
#
|
||||
# v29 2026-07-22: HONEST labels. UCI idx=1=5g config (driver maps
|
||||
# band=5g content to the 5G PHY whatever netdev it is this boot).
|
||||
# idx=2=2g config (maps to 2.4G PHY). ra0/rax0 netdev binding is
|
||||
# random per boot but physical broadcast always correct (band-content
|
||||
# invariant). LuCI Overview shows iwinfo truth. Edit forms show UCI
|
||||
# config. Do NOT use LuCI Save and Apply (triggers wifi reload);
|
||||
# reboot to apply wireless changes.
|
||||
|
||||
. /lib/functions.sh
|
||||
|
||||
# ===== LAN IP =====
|
||||
uci set network.lan.ipaddr="192.168.1.2"
|
||||
uci set network.lan.netmask="255.255.255.0"
|
||||
uci commit network
|
||||
|
||||
# ===== WiFi SSID + htmode + uapsd (honest labels) =====
|
||||
uci set wireless.MT7981_1_1.phy="ra0"
|
||||
uci set wireless.MT7981_1_1.band="5g"
|
||||
uci set wireless.MT7981_1_1.hwmode="11a"
|
||||
uci set wireless.MT7981_1_1.htmode="HE160"
|
||||
uci set wireless.MT7981_1_1.country="CN"
|
||||
uci set wireless.MT7981_1_1.channel="36"
|
||||
uci set wireless.MT7981_1_1.dbdc_main="1"
|
||||
uci set wireless.default_MT7981_1_1.ssid="ImmortalWrt-5G"
|
||||
uci set wireless.default_MT7981_1_1.uapsd="0"
|
||||
uci set wireless.default_MT7981_1_1.encryption="none"
|
||||
|
||||
uci set wireless.MT7981_1_2.phy="rax0"
|
||||
uci set wireless.MT7981_1_2.band="2g"
|
||||
uci set wireless.MT7981_1_2.hwmode="11g"
|
||||
uci set wireless.MT7981_1_2.htmode="HE40"
|
||||
uci set wireless.MT7981_1_2.country="CN"
|
||||
uci set wireless.MT7981_1_2.channel="auto"
|
||||
uci set wireless.MT7981_1_2.dbdc_main="0"
|
||||
uci set wireless.default_MT7981_1_2.ssid="ImmortalWrt-2.4G"
|
||||
uci set wireless.default_MT7981_1_2.uapsd="0"
|
||||
uci set wireless.default_MT7981_1_2.encryption="none"
|
||||
|
||||
uci commit wireless
|
||||
|
||||
# ===== dnsmasq enable =====
|
||||
/etc/init.d/dnsmasq enable
|
||||
|
||||
# ===== IPv6 RA disabled =====
|
||||
uci set dhcp.lan.ra="disabled"
|
||||
uci set dhcp.lan.dhcpv6="disabled"
|
||||
uci commit dhcp
|
||||
|
||||
# ===== turboacc: BBR as default TCP CCA =====
|
||||
# /etc/init.d/turboacc force-sets tcp_congestion_control from
|
||||
# turboacc.config.tcpcca at every boot (S90, after sysctl.d), defaulting
|
||||
# to cubic and clobbering sysctl.d/12-tcp-bbr.conf. Pin bbr here so the
|
||||
# 网络加速 page shows BBR active out of the box.
|
||||
uci set turboacc.config.tcpcca="bbr"
