Differences
This shows you the differences between two versions of the page.
|
doc:uci:network [2012/07/20 22:14] 70d7a4f46 Sidenote on alternative solution for 6in4 tunnel behind 1:1 NAT |
doc:uci:network [2013/06/18 14:57] (current) steven |
||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Network configuration ====== | ====== Network configuration ====== | ||
| - | The central network configuration is located in ''/etc/config/network''. This configuration is responsible for defining //switch VLANs//, //interface configurations// and //network routes//. | + | The central network configuration is located in the file ''/etc/config/network''. This configuration file is responsible for defining //switch VLANs//, //interface configurations// and //network routes//. After editing and saving ''/etc/config/network'' you need to execute <code>/etc/init.d/network reload</code> to stop and restart the network before any changes take effect. Rebooting the router is not necessary. |
| - | **''Hint:''** After editing ''/etc/config/network'' you need to execute | + | * https://dev.openwrt.org/browser/branches/attitude_adjustment/package/base-files/files/etc/config/network |
| - | <code> | + | * https://dev.openwrt.org/browser/trunk/package/base-files/files/etc/config/network |
| - | /etc/init.d/network restart | + | |
| - | </code> | + | Feel free to inform yourself about [[doc/techref/netifd|netifd]] (Network Interface Daemon). |
| - | to make your new configuration take effect. There is no need to reboot the router. | + | |
| ===== Sections ===== | ===== Sections ===== | ||
| Line 12: | Line 11: | ||
| Below is an overview of the section types that may be defined in the network configuration. | Below is an overview of the section types that may be defined in the network configuration. | ||
| A minimal network configuration for a router usually consists of at least two //interfaces// (''lan'' and ''wan'') and a //switch// section if applicable. | A minimal network configuration for a router usually consists of at least two //interfaces// (''lan'' and ''wan'') and a //switch// section if applicable. | ||
| - | ==== Switch ==== | ||
| - | The ''switch'' section is responsible for partitioning the switch into several //VLANs// which appear as independent interfaces in the system although they share the same hardware. Not every OpenWrt supported device has a programmable switch, therefore this section might not be present on some platforms. | + | ==== Global Settings ==== |
| + | :!: The globals section is available in Barrier Breaker and later releases. | ||
| - | There are currently two different configuration formats in use, one for the legacy ''/proc/switch/'' API and one for the newer //swconfig// based switch infrastructure. | + | The ''globals'' section contains interface-independent options affecting the network configuration in general. |
| - | === /proc/switch === | + | ^ Name ^ Type ^ Required ^ Default ^ Description ^ |
| + | | ''ula_prefix'' | IPv6-prefix | no | //(none)// | IPv6 [[wp>Unique local address|ULA]]-Prefix for this device | | ||
| - | This variant is only found on Broadcom devices like the WRT54GL. | + | ==== Switch ==== |
| + | The ''switch'' section is responsible for partitioning the switch into several //VLANs// which appear as independent interfaces in the system although they share the same hardware. Not every OpenWrt supported device has a programmable switch, therefore this section might not be present on some platforms. Please also note, that some switches only support 4Bit-VLANs. | ||
| + | |||
| + | There are currently two different configuration formats in use, one for the legacy ''/proc/switch/'' API and one for the newer ''[[doc/techref/swconfig|swconfig]]''-based switch configuration. | ||
| + | |||
| + | === /proc/switch === | ||
| + | This variant is actually only found on Broadcom devices like the WRT54GL. | ||
| A typical configuration for it looks like this: | A typical configuration for it looks like this: | ||
| Line 33: | Line 39: | ||
| === swconfig === | === swconfig === | ||
| + | The newer ''[[doc/techref/swconfig|swconfig]]''-framework is intended to replace the legacy switch configuration. | ||
| - | The newer //swconfig// framework is intended to replace the legacy switch configuration. | + | Configuration for swconfig have a slightly different structure with one extra section per VLAN. |
