setup wizard: fix routing, DHCP, WiFi AP, firewall, and deploy task

Setup script fixes:
- _cidr_to_mask: pad to 4 octets (/24 -> 255.255.255.0)
- UCI quoting: remove embedded shell quotes from uci set calls
- Bridge ports: auto-detect zt* interface instead of hardcoding ztabc0
- Bridge netmask: default to /23 (255.255.254.0) for ZT+WIBLAN
- DHCP/WiFi AP: reference interface name (zt_wiblan) not device name (br_zt)
- Firewall zone: add zt_wiblan to LAN zone for nftables fw4
- ZT IP persistence: ensure ZT-assigned IP stays on interface for ARP
- Exit gateway routing: table 100/101 route via exit gateway, not self
- New setup-wifi-ap subcommand for WIBLAN WiFi AP

UBUS handler:
- Add setup-wifi-ap to validation regex and error message

Deploy task:
- Auto-discover files from root/ and htdocs/ instead of hardcoded list
- Clear LuCI cache before restarting services

Documentation:
- New docs/SETUP-GATEWAY.md with architecture, config, pitfalls, checklist
- Updated docs/INSTALL.md with deploy task and setup wizard sections
- Updated docs/PROGRESS.md with session log and learnings
This commit is contained in:
2026-07-13 11:10:57 +05:30
parent cd429291ef
commit 1e4a46c4bf
11 changed files with 1045 additions and 81 deletions

View File

@@ -21,9 +21,10 @@
#
# Environment overrides (for testing and non-default configs):
# ZTG_BRIDGE bridge device (default: br-zt)
# ZTG_BRIDGE_PORTS space-separated ports (default: ztabc0)
# ZTG_BRIDGE_PORTS space-separated ports (default: auto-detect zt* interface)
# ZTG_WIBLAN_CIDR WIBLAN subnet (default: 10.11.13.0/24)
# ZTG_WIBLAN_GW WIBLAN gateway IP (default: 10.11.13.1)
# ZTG_BRIDGE_NETMASK bridge subnet mask (default: 255.255.254.0 /23)
# ZTG_WIBLAN_LEASE_FIRST first DHCP IP (default: 10.11.13.100)
# ZTG_WIBLAN_LEASE_LAST last DHCP IP (default: 10.11.13.200)
# ZTG_TABLE_MAIN main policy table (default: 100)
@@ -35,6 +36,10 @@
# ZTG_RCLOCAL rc.local path
# ZTG_DHCPCONF DHCP UCI config file (default: /etc/config/dhcp)
# ZTG_NETWORKCONF network UCI config file (default: /etc/config/network)
# ZTG_WIFI_SSID WiFi AP SSID (default: WIBLAN)
# ZTG_WIFI_KEY WiFi AP WPA2 key (default: zt-r0ute-2026)
# ZTG_WIFI_RADIO WiFi radio device (default: auto-detect first radio)
# ZTG_WIFI_ENCRYPTION WiFi encryption (default: psk2)
# ZTG_SKIP_PERSIST skip UCI persistence (testing)
set -eu
@@ -43,9 +48,20 @@ set -eu
# Config
# ----------------------------------------------------------------------------
BRIDGE="${ZTG_BRIDGE:-br-zt}"
BRIDGE_PORTS="${ZTG_BRIDGE_PORTS:-ztabc0}"
# Auto-detect ZeroTier interface if not specified (zt + random suffix, not br-zt)
if [ -n "${ZTG_BRIDGE_PORTS:-}" ]; then
BRIDGE_PORTS="$ZTG_BRIDGE_PORTS"
else
BRIDGE_PORTS=$(ip -o link show 2>/dev/null \
| awk -F': ' '/^[0-9]+:/{gsub(/@.*/, "", $2); if ($2 ~ /^zt/ && $2 != "br-zt") print $2; exit}')
if [ -z "$BRIDGE_PORTS" ]; then
BRIDGE_PORTS="ztabc0"
fi
fi
WIBLAN_CIDR="${ZTG_WIBLAN_CIDR:-10.11.13.0/24}"
WIBLAN_GW="${ZTG_WIBLAN_GW:-10.11.13.1}"
# Bridge netmask must be /23 to cover both ZeroTier (10.11.12.x) and WIBLAN (10.11.13.x)
BRIDGE_NETMASK="${ZTG_BRIDGE_NETMASK:-255.255.254.0}"
