0commit 1c9d4a117a442b8df8a046262708f71b35d6b38e
1Author: lakefox <mason@lakefox.net>
2Date:   Wed Dec 17 20:35:18 2025 -0700
3
4    Unsure if it works but should work
5
6diff --git a/.gitignore.swp b/.gitignore.swp
7deleted file mode 100644
8index 5efdf33..0000000
9Binary files a/.gitignore.swp and /dev/null differ
10diff --git a/bin/xtables-legacy-multi b/bin/xtables-legacy-multi
11deleted file mode 100755
12index ed7d58a..0000000
13Binary files a/bin/xtables-legacy-multi and /dev/null differ
14diff --git a/init.sh b/init.sh
15index e1f19a5..53c9d9a 100755
16--- a/init.sh
17+++ b/init.sh
18@@ -5,6 +5,8 @@ rm -f initramfs_router.cpio
19 
20 mkdir -p root/{bin,sbin,etc,proc,sys,usr,dev,tmp,var}
21 mkdir -p root/boot
22+mkdir -p root/run
23+touch root/run/xtables.lock
24 
25 mkdir -p root/lib/firmware
26 cp -r /lib/firmware/rtl_nic root/lib/firmware/
27@@ -12,87 +14,22 @@ cp -r /lib/firmware/rtl_nic root/lib/firmware/
28 # Assuming you have a static busybox binary at this path:
29 cp /usr/bin/busybox root/bin/
30 
31-# Run scripts/iptables.sh to create
32-cp bin/xtables-legacy-multi root/bin/
33-
34 cd root/bin
35 ./busybox --install ./
36 cd -
37 
38-# Add the ethernet drivers
39-#cp "/lib/modules/$(uname -r)/kernel/drivers/net/ethernet/realtek/r8169.ko.xz" root/lib/modules/
40-
41-# 1. Define your target modules
42-# Using xhci-pci usually pulls in xhci-hcd, and usbhid pulls in hid/usbcore
43-TARGET_MODS="xhci-pci usbhid hid-generic hid-apple r8169 realtek libphy"
44-
45-# 2. Clear and recreate the module directory structure
46-KVER=$(uname -r)
47-MOD_DEST="root/lib/modules/$KVER"
48-mkdir -p "$MOD_DEST"
49-
50-# 3. Copy the necessary metadata files to satisfy depmod
51-cp "/lib/modules/$KVER/modules.order" "$MOD_DEST/"
52-cp "/lib/modules/$KVER/modules.builtin" "$MOD_DEST/"
53-
54-# 4. Use modinfo to find and copy every dependency for our target modules
55-for mod in $TARGET_MODS; do
56-    # Get the path for the module and all its dependencies
57-    # then copy them while preserving the directory structure
58-    modprobe --show-depends $mod | awk '{print $2}' | while read line; do
59-        cp --parents "$line" root/
60-    done
61-done
62-
63-# 5. Run depmod pointing to your root directory
64-# The -a flag tells it to analyze all modules found
65-depmod -b root/ "$KVER"
66-
67-cat << EOF > root/init
68-#!/bin/sh
69-
70-# 1. Mount essential kernel filesystems
71-/bin/mount -t proc proc /proc
72-/bin/mount -t sysfs sysfs /sys
73-/bin/mount -t devtmpfs devtmpfs /dev
74 
75-# Start the drivers
76-/bin/modprobe xhci-pci
77-/bin/modprobe usbhid
78-/bin/modprobe hid-apple
79-/bin/modprobe hid-generic
80-/bin/modprobe realtek
81-/bin/modprobe libphy
82-/bin/modprobe r8169
83+# Load firmware and tools
84+source modules/firmware.sh
85+source modules/tools.sh
86 
87-#/bin/xz -d /lib/modules/r8169.ko.xz 
88-#/bin/insmod /lib/modules/r8169.ko
89+# Create the init script
90+source modules/script.sh
91+source modules/dhcp.sh
92 
93-# 2. Configure Networking for Router (This is where your setup logic goes)
94-
95-# Set IP forwarding (Mandatory for a router)
96-/bin/echo 1 > /proc/sys/net/ipv4/ip_forward
97-
98-# Bring up interfaces (replace with your interface names and IPs)
99-/bin/ip link set eth0 up
100-/bin/ip link set eth1 up
101-/bin/ip addr add 192.168.1.1/24 dev eth0
102-
103-# 3. Apply Firewall/NAT Rules (Using BusyBox's limited iptables support or a custom script)
104-# Note: BusyBox typically links to the full iptables binary if available, or requires a custom build.
105-# We'll just start the shell for now.
