Linksys WRT54G

Tootja kodukas Isend mida mina kasutan on rauaversiooniga v2.0. Seega räägin täpsemalt sellest. Protsessoriks on Broadcomi BCM4712KPB mis on liitkiip 200Mhz MIPS32 prosast ja 54g MAC/Baseband protsessorist, lisaks on tal sees 2 USB kontrollerit ja 2 serialpordi UARTi (millest üks väidetavalt ei taha töödata). Lisaks on veel üks 10/100 etherneti kontroller. Süsteemimälu on 16Mb ja flashi 4Mb. Etherneti switchiks on plaadil ADMtek ADM6996 6 pordiga kivi mis oskab kuni 16 802.1q VLAN kasutada. Asja on võimalik manageerida süsteemi alt. Lõpetuseks on ka Broadcomi BCM2050KWL raadioosa (MAC on protsessoris).

Eestis müügil Elioni esindustes

Kõige selle peal jooksutatakse aga uClinuxi modifitseeritud distrot milles on osad binary only draiverid wirelessu kaardi ja etherneti jooksutamiseks. Linksys laseb sourcet vabalt GNU litsensi alusel maha laadida aadressilt http://www.linksys.com/support/opensourcecode/wrt54gv2/2.02.7/wrt54g.2.02.7.tgz Kuna source on kõigile kättesaadav on tehtud WRT54G erinevaid omi firmwaresid ja koguni distributsioone. Hea koht nende leidmiseks on inglisekeelne sait www.seattlewireless.net. Mina ise kasutan OpenWrt nimelist distributsiooni.

OpenWrt

OpenWrt erineb teistest sarnastest binaarfirmwaredest, kuna temasse pole topitud kõikemõeldavat sisse. Selleasemel kasutatakse minimaalset vajalikku baasfirmwares ja vajaliku võib ise binaarpakkidena (sic!) routerist endast kohale tirida. Lisaks on välja visatud ruuminõudev WWW konfigureerimisliides. Nii on cramfs asemel kasutades squashfs mis võtab vähem ruumi. Tänu sellele on saadud veel lisapartitsioon Axis Communicationi jffs2 zurnaaliga fläsh failisüsteemi jaoks mis on readwrite olekus. Igasuguste point-n-clik-and-beep-make-lot-of-profit-and-fun www ja gui konfi austajatel tuleks siinkohal loobuda. Lõptulemusena vaatab masinast vastu ash käsurida ja püsivaid parameetreid muudetakse nvram käsuga.

OpenWrt binaarfirmware saamiseks tuleb talitada samamoodi nagu on kirjeldatud OpenWrt saidil. Hetkel on viimane versioon sellest distrost b4-pre mis on saadaval ainult algkoodina.

selle saab kätte nii:

wget http://openwrt.ksilebo.net/temp/b4-pre/buildroot-20040509.tar.bz2
tar jxvf buildroot-20040509.tar.bz2
cd buildroot
wget http://openwrt.ksilebo.net/temp/b4-pre/buildroot-openwrt-20040509.tar.bz2
tar jxvf buildroot-openwrt-20040509.tar.bz2
make

selle tulemusena tekkib mingi aja pärast, kui on kokku lastud gcc krosskompilaator ja utiliidid mips32 prosa koodi saamiseks, buildroot nimelisse katalooma openwrt-*-code.bin failid. G on wrt54g ja GS wrt54gs'ile, mis on 8M flashi ja 32M RAM'iga versioon samast seadmest.NB! enne flashimist on vaja saada nvrami parameeter boot_wait=on. Mina tegin seda kasutades EWRT distributsiooni ja sealt WWW liidesest systeemiparameetrite alt optsiooni boot_wait on. Juhul kui seda ei tee ja firmware on õnnetu, on tulemuseks MITTETÖÖTAV SEADE!!! Veel üks lahendus boot_wait 'i jaoks. Selle binaari võib siis routerisse 'updateda'. NB! Flashitakse soovitavalt nii, et toitekadumine on välistatud (UPS), muidu on tulemuseks sinise esipaneeliga telliskivi. Siis tuleb oma ruuterisse sisse telnettida ja käivitada käsk firstboot mis teeb valmis jffs2 failisüsteemi ja sinna peale hunniku sümlinke mis viitavad firmware readonly partitsiooni peale. Kui see käsk lõpetab võib teha reboodi.

Süsteem valmis. Kui on vaja oma konfifaile või süsteemikäivituskripte muuta, kustuta lihtsalt sümlink maha, kopeeri /rom/ failisüsteemist sama fail kohale ja redigeeri vi'ga.

