New NetGear R7800 - Where to start

hum, ok, so info in the Docs looks a bit misleading. At least to me!.

Anyways, I said I gave up on no-ip.com, but I guess I'll stick with it for now, until I don't get along with the setup.
Later, maybe I choose another one.

Also, I went to github for the latest /etc/config/ddns version and they say there to not use that file but a copy of it because all lines started with # and empty lines will be removed, as will be the options that I eventually set (uncomment) and they are already the default ones. I don't understand what they mean with "use a copy of this file". How will that change things? The content will be the same if I create a copy of the file.

Edited;
Nevermind, I got it.

I have tried to install ddns-scripts_no-ip_com and the first time I got an error, then I tried again and looks like it installed with no problems.

What happened???

# opkg install ddns-scripts_no-ip_com
Installing ddns-scripts_no-ip_com (2.7.8-12) to root...
Downloading http://downloads.openwrt.org/releases/19.07.2/packages/arm_cortex-a15_neon-vfpv4/packages/ddns-scripts_no-ip_com_2.7.8-12_all.ipk
Configuring ddns-scripts_no-ip_com.
Parse error (invalid command) at line 84, byte 1
Parse error (invalid command) at line 85, byte 1
uci: Parse error (invalid command) at line 84, byte 1
root@OpenWrt:~# opkg install ddns-scripts_no-ip_com
Package ddns-scripts_no-ip_com (2.7.8-12) installed in root is up to date.
root@OpenWrt:~#

I finally managed to get this working. But I still have a question. I'll first state how I managed to make it work and then I'll ask the question.

Steps:
1 - Install ddns-scripts

opkg install ddns-scripts

2 - Install additional package if needed (no-ip.com needs)

opkg install ddns-scripts_no-ip_com

3 - Replace file /etc/config/ddns-scripts with the most recent version from OpenWrt Github here.
Also keep the original name, just in case. I'm not sure if you can change the name.

4 - Change the following lines containing the following settings accordingly (downloaded file from step 3 is from 30/04/2020)

  • Line 66
    config service "noip_ddns"
    (service cannot contain white-spaces or dashes "-" or "@" ":" "!" or other special characters).

  • Line 73

option enable "1"
  • Line 79
option use_ipv6 "0"
  • Line 86
option interface "wan"
  • Line 107
    Comment it out. This is only needed if an upate script is not provided by OpenWrt. NoIP script is provided, so not needed.
#option service_name "dyndns.org"
  • Line 115
    Remove hash symbol. Uncomment. This is the location of the update script for NoIP, provided by OpenWrt.
option update_script   "/usr/lib/ddns/update_no-ip_com.sh"
  • Line 127
    This is where you place the "url" so to speak, that you chose in your NoIP account to be pointed to by the IPs your PC is assigned with. For instance "my.chosen.domain.ddns.net"
option domain "my.chosen.domain.ddns.net"
  • Line 131 and 135
    These are self explanatory. Your NoIP login credentials.

Last but not the least, restart ddns service with:

/etc/init.d/ddns restart

You can check it it is working by ping your my..chosen.domain.ddns.net from outside your local network and see if it gets 0% loss.

I hope I'm not alone already in this thread...

Is it possible to check if I have correctly setup SSL for my DDNS service?

I already have 'wget' and 'curl' installed, I suppose from the stock firmware. So I just enabled the option

option use_https "1"
inside /etc/config/ddns and restarted the service. The path to default certs.pem file was already in the config file.

Can I check somehow if my DDNS service is using SSL?

Are there any traces in the logs? Maybe it tells you where it connected?

If not then one way possible to check is to create a firewall rule to block tcp port 80 from any_zone to wan. Then I would trigger the DDNS service to see if it succeed updating your ip. Don't forget to unblock 80 afterwards.

Hi.

Which log?

logread -f

And would that be right after restarting DDNS service or when? I want to avoid messing with the firewall because I don't feel comfortable with it and I can't afford to mess it up and lose internet connection.

@DjiPi, what logs should I look in and when? About the DDNS traffic?

There is a section about monitoring trough the logs in the Wiki. You need to enable the logs (if the doc is still up-to-date).

https://openwrt.org/docs/guide-user/services/ddns/client#monitoring

From your configuration file, standard logging should occur in /var/log/ddns/myddns_ipv4.log and /var/log/ddns/myddns_ipv6.log. These are your config service '***' entries.

Maybe you need to manually set option use_syslog '1' (in config service '***'), then set it to 3 after you are done debugging.

1 Like

Hello @DjiPi.

