Category Archives: Computer

DNS / DHCP

Today i’ve migrated my DNS/DHCP to a Mikrotik router.
See post

I’m planning to replace my main firewall/dhcp/dns/web/irc/mail/ids whatever more .. to virtual machines and a mikrotik router.

Having used bind and isc-dhcp-server for many years, i had to try some alternatives.

  • DNS in FreeIPA
  • Unbound with zone/dns
  • Phpipam with powerdns

And now DNS/DHCP in a Mikrotik router!

I still use Phpipam as cmdb.
So i’m planning to use ansible to synchronize phpipam and the mikrotik.

Nice .. no seach domain needed …
nslookup webserver, resolves webserver.dmz
If there are 2 hosts with the same hostname, you have to add a domain.

Shelly Devices

I love shellies, easy to implement and hacker friendly.

MQTT out of the box.
Curl in and out – you can switch it on/off using curl, but it can send a http command also.
I’ve used this with Domoticz and Home Assistant.
It has a webinterface, with timers, and there is also a client for Android/Iphone
You’ve got some own gpio pins to your disposal and the unit is flash-able!

curl -X POST https://shellydevice/device/relay/control -d "channel=IDHERE&turn=on&id=ID&auth_key=AUTH"

The device is not isolated from the mains. To flash it, the mains must be disconnected.

SHELLY 1

I use this for simple on/off switches around the house.
Using it with a physical switch and MQTT (Nodered)

SHELLY 2 PM

Same as above but this one has a build in power meter

SHELLY DIMMER

Generic dimmer

Dimmer with low voltage rotary encoder!
https://www.instructables.com/Shelly-Dimmer-Wall-Switch-With-Rotary-Knob-and-Hom/

SHELLY RGBW2

A RGBW / 4 Channel controller
You can connect RGB strips, but also dimmable white strips in 4 channels. 12V or 24V.
NOTE! : There is a common 12V connection, and GND will be controlled!

SHELLY PLUG S

I love these small wall plugs, i’ve used these also to find power consuming devices around the house.

For example, i made a nodered flow, to see if the washing machines are running or not.

SHELLY BUTTON

This became my all purpose alarm thinghy

SHELLY DOORSENSOR

A door sensor WITH temperature and light sensor build in!

Home Assistant example

SHELLY WATER SENSOR

This one lays below our washing machine

SHELLY SMOKE ALARM

(Preordered)

SHELLY PM4

A four channel power measure/switch for your fuse box


GENERIC SHELLY STUFF
A smart doorbell schematic i found

https://www.thingiverse.com/thing:5756154
Very nice .. printable cases for your shellies!

Converting old media

Old files, own created stuff, downloaded stuff. Sometimes there are no viewers anymore, or you thrown devices away.

(I will add to this when i find more information)

These are the tools i’ve used to convert them to a newer format.

NOTE: Converting will always impact the quality

IMAGES

LBM (amiga)

ilbmtoppm < test.LBM | pnmtopng - > test.png

RAM (video files)

ffmpeg -i file.ram file.mp4
or
ffmpeg -i file.ram file.gif

Own DVD’s
NOTE: VOB files are mpg, to keep same quality i use stream copy (-c copy) , besides mpg i´d like to have movies in a web streamable format like MP4, so i DO convert these

ffmpeg -i "concat:VTS_01_1.VOB|VTS_01_2.VOB|VTS_01_3.VOB" -f mpeg -c copy output.mpeg

Flash/SWF

http://www.swffileplayer.com/
https://flasharch.com/en/downloads
.. and record with OBS

AMR ( Adaptive Multi-Rate audio codec )

ffmpeg -i folkband.amr -ar 22050 folkband.mp3

3GP

ffmpeg -i pipes.3gp -vcodec h264 -c:a aac pipes.mp4
If your 3gp is recent and has a x264 tag (check with mediainfo)
then you can convert lossless with
ffmpeg -i 10026202.3gp -c:v copy -c:a copy 10026202.mp4

QTVR (need to get a better solution for this)
I’ve used this for rendered scenes

ffmpeg -i ../test.mov %02d.png
ffmpeg -i %02d.png -vf "tile=1x24,transpose=1" qtvrmovie.png

FLV

ffmpeg -i filename.flv -c:v libx264 -crf 19 -strict experimental filename.mp4

WEBP (Not a old media format, but i dont like webp format.)
This script converts to images or animated gif depending on the number of frames

#!/bin/bash


ls *webp |  while read file; do
duration=$(webpinfo -summary "$file" | grep Duration | head -1 |  sed -e 's/.* \([0-9]*\)$/\1/')
frames=$(webpinfo -summary "$file" | grep frames | head -1 |  sed -e 's/.* \([0-9]*\)$/\1/')
if [ "$duration" == "0" ] ; then duration=50 ;fi
echo "DUR $duration : FRM $frames"
dur=$( echo "$duration / 100" | bc )


if [ $frames == "1" ] ; then convert $file png/$file.jpg 
else 
for i in $(seq -f "%05g" 1 $frames)
do
    webpmux -get frame $i $file -o $file.$i.webp
    dwebp $file.$i.webp -o $file.$i.png
done
fi

convert $file.*.png  -colorspace srgb  +dither  -delay $dur -loop 0 gif/$file.gif
rm $file.[0-9]*.png *webp.[0-9]*.webp
done