106-
107-sleep 2
108-
109-echo "--- BusyBox Router Initialized ---"
110-
111-# 4. Start the interactive root shell (PID 1 hands off to this)
112-exec setsid cttyhack /bin/sh || exec /bin/sh
113-
114-# 5. If the shell exits, prevent the panic
115-echo "Root shell exited. Shutting down."
116-/bin/poweroff -f
117-EOF
118+# Load the firewall script
119+cp modules/firewall.sh root/lib
120+chmod +x root/lib/firewall.sh
121 
122 # Make the init script executable
123 chmod +x root/init
124@@ -101,3 +38,6 @@ cd root
125 # Create the cpio archive
126 find . -print0 | cpio --null -o --format=newc > ../initramfs_router.cpio
127 cd -
128+
129+# Write the new image to the usb
130+./fla.sh
131diff --git a/modules/dhcp.sh b/modules/dhcp.sh
132new file mode 100755
133index 0000000..370c8f1
134--- /dev/null
135+++ b/modules/dhcp.sh
136@@ -0,0 +1,25 @@
137+#!/bin/bash
138+
139+mkdir -p root/var/lib/misc
140+touch root/var/lib/misc/udhcpd.leases
141+
142+cat << EOF > root/etc/udhcpd.conf
143+# The range of IPs to lease
144+start      192.168.0.2
145+end        192.168.1.254
146+
147+# The interface to listen on
148+interface  eth1
149+
150+# Options sent to the client
151+opt dns    1.1.1.1 9.9.9.9
152+opt subnet 255.255.255.0
153+opt router 192.168.0.1
154+opt lease  864000 # 10 days in seconds
155+
156+# Static lease for the server
157+static_lease 14:98:77:86:e5:0d 192.168.0.11
158+
159+# File to store active leases (ensure directory exists)
160+lease_file /var/lib/misc/udhcpd.leases
161+EOF
162diff --git a/modules/firewall.sh b/modules/firewall.sh
163new file mode 100755
164index 0000000..ccc832b
165--- /dev/null
166+++ b/modules/firewall.sh
167@@ -0,0 +1,97 @@
168+#!/bin/sh
169+
170+# Set IP forwarding (Mandatory for a router)
171+echo 1 > /proc/sys/net/ipv4/ip_forward
172+
173+# Bring up interfaces
174+ip link set eth0 up
175+ip link set eth1 up
176+ip addr add 192.168.0.1/24 dev eth1
177+
178+touch /var/lib/misc/udhcpd.leases
179+udhcpd /etc/udhcpd.conf &
180+
181+# Request an IP address from the Modem/ISP (eth0)
182+udhcpc -i eth0 &
183+
184+# Enable SYN cookies
185+echo 1 > /proc/sys/net/ipv4/tcp_syncookies
186+
187+# Increase the "backlog" (how many connections we can track at once)
188+echo 2048 > /proc/sys/net/ipv4/tcp_max_syn_backlog
189+
190+# Reduce the time we wait for a dead connection to time out
191+echo 3 > /proc/sys/net/ipv4/tcp_synack_retries
192+
193+# --- 1. Set Default Policies ---
194+# These tell the router: "If I didn't specifically allow it, kill it."
195+iptables -P INPUT DROP
196+iptables -P FORWARD DROP
197+iptables -P OUTPUT ACCEPT
198+
199+# --- 2. Allow Internal (Safe) Traffic ---
200+# Allow the router to talk to itself (localhost)
201+iptables -A INPUT -i lo -j ACCEPT
202+
203+# Allow your home devices (eth1) to talk to the router (for DHCP/DNS)
204+iptables -A INPUT -i eth1 -j ACCEPT
205+
206+# --- 3. The "Stateful" Firewall (Crucial for Internet) ---
207+# Allow traffic that YOU started to come back in.
208+# This lets you browse the web but stops hackers from starting a connection to you.