| - | + | ||
| - | The typical filepath for the config is ''/etc/config/network'' | + | |
| - | + | ||
| - | //Swconfig// based configurations have a different structure with one extra section per vlan. | + | |
| The example below shows a typical configuration: | The example below shows a typical configuration: | ||
| <code>config 'switch' 'eth0' | <code>config 'switch' 'eth0' | ||
| Line 56: | Line 59: | ||
| Common properties are defined within the ''switch'' section; vlan specific properties are located in additional ''switch_vlan'' sections linked to the ''switch'' section through the ''device'' option. | Common properties are defined within the ''switch'' section; vlan specific properties are located in additional ''switch_vlan'' sections linked to the ''switch'' section through the ''device'' option. | ||
| The complete layout is explained in the [[doc:uci:network::switch|switch documentation]]. | The complete layout is explained in the [[doc:uci:network::switch|switch documentation]]. | ||
| - | ==== Interfaces ==== | ||
| + | |||
| + | ==== Interfaces ==== | ||
| Sections of the type ''interface'' declare logical networks serving as containers for IP address settings, [[doc:uci:network#aliases|aliases]], [[doc:uci:network#ipv4.routes|routes]], physical interface names and [[doc:uci:firewall#zones|firewall rules]] - they play a central role within the OpenWrt configuration concept. | Sections of the type ''interface'' declare logical networks serving as containers for IP address settings, [[doc:uci:network#aliases|aliases]], [[doc:uci:network#ipv4.routes|routes]], physical interface names and [[doc:uci:firewall#zones|firewall rules]] - they play a central role within the OpenWrt configuration concept. | ||
| Line 75: | Line 79: | ||
| | ''static'' | Static configuration with fixed address and netmask | ''ip''/''ifconfig'' | | | ''static'' | Static configuration with fixed address and netmask | ''ip''/''ifconfig'' | | ||
| | ''dhcp'' | Address and netmask are assigned by DHCP | ''udhcpc'' (Busybox) | | | ''dhcp'' | Address and netmask are assigned by DHCP | ''udhcpc'' (Busybox) | | ||
| + | | ''dhcpv6'' | Address and netmask are assigned by DHCPv6 | ''odhcpc6c'' | | ||
| | ''ppp'' | PPP protocol - dialup modem connections | ''pppd'' | | | ''ppp'' | PPP protocol - dialup modem connections | ''pppd'' | | ||
| | ''pppoe'' | PPP over Ethernet - DSL broadband connection | ''pppd'' + ''plugin rp-pppoe.so'' | | | ''pppoe'' | PPP over Ethernet - DSL broadband connection | ''pppd'' + ''plugin rp-pppoe.so'' | | ||
| Line 91: | Line 96: | ||
| ^ Name ^ Type ^ Required ^ Default ^ Description ^ | ^ Name ^ Type ^ Required ^ Default ^ Description ^ | ||
| | ''ifname'' | interface name(s) | yes(*) | //(none)// | Physical interface name to assign to this section, list of interfaces if type bridge is set.\\ //(*) This option may be empty or missing if only a wireless interface references this network or if the protocol type is ''pptp'', ''pppoa'' or ''6in4''// | | | ''ifname'' | interface name(s) | yes(*) | //(none)// | Physical interface name to assign to this section, list of interfaces if type bridge is set.\\ //(*) This option may be empty or missing if only a wireless interface references this network or if the protocol type is ''pptp'', ''pppoa'' or ''6in4''// | | ||
| - | | ''type'' | string | no | //(none)// | If set to "bridge", a bridge containing the given //ifnames// is created | | + | | ''type'' | string | no | //(none)// | If set to "bridge", a bridge containing the given //ifnames// is created\\ [[https://forum.openwrt.org/viewtopic.php?pid=203784#p203784|Wlan interface names are not predictable, therfore you cannot reference them directly in the network config]] | |
| | ''stp'' | boolean | no | ''0'' | Only valid for type "bridge", enables the Spanning Tree Protocol | | | ''stp'' | boolean | no | ''0'' | Only valid for type "bridge", enables the Spanning Tree Protocol | | ||
| | ''macaddr'' | mac address | no | //(none)// | Override MAC address of this interface | | | ''macaddr'' | mac address | no | //(none)// | Override MAC address of this interface | | ||
| | ''mtu'' | number | no | //(none)// | Override the default MTU on this interface | | | ''mtu'' | number | no | //(none)// | Override the default MTU on this interface | | ||
