Linux.com

The biggest change is probably the addition of webif, the Web-based Admin Console that lets you install and remove packages with a click or two. There are more applications available for OpenWrt almost every day, and RC4 -- based on the official 2.4.30 kernel sources -- now runs on routers from 23 different manufacturers.

Getting started

I've been running a D-Link DI-524 wireless router in my home office for the past couple of years. Unfortunately, it is not one of OpenWrt's supported routers, so in order to test OpenWrt I needed to purchase a router that is supported. I settled on a lightly used Linksys WRT54GS from an online auction site that I got for $44 plus shipping.

CAUTION! READ THE BIG FAT WARNING!

I had a backup router available so that no matter how badly I bricked the Linksys, I could still restore my Internet access by swapping it for the D-Link. I mention this because it's not an unusual event. This is not software for the faint of heart. It's close to bleeding edge. You should always leave yourself with an alternate way back to connectivity as you explore OpenWrt. Read the BIG FAT WARNING in the installation documentation before proceeding. That said, I've been using the Linksys with OpenWrt installed full time for almost a month, and I have not bricked it nor lost my connectivity. Yet.

Part of the instructions for installation are router-specific. Keep in mind that I was installing it on a Linksys WRT54GS, and what I did may or may not work for you. Be sure to read the documentation.

White Russian RC4 is available for the WRT54GS in two different versions, depending on the filesystem you prefer: SquashFS or JFFS2. The SquashFS version uses a combination of read-only and writable filesystems. The JFFS2 version has no read-only component. According to the docs, the SquashFS version is more secure, and the JFFS2 version for more experienced users, so I chose SquashFS.

Give me two seconds, please

You can install OpenWrt using the router's existing firmware administration tool, but that's not the recommended procedure. A safer path -- especially on the first install -- is to set a parameter in the router's NVRAM to wait two seconds at power-on time before booting the firmware. This gives you a brief window you can use to install firmware using tftp, whether it's a new version of OpenWrt or a version of the stock firmware that originally came with the router.

Once that parameter is set, you power down the router and start a tftp client running on your PC so that it is constantly trying to connect with the router, then power the router back on. If you've been successful setting the two-second delay, the router will accept the new firmware rather than boot the existing code.

The problem is that in order to reset that parameter on the WRT54GS, you have to crack the router using an old exploit, and the newer versions of the firmware are no longer vulnerable to the exploit. I tried the "ping.asp exploit" described in the OpenWrt online documentation, as well as several variations I found in the OpenWrt forum, but I couldn't get in -- although others using the same version of hardware and firmware apparently did.

Finally, I bit the bullet and simply installed OpenWrt using the Linksys install firmware tool. It worked perfectly. The DMZ light on the front of the router came on and stayed on for a minute while OpenWrt was booting. When it went out, I was connected to the Internet and a basic iptables firewall was in place.

We know telnet is insecure

The OpenWrt documentation explains that the developers know telnet is insecure, but they use it as the default means of access anyway. Their thinking, as explained in the documentation, is: "Telnet is an insecure protocol with no encryption, we try to make a point of this insecurity by not enabling a password. If you're in an environment that requires password protection we suggest setting a password with the passwd command, which will disable the telnet server and enable the Dropbear SSH server."

Here's what the login screen looks like in White Russian:

BusyBox v1.00 (2005.11.23-21:46+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 WHITE RUSSIAN (RC4) -------------------------------
  * 2 oz Vodka   Mix the Vodka and Kahlua together
  * 1 oz Kahlua  over ice, then float the cream or
  * 1/2oz cream  milk on the top.
 ---------------------------------------------------
root@OpenWrt:~#

I expected to have to do OpenWrt configuration, package installation, and so on, at the CLI. Of course you can do it that way if you like -- but you don't have to. A Web administration program called webif is installed by default in White Russian RC4. To access it, just point your browser at the router's IP address.

From the main screen of webif's OpenWrt Admin Console you can go to one of four areas: Info, Status, System, or Network. If you've set a password for OpenWrt -- and you should -- you'll need to use that password with webif, too.

But it's the Wireless page that really shows off webif at its best. From that screen you can enable or disable the router's wireless capabilities, set the ESSID, choose the operating mode (Access Point, Bridge, Client, or Ad Hoc), and the type of encryption (WEP, WPA-preshared key, or WPA-RADIUS), if any. You can also add WDS connections. The current version of OpenWrt comes with a default ESSID setting of "bears2973" using channel 6, and includes four default 128-bit WEP keys.

From the System page you can assign a host name for the router and turn the critical two-second boot_wait NVRAM parameter on and off. You can also install and remove software packages and update the lists of available packages from your repositories -- very cool.

This is probably a good time to explain OpenWrt's package management. It's another key in making OpenWrt human-usable.

OpenWrt uses ipkg for package management. It's similar in concept to apt-get, so if you're familiar with the concept of repositories such as those for Debian-based distributions, you'll find ipkg easy to use.

To install a package from the CLI, enter ipkg install package-name and ipkg will fetch it and any prerequisites from the repositories listed in the /etc/ipkg.conf configuration file. To install an available package from the Admin Console, click Install from the list of available packages. Be sure to click "update the package lists" before installing packages, as coders are constantly adding new packages or updating existing ones.

If you don't want to always be adding new repositories to ipkg.conf, and you notice an interesting new package on the OpenWrt Package Tracker, you can download it to your PC. Use scp to copy it to /tmp or /etc on the router, and then use ipkg to install it from that directory. Just remember that anything the package depends upon has to either be available through your current repositories or downloaded as well.

Before I forget, if you've installed the SquashFS version of White Russian, you'll need to rm the ipkg.conf file in /etc, then copy it from /rom/etc/ipkg.conf to /etc/ipkg.conf before you can modify the default list of repositories. That's because -- in a space-saving move -- it is simply a link to the /rom version to begin with.

All in all, the OpenWrt Admin Console (webif) is a nice tool that makes OpenWrt a little more accessible to non-guru users like me. I've heard unofficial chatter on the #openwrt channel on the FreeNode IRC network that iptables management will be included in a future version.

One final tip

There is a lot of good documentation for OpenWrt, but with the frantic level of activity going on in all areas of the project, it goes out of date quickly. Use the most recent posts in the forums or ask on the IRC channel to resolve difficulties not covered by the docs.

Now you have OpenWrt on your router - so what?

Click to enlarge

If you like, you can do fun-but-pointless things like chat on IRC, using one of several IRC client packages available. But you can do things that matter, too, like run any of a wide range of network and wireless security tools that are available for OpenWrt. The list includes such well-known programs as Snort, Nmap, aircrack, fwmon, OpenSSH, GnuPG, Portsentry, Kismet, Tor, Shorewall, and many more.

Not impressed yet? How about such well-known applications as Samba, SANE, Chillispot, CUPS, DansGuardian, gPhoto2, and Asterisk? Yes, Asterisk. No need to dedicate a PC to have your own personal open source PBX -- just run it on your router. All of these apps are available for OpenWrt today. Not bad for a new distribution of Linux that is still in the RC stage.

My experience with OpenWrt has been nothing but positive. It's fun and it's useful. Given the magic of open source and the level of activity around OpenWrt that I see on IRC, in the forums, and in the repositories, I believe there are a lot more good things to come.

Share    Print    Comments