Süsteemi ülesehitus

root@purk:~# cat /proc/cpuinfo 
system type             : Broadcom BCM947XX
processor               : 0
cpu model               : BCM3302 V0.7
BogoMIPS                : 199.47
wait instruction        : no
microsecond timers      : yes
tlb_entries             : 32
extra interrupt vector  : no
hardware watchpoint     : no
VCED exceptions         : not available
VCEI exceptions         : not available
dcache hits             : 4043308640
dcache misses           : 3221360645
icache hits             : 4029644849
icache misses           : 1648199801
instructions            : 0
root@purk:~# ifconfig -a
br0       Link encap:Ethernet  HWaddr 00:0F:66:51:81:B6  
          inet addr:10.0.0.14  Bcast:10.255.255.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:12297 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2055 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:684815 (668.7 KiB)  TX bytes:271515 (265.1 KiB)

eth0      Link encap:Ethernet  HWaddr 00:0F:66:51:81:B6  
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:2161556 errors:9 dropped:0 overruns:8 frame:8
          TX packets:594728 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:1878687307 (1.7 GiB)  TX bytes:42028327 (40.0 MiB)
          Interrupt:5 Base address:0x2000 

eth1      Link encap:Ethernet  HWaddr 00:0F:66:51:81:B8  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:587521 errors:0 dropped:0 overruns:0 frame:1265
          TX packets:1206275 errors:86 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:100 
          RX bytes:39067951 (37.2 MiB)  TX bytes:1805054277 (1.6 GiB)
          Interrupt:4 Base address:0x1000 

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:2 errors:0 dropped:0 overruns:0 frame:0
          TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:224 (224.0 B)  TX bytes:224 (224.0 B)

vlan0     Link encap:Ethernet  HWaddr 00:0F:66:51:81:B6  
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1203587 errors:0 dropped:0 overruns:0 frame:0
          TX packets:594676 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:1783272813 (1.6 GiB)  TX bytes:42024130 (40.0 MiB)

vlan1     Link encap:Ethernet  HWaddr 00:0F:66:51:81:B7  
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:957969 errors:0 dropped:0 overruns:0 frame:0
          TX packets:52 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:56506486 (53.8 MiB)  TX bytes:4197 (4.0 KiB)


root@purk:~# cat /proc/net/vlan/config 
VLAN Dev name    | VLAN ID
Name-Type: VLAN_NAME_TYPE_PLUS_VID_NO_PAD
vlan0          | 0  | eth0
vlan1          | 1  | eth0

root@purk:~# brctl show
bridge name     bridge id               STP enabled     interfaces
br0             8000.000f665181b6       yes             vlan0
                                                        eth1
root@purk:~# admcfg 
OpenWRT ADM Config:

port0   ENABLED 100Mbps FD FLOW UNTAG VLAN NOPRIO 
        UP 100Mbps FD FLOW 
        PRIO:0 PVID:1 vlan1
        RX packets:959202
        TX packets:52
        collisions:0 errors:0
        RX bytes:70005866 (66.7 MiB) TX bytes:4617 (4.5 KiB)

port1   ENABLED 100Mbps FD FLOW UNTAG VLAN NOPRIO 
        DOWN 10Mbps HD FLOW 
        PRIO:0 PVID:0 vlan0
        RX packets:0
        TX packets:0
        collisions:0 errors:0
        RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

port2   ENABLED 100Mbps FD FLOW UNTAG VLAN NOPRIO 
        UP 100Mbps FD FLOW 
        PRIO:0 PVID:0 vlan0
        RX packets:1203915
        TX packets:1538886
        collisions:0 errors:0
        RX bytes:1800148223 (1.6 GiB) TX bytes:110980242 (105.8 MiB)

port3   ENABLED 100Mbps FD FLOW UNTAG VLAN NOPRIO 
        DOWN 10Mbps HD FLOW 
        PRIO:0 PVID:0 vlan0
        RX packets:0
        TX packets:0
        collisions:0 errors:0
        RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

port4   ENABLED 100Mbps FD FLOW UNTAG VLAN NOPRIO 
        DOWN 10Mbps HD FLOW 
        PRIO:0 PVID:0 vlan0
        RX packets:0
        TX packets:0
        collisions:0 errors:0
        RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

port5   ENABLED 100Mbps FD FLOW TAG VLAN NOPRIO 
        UP 100Mbps HD FLOW 
        PRIO:0 PVID:0 vlan0 vlan1
        RX packets:594899
        TX packets:2163117
        collisions:0 errors:0
        RX bytes:42047213 (40.0 MiB) TX bytes:1870154089 (1.7 GiB)
root@purk:~# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            state INVALID 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:22 
REJECT     tcp  --  anywhere             anywhere            reject-with tcp-reset 
REJECT     all  --  anywhere             anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
DROP       all  --  anywhere             anywhere            state INVALID 
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
DROP       all  --  anywhere             anywhere            state INVALID,NEW 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
root@purk:~# iptables -L -t nat
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
MASQUERADE  all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

root@purk:~# iwconfig eth1
eth1      IEEE 802.11-DSF  ESSID:"linksys"  
          Mode:Master  Channel:1   Access Point: 00:0F:66:51:81:B8  
          Bit Rate:54Mb/s   Tx-Power=15 dBm   
          Retry limit:0   RTS thr:off   Fragment thr:off
          Encryption key:off
          Link Quality:0/5  Signal level:-160 dBm  Noise level:-256 dBm
          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0
          Tx excessive retries:0  Invalid misc:0   Missed beacon:0

root@purk:~# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
10.0.0.0        *               255.255.255.0   U     0      0        0 br0
192.168.1.0     *               255.255.255.0   U     0      0        0 vlan1
default         10.0.0.1        0.0.0.0         UG    0      0        0 br0