| | ''auto'' | boolean | no | ''0'' for proto ''none'', else ''1'' | Specifies whether to bring up interface on boot | | | ''auto'' | boolean | no | ''0'' for proto ''none'', else ''1'' | Specifies whether to bring up interface on boot | | ||
| - | | ''accept_ra'' | boolean | no | ''1'' for protocol ''dhcp'', else ''0'' | Specifies whether to accept IPv6 Router Advertisements on this interface | | + | | ''accept_ra'' | boolean | no | ''1'' for protocol ''dhcp'', else ''0'' | **deprecated:** Specifies whether to accept IPv6 Router Advertisements on this interface (On Attitude Adjustment 12.09 and earlier versions) | |
| - | | ''send_rs'' | boolean | no | ''1'' for protocol ''static'', else ''0'' | Specifies whether to send Router Solicitations on this interface | | + | | ''send_rs'' | boolean | no | ''1'' for protocol ''static'', else ''0'' | **deprecated:** Specifies whether to send Router Solicitations on this interface (On Attitude Adjustment 12.09 and earlier versions) | |
| === Protocol "static" === | === Protocol "static" === | ||
| Line 108: | Line 113: | ||
| | ''ip6addr'' | ipv6 address | yes, if no ''ipaddr'' is set | //(none)// | Assign given IPv6 address to this interface (CIDR notation) | | | ''ip6addr'' | ipv6 address | yes, if no ''ipaddr'' is set | //(none)// | Assign given IPv6 address to this interface (CIDR notation) | | ||
| | ''ip6gw'' | ipv6 address | no | //(none)// | Assign given IPv6 default gateway to this interface | | | ''ip6gw'' | ipv6 address | no | //(none)// | Assign given IPv6 default gateway to this interface | | ||
| + | | ''ip6assign'' | prefix length | no | //(none)// | Delegate a [[[[network6#downstream.configuration.for.lan-interfaces|prefix of given length]] to this interface (Barrier Breaker and later only) | | ||
| + | | ''ip6hint'' | prefix hint (hex) | no | //(none)// | [[network6#downstream.configuration.for.lan-interfaces|Hint the subprefix-ID]] that should be delegeted as hexadecimal number (Barrier Breaker and later only) | | ||
| + | | ''ip6prefix'' | ipv6 prefix | no | //(none)// | IPv6 prefix routed here for use on other interfaces (Barrier Breaker and later only) | | ||
| + | | ''ip6class'' | list of strings | no | //(none)// | Define the IPv6 prefix-classes this interface will accept | | ||
| | ''dns'' | list of ip addresses | no | //(none)// | DNS server(s) | | | ''dns'' | list of ip addresses | no | //(none)// | DNS server(s) | | ||
| | ''metric'' | integer | no | ''0'' | Specifies the default route metric to use | | | ''metric'' | integer | no | ''0'' | Specifies the default route metric to use | | ||
| Line 123: | Line 132: | ||
| | ''metric'' | integer | no | ''0'' | Specifies the default route metric to use | | | ''metric'' | integer | no | ''0'' | Specifies the default route metric to use | | ||
| | ''reqopts'' | list of strings | no | //(none)// | Specifies a list of additional DHCP options to request | | | ''reqopts'' | list of strings | no | //(none)// | Specifies a list of additional DHCP options to request | | ||
| + | | ''iface6rd'' | logical interface | no | //(none)// | Logical interface template for auto-configuration of 6rd | | ||
| + | |||
| + | **Note:** To automatically configure 6rd from dhcp you need to create an interface with ''option auto 0'' and put its name as the 'iface6rd' parameter. In addition you also need to add its name to a suitable firewall zone in /etc/config/firewall. | ||
| + | |||
| + | === Protocol "dhcpv6" === | ||
| + | |||
| + | :!: The package ''odhcp6c'' must be installed to use dhcpv6. | ||
| + | |||
| + | ^ Name ^ Type ^ Required ^ Default ^ Description ^ | ||
| + | | ''reqaddress'' | [try,force,none] | no | try | Behaviour for requesting addresses | | ||
| + | | ''reqprefix'' | [auto,no,0-64] | no | auto | Behaviour for requesting prefixes (numbers denote hinted prefix length). Use 'no' if you only want a single IPv6 address for the AP itself without a subnet for routing | | ||
| + | | ''clientid'' | string | no | //system default// | Override client identifier in DHCP requests | | ||
| + | | ''ifaceid'' | ipv6 addr | no | //link-local identifier// | Override the interface identifier for adresses received via RA | | ||
| + | | ''dns'' | list of ip addresses | no | //(none)// | Supplement DHCP-assigned DNS server(s), or use only these if peerdns is 0 | | ||
| + | | ''peerdns'' | boolean | no | ''1'' | Use DHCP-provided DNS server(s) | | ||
| + | | ''reqopts'' | list of numbers | no | //(none)// | Specifies a list of additional DHCP options to request | | ||
