Linux On Routers

[justsumhelp]

I see alot of discussion on around the forum about about open-wrt, dd-wrt, and tomatousb. So lets talk about them. Also some of these will not work across all routers due to hardware limitations, etc....

Some nice Optware

For torrent users: transmission ipkg It has a nice web interface and with a nas no more need to leave computer while the torrents run

For home webserver: lighthttpd ipkg

Other stuff

For the voyeur or security conscious: etherpuppet- mipsel alone it does nothing but once you get the puppet interface brought up in Wireshark you can view all traffic on the router.

[urandom]

more a suggestion here... I'm the happy owner of a RT-N16 and I really like code to be super fresh so I was a bit frustrated to see the latest build stalling (as of today it's dated 11/30/2010). there is a really nice tutorial on how to build tomatousb from source here: http://tomatousb.org/tut:how-to-build-and-rebuild-tomato-for-total-noobs so I just decided to roll my own. there are many different branches (see http://repo.or.cz/w/tomato.git/heads ) and some of them are *very* active. I'm now happily running the Toastman-RT branch which has some nice additions (see http://repo.or.cz/w/tomato.git/shortlog/refs/heads/Toastman-RT ) and runs great on the RT-N16.

anyone not interested in building the stuff but interested in using it, let me know the branch, build type and revision you're interested in, I could build it for you (if you trust me (you shouldn't)).

[urandom]

God bless F/OSS.

After building firmwares from source, now was the time to cross-compile packages, instructions here:

http://www.nslu2-linux.org/wiki/Optware/AddAPackageToOptware

There are 4/5 things broken in the toolchain build script but they are super easy to fix. Now I can install an *up-to-date* webserver on my beloved RT-N16.

<3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3

em@drama:~/slug/optware/ddwrt$ ls builds/

hiawatha hiawatha_7.7-1_mipsel.ipk libuclibc++ libxml2 libxslt openssl zlib

<3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3 <3

[smiling mantis]

I've got a D-Link DNS-320 and I want to run tranmission on it but am waiting to fix whatever this issue is that is keeping me from mounting a USB drive on the thing as I do not want to stress my main drives with the chatter torrents can generate.

I've got a E3000 running Tomato that I'm sure I could get transmission running on, and the USB works, but I want to get QoS working at some point and I'm afraid QoS + transmission will mean major fail for my low latency app needs, even when upstream is throttled down hard. I'm also thinking seedbox so there's that.

And every time I end up spending more than an hour on this stuff I can't help but think that I shouldn't have just built myself a real system to do it all and enjoy the ability to expand when necessary. Out more money but less time, and time is money too.

[urandom]

I've got a D-Link DNS-320 and I want to run tranmission on it but am waiting to fix whatever this issue is that is keeping me from mounting a USB drive on the thing

any log we could use to try to debug this?

I've got a E3000 running Tomato that I'm sure I could get transmission running on, and the USB works, but I want to get QoS working at some point and I'm afraid QoS + transmission will mean major fail for my low latency app needs, even when upstream is throttled down hard.

well, i may have misunderstood but QoS is excatly what you need to avoid this "major fail for [...] low latency app needs".

And every time I end up spending more than an hour on this stuff I can't help but think that I shouldn't have just built myself a real system to do it all and enjoy the ability to expand when necessary. Out more money but less time, and time is money too.

Cross-building was fun but I ended up using lighttpd on a x86 linux box. just more convenient given what I had to host.

[smiling mantis]

I've got a D-Link DNS-320 and I want to run tranmission on it but am waiting to fix whatever this issue is that is keeping me from mounting a USB drive on the thing

any log we could use to try to debug this?

I've got a E3000 running Tomato that I'm sure I could get transmission running on, and the USB works, but I want to get QoS working at some point and I'm afraid QoS + transmission will mean major fail for my low latency app needs, even when upstream is throttled down hard.

well, i may have misunderstood but QoS is excatly what you need to avoid this "major fail for [...] low latency app needs".

And every time I end up spending more than an hour on this stuff I can't help but think that I shouldn't have just built myself a real system to do it all and enjoy the ability to expand when necessary. Out more money but less time, and time is money too.

Cross-building was fun but I ended up using lighttpd on a x86 linux box. just more convenient given what I had to host.

No (useful) log yet, but I need to install more stuff on there to make that happen. I had hoped it would just work "out of the box", and it isn't.

