pixelserv pixelserv - A Better One-pixel Webserver for Adblock

[martinr]

Run pixelserv-tls -B

And see if it does a benchmark test.


Sent from my iPhone using Tapatalk

Thank you

I see lines “generate cert to disk” and each takes around 14.5ms

Load from disk average is 14.617 sec

 

[Asad Ali]

Thank you

I see lines “generate cert to disk” and each takes around 14.5ms

Ok then pixelserv-tls is indeed installed and running. Did you try after a complete reboot?

 

[martinr]

Ok then pixelserv-tls is indeed installed and running. Did you try after a complete reboot?

No, I’m ashamed to admit I haven’t yet tried that!

 

[Asad Ali]

Still looking for a solution to make the pixelserv IP visible to computers on the guest networks. Is this something I could do with an iptables rule maybe? Most of the devices at my place are on guest networks, but unfortunately that means ABS & PS are of limited utility, unless I can get this visibility thing figured out.

something like...

iptables --append INPUT --match tcp --protocol tcp --src 192.168.10.1/24 --dst 192.168.10.3 --jump ACCEPT

The easiest way to do that is to allow guest network to access Intranet, but that approach is not for everyone since the guests can too access your internal network ( assuming they know the security credentials)

 

[martinr]

Ok then pixelserv-tls is indeed installed and running. Did you try after a complete reboot?

Surprisingly, a reboot didn’t fix it. I’ll sleep on it and try again tomorrow. Maybe a bit of perseverence will work.

 

[Twiglets]

Surprisingly, a reboot didn’t fix it. I’ll sleep on it and try again tomorrow. Maybe a bit of perseverence will work.

As typing bits of scripts seems to trigger 'cloudflare' blocking your account I have screen captured the text I want to type
Please read and advise what you get as a result.

(Yes .... I know the explaination/text is wrong, I changed what I was doing mid typing and could not be bothered to change the text for the screen cap !!! )

 

[Asad Ali]

Hey @kvic so I just did a clean reinstall of Entware, Pixelserv-tls and ABS and after that when I try to update the libopenssl library to the updated one you posted using this one liner:

opkg install http://bin.entware.net/aarch64-k3.10/test/libopenssl_1.0.2n-1c_aarch64-3.10.ipk

I get this error:

admin@RT-AC86U:/tmp/home/root# opkg install http://bin.entware.net/aarch64-k3.10/test/libopenssl_1.0.2n-1c_aarch64-3.10.ipk
Downloading http://bin.entware.net/aarch64-k3.10/test/libopenssl_1.0.2n-1c_aarch64-3.10.ipk
Package libopenssl (1.0.2o-1) installed in root is up to date.

Output of:

opkg list-installed |grep libopenssl
libopenssl - 1.0.2o-1

I'm trying this on Asus RT-AC86U ( ARM V8 64-bit ) and on latest Merlin FW ( 384.5 ) so is the error telling the truth and it's actually the updated version or ther's some bug in disguise?

 

[JaimeZX]

The easiest way to do that is to allow guest network to access Intranet, but that approach is not for everyone since the guests can too access your internal network ( assuming they know the security credentials)

Thanks. Then I have the reverse problem, and would need to DROP all packets from the guest networks NOT going to pixelserv. I don't trust the machines on the Guest networks, which is why they're not on my main network.

Appreciate your thought though!

 

[Asad Ali]

Thanks. Then I have the reverse problem, and would need to DROP all packets from the guest networks NOT going to pixelserv. I don't trust the machines on the Guest networks, which is why they're not on my main network.

Appreciate your thought though!

I think what you need to do can be done by playing with iptables but I'm no way an expert in that to help you out there lol but Im sure @Martineau will be able to

 

[JaimeZX]

We'll see. I created a separate post in the "Security" subforum but no love yet.
https://www.snbforums.com/threads/any-experts-with-iptables-here.46702/

 

[kvic]

Hey @kvic so I just did a clean reinstall of Entware, Pixelserv-tls and ABS and after that when I try to update the libopenssl library to the updated one you posted using this one liner:

I believe there was an Entware update in the middle of May.

Good news is pixelserv-tls 2.1.1 is available on Entware as well as a new version of libopenssl v1.0.2o.

The previous prod version of libopenssl was v1.0.2n-1b and the test lib was v1.0.2n-1c. Both are older than the latest v1.0.2o. Hence, you cannot install the test lib without workaround.

The bad news is that I think libopenssl v1.0.2o does not have the special flag enabled as per this ticket. Paging @ryzhov_al @zyxmon

Workaround

Uninstall v1.0.2o

$ opkg --force-depends remove libopenssl

After that re-run the commands as per installing the test lib as before.

My quick tests show the test library is still compatible with all my installed packages (a lot!) that depend on libopenssl.

 

[kvic]

When running code

sh -c "$(wget -qO - https://kazoo.ga/pixelserv-tls/config-webgui.sh)"

to issue a certificate to the webGUI, I see the message that I either don’t have pixelserv installed or running.

I have version 2.1.1 installed and I can obtain servstats in my browser. I can also ping the server (from the router command prompt).

Are you running the config-webgui.sh on the same router that you're running pixelserv-tls ? They need to be on the same machine.

If already so, then check "ps | grep pixelserv" to see what you get.

 

[Asad Ali]

Workaround

Uninstall v1.0.2o

$ opkg --force-depends remove libopenssl

After that re-run the commands as per installing the test lib as before.

