0commit 135ee6c31d052f8ed5c9c4cf41f5975b2c401733
1Author: lakefox <mason@lakefox.net>
2Date:   Sat Dec 20 17:41:27 2025 -0700
3
4    Working wifi no firewall
5
6diff --git a/init.sh b/init.sh
7index 53c9d9a..62275fc 100755
8--- a/init.sh
9+++ b/init.sh
10@@ -6,7 +6,6 @@ rm -f initramfs_router.cpio
11 mkdir -p root/{bin,sbin,etc,proc,sys,usr,dev,tmp,var}
12 mkdir -p root/boot
13 mkdir -p root/run
14-touch root/run/xtables.lock
15 
16 mkdir -p root/lib/firmware
17 cp -r /lib/firmware/rtl_nic root/lib/firmware/
18@@ -27,8 +26,14 @@ source modules/tools.sh
19 source modules/script.sh
20 source modules/dhcp.sh
21 
22+mkdir -p root/usr/share/udhcpc
23+cp modules/default.script root/usr/share/udhcpc
24+chmod +x root/usr/share/udhcpc/default.script
25+
26 # Load the firewall script
27+cp modules/network.sh root/lib
28 cp modules/firewall.sh root/lib
29+chmod +x root/lib/network.sh
30 chmod +x root/lib/firewall.sh
31 
32 # Make the init script executable
33diff --git a/modules/.network.sh.swp b/modules/.network.sh.swp
34new file mode 100644
35index 0000000..0088afd
36Binary files /dev/null and b/modules/.network.sh.swp differ
37diff --git a/modules/default.script b/modules/default.script
38new file mode 100755
39index 0000000..ecb2cbf
40--- /dev/null
41+++ b/modules/default.script
42@@ -0,0 +1,39 @@
43+#!/bin/sh
44+
45+# Send logs directly to the screen so you can see them live
46+echo "SCRIPT TRIGGERED WITH ARG: $1" > /dev/console
47+
48+case "$1" in
49+    deconfig)
50+        ip addr flush dev $interface
51+        ip link set $interface up
52+        ;;
53+
54+    renew|bound)
55+        echo "Applying IP $ip to $interface..." > /dev/console
56+        
57+        # 1. Use 'replace' to be safe, and add a broadcast address
58+        ip addr replace $ip/${mask:-24} broadcast + dev $interface
59+        
60+        # 2. WAIT for the kernel to register the address (Crucial for initramfs)
61+        sleep 1
62+
63+        # 3. Apply the Gateway
64+        if [ -n "$router" ]; then
65+            echo "Applying Gateway $router..." > /dev/console
66+            # Delete any existing defaults first to prevent "File exists" errors
67+            ip route del default dev $interface 2>/dev/null
68+            ip route add default via $router dev $interface
69+        fi
70+
71+        # 4. DNS
72+        if [ -n "$dns" ]; then
73+            echo -n > /etc/resolv.conf
74+            for i in $dns; do
75+                echo "nameserver $i" >> /etc/resolv.conf
76+            done
77+        fi
78+        
79+        echo "Network configuration complete." > /dev/console
80+        ;;
81+esac
82diff --git a/modules/dhcp.sh b/modules/dhcp.sh
83index 370c8f1..1420eaf 100755
84--- a/modules/dhcp.sh
85+++ b/modules/dhcp.sh
86@@ -19,6 +19,7 @@ opt lease  864000 # 10 days in seconds
87 
88 # Static lease for the server
89 static_lease 14:98:77:86:e5:0d 192.168.0.11
90+static_lease 18:7c:0b:02:c4:50 192.168.0.2
91 
92 # File to store active leases (ensure directory exists)
93 lease_file /var/lib/misc/udhcpd.leases
94diff --git a/modules/firmware.sh b/modules/firmware.sh
95index fbc3828..7897d3b 100755
96--- a/modules/firmware.sh
97+++ b/modules/firmware.sh
98@@ -3,12 +3,9 @@
99 # 1. Define your target modules
100 # Using xhci-pci usually pulls in xhci-hcd, and usbhid pulls in hid/usbcore
101 TARGET_MODS="xhci-pci usbhid hid-generic hid-apple r8169 realtek libphy \
102-crc32c_intel crc32c_generic libcrc32c \
103-ip_tables iptable_filter iptable_nat iptable_mangle \
104-xt_tcpudp xt_limit xt_state xt_conntrack xt_MASQUERADE xt_nat \
105-nf_nat nf_conntrack nf_defrag_ipv4 nf_reject_ipv4 \
106-crc32_pclmul crc32c_intel nf_nat_proto_udp nf_nat_proto_tcp \
107-nft_compat nft_chain_nat nf_tables"
108+libcrc32c crc32c_generic \
109+nf_tables nft_compat nft_counter nft_chain_nat nft_nat nft_masq \
110+nfnetlink nfnetlink_log nfnetlink_queue nf_tables_netdev"
111 
112 # 2. Clear and recreate the module directory structure
113 KVER=$(uname -r)
114@@ -25,7 +22,7 @@ for mod in $TARGET_MODS; do
115 	# Get the path for the module and all its dependencies
116 	# then copy them while preserving the directory structure
117 	modprobe --show-depends $mod | awk '{print $2}' | while read line; do
118-		cp --parents "$line" root/
119+		cp -L --parents "$line" root/
120 	done
121 done
122 