Nextcloud Notes

(Old and new notes, i will keep adding info)

A install step stopped .. find a .step file and remove this

[nginx@nextcloud nextcloud]$ rm /mnt/fileserver/updater-ocv0dxmv6vpg/.step

Login page loop: directory rights wrong

This server was running nginx
drwxrwx---.  2 root apache     6 Jan  3 18:19 wsdlcache
drwxrwx---.  2 root apache 16384 Jan  3 18:19 session
drwxrwx---.  2 root apache     6 Jan  3 18:19 opcache

fixed with:
chown root:nginx /var/lib/php/session 
chown root:nginx /var/lib/php/opcache
chown root:nginx /var/lib/php/wsdlcache

Other things to check (Generic)

  • Really slow storage can cause problems, check with iotop
  • Check selinux! (temporary test with : setenforce 0 )
  • Behind a reverse proxy? remove these options in your config.php and check a local connection. This is a test for: reverseproxy, firewall and proxy settings in config.php. Need to test a localhost connection with your browser?
    ssh -L8080:localhost:80 nextcloudserver (and connect to http://localhost:8080 with your browser
  • Check your services! .. memcache, nginx, apache, mysql/mariadb
  • Check logs: journalctl -f, tail -f /var/log/nginx/*log /x/y/z/netcloud.log
  • Storage on a remote server? (Using NFS for example) Check your rights
    • change into your webserver account and test access to files.storage
      ( sudo su – nginx -s /bin/bash )

Migrating users to a complete new nextcloud instance keeping IDs

Get a list of users

su - apache -s /bin/bash  -c " source /opt/rh/rh-php72/enable; cd /var/www/html/nextcloud ;./occ user:list 2>/dev/null | grep -v admin ; exit" > listofusers

Sync and check users
Rsync data and use occ command to scan files into database

#!/bin/bash
cd /root
#set -x
templist=templist.$$
./getlistusers > userlistsvr1
cat userlistsvr1 > /tmp/$templist
cat userlistsvr2.new >> /tmp/$templist
cat /tmp/$templist | cut -f2 -d: | sort  | uniq -c | grep " 2 " | cut -c 10- > /tmp/deze.$$
cat /tmp/deze.$$ | while read ; do
	echo "User $REPLY"
	oldtest=0
	newtest=0
	old=$(cat userlistsvr2 | grep "$REPLY" | awk '{ print $2 }' | sed s/://g)
	new=$(cat userlistsvr1 | grep "$REPLY" | awk '{ print $2 }' | sed s/://g)
	test -d /var/data/owncloud/data/$old/files/ && oldtest=1
	test -d /var/data/owncloud/nextcloud/$new/files/ && newtest=1
	if [ $oldtest -eq 1 ] ; then echo " found old dir - $old" ; fi
	if [ $newtest -eq 1 ] ; then echo " found new dir - $new" ; fi
	if [ $oldtest -eq 1 ] && [ $newtest -eq 1 ] ; then echo "  both found - ready to sync" 
		rsync -va /var/data/owncloud/data/$old/files/ /var/data/owncloud/nextcloud/$new/files/
		echo " RUN occ files:scan $new ############################"
		su - apache -s /bin/bash  -c " source /opt/rh/rh-php72/enable; cd /var/www/html/nextcloud ;./occ files:scan $new"
        fi
	echo " "
 
done
rsync -va  /var/data/owncloud/data/root/files/xyz/ /var/data/owncloud/nextcloud/38842e24-5d0d-11e9-dbdb-0001a4ab950f/files/
su - apache -s /bin/bash  -c " source /opt/rh/rh-php72/enable; cd /var/www/html/nextcloud ;./occ files:scan 38842e24-5d0d-11e9-dbdb-0001a4ab950f"

Linux crypt methods i’m using.

Some directories on my fileserver are encrypted using ecryptfs.

eCryptfs is a POSIX-compliant enterprise cryptographic stacked filesystem for Linux. eCryptfs stores cryptographic metadata in the header of each file, so that encrypted files can be copied between hosts; the file will be decrypted with the proper key in the Linux kernel keyring. There is no need to keep track of any additional information aside from what is already in the encrypted file itself. You may think of eCryptfs as a sort of “gnupg as a filesystem”.

