**若在防火牆區域勾選NAT或IP動態偽裝，則會上下行都會使用OpenWrt本身IP，若NAT後主機則無法取得真實IP**
#### **基本NAT設定** **勾選NAT內部主機即可外連** [](https://note.homesitetw.com/uploads/images/gallery/2025-07/image.png) #### **只需內部主機對外NAT** **取消勾選NAT，新增NAT規則** **來源位址輸入內部網段** [](https://note.homesitetw.com/uploads/images/gallery/2025-07/1TJimage.png) #### **iptables 指令** **172.20.10.0/24對外br-lan介面進行NAT** ``` iptables -A POSTROUTING -t nat -s 172.20.10.0/255.255.255.0 -o br-lan -j MASQUERADE ``` # OpenWrt WireGuard安裝 #### **安裝套件****OpenWrt 25.12 之後適用**
**WEB 介面上安裝以下套件** ``` wireguard-tools luci-proto-wireguard qrencode ``` #### **新增WireGuard介面** **自訂本機介面IP** **連接阜可自訂或維持預設** [](https://note.homesitetw.com/uploads/images/gallery/2026-09/iXTimage.png) #### **建立防火牆** [](https://note.homesitetw.com/uploads/images/gallery/2026-09/dySimage.png) #### **新增對等點** **填入對等點公鑰和IP** [](https://note.homesitetw.com/uploads/images/gallery/2026-09/uvvimage.png) #### **防火牆設定** **勾選NAT，例如往lan介面流量會轉成lan介面IP傳送** **涵蓋網路選擇WireGuard需要轉送的區域** [](https://note.homesitetw.com/uploads/images/gallery/2026-09/EaVimage.png) #### **流量規則設定** **Wan都是固定IP或PPPOE，因此外部預設傳入拒絕，需放行連入WireGuard連接阜** [](https://note.homesitetw.com/uploads/images/gallery/2026-09/0qOimage.png) **設定後重啟wg介面** #### **Windows WireGuard設定** **填入OpenWrt WireGuard的公鑰和定義連接阜** **AllowedIPs允許本身連接的介面和網段** [](https://note.homesitetw.com/uploads/images/gallery/2026-09/bIyimage.png)**MTU自行調整，固網可以用1400，手機熱點則可以1380(自行測試最佳值)**
# OpenWrt OpenVPN Server安裝 [](https://note.homesitetw.com/uploads/images/gallery/2025-07/osRimage.png) #### **運行環境** - **OpenWrt 21.02.3** #### **安裝套件** ``` opkg update opkg install openvpn-openssl openvpn-easy-rsa opkg install luci-app-openvpn #web介面管理 ``` ``` # Configuration parameters OVPN_PKI="/etc/easy-rsa/pki" export EASYRSA_PKI="${OVPN_PKI}" export EASYRSA_REQ_CN="ovpnca" export EASYRSA_BATCH="1" # Remove and re-initialize the PKI directory easyrsa init-pki # Generate DH parameters easyrsa gen-dh # Create a new CA easyrsa build-ca nopass # Generate a key pair and sign locally for a server easyrsa build-server-full server nopass # Generate a key pair and sign locally for a client easyrsa build-client-full client nopass # Generate TLS PSK openvpn --genkey --secret ${OVPN_PKI}/tc.pem ``` #### **設定** **新增server設定，這裡使用tap bridge為範例，編輯`/etc/config/openvpn`** ``` config openvpn 'vpntap' option enable '1' option proto 'udp' option dev 'tap0' option ca '/etc/easy-rsa/pki/ca.crt' option cert '/etc/easy-rsa/pki/issued/server.crt' option key '/etc/easy-rsa/pki/private/server.key' option dh '/etc/easy-rsa/pki/dh.pem' option tls_auth '/etc/easy-rsa/pki/tc.pem 0' option tls_server '1' option keepalive '10 120' option comp_lzo 'adaptive' option persist_key '1' option persist_tun '1' option status '/tmp/openvpn-status.log' option verb '3' option server_bridge ' ' option port '12975' option duplicate_cn '1' <<允許多個client ``` ``` /etc/init.d/openvpn restart ``` **client config設定** ``` client dev tap proto udp remote**適用25.12以後版本**
**搜尋snmpd安裝** [](https://note.homesitetw.com/uploads/images/gallery/2026-10/image.png) **重新整理頁面會出現服務選項自行修改設定** [](https://note.homesitetw.com/uploads/images/gallery/2026-10/EYMimage.png) **這裡只保留一組public** [](https://note.homesitetw.com/uploads/images/gallery/2026-10/stDimage.png) **重啟snmpd** ``` /etc/init.d/snmpd restart ``` **測試是否可以抓到snmpwalk** ``` snmpwalk -v 2c -c public 192.168.12.9 ``` #### **Librenms 設定** **在openwrt安裝librenms distro腳本抓取發行版本****放在/etc/config/裡，網頁上的備份功能會備份這個路徑所有檔案，之後若要遷移不用再重新下載**
``` wget -O /etc/config/distro https://raw.githubusercontent.com/librenms/librenms-agent/master/snmp/distro chmod +x /etc/config/distro ``` **確認可以抓到版本** [](https://note.homesitetw.com/uploads/images/gallery/2026-11/KfDimage.png) **編輯 `/etc/config/snmpd` 新增extend****安裝後Librenms抓不到hardware(25.12之前沒遇到)，因為是安裝在PVE裡我就手動指定通用名稱**