| + | | ''noslaaconly'' | boolean | no | ''0'' | Don't allow configuration via SLAAC (RAs) only (implied by reqprefix != no) | | ||
| + | | ''norelease'' | boolean | no | ''0'' | Don't send a RELEASE when the interface is brought down | | ||
| + | | ''ip6prefix'' | ipv6 prefix | no | //(none)// | Use an (additional) user-provided IPv6 prefix for distribution to clients | | ||
| + | | ''iface_dslite'' | logical interface | no | //(none)// | Logical interface template for auto-configuration of DS-Lite | | ||
| + | |||
| + | **Note:** To automatically configure ds-lite from dhcpv6 you need to create an interface with ''option auto 0'' and put its name as the 'iface_dslite' parameter. In addition you also need to add its name to a suitable firewall zone in /etc/config/firewall. | ||
| === Protocol "ppp" (PPP over Modem) === | === Protocol "ppp" (PPP over Modem) === | ||
| Line 223: | Line 254: | ||
| | ''peeraddr'' | IPv4 address | yes | //(none)// | Remote IPv4 endpoint address | | | ''peeraddr'' | IPv4 address | yes | //(none)// | Remote IPv4 endpoint address | | ||
| | ''ip6addr'' | IPv6 address (CIDR) | yes | //(none)// | Local IPv6 address delegated to the tunnel endpoint | | | ''ip6addr'' | IPv6 address (CIDR) | yes | //(none)// | Local IPv6 address delegated to the tunnel endpoint | | ||
| + | | ''ip6prefix'' | IPv6 prefix | no | //(none)// | Routed IPv6 prefix for downstream interfaces (Barrier Breaker and later only) | | ||
| | ''defaultroute'' | boolean | no | ''1'' | Whether to create an IPv6 default route over the tunnel | | | ''defaultroute'' | boolean | no | ''1'' | Whether to create an IPv6 default route over the tunnel | | ||
| | ''ttl'' | integer | no | ''64'' | TTL used for the tunnel interface | | | ''ttl'' | integer | no | ''64'' | TTL used for the tunnel interface | | ||
| | ''mtu'' | integer | no | ''1280'' | MTU used for the tunnel interface | | | ''mtu'' | integer | no | ''1280'' | MTU used for the tunnel interface | | ||
| - | | ''wan_device'' | string | no | //(none)// | Interface from where client IPv4 endpoint address is derived (used for endpoint update)| | ||
| | ''tunnelid'' | integer | no | //(none)// | HE.net global tunnel ID (used for endpoint update) | | | ''tunnelid'' | integer | no | //(none)// | HE.net global tunnel ID (used for endpoint update) | | ||
| | ''username'' | string | no | //(none)// | HE.net user ID (used for endpoint update) | | | ''username'' | string | no | //(none)// | HE.net user ID (used for endpoint update) | | ||
| Line 244: | Line 275: | ||
| | ''ttl'' | integer | no | ''64'' | TTL used for the tunnel interface | | | ''ttl'' | integer | no | ''64'' | TTL used for the tunnel interface | | ||
| | ''mtu'' | integer | no | ''1280'' | MTU used for the tunnel interface | | | ''mtu'' | integer | no | ''1280'' | MTU used for the tunnel interface | | ||
| - | | ''adv_interface'' | string | no | ''lan'' | The //logical interface name// of the network the subnet should be advertised on. Multiple interface names can be given. | | ||
| - | | ''adv_subnet'' | hex number | no | ''1'' | A subnet ID between ''1'' and ''FFFF'' which selects the advertised /64 prefix from the mapped 6to4 space. The subnet ID is incremented by 1 for every interface specified in ''adv_interface''. | | ||
| - | | ''adv_valid_lifetime'' | integer | no | ''300'' | Overrides the advertised valid prefix lifetime, in seconds (see also [[doc:uci:radvd#prefix|radvd prefix options]]) | | ||
| - | | ''adv_preferred_lifetime'' | integer | no | ''120'' | Overrides the advertised preferred prefix lifetime, in seconds (see also [[doc:uci:radvd#prefix|radvd prefix options]]) | | ||
| | ''metric'' | integer | no | ''0'' | Specifies the default route metric to use | | | ''metric'' | integer | no | ''0'' | Specifies the default route metric to use | | ||
| + | | ''adv_interface'' | string | no | ''lan'' | (deprecated) The //logical interface name// of the network the subnet should be advertised on. Multiple interface names can be given. | | ||
| + | | ''adv_subnet'' | hex number | no | ''1'' | (deprecated) A subnet ID between ''1'' and ''FFFF'' which selects the advertised /64 prefix from the mapped 6to4 space. The subnet ID is incremented by 1 for every interface specified in ''adv_interface''. | | ||
