Diese Seite (Version-31) wurde zuletzt am 30-Juni-2025 18:51 von Administrator geändert.

Diese Seite wurde am 28-Dez.-2024 17:15 von Administrator erstellt.

Du bist nicht autorisiert, diese Seite umzubenennen.

Du bist nicht autorisiert, diese Seite zu löschen.

Versionsgeschichte der Seite

Version Zuletzt geändert Größe Autor Änderungen Kommentar
31 30-Juni-2025 18:51 6 KB Administrator zur vorherigen
30 29-Dez.-2024 12:43 6 KB Administrator zur vorherigen | zur neuesten
29 29-Dez.-2024 12:40 5 KB Administrator zur vorherigen | zur neuesten
28 29-Dez.-2024 12:39 5 KB Administrator zur vorherigen | zur neuesten
27 29-Dez.-2024 12:39 5 KB Administrator zur vorherigen | zur neuesten
26 29-Dez.-2024 12:36 3 KB Administrator zur vorherigen | zur neuesten
25 29-Dez.-2024 12:35 3 KB Administrator zur vorherigen | zur neuesten
24 29-Dez.-2024 12:34 3 KB Administrator zur vorherigen | zur neuesten
23 29-Dez.-2024 12:29 4 KB Administrator zur vorherigen | zur neuesten
22 29-Dez.-2024 12:28 5 KB Administrator zur vorherigen | zur neuesten
21 29-Dez.-2024 12:27 4 KB Administrator zur vorherigen | zur neuesten

Links

Eingehende Links Ausgehende Links
Exposing Raspberry to Internet
Exposing Raspberry to Internet

Versionsunterschiede

Unterschiede zwischen Version und .