209+iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
210+iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
211+
212+# --- 4. Allow Outbound Internet ---
213+# Allow your home devices (eth1) to send requests out to the web (eth0)
214+iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
215+
216+# --- 5. NAT (Masquerade) ---
217+iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
218+
219+iptables -t mangle -A PREROUTING -m conntrack --ctstate INVALID -j DROP
220+
221+iptables -A INPUT -p tcp -m state --state NEW -m limit --limit 10/minute --limit-burst 5 -j ACCEPT
222+
223+iptables -N SYN_FLOOD
224+iptables -A INPUT -p tcp --syn -j SYN_FLOOD
225+iptables -A SYN_FLOOD -m limit --limit 25/s --limit-burst 50 -j RETURN
226+iptables -A SYN_FLOOD -j DROP
227+
228+# Drop packets that are not a new SYN but aren't part of an established connection
229+iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
230+
231+# Drop "XMAS" and "Null" packets (common scanner/flood techniques)
232+iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
233+iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
234+
235+iptables -A INPUT -p icmp --icmp-type echo-request -m limit --limit 2/s -j ACCEPT
236+iptables -A INPUT -p icmp -j DROP
237+
238+# Ignore any packet on eth0 that claims to be from a private internal IP
239+for i in /proc/sys/net/ipv4/conf/*/rp_filter; do
240+    echo 1 > $i
241+done
242+
243+iptables -A INPUT -i eth0 -p udp --dport 67:68 -j DROP
244+iptables -A INPUT -i eth0 -p udp --dport 137:139 -j DROP
245+iptables -A INPUT -i eth0 -d 255.255.255.255 -j DROP
246+
247+# Forward HTTP (80)
248+iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.0.11
249+
250+# Forward DNS (53) - Both UDP and TCP
251+iptables -t nat -A PREROUTING -i eth0 -p udp --dport 53 -j DNAT --to-destination 192.168.0.11
252+iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 53 -j DNAT --to-destination 192.168.0.11
253+
254+# Allow the forwarded traffic to reach the server
255+iptables -A FORWARD -d 192.168.0.11 -p tcp --dport 80 -j ACCEPT
256+iptables -A FORWARD -d 192.168.0.11 -p udp --dport 53 -j ACCEPT
257+iptables -A FORWARD -d 192.168.0.11 -p tcp --dport 53 -j ACCEPT
258+iptables -A FORWARD -d 192.168.0.11 -p udp --dport 53 -m limit --limit 50/s -j ACCEPT
259+iptables -A FORWARD -d 192.168.0.11 -p tcp --dport 53 -m limit --limit 50/s -j ACCEPT
260+iptables -A FORWARD -d 192.168.0.11 -p tcp --dport 80 -m limit --limit 50/s -j ACCEPT
261+
262+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d 192.168.0.11 -p tcp --dport 80 -j MASQUERADE
263+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d 192.168.0.11 -p udp --dport 53 -j MASQUERADE
264+iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -d 192.168.0.11 -p tcp --dport 53 -j MASQUERADE
265diff --git a/modules/firmware.sh b/modules/firmware.sh
266new file mode 100755
267index 0000000..fbc3828
268--- /dev/null
269+++ b/modules/firmware.sh
270@@ -0,0 +1,44 @@
271+#!/bin/bash
272+
273+# 1. Define your target modules
274+# Using xhci-pci usually pulls in xhci-hcd, and usbhid pulls in hid/usbcore
275+TARGET_MODS="xhci-pci usbhid hid-generic hid-apple r8169 realtek libphy \
276+crc32c_intel crc32c_generic libcrc32c \
277+ip_tables iptable_filter iptable_nat iptable_mangle \
278+xt_tcpudp xt_limit xt_state xt_conntrack xt_MASQUERADE xt_nat \
279+nf_nat nf_conntrack nf_defrag_ipv4 nf_reject_ipv4 \
280+crc32_pclmul crc32c_intel nf_nat_proto_udp nf_nat_proto_tcp \
281+nft_compat nft_chain_nat nf_tables"
282+
283+# 2. Clear and recreate the module directory structure
284+KVER=$(uname -r)
285+MOD_DEST="root/lib/modules/$KVER"
286+mkdir -p "$MOD_DEST"
287+
288+# 3. Copy the necessary metadata files to satisfy depmod
289+cp "/lib/modules/$KVER/modules.order" "$MOD_DEST/"
290+cp "/lib/modules/$KVER/modules.builtin" "$MOD_DEST/"
291+cp "/lib/modules/$KVER/modules.builtin.modinfo" "$MOD_DEST/"
292+
293+# 4. Use modinfo to find and copy every dependency for our target modules
294+for mod in $TARGET_MODS; do
295+	# Get the path for the module and all its dependencies
296+	# then copy them while preserving the directory structure