| + | | ''adv_valid_lifetime'' | integer | no | ''300'' | (deprecated) Overrides the advertised valid prefix lifetime, in seconds (see also [[doc:uci:radvd#prefix|radvd prefix options]]) | | ||
| + | | ''adv_preferred_lifetime'' | integer | no | ''120'' | (deprecated) Overrides the advertised preferred prefix lifetime, in seconds (see also [[doc:uci:radvd#prefix|radvd prefix options]]) | | ||
| **Note:** This protocol type does not need an ''ifname'' option set in the interface section. The interface name is derived from the section name, e.g. ''config interface wan6'' would result in an interface named ''6to4-wan6''. \\ | **Note:** This protocol type does not need an ''ifname'' option set in the interface section. The interface name is derived from the section name, e.g. ''config interface wan6'' would result in an interface named ''6to4-wan6''. \\ | ||
| - | **Note:** If [[doc:uci:radvd|radvd]] is installed and enabled, the 6to4 scripts will add a temporary prefix and interface declaration to the //radvd// uci configuration and perform a daemon restart if required. | + | **Note:** If [[doc:uci:radvd|radvd]] is installed and enabled, the 6to4 scripts will add a temporary prefix and interface declaration to the //radvd// uci configuration and perform a daemon restart if required. (deprecated) |
| + | |||
| + | |||
| + | === Protocol "6rd" (IPv6 rapid deployment) === | ||
| + | |||
| + | :!: The package ''6rd'' must be installed to use this protocol. | ||
| + | |||
| + | ^ Name ^ Type ^ Required ^ Default ^ Description ^ | ||
| + | | ''peeraddr'' | IPv4 address | yes | no | 6rd - Gateway | | ||
| + | | ''ipaddr'' | IPv4 address | no | Current WAN IPv4 address | Local IPv4 endpoint address | | ||
| + | | ''ip6prefix'' | IPv6 prefix (without length) | yes | no | 6rd-IPv6 Prefix | | ||
| + | | ''ip6prefixlen'' | IPv6 prefix length | yes | no | 6rd-IPv6 Prefix length | | ||
| + | | ''ip4prefixlen'' | IPv6 prefix length | no | 0 | IPv4 common prefix | | ||
| + | | ''defaultroute'' | boolean | no | ''1'' | Whether to create an IPv6 default route over the tunnel | | ||
| + | | ''ttl'' | integer | no | ''64'' | TTL used for the tunnel interface | | ||
| + | | ''mtu'' | integer | no | ''1280'' | MTU used for the tunnel interface | | ||
| + | |||
| + | **Note:** This protocol type does not need an ''ifname'' option set in the interface section. The interface name is derived from the section name, e.g. ''config interface wan6'' would result in an interface named ''6rd-wan6''. | ||
| + | |||
| + | |||
| + | === Protocol "dslite" (Dual-Stack Lite) === | ||
| + | |||
| + | :!: The package ''ds-lite'' must be installed to use this protocol. | ||
| + | |||
| + | ^ Name ^ Type ^ Required ^ Default ^ Description ^ | ||
| + | | ''peeraddr'' | IPv6 address | yes | no | DS-Lite AFTR address | | ||
| + | | ''ip6addr'' | IPv6 address | no | Current WAN IPv6 address | Local IPv6 endpoint address | | ||
| + | | ''tunlink'' | Logical Interface | no | Current WAN interface | Tunnel base interface | | ||
| + | | ''defaultroute'' | boolean | no | ''1'' | Whether to create an IPv6 default route over the tunnel | | ||
| + | | ''ttl'' | integer | no | ''64'' | TTL used for the tunnel interface | | ||
| + | | ''mtu'' | integer | no | ''1280'' | MTU used for the tunnel interface | | ||
| + | |||
| + | :!: ds-lite operation requires that IPv4 NAT is disabled. You should adjust your settings in /etc/config/firewall accordingly. | ||
| + | |||
| + | **Note:** This protocol type does not need an ''ifname'' option set in the interface section. The interface name is derived from the section name, e.g. ''config interface wan'' would result in an interface named ''dslite-wan''. | ||
| Line 286: | Line 351: | ||
| | ''forward_bcast'' | boolean | no | ''1'' | Enables forwarding of broadcast traffic, ''0'' disables it | | | ''forward_bcast'' | boolean | no | ''1'' | Enables forwarding of broadcast traffic, ''0'' disables it | | ||
| | ''forward_dhcp'' | boolean | no | ''1'' | Enables forwarding of DHCP requests and responses, ''0'' disables it | | | ''forward_dhcp'' | boolean | no | ''1'' | Enables forwarding of DHCP requests and responses, ''0'' disables it | | ||
| + | |||
| + | === Protocol "6relay" (IPv6 Pseudo Bridge) === | ||
| + | |||
| + | :!: The IPv6 pseudo-bridging feature has been moved into its own configuration. See [[doc:uci::6relayd|6relayd configuration]]. | ||
| ==== ATM Bridges (Ethernet over ATM AAL5) ==== | ==== ATM Bridges (Ethernet over ATM AAL5) ==== | ||
