Differences

This shows you the differences between two versions of the page.

--- systemrescue_as_a_router [2026/06/20 16:38] – created steve
+++ systemrescue_as_a_router [2026/06/23 17:28] (current) – steve
@@ Line 1: / Line 1: @@
 ==== System Rescue as a router ====
-Use curl to get this script to a freshly booted machine running SystemRescue [[https://www.system-rescue.org/]] and use it as an emergency backup router.
+Use curl to get this script to a freshly booted machine running SystemRescue [[https://www.system-rescue.org/]] and use it as an emergency backup router. This was set up in a VM and tested with SystemRescue 12.03.
+^^%%curl -sL "https://wiki.cyli.org/doku.php?do=export_code&id=systemrescue_as_a_router&codeblock=0" | bash%%^^
 <code bash srr.sh>
-## 1. Clean Dnsmasq Configuration
+#!/usr/bin/env bash
-#     Replace the contents of your /etc/dnsmasq.conf file with the following
+# This sets up pretty much any hardware with two interfaces as an
-#     directives. It is restricted to bind and listen only on your internal
+# emergency router. If it reboots, everything needs to be reloaded.
-#     interface:
+# If this is booted from Ventoy, add this script in a 3rd partition.
-mv /etc/dnsmasq.conf /etc/dnsmasq.orig
+# The variables below are the only things that should need changing;
-export enX1=enX1   # Internal Interface
-export enX0=enX0   # External Interface
+export ExtIF="enX0"             # External Interface, connected to Internet
+export IntIF="enX1"             # Internal Interface, connected to PCs
+export Sub="192.168.11"         # Subnet number
+export CIDR="/24"               # Subnet mask
+export  IntIP="${Sub}.1"        # Internal interface address
+export IntNet="${Sub}.0${CIDR}"	# Internal Network
+export IntLow="${Sub}.50"       # Low IP lease
+export  IntHi="${Sub}.199"      # High IP lease
+export Dur="1h"                 # Lease duration
+export DNS1="8.8.8.8"           # First DNS server
+export DNS2="1.1.1.1"           # Second DNS server
+export Dom="cyli.org"           # Our domain
+#    Replace the contents of your /etc/dnsmasq.conf file with the following
+mv /etc/dnsmasq.conf /etc/dnsmasq.orig
 cat << EndOfFile > /etc/dnsmasq.conf
 # --- NETWORK INTERFACE ---
 # Bind only to the internal interface for security
-interface=${enX1}
+interface=${IntIF}
 bind-interfaces
@@ Line 21: / Line 37: @@
 domain-needed
 bogus-priv
-domain=local.lan
+domain=${Dom}
 expand-hosts
 # --- UPSTREAM DNS FORWARDERS ---
-server=1.1.1.1
+server=${DNS1}
-server=8.8.8.8
+server=${DNS2}
 # --- DHCP SETTINGS ---
-# Lease range tailored to your 192.168.31.0/24 subnet
+# Lease range for ${IntNet}
-dhcp-range=192.168.31.50,192.168.31.250,12h
+dhcp-range=${IntLow},${IntHi},${Dur}
-# Explicitly pass this server's internal IP as the gateway
+# Explicitly pass this VMs internal IP as the gateway
-dhcp-option=option:router,192.168.31.1
+dhcp-option=option:router,${IntIP}
-# Announce this server as the authoritative DHCP source
+# Announce this VM as the authoritative DHCP source
 dhcp-authoritative
 EndOfFile
-## 2. Network Interface Alignment
+#    Before starting the services, ensure your internal interface (${IntIF})
-## Before starting the services, ensure your internal interface (${enX1})
+#    is configured and up
-ip addr add 192.168.31.1/24 dev ${enX1}
+ip addr add ${IntIP}${CIDR} dev ${IntIF}
-ip link set ${enX1} up
+ip link set ${IntIF} up
-## 3. Bash Script to Flush Rules, Enable Routing, and NAT
+#    Run this to completely wipe the firewall, enable system-level
-#     Run this script to completely wipe the firewall, enable system-level
+#    packet forwarding, and route internal client traffic out to the
-#     packet forwarding, and route internal client traffic out to the
+#    internet through ${ExtIF}.
-#     internet through ${enX0}.
+#      Enable IPv4 packet forwarding in the Linux kernel
-#     1. Enable IPv4 packet forwarding in the Linux kernel
 sysctl -w net.ipv4.ip_forward=1
 echo "net.ipv4.ip_forward=1" | tee -a /etc/sysctl.conf
-#     2. Set default policies to ACCEPT everything temporarily
+#      Set default policies to ACCEPT everything temporarily
 iptables -P INPUT ACCEPT
 iptables -P FORWARD ACCEPT
 iptables -P OUTPUT ACCEPT
-#     3. Flush all rules from all tables (Filter, NAT, Mangle)
+#      Flush all rules from all tables (Filter, NAT, Mangle)
 iptables -F
 iptables -t nat -F
 iptables -t mangle -F
-#     4. Delete all custom user-defined chains
+#      Delete all custom user-defined chains
 iptables -X
 iptables -t nat -X
 iptables -t mangle -X
-#     5. Reset all packet and byte counters back to zero
+#      Reset all packet and byte counters back to zero
 iptables -Z
-#     6. Configure NAT / Masquerade out of the external interface
+#      Configure NAT / Masquerade out of the external interface
-iptables -t nat -A POSTROUTING -o ${enX0} -j MASQUERADE
+iptables -t nat -A POSTROUTING -o ${ExtIF} -j MASQUERADE
-#     7. Forward traffic from internal network out to the internet
+#      Forward traffic from internal network out to the internet
-iptables -A FORWARD -i ${enX1} -o ${enX0} -j ACCEPT
+iptables -A FORWARD -i ${IntIF} -o ${ExtIF} -j ACCEPT
-iptables -A FORWARD -i ${enX0} -o ${enX1} -m state --state RELATED,ESTABLISHED -j ACCEPT
+iptables -A FORWARD -i ${ExtIF} -o ${IntIF} -m state --state RELATED,ESTABLISHED -j ACCEPT
-## Restarting the Clean Infrastructure
 #  Wipe out any runtime artifacts from old setups and fire up the new router configuration
 #  Clear any stuck active leases
@@ Line 89: / Line 103: @@
 systemctl restart dnsmasq
 </code>
+{{ :scripts:routertestcommand_prompt.png?nolink |}}