WIBLAN_LEASE_FIRST="${ZTG_WIBLAN_LEASE_FIRST:-10.11.13.100}"
WIBLAN_LEASE_LAST="${ZTG_WIBLAN_LEASE_LAST:-10.11.13.200}"
TABLE_MAIN="${ZTG_TABLE_MAIN:-100}"
@@ -57,11 +73,21 @@ HOTPLUG="${ZTG_HOTPLUG:-/etc/hotplug.d/net/99-zerotier-bridge}"
RCLOCAL="${ZTG_RCLOCAL:-/etc/rc.local}"
DHCPCONF="${ZTG_DHCPCONF:-/etc/config/dhcp}"
SKIP_PERSIST="${ZTG_SKIP_PERSIST:-0}"
WiFi_SSID="${ZTG_WIFI_SSID:-WIBLAN}"
WiFi_KEY="${ZTG_WIFI_KEY:-zt-r0ute-2026}"
WiFi_ENCRYPTION="${ZTG_WIFI_ENCRYPTION:-psk2}"
# Auto-detect first WiFi radio if not specified
WiFi_RADIO="${ZTG_WIFI_RADIO:-}"
if [ -z "$WiFi_RADIO" ]; then
WiFi_RADIO=$(uci -q get wireless.@wifi-device[0].name 2>/dev/null || echo "radio0")
fi
# Derived: extract prefix bits from CIDR
WIBLAN_BITS="${WIBLAN_CIDR##*/}"
# UCI-safe section name (replace hyphens with underscores)
BRIDGE_UCI=$(printf '%s' "$BRIDGE" | tr '-' '_')
# Interface name (used by DHCP and WiFi AP, must reference interface not device)
WIBLAN_IFACE="zt_wiblan"
# ----------------------------------------------------------------------------
# Logging
@@ -78,16 +104,17 @@ ensure_uci_config() {
}
# CIDR to dotted mask (e.g. 24 -> 255.255.255.0)
# CIDR to dotted mask (e.g. 24 -> 255.255.255.0)
_cidr_to_mask() {
bits=$1
mask=""
# Build octets from the CIDR prefix
octets=""
while [ "$bits" -gt 0 ]; do
if [ "$bits" -ge 8 ]; then
oct=255
bits=$((bits - 8))
else
# Build partial octet: bits leading 1s in MSB position
oct=0
j=0
while [ $j -lt "$bits" ]; do
@@ -96,13 +123,17 @@ _cidr_to_mask() {
done
bits=0
fi
if [ -n "$mask" ]; then
mask="${mask}.${oct}"
if [ -n "$octets" ]; then
octets="${octets}.${oct}"
else
mask="${oct}"
octets="${oct}"
fi
done
printf '%s' "$mask"
# Pad remaining octets with 0
while [ "$(printf '%s' "$octets" | tr -cd '.' | wc -c)" -lt 3 ]; do
octets="${octets}.0"
done
printf '%s' "$octets"
}
# ----------------------------------------------------------------------------
@@ -211,10 +242,10 @@ cmd_setup_bridge() {
# Create interface section bridging to br-zt for WIBLAN
if ! uci -q get "network.zt_wiblan" >/dev/null 2>&1; then
uci -q set "network.zt_wiblan=interface"
uci -q set "network.zt_wiblan.proto='static'"
uci -q set "network.zt_wiblan.device='${BRIDGE}'"
uci -q set "network.zt_wiblan.ipaddr='${WIBLAN_GW}'"
uci -q set "network.zt_wiblan.netmask='$(_cidr_to_mask "$WIBLAN_BITS")'"
uci -q set "network.zt_wiblan.proto=static"
uci -q set "network.zt_wiblan.device=${BRIDGE}"
uci -q set "network.zt_wiblan.ipaddr=${WIBLAN_GW}"
uci -q set "network.zt_wiblan.netmask=${BRIDGE_NETMASK}"
fi
if [ "$SKIP_PERSIST" != "1" ]; then
@@ -228,6 +259,30 @@ cmd_setup_bridge() {
log "warning: ifup zt_wiblan failed; may need 'service network restart'"
fi
# Ensure ZeroTier-assigned IP stays on the ZT interface (needed for ARP)
# When ZT interface is a bridge port, the assigned IP can be lost
zt_ip=$(zerotier-cli listnetworks 2>/dev/null \
| awk '/OK/{for(i=6;i<=NF;i++) if($i ~ /\//) {split($i,a,"/"); print a[1]; exit}}')
zt_bits=$(zerotier-cli listnetworks 2>/dev/null \