Wireless AP on realiseeritud integreeritud WLAN kaardi peal mis paistab süsteemile kui eth1, eth0 on ühendatud switchi 6 (5) pordiga mis on 802.1q tagitud. eth0 peal on kaks VLAN'i vlan0 ja vlan1. vlan0 on konfitud switchi portidesse 1-4 ja vlan1 porti 0 mis on märgitud kui WAN port. eth1 ja vlan0 on omavahel kokku sillatud linuxi bridgega br0 millele on antud ka LAN poolne aadress. vlan1 interfeisile on antud aga WAN poole ip aadress. iptablesiga on tehtud firewall ja NAT osa, kusjuures kõikvõimalikud vpn, ning muud NAT helperid on kernelis olemas.

Lisasoft

Tuleb ipkg nimelise utiliidiga. Vaikimisi on seal sees vaid üks source, aga neid saab vabalt lisada. softi listi sikutamiseks on 'ipkg update' ja vaatamiseks 'ipkg list'. Esimese asjana on soovitav alla tõmmata dropbear mis on väike ssh server. Samuti lisada ta käivituskriptidesse. (/etc/init.d/S50services) Nüüd pole enam telnetd vaja ja selle võib välja kommenteerida. Kuna mul polnud vaja ka http ja dhcp serverit viskasin nad välja. Samuti kommenteerisin välja dhcp kliendi wan interfeisist mis on /etc/inittab failis.

#!/bin/sh
#/usr/sbin/telnetd -l /bin/login
/usr/bin/dropbear -b /etc/banner
/sbin/syslogd -R 10.0.0.1
#/usr/sbin/httpd -p 80 -h /www -r WRT54G Router
#/usr/sbin/udhcpd /etc/udhcpd.conf

lisaks on soovitav alla tõmmata Etherneti switchi manageerimiseks soft admcfg mis sisaldab kerneli moodulit adm.o (soovitav käivituskriptidesse lisada) ja utikat admcfg mille kasutus on kirjeldatud openwrt foorumis.. Proovisin lahendust, kus WLAN kaart töötas kliendireziimis ja switchi taga oli 5 erinevat LAN'i millised ma lahendasin üle VLAN'ide. Lisaks jooksis igas vlanis dhcp server ja ip filtriga oli vlan'ide omavaheline IP suhtlus üle routeri keelatud. Asi õnnestus suurepäraselt. Mäherdune võimas pill pisi WISPi käes :). Lisaks saab ka iga pordi omakorda 802.1q VLAN tag'ida, et samasuguse switchiga või seadmega VLAN'e väljaspool kasutada. Performance testid on küll veel tegemata :P

NVRAM sätungid

Põhiliseks ultimatiivseks tööriistaks on nvram. NB! NVRAMI EI TOHI TÜHJAKS LASTA. CFE boot vajab NVRAMi parameetreid!!! Tulemuseks on mittetöötav karp. nvramis hoitakse kõiki parameetreid ruuteri kohta. Näiteks selgusetu on veel kus initsialiseeritakse switchi vlan osad, kuid nvrami parameetreid mudides on seda võimalik boodi ajal konfida. Nvrami parameetrid on kirjeldatud OpenWrt FAQ's

Skriptidega asi puusse keeratud? Uus kernel ei boodi? Asi on omandanud telliskivi väärtuse ?

Õnneks veel mitte. Boodi ajal tuleb oodata kuni DMZ tuli põlema läheb ja siis kohe reset nuppu vajutada, siis saab nn FAILSAFE modesse, mis on boot /rom/ ketta ruuduks sättides. Siis saab minna ja skriptid ära remontida. Juhul kui see ei õnnestu saab tftp'ga 192.168.1.1 toimiva firmware üles saata. Teha tuleb seda nii, et etherneti kabla on LAN poolel ja 3 sekundit seda oodatakse peale toite sisselülitamist. Protsess ise on kirjeldatud siin.

NB!!!. Kui boodi ajal hoida reset nuppu all, resetitakse NVRAM'i parameetrid vaikimisi väärtustele. Reset nupp pole mingi rauaga seotud reseti värk, vaid lihtsalt kivi GPIO porti jooksev sisend. Selle nupu staatust saab kontrollida utiliidi resetmon väljumise väärtuse järgi. So allhoides kukub see programm välja error(1)'ga.

Serialpordi olemasolul saab samuti booti seisma panna, tuleb vaid konsoolikaabel järgi ühendada ja boodi ajal kiirelt CTRL-C pressida, selletulemusena satutakse CFE bootprogrammi prompti otsa mille help on üsna arusaadav, et oma õige soft uuesti sisse flashida.