Zeile 8: 11 Zeilen geändert.
!! Scope
Raspberry is exposed to the internet for my backup solution. I want to enable ipv6 access only and enable access only from my home computer. \\
Steps:
# register your home computer (Windows) at a dyndns service to provide the current ipv6, see [dynv6.com|https://dynv6.com]
# Windows: create windows batch script to update dynv6
# Windows schedule script to run each time the PC is booted, see "Aufgabenplanung" (task scheduler)
# Raspberry: create and set iptables ruleset
# Raspberry: use python script to query the current ipv6 from dynv6 (Windows) and replace in iptables ruleset
# Raspberry: schedule the ipv6 update in firewall (ip6tables)
!2. Windows batch script to update dynv6 service
! SSH
Change SSH Port
Zeile 20: Eine Zeile geändert.
REM update_dynv6.bat
> sudo vi /etc/ssh/sshd_config # here is the port
Port xxx # set port here
ListenAddress :: # enable all ipv6
ListenAddress 0.0.0.0 # enable all ipv4
LogLevel DEBUG # change log level like INFO, DEBUG3
AllowUsers <user> # allow only this user
PermitRootLogin prohibit-password # activate to disable root
> sudo vi /etc/ssh/ssh_config # this is general
> cd /etc/ssh/sshd_config.d # check also sub configurations
Zeile 22: 31 Zeilen geändert.
REM set utf-8
chcp 65001
echo off
set domain=<your.domain.here>
set token=<youtTokenHere>
echo ---- check and update local ipv6 address at dynv6.com for %domain% ----
rem ping -n 1 -6 %domain%
for /F "tokens=3" %%i in ('"ping -n 1 -6 %domain% | findstr Antwort"') do set dynv6_ipv6=%%i
rem cut last colon, example 2a02:5a0:4110:f590:29f6:40ba:51b4:b4da:
set dynv6_ipv6=%dynv6_ipv6:~0,-1%
echo dynv6 ipv6= %dynv6_ipv6%
rem ipconfig
rem echo ---------- extracting Temporäre IPv6-Adresse ----------
for /F "tokens=9" %%i in ('"ipconfig | findstr Temp | findstr 2a02"') do set local_ipv6=%%i
echo local ipv6= %local_ipv6%
if %local_ipv6% == %dynv6_ipv6% (
echo ipv6 at dynv6 is up to date, update skipped
) else (
set url="https://dynv6.com/api/update?hostname=%domain%^&token=%token%&ipv6=%ipv6%"
ECHO updating IPv6
curl "%url%"
)
echo:
echo done
pause
> sudo systemctl status ssh # check status
> sudo service ssh restart # reload / restart
> sudo /etc/init.d/ssh restart # reload / restart alternative
> sudo netstat -pantWul # check connections
Zeile 26: 5 Zeilen hinzugefügt.
Check [port ranges|https://datatracker.ietf.org/doc/html/rfc6335#section-6], [Common Ports|https://de.wikipedia.org/wiki/Liste_der_Portnummern]
# System/well known ports: 0-1023
# User or registered ports: 1024-49151 <== use port from here
# Dynamic/private ports: 49152-65535
[Dynamic Dns and Remote ssh and VNC|https://chrisjrob.com/2011/04/05/dynamic-dns-and-remote-ssh-and-vnc/]
Zeile 55: 2 Zeilen geändert.
!! iptables
!Commands
Windows
Zeile 58: 5 Zeilen geändert.
> ls -la /usr/sbin/ip* # list all commands, there are many
> iptables* # for ipv4 (in debian busters = nft)
> ip6tables* # for ipv6 (in debian busters = nft)
> iptables-legacy # former ones, not nft
> iptables-nft # directly use nft
> ssh 2a02:5a0:4110:f590:4670:d3e6:1234:6547 -p 123 # with custom port
> ssh markus@192.168.188.76 # with username
> ssh pi5backup.v6.rocks -p 31415 ipv6 fe80::7ea5:7cb2:6563:1518 # with source ipv6
Zeile 64: 3 Zeilen geändert.
Notes:
* all iptables commands (for ipv4) have an ip__6__tabbles* equivalent (for ipv6)
* see [info|https://developers.redhat.com/blog/2020/08/18/iptables-the-two-variants-and-their-relationship-with-nftables#using_iptables_nft] on nft
!Automatic updates
Zeile 68: 5 Zeilen geändert.
> who -u # get all sessions with ip and pid
> sudo netstat -pantW # list network connections, p=programs,a=all,n=IPs,t=tcp,W=wide(not truncate IP address)
> ip a # list all ips
> sudo ip6tables -L -v # list all ipv6 rules
> sudo ip6tables -n -v --line-numbers -L # list all ipv6 rules with numeric IPs and rule number
> sudo apt install unattended-upgrades
> sudo dpkg-reconfigure --priority=low unattended-upgrades
Zeile 75: 2 Zeilen geändert.
! Syntax
see [docu|https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s1-iptables-options#s2-iptables-options-structure]
!Brute Force Attacks
Disable IPs on multiple failed 6 logins for 10 minutes
Zeile 78: 6 Zeilen geändert.
> sudo iptables -L -v
> sudo iptables -n -v --line-numbers -L
> sudo service iptables start # activate firewalling
> sudo service ip6tables start
> sudo chkconfig iptables on # enable after reboot
> sudo chkconfig ip6tables on
> sudo apt-get install fail2ban
> sudo vi /etc/fail2ban/jail.conf
Zeile 52: Eine Zeile hinzugefügt.
!Logging
Zeile 87: Eine Zeile geändert.