| awk '/OK/{for(i=6;i<=NF;i++) if($i ~ /\//) {split($i,a,"/"); print a[2]; exit}}')
if [ -n "$zt_ip" ] && [ -n "$zt_bits" ]; then
if ! ip -4 addr show dev "$BRIDGE_PORTS" 2>/dev/null | grep -q "$zt_ip"; then
ip addr add "${zt_ip}/${zt_bits}" dev "$BRIDGE_PORTS" 2>/dev/null || \
log "warning: could not add ZT IP ${zt_ip}/${zt_bits} to ${BRIDGE_PORTS}"
fi
fi
# Add bridge interface to firewall LAN zone (needed for nftables fw4)
if command -v uci >/dev/null 2>&1 && [ "$SKIP_PERSIST" != "1" ]; then
lan_zone=$(uci -q get firewall.@zone[0].name 2>/dev/null)
if [ "$lan_zone" = "lan" ]; then
if ! uci -q get firewall.@zone[0].network 2>/dev/null | grep -q "zt_wiblan"; then
uci -q add_list "firewall.@zone[0].network=zt_wiblan"
uci -q commit firewall
log "added zt_wiblan to firewall LAN zone"
fi
fi
fi
log "bridge ${BRIDGE} setup complete"
}
@@ -241,15 +296,38 @@ cmd_setup_routing() {
ip route replace "$WIBLAN_GW" dev "$BRIDGE" 2>/dev/null || \
log "warning: host route to ${WIBLAN_GW} failed"
# Table 100 (main policy): default via WIBLAN_GW
ip route replace default via "$WIBLAN_GW" dev "$BRIDGE" table "$TABLE_MAIN"
# Table 100 (main policy): default via exit gateway + direct WIBLAN subnet route
# The exit gateway is the ZeroTier peer that has internet access (not WIBLAN_GW which is local)
EXIT_GW=$(uci -q get zt-gateway.global.active_ip 2>/dev/null || \
uci -q get zt-gateway.@gateway[0].ip 2>/dev/null || \
ip route show table "$TABLE_MWAN" 2>/dev/null \
| awk '/default/{for(i=1;i<=NF;i++) if($i=="via") {print $(i+1); exit}}')
if [ -z "$EXIT_GW" ]; then
# Fallback: find ZeroTier peer IP on the same /23
EXIT_GW=$(ip route show table "$TABLE_MWAN" 2>/dev/null \
| awk '/via.*dev/{for(i=1;i<=NF;i++) if($i=="via") {print $(i+1); exit}}')
fi
if [ -n "$EXIT_GW" ]; then
log "exit gateway: ${EXIT_GW}"
ip route replace default via "$EXIT_GW" dev "$BRIDGE_PORTS" table "$TABLE_MAIN"
ip route replace "$WIBLAN_CIDR" dev "$BRIDGE" table "$TABLE_MAIN"
# Table 101 (drain): default via WIBLAN_GW (same default; drain overrides per-flow)
ip route replace default via "$WIBLAN_GW" dev "$BRIDGE" table "$TABLE_DRAIN"
# Table 101 (drain): default via exit gateway
ip route replace default via "$EXIT_GW" dev "$BRIDGE_PORTS" table "$TABLE_DRAIN"
else
log "warning: could not determine exit gateway; using WIBLAN_GW"
ip route replace default via "$WIBLAN_GW" dev "$BRIDGE" table "$TABLE_MAIN"
ip route replace "$WIBLAN_CIDR" dev "$BRIDGE" table "$TABLE_MAIN"
ip route replace default via "$WIBLAN_GW" dev "$BRIDGE" table "$TABLE_DRAIN"
fi
# mwan3 return-traffic table: route WIBLAN back through bridge
ip route replace "$WIBLAN_CIDR" dev "$BRIDGE" table "$TABLE_MWAN"
# ip rule: WIBLAN subnet -> main policy table
ip rule add from "$WIBLAN_CIDR" table "$TABLE_MAIN" priority 100 2>/dev/null || \
ip rule replace from "$WIBLAN_CIDR" table "$TABLE_MAIN" priority 100
# ip rule: fwmark 0x100 -> drain table
ip rule add fwmark "$FWMARK" table "$TABLE_DRAIN" priority "$DRAIN_PRIORITY" 2>/dev/null || \
ip rule replace fwmark "$FWMARK" table "$TABLE_DRAIN" priority "$DRAIN_PRIORITY"