Example crypted directory using filename encryption

ECRYPTFS_FNEK_ENCRYPTED.FWYQ.y58tWRY7EQqyVPxxMk11BuiLpk8jXCQ8BRz0z5p9C2Pu2HZg-mmv---/ECRYPTFS_FNEK_ENCRYPTED.FWYQ.y58tWRY7EQqyVPxxMk11BuiLpk8jXCQ-Jx6RlQrLhDhdZ9IrcCOAE--
ECRYPTFS_FNEK_ENCRYPTED.FWYQ.y58tWRY7EQqyVPxxMk11BuiLpk8jXCQ8BRz0z5p9C2Pu2HZg-mmv---/ECRYPTFS_FNEK_ENCRYPTED.FWYQ.y58tWRY7EQqyVPxxMk11BuiLpk8jXCQ.cE4XNdvLLui2EamsqU2rE--
ECRYPTFS_FNEK_ENCRYPTED.FWYQ.y58tWRY7EQqyVPxxMk11BuiLpk8jXCQ8BRz0z5p9C2Pu2HZg-mmv---/ECRYPTFS_FNEK_ENCRYPTED.FWYQ.y58tWRY7EQqyVPxxMk11BuiLpk8jXCQ1J..MuVpsw6kaCgwYCwJXk--

Adhoc mounting

You can use the same dir for mounting!
Filenames are encrypted also.
Use umount go back to the crypted state

NOTE: You can write files to the crypted dir, if you are NOT using filename encryption, you can’t see which one is crypted and which is not.
Use the script below to get hints of the readable files!

mount -t ecryptfs securedir securedir
Passphrase:
Select cipher:
 1) aes: blocksize = 16; min keysize = 16; max keysize = 32
 2) blowfish: blocksize = 8; min keysize = 16; max keysize = 56
 3) des3_ede: blocksize = 8; min keysize = 24; max keysize = 24
 4) twofish: blocksize = 16; min keysize = 16; max keysize = 32
 5) cast6: blocksize = 16; min keysize = 16; max keysize = 32
 6) cast5: blocksize = 8; min keysize = 5; max keysize = 16
Selection [aes]:
Select key bytes:
 1) 16
 2) 32
 3) 24
Selection [16]:
Enable plaintext passthrough (y/n) [n]:
Enable filename encryption (y/n) [n]: y
Filename Encryption Key (FNEK) Signature [xxxxxxxxxxxxxxxxxx]:
Attempting to mount with the following options:
  ecryptfs_unlink_sigs
  ecryptfs_fnek_sig=xxxxxxxxxxxxxxxxxx
  ecryptfs_key_bytes=16
  ecryptfs_cipher=aes
  ecryptfs_sig=xxxxxxxxxxxxxxxxxxx
Mounted eCryptfs

Crypting disks for travel/backup

For this i’m using Luks

The Linux Unified Key Setup (LUKS) is a disk encryption specification created by Clemens Fruhwirth in 2004 and was originally intended for Linux.

While most disk encryption software implements different, incompatible, and undocumented formats , LUKS implements a platform-independent standard on-disk format for use in various tools. This not only facilitates compatibility and interoperability among different programs, but also assures that they all implement password management in a secure and documented manner

Formatting a disk and mounting

cryptsetup luksFormat /dev/sdb1

WARNING!
========
This will overwrite data on /dev/sdb1 irrevocably.

Are you sure? (Type uppercase yes): YES
Enter passphrase for /dev/sdb1:
Verify passphrase:
root@workstation:~# cryptsetup luksOpen /dev/sdb1 crypto
Enter passphrase for /dev/sdb1:
root@workstation:~# mkfs.ext4 /dev/mapper/crypto
mke2fs 1.44.1 (24-Mar-2018)
Creating filesystem with 244188672 4k blocks and 61054976 inodes
Filesystem UUID: 844eb9ee-d4da-4dfd-9d94-b62987e96b93
Superblock backups stored on blocks:
        32768, 98304, 163840, 229376, 294912, 819200, 884736, 1605632, 2654208,
        4096000, 7962624, 11239424, 20480000, 23887872, 71663616, 78675968,
        102400000, 214990848

Allocating group tables: done
Writing inode tables: done
Creating journal (262144 blocks): done
Writing superblocks and filesystem accounting information: done

root@workstation:~# mount /dev/mapper/crypto /backup/

Umount and close

umount /backup
cryptsetup luksClose crypto

File crypt checker (checks for data files which COULD be crypted)

#!/bin/bash
find secure -type f  -exec file {} \;| egrep -v "ASCII text|MS Windows shortcut|ISO-8859 text|image data|PDF document|PC bitmap|Composite Document File|WebM|ISO Media|Microsoft Word|HTML| Microsoft Excel|Matroska|vCard|Microsoft ASF|Web/
P|RIFF|MPEG|RealMedia|UTF\-8 Unicode|Zip archive data|Macromedia Flash|RAR archive|EPUB document|Adobe Photoshop Image|AppleDouble|OpenType|empty|gzip compressed data|MS Windows|OpenDocument|Paint Shop Pro|executable|PostScript document|
Rich Text|audio data|SVG Scalable|UDF filesystem|very short file|Web Open Font Format|IFF |TrueType|BeautifulWatches|MTS:" > data-or-not

OR 

File crypt checker ( When the directory is in crypted state )
All files should be raw data

#!/bin/bash
find secure -type f  -exec file {} \;| egrep -v data$  > notcrypted-files

Escape game messages screen v1

Today working on the backend engine and screens like this.
All text will be generated, and send from the server.

