The proxy is now running on my local server which sits behind the real gateway. Besides making the device use the server as gateway and enable NAT on the server this single iptables rule is all that is needed:

iptables -t nat -A PREROUTING -s $CLIENT_IP -p tcp --dport 80 -j REDIRECT --to-port 8080

(All commands below are executed as root.)

First I created a group to group them together and then added the users to that group. I choose to disable their password as I only allow logins using SSH keys.

addgroup sftponly
# Repeat the line below for each user
adduser --disabled-password --ingroup sftponly ausername

As for the upload directory I wanted them to upload their data to my raid1 volume mounted under /data/pool1. Since OpenSSH has some requirements for the permission on the directories used as chroot I created the following directory layout.

cd /data/pool1
mkdir -m 751 sftp
ln -s . sftp/home
# Repeat the lines below for each user
mkdir -m 700 sftp/ausername
chmod ausername.root sftp/ausername

The home symlink is there to make the initial SFTP directory /ausername and the sftp directory is created with 751 to disallow directory listing in the top directory.

Then, as “all components of the pathname must be root-owned directories that are not writable by any other user or group” and /data/pool1 is not root owned I created a bind mount by adding the following to /etc/fstab.

/data/pool1/sftp  /srv/sftp  bind  bind  0  0

Before the initial mount, the directory must be created.

mkdir /srv/sftp
mount /srv/sftp

Then, the final part was to configure OpenSSH by adding the following lines at the end of /etc/ssh/sshd_config.

Match Group sftponly
  ChrootDirectory /srv/sftp
  ForceCommand internal-sftp
  AllowTcpForwarding no
  X11Forwarding no

Remember to restart the server afterwards.

In the BIOS, enable “Power on by PCIE device”.

In Linux, first install ethtool and then check that Wake on LAN is supported by running the following command:

root@host$ ethtool eth0
...
        Supports Wake-on: g
        Wake-on: g
...

The output should contain a ‘g’ to indicate that the device can be woken by sending it a “magic packet”.

Enable Wake-on by running:

root@host$ ethtool -s eth0 wol g

Since this command must be run on every boot, add it to /etc/rc.local.

root@host$ cat /etc/rc.local
...
ethtool -s eth0 wol g
exit 0

As the last step we must make sure that halt doesn’t disable the network device. This is done by adding this line to /etc/default/halt:

NETDOWN=no

We also need the MAC address to send the magic packet to.

root@host$ ifconfig eth0
eth0      Link encap:Ethernet  HWaddr 00:1e:8c:cf:d0:bb  
...

Then shutdown the computer. On an other computer, install e.g. wakeonlan and run:

user@other$ wakeonlan 00:1e:8c:cf:d0:bb

The computer should now start.

We tried many things to get the Wii to connect, without any success. In a last attempt we tried changing the pass phrase to a 64 characters long hexadecimal pass phrase. That did the trick. Both the Wii and both laptops now connect without any problem. So if you are having problems connecting your Wii to the wireless network, try changing the pass phrase to consist of hexadecimal characters (0-9, A-F) only. For WPA/WPA2 it must be exactly 64 characters long.

More information on netem’s homepage.