| Line 314: | Line 383: | ||
| | ''payload'' | string | no | ''bridged'' | PPPoA forwarding mode: 'routed' or 'bridged' | | | ''payload'' | string | no | ''bridged'' | PPPoA forwarding mode: 'routed' or 'bridged' | | ||
| ==== Aliases ==== | ==== Aliases ==== | ||
| + | |||
| + | | {{:meta:icons:tango:48px-outdated.svg.png?nolink}} | The "config alias" approach is //deprecated//. it used to be needed when multiple interfaces sharing the same device where not supported. [[https://forum.openwrt.org/viewtopic.php?pid=203943#p203943|JoW]] | | ||
| //Alias// sections can be used to define further IPv4 and IPv6 addresses for interfaces. | //Alias// sections can be used to define further IPv4 and IPv6 addresses for interfaces. | ||
| Line 347: | Line 418: | ||
| | ''dns'' | list of ip addresses | no | //(none)// | DNS server(s) | | | ''dns'' | list of ip addresses | no | //(none)// | DNS server(s) | | ||
| | ''layer'' | integer | no | ''3'' | Selects the interface to attach to for stacked protocols (tun over bridge over eth, ppp over eth or similar).\\ 3: attach to layer 3 interface (//tun*//, //ppp*// if parent is layer 3 else fallback to 2)\\ 2: attach to layer 2 interface (//br-*// if parent is bridge else fallback to layer 1)\\ 1: attach to layer 1 interface (//eth*//, //wlan*//) | | | ''layer'' | integer | no | ''3'' | Selects the interface to attach to for stacked protocols (tun over bridge over eth, ppp over eth or similar).\\ 3: attach to layer 3 interface (//tun*//, //ppp*// if parent is layer 3 else fallback to 2)\\ 2: attach to layer 2 interface (//br-*// if parent is bridge else fallback to layer 1)\\ 1: attach to layer 1 interface (//eth*//, //wlan*//) | | ||
| + | |||
| + | To list IP addresses associated with devices, you can run ''ifconfig'', but that command will show only first IP address per device. However it will show //alias// device if you provided name (label) for it. The error proof method to list all IP addresses is: | ||
| + | ip addr | ||
| + | |||
| + | |||
| ==== IPv4 Routes ==== | ==== IPv4 Routes ==== | ||
| Line 372: | Line 448: | ||
| | ''metric'' | number | no | ''0'' | Specifies the //route metric// to use | | | ''metric'' | number | no | ''0'' | Specifies the //route metric// to use | | ||
| | ''mtu'' | number | no | //interface MTU// | Defines a specific MTU for this route | | | ''mtu'' | number | no | //interface MTU// | Defines a specific MTU for this route | | ||
| + | | ''table'' | routing table | no | //(none)// | Defines the table ID to use for the route. The ID can be either a numeric table index ranging from 0 to 65535 or a symbolic alias declared in /etc/iproute2/rt_tables. The special aliases local (255), main (254) and default (253) are recognized as well | | ||
| + | |||
| ==== IPv6 Routes ==== | ==== IPv6 Routes ==== | ||
| Line 395: | Line 473: | ||
| | ''metric'' | number | no | ''0'' | Specifies the //route metric// to use | | | ''metric'' | number | no | ''0'' | Specifies the //route metric// to use | | ||
| | ''mtu'' | number | no | //interface MTU// | Defines a specific MTU for this route | | | ''mtu'' | number | no | //interface MTU// | Defines a specific MTU for this route | | ||
| + | | ''table'' | routing table | no | //(none)// | Defines the table ID to use for the route. The ID can be either a numeric table index ranging from 0 to 65535 or a symbolic alias declared in /etc/iproute2/rt_tables. The special aliases local (255), main (254) and default (253) are recognized as well | | ||
| + | |||
| + | ==== IP rules ==== | ||
| + | |||
| + | Since OpenWrt Barrier Braker, netifd supports //IP rule// declarations which are required to implement policy routing. \\ | ||
| + | IPv4 rules can be defined by declaring one or more sections of type ''rule'', IPv6 rules are denoted by sections of type ''rule6''. Both types share the same set of defined options. | ||
| + | |||
| + | A simple IPv4 rule may look like: | ||
| + | |||
| + | <code>config rule | ||
| + | option mark '0xFF' | ||
| + | option in 'lan' | ||
| + | option dest '172.16.0.0/16' | ||
| + | option lookup '100'</code> | ||
| + | |||
| + | * ''0xFF'' is a [[http://www.tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.netfilter.html|fwmark]] to be matched | ||
| + | * ''lan'' is the incoming //logical interface name// | ||
| + | * ''172.16.0.0/16'' is the destination subnet to match | ||
