\n# Remove in \/etc\/dhcp\/dhclient.conf the classless static route option\nsudo nano \/etc\/dhcp\/dhclient.conf\n\n# Old entries:\noption rfc3442-classless-static-routes code 121 = array of unsigned integer 8;\n\nrequest subnet-mask, broadcast-address, time-offset, routers, domain-name,\ndomain-name-servers, domain-search, host-name, dhcp6.name-servers,\ndhcp6.domain-search, dhcp6.fqdn, dhcp6.sntp-servers, netbios-name-servers,\nnetbios-scope, interface-mtu, rfc3442-classless-static-routes, ntp-servers; \n\n# New entries:\n#option rfc3442-classless-static-routes code 121 = array of unsigned integer 8;\n\nrequest subnet-mask, broadcast-address, time-offset, routers, domain-name,\ndomain-name-servers, domain-search, host-name, dhcp6.name-servers,\ndhcp6.domain-search, dhcp6.fqdn, dhcp6.sntp-servers, netbios-name-servers,\nnetbios-scope, interface-mtu, ntp-servers;\n<\/pre><\/div>\n\n\n\u2022 \u2022 \u2022<\/p><\/h1>\n\n\n\n
6. Setting up network interfaces<\/h5>\n\n\n\n
Currently, TorBox supports the following connections:<\/p>\n\n\n
\nINTERNET CLIENT\u00a0\u00a0\u00a0\u00a0\u00a0 Remarks\n--------------------------------------------------------------------------------------------\nETH0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 WLAN0(+ETH1+TUN1)\u00a0\u00a0\u00a0\u00a0 Ethernet cable (eth0) or TorBox on a cloud (tun1)\nETH1 WLAN0(+ETH0)\u00a0 USB ethernet adapter or Tethering (iOS)\nWLAN1\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 WLAN0(+ETH0)\u00a0\u00a0\u00a0\u00a0 Wireless network (USB adapter; wlan1)\nWLAN0\u00a0\u00a0\u00a0\u00a0\u00a0 WLAN1(+ETH0+USB0)\u00a0\u00a0\u00a0\u00a0 Wireless network or TorBox mini (onboard chip; wlan0)\nUSB0\t WLAN0(+ETH0)\u00a0\u00a0\u00a0\u00a0 USB dongle or Tethering (Android) (usb0)\nPPP0 WLAN0(+ETH0)\u00a0\u00a0\u00a0\u00a0 Cellular-internet\nTUN0 WLAN0(+ETH0)\u00a0 Over a VPN connection\n<\/pre><\/div>\n\n\n\u00a0In the beginning, only the standard \/etc\/network\/interface<\/code> — listed below — is necessary. Depending on your choice in the TorBox menu, this file is automatically altered by TorBox.<\/p>\n\n\n\n# Edit \/etc\/network\/interfcae:\nsudo nano \/etc\/network\/interface\n\n# Replace \/etc\/network\/interface with the following content:\n\n# source-directory \/etc\/network\/interfaces.d\n\nauto lo\nauto eth0\nauto wlan1\nauto usb0\n\niface lo inet loopback\niface eth0 inet dhcp\niface wlan1 inet dhcp\niface usb0 inet dhcp\nallow-hotplug wlan0 wlan1 eth0 eth1 usb0\n\niface wlan0 inet static\n address 192.168.42.1\n netmask 255.255.255.0\n\twireless-power off\n\niface eth1 inet static\n address 192.168.43.1\n netmask 255.255.255.0\n<\/pre><\/div>\n\n\n\u2022 \u2022 \u2022<\/p><\/h1>\n\n\n\n
7. Configuring the TorBox AP<\/h5>\n\n\n\n# Edit \/etc\/hostapd\/hostapd.conf\nsudo nano \/etc\/hostapd\/hostapd.conf\n\n# Replace \/etc\/hostapd\/hostapd.conf with the following content:\ninterface=wlan0\ndriver=nl80211\nssid=TorBox055\ncountry_code=US\nhw_mode=g\nchannel=6\nieee80211n=1\nieee80211ac=1\nwmm_enabled=1\n#ht_capab=[HT40-][HT40+][SHORT-GI-20][SHORT-GI-40][DSSS_CCK-40]\n#vht_oper_chwidth=1\n#vht_oper_centr_freq_seg0_idx=42\nmacaddr_acl=0\nauth_algs=1\nignore_broadcast_ssid=0\nwpa=2\nwpa_passphrase=CHANGE-IT\nwpa_key_mgmt=WPA-PSK\nrsn_pairwise=CCMP\n<\/pre><\/div>\n\n\nImportant<\/strong><\/p>\n\n\n\n\n- Only letters (upper and lower case) and numbers are allowed in the passphrase. The length must be between 8 and 63 characters.<\/li>\n\n\n\n
- Don’t remove or change the “#-lines” and the
country_code=US<\/code> value! Otherwise, the 2.4 GHz 40 MHz and the 5 GHz 40 and 80 MHz settings will probably not work and will crash hostapd! In use, TorBox changes this file along with the selection in the configuration sub-menu. However, if you delete values (even those with #), TorBox doesn’t re-add them!<\/li>\n<\/ol>\n\n\n\n# Edit \/etc\/default\/hostapd\nsudo nano \/etc\/default\/hostapd\n\n# Old entry:\n#DAEMON_CONF=\"\"\n\n# New entry:\nDAEMON_CONF=\"\/etc\/hostapd\/hostapd.conf\"\n<\/pre><\/div>\n\n\nThis ensures the services start automatically when TorBox starts, and they also start immediately.<\/p>\n\n\n