I have used the sample config file from github. It's supposedly a newer version of this file.
Here: https://github.com/openwrt/packages/blob/lede-17.01/net/ddns-scripts/samples/ddns.config_sample

So It may be a little bit different than what I posted in post #68 you mentioned.

I have these files in /var/log/ddns:

myddns_ipv4.log
myddns_ipv6.log
no_ip_ipv4.log
noip_ddns.log

But only the last one has today's date, so I think the other files are from previous failed attempts of me trying to configure the service as they have older dates.
In this last file this is what I can see with

tail -f /var/log/ddns/noip_ddns.log
220740       : Detect local IP on 'network'
220740       : Local IP 'xxx.xxx.xxx.xxx' detected on network 'wan'
220740       : Waiting 600 seconds (Check Interval)
221740       : Detect registered/public IP
221741       : #> /usr/bin/nslookup helloshitty.ddns.net  >/var/run/ddns/noip_ddns.dat 2>/var/run/ddns/noip_ddns.err
221741       : Registered IP 'xxx.xxx.xxx.xxx' detected
221741  info : Rerun IP check at 2020-05-07 22:17
221741       : Detect local IP on 'network'
221741       : Local IP 'xxx.xxx.xxx.xxx' detected on network 'wan'
221741       : Waiting 600 seconds (Check Interval)

I can't see anything related to SSL being used. What else can I do?

Do you have these lines in your config:

option use_syslog  "1"
option use_logfile "1"

The second line, I have it since the very beginning the ddns service.
The first line I changed it today and reloaded ddns service. Should I restart the service instead?

Is there anything now in the system logfile?

I'm back here.

When am I supposed to find anything there related to DDNS with SSL? Do you have idea of what kind of lines I am supposed to find? I have no idea what to look for!

@DjiPi I have checked systemlog and the only thing related to DDNS I can see is this:

Fri May  8 22:44:01 2020 user.info ddns-scripts[6181]: noip_ddns: Rerun IP check at 2020-05-08 22:44

But nothing that tells me that SSL is actually being used!

I'm sorry, I really can't help you more. I don't even use DDNS on my OpenWrt, I was trying to point you to the right direction. I'm using it on my Synology instead.

All the information I gave you, I've got them using the forum. You need to search on the forum for DDNS Script Log, you'll find plenty of log samples, like this one:

Don't take it wrong, but someone with knowledge about this will need to chime in because I'm the blind who's walking the blind actually :wink:

1 Like

Sure. I appreciate your help.

@DjiPi I just got what I wanted but with the help of someone.

Let me say here how I was able to get it.
I think I was looking for more debug output than what the script and the service are prepared to output so I changed the variable VERBOSE to a value of 2 in /usr/lib/ddns/dynamic_dns_functions.sh because I see this line:

if [ ${use_logfile:-1} -eq 1 -o $VERBOSE -gt 1 ]; then

So, setting VERBOSE to any value greater than 1, gets me the following output:

122453       : sending real IP to 'no-ip.com'
122453       : #> /usr/bin/curl -RsS -o /var/run/ddns/noip_ddns.dat --stderr /var/run/ddns/noip_ddns.err --capath /etc/ssl/certs --noproxy '*' 'https://blablabla:***PW***@dynupdate.no-ip.com/nic/update?hostname=blablabla.ble.bli&myip=xxx.xxx.xxx.xxx'
122454       : 'no-ip.com' answered:
good xxx.xxx.xxx.xxx
122454  info : Update successful - IP 'xxx.xxx.xxx.xxx' send
122454       : Waiting 600 seconds (Check Interval)
1 Like

Thatโ€™s Where I was trying to get you, glad you got trough!

Thank you.
I think I'll keep using this thread for upcoming tasks. I now want to do 2 other things. Setup a remote log so that I can save logs somewhere out of the router, in order to save space, and also setup DoT.

I will also want to get familiar with firewall settings. But that's another 500s.

Hello,

Once more, trying to configure something in my OpenWrt.
I'm trying to redirect some traffic to allow SSH connections from outside. I've added the following to my /etc/config/firewall file, after saving a backup:

config redirect
    option name      'OutToIn-SSH'
    option src       'wan'
    option dest      'lan'
    option dest_ip   '192.168.1.112'
    option dest_port 'xxxxx'
    option proto     'tcp'
    option target    'DNAT'

And I also want to open 'xxxxx' port so I'm adding this, but not sure how to complete the section:

config rule
    option name 'OpenPortSSH'
    option src 'wlan'
    option dest 'lan'
    option dest_port 'xxxxx'

Well, I guess only the upper part is needed. No config rule needed as my laptop with internal IP will ever be accessible from outside!