Changeset b60358c in freewrt


Ignore:
Timestamp:
Aug 17, 2025, 6:00:59 PM (4 months ago)
Author:
Waldemar Brodkorb <wbx@…>
Branches:
freewrt_2_0
Children:
a04fe5e
Parents:
78cc191
Message:

handbook: update to reflect 2.0

Location:
docs/handbook
Files:
1 deleted
2 edited

Legend:

Unmodified
Added
Removed

  • docs/handbook/user/cover.tex

    r78cc191 rb60358c  
    1818\\
    1919\rightline{%
    20 Revision 1.0.3, \svnInfoRevision}
     20Revision 2.0, \svnInfoRevision}
    2121\\
    2222\rightline{%
    … …  
    3232\renewcommand{\baselinestretch}{1.0}
    3333\normalfont \footnotesize
    34 \textbf{Waldemar Brodkorb} \texttt{<wbx@freewrt.org>}
     34\textbf{Waldemar Brodkorb} \texttt{<wbx@freewrt.de>}
    3535\\
    36 \textbf{Phil Richard Sutter} \texttt{<n0-1@freewrt.org>}
     36\textbf{Phil Richard Sutter}
    3737\\
    38 \textbf{Dirk Nehring} \texttt{<dnehring@freewrt.org>}
     38\textbf{Dirk Nehring}
    3939\\
    40 \textbf{Markus Wigge} \texttt{<markus@freewrt.org>}
     40\textbf{Markus Wigge}
    4141\\
    42 \textbf{Michael Schwab} \texttt{<ms@freewrt.org>}
     42\textbf{Michael Schwab}
    4343\\
    4444\vspace{.1cm}