123diff --git a/modules/network.sh b/modules/network.sh
124new file mode 100755
125index 0000000..1bbe2e1
126--- /dev/null
127+++ b/modules/network.sh
128@@ -0,0 +1,31 @@
129+#!/bin/sh
130+
131+# Set IP forwarding
132+echo 1 > /proc/sys/net/ipv4/ip_forward
133+
134+# Bring up interfaces
135+ip link set lo up
136+ip link set eth0 up
137+ip link set eth1 up
138+ip addr add 192.168.0.1/24 dev eth1
139+
140+# DHCP Server for local network
141+touch /var/lib/misc/udhcpd.leases
142+udhcpd /etc/udhcpd.conf &
143+
144+# Request ISP IP - Backgrounded so boot continues
145+udhcpc -i eth0 -s /usr/share/udhcpc/default.script -b &
146+
147+# --- Firewall Rules ---
148+# Flush the ruleset to ensure a clean state
149+nft flush ruleset
150+
151+# Create the most basic table structure
152+# Note: Use single quotes so the shell doesn't mess with the curly braces
153+nft add table ip filter
154+nft 'add chain ip filter forward { type filter hook forward priority 0 ; policy accept ; }'
155+
156+# If the above succeeds, try the NAT table
157+nft add table ip nat
158+nft 'add chain ip nat postrouting { type nat hook postrouting priority 100 ; }'
159+nft add rule ip nat postrouting oifname "eth0" masquerade
160diff --git a/modules/script.sh b/modules/script.sh
161index 03004df..29d8ad2 100755
162--- a/modules/script.sh
163+++ b/modules/script.sh
164@@ -8,11 +8,8 @@ cat << EOF > root/init
165 /bin/mount -t sysfs sysfs /sys
166 /bin/mount -t devtmpfs devtmpfs /dev
167 
168-# --- Foundations (Math & Compatibility) ---
169-/bin/modprobe crc32_pclmul 2>/dev/null || /bin/modprobe crc32c_generic
170+/bin/modprobe crc32c_generic
171 /bin/modprobe libcrc32c
172-/bin/modprobe nft_compat    # Crucial for 6.12 kernels to understand iptables-legacy
173-/bin/modprobe nf_tables
174 
175 # --- Hardware Drivers ---
176 /bin/modprobe xhci-pci
177@@ -23,27 +20,25 @@ cat << EOF > root/init
178 /bin/modprobe libphy
179 /bin/modprobe r8169
180 
181-# --- Core Networking ---
182-/bin/modprobe nf_conntrack
183-/bin/modprobe nf_nat
184-
185-# --- iptables Tables ---
186-/bin/modprobe ip_tables
187-/bin/modprobe x_tables
188-/bin/modprobe iptable_filter
189-/bin/modprobe iptable_nat
190-/bin/modprobe iptable_mangle
191-
192-# --- iptables Extensions ---
193-/bin/modprobe xt_state
194-/bin/modprobe xt_conntrack
195-/bin/modprobe xt_limit
196-/bin/modprobe xt_tcpudp
197-/bin/modprobe xt_MASQUERADE
198-/bin/modprobe xt_nat        # Use xt_nat instead of xt_DNAT for newer kernels
199+# 1. Load the Netlink communication layer FIRST
200+/bin/modprobe nfnetlink
201+
202+# 2. Load the core nftables engine
203+/bin/modprobe nf_tables
204+
205+# 3. Load the specific engines for NAT and Filtering
206+/bin/modprobe nft_chain_nat
207+/bin/modprobe nft_nat
208+/bin/modprobe nft_masq
209+/bin/modprobe nft_payload
210+/bin/modprobe nft_lookup
211+
212+# Give the kernel a second to register the netlink interface
213+sleep 1
214 
215 # Start the firewall
216-./lib/firewall.sh
217+/lib/network.sh > /tmp/boot_debug.log 2>&1
218+#./lib/firewall.sh
219 
220 sleep 2
221 
222diff --git a/modules/tools.sh b/modules/tools.sh
223index b9c0b01..7d17d9f 100755
224--- a/modules/tools.sh
225+++ b/modules/tools.sh
226@@ -1,7 +1,11 @@
227 #!/bin/bash
228 
229 # 1. Define the tools you want to bring over
230-TOOLS="/usr/sbin/xtables-legacy-multi /usr/sbin/ip"
231+TOOLS="/usr/sbin/nft /usr/sbin/ip"
232+
233+cp --parents /lib/x86_64-linux-gnu/libnftables.so* root/
234+cp --parents /lib/x86_64-linux-gnu/libmnl.so* root/
235+cp --parents /lib/x86_64-linux-gnu/libnftnl.so* root/
236 
237 # 2. Copy the binaries and every library they need
238 for tool in $TOOLS; do
239@@ -16,12 +20,9 @@ for tool in $TOOLS; do
240     done
241 done
242 
243-# 3. Copy the Loader (The "Interpretor") 
244-# ldd shows this as /lib64/ld-linux-x86-64.so.2 (it's not in the '=>' list)
245+# 3. Copy the Loader (The "Interpreter")
246 cp --parents /lib64/ld-linux-x86-64.so.2 root/ 2>/dev/null || true
247 
248-# 4. Create symlinks so you can just type 'iptables'
249-ln -sf /usr/sbin/xtables-legacy-multi root/bin/iptables
250-ln -sf /usr/sbin/xtables-legacy-multi root/bin/iptables-save
251-ln -sf /usr/sbin/xtables-legacy-multi root/bin/iptables-restore
252-
253+# 4. Create symlinks for easier typing
254+ln -sf /usr/sbin/ip root/bin/ip
255+ln -sf /usr/sbin/nft root/bin/nft