22. juuni 2004

Serialport ja tinylogin konsooli jaoks

27. juuni 2004

Kuna seadmel on olemas konsool serialpordi näol, dmesgist:

Kernel command line: root=/dev/mtdblock2 rootfstype=squashfs init=/etc/preinit noinitrd console=ttyS0,115200

Otsustasin http://www.rwhitby.net/wrt54gs/serial.html lehe eeskujul teha endalegi serialpordi. Kõigepealt tellisin jupid mis on:

1. MAX233CPP RS232/dual serial line driver või analoog sellele - võib ka ühepordise võtta kuna teist porti ma tööle ei saanud. Oluline, et see kivi töötaks 3,3 voldiga mille saab JP1 pesast.
2. 9 väänatud jalaga D-SUB pistik trükkplaadile (male)
3. 10 jalaga IDC madala profiiliga pesa trükkplaadile
4. vana lisaserialport 486 ISA iokaardi ajastust, serialpordi lõikasin maha ja jätsin ainult lintkaabli pistikuga
5. 20 jalaga mikroskeemipesa
6. Makettplaati

Vastavalt ülalolevale skeemi tinutasin serialpordi adapteri kokku. Toitejalgade 7 ja 5,9 vahele tinutasin tantaalelektrolüütkondeka mahtuvusega 10mF.

Lintkaabli ühendused - 1 soon on tähistatud punase värviga ja algab paremalt poolt (ruuteri trükplaati esipoolt vaadates).
1. +3.3V toide
2. +3.3V toide (lõikasin lihtsalt maha)
3. tts/1 TXD mikroskeemi 1 jalg
4. tts/0 TXD mikroskeemi 2 jalg
5. tts/1 RXD mikroskeemi 20 jalg
6. tts/0 RXD mikroskeemi 3 jalg
7. lõikasin maha
8. lõikasin maha
9. maandus
10. maandus (minul soon puudus üldse)

Kuna ma teist porti (tts/1) üldse elama ei saanud, ei tinutanud ma ka 9jalast D-SUB pesa üldse külge. Pordi kinnitasin ma ruuteri sinisele esipaneelile, kohale kus on kirjutatud Wireless-G Broadband Router.

Ajasin minicomi käima (B115200,8,1,N), serialkaabli ruuteri ja arvuti vahele, ruuterile toide sisse ja tulemuseks oli selline logi

Et saada ka login konsooliporti, kompileerisin tinylogin nimelise paki buildroot kataloogis käsuga make tinylogin. kopeerisin saadud tinylogin binaari ära ruuterisse, linkisin ta getty'ks ja lisasin /etc/inittab faili rea ::respawn:/bin/getty 115200 /dev/tts/0. Tulemusena vaatas peale booti serialpordi otsast mulle viimase reana otsa

purk login:

Probleem juhul kui init'ist on käima tõmmatud dnsmasq, nimelt CTRL-C vajutades tapetakse konsoolilt just see programm mitte aga konsoolilt käima tõmmatud programm. mina pistsin dnsmasq'i hoopis 'lapsehoidija' kätte ja tõmban seda käima cronist, seega crond tuleb käima ajada.

Kõigepealt crond

mkdir -p /usr/spool/cron/crontabs

/etc/init.d/S50services lõppu

ln -s /usr/spool /tmp/
/usr/sbin/crond

crontab -l
* * * * *       /bin/d-masq-nanny.sh

root@purk:/usr/spool/cron/crontabs# cat /bin/d-masq-nanny.sh 
#!/bin/sh
PATH=$PATH:/usr/bin:/usr/sbin:/bin:/sbin:
if [ -z "$(ps | grep dnsmasq | grep -v grep)" ]
then
/usr/sbin/dnsmasq -l /tmp/udhcpd2.leases -s wan2 -i vlan3
fi

Ja kommenteerime dnsmasqi inittabist välja.

28.06.2004 - Vaatamata setseriali kompileerimisega mips32 jaoks ning sellega katsetamisele, ei õnnestunud mul 2 serialporti tööle saada. :(

Switch, nvram ja ADMCFG

Tundub nii et CFE bootloader konfib kohe peale booti ära ka ADM6996 switchi kivi. Lisaks tehakse switchi reset ja reconfigure et mooduli sisselugemisel. et on binary moodul 2.4.20 kerneli jaoks mis arvatavasti loeb oma konfiparameetrid nvram'ist. Peamised parameetrid selleks on vlan algavad. Minul on hetkel selline konf.

root@purk:~# nvram show | grep vlan
size: 1888 bytes (30880 left)
vlan3hwname=et0
vlan0ports=1 2 3 5*
wan2_ifname=vlan3
vlan3ports=4 5
vlan1hwname=et0
vlan1ports=0 5
wan_ifname=vlan1
vlan0hwname=et0

so vlan0ports kirjeldab ära vlan0 gruppi kuuluvad pordid ja * nr 5 järel tähendab, et 5 port on ülespoole (out) TAG port. vlan1 on konfitud kui wan so 0 (füüsiline WAN port ruuteri tagaküljel) ja 5 port. Lisaks tegin ma sellise võrgu nagu wan2 millel on pordid 4 ja 5. Selle järgi initsialiseerib CFE algul ära kogu switchi. Mõnikord aga vigaselt, kuna vlan1 pannakse ka millegipärast vlan0 portidele. Et seda jama vältida on mul startupis skript

root@purk:~# cat /etc/init.d/S66adm 
#!/bin/sh
/bin/admcfg port1 vlan0 port2 vlan0 port3 vlan0 port4 vlan3 port0 vlan12>&1 >/dev/null 

mis omakorda initsialiseerib kogu kupatuse õieti. Enne seda sain ma õigepea 'broadcast stormi' ehk etherneti loop'i endale võrku.

