Steps for creating a NoCat [http://www.openwrt.org/ Openwrt] Build on a Linksys WRT54g or gs
"["OpenWRT"] is a linux distribution for the Linksys WRT54G. Instead of trying to cram every possible feature into one firmware, ["OpenWRT"] provides only a minimal firmware with support for add-on packages. For users this means the ability to custom tune features, removing unwanted packages to make room for other packages and for developers this means being able to focus on packages without having to test and release an entire firmware."
To use nocatsplash on openwrt, you need to do some fiddling.
Get a current version of a prebuilt ["OpenWRT"] binary image with MAC support and iptables enabled here: BR
["OpenWRT"] binary (CVS 10-Dec-2004) [http://bjencks.net/~brj/openwrt/openwrt-g-code.bin WRT54G] md5sum: 37664add5eafd051ec07e339d26f0e37 BR ["OpenWRT"] binary (CVS 10-Dec-2004) [http://bjencks.net/~brj/openwrt/openwrt-gs-code.bin WRT54GS] md5sum: 459df29183d7afcb8ffbbac3b7726c3f BR
BROr
Get a working buildroot following the instructions on the [http://www.openwrt.org/ openwrt] site.
- First, you need to enable the MAC matching support in iptables, both in the kernel and as an iptables module.
- To enable the iptables module
- edit buildroot/sources/iptables-openwrt-extensions.patch
- add 'mac' to the end of the PF_EXT_SLIB line.
- For the kernel module
- Edit buildroot/sources/openwrt/kernel/linux.config
- Set CONFIG_IP_NF_MATCH_MAC=y
- To enable the iptables module
- Do a full build ("make"). This will need some fiddling, mostly with the snapshot date in the main Makefile.
- First, you need to enable the MAC matching support in iptables, both in the kernel and as an iptables module.
Load the image onto your WRT. The openwrt website has some good [http://www.openwrt.org/userguide.html#before_you_flash instructions] on how to do this.
At this point you should telnet to the WRT, edit /etc/ipkg.conf to add the main openwrt package directory
src openwrt http://www.openwrt.org/ipkg
ipkg update and ipkg install dropbear. Start sshd, and make an initscript to start it on boot. Then disable telnet, and use ssh to log in from now on.
Now, you can either use the [http://bjencks.net/~brj/openwrt/nocatsplash_nightly-5_mipsel.ipk ipk] I built
BROr
- build it yourself. I recommend building it yourself, so you can tweak it later more easily.
- To build it yourself
make libglib: make `pwd`/build_mipsel/staging_dir/lib/libglib.a
unpack the [http://bjencks.net/~brj/openwrt/nocat-openwrt-r5.tar.gz tarball] into your buildroot
- run 'make packages'.
- To modify it
- edit the patch buildroot/sources/nocatsplash.patch,
- edit make/nocatsplash.mk and increment the version number
then make nocatsplash-dirclean; make packages.
(The patch adds mac address logging, and more levels of logging. I recommend level 1, which shows auths and timeouts only. The logging part was by the ewrt people)
After installing, configure by editing /etc/nocat.conf. Check all the options in there. Also, add the option InsideIP 10.11.x.y, or the redirects won't work (IE, no way to auth).
TODO
Update package to use release version of NoCatSplash
This [http://openwrt.org/OpenWrtNVRAM list of NVRAM variables] can be handy when setting up your OpenWRT
More packages to add to your OpenWRT can be found on the [http://openwrt.org/OpenWrtPackages OpenWRT wiki] or [http://nthill.free.fr/openwrt/tracker/ the OpenWRT Package Tracker]
The wiring of the WRT network devices: There are 2 'real' devices, eth0 and eth1. eth0 is an interface to the switch on the back. eth1 is the wireless link. eth0 uses vlans. vlan0 is the 'lan' set of ports, and vlan1 is the 'wan' port. The default configuration creates a bridge, br0, of eth1 and vlan0. OpenWRT networking is configured with *_ipaddr, *_proto, etc. These are documented more extensively on the OpenWRT site. The default config is lan_* is br0, wan_* is vlan1. If you want to break the bridge, and treat lan, wan, and wifi separately, you use lan_* for vlan0, wifi_* for eth1, and wan_* for vlan1.
Troubleshooting
Q) I have flashed the OpenWrt bin on but whenI try to telnet in my old username/pswd simply do not work. I even reflashed it with the previous firmware (ewrt) and test the username/password just to be sure. Any thoughts? (TomHiggins)
A) You're using the old broken image. Get the 10 december one and try again. This problem is due to using the wrong /bin/login file, one that was actually trying to check credentials. However, there aren't any credentials, so it will always deny. The correct /bin/login just logs you in without asking anything. (Worked like a charm, thanks Ben! (TomHiggins))