\nsudo systemctl unmask hostapd\nsudo systemctl enable hostapd\nsudo systemctl start hostapd\nsudo systemctl unmask isc-dhcp-server\nsudo systemctl enable isc-dhcp-server\nsudo systemctl start isc-dhcp-server\nsudo systemctl disable dhcpcd\nsudo systemctl daemon-reload\n<\/pre><\/div>\n\n\n\u2022 \u2022 \u2022<\/p><\/h1>\n\n\n\n
8. Configuring Network Address Translation (NAT)<\/h5>\n\n\n\necho 'net.ipv4.ip_forward=1' | sudo tee \/etc\/sysctl.d\/99-ipforward.conf\nsudo sysctl -p \/etc\/sysctl.d\/99-ipforward.conf\n\n# With the following command, we have to enable IP forwarding (necessary to overcom captive portals):\nsudo sh -c "echo 1 > \/proc\/sys\/net\/ipv4\/ip_forward"\n<\/pre><\/div>\n\n\n\u2022 \u2022 \u2022<\/p><\/h1>\n\n\n\n
9. Configuring Nginx to work with WebSSH and Onion Services<\/h5>\n\n\n\n
The default Nginx configuration works fine, but we need to allow uploads larger than 1 MB. Setting client_max_body_size to 0<\/code> removes the size limit. Of course, there is also the possibility of setting another, bigger size limit than 1 Mb. For security reasons, we also recommend setting server_tokens<\/code> to off<\/code> to hide the Nginx server version on error pages.<\/p>\n\n\n\n# Edit \/etc\/nginx\/nginx.conf:\nsudo nano \/etc\/nginx\/nginx.conf\n\n# Old entries:\nclient_max_body_size 1m;\n\n# New entry:\nclient_max_body_size 0;\nserver_tokens off;\n<\/pre><\/div>\n\n\nNginx also has an annoying behaviour: it doesn’t remove the socket files in \/var\/run<\/code> during a restart or when closing down. When starting again, Nginx complains about these existing socket files. Currently, in TorBox, we handle this in the script by looking for unused socket files and deleting them. Nevertheless, we recommend implementing this change to the \/etc\/init.d\/nginx<\/code>, which is recommended here by using the following command:<\/p>\n\n\n\nsudo sed \"s|STOP_SCHEDULE=\"${STOP_SCHEDULE:-QUIT\/5\/TERM\/5\/KILL\/5}\"|STOP_SCHEDULE=\"${STOP_SCHEDULE:-TERM\/5\/KILL\/5}\"|g\" \/etc\/init.d\/nginx\n<\/pre><\/div>\n\n\nAlso, we don’t need the example configuration and HTML file, but the configuration file for WebSSH:<\/p>\n\n\n
\nsudo rm \/etc\/nginx\/sites-enabled\/default\nsudo rm \/etc\/nginx\/sites-available\/default\nsudo rm -r \/var\/www\/html\n\n# This is necessary for Nginx \/ TFS\nsudo chown torbox:torbox \/var\/www\n\nsudo cp etc\/nginx\/sites-available\/sample-webssh.conf \/etc\/nginx\/sites-available\/webssh.conf\nsudo ln -sf \/etc\/nginx\/sites-available\/webssh.conf \/etc\/nginx\/sites-enabled\/\n<\/pre><\/div>\n\n\n\u2022 \u2022 \u2022<\/p><\/h1>\n\n\n\n
10. Disable Bluetooth<\/h5>\n\n\n\n
For security reasons, we recommend disabling Bluetooth on your Raspberry Pi.<\/p>\n\n\n
\n# Change your \/boot\/config.txt:\nsudo nano \/boot\/firmware\/config.txt\n\n# Add to the end of \/boot\/firmware\/config.txt:\ndtoverlay=disable-bt\n\n# NEW v.0.5.5: hciuart removed because it is not anymore used in the latest Raspberry Pi OS\n# Run following command to disable the related services:\nsudo systemctl stop bluetooth.service\nsudo systemctl disable bluetooth.service\nsudo systemctl mask bluetooth.service\nsudo systemctl daemon-reload\nsudo apt-get purge -y bluez bluez-firmware pi-bluetooth\nsudo apt-get -y autoremove\nsudo rfkill block bluetooth\n<\/pre><\/div>\n\n\nYou have to reboot your Raspberry Pi to apply the changes.<\/p>\n\n\n\n
\u2022 \u2022 \u2022<\/p><\/h1>\n\n\n\n
![\"\"](\"http:\/\/www.torbox.ch\/wp-content\/uploads\/2018\/01\/download_button-300x74.png\")
<\/a>