Uus VLAN lisaks, puust ette ja punaseks.

Kõigepealt nvramist konf

nvram set vlan3hwname=et0
nvram set vlan3ports="4 5"
nvram set vlan0ports="1 2 3 5*"
nvram set wan2_ifname=vlan3
nvram set wan2_ipaddr=192.168.2.1
nvram set wan2_netmask=255.255.255.0
nvram set wan2_proto=static
nvram set wan2_hwaddr=xx:xx:xx:xx:xx:xx
nvram commit

hwaddr võib valida hex'is 1 võrra suurem wl0_hwaddr olevast. seejärel tuleb /etc/init.d/S40network'i ifup wan lisada read

ifup wan2 

ja interfeiss tõmmatakse boodi ajal ise ülesse.
DHCP serveri ja dnsmasq lisamiseks tuleb need vastavalt konfida

root@purk:/usr/spool/cron/crontabs# more /etc/udhcpd2.conf 
max_leases 200
start 192.168.2.20
end 192.168.2.250
interface vlan3
lease_file /tmp/udhcpd2.leases
domain wan2
pidfile /tmp/udhcpd2.pid
option dns 192.168.2.1
option subnet 255.255.255.0
option router 192.168.2.1
lease 7200

echo "/usr/sbin/udhcpd /etc/udhcpd2.conf" >> /etc/init.d/S50services

dnsmasq käimatõmbamine on ülal juba olemas. ka tuleb vastavad read kirjutada /etc/init.d/S45firewall sisse

#!/bin/sh
. /etc/functions.sh

#WAN=$(nvram_get wan_ifname)
WAN=br0


IPT=/usr/sbin/iptables

for T in filter nat mangle ; do
  $IPT -t $T -F
  $IPT -t $T -X
done

$IPT -t filter -A INPUT -m state --state INVALID -j DROP
$IPT -t filter -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
$IPT -t filter -A INPUT -p icmp -j ACCEPT 
$IPT -t filter -A INPUT -i $WAN -p tcp -j ACCEPT --dport 23
$IPT -t filter -A INPUT -i $WAN -p tcp -j ACCEPT --dport 22
$IPT -t filter -A INPUT -i $WAN -p tcp -j ACCEPT --dport 2222
$IPT -t filter -A INPUT -i $WAN -p tcp -j REJECT --reject-with tcp-reset 
$IPT -t filter -A INPUT -i $WAN -j REJECT --reject-with icmp-port-unreachable 
$IPT -t filter -A FORWARD -m state --state INVALID -j DROP 
$IPT -t filter -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT 
$IPT -t filter -A FORWARD -p tcp -d y.y.y.y --dport 22 -j ACCEPT
$IPT -t filter -A FORWARD -i $WAN -m state --state NEW,INVALID -j DROP


$IPT -t nat -A POSTROUTING -o $WAN -j MASQUERADE
$IPT -t nat -A PREROUTING -j DNAT -p tcp -d x.x.x.x --dport 2222 --to y.y.y.y:22

NAT Performance

Lahendusel vlan3 -> NAT -> br0 sain ma FTPga kiiruseks ~32Mbit/s. Masina load tõusis ligikaudu 0.6 ja shell liikus konsoolil märgatavalt aeglasemalt :P. Üldiselt pole ju paha tulemus 200Mhz prosa kohta.

USB

On BCM4712KPB kivi sees täiesti olemas:

usb.c: registered new driver usbdevfs
usb.c: registered new driver hub
usb-ohci.c: USB OHCI at membase 0xb8004000, IRQ 2
usb-ohci.c: usb-00:04.0, PCI device 14e4:4716
usb.c: new USB bus registered, assigned bus number 1
usb.c: kmalloc IF 80d854e0, numif 1
usb.c: new device strings: Mfr=0, Product=2, SerialNumber=1
usb.c: USB device number 1 default language ID 0x0
Product: USB OHCI Root Hub
SerialNumber: b8004000
hub.c: USB hub found
hub.c: 2 ports detected
hub.c: standalone hub
hub.c: ganged power switching
hub.c: no over-current protection
hub.c: Port indicators are not supported
hub.c: power on to power good time: 4ms
hub.c: hub controller current requirement: 0mA
hub.c: port removable status: RR
hub.c: local power source is good
hub.c: no over-current condition exists
hub.c: enabling power on all ports
usb.c: hub driver claimed interface 80d854e0
usb.c: kusbd: /sbin/hotplug add 1

ainult et WRT54G'l pole seda prosajalgadelt välja toodud :( Kes tahab USB'iga majandada peaks vaatama ASUS AP500 poole.

