OpenWrt on a Buffalo WHRG54S

These are some instructions describing one way to construct an OpenWrt-loaded Buffalo WHR-G54S, an inexpensive wireless router (around $40 new, as of 2007-02).

Build OpenWrt Kamikaze

• make a directory

  TOPDIR=/src/openwrt-2.4 (or whatever)
  mkdir $TOPDIR

• checkout stuff

  cd $TOPDIR
  svn co https://svn.openwrt.org/openwrt/trunk/
  svn co https://svn.openwrt.org/openwrt/packages

• my local hacks:
  • create a symlink to a download directory that may already be populated:

    TRUNK=${TOPDIR}/trunk
    cd $TRUNK
    ln -s /src_archive/openwrt/dl dl

  • link packages in the packages tree into trunk/package

    cd ${TRUNK}/package
    for i in $(find ../../packages -type d | grep -v .svn | awk -F/ 'NF==5') ; do echo $i ; ln -s $i $(echo $i | awk -F/ '{ print $5 }') ; done

• configure

  cd $TRUNK
  make menuconfig

  • For the Buffalo:
    • Target System (Broadcom BCM947xx/953xx [2.4])

    • Target Profile (Generic Broadcom WiFi)

    • Select all packages by default (y)
• build (this can take a few hours, and might fail in the middle)

  cd $TRUNK
  make

  • if it does fail somewhere, get more information about why by restarting with:

    make V=99

  • either fix the problems, or just find the option in the menuconfig and disable the broken package.
• when it finishes, you should have a bunch of .trx and .bin binaries in /src/openwrt-2.4/trunk/bin, as well as the .ipk files in /src/openwrt-2.4/trunk/bin/packages. Move them to some place useful:

  cd $TRUNK
  REV=$(echo r$(svn info | grep '^Revision: ' | cut -d' ' -f2))
  cp ${TRUNK}/bin/openwrt-brcm-2.4-squashfs.trx /var/lib/tftpboot/whrg54s/openwrt-brcm-2.4-squashfs-${REV}.trx
  cp ${TRUNK}/openwrt-brcm-2.4-jffs2-64k.trx /var/lib/tftpboot/whrg54s/openwrt-brcm-2.4-jffs2-64k-${REV}.trx
  rsync -v -a -H ${TRUNK}/bin/packages/ russell@donk.personaltelco.net:public_html/openwrt/2.4-${REV}/

OLDER STUFF

Steps for creating a NoCat [http://www.openwrt.org/ Openwrt] Build on a Linksys WRT54g or gs

"["OpenWRT"] is a linux distribution for the Linksys WRT54G. Instead of trying to cram every possible feature into one firmware, ["OpenWRT"] provides only a minimal firmware with support for add-on packages. For users this means the ability to custom tune features, removing unwanted packages to make room for other packages and for developers this means being able to focus on packages without having to test and release an entire firmware."

To use nocatsplash on openwrt, you need to do some fiddling.

• Get a current version of a prebuilt ["OpenWRT"] binary image with MAC support and iptables enabled here: BR

["OpenWRT"] binary (CVS 10-Dec-2004) [http://bjencks.net/~brj/openwrt/openwrt-g-code.bin WRT54G] md5sum: 37664add5eafd051ec07e339d26f0e37 BR ["OpenWRT"] binary (CVS 10-Dec-2004) [http://bjencks.net/~brj/openwrt/openwrt-gs-code.bin WRT54GS] md5sum: 459df29183d7afcb8ffbbac3b7726c3f BR

• BROr

• Get a working buildroot following the instructions on the [http://www.openwrt.org/ openwrt] site.

  • First, you need to enable the MAC matching support in iptables, both in the kernel and as an iptables module.
    • To enable the iptables module
      • edit buildroot/sources/iptables-openwrt-extensions.patch
      • add 'mac' to the end of the PF_EXT_SLIB line.
    • For the kernel module
      • Edit buildroot/sources/openwrt/kernel/linux.config
      • Set CONFIG_IP_NF_MATCH_MAC=y
  • Do a full build ("make"). This will need some fiddling, mostly with the snapshot date in the main Makefile.

• Load the image onto your WRT. The openwrt website has some good [http://www.openwrt.org/userguide.html#before_you_flash instructions] on how to do this.

• At this point you should telnet to the WRT, edit /etc/ipkg.conf to add the main openwrt package directory

  src openwrt http://www.openwrt.org/ipkg

  ipkg update and ipkg install dropbear. Start sshd, and make an initscript to start it on boot. Then disable telnet, and use ssh to log in from now on.

• Now, you can either use the [http://bjencks.net/~brj/openwrt/nocatsplash_nightly-5_mipsel.ipk ipk] I built

  • BROr

• build it yourself. I recommend building it yourself, so you can tweak it later more easily.
• To build it yourself

  • make libglib: make `pwd`/build_mipsel/staging_dir/lib/libglib.a

  • unpack the [http://bjencks.net/~brj/openwrt/nocat-openwrt-r5.tar.gz tarball] into your buildroot

  • run 'make packages'.
  • To modify it
    • edit the patch buildroot/sources/nocatsplash.patch,
    • edit make/nocatsplash.mk and increment the version number

    • then make nocatsplash-dirclean; make packages.

      • BR

(The patch adds mac address logging, and more levels of logging. I recommend level 1, which shows auths and timeouts only. The logging part was by the ewrt people)

After installing, configure by editing /etc/nocat.conf. Check all the options in there. Also, add the option InsideIP 10.11.x.y, or the redirects won't work (IE, no way to auth).

TODO

• Update package to use release version of NoCatSplash

• This [http://openwrt.org/OpenWrtNVRAM list of NVRAM variables] can be handy when setting up your OpenWRT

• More packages to add to your OpenWRT can be found on the [http://openwrt.org/OpenWrtPackages OpenWRT wiki] or [http://nthill.free.fr/openwrt/tracker/ the OpenWRT Package Tracker]

The wiring of the WRT network devices: There are 2 'real' devices, eth0 and eth1. eth0 is an interface to the switch on the back. eth1 is the wireless link. eth0 uses vlans. vlan0 is the 'lan' set of ports, and vlan1 is the 'wan' port. The default configuration creates a bridge, br0, of eth1 and vlan0. OpenWRT networking is configured with *_ipaddr, *_proto, etc. These are documented more extensively on the OpenWRT site. The default config is lan_* is br0, wan_* is vlan1. If you want to break the bridge, and treat lan, wan, and wifi separately, you use lan_* for vlan0, wifi_* for eth1, and wan_* for vlan1.

Troubleshooting

Q) I have flashed the OpenWrt bin on but whenI try to telnet in my old username/pswd simply do not work. I even reflashed it with the previous firmware (ewrt) and test the username/password just to be sure. Any thoughts? (TomHiggins)

A) You're using the old broken image. Get the 10 december one and try again. This problem is due to using the wrong /bin/login file, one that was actually trying to check credentials. However, there aren't any credentials, so it will always deny. The correct /bin/login just logs you in without asking anything. (Worked like a charm, thanks Ben! (TomHiggins))

_

!!!!WARNING!!!!

The firmare and package needs libpthread. But even with it, the rotuer *FAILS* to capture pages. It does not do anything but drop packets. DO NOT USE THIS, IT IS BROKEN!