A local version to try in your browser: (optimized for 1920×1080 press F11!)

<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Indie+Flower&family=Tangerine&display=swap" rel="stylesheet">

<style>

body {
    background: url("background.jpg");
    height: 1080px;
    width: 100%;
    text-align: center;
    margin: auto;
    font-family: 'Tangerine', cursive;
    color:#000;
	}
/* The Modal (background) */
.modal {
  display: none; /* Hidden by default */
  position: fixed; /* Stay in place */
  z-index: 1; /* Sit on top */
  padding-top: 100px; /* Location of the box */
  left: 0;
  top: 0;
  width: 100%; /* Full width */
  height: 100%; /* Full height */
  overflow: auto; /* Enable scroll if needed */
  background-color: rgb(0,0,0); /* Fallback color */
  background-color: rgba(0,0,0,0.4); /* Black w/ opacity */
}

/* Modal Content */
.modal-content {
  background-image: url("note.jpg"); /* The image used */
  height: 788px; /* You must set a specified height */
  background-position: center; /* Center the image */
  background-repeat: no-repeat; /* Do not repeat the image */
  margin: auto;
  padding: 20px;
}

/* The Close Button */
.close {
 position: absolute; /*Can also be `fixed`*/
  color: #ff0000;
  		  font-size: 40px;
		  right: 550px;

  font-weight: bold;
}

.close:hover,
.close:focus {
  color: #000;
  text-decoration: none;
  cursor: pointer;
}
.topcontent {
        width: 400px;
        height: 200px;
        font-family: 'Indie Flower', cursive;
		  font-size: 40px;

        position: absolute; /*Can also be `fixed`*/
        left: 0;
        right: 350;
        top: -440;
        bottom: 0;
        margin: auto;
        /*Solves a problem in which the content is being cut when the div is smaller than its' wrapper:*/
        max-width: 100%;
        max-height: 100%;
        overflow: auto;
}
.playercontent {
        width: 400px;
        height: 200px;
        font-family: 'Indie Flower', cursive;
		  font-size: 40px;

        position: absolute; /*Can also be `fixed`*/
        left: 0;
        right: 300;
        top: -340;
        bottom: 0;
        margin: auto;
        /*Solves a problem in which the content is being cut when the div is smaller than its' wrapper:*/
        max-width: 100%;
        max-height: 100%;
        overflow: auto;
}
.content {
        width: 400px;
        height: 200px;
        font-family: 'Indie Flower', cursive;
		  font-size: 40px;

        position: absolute; /*Can also be `fixed`*/
        left: 0;
        right: 0;
        top: 100;
        bottom: 0;
        margin: auto;
        /*Solves a problem in which the content is being cut when the div is smaller than its' wrapper:*/
        max-width: 100%;
        max-height: 100%;
        overflow: auto;
}
</style>
</head>
<body>


<!-- Trigger/Open The Modal -->
<button id="myBtn">Incoming message</button>

<!-- The Modal -->
<div id="myModal" class="modal">
  <div class="topcontent">HQ</div>
  <div class="playercontent">Spy #1</div>

  <div class="content">We need the code now! Look for a yellow key</div>

  <!-- Modal content -->
  <div class="modal-content">
  
    <span class="close">close</span>
  </div>

</div>

<script>
// Get the modal
var modal = document.getElementById("myModal");

// Get the button that opens the modal
var btn = document.getElementById("myBtn");

// Get the <span> element that closes the modal
var span = document.getElementsByClassName("close")[0];

// When the user clicks the button, open the modal 
btn.onclick = function() {
  modal.style.display = "block";
}

// When the user clicks on <span> (x), close the modal
span.onclick = function() {
  modal.style.display = "none";
}

// When the user clicks anywhere outside of the modal, close it
window.onclick = function(event) {
  if (event.target == modal) {
    modal.style.display = "none";
  }
}
</script>

Mikrotik Vlan network with DMZ

UPDATE: 20230227 Static ip script

Example network with DMZ part, using VLANs and trunks.
Tested in my network, but not my current setup.

VLAN 3 – DMZ
VLAN 10 – Homenetwork
VLAN 128 – MGT

Modem : fritzbox, is dhcp server for 192.168.1.1 network
CRS: is dhcp server for wlan, home network, management, Also a firewall with NAT is configured here. ( No block examples below, only NAT )
RB: (Routerboard 2011) has no IPs except for a management IP (not in config below)
Server and Reverse proxy are in the 192.168.1.1 network.
(dhcp requests in a dmz vlan (3) get their IP from the modem DHCP pool.