Wireless, wl moodul, wlconf ja wl utiliit

Wireless on realiseeritud teise binary only draiveriga mille nimeks on wl. wl sisselugemisel käiakse samuti nvrami kallal parameetreid küsimas. Samuti teeb seda utiliit wlconf. Muidugi saab wirelessu parameetreid muuta ka iwconfigu'ga, kuid kõvem utikas on wl. Selle saab kas Linksys'iga kaasatulevast algkoodipakist või ipkg installides. wl'i käsud näeb ära nii:

root@purk# wl 

Usage: wl [-a|i ] [-hu]  [arguments]

  -a, -i        adapter name or number
  -h, -u        this message

ver     get version information

up      reinitialize and mark adapter up (operational)

down    reset and mark adapter down (disabled)

out     mark adapter down but do not reset hardware(disabled)
        On dualband cards, cards must be bandlocked before use.

clk     set board clock state. return error for set_clk attempt if the driver is not down
        0: clock off
        1: clock on

restart Restart driver.  Driver must already be down.


reboot  Reboot platform

ucflags Get/Set ucode flags

radio   Set the radio on or off.
        "on" or "off"

dump    print driver software state and chip registers to stdout

srdump  print contents of SPROM to stdout

nvdump  print nvram variables to stdout

nvset   set an nvram variable
        name=value (no spaces around '=')


nvget   get the value of an nvram variable


revinfo get hardware revision information


msglevel
        set driver console debugging message bitvector
        type 'wl msglevel ?' for values

PM      set driver power management mode:
        0: CAM (constantly awake)
        1: PS  (power-save)

wake    set driver power-save mode sleep state:
        0: core-managed
        1: awake

promisc set promiscuous mode ethernet address reception
        0 - disable
        1 - enable

monitor set monitor mode
        0 - disable
        1 - enable active monitor mode (interface still operates)

frag    Set the fragmentation threshhold.  (integer [256, 2346])

rts     Set the RTS threshhold. (integer [0, 2347])

cwmin   Set the cwmin.  (integer [1, 255])

cwmax   Set the cwmax.  (integer [256, 2047])

srl     Set the short retry limit.  (integer [1, 255])

lrl     Set the long retry limit.  (integer [1, 255])

rate    force a fixed rate:
        valid values for 802.11a are (6, 9, 12, 18, 24, 36, 48, 54)
        valid values for 802.11b are (1, 2, 5.5, 11)
        valid values for 802.11g are (1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, 54)
        -1 (default) means automatically determine the best rate

mrate   force a fixed multicast rate:
        valid values for 802.11a are (6, 9, 12, 18, 24, 36, 48, 54)
        valid values for 802.11b are (1, 2, 5.5, 11)
        valid values for 802.11g are (1, 2, 5.5, 6, 9, 11, 12, 18, 24, 36, 48, 54)
        -1 (default) means automatically determine the best rate

infra   Set Infrastructure mode: 0 (IBSS) or 1 (Infra BSS)

ap      Set AP mode: 0 (STA) or 1 (AP)

bssid   Get the BSSID value, error if STA and not associated

channel Set the channel:
        valid channels for 802.11b/g (2.4GHz band) are 1 through 14
        valid channels for 802.11a  (5 GHz band) are:
                36, 40, 44, 48, 52, 56, 60, 64,
                100, 104, 108, 112, 116,120, 124, 128, 132, 136, 140,
                149, 153, 157, 161,
                184, 188, 192, 196, 200, 204, 208, 212, 216

tssi    Get the tssi value from radio

txpwr   Set tx power in milliwatts.  Range [1, 84].

txpathpwr
        Turn the tx path power on or off on 2050 radios

powerindex
        Set the transmit power for A band(0-63).
        -1 - default value

atten   Set the transmit attenuation for B band. Args: bb radio txctl1.
        auto to revert to automatic control

phyreg  Get/Set a phy register.

radioreg
        Get/Set a radio register.

shmem   Get/Set a shared memory location.

macreg  Get/Set any mac registers(include IHR and SB)
        macreg offset size[2,4] [value]

antdiv  Set antenna diversity for rx
        0 - force use of antenna 0
        1 - force use of antenna 1
        3 - automatic selection of antenna diversity

txant   Set the transmit antenna
        0 - force use of antenna 0
        1 - force use of antenna 1
        3 - use the RX antenna selection that was in force during
            the most recently received good PLCP header

plcphdr Set the plcp header.
        "long" or "auto" or "debug"

phytype Get phy type

scbdump print driver scb state to stdout

ratedump
        print driver rate selection tunables and
        per-scb state to stdout, valid scb values are
        0 through NSCB-1

rateparam
        set driver rate selection tunables
        arg 1: tunable id
        arg 2: tunable value

wepstatus
        Set or Get WEP status
        wepstatus [on|off]

primary_key
        Set or get index of primary key

addwep  Set an encryption key.  The key must be 5, 13 or 16 bytes long, or
        10, 26, 32, or 64 hex digits long.  The encryption algorithm is
        automatically selected based on the key size. keytype is accepted
        only when key length is 16 bytes/32 hex digits and specifies
        whether AES-OCB or AES-CCM encryption is used. Default is ccm.
        addwep  [ocb | ccm] [notx] [xx:xx:xx:xx:xx:xx]

rmwep   Remove the encryption key at the specified key index.