As for QoS, I'm basing my pessimism on results obtained from DD-WRT on another LinkSys router, I forget the number... the 210 maybe? It's the one that had a serious overheating problem. Anyways, QoS was just too much for the thing, I would end up having to reset the router on a daily basis. The E3000 has the same enclosure, so I'm guessing that I can have one or the other but not both, but yeah, I don't know that for sure yet. IOW, it isn't managing the bandwidth that I'm concerned about (which is impossible to do with Bittorrent using QoS anyways) but the CPU load.

lighttpd on a x86 box is exactly what I'd be doing if I knew I were staying in LOS long-term.

[urandom]

IOW, it isn't managing the bandwidth that I'm concerned about (which is impossible to do with Bittorrent using QoS anyways) but the CPU load.

not using QoS myself but http://www.decimation.com/markw/2007/10/03/tomato-qos-setup/

[smiling mantis]

IOW, it isn't managing the bandwidth that I'm concerned about (which is impossible to do with Bittorrent using QoS anyways) but the CPU load.

not using QoS myself but http://www.decimation.com/markw/2007/10/03/tomato-qos-setup/

When I go to that page I get iPhone articles and political stories.

Anyways... Tomato is just brilliant... thanks for you link on how to build for yourself, but honestly, so far there's nothing that Tomato doesn't do that I'd want.

As for QoS, I'm assuming it's just their wrapper sitting atop iptables, and so it's going to have all of the same strengths and weaknesses, the latter primarily being that you can't correctly shape downstream traffic with it when using something like Bit Torrent.

[smiling mantis]

I've got a D-Link DNS-320 and I want to run tranmission on it but am waiting to fix whatever this issue is that is keeping me from mounting a USB drive on the thing as I do not want to stress my main drives with the chatter torrents can generate.

Just to follow up on this...

I'm an idiot. The drive was formatted as HFS Plus. The NAS only recognizes ext3. What to do? Install Fonz Fun Plug! They've got instructions on how to build your own kernel modules (though you have to download a 400MB gzip file from D-Link first to do it, ugh.) I built one for HFS Plus, and also one for ext4 (some net stuff can take advantage of its sparse files).

It's not exactly a new kernel they've got in there (2.6.22.18) so the ext4 module is still marked as experimental, but hey, it's Linux.

You can pick up a DNS-320 at IT City for ~3100B if memory serves. Put two 2TB WD green drives in there. Was getting the expected 22MB/s on writes in JBOD mode, but since reformatting as RAID 1 I'm getting half of that. Kernel RAID isn't as fast as hardware but it isn't that slow either, so I guess I got more fiddling to do.

Very happy with the purchase. It's basically a $100 Linux box that sips power. Only 128MB and an armv5 but that's enough for quite a few things, and it lets my router concentrate on what's important, which is doing QoS, firewall, etc. Play more with that later, but like I said, Tomato as delivered is just wonderful on that device so why mess with success.

[urandom]

FWIW, I changed oldconfig to menuconfig in the Makefile before building the firmware so I could play a bit with the kernel options. I'm now using westwood+ tcp congestion algorithm, works great so far.

TCP Westwood+ significantly increases throughput over wireless links and fairness compared to TCP Reno/New Reno in wired networks

it's there:

│ -> Networking support (NET [=y])

│ -> Networking options

│ -> TCP/IP networking (INET [=y])

│ -> TCP: advanced congestion control (TCP_CONG_ADVANCED [=y])

[smiling mantis]

there is a really nice tutorial on how to build tomatousb from source here: http://tomatousb.org/tut:how-to-build-and-rebuild-tomato-for-total-noobs so I just decided to roll my own

A belated thanks for this... I will be needing to get into this. I want mDNSResponder in there so I can use its Bonjour Sleep Proxy feature.

Bonjour/Zeroconf is nice for other reasons of course -- I like having my router give out addresses via DHCP and then names for those addresses so I don't have to bother maintaining my hosts file for this purpose -- but I want to turn my spare MacBook into the living room media server and I don't want it to just sit there and be on all of the time just to be that.

I'll be using my iPhone as the remote -- for iTunes and VLC -- and it does Bluetooth of course so there's a chance I might be able to wake up the MacBook that way, but I'd rather do it the right way. Also lets me wake the MacBook up from across town if ever I get up the nerve to open up a port in the firewall for it.