iptables [-t <table-name>] <command> <chain-name> <parameter-1> <option-1> <parameter-n> <option-n>
> sudo journalctl -b # since last boot
> sudo journalctl -k | grep netfilter
> sudo journalctl _COMM=sshd
> sudo journalctl --vacuum-time=1d # purge, keep last day
> sudo journalctl --vacuum-size=500M # purge, keep last 500MB
> sudo rm -r /var/log/journal/* # if purging does not help you can erase the whole file and restart
> systemctl restart systemd-journald
Zeile 89: 32 Zeilen gelöscht.
* table-name
** like ~[filter, nat, mangle, raw, security~], if omitted we use "filter"
* command
** -F : flush current chain or all if omitted
** -X : deletes a user-specified chain or all if omitted
** -Z : zeros the byte and packet counters in all chains
** -A : apppend a rule at the end
** -I : inserts at a specified position (similar to replace -R), wihtout position at the top
** -P : a policy is a fall back and is used after all rules have passede** you can enable certain special addresses earlier
** -L : list all rules
* chain-name
** INPUT, FORWARD, OUTPUT (as listed with > iptables -L)
** you may invent new chain names, but this seems not to be common (command -N)
* parameter-1 (filter)
** -s : source filter (address~[/mask~]~[...~])
** -d : destination filter
** -p : protocoll filter like ~[icmp, tcp, udp, all~] or those in /etc/protocols, if omitted ALL protocols are considered
*** with -p tcp you can use --dport for destination port filter, any number
*** with -p udp you can use --dport for destination port and --sport as source port filter
*** ports can be also a range like 3000:3200 (all from 3000 to 3200)
*** with -p icmp you can use --icmp-type
** -i : interface like ~[eth0, lo, ppp0~], without name ALL interfaces are used
** -j : jump to ~[ACCEPT, DROP, QUEUE, RETURN~] (or others added with modules)
** -m : adds a comment when listing the rules, syntax >-m comment --comment "My comments here"<
* option-1 (target)
** ~[ACCEPT, DROP, QUEUE, RETURN~] (or others added with modules)
* option-n (listing options)
** -v : verbose output
** -n : displays IP addresses and port numbers in numeric format instead of hostname/network service
* notes
** the first three commands are usually used to create a fresh ruleset in a script
** in the chain list and then drop all other later
Zeile 122: Eine Zeile gelöscht.
! 4. my general ruleset
Zeile 124: 5 Zeilen gelöscht.
We also need to enable the local interface and the DNS nameservers.\\
I use a custom DNS server setting, because the fritzbox does not resolve my dynv6 domains (?).
{{{
> sudo nmcli -o device show # show interfaces settings
> sudo nmcli -p connection show # show interface status
Zeile 130: 7 Zeilen gelöscht.
#THIS IS NECESSARY
> sudo nmcli con mod "Wired connection 1" ipv4.dns "1.1.1.1,8.8.8.8" # add cloudflare and google dns
> sudo nmcli con mod "Wired connection 1" ipv4.ignore-auto-dns no # this adds "search fritz.box" to get ips at all from frit.box
> sudo nmcli con mod "Wired connection 1" ipv6.ignore-auto-dns yes # we skip ipv6 dns
> sudo nmcli c down "Wired connection 1" && sudo nmcli c up "Wired connection 1" # restart
> sudo vi /etc/resolv.conf # validate settings
}}}
Zeile 66: 5 Zeilen hinzugefügt.
!! Restricting Access from three devices
! 1. Register your home computer (Windows) at a dyndns service to provide the current ipv6, see [dynv6.com|https://dynv6.com]
! 2. Windows: create script (I use python) to set local IP at dynv6
Zeile 139: 3 Zeilen geändert.
#!/bin/bash
# MARKUS
SOURCE=::
import socket # determine ipv6
import re # regular expression
import urllib.request # http
Zeile 143: 5 Zeilen geändert.
# ipv4 ------------------------------------
# Flush all rules and delete all chains for a clean startup
iptables -F
iptables -X
iptables -Z # Zero out all counters
dynv6_domain = "your.dynv6.domain"
dynv6_token="your.token"
local_domain = socket.gethostname()
Zeile 149: 5 Zeilen geändert.
# drop all ipv4 traffic, we want to use ipv6 only
iptables -A INPUT -s 1.1.1.1 -j ACCEPT
iptables -A OUTPUT -d 1.1.1.1 -j ACCEPT
iptables -A INPUT -s 8.8.8.8 -j ACCEPT
iptables -A OUTPUT -d 8.8.8.8 -j ACCEPT
print('Checking DynV6', dynv6_domain, 'against', local_domain)
Zeile 155: 5 Zeilen geändert.
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -j DROP
iptables -A FORWARD -j DROP
iptables -A OUTPUT -j DROP
#ipv6_regex = "^([0-9a-fA-F]{1,4}:){7,7}[0-9a-fA-F]{1,4}$"
ipv6_regex = "^([0-9a-fA-F]{1,4}:).*$"
Zeile 161: 5 Zeilen geändert.
# ipv6 ------------------------------------
# Flush all rules and delete all chains for a clean startup
ip6tables -F
ip6tables -X
ip6tables -Z
##--- get LOCAL address ---
Zeile 167: 5 Zeilen geändert.
