harrypnyce / raspbian10-buster

passwd
usermod -aG sudo user
groupadd user
usermod -d /home/user -m -g user -l user pi 

sudo raspi-config

ssh-keygen -t rsa -b 4096

ssh-copy-id -i ~/.ssh/id_rsa user@host/ip

nano /etc/ssh/sshd_config
sudo apt update && sudo apt-get upgrade -y

apt-get purge fake-hwclock
sudo apt-get install python-smbus i2c-tools
sudo nano /etc/modules
	rtc-ds1307
sudo i2cdetect -y 1
sudo nano /etc/rc.local
	echo ds1307 0x68 > /sys/class/i2c-adapter/i2c-1/new_device
		hwclock -s
sudo reboot
date
sudo date -s "Thu 27 Jun 2019 01:41:20"
sudo hwclock -w
date; sudo hwclock -r

curl -L https://install.pivpn.io | bash

sudo apt-get install hostapd dnsmasq libmnl-dev linux-headers-rpi build-essential git dnsutils bc raspberrypi-kernel-headers iptables-persistent -y
echo "deb http://deb.debian.org/debian/ unstable main" > /etc/apt/sources.list.d/unstable-wireguard.list
sudo su
printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' > /etc/apt/preferences.d/limit-unstable
sudo apt-key adv --keyserver   keyserver.ubuntu.com --recv-keys 04EE7237B7D453EC

sudo apt update
sudo apt-get install wireguard -y
sudo reboot		

sudo perl -pi -e 's/#{1,}?net.ipv4.ip_forward ?= ?(0|1)/net.ipv4.ip_forward = 1/g' /etc/sysctl.conf
sudo reboot

sysctl net.ipv4.ip_forward		

mkdir wgkeys		
cd wgkeys		

wg genkey > server_private.key		
wg pubkey > server_public.key < server_private.key		
wg genkey > client1_private.key		
wg pubkey > client1_public.key < client1_private.key		
ls -la		
cat server_private.key		
cat client1_public.key

sudo nano /etc/wireguard/wg0.conf		


[Interface]
Address = 192.168.99.1/24
ListenPort = 51820

PrivateKey = <server_private.key>
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
#Client1
PublicKey = <client1_public.key>
AllowedIPs = 192.168.99.2/32

sudo wg-quick up wg0		
sudo wg		

sudo systemctl enable wg-quick@wg0
sudo apt install qrencode

sudo curl -sSL https://install.pi-hole.net | bash

sudo apt install unbound

wget -O root.hints https://www.internic.net/domain/named.root
sudo mv root.hints /var/lib/unbound/

sudo nano /etc/unbound/unbound.conf.d/pi-hole.conf

server:
# If no logfile is specified, syslog is used
# logfile: "/var/log/unbound/unbound.log"
verbosity: 2

port: 5353
do-ip4: yes
do-udp: yes
do-tcp: yes

# May be set to yes if you have IPv6 connectivity
do-ip6: no

# Use this only when you downloaded the list of primary root servers!
root-hints: "/var/lib/unbound/root.hints"

# Trust glue only if it is within the servers authority
harden-glue: yes

# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
harden-dnssec-stripped: yes

# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
use-caps-for-id: no

# Reduce EDNS reassembly buffer size.
# Suggested by the unbound man page to reduce fragmentation reassembly problems
edns-buffer-size: 1472

# Perform prefetching of close to expired message cache entries
# This only applies to domains that have been frequently queried
prefetch: yes

# This attempts to reduce latency by serving the outdated record before
# updating it instead of the other way around. Alternative is to increase
# cache-min-ttl to e.g. 3600.
cache-min-ttl: 0
serve-expired: yes
# serve-expired-ttl: 3600 # 0 or not set means unlimited (I think)

# Use about 2x more for rrset cache, total memory use is about 2-2.5x
# total cache size. Current setting is way overkill for a small network.
# Judging from my used cache size you can get away with 8/16 and still
# have lots of room, but I've got the ram and I'm not using it on anything else.
# Default is 4m/4m
msg-cache-size: 128m
rrset-cache-size: 256m

# One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
num-threads: 1

# Ensure kernel buffer is large enough to not lose messages in traffic spikes
so-rcvbuf: 1m

# Ensure privacy of local IP ranges
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10

sudo service unbound start
dig pi-hole.net @127.0.0.1 -p 5353

cd /usr/share/lighttpd/
sudo ln -s create-mime.conf.pl create-mime.assign.pl

sudo iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p tcp --dport 53 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p udp --dport 53 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p udp --dport 67 -j ACCEPT
sudo iptables -A INPUT -i eth0 -p udp --dport 68 -j ACCEPT
sudo netfilter-persistent save
sudo netfilter-persistent reload

sudo iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE

sudo iptables -A FORWARD -i eth0 -o wg0 -j ACCEPT

sudo iptables -A FORWARD -i wg0 -o eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT

sudo iptables -A INPUT -i lo -j ACCEPT

sudo iptables -A INPUT -i eth0 -p icmp -j ACCEPT

sudo iptables -A INPUT -i eth0 -p tcp --dport 22 -j ACCEPT

sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

sudo iptables -P FORWARD DROP
sudo iptables -P INPUT DROP
sudo iptables -L

sudo systemctl enable netfilter-persistent
sudo netfilter-persistent reload

sudo apt install nftables

iptables-translate -A INPUT -j CHECKSUM --checksum-fill

iptables-save > rules.iptables
iptables-restore-translate -f rules.iptables > rules.nft
nft -f rules.nft
nft list ruleset