|
||||
uci commit turboacc
|
||||
|
||||
# ===== Firewall: prepare for MSS clamp via hotplug =====
|
||||
# fw4 reload wipes hotplug MSS clamp rules; the 30-mss-clamp hotplug
|
||||
# re-adds them on every iface ifup. No static config needed here.
|
||||
|
||||
exit 0
|
||||
@@ -0,0 +1,59 @@
|
||||
#!/bin/sh
|
||||
# wifi-band-verify.sh — LOG-ONLY diagnostic. Compares UCI labels against the
|
||||
# PHYSICAL band each netdev is on and records the verdict to logread.
|
||||
# NEVER writes UCI: with ra0/rax0 ↔ dat binding random per boot (and band-content
|
||||
# invariant keeping physical always correct), mutating UCI oscillates across
|
||||
# wifi reloads. Logging the mismatch is enough — LuCI display patch (wireless.js
|
||||
# getActiveSSID) makes the UI match iwinfo truth regardless of UCI labels.
|
||||
# Triggered by rc.local at boot and mtwifi_cfg dispatcher tail.
|
||||
# Commit-only would still be loop-safe, but useless: detection is non-deterministic
|
||||
# across reloads, so any commit causes oscillation. Log-only is structurally stable.
|
||||
|
||||
LOCK=/tmp/wifi-band-verify.lock
|
||||
NOW=$(date +%s)
|
||||
if [ -f "$LOCK" ]; then
|
||||
LAST=$(cat "$LOCK" 2>/dev/null)
|
||||
[ -n "$LAST" ] && [ $((NOW - LAST)) -lt 120 ] && exit 0
|
||||
fi
|
||||
echo "$NOW" > "$LOCK"
|
||||
|
||||
log() { logger -t wifi-band-verify -- "$*"; }
|
||||
|
||||
get_ch() { iwinfo "$1" info 2>/dev/null | awk '/Channel:/ {print $4}'; }
|
||||
get_essid(){ iwinfo "$1" info 2>/dev/null | awk -F"\x22" '/ESSID:/ {print $2}'; }
|
||||
|
||||
# Phase 1: wait until both radios report identical channels on two consecutive
|
||||
# 10s probes (guards against mid-init transient reads; max 18 rounds = 3min).
|
||||
ra0ch=""; rax0ch=""; stable=0; i=0
|
||||
while [ $i -lt 18 ]; do
|
||||
c1=$(get_ch ra0); c2=$(get_ch rax0)
|
||||
case "$c1" in ""|*[!0-9]*) c1="" ;; esac
|
||||
case "$c2" in ""|*[!0-9]*) c2="" ;; esac
|
||||
if [ -n "$c1" ] && [ -n "$c2" ] && [ "$c1" = "$ra0ch" ] && [ "$c2" = "$rax0ch" ]; then
|
||||
stable=1; break
|
||||
fi
|
||||
ra0ch=$c1; rax0ch=$c2
|
||||
i=$((i+1)); sleep 10
|
||||
done
|
||||
[ $stable -eq 1 ] || { log "radios not stable after 3min; skipped"; exit 0; }
|
||||
|
||||
# Phase 2: physical band from channel (2g ≤14, 5g ≥36)
|
||||
band_of() { [ "$1" -le 14 ] && echo 2g || echo 5g; }
|
||||
ra0band=$(band_of "$ra0ch"); rax0band=$(band_of "$rax0ch")
|
||||
[ "$ra0band" = "$rax0band" ] && { log "both radios on $ra0band ch$ra0ch/$rax0ch; abnormal"; exit 0; }
|
||||
|
||||
# Phase 3: read UCI labels and live ESSIDs, log verdict — NO mutation.
|
||||
uci -q get wireless.MT7981_1_1 >/dev/null || exit 0
|
||||
uci -q get wireless.MT7981_1_2 >/dev/null || exit 0
|
||||
u1=$(uci -q get wireless.MT7981_1_1.band)
|
||||
u2=$(uci -q get wireless.MT7981_1_2.band)
|
||||
s1=$(uci -q get wireless.default_MT7981_1_1.ssid)
|
||||
s2=$(uci -q get wireless.default_MT7981_1_2.ssid)
|
||||
e1=$(get_essid ra0); e2=$(get_essid rax0)
|
||||
|
||||
if [ "$u1" = "$ra0band" ] && [ "$u2" = "$rax0band" ] && [ "$s1" = "$e1" ] && [ "$s2" = "$e2" ]; then
|
||||
log "consistent: ra0=$ra0band ch$ra0ch [$e1], rax0=$rax0band ch$rax0ch [$e2]; uci=$u1/$u2"
|
||||
else
|
||||
log "MISMATCH (no-op): ra0=$ra0band ch$ra0ch [$e1], rax0=$rax0band ch$rax0ch [$e2]; uci=$u1/$u2 ssid=$s1/$s2"
|
||||
fi
|
||||
exit 0
|
||||
Reference in New Issue
Block a user