# drop all ipv6 traffic, except EbelStube
# do not limit to --dport 22, because the source has random ports (?)
# add first to enabel replacing 1. rule later
ip6tables -A INPUT -s $SOURCE -j ACCEPT
ip6tables -A OUTPUT -d $SOURCE -j ACCEPT
tupel = socket.getaddrinfo(local_domain, None, socket.AF_INET6, flags=socket.AI_CANONNAME)
local_ipv6 = ''
for item in tupel:
if(item[4][0].startswith('2a02')):
#print("item=", item)
local_ipv6 = item[4][0]
break
Zeile 173: 3 Zeilen geändert.
# allow ipv6 local loopback
ip6tables -A INPUT -i lo -j ACCEPT
ip6tables -A OUTPUT -o lo -j ACCEPT
local_ipv6_valid = False
if re.search(ipv6_regex, local_ipv6):
local_ipv6_valid = True
if(local_ipv6_valid == False):
print("local_ipv6=", local_ipv6, " NOT VALID")
else:
print("local_ipv6=", local_ipv6, " IS VALID")
Zeile 177: 4 Zeilen geändert.
# drop everthing else
ip6tables -P FORWARD DROP # as policy generally
ip6tables -A INPUT -j DROP
ip6tables -A OUTPUT -j DROP
#--- get dynV6 address ---
tupel = socket.getaddrinfo(dynv6_domain, None, socket.AF_INET6)
dynv6_ipv6 = tupel[0][4][0]
Zeile 182: 2 Zeilen geändert.
# update first ip6tables rules and enable my computer
/home/markus/update_ip6tables.py
dynv6_ipv6_valid = False
if re.search(ipv6_regex, dynv6_ipv6):
dynv6_ipv6_valid = True
if(dynv6_ipv6_valid == False):
print("dynv6_ipv6=", dynv6_ipv6, " NOT VALID")
else:
print("dynv6_ipv6=", dynv6_ipv6, " IS VALID")
if(not local_ipv6_valid or not dynv6_ipv6_valid):
print("one ipv6 is invalid, skipping update")
else:
if(local_ipv6 == dynv6_ipv6):
print("dynv6 ipv6 is up to date, skipping update")
else:
print("dynv6 differs from local ipv6 => UPDATING...")
url = "https://dynv6.com/api/update?hostname=" + dynv6_domain + "&token=" + dynv6_token + "&ipv6=" + local_ipv6
response = urllib.request.urlopen(url).read()
print(response)
Zeile 186: Eine Zeile geändert.
!! Python
! 3. Windows: schedule script to run each time the PC is booted, see "Aufgabenplanung" (task scheduler)
I scheduled this batch
{{{
echo off
REM set utf-8
chcp 65001
python "G:\Raspberry PI5 8GB\DynDNS\update_computer.py"
echo:
echo done
pause
}}}
! 4. Raspberry: create and set iptables ruleset, see [Firewall with iptables]
! 5. Raspberry: use python script to query the current ipv6 from dynv6 (Windows) and replace in iptables ruleset
Notes:
Zeile 189: 3 Zeilen geändert.
* alternatively you can use subprocess.run to call the original system commands
! 5. subprocess
* alternatively you can use subprocess.run to call the original system commands (easiest)
Zeile 197: 3 Zeilen geändert.
tupel = socket.getaddrinfo('your.pc.com', None, socket.AF_INET6)
# tupel like [(<AddressFamily.AF_INET6: 23>, 0, 0, '', ('2a02:5a0:4110:f590:4670:d3e6:f2bc:ee', 8384, 0, 0))]
print("tupel=", tupel)
def set_dynv6_domain_into_ipv6tables(dynv6_domain, rulenum):
try:
print('------------------------------------------------------------')
print('set dynv6 domain', dynv6_domain, 'into ip6tables at position', rulenum)
tupel = socket.getaddrinfo(dynv6_domain, None, socket.AF_INET6)
# tupel like [(<AddressFamily.AF_INET6: 23>, 0, 0, '', ('2a02:5a0:4110:f590:4670:9876:1345:ee', 8384, 0, 0))]
print("tupel=", tupel)
Zeile 201: 2 Zeilen geändert.
ipv6=tupel[0][4][0]
print("ipv6=", ipv6)
ipv6=tupel[0][4][0]
print(dynv6_domain + " ipv6=", ipv6)
Zeile 204: 3 Zeilen geändert.
subprocess.run(["/usr/sbin/ip6tables", "-R", "INPUT", "1", "-s", ipv6, "-j", "ACCEPT"])
subprocess.run(["/usr/sbin/ip6tables", "-R", "OUTPUT", "1", "-d", ipv6, "-j", "ACCEPT"])
}}}
subprocess.run(["/usr/sbin/ip6tables", "-R", "INPUT", rulenum, "-s", ipv6, "-j", "ACCEPT"])
subprocess.run(["/usr/sbin/ip6tables", "-R", "OUTPUT", rulenum, "-d", ipv6, "-j", "ACCEPT"])
except BaseException:
print('FAILED TO GET', dynv6_domain)
Zeile 208: Eine Zeile gelöscht.
! 6. Schedule script with crontab
Zeile 210: Eine Zeile geändert.
Run every 15 minutes
set_dynv6_domain_into_ipv6tables('your.dynv6.domain.no1', '1')
set_dynv6_domain_into_ipv6tables('your.dynv6.domain.no2', '2')
set_dynv6_domain_into_ipv6tables('your.dynv6.domain.no3', '3')
}}}
! 6. Raspberry: schedule the ipv6 update in firewall (ip6tables) via crontab
Run every 5 minutes
Zeile 212: Eine Zeile geändert.
> sudo crontab -u root -e
> sudo crontab -u root -e # anything is activated on save automatically
Zeile 214: 2 Zeilen geändert.
*/15 * * * * /home/markus/update_ip6tables.py
}}}
# m h dom mon dow command
*/5 * * * * /home/markus/update_ip6tables.py > /var/log/con.log
Zeile 186: 3 Zeilen hinzugefügt.
#check with
> journalctl -b
}}}
Diese Seite (Version-31) wurde zuletzt am 30-Juni-2025 18:51 von Administrator geändert.Top