wep     Set WEP options.
        wl wep [options]
        [on|enable|1]   enable WEP
        [off|disable|0] disable WEP
        [sw|software]   perform WEP in software
        [hw|hardware]   perform WEP in hardware

tkip    Set TKIP options.
        wl tkip [options]
        [on|enable|1]   enable TKIP
        [off|disable|0] disable TKIP
        [sw|software]   perform TKIP in software
        [hw|hardware]   perform TKIP in hardware

aes     Set AES options.
        wl aes [options]
        [on|enable|1]   enable AES
        [off|disable|0] disable AES
        [sw|software]   perform AES in software
        [hw|hardware]   perform AES in hardware

keys    Prints a list of the current WEP keys

txiv    Print Tx IV for key at specified key index.

wsec_test
        Generate wsec errors
        wsec_test 
        type 'wl wsec_test ?' for test_types

tkip_countermeasures
        Enable or disable TKIP countermeasures (TKIP-enabled AP only)
        0 - disable
        1 - enable

wsec_restrict
        Drop unencrypted packets if WSEC is enabled
        0 - disable
        1 - enable

eap     restrict traffic to 802.1X packets until 802.1X authorization succeeds
        0 - disable
        1 - enable

authorize
        restrict traffic to 802.1X packets until 802.1X authorization succeeds

deauthorize
        do not restrict traffic to 802.1X packets until 802.1X authorization succeeds

deauthenticate
        deauthenticate a STA from the AP with optional reason code (AP ONLY)

wsec    wireless security bit vector
        1 - WEP enabled
        2 - TKIP enabled
        4 - AES enabled
        8 - WSEC in software

wpa_auth
        WPA authorization mode
        [none|0]        none
        [unspecified|1] WPA 802.1X
        [psk|2]         WPA PSK
        [disable|255]   disable WPA

scan    Initiate an active scan across all channels.
        Optional SSID argument specifies a particular SSID to scan.
        With no SSID argument, a broadcast SSID scan is performed.

passive Puts scan engine into passive mode

regulatory
        Get/Set regulatory domain mode (802.11d). Driver must be down.

spect   Get/Set 802.11h Spectrum Management mode.

scanresults
        Return results from last scan.

assoc   Print information about current network association.
        (also known as "status")

status  Print information about current network association.
        (also known as "assoc")

disassoc
        Disassociate from the current BSS/IBSS.

chanlist
        Return valid channels for the current settings.

channels
        Return valid channels for the current settings.

channels_in_country
        Return valid channels for the country specified.
        Arg 1 is the country abbreviation
        Arg 2 is the band(a or b)

curpower
        Return current tx power settings

scansuppress
        Suppress all scans for testing.
        0 - allow scans
        1 - suppress scans

evm     Start an EVM test on the given channel, or stop EVM test.
        Arg 1 is channel number 1-14, or "off" or 0 to stop the test.
        Arg 2 is optional rate (1, 2, 5.5 or 11)

rateset Returns or sets the supported and basic rateset, (b) indicates basic
        With no args, returns the rateset. Args are
        rateset "default" | "all" | 
                default - driver defaults
                all - all rates are basic rates
                arbitrary rateset - list of rates
        List of rates are in Mbps and each rate is optionally followed
        by "(b)" or "b" for a Basic rate. Example: 1(b) 2b 5.5 11
        At least one rate must be Basic for a legal rateset.

roam_trigger
        Set the roam trigger RSSI threshold.  (integer)

roam_delta
        Set the roam candidate qualification delta.  (integer)

roam_scan_period
        Set the roam candidate qualification delta.  (integer)

suprates
        Returns or sets the 11g override for the supported rateset
        With no args, returns the rateset. Args are a list of rates,
        or 0 or -1 to specify an empty rateset to clear the override.
        List of rates are in Mbps, example: 1 2 5.5 11

scan_channel_time
        Get/Set scan channel time

scan_unassoc_time
        Get/Set unassociated scan channel dwell time

scan_home_time
        Get/Set scan home channel dwell time

scan_passive_time
        Get/Set passive scan channel dwell time

scan_nprobes
        Get/Set scan parameter for number of probes to use per channel scanned

prb_resp_timeout
        Get/Set probe response timeout

channel_qa
        Get last channel quality measurment

channel_qa_start
        Start a channel quality measurment

country Select Country code for use with 802.11d
        Use either long name or abbreviation from ISO 3166.
        Use 'wl country list' for the complete list.

locale  OBSOLETE: use "wl country"
        Select the country:
        Worldwide
        Thailand
        Israel
        Jordan
        China
        Japan
        USA/Canada/ANZ
        Europe
        USAlow
        JapanHigh
        All

join    Join a specified network SSID.
        Join syntax is: join  [key xxxxx] [imode bss|ibss] [amode open|shared]

ssid    Set or get the current SSID.
        Setting will initiate an assoication attempt if in infrastructure mode,
        or join/creation of an IBSS if in IBSS mode,
        or creation of a BSS if in AP mode.

mac     Set or get the list of source MAC address matches.
        wl mac xx:xx:xx:xx:xx:xx [xx:xx:xx:xx:xx:xx ...]
        To Clear the list: wl mac none

macmode Set the mode of the MAC list.
        0 - Disable MAC address matching.
        1 - Deny association to stations on the MAC list.
        2 - Allow association to stations on the MAC list.