Example ip’s server and PC

server: gets dhcp from modem, 192.168.1.10/24 gateway 192.168.1.1 DNS 192.168.1.1
PC: gets dhcp from CRS, 10.10.0.1/24 gateway 10.10.0.253 DNS 1.1.1.1

Config CRS

# feb/04/2023 14:55:22 by RouterOS 6.49.5
# software id = xxxx-xxxx
#
# model = CRS125-24G-1S
# serial number = xxxxxxxxxxxx
/interface bridge
add admin-mac=4C:5E:0C:xx:xx:xx auto-mac=no comment=defconf name=bridge
/interface ethernet
set [ find default-name=ether1 ] comment=WAN
set [ find default-name=ether2 ] comment=trunk
set [ find default-name=ether3 ] comment=trunk
set [ find default-name=ether9 ] comment=vlan3
set [ find default-name=ether10 ] comment=vlan10
set [ find default-name=ether24 ] comment="MGMT - untagged"
/interface vlan
add interface=bridge name=vlan3 vlan-id=3
add interface=bridge name=vlan10 vlan-id=10
add interface=bridge name=vlan128 vlan-id=128
/interface list
add name=WAN
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/ip pool
add name=vlan128-pool ranges=10.128.0.100-10.128.0.200
add name=vlan10-pool ranges=10.10.0.100-10.10.0.200
/ip dhcp-server
add address-pool=vlan128-pool disabled=no interface=vlan128 name=mgt-dhcp
add address-pool=vlan10-pool disabled=no interface=vlan10 name=gen-dhcp
/interface bridge port
add bridge=bridge comment=defconf ingress-filtering=yes interface=ether1
add bridge=bridge comment=defconf frame-types=admit-only-vlan-tagged ingress-filtering=yes interface=ether2
add bridge=bridge comment=defconf ingress-filtering=yes interface=ether3
add bridge=bridge comment=defconf interface=ether4
add bridge=bridge comment=defconf interface=ether5
add bridge=bridge comment=defconf interface=ether6
add bridge=bridge comment=defconf interface=ether7
add bridge=bridge comment=defconf interface=ether8
add bridge=bridge comment=defconf interface=ether9
add bridge=bridge comment=defconf interface=ether10
add bridge=bridge comment=defconf interface=ether11
add bridge=bridge comment=defconf interface=ether12
add bridge=bridge comment=defconf interface=ether13
add bridge=bridge comment=defconf interface=ether14
add bridge=bridge comment=defconf interface=ether15
add bridge=bridge comment=defconf interface=ether16
add bridge=bridge comment=defconf interface=ether17
add bridge=bridge comment=defconf interface=ether18
add bridge=bridge comment=defconf interface=ether19
add bridge=bridge comment=defconf interface=ether20
add bridge=bridge comment=defconf interface=ether21
add bridge=bridge comment=defconf interface=ether22
add bridge=bridge comment=defconf interface=ether23
add bridge=bridge comment=defconf interface=ether24
add bridge=bridge comment=defconf interface=sfp1
/interface ethernet switch egress-vlan-tag
add tagged-ports=ether2,ether3,switch1-cpu vlan-id=128
add tagged-ports=ether2,ether3,switch1-cpu vlan-id=10
add tagged-ports=ether2,ether3,switch1-cpu vlan-id=3
/interface ethernet switch ingress-vlan-translation
add customer-vid=0 new-customer-vid=128 ports=ether2,ether3,ether24
add customer-vid=0 new-customer-vid=3 ports=ether1,ether2,ether3,ether9
add customer-vid=0 new-customer-vid=10 ports=ether10,ether2,ether3
/interface ethernet switch vlan
add ports=ether2,ether3,ether24,switch1-cpu vlan-id=128
add ports=ether2,ether3,ether10,switch1-cpu vlan-id=10
add ports=ether1,ether2,ether3,ether9,switch1-cpu vlan-id=3
/interface list member
add interface=ether1 list=WAN
add interface=bridge list=LAN
/ip address
add address=192.168.1.253/24 comment=defconf interface=vlan3 network=192.168.1.0
add address=10.128.0.253/24 interface=vlan128 network=10.128.0.0
add address=10.10.0.253/24 interface=vlan10 network=10.10.0.0
/ip dhcp-server network
add address=10.1.0.0/24 dns-server=1.1.1.1 gateway=10.1.0.253
add address=10.128.0.0/24 dns-server=1.1.1.1 gateway=10.128.0.253
add address=192.168.88.0/24 gateway=192.168.88.1 netmask=24
/ip dns
set servers=1.1.1.1
/ip firewall nat
add action=masquerade chain=srcnat src-address=10.10.0.0/24
add action=masquerade chain=srcnat src-address=10.128.0.0/24 src-address-list=""
/ip route
add distance=1 gateway=192.168.1.1
/ip service
set telnet disabled=yes
set ftp disabled=yes
/lcd
set time-interval=hour
/system clock
set time-zone-name=Europe/Amsterdam
/system identity
set name=crs125
/system ntp client
set enabled=yes primary-ntp=194.109.6.67 secondary-ntp=194.109.9.100