``` config extend option name distro option prog '/etc/config/distro' config extend option name hardware option prog '/bin/echo' option args 'Generic x86 64-bit' ``` **重啟snmpd** ``` /etc/init.d/snmpd restart ``` **Librenms新增主機確認正常** [](https://note.homesitetw.com/uploads/images/gallery/2026-10/BxZimage.png) # OpenWrt 安裝 SQM QoS #### **安裝 SQM QoS** **搜尋`luci-app-sqm`安裝** [](https://note.homesitetw.com/uploads/images/gallery/2026-10/xabimage.png) #### **設定** **頻寬100M/40M,這裡設定限頻下載95M/上傳36M，使用預設CAKE 演算法就可以** [](https://note.homesitetw.com/uploads/images/gallery/2026-10/aZaimage.png) [](https://note.homesitetw.com/uploads/images/gallery/2026-10/hw2image.png) **使用測速網站確認成功限頻** # OpenWrt 安裝NUT (Network UPS Tools)監控UPS #### **安裝nut-upsmon** **搜尋`nut-upsmon`和`luci-app-nut`安裝** [](https://note.homesitetw.com/uploads/images/gallery/2026-11/JDfimage.png) [](https://note.homesitetw.com/uploads/images/gallery/2026-11/C4Simage.png) **重新登入網頁會顯示NUT設定側欄** [](https://note.homesitetw.com/uploads/images/gallery/2026-11/HCmimage.png) #### **設定NUT監控** **我的UPS server在Synology上，所以設定UPS 從裝置** [](https://note.homesitetw.com/uploads/images/gallery/2026-11/luuimage.png) **CLI確認可以讀取UPS並啟用** ``` root@OpenWrt:~# upsc ups@192.168.0.250 battery.charge: 100 battery.charge.low: 10 battery.charge.warning: 50 battery.date: 2001/09/25 battery.mfr.date: 2023/08/10 battery.runtime: 2324 battery.runtime.low: 120 battery.type: PbAc ``` ``` /etc/init.d/nut-monitor enable /etc/init.d/nut-monitor start ``` #### **監控設定** **我將所有通知寫入syslog，另外切換到電池和恢復市電會另外執行指令** [](https://note.homesitetw.com/uploads/images/gallery/2026-11/aHOimage.png) **執行指令的部分自行建立`/etc/config/ups-action`執行** **而關機指令則維持系統預設** [](https://note.homesitetw.com/uploads/images/gallery/2026-11/FNwimage.png) **建立`/etc/config/ups-action`** ``` #!/bin/sh EVENT="$1" TIMESTAMP=$(date "+%Y-%m-%d %H:%M:%S") LOCK_FILE="/var/run/onbatt_countdown.pid" case "$EVENT" in ONBATT) logger -t nut-action "AC Power outage, on battery" ( echo $$ > "$LOCK_FILE" sleep 120 if [ -f "$LOCK_FILE" ]; then NOW=$(date "+%Y-%m-%d %H:%M:%S") logger -t nut-action -p authpriv.warn "AC Power not restored after 120s, shutdown system." echo "[$NOW] ONBATT confirmed after 120s wait." >> /tmp/ups_events.log rm -f "$LOCK_FILE" /sbin/poweroff fi ) & ;; ONLINE) logger -t nut-action "AC Power restored" if [ -f "$LOCK_FILE" ]; then PID=$(cat "$LOCK_FILE") rm -f "$LOCK_FILE" kill -9 "$PID" 2>/dev/null fi ;; *) logger -t nut-action "[NUT EVENT] $TIMESTAMP - Event $EVENT triggered." ;; esac exit 0 ``` **腳本行為** ****`ONBATT` 觸發**：印出日誌、記錄背景子程序 PID，並進行 120 秒非阻塞倒數。** ****`ONLINE` 中途恢復**：精準依據 PID 砍掉背景倒數程序並清理 PID 檔，順利取消關機。** ****120 秒超時**：確認 PID 檔依然存在，寫入確認 Log 後直接呼叫 `/sbin/poweroff` 執行安全關機。** ``` chmod +x /etc/config/ups-action ``` # OpenWrt 安裝 syslog-ng #### **安裝syslog-ng** **在網頁上搜尋安裝** [](https://note.homesitetw.com/uploads/images/gallery/2026-11/R5Timage.png) #### **設定syslog-ng** **編輯`/etc/syslog-ng.conf `，在source src裡的unix-dgram補上時區** **若未設定，大部分服務寫入/dev/log 的時間都不會+8** ``` source src { internal(); unix-dgram("/dev/log" keep-timestamp(no) time-zone("+08:00")); }; ``` #### **修改開機順序** **預設syslog-ng順序在50順位會導致開機時某些服務不會被syslog-ng接管** **lrwxrwxrwx 1 root root 19 Nov 9 10:42 /etc/rc.d/S50syslog-ng -> ../init.d/syslog-ng** **編輯`/etc/init.d/syslog-ng`，將START改成12** ``` START=12 ``` **重新建立符號連結** ``` /etc/init.d/syslog-ng enable /etc/init.d/syslog-ng start #移除舊的S50連結 rm /etc/rc.d/S50syslog-ng ``` **確認順序已提升至12** **lrwxrwxrwx 1 root root 19 Nov 9 12:27 /etc/rc.d/S12syslog-ng -> ../init.d/syslog-ng** **確認`/var/log/messages `已寫入log** ``` root@OpenWrt:~# cat /var/log/messages Nov 9 10:42:06 OpenWrt syslog-ng[26611]: syslog-ng starting up; version='4.12.0' Nov 9 10:42:06 OpenWrt syslog-ng[26611]: syslog-ng shutting down; version='4.12.0' ``` **關閉舊的`logd`服務** ``` /etc/init.d/log stop /etc/init.d/log disable ``` **openwrt logread已指向讀取`/var/log/messages`**