wds     Set or get the list of WDS member MAC addresses.
        Set using a space separated list of MAC addresses.
         wl wds xx:xx:xx:xx:xx:xx [xx:xx:xx:xx:xx:xx ...]

lazywds Set or get "lazy" WDS mode (dynamically grant WDS membership to anyone).

noise   Get noise (moving average) right after tx in dBm

fqacurcy
        Manufacturing test: set frequency accuracy mode.
        freqacuracy syntax is: fqacurcy 
        Arg is channel number 1-14, or 0 to stop the test.

crsuprs Manufacturing test: set carrier suppression mode.
        carriersuprs syntax is: crsuprs 
        Arg is channel number 1-14, or 0 to stop the test.

int     Interrupt Test - remember to precede by 'wl down' and follow by 'wl up'

lbt     Loopback Test - remember to precede by 'wl down' and follow by 'wl up'

band    Returns or sets the current band
        auto - auto switch between available bands (default)
        a - force use of 802.11a band
        b - force use of 802.11b band

bands   Return the list of available 802.11 bands

phylist Return the list of available phytypes

shortslot
        Get/Set 11g Short Slot Timing mode. (-1=auto, 0=long, 1=short)

shortslot_override
        Get/Set 11g Short Slot Timing mode override. (-1=auto, 0=long, 1=short)

shortslot_restrict
        Get/Set AP Restriction on associations for 11g Short Slot Timing capable STAs.
        0 - Do not restrict association based on ShortSlot capability
        1 - Restrict association to STAs with ShortSlot capability

ignore_bcns
        AP only (G mode): Check for beacons without NONERP element (0=Examine beacons, 1=Ignore beacons)

pktcnt  Get the summary of good and bad packets.

upgrade Upgrade the firmware on an embedded device

gmode   Set the 54g Mode (LegacyB|Auto||GOnly|BDeferred|Performance|LRS|Afterburner)

gmode_protection
        Get G protection mode. (0=disabled, 1=enabled)

gmode_protection_control
        Get/Set 11g protection mode control alg. (0=always off, 1=monitor local association, 2=monitor overlapping BSS)

gmode_protection_cts
        Get/Set 11g protection type to CTS (0=disable, 1=enable)

gmode_protection_override
        Get/Set 11g protection mode override. (-1=auto, 0=disable, 1=enable)

legacy_erp
        Get/Set 11g legacy ERP inclusion (0=disable, 1=enable)

scb_timeout
        AP only: inactivity timeout value for authenticated stas

assoclist
        AP only: Get the list of associated MAC addresses.

rssi    Get the current RSSI val, for an AP you must specify the mac addr of the STA

isup    Get driver operational state (0=down, 1=up)

fasttimer
        Get/Set High frequency watchdog timeout (tx_power) [15 sec]

slowtimer
        Get/Set Low frequency watchdog timeout (nrssislope) [60 sec]

glacialtimer
        Get/Set Very Low frequency watchdog timeout (measurelo) [120 sec]

radar   Enable/Disable radar

rssidump
        Dump rssi values from aci scans

interference
        Get/Set interference mitigation mode. Choices are:
        0 = none
        1 = non wlan
        2 = wlan manual
        3 = wlan automatic

aciargs Get/Set various aci tuning parameters.  Choices are:
        enter:  CRS glitch trigger level to start detecting ACI
        exit:   CRS glitch trigger level to exit ACI mode
        glitch  Seconds interval between ACI scans when glitchcount is continuously high
        spin:   Num microsecs to delay between rssi samples
        Usage: wl aciargs [enter x][exit x][spin x][glitch x]

frameburst
        Disable/Enable frameburst mode

pwr_percent
        Get/Set power output percentage

wet     Get/Set wireless ethernet bridging mode

dtim    Get/Set DTIM

peer_mac
        Get WDS peer MAC address

wpa_sup Get WDS peer MAC address

measure_req
        Send an 802.11h measurement request.
        Usage: wl measure_req 
        Measurement types are: TPC, Basic, CCA, RPI
        Target MAC addr format is xx:xx:xx:xx:xx:xx

quiet   Send an 802.11h quiet command.
        Usage: wl quiet , , 


csa     Send an 802.11h channel switch anouncement
        Usage wl csa 


constraint
        Send an 802.11h Power Constraint IE
        Usage: wl constraint 1-255 db

---

TissKlaimer! Väljamaal on moodne on kirjutada lõppu, et autor ei võta mingit vastutust juhul kui keegi oma seadme selle peale käkki keerab. Nii minagi. Kõik mis te teete on teie enda vastutusel. Või juhul kui te leiate sellise lolli kes selle jutu peale pea tulle pistab, vanaema kassi surnuks ehmatab ja vesipüksi valla päästab, andke mulle kah teada. Paneks näitlikuks õppevahendiks ligimese lollusest Eesti Rahva Muuseumisse klaasi taha. Ligimese maitselagedust peab varsti suisa austama hakkama, aga lollusega vasta võiks olla sallimatu niikaua kui kannatab.

Kopeeritud autori loal aadressilt: http://www.bumpclub.ee/~jaanus/wrt54g/