Hi Guys,

How do I best secure Node-RED on an Omega 2 Pro?

It seems to me that what gets installed via the Onion OS does not include support for the security settings. I've tried installing the missing bits but it seems that the Omega doesn't have a sufficient grunt to calculate password hashes in a reasonable time.

Given that the Node-RED UI is accessible via Onion OS I'd be happy to simply prevent direct access via port 1880 and hence authenticate via Onion OS first.

I've tried adding some custom iptables rules to DROP traffic to port 1880 but my efforts have also prevented access from within the Onion OS UI.

Is there a way to block direct access to port 1880 while still allowing access via the Onion OS UI?

Whats actually going on here? Is there some sort of reverse proxy happening which allows access to Node-RED via Onion OS on port 80?

Cheers, Malcolm

@crispyoz Thanks for that ... the device can now resolve local names.

root@Omega:~# nslookup omega.ialchemy.com.au                                                                                                                                                             
Server:         10.0.1.2                                                                                                                                                                                 
Address:        10.0.1.2#53                                                                                                                                                                              
                                                                                                                                                                                                         
Name:      omega.ialchemy.com.au                                                                                                                                                                         
Address 1: 10.0.1.161                                                                                                                                                                                    
*** Can't find omega.ialchemy.com.au: No answer                                                                                                                                                          
root@Omega:~#   

and it seems to picking up my primary and the two secondaries.

root@Omega:~# cat /etc/resolv.conf                                                                                                                                                                       
# Interface wwan                                                                                                                                                                                         
nameserver 10.0.1.2                                                                                                                                                                                      
nameserver 10.0.1.3                                                                                                                                                                                      
nameserver 10.0.1.6                                                                                                                                                                                      
search ialchemy.com.au                                                                                                                                                                                   
root@Omega:~#   

Taking out dnsmasq has also taken out the DHCP service on the wlan interface. Its nice to be able to connect to wlan without having to set a static address in the range but I'd really like wlan to ONLY be enabled if wwan is unable to connect to the network so I guess its not a big deal as I don't intend to use the device in AP mode.

@crispyoz Thanks for the advice unfortunately things don't appear to be quite like you suggest.

root@Omega-FCC8:~# uci show network
network.loopback=interface
network.loopback.ifname='lo'
network.loopback.proto='static'
network.loopback.ipaddr='127.0.0.1'
network.loopback.netmask='255.0.0.0'
network.globals=globals
network.globals.ula_prefix='fd1d:48c4:7633::/48'
network.wlan=interface
network.wlan.type='bridge'
network.wlan.proto='static'
network.wlan.ipaddr='192.168.3.1'
network.wlan.netmask='255.255.255.0'
network.wlan.ip6assign='60'
network.wwan=interface
network.wwan.ifname='apcli0'
network.wwan.proto='dhcp'
network.wwan.hostname='Omega-FCC8'
network.wan=interface
network.wan.ifname='eth0'
network.wan.proto='dhcp'
root@Omega-FCC8:~# 

Just to be sure that I hadn't broken something I've just done a Factory Reset and gone through the process of adding the device to my LAN again.

Doing an nslookup of an internet host I get ...

root@Omega-FCC8:~# nslookup onion.io
Server:         127.0.0.1
Address:        127.0.0.1#53

Name:      onion.io
Address 1: 99.86.181.46
Address 2: 99.86.181.60                                                                                                                                                                                  
Address 3: 99.86.181.75                                                                                                                                                                                  
Address 4: 99.86.181.87                                                                                                                                                                                  
*** Can't find onion.io: No answer                                                                                                                                                                       
root@Omega-FCC8:~#     

Doing an nslookup of a local host in my DNS ...

root@Omega-FCC8:~# nslookup omega.ialchemy.com.au                                                                                                                                                        
Server:         127.0.0.1                                                                                                                                                                                
Address:        127.0.0.1#53                                                                                                                                                                             
                                                                                                                                                                                                         
*** Can't find omega.ialchemy.com.au: No answer                                                                                                                                                          
*** Can't find omega.ialchemy.com.au: No answer                                                                                                                                                          
root@Omega-FCC8:~#        

Before doing the reset I was able to access Node-RED on the device via that FQDN so my local DNS works for my local workstations but although the device is getting its address via DHCP its not using the supplied DNS servers.

It is clearly using something as it can resolve external names.

I don't need to be running a DNS server on the device so if dnsmasq is a problem what's the best way to disable/remove it?

Hi Guys,

Does the Onion OS use hardwired DNS Servers?

I expected my Omega 2 Pro to use the DNS Servers supplied by my DHCP Server but although it appears to resolve hosts on the internet it can't resolve hosts which are set up in my internal DNS Servers.

It seems that Onion OS is using 127.0.0.1 as its DNS Server ... dnsmasq, but what is it using?

How do I force dnsmasq to use the servers provided by DHCP?

I don't want to hardcode DNS servers as I want to be able to deploy to multiple locations and in most cases need to resolve hosts which are only in the DHCP identified servers.

Cheers, Malcolm

Hi Guys,

I've built a proof of concept app on an iPhone which reads NDEF records from NTAG216 tags and creates records in a cloud based database via a Data API. This is all well and good but an iPhone is a tad expensive for an IoT application.

Straight out of the box the Omega 2 Pro has an NFC Expansion board and Node-RED so it seems ideal for my needs.

I've sorted the Data API side of the problem but I'm at a loss as to how best to get Node-RED to leverage the NFC Expansion board. The Onion OS demo NFC app happily reads the UID of my tags so I'd first like to get same happening within Node-RED and then move onto reading the actual NDEF records.

It would be cool if there was a Node-RED palette for the NFC Expansion Board as I'm really looking for a "low code" solution. Short of that, is the demo NFC app documented somewhere so I can leverage its core functionality?

Other solutions or suggestions would be gratefully accepted.

Cheers, Malcolm