@@ -262,20 +340,28 @@ cmd_setup_routing() {
# Host route
if ! uci -q get "network.zt_wiblan_host" >/dev/null 2>&1; then
uci -q set "network.zt_wiblan_host=route"
uci -q set "network.zt_wiblan_host.target='${WIBLAN_GW}'"
uci -q set "network.zt_wiblan_host.interface='${BRIDGE}'"
uci -q set "network.zt_wiblan_host.target=${WIBLAN_GW}"
uci -q set "network.zt_wiblan_host.interface=${BRIDGE}"
fi
# Main policy table default route
if ! uci -q get "network.zt_wiblan_default" >/dev/null 2>&1; then
uci -q set "network.zt_wiblan_default=route"
uci -q set "network.zt_wiblan_default.target='0.0.0.0'"
uci -q set "network.zt_wiblan_default.netmask='0.0.0.0'"
uci -q set "network.zt_wiblan_default.gateway='${WIBLAN_GW}'"
uci -q set "network.zt_wiblan_default.interface='${BRIDGE}'"
uci -q set "network.zt_wiblan_default.table='${TABLE_MAIN}'"
uci -q set "network.zt_wiblan_default.target=0.0.0.0"
uci -q set "network.zt_wiblan_default.netmask=0.0.0.0"
uci -q set "network.zt_wiblan_default.gateway=${WIBLAN_GW}"
uci -q set "network.zt_wiblan_default.interface=${BRIDGE}"
uci -q set "network.zt_wiblan_default.table=${TABLE_MAIN}"
fi
# WIBLAN subnet route in main policy table
if ! uci -q get "network.zt_wiblan_subnet" >/dev/null 2>&1; then
uci -q set "network.zt_wiblan_subnet=route"
uci -q set "network.zt_wiblan_subnet.target=${WIBLAN_CIDR}"
uci -q set "network.zt_wiblan_subnet.netmask=$(_cidr_to_mask "$WIBLAN_BITS")"
uci -q set "network.zt_wiblan_subnet.interface=${BRIDGE}"
uci -q set "network.zt_wiblan_subnet.table=${TABLE_MAIN}"
fi
uci commit network
log "routing UCI config committed"
fi
@@ -299,20 +385,17 @@ cmd_setup_dhcp() {
else
uci -q set "dhcp.${BRIDGE_UCI}=dhcp"
fi
uci -q set "dhcp.${BRIDGE_UCI}.interface=${BRIDGE}"
uci -q set "dhcp.${BRIDGE_UCI}.interface=${WIBLAN_IFACE}"
uci -q set "dhcp.${BRIDGE_UCI}.start=${WIBLAN_LEASE_FIRST##*.}"
uci -q set "dhcp.${BRIDGE_UCI}.limit=$(( ${WIBLAN_LEASE_LAST##*.} - ${WIBLAN_LEASE_FIRST##*.} + 1 ))"
uci -q set "dhcp.${BRIDGE_UCI}.leasetime=12h"
# Provide gateway and DNS to DHCP clients
uci -q set "dhcp.${BRIDGE_UCI}.dhcp_option=3,${WIBLAN_GW}"
uci -q add_list "dhcp.${BRIDGE_UCI}.dhcp_option=6,8.8.8.8,1.1.1.1"
# Ignore WIBLAN subnet in upstream DHCP (prevent handing out
# conflicting leases on the LAN side)
lan_iface=$(uci -q get dhcp.lan.interface 2>/dev/null || echo "lan")
if [ -n "$lan_iface" ]; then
# Add WIBLAN to lan's ignore list if not already there
if ! uci -q get "dhcp.lan.ignore" 2>/dev/null | grep -q "$WIBLAN_CIDR"; then
uci -q add_list "dhcp.lan.dhcp_option='6,${WIBLAN_GW}'" 2>/dev/null || true
fi
# Disable DHCP on LAN to prevent conflicting leases
if ! uci -q test dhcp.lan.ignore >/dev/null 2>&1; then
uci -q set "dhcp.lan.ignore=1"
fi
if [ "$SKIP_PERSIST" != "1" ]; then
@@ -329,6 +412,50 @@ cmd_setup_dhcp() {
log "DHCP setup complete"
}
# ----------------------------------------------------------------------------
# setup-wifi-ap
# ----------------------------------------------------------------------------
cmd_setup_wifi_ap() {
log "setting up WiFi AP (${WiFi_SSID}) on ${WiFi_RADIO}..."