RB2011 config

# software id = xxxx-xxxx
#
# model = 2011iL
# serial number = xxxxxxxxxxxx
/interface bridge
add name=bridge1
/interface ethernet switch port
set 1 vlan-header=add-if-missing vlan-mode=secure
set 2 default-vlan-id=3 vlan-header=always-strip vlan-mode=secure
set 3 default-vlan-id=10 vlan-header=always-strip vlan-mode=secure
set 4 default-vlan-id=128 vlan-header=always-strip vlan-mode=secure
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface bridge port
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface ethernet switch vlan
add independent-learning=yes ports=ether2,ether3 switch=switch1 vlan-id=3
add independent-learning=yes ports=ether2,ether4 switch=switch1 vlan-id=10
add independent-learning=yes ports=ether2,ether5 switch=switch1 vlan-id=128

Additional info

Create a static dhcp entry :  IP->DHCP Server->Leases->Make Static
OR
add address=10.1.0.2 mac-address=00:1E:EC:xx:xx:xx server=gen-dhcp comment=”laptop”

Connected device gets ip from pool
Change into static
Waiting until lease expires
D – Dynamic flag is gone, now also comments are enabled

Converting above from a dhcpd.conf file

cat dhcpd.conf | egrep "host|fixed-address|hardware" | grep -v \# | grep -A1 -B1 fixed-address |  sed -e 'N;N;s/\n/ /g' | awk '{ print $5" "$8" "$2 }' | tr -d ';' | cut -f-4 -d. | awk '{ print "add address="$1" mac-address="$2" server=gen-dhcp comment=\""$3"\"" }'

will give you:
add address=10.1.0.41 mac-address=2C:F4:32:xx:xx:xx server=gen-dhcp comment="tasmotawifiusb"
add address=10.1.0.42 mac-address=b8:27:eb:xx:xx:xx server=gen-dhcp comment="ledserver"
add address=10.1.0.46 mac-address=CC:50:E3:xx:xx:xx server=gen-dhcp comment="kliko"
etc

Static DNS

/ip dns static
add address=10.1.0.1 name=brewpi.example.com

from the dhcpd.conf static entries
cat dhcpd.conf | egrep "host|fixed-address|hardware" | grep -v \# | grep -A1 -B1 fixed-address |  sed -e 'N;N;s/\n/ /g' | awk '{ print $5" "$8" "$2 }' | tr -d ';' | awk '{ print "add address="$1" name="$3 }'

from bind service
cat zonefile | grep "10.1" | awk '{ print "add address="$3" name="$1".example.com" }'

FreeIPA

ipa dnsrecord-find exampel.lab | grep -B1 "A rec" | grep -v "\-\-" | sed 'N;s/\n//' | awk '{ print "add address="$6" name="$3".example.lab" }'


Faster DNS
Add 2 firewall rules
forward chain, udp 53 action fasttrack
forward chain, tcp 53 action fasttrack

Old and new computer games

Only the ones i’ve played recently or having good memories playing it.
Only noteworthy games

Pyramid Mummy pharaoh thingy ??? One of the first games i remember.
(Besides Pong on a “pong-only” system)

I’ve played a Mummy game in Black/White on a XZ81 or ZX Spectrum, one of the first Computers i had access to. (Richard)
But i can´t find/remember the name.

The Sentinel (1986)

https://classicreload.com/the-sentinel.html

https://en.wikipedia.org/wiki/The_Sentinel_(video_game)

In The Sentinel, the player takes the role of a Synthoid, a telepathic robot who has to take control of a number of surreal, checkered landscapes of hills and valleys, by climbing from the lowest spot, where the hunt begins, to the highest platform, over which the Sentinel looms.

The Synthoid itself cannot move across the level; instead it can look around, accumulate energy by absorbing the objects that are scattered across the landscape, create stacks of boulders, generate inert Synthoid shells and transfer its consciousness from one of these clones to another.

Kings Quest II? (1985)

Played this with my friend Richard on his Atari ST

Few years later, same kind of Game Engine:

Leisure suit larry in the land of the lounge lizards

The Myst series (1993-)

Carmageddon

The player races a vehicle against several other computers controlled competitors in various settings, including city, mine, and industrial areas. The player has a certain amount of time to complete each race, but more time may be gained by collecting bonuses, damaging the competitors’ cars, or by running over pedestrians. Unusually for a racing game, checkpoints do not extend the time limit.

7th Guest

The 7th Guest is an interactive movie puzzle adventure game, produced by Trilobyte and originally released by Virgin Interactive Entertainment in April 1993. It is one of the first computer video games to be released only on CD-ROM. The 7th Guest is a horror story told from the unfolding perspective of the player, as an amnesiac. The game received a great amount of press attention for making live action video clips a core part of its gameplay, for its unprecedented amount of pre-rendered 3D graphics, and for its adult content. In addition, the game was very successful, with over two million copies sold. It, alongside Myst, is widely regarded as a killer app that accelerated the sales of CD-ROM drives.

