jaysoffian / eap_proxy

Proxy EAP packets between interfaces on Linux devices such as the Ubiquiti Networks EdgeRouter™ and UniFi® Security Gateway.
BSD 3-Clause "New" or "Revised" License
562 stars 87 forks source link

Installation and setup instructions for non-EdgeOS (generic Linux) devices #21

Open tobiasmcnulty opened 5 years ago

tobiasmcnulty commented 5 years ago

Thanks so much for this great project. It works flawlessly for me, and as a Python developer I'm particularly grateful for the clean and readable code!

Initially when I found this repo I dismissed it for my own use because it appeared from the README to work only for Ubiquiti devices. Once I gave up on all the other (non-proxy) options and looked more carefully at the code, however, I realized there's very little that is Ubiquiti-specific to this solution. I have it working on a Debian server right now and I'm fairly certain everything (except for the DHCP restart bits) will work fine on nearly any Linux-based device.

Would you be open to a PR (probably all README tweaks) to clarify that this can be used on other Linux-based devices, along with a sample config for Debian-based OSes? I'm happy to put something together if so. Another thought would be to make this pip-installable. I'm not sure if Ubiquiti devices come with pip installed, but if they do that might simplify the installation process. Again I'm happy to work on this myself and submit a PR if you're open to it.

Thanks again for the great project!

jaysoffian commented 5 years ago

EdgeOS devices do not include pip. There's an open PR (#5) for Debian packaging which I may someday update and merge. Neither of those precludes pip packaging as well. I just honestly didn't want to deal with the packaging overhead for what's essentially just two scripts.

I'd be happy to review README changes and a sample config.

tobiasmcnulty commented 5 years ago

Sample supervisor setup, until I have time to push up a PR for the README:

# apt install -y supervisor python3-setuptools
# easy_install3 install pip
# pip3 install -U eap_proxy
# cat <<EOF > /etc/supervisor/conf.d/eap_proxy.conf 
[program:eap_proxy]
command=/usr/local/bin/eap_proxy --ignore-start --ignore-logoff --run-as nobody eth0 eth2
autostart=true
startretries=100
redirect_stderr=true
stdout_syslog=true
EOF
# supervisorctl reload
# supervisorctl status

Tips:

Disclaimer: The pip-installable eap_proxy is built from the tobiasmcnulty/eap_proxy fork of this repo, which is identical (as of 8/12/19), other than for the presence of a setup.py. See: https://github.com/jaysoffian/eap_proxy/compare/master...tobiasmcnulty:master

tobiasmcnulty commented 5 years ago

@jaysoffian Per the disclaimer above I set up https://pypi.org/project/eap-proxy/, which I'm happy to update periodically and/or add you to if you like.

One other question: Do EdgeOS devices include easy_install? If so you could probably use that to install pip (or just install easy_install eap_proxy directly if preferred).

jaysoffian commented 5 years ago

No, EdgeOS does not have easy_install. EdgeOS is based on Debian so of course it can be added, or it could be installed with with get-pip.py, but those changes get lost on upgrade. There's a limited area of the file-system that's set-aside for user-files which are kept between upgrades. Also, it just doesn't make sense to install pip or turn this into a Debian package for EdgeOS. It's just two files, so it's all overhead.

I'm not really sure I see any advantage of making this pip installable since that still doesn't get you the start/stop script or process monitor config. At least an RPM and/or Deb makes a little more sense to me. I just don't really want to be responsible for keeping those up to date.

So I'm mildly thumbs-down on https://pypi.org/project/eap-proxy/ with it linking to a fork, but it's BSD licensed after-all.

tobiasmcnulty commented 5 years ago

Fair enough. Maybe I'll try it out on VyOS one of these days, assuming that's relatively similar.

As an alternative to PyPI, simply having a setup.py in the repo would make it pip-installable via the zip download link in GitHub. I wonder if Python could be convinced to install the script in the directory that persists between upgrades.

jaysoffian commented 5 years ago

That sounds like a totally reasonable compromise. I'll add a setup.py and a proper version.

mrancier commented 5 years ago

Fair enough. Maybe I'll try it out on VyOS one of these days, assuming that's relatively similar.

As an alternative to PyPI, simply having a setup.py in the repo would make it pip-installable via the zip download link in GitHub. I wonder if Python could be convinced to install the script in the directory that persists between upgrades.

Did you ever try this on VYOS ?

tobiasmcnulty commented 5 years ago

Did you ever try this on VYOS ?

No, I haven't.

WisChrendel commented 4 years ago

Interested in trying this with a Amplifi Router and Ubuntu server. What is the wiring set up that you are using for your debian set up?

tobiasmcnulty commented 4 years ago

Physical wiring is pretty much the same as other devices. You do need three separate ethernet ports (I had to buy a USB ethernet adapter since my device only had two). Don't forget to put the actual WAN connection on VLAN 0, too.

cordone commented 4 years ago

@tobiasmcnulty Would you happen to have any drafts of your README tweaks or a sample of your Debian config? I'm looking to set this up on a Debian-based router, but I'm not sure what I would need to do differently compared to the EdgeOS setup.

tobiasmcnulty commented 4 years ago

@cordone My semi-working config can be found in a comment above: https://github.com/jaysoffian/eap_proxy/issues/21#issuecomment-520637447

tobiasmcnulty commented 4 years ago

@mrancier The EdgeRouter instructions seem to work fine for me on VyOS, too. For hardware I am using the PC Engines apu4 (https://www.pcengines.ch/apu4c4.htm). It looks like the startup script might work a little differently (I just ran sudo eap_proxy.sh manually for now): https://docs.vyos.io/en/latest/appendix/command-scripting.html