Another clever solution I found while browsing the net is to get the DHCP server to run a script when a lease is renewed. This works great if you can dedicate a device as the remote control (as I can, as an owner of an old, unused iPhone). You turn on the iPhone, which turns on its Wifi, which then goes for a lease (which you've set to renew after some ridiculously small period of time in your DHCP server), the script runs on the router and then invokes your vanilla wake on lan functionality on the sleeping device.

Now watch as I brick my router over this nonsense.

[urandom]

christmas came early in nerdland this year. i took an old pc case, bought the cheapest AMD single core CPU (45W) (THB1,1xx and can be turned into a dual core with BIOS magic), an old 2.5" laptop HDD, some NICs and built a pfsense webcache proxy/IDS/network monitoring/firewall/router box.

Realtek onboard NIC --> WAN

dual port intel NIC port #1 --> LAN

dual port intel NIC port #2 --> OPT1

PCI wireless b/g/n (Ralink chipset) --> OPT2 (wireless AP)

all NICs are on a different subnet.

I kept the RT-N16 (still running tomato) and now use it as another wireless AP. it is bridge to LAN interface and its ethernet ports are used as a switch now (BTW the WAN port can be bridge to LAN, nice if you're missing one ethernet port).

kids+wife machines are using OPT2 and never will se anything else. the htpc/torrentbox is on OPT1 and I'm on LAN with some routes to OPT1.

todo: setup snort, squid and traffic shapping.

pfsense features list: http://www.pfsense.org/index.php?option=com_content&task=view&id=40&Itemid=43

this is great stuff, i'm still learning how to use it but i love it already, you will too.

[smiling mantis]

Hey! You got FreeBSD in our Linux thread! /jk

I'm sort of regretting not taking the "just buy a cheap PC" approach. It's like building a ship-in-a-bottle trying to get what I need running on these embedded devices, and while it has its fun moments, I had all this crap solved with Gentoo a long time ago on my previous router box and there are other things I could be doing. Optware is crap; they've got packages on there that have been broken for over a year with no update in sight. I can get low power use by under-clocking/under-volting, and spinning disks down. So it's the difference between $300 and loads of time invested on my part, or maybe $500 and a maybe only a day's worth of work. Classic penny-wise, pound-foolish logic.

I should have said &lt;deleted&gt; it a long time ago and just become a movie star.

[urandom]

so i've been testing this setup every evening to be sure everything's fine before the real switch. unfortunately, i have to say that wireless in master mode sucks quite hard. the card locks up after some time, obviously a driver issue. as the aim is to get rid of the rt-n16 at some point (once FreeBSD supports 11n, supposed to be in 9.0-RELEASE, partly at least) there is some real issue here. i'm not planning to invest anymore so another wireless card is not an option. i'll put my beloved CRUX and a debloat kernel [ http://www.bufferbloat.net/ ] on that thing and we'll see how it goes. but first i need to read those ten thousand billion pages iptables books

[urandom]

that's it. teh rt-n16 will spend new year's eve in the closet. the linux box is now up and running, it took me quite some time as I did it for the first time, almost from scratch, with a lot of trial/error...

this is how my baby looks like:

CRUX 32bit userland with a custom 64bit git kernel built from:

net-next kernel http://git.kernel.org/?p=linux/kernel/git/davem/net-next.git;a=summary

in which I pulled wireless-next bits http://git.kernel.org/?p=linux/kernel/git/linville/wireless-next.git;a=summary

wireless userspace:

libnl, hostapd, iw. all git versions.

dnsmasq handles dhcp and dns

configuring, monitoring and misc tools: nmap, ethtool, ettercap, tcpdump, openntpd, iproute2

dynamic dns from afraid.org, afraid-dyndns update client.

100BASE-TX Nvidia onboard NIC for WAN (pppoE)

1000BASE-T Intel NIC#1 for LAN - 192.168.1.0/24

1000BASE-T Intel NIC#2 for DMZ - 192.168.2.0/24

2.4Ghz 802.11n Atheros NIC for wireless AP - 192.168.3.0/24

To do, maybe... fail2ban, polipo/squid, snort, tc

A few links I have used during the setup:

iptables: http://www.frozentux.net/iptables-tutorial/iptables-tutorial.html

wireless AP: http://linuxwireless.org/en/users/Documentation/hostapd

And this book:

misc: http://shop.oreilly.com/product/9780596102487.do

[dharmabm]

that's it. teh rt-n16 will spend new year's eve in the closet.

umm, unless you need a backup, bring it to the meeting next week and i'll take it off your hands for a few beers! ;>}