DOOM and Quake

Many many hours i’ve spend playing doom with Mandy on my first network (1995?)
Quake was my Graphics Card Checker, i never made it to level two!

Amiga

Shadow of the Beast, Super Frog ,The Sentinel, Game of Thrones and Dr Mario
https://www.youtube.com/watch?v=OuGilF0TwYA

And dual player Stunt Car Racer. We played this before there were networks, using a serial cable!

Simulators and more

I used to have Microsoft Flightsim (the old version) , but my main operating system is Linux so i switched to XPlane (Windows, linux and Mac) See other posts about Flightsims

VR games

We bought VR glasses.
Besides viewing movies in 3D, playing with Blender in 3D, Xplane flightsimulator there are some games i sometimes play.

I expect you to die, WWI Warplanes, Green Hell and Mass Exodus Redux. The last one is great fun together with a PC player.

Android games

Tried several games, non stuck.
I enjoyed “SpaceTeam” the most.
Current (dorment on my phone) : Mekorama, BinaryGrid2 (Yes Nerd), Dice me and 2 Player Reactor (those last two, for playing with friends while traveling)

Arcade games

I only knew Galaga, on a table version in Germany (We played there with the Concord Pipe Band)
The other one was
Hyper Olympics by Konami ( Snackbar “Lunch” when attending school LTS Deventer )

PC Games (Recent)

Uboot, Xplane Flightsimulator,Keep talking and nobody explodes
https://store.steampowered.com/app/494840/UBOAT/

Switch Games (Recent)

Limbo, Unravel Two, Death Squared,Machinarium,Degrees of Separation, Guacamelee 2
Mostly Co-op

Sidetrack … pinball

I really like the Terminator pinball game.
There is one in Zwolle at https://computermuseum.nl/
(This one i played when i was a soldier in 1992)
I have some test setups for Virtual Pinballs, but its not the same.

“Recent” old Skool games

https://www.henriaanstoot.nl/2021/11/21/retropi-handheld/

1942 – https://en.wikipedia.org/wiki/1942_(video_game)

Metal Slug series – https://en.wikipedia.org/wiki/Metal_Slug_2

Escape case work in progress

UPDATE: 20230214 more work done

Making a frame in a aluminum case, using rivets and nut rivets.

The nut rivet tool (suggestion by Duncan) is a superb addition in my tool shed!

There is place for 4 modules in this “test” case. I need to move the holes for the rivet-nuts, because the modules should go in every position.
(Also 4 rounded corners)

Module example https://www.henriaanstoot.nl/2022/12/20/connect-the-wires-puzzle/

TODO:

Alumium squares instead of these wooden temporary pieces.
Making a buildin power connector like this.
Think of something to place in the lid!

UPDATE: Didn’t go for this solution.

UPDATE: 20230214

Mobile Raspberry Access Point with Mqtt and a display

UPDATE: 20230214 / 20230224

Install Bullseye on a SDCard

Enable wifi country code using raspi-conf
(While you at it, enable I2C for the display)

Install and configure an Access Point

# As root
apt update
apt upgrade
apt install hostapd
apt install dnsmasq
systemctl stop hostapd
systemctl stop dnsmasq

cat <<EOF > /etc/hostapd/hostapd.conf
interface=wlan0
driver=nl80211
ssid=escape
hw_mode=g
channel=6
wmm_enabled=0
macaddr_acl=0
auth_algs=1
ignore_broadcast_ssid=0
wpa=2
wpa_passphrase=mysecretpass
wpa_key_mgmt=WPA-PSK
rsn_pairwise=CCMP
EOF

cat <<EOF >> /etc/dnsmasq.conf
interface=wlan0
bind-dynamic
domain-needed
bogus-priv
dhcp-range=192.168.50.150,192.168.50.200,255.255.255.0,12h
EOF

cat <<EOF >> /etc/dhcpcd.conf
interface wlan0
nohook wpa_supplicant
static ip_address=192.168.50.10/24
static routers=192.168.50.1
static domain_name_servers=8.8.8.8
EOF

sed -i s/#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/g /etc/sysctl.conf


mkdir /etc/nftables
cat <<EOF > /etc/nftables/nft-stat-ap.nft
flush ruleset

table inet ap {
        chain routethrough {
                type nat hook postrouting priority filter; policy accept;
                oifname "eth0" masquerade
        }

        chain fward {
                type filter hook forward priority filter; policy accept;
                iifname "eth0" oifname "wlan0" ct state established,related accept
                iifname "wlan0" oifname "eth0" accept
        }
}
EOF

chmod +x /etc/nftables/nft-stat-ap.nft
cat /etc/nftables.conf | grep nft-stat-ap.nft || echo 'include "/etc/nftables/nft-stat-ap.nft"' >> /etc/nftables.conf

systemctl unmask hostapd
systemctl enable hostapd
systemctl enable nftables

reboot

UPDATE: 20230214

Now in its case, added two buttons and one led.