297+	modprobe --show-depends $mod | awk '{print $2}' | while read line; do
298+		cp --parents "$line" root/
299+	done
300+done
301+
302+
303+find root/lib/modules/ -name "*.ko.xz" -exec unxz {} \;
304+# 5. Run depmod pointing to your root directory
305+# The -a flag tells it to analyze all modules found
306+depmod -b root/ "$KVER"
307+
308+
309+# Load user shared objects for iptables
310+XT_DIR="/usr/lib/x86_64-linux-gnu/xtables"
311+DEST_XT="root/usr/lib/x86_64-linux-gnu/xtables"
312+
313+mkdir -p "$DEST_XT"
314+cp "$XT_DIR"/*.so "$DEST_XT/"
315diff --git a/modules/script.sh b/modules/script.sh
316new file mode 100755
317index 0000000..03004df
318--- /dev/null
319+++ b/modules/script.sh
320@@ -0,0 +1,59 @@
321+#!/bin/bash
322+
323+cat << EOF > root/init
324+#!/bin/sh
325+
326+# 1. Mount essential kernel filesystems
327+/bin/mount -t proc proc /proc
328+/bin/mount -t sysfs sysfs /sys
329+/bin/mount -t devtmpfs devtmpfs /dev
330+
331+# --- Foundations (Math & Compatibility) ---
332+/bin/modprobe crc32_pclmul 2>/dev/null || /bin/modprobe crc32c_generic
333+/bin/modprobe libcrc32c
334+/bin/modprobe nft_compat    # Crucial for 6.12 kernels to understand iptables-legacy
335+/bin/modprobe nf_tables
336+
337+# --- Hardware Drivers ---
338+/bin/modprobe xhci-pci
339+/bin/modprobe usbhid
340+/bin/modprobe hid-apple
341+/bin/modprobe hid-generic
342+/bin/modprobe realtek
343+/bin/modprobe libphy
344+/bin/modprobe r8169
345+
346+# --- Core Networking ---
347+/bin/modprobe nf_conntrack
348+/bin/modprobe nf_nat
349+
350+# --- iptables Tables ---
351+/bin/modprobe ip_tables
352+/bin/modprobe x_tables
353+/bin/modprobe iptable_filter
354+/bin/modprobe iptable_nat
355+/bin/modprobe iptable_mangle
356+
357+# --- iptables Extensions ---
358+/bin/modprobe xt_state
359+/bin/modprobe xt_conntrack
360+/bin/modprobe xt_limit
361+/bin/modprobe xt_tcpudp
362+/bin/modprobe xt_MASQUERADE
363+/bin/modprobe xt_nat        # Use xt_nat instead of xt_DNAT for newer kernels
364+
365+# Start the firewall
366+./lib/firewall.sh
367+
368+sleep 2
369+
370+echo "--- BusyBox Router Initialized ---"
371+
372+# 4. Start the interactive root shell (PID 1 hands off to this)
373+exec setsid cttyhack /bin/sh || exec /bin/sh
374+
375+# 5. If the shell exits, prevent the panic
376+echo "Root shell exited. Shutting down."
377+/bin/poweroff -f
378+EOF
379+
380diff --git a/modules/tools.sh b/modules/tools.sh
381new file mode 100755
382index 0000000..b9c0b01
383--- /dev/null
384+++ b/modules/tools.sh
385@@ -0,0 +1,27 @@
386+#!/bin/bash
387+
388+# 1. Define the tools you want to bring over
389+TOOLS="/usr/sbin/xtables-legacy-multi /usr/sbin/ip"
390+
391+# 2. Copy the binaries and every library they need
392+for tool in $TOOLS; do
393+    # Copy the binary itself
394+    cp --parents "$tool" root/
395+    
396+    # Find all shared library dependencies and copy them
397+    # This ignores 'linux-vdso' (kernel space) but grabs everything else
398+    deps=$(ldd "$tool" | grep "=> /" | awk '{print $3}')
399+    for dep in $deps; do
400+        cp --parents "$dep" root/
401+    done
402+done
403+
404+# 3. Copy the Loader (The "Interpretor") 
405+# ldd shows this as /lib64/ld-linux-x86-64.so.2 (it's not in the '=>' list)
406+cp --parents /lib64/ld-linux-x86-64.so.2 root/ 2>/dev/null || true
407+
408+# 4. Create symlinks so you can just type 'iptables'
409+ln -sf /usr/sbin/xtables-legacy-multi root/bin/iptables
410+ln -sf /usr/sbin/xtables-legacy-multi root/bin/iptables-save
411+ln -sf /usr/sbin/xtables-legacy-multi root/bin/iptables-restore
412+
413diff --git a/scripts/iptables.sh b/scripts/iptables.sh
414deleted file mode 100644
415index ba3fc2b..0000000
416--- a/scripts/iptables.sh
417+++ /dev/null
418@@ -1,19 +0,0 @@
419-#!/bin/bash
420-source=(https://netfilter.org/projects/iptables/files/iptables-1.8.11.tar.xz) 
421-
422-print $source
423-
424-curl -q -L -O $source
425-tar xvf iptables-1.8.11.tar.xz
426-
427-cd iptables-1.8.11
428-
429-./configure \
430-    --prefix=/ \
431-    --disable-shared \
432-    --enable-static \
433-    --disable-nftables
434-
435-make
436-cd iptables/
437-cp xtables-legacy-multi ../../../bin