My quick tests show the test library is still compatible with all my installed packages (a lot!) that depend on libopenssl.

Looks like they are redirecting the test files URL to the latest version too :/

admin@RT-AC86U:/tmp/home/root# opkg --force-depends remove libopenssl
Removing package libopenssl from root...
admin@RT-AC86U:/tmp/home/root# opkg install http://bin.entware.net/aarch64-k3.10/test/libopenssl_1.0.2n-1c_aarch64-3.10.ipk
Downloading http://bin.entware.net/aarch64-k3.10/test/libopenssl_1.0.2n-1c_aarch64-3.10.ipk
Installing libopenssl (1.0.2o-1) to root...
Downloading http://bin.entware.net/aarch64-k3.10/libopenssl_1.0.2o-1_aarch64-3.10.ipk
Configuring libopenssl.
admin@RT-AC86U:/tmp/home/root# /opt/etc/init.d/S80pixelserv-tls restart
 Shutting down pixelserv-tls...              done.
 Starting pixelserv-tls (AB-Solution)...              done.
admin@RT-AC86U:/tmp/home/root# opkg list-installed |grep libopenssl
libopenssl - 1.0.2o-1
admin@RT-AC86U:/tmp/home/root#

 

[mrchow]

Looks like they are redirecting the test files URL to the latest version too :/

admin@RT-AC86U:/tmp/home/root# opkg --force-depends remove libopenssl
Removing package libopenssl from root...
admin@RT-AC86U:/tmp/home/root# opkg install http://bin.entware.net/aarch64-k3.10/test/libopenssl_1.0.2n-1c_aarch64-3.10.ipk
Downloading http://bin.entware.net/aarch64-k3.10/test/libopenssl_1.0.2n-1c_aarch64-3.10.ipk
Installing libopenssl (1.0.2o-1) to root...
Downloading http://bin.entware.net/aarch64-k3.10/libopenssl_1.0.2o-1_aarch64-3.10.ipk
Configuring libopenssl.
admin@RT-AC86U:/tmp/home/root# /opt/etc/init.d/S80pixelserv-tls restart
 Shutting down pixelserv-tls...              done.
 Starting pixelserv-tls (AB-Solution)...              done.
admin@RT-AC86U:/tmp/home/root# opkg list-installed |grep libopenssl
libopenssl - 1.0.2o-1
admin@RT-AC86U:/tmp/home/root#

Download the ipk manually and install it by specifying its' path. The file on the server looks good and hasn't been touched since the beginning of April.

'opkg --force-depends remove libopenssl' broke my entware install anyway.. wget stopped working.. I just copied the file to the router via scp and installed it by specifying the path of the ipk.

On a side note I have some troubles with pixelserv-tls.. After a while it's just dead... I have tried to reproduce it but to no avail.. I'll enable debug logging again.
All of this happened after a fresh install of the router (I reused the /jffs and /opt partitions thought).

 

[martinr]

Are you running the config-webgui.sh on the same router that you're running pixelserv-tls ? They need to be on the same machine.

If already so, then check "ps | grep pixelserv" to see what you get.

Yes, only the one router.

And ps | grep pixelserv does nothing: I simply get the command prompt again with no message of any sorts.

However, pinging the pixelserv server works, as does servstats in the browser, and checking the status of pixelserv through AMTM shows it as ON.

 

[kvic]

Looks like they are redirecting the test files URL to the latest version too :/

That weird and I haven't seen before. Download the test lib manually and install from local copy should do.

'opkg --force-depends remove libopenssl' broke my entware install anyway.. wget stopped working..

Entware's wget package depends on libopenssl. Its wget-nossl has no such dependency. Install from local directory will do as you've found out.

On a side note I have some troubles with pixelserv-tls.. After a while it's just dead... I have tried to reproduce it but to no avail.. I'll enable debug logging again.
All of this happened after a fresh install of the router (I reused the /jffs and /opt partitions thought).

Unresponsive or crash? More descriptions of the problem may help.

 

[kvic]

Yes, only the one router.

And ps | grep pixelserv does nothing: I simply get the command prompt again with no message of any sorts.

However, pinging the pixelserv server works, as does servstats in the browser, and checking the status of pixelserv through AMTM shows it as ON.

I made a small change to the script. Pls try config-webgui.sh again.

I believe it shall resolve your problem..

 

[kvic]

Thanks very much for looking after us ER and MIPS users, in due course when you are ready I'll be happy to do any testing.

pixelserv-tls 2.1.1 Debian packages are available for Edgerouters (both mipsel and 64-bit mips). You may get it from GitHub.

A guide on installing v2.0.1 on ER-X. It still applies (and applies to 64-bit mips as well). Remember to substitute with v2.1.1 package file.

 

[Asad Ali]

Download the ipk manually and install it by specifying its' path. The file on the server looks good and hasn't been touched since the beginning of April.

That weird and I haven't seen before. Download the test lib manually and install from local copy should do

Thanks guys, manual installation works.

 

[mrchow]

Unresponsive or crash? More descriptions of the problem may help.

Sorry for the late reply. Wanted to observe the issue again. So it crashed again (process is not running anymore). It may be related to the fact that I blocked rgom10-en.url.trendmicro.com. I'll unblock it and try it again

here's some of the log-output right before the crash (last pixelserv-tls activity): https://hastebin.com/uhurimufuh.pl