| + | * ''100'' is the routing table ID to use for the matched traffic | ||
| + | |||
| + | Similary, an IPv6 rule looks like: | ||
| + | |||
| + | <code>config rule6 | ||
| + | option in 'vpn' | ||
| + | option dest 'fdca:1234::/64' | ||
| + | option action 'prohibit'</code> | ||
| + | |||
| + | * ''vpn'' is the incoming //logical interface name// | ||
| + | * ''fdca:1234::/64'' is the destination subnet to match | ||
| + | * ''prohibit'' is a routign action to take | ||
| + | |||
| + | The options below are defined for //IP rule// (''rule'' and ''rule6'') sections: | ||
| + | |||
| + | ^ Name ^ Type ^ Required ^ Default ^ Description ^ | ||
| + | | ''in'' | string | no | //(none)// | Specifies the incoming //logical interface name// | | ||
| + | | ''out'' | string | no | //(none)// | Specifies the outgoing //logical interface name// | | ||
| + | | ''src'' | ip subnet | no | //(none)// | Specifies the source subnet to match (CIDR notation) | | ||
| + | | ''dest'' | ip subnet | no | //(none)// | Specifies the destination subnet to match (CIDR notation) | | ||
| + | | ''tos'' | integer | no | //(none)// | Specifies the TOS value to match in IP headers | | ||
| + | | ''mark'' | mark/mask | no | //(none)// | Specifies the //fwmark// and optionally its mask to match, e.g. ''0xFF'' to match mark 255 or ''0x0/0x1'' to match any even mark value | | ||
| + | | ''invert'' | boolean | no | ''0'' | If set to ''1'', the meaning of the match options is inverted | | ||
| + | | ''priority'' | integer | no | //(incrementing)// | Controls the order of the IP rules, by default the priority is auto-assigned so that they are processed in the same order they're declared in the config file | | ||
| + | | ''lookup'' | routing table | at least one of | //(none)// | The rule target is a table lookup, the ID can be either a numeric table index ranging from ''0'' to ''65535'' or a symbolic alias declared in ''/etc/iproute2/rt_tables''. The special aliases ''local'' (''255''), ''main'' (''254'') and ''default'' (''253'') are recognized as well | | ||
| + | | ''goto'' | rule index | ::: | ::: | The rule target is a jump to another rule specified by its ''priority'' value | | ||
| + | | ''action'' | string | ::: | ::: | The rule target is one of the routing actions outlined in the table below | | ||
| + | |||
| + | === Routing Actions === | ||
| + | |||
| + | ^ Action ^ Description ^ | ||
| + | | ''prohibit'' | When reaching the rule, respond with //ICMP prohibited// messages and abort route lookup | | ||
| + | | ''unreachable'' | When reaching the rule, respond with //ICMP unreachable// messages and abort route lookup | | ||
| + | | ''blackhole'' | When reaching the rule, drop packet and abort route lookup | | ||
| + | | ''throw'' | Stop lookup in the current routing table even if a default route exists | | ||
| ===== Examples ===== | ===== Examples ===== | ||
| Line 466: | Line 597: | ||
| option 'output' 'ACCEPT' | option 'output' 'ACCEPT' | ||
| option 'masq' '1'</code> | option 'masq' '1'</code> | ||
| + | |||
| + | ==== PPPoA ADSL internet connection ==== | ||
| + | |||
| + | <code>config adsl-device 'adsl' | ||
| + | option fwannex 'a' | ||
| + | option annex 'a' | ||
| + | |||
| + | config interface 'wan' | ||
| + | option proto 'pppoa' | ||
| + | option username 'jbloggs@plusdsl.net' | ||
| + | option password 'XXXXXXXXX' | ||
| + | option vpi '0' | ||
| + | option vci '38' | ||
| + | option encaps 'vc'</code> | ||
| + | |||
| ==== Static IPv6-in-IPv4 tunnel ==== | ==== Static IPv6-in-IPv4 tunnel ==== | ||
| Line 477: | Line 623: | ||
| option 'ip6addr' '2001:0DB8:1f0a:1359::2/64'</code> | option 'ip6addr' '2001:0DB8:1f0a:1359::2/64'</code> | ||
| - | :!: You should also add an address from your routed IPv6 network to the "lan" interface. | + | :!: You should also add an address from your routed IPv6 network to the "lan" interface. |
| :!: To apply IPv6 firewall rules to the tunnel interface, add it to the "wan" zone in ''/etc/config/firewall'': | :!: To apply IPv6 firewall rules to the tunnel interface, add it to the "wan" zone in ''/etc/config/firewall'': | ||
| Line 493: | Line 639: | ||
| otherwise [[doc/uci/firewall#forwardings|unidirectional forwarding rules]] will not work. | otherwise [[doc/uci/firewall#forwardings|unidirectional forwarding rules]] will not work. | ||