UPDATE : 20230224 mqtt config

apt-get install mosquitto mosquitto-clients

vi /etc/mosquitto/conf.d/remotemqtt.conf
per_listener_settings true
# internal mqtt
listener 1883
allow_anonymous true
# connection over the internet
connection bridge-01
address remoteserver:8883
bridge_cafile /etc/mosquitto/certs/ca.crt
bridge_keyfile /etc/mosquitto/certs/remoteaccesspoint.key
bridge_certfile /etc/mosquitto/certs/remoteaccesspoint.crt
topic escape/# both 0
remote_username remoteuser
remote_password remotepass

########## remote server config

cd /etc/mosquitto
mosquitto_passwd passwords remoteuser

cd /etc/mosquitto/certs
./generate-CA.sh client remoteaccesspoint

copy ca.crt remoteaccesspoint.key and remoteaccesspoint.crt to accesspoint

mosquitto.conf
pid_file /var/run/mosquitto.pid
persistence true
persistence_location /var/lib/mosquitto/
#per_listener_settings true
# Plain MQTT protocol
listener 1883
allow_anonymous true
# End of plain MQTT configuration
# MQTT over TLS/SSL
listener 8883
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/webserver.fash.lab.crt
keyfile /etc/mosquitto/certs/webserver.fash.lab.key
allow_anonymous false
password_file /etc/mosquitto/passwords
# End of MQTT over TLS/SLL configuration
listener 9001
protocol websockets
# End of plain Websockets configuration
# WebSockets over TLS/SSL
listener 9883
protocol websockets
cafile /etc/mosquitto/certs/ca.crt
certfile /etc/mosquitto/certs/webserver.fash.lab.crt
keyfile /etc/mosquitto/certs/webserver.fash.lab.key
log_dest file /var/log/mosquitto/mosquitto.log
include_dir /etc/mosquitto/conf.d
connection bridge-01
address extramqttserver:1883
topic lscspm1/# both 0
topic owntracks/# both 0
topic escape/# both 0

log_type all


Controlling Display and MQTT messages examples

apt-get install python3-smbus

python3 printline.py -1 "line 1" -2 "line 2"

wget https://github.com/emcniece/rpi-lcd/blob/master/RPi_I2C_driver.py

cat printline.py
# requires RPi_I2C_driver.py
import RPi_I2C_driver
from time import *
import sys, getopt

#python3 fix
unichr = chr 

mylcd = RPi_I2C_driver.lcd()
# test 2                  1234567812345678


def main(argv):
   line1 = ''
   line2 = ''
   try:
      opts, args = getopt.getopt(argv,"h1:2:",["txt1=","txt2="])
   except getopt.GetoptError:
      print ('printline.py -1 <line1> -2 <line2>')
      sys.exit(2)
   for opt, arg in opts:
      if opt == '-h':
         print ('printline.py -1 <line1> -2 <line2>')
         sys.exit()
      elif opt in ("-1", "--txt1"):
         line1 = arg
      elif opt in ("-2", "--txt2"):
         line2 = arg

   mylcd.lcd_display_string(line1, 1)
   mylcd.lcd_display_string(line2, 2)
if __name__ == "__main__":
   main(sys.argv[1:])

Print internal and external ip

myip=$(/usr/sbin/ifconfig eth0 | grep "inet " | awk '{ print $2 }')
extip=$(curl -s http://whatismyip.akamai.com/)
python3 printline.py -1 "i $myip" -2 "e $extip"

mosquitto health tester

timeout 1 mosquitto_sub -t '$SYS/#' -C 1 | grep -v Error || exit 1

Button press shutdown

raspi-gpio get 27  | grep level=0 >/dev/null 
if [ $? == 0 ] ; then

python3 printline.py -1 "shutting" -2 "down"
/usr/sbin/halt -p
fi

Cleaned-up minimal mqtt poster

#include <WiFi.h>
#include <PubSubClient.h>

const char* ssid = "ssidname";
const char* password = "ssidpass";
const char* mqttServer = "192.168.50.10";

WiFiClient espClient;
PubSubClient client(espClient);


void initWiFi() {
  WiFi.mode(WIFI_STA);
  WiFi.begin(ssid, password);
  Serial.print("Connecting to WiFi ..");
  while (WiFi.status() != WL_CONNECTED) {
    Serial.print('.');
    delay(1000);
  }
  Serial.println(WiFi.localIP());
}


void setup() {
Serial.begin(115200);
initWiFi();
  Serial.print("RRSI: ");
  Serial.println(WiFi.RSSI());
    client.setClient(espClient);
    client.setServer(mqttServer,1883);
 if (client.connect("testmodule")) {

      Serial.println("connected");
 client.publish("escape/testclient", "connected");
    } else {
            Serial.println("Mqtt not connected");
    }

}

void loop() {
        }

}