if ! command -v uci >/dev/null 2>&1; then
die 3 "uci not found; cannot configure WiFi"
fi
ensure_uci_config wireless
# Find existing wifinet section for our SSID, or create new one
existing=""
for idx in 0 1 2 3 4 5 6 7 8 9; do
if uci -q get "wireless.wifinet${idx}.ssid" 2>/dev/null | grep -q "^${WiFi_SSID}$"; then
existing="wifinet${idx}"
break
fi
done
if [ -n "$existing" ]; then
log "WiFi AP '${WiFi_SSID}' already exists (${existing}); updating"
section="$existing"
else
section=$(uci -q add wireless wifi-iface)
log "created new wireless section: ${section}"
fi
uci -q set "wireless.${section}.device=${WiFi_RADIO}"
uci -q set "wireless.${section}.mode=ap"
uci -q set "wireless.${section}.ssid=${WiFi_SSID}"
uci -q set "wireless.${section}.encryption=${WiFi_ENCRYPTION}"
uci -q set "wireless.${section}.key=${WiFi_KEY}"
uci -q set "wireless.${section}.network=${WIBLAN_IFACE}"
uci -q set "wireless.${section}.wpa_disable_eapol_key_retries=1"
if [ "$SKIP_PERSIST" != "1" ]; then
uci commit wireless
log "wireless UCI config committed"
fi
log "WiFi AP setup complete: ssid=${WiFi_SSID} radio=${WiFi_RADIO} bridge=${BRIDGE}"
}
# ----------------------------------------------------------------------------
# setup-hotplug
# ----------------------------------------------------------------------------
@@ -359,6 +486,20 @@ ZTG_WIBLAN_CIDR="${ZTG_WIBLAN_CIDR:-10.11.13.0/24}"
case "$ACTION" in
ifup)
# Ensure ZeroTier-assigned IP stays on the ZT interface (needed for ARP)
zt_if=$(ip -o link show 2>/dev/null | awk -F': ' '/^[0-9]+:/{gsub(/@.*/, "", $2); if ($2 ~ /^zt/ && $2 != "'"$ZTG_BRIDGE"'") print $2; exit}')
if [ -n "$zt_if" ]; then
zt_ip=$(zerotier-cli listnetworks 2>/dev/null \
| awk '/OK/{for(i=6;i<=NF;i++) if($i ~ /\//) {split($i,a,"/"); print a[1]; exit}}')
zt_bits=$(zerotier-cli listnetworks 2>/dev/null \
| awk '/OK/{for(i=6;i<=NF;i++) if($i ~ /\//) {split($i,a,"/"); print a[2]; exit}}')
if [ -n "$zt_ip" ] && [ -n "$zt_bits" ] && \
! ip -4 addr show dev "$zt_if" 2>/dev/null | grep -q "$zt_ip"; then
ip addr add "${zt_ip}/${zt_bits}" dev "$zt_if" 2>/dev/null
logger -t zt-gw-hotplug "added ZT IP ${zt_ip}/${zt_bits} to ${zt_if}"
fi
fi
# Read active gateway from UCI
active_ip=$(uci -q get zt-gateway.global.active_ip 2>/dev/null || \
uci -q get zt-gateway.global.active_gateway 2>/dev/null)
@@ -497,6 +638,7 @@ cmd_setup_all() {
cmd_setup_bridge
cmd_setup_routing
cmd_setup_dhcp
cmd_setup_wifi_ap
cmd_setup_hotplug
cmd_setup_persistence
@@ -508,6 +650,7 @@ cmd_setup_all() {
log " Gateway IP: ${WIBLAN_GW}"
log " Tables: ${TABLE_MAIN} (main), ${TABLE_DRAIN} (drain)"
log " DHCP: ${WIBLAN_LEASE_FIRST} - ${WIBLAN_LEASE_LAST}"
log " WiFi AP: ${WiFi_SSID} on ${WiFi_RADIO}"
log "========================================="
}
@@ -523,6 +666,7 @@ Commands:
setup-bridge Create the br-zt bridge interface
setup-routing Configure policy routing (tables 100/101, ip rules)
setup-dhcp Configure DHCP for WIBLAN on br-zt
setup-wifi-ap Create WIBLAN WiFi AP bridged to br-zt
setup-hotplug Create hotplug script to re-apply routes on ifup
setup-persistence Write rc.local + UCI network routes
setup-all Run all setup-* commands in order
@@ -546,6 +690,7 @@ main() {
setup-bridge) cmd_setup_bridge "$@" ;;
setup-routing) cmd_setup_routing "$@" ;;
setup-dhcp) cmd_setup_dhcp "$@" ;;
setup-wifi-ap) cmd_setup_wifi_ap "$@" ;;
setup-hotplug) cmd_setup_hotplug "$@" ;;
setup-persistence) cmd_setup_persistence "$@" ;;
setup-all) cmd_setup_all "$@" ;;