| + | :!: Don't forget to set up [[doc:uci:firewall#forwarding.ipv6.tunnel.traffic|forwarding rules]] between the LAN and the tunnel if you want to route IPv6 traffic between them. | ||
| === Setup behind one-to-one NAT === | === Setup behind one-to-one NAT === | ||
| If [[http://checkip.dyndns.org/|your public IP]], e.g. ''178.24.115.19'', is not matching the IP address on your WAN interface, your ISP is probably using [[http://shorewall.net/NAT.htm#One-to-one|one-to-one NAT]] (aka [[http://en.wikipedia.org/wiki/Network_address_translation#Methods_of_Port_translation|full-cone NAT]]) and you won't be able to establish static [[doc:uci:network#static.ipv6-in-ipv4.tunnel|IPv6-in-IPv4 tunnel]]. IP address of your WAN interface can be obtained with the following command: | If [[http://checkip.dyndns.org/|your public IP]], e.g. ''178.24.115.19'', is not matching the IP address on your WAN interface, your ISP is probably using [[http://shorewall.net/NAT.htm#One-to-one|one-to-one NAT]] (aka [[http://en.wikipedia.org/wiki/Network_address_translation#Methods_of_Port_translation|full-cone NAT]]) and you won't be able to establish static [[doc:uci:network#static.ipv6-in-ipv4.tunnel|IPv6-in-IPv4 tunnel]]. IP address of your WAN interface can be obtained with the following command: | ||
| - | <code>uci -P/var/state get network.wan.ipaddr</code> | + | * Backfire <code>uci -P/var/state get network.wan.ipaddr</code> |
| + | * Trunk/Attitude Adjustment <code>. /lib/functions/network.sh; network_get_ipaddr ip wan; echo $ip</code> | ||
| If this is your case you should fill the WAN IP address into ''ipaddr'' option instead of your actual public IP that might have been provided to [[http://he.net/|Hurricane Electric]] during tunnel creation.((You should always use your public IP while creating Hurricane Electric tunnel, so don't change it just because you are behind one-to-one NAT.)) Or you may completely omit the [[doc:uci:network#protocol.6in4.ipv6-in-ipv4.tunnel|optional]] ''ipaddr'' option and let auto configuration to handle the correct IP. (FIXME Auto configuration is vague. Is ''uci'' handling this case?) That would be preferred solution if your WAN IP is dynamic (i.e. obtained via DHCP) or you are not sure. Example of ''/etc/config/network'' entry: | If this is your case you should fill the WAN IP address into ''ipaddr'' option instead of your actual public IP that might have been provided to [[http://he.net/|Hurricane Electric]] during tunnel creation.((You should always use your public IP while creating Hurricane Electric tunnel, so don't change it just because you are behind one-to-one NAT.)) Or you may completely omit the [[doc:uci:network#protocol.6in4.ipv6-in-ipv4.tunnel|optional]] ''ipaddr'' option and let auto configuration to handle the correct IP. (FIXME Auto configuration is vague. Is ''uci'' handling this case?) That would be preferred solution if your WAN IP is dynamic (i.e. obtained via DHCP) or you are not sure. Example of ''/etc/config/network'' entry: | ||
| Line 590: | Line 738: | ||
| In order to derive a Linux interface name like ''eth1'' from a logical network name like ''wan'' for use in scripts or tools like ''ifconfig'' and ''route'' the ''uci'' utility can be used as illustrated in the example below which opens port 22 on the interface. | In order to derive a Linux interface name like ''eth1'' from a logical network name like ''wan'' for use in scripts or tools like ''ifconfig'' and ''route'' the ''uci'' utility can be used as illustrated in the example below which opens port 22 on the interface. | ||
| - | <code>WANIF=$(uci -P/var/state get network.wan.ifname) | + | <code bash> |
| - | iptables -I INPUT -i $WANIF -p tcp --dport 22 -j ACCEPT</code> | + | WANIF=$(uci -P/var/state get network.wan.ifname) |
| + | iptables -I INPUT -i $WANIF -p tcp --dport 22 -j ACCEPT | ||
| + | </code> | ||
| + | |||
| + | The uci state vars are deprecated and not used anymore for network related information [[https://forum.openwrt.org/viewtopic.php?pid=203787#p203787|Quoting jow in the forum]].\\ | ||
| + | Use /lib/functions/network.sh: | ||
| + | |||
| + | <code bash> | ||
| + | source /lib/functions/network.sh | ||
| + | |||
| + | if network_get_ipaddr addr "wan"; then | ||
| + | echo "IP is $addr" | ||
| + | fi | ||
| + | </code> | ||
doc/uci/network.1342815281.txt.bz2 · Last modified: 2012/07/20 22:14 by 70d7a4f46
This text is licensed under a Creative Commons Attribution-ShareAlike 3.0 Unported License.
