Posted by Grommish on Jun 26, 2019; 9:30pm
URL: https://itus.accessinnov.com/FIRMWARE-Itus-Networks-Shield-Firmware-Upgrade-WIP-tp1726p1780.html

Hey Roadrunnere42,

My test versions are running Snort 2.13.9 (latest non-beta version).  I'm not sure about previous versions, but my current test is running a single Snort Config with DAQ afpacket (nfq isn't working right at the moment, I'm looking into it) in inline mode covering both eth0 and br-lan.  I have noticed that doing this, I can no longer use SSH to github, so I think there is a rule blocking outbound ssh.  This is why I was asking about the concurrently running Snort (one for WAN, one for LAN).  snort7/snort8 was setup this was, right?  Any idea which one was which?

I asked about you and Lua because I saw that most of the commits on Github were credited to you :)

I do my testing on the Shield itself.  Because I use the Gateway slot, I can leave the other two slots alone.  This allows me to do a recovery if I have to without going through the tftp process.  I'll point out that the only difference between the 3 modes is the image uboot picks on boot.  Programmatically, there isn't anything that keeps "Gateway" from being "Router", for example.

If you want a test build, I'll email you a send.firefox.com link and you can follow the directions in the first post.

The question is, do you want a version that doesn't change the mmcblk1p3 mount (changes don't survive reboots) or one that does (changes will survive reboots).  If you're not using the Gateway spot, the one that changes the mmcblk1p3 is best, since it allows you to experiment more.  Just let me know.

If you WANT to build out from source, you should be able to by getting the github source.  The only thing that might cause issues in building out the source yourself is the fact that I haven't kept track of what host packages are required, so you'd probably have to work through the build dependencies when they error.  My ubuntu box serves no purpose other than development, so I have no issues with throwing any packages on the system that I need .

Anyway, let me know..

Roadrunnere42 wrote

Hi Grommish
I was under the impression that snort could not do multi tasking, so itus
has one instant of snort running on each core, I could be wrong.

With regards to doing Lua for luCi i did look into it a few years back but
could not work out do i learn Lua or luCi. I could not find any learning
docs for luCi.

How are you doing testing with openwrt on the Shield, do you work things
out in a vm running openwrt and then copy to the Shield?

I also ran ipvar HOME_NET [10.0.0.0/8,172.16.0.0/12,192.168.1.0/16] instead
of ipvar HOME_NET any on my Shield, but left it out on any upgrade because
it had a side effect which messed things up for some people, but you right
not to use  ipvar HOME_NET any.

Do i have to build a firmware image from github and then copy over a you
said at the beginning of these emails.

Roadrunnere42