From a52af3b50a74fea0ecf3168a984085816a2f93a2 Mon Sep 17 00:00:00 2001 From: CyberMind-FR Date: Sat, 27 Jun 2026 17:11:23 +0200 Subject: [PATCH] feat(netplan): standardize SecuBox LAN to 192.168.10.0/24; bump 1.10.0 (ref #760) Default br-lan 192.168.1.1/24 collided with common ISP-router LANs (Freebox/Livebox 192.168.1.0/24) when the appliance sits behind one: WAN(DHCP)+LAN land on the same subnet -> duplicate route, ARP ambiguity, unreachable mgmt IP. Observed live on c3box behind a Freebox. - All board netplans (mochabin, espressobin-v7/ultra, x64-vm, x64-live) + VM LANs (vm-x64, vm-arm64) -> br-lan/LAN 192.168.10.1/24 - Generators: secubox-netmodes (inline + router.yaml.j2 template), secubox-hub preview, secubox-net-detect - dnsmasq (espressobin-v7.conf): dhcp-range + option:router + dns-server - live-usb build scripts + self-signed cert SANs -> IP:192.168.10.1 - Out of scope (untouched): 192.168.255.1 mgmt/trusted-proxy whitelist, WAN-probe GATEWAYS lists, remote-ui/round + tests - Minor "medium" bump 1.9.0 -> 1.10.0 (core build scripts; mochabin-live stays on its 2.0.0 track) Live: c3box br-lan already 192.168.10.1/24 + netmodes template aligned; gk2 WAN moved to eth2 DHCP @ .200 (Freebox reservation on eth2 MAC). --- .claude/HISTORY.md | 33 +++++++++++++++++++ .../espressobin-ultra/netplan/00-secubox.yaml | 2 +- board/espressobin-v7/netplan/00-secubox.yaml | 2 +- board/mochabin/netplan/00-secubox.yaml | 2 +- board/vm-arm64/netplan/00-secubox.yaml | 2 +- board/vm-x64/netplan/00-secubox.yaml | 2 +- board/x64-live/netplan/00-secubox.yaml | 2 +- board/x64-vm/netplan/00-secubox.yaml | 2 +- image/build-ebin-live-usb.sh | 4 +-- image/build-image.sh | 4 +-- image/build-live-usb.sh | 6 ++-- image/build-mochabin-live-usb.sh | 2 +- image/build-rpi-usb.sh | 4 +-- image/firstboot.sh | 4 +-- image/profiles/espressobin-v7.conf | 8 ++--- image/sbin/secubox-net-detect | 4 +-- packages/secubox-hub/api/main.py | 2 +- packages/secubox-netmodes/api/main.py | 2 +- .../secubox-netmodes/templates/router.yaml.j2 | 4 +-- 19 files changed, 62 insertions(+), 29 deletions(-) diff --git a/.claude/HISTORY.md b/.claude/HISTORY.md index aab29672..e405e1eb 100644 --- a/.claude/HISTORY.md +++ b/.claude/HISTORY.md @@ -3,6 +3,39 @@ --- +## 2026-06-27 — LAN standardisé 192.168.10.0/24 + c3box/gk2 live Freebox + bump 1.10.0 (#760) + +Session terrain "c3box derrière Freebox" : la LAN SecuBox par défaut (`br-lan 192.168.1.1/24`) +entrait en collision avec la LAN d'un routeur opérateur courant (Freebox/Livebox en +`192.168.1.0/24`). En aval d'une Freebox, le WAN DHCP et la LAN se retrouvaient sur le **même +sous-réseau** → route dupliquée, ARP ambigu, IP de management injoignable. + +### A. Constat live + remédiation immédiate +- **c3box** (second MOCHAbin) derrière Freebox : WAN `eth2=192.168.1.94` (bail Freebox) + + `br-lan=192.168.1.1/24` → `.94` injoignable depuis le LAN. Corrigé live : `br-lan → 192.168.10.1/24`. + SSH root activé, webadmin `https://192.168.1.94/` OK, `/dev/sda1` (931 G) monté sur `/data` + (style gk2 : UUID + nofail), partition eMMC retirée (`emmc-data`). +- **gk2** (live PoC) : uplink déplacé de `lan0` (DSA) vers le port cuivre WAN `eth2` ; netplan + réparé via **série** (gk2 hors-réseau le temps du switch) → `eth2 dhcp4: true`, `lan0` dépouillé. + Bail Freebox réservé sur le MAC eth2 `f0:ad:4e:27:88:9b` → gk2 reprend `192.168.1.200`. Persisté. + +### B. Standardisation source (LAN = 192.168.10.0/24, gw .10.1) — 17 fichiers +- Netplans board : mochabin, espressobin-v7, espressobin-ultra, x64-vm, x64-live (`br-lan`), + + unification VM vm-x64/vm-arm64 (`192.168.100.1 → 192.168.10.1`). +- Générateurs de netplan : `secubox-netmodes`, `secubox-hub` (preview), `secubox-net-detect`. +- dnsmasq (`espressobin-v7.conf`) : `dhcp-range` + `option:router` + `option:dns-server`. +- Scripts live-usb (mochabin/ebin) + SAN des certs auto-signés (`firstboot`, `build-image`, + `build-rpi-usb`, `build-live-usb`) → `IP:192.168.10.1`. +- **Hors scope (intacts)** : `192.168.255.1` (whitelist mgmt/trusted-proxy WAF/mail/wg/mitm), + listes `GATEWAYS` de sonde WAN, exemples remote-ui/round + tests. + +### C. Release +- Bump mineur (« medium ») **1.9.0 → 1.10.0** : `build-image.sh`, `build-live-usb.sh`, + `build-ebin-live-usb.sh`, `build-rpi-usb.sh` (mochabin-live reste sur sa piste 2.0.0). +- Artefacts amd64 (x64) reconstruits depuis cette base. + +--- + ## 2026-06-27 — Netboot live PROUVÉ + première install SecuBox Debian sur c3box (second MOCHAbin) (#748 #737) Grande session hardware : netboot gk2→c3box validé de bout en bout, premier SecuBox Debian installé diff --git a/board/espressobin-ultra/netplan/00-secubox.yaml b/board/espressobin-ultra/netplan/00-secubox.yaml index 28ea50f6..c3a78b50 100644 --- a/board/espressobin-ultra/netplan/00-secubox.yaml +++ b/board/espressobin-ultra/netplan/00-secubox.yaml @@ -19,7 +19,7 @@ network: bridges: br-lan: interfaces: [lan0, lan1, lan2, lan3] - addresses: [192.168.1.1/24] + addresses: [192.168.10.1/24] dhcp4: false parameters: stp: false diff --git a/board/espressobin-v7/netplan/00-secubox.yaml b/board/espressobin-v7/netplan/00-secubox.yaml index 901998e8..ca458a55 100644 --- a/board/espressobin-v7/netplan/00-secubox.yaml +++ b/board/espressobin-v7/netplan/00-secubox.yaml @@ -44,7 +44,7 @@ network: bridges: br-lan: interfaces: [lan0, lan1] - addresses: [192.168.1.1/24] + addresses: [192.168.10.1/24] dhcp4: false parameters: stp: false diff --git a/board/mochabin/netplan/00-secubox.yaml b/board/mochabin/netplan/00-secubox.yaml index 0f58ac71..5bc05063 100644 --- a/board/mochabin/netplan/00-secubox.yaml +++ b/board/mochabin/netplan/00-secubox.yaml @@ -37,7 +37,7 @@ network: # Bridge LAN br-lan: interfaces: [eth1, eth3, eth4] - addresses: [192.168.1.1/24] + addresses: [192.168.10.1/24] dhcp4: false parameters: stp: false diff --git a/board/vm-arm64/netplan/00-secubox.yaml b/board/vm-arm64/netplan/00-secubox.yaml index 574c762b..10d7fdd2 100644 --- a/board/vm-arm64/netplan/00-secubox.yaml +++ b/board/vm-arm64/netplan/00-secubox.yaml @@ -13,7 +13,7 @@ network: # LAN — Interface 2 QEMU (si configurée) enp0s2: - addresses: [192.168.100.1/24] + addresses: [192.168.10.1/24] dhcp4: false optional: true diff --git a/board/vm-x64/netplan/00-secubox.yaml b/board/vm-x64/netplan/00-secubox.yaml index 49ee0ae0..9d74a4e8 100644 --- a/board/vm-x64/netplan/00-secubox.yaml +++ b/board/vm-x64/netplan/00-secubox.yaml @@ -14,7 +14,7 @@ network: # LAN — Interface 2 VirtualBox (Internal Network ou Host-Only) enp0s8: - addresses: [192.168.100.1/24] + addresses: [192.168.10.1/24] dhcp4: false optional: true diff --git a/board/x64-live/netplan/00-secubox.yaml b/board/x64-live/netplan/00-secubox.yaml index 0e5d9553..1ed64889 100644 --- a/board/x64-live/netplan/00-secubox.yaml +++ b/board/x64-live/netplan/00-secubox.yaml @@ -64,7 +64,7 @@ network: br-lan: interfaces: [] addresses: - - 192.168.1.1/24 + - 192.168.10.1/24 dhcp4: false optional: true parameters: diff --git a/board/x64-vm/netplan/00-secubox.yaml b/board/x64-vm/netplan/00-secubox.yaml index daedb7d3..174c2408 100644 --- a/board/x64-vm/netplan/00-secubox.yaml +++ b/board/x64-vm/netplan/00-secubox.yaml @@ -63,7 +63,7 @@ network: bridges: br-lan: interfaces: [enp0s8] - addresses: [192.168.1.1/24] + addresses: [192.168.10.1/24] dhcp4: false parameters: stp: false diff --git a/image/build-ebin-live-usb.sh b/image/build-ebin-live-usb.sh index f17c1ff1..707e5b66 100755 --- a/image/build-ebin-live-usb.sh +++ b/image/build-ebin-live-usb.sh @@ -10,7 +10,7 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" REPO_DIR="$(dirname "$SCRIPT_DIR")" # ── Version & Build Info ────────────────────────────────────────── -SECUBOX_VERSION="1.9.0" +SECUBOX_VERSION="1.10.0" BUILD_DATE=$(date '+%Y-%m-%d') BUILD_TIMESTAMP=$(date '+%Y-%m-%d %H:%M') @@ -310,7 +310,7 @@ network: bridges: br-lan: interfaces: [lan0, lan1] - addresses: [192.168.1.1/24] + addresses: [192.168.10.1/24] dhcp4: false parameters: stp: false diff --git a/image/build-image.sh b/image/build-image.sh index 557310b4..5de5385a 100755 --- a/image/build-image.sh +++ b/image/build-image.sh @@ -26,7 +26,7 @@ LOCAL_REPO_PORT="8080" SLIPSTREAM_DEBS=1 # Intégrer les .deb locaux dans l'image (default: ON) # SecuBox versioning -SECUBOX_VERSION="1.9.0" +SECUBOX_VERSION="1.10.0" BUILD_TIMESTAMP=$(date '+%Y-%m-%d %H:%M') RED='\033[0;31m'; CYAN='\033[0;36m'; GOLD='\033[0;33m' @@ -989,7 +989,7 @@ openssl req -x509 -newkey rsa:2048 -days 365 \ -keyout "${ROOTFS}/etc/secubox/tls/key.pem" \ -out "${ROOTFS}/etc/secubox/tls/cert.pem" \ -nodes -subj "/CN=secubox/O=CyberMind SecuBox/C=FR" \ - -addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.1.1" \ + -addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.10.1" \ 2>/dev/null if [[ -f "${ROOTFS}/etc/secubox/tls/cert.pem" ]]; then diff --git a/image/build-live-usb.sh b/image/build-live-usb.sh index 8572e396..aa7652f2 100755 --- a/image/build-live-usb.sh +++ b/image/build-live-usb.sh @@ -14,7 +14,7 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" REPO_DIR="$(dirname "$SCRIPT_DIR")" # ── Version & Build Info ────────────────────────────────────────── -SECUBOX_VERSION="1.9.0" +SECUBOX_VERSION="1.10.0" BUILD_TIMESTAMP=$(date '+%Y-%m-%d %H:%M') BUILD_DATE=$(date '+%Y%m%d') @@ -786,7 +786,7 @@ cat > "${ROOTFS}/etc/netplan/00-secubox.yaml" <<'NETPLAN' # and router-mode br-lan later via secubox-net-* tools. # # Earlier versions baked an empty `br-lan` bridge with a static -# 192.168.1.1/24 address into the bootstrap. On bare-metal real +# 192.168.10.1/24 address into the bootstrap. On bare-metal real # hardware the physical NIC went silent and only the phantom br-lan # showed an IP — networkd was honouring the static bridge but # something (predictable rename? secubox-net-detect leftover?) @@ -1226,7 +1226,7 @@ openssl req -x509 -newkey rsa:2048 -days 365 \ -keyout "${ROOTFS}/etc/secubox/tls/key.pem" \ -out "${ROOTFS}/etc/secubox/tls/cert.pem" \ -nodes -subj "/CN=secubox-live/O=CyberMind SecuBox/C=FR" \ - -addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.1.1" \ + -addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.10.1" \ 2>/dev/null if [[ -f "${ROOTFS}/etc/secubox/tls/cert.pem" ]]; then diff --git a/image/build-mochabin-live-usb.sh b/image/build-mochabin-live-usb.sh index 08ec2be8..ec62ce9e 100755 --- a/image/build-mochabin-live-usb.sh +++ b/image/build-mochabin-live-usb.sh @@ -331,7 +331,7 @@ network: bridges: br-lan: interfaces: [eth1, eth2, eth3, eth4] - addresses: [192.168.1.1/24] + addresses: [192.168.10.1/24] dhcp4: false parameters: stp: false diff --git a/image/build-rpi-usb.sh b/image/build-rpi-usb.sh index ad1d25fa..06c63bec 100755 --- a/image/build-rpi-usb.sh +++ b/image/build-rpi-usb.sh @@ -13,7 +13,7 @@ SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" REPO_DIR="$(dirname "$SCRIPT_DIR")" # ── Version ─────────────────────────────────────────────────────── -SECUBOX_VERSION="1.9.0" +SECUBOX_VERSION="1.10.0" # ── Defaults ────────────────────────────────────────────────────── SUITE="bookworm" @@ -702,7 +702,7 @@ openssl req -x509 -newkey rsa:2048 -days 365 \ -keyout "${ROOTFS}/etc/secubox/tls/key.pem" \ -out "${ROOTFS}/etc/secubox/tls/cert.pem" \ -nodes -subj "/CN=secubox-rpi/O=CyberMind SecuBox/C=FR" \ - -addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.1.1" \ + -addext "subjectAltName=DNS:localhost,DNS:secubox.local,IP:127.0.0.1,IP:192.168.10.1" \ 2>/dev/null if [[ -f "${ROOTFS}/etc/secubox/tls/cert.pem" ]]; then diff --git a/image/firstboot.sh b/image/firstboot.sh index 449f0383..094e89ec 100755 --- a/image/firstboot.sh +++ b/image/firstboot.sh @@ -359,7 +359,7 @@ if [[ ! -f "${TLS_DIR}/cert.pem" ]]; then -keyout "${TLS_DIR}/key.pem" \ -out "${TLS_DIR}/cert.pem" \ -nodes -subj "/CN=${HOSTNAME}/O=CyberMind SecuBox/C=FR" \ - -addext "subjectAltName=DNS:${HOSTNAME},DNS:secubox.local,IP:192.168.1.1" \ + -addext "subjectAltName=DNS:${HOSTNAME},DNS:secubox.local,IP:192.168.10.1" \ 2>/dev/null chown -R secubox:secubox "${TLS_DIR}" chmod 640 "${TLS_DIR}/key.pem" @@ -378,7 +378,7 @@ log "=== Network Detection ===" # Short-circuit when the image was built with --static-ip: build-live-usb.sh # wrote a fixed netplan AND pre-touched /var/lib/secubox/.net-configured. # Running net-detect here would clobber the static config with router-mode -# defaults (WAN + br-lan 192.168.1.1/24), the exact regression in #128. +# defaults (WAN + br-lan 192.168.10.1/24), the exact regression in #128. if [[ -f /var/lib/secubox/.net-configured ]]; then log "Static netplan in effect (.net-configured present) — skipping net-detect" elif [[ -x /usr/sbin/secubox-net-detect ]]; then diff --git a/image/profiles/espressobin-v7.conf b/image/profiles/espressobin-v7.conf index 72486c6e..cef2b544 100644 --- a/image/profiles/espressobin-v7.conf +++ b/image/profiles/espressobin-v7.conf @@ -127,7 +127,7 @@ network: bridges: br-lan: interfaces: [lan0, lan1] - addresses: [192.168.1.1/24] + addresses: [192.168.10.1/24] dhcp4: false EOF @@ -135,8 +135,8 @@ EOF cat > "$root/etc/dnsmasq.d/secubox.conf" << 'EOF' interface=br-lan bind-interfaces -dhcp-range=192.168.1.100,192.168.1.250,24h -dhcp-option=option:router,192.168.1.1 -dhcp-option=option:dns-server,192.168.1.1 +dhcp-range=192.168.10.100,192.168.10.250,24h +dhcp-option=option:router,192.168.10.1 +dhcp-option=option:dns-server,192.168.10.1 EOF } diff --git a/image/sbin/secubox-net-detect b/image/sbin/secubox-net-detect index 5397d02c..1e1ad21f 100755 --- a/image/sbin/secubox-net-detect +++ b/image/sbin/secubox-net-detect @@ -337,7 +337,7 @@ generate_netplan() { bridges=" bridges: br-lan: interfaces: [${lan_array}] - addresses: [192.168.1.1/24] + addresses: [192.168.10.1/24] dhcp4: false optional: true parameters: @@ -346,7 +346,7 @@ generate_netplan() { " else # No LAN interfaces — DON'T create an empty br-lan with - # 192.168.1.1/24. A member-less bridge with a static IP + # 192.168.10.1/24. A member-less bridge with a static IP # squats the .1 address without routing anything, makes # systemd-networkd think the interface is "configured", # and frequently breaks DHCP on the real WAN NIC (the diff --git a/packages/secubox-hub/api/main.py b/packages/secubox-hub/api/main.py index 6b7e87b6..faea989c 100644 --- a/packages/secubox-hub/api/main.py +++ b/packages/secubox-hub/api/main.py @@ -1754,7 +1754,7 @@ async def preview_network_mode(mode: str, user=Depends(require_jwt)): bridges: br-lan: interfaces: [{lan_str}] - addresses: [192.168.1.1/24] + addresses: [192.168.10.1/24] dhcp4: false """ elif mode in ("sniffer-inline", "sniffer-passive"): diff --git a/packages/secubox-netmodes/api/main.py b/packages/secubox-netmodes/api/main.py index ff19306b..9c1982a1 100644 --- a/packages/secubox-netmodes/api/main.py +++ b/packages/secubox-netmodes/api/main.py @@ -526,7 +526,7 @@ network: bridges: br-lan: interfaces: [{lan_list}] - addresses: [192.168.1.1/24] + addresses: [192.168.10.1/24] dhcp4: false parameters: stp: false diff --git a/packages/secubox-netmodes/templates/router.yaml.j2 b/packages/secubox-netmodes/templates/router.yaml.j2 index 2a227675..1c7e3e77 100644 --- a/packages/secubox-netmodes/templates/router.yaml.j2 +++ b/packages/secubox-netmodes/templates/router.yaml.j2 @@ -9,13 +9,13 @@ network: dhcp6: false {{ lan | default('eth1') }}: addresses: - - 192.168.100.1/24 + - 192.168.10.1/24 bridges: br0: interfaces: - {{ lan | default('eth1') }} addresses: - - 192.168.100.1/24 + - 192.168.10.1/24 dhcp4: false parameters: stp: false