  • docs/handbook/user/handbook.tex

    r78cc191 rb60358c  
    5757
    5858\begin{document}
    59 \svnInfo $Id: handbook.tex 3807 2008-10-07 18:08:46Z n0-1 $
     59% \svnInfo $Id: handbook.tex 3807 2008-10-07 18:08:46Z n0-1 $
    6060\setlength{\marginparwidth}{10mm}
    6161
    … …  
    101101
    102102Welcome to FreeWRT! This handbook covers the building, installation and usage
    103 aspects of the FreeWRT 1.0 Linux distribution.  FreeWRT is a portable, secure
     103aspects of the FreeWRT 2.0 Linux distribution.  FreeWRT is a portable, secure
    104104and functional Linux distribution for embedded systems. As FreeWRT is a source
    105105code distribution, it does not provide any pre-compiled firmware for embedded
    106106systems. The latest version of this document is always available at the FreeWRT
    107107website. If you have any comments, criticism or found some wrong description,
    108 please send us an e-mail to
    109 \href{mailto:freewrt-handbook@freewrt.org}{freewrt-handbook@freewrt.org}, we
    110 are always happy about getting feedback to this document, and will try to
     108please send me an e-mail to
     109\href{mailto:wbx@freewrt.de}{wbx@freewrt.de}, I
     110am always happy about getting feedback to this document, and will try to
    111111update or correct the issues mentioned by you.
    112112
    … …  
    119119management and update mechanism. The last chapter,
    120120\nameref{ch:troubleshooting}, helps troubleshooting problems and recovering a
    121 bad firmware installation.  The appendix contains board specific information.
    122 For FreeWRT 1.0 these are only Broadcom based embedded systems.
     121bad firmware installation. 
    123122
    124123The intended audience for this handbook are advanced users with basic knowledge
    … …  
    145144\end{Verbatim}
    146145
    147 %\chapter{Web Interface Builder (WIB)}\label{ch:WIB}
    148 %
    149 %FIXME It is named later in the text, but not explained what it is.  Probably
    150 %this chapter can be joined with the chapter about ADK
    151 
    152146\chapter{Appliance Development Kit (ADK)}\label{ch:ADK}
    153147
    154148The ADK is the core of FreeWRT and contains all scripts and sources to create
    155 firmware images for every supported embedded system. FreeWRT 1.0 supports the
    156 following embedded systems:
     149firmware images for every supported embedded system. FreeWRT 2.0 supports the
     150following WLAN routers:
    157151
    158152\begin{itemize}
    … …  
    173167\end{itemize}
    174168
    175 In this release we only support the Linux 2.4 kernel. The ADK contains over 600
     169In this release we only support the Linux 6.12.x kernel. The ADK contains over 320
    176170software packages.
    177171
    … …  
    191185        \item Ubuntu GNU/Linux
    192186        \item Fedora Core
    193         \item OpenBSD (partial support)
    194                 \footnote{some addon packages does not compile}
    195         \item MirOS BSD (partial support)
    196                 \footnote{some addon packages does not compile}
    197187\end{itemize}
    198188
    … …  
    204194
    205195\begin{itemize}
    206         \item gcc3 or higher
     196        \item gcc
    207197        \item g++
    208198        \item binutils
    … …  
    211201        \item bzip2
    212202        \item unzip
     203        \item xz
    213204        \item flex
    214205        \item bison
    … …  
    216207        \item zlib (+headers)
    217208        \item ncurses (+headers)
     209        \item zstd (+headers)
    218210        \item (g)libc headers
    219211        \item perl
    … …  
    235227
    236228To get the latest stable FreeWRT ADK try one of these commands:
    237 \begin{Verbatim}[label=Check out an 1.0.x revision of FreeWRT ADK via HTTP protocol]
    238 $ svn co http://www.freewrt.org/svn/tags/freewrt_1_0_x freewrt
    239 \end{Verbatim}
    240 \begin{Verbatim}[label=Check out the 1.0-stable branch of FreeWRT ADK via HTTP protocol]
    241 $ svn co http://www.freewrt.org/svn/branches/freewrt_1_0 freewrt
    242 \end{Verbatim}
    243 
    244 The value $x$ is a place holder for the latest minor release number.  Take a
    245 look at our project page to find out which minor release number is the latest
    246 one.
     229\begin{Verbatim}[label=Check out FreeWRT ADK via HTTPS protocol]
     230$ git clone https://git.freewrt.de/git/freewrt
     231\end{Verbatim}
    247232
    248233After successfully downloading, enter the directory:
    … …  
    285270\end{itemize}
    286271
    287 Then quit saving changes. If you forgot that, just run \command{make} again,
     272Then quit saving changes. If you forgot that, just run \command{make menuconfig} again,
    288273redo your changes, then save.
    289274
    … …  
    308293
    309294\begin{enumerate}
    310         \item Get and prepare the Kernel and C~library headers of your target system
    311295        \item Compile the binutils package for your target
    312296        \item Compile a static C~compiler for your target
     297        \item Get and prepare the Kernel and C~library headers of your target system
    313298        \item Compile and install a C~library for your target
    314299        \item Compile and install a full C/C++~compiler
    … …  
    325310compiler directly (e.g. compiling a MIPS Little Endian application):
    326311\begin{Verbatim}[label=compile a simple application with the cross-compiler]
    327 ./staging_dir_mipsel/bin/mipsel-linux-uclibc-gcc -o myapp myapp.c
     312./staging_dir_mipsel/bin/mipsel-freewrt-uclibc-gcc -o myapp myapp.c
    328313\end{Verbatim}
    329314
    … …  
    343328
    344329When selecting packages, \code{<*>} means it will be inserted into the firmware
    345 images and \code{<M>} means it will be build as an addon package which can be
    346 installed later at runtime.
     330image and \code{<M>} means it will be build as an addon package which can be
     331installed later at runtime (only if you use read-write jffs2 root filesystem).
    347332
    348333The target device and filesystem should already been chosen by you to the right
    … …  
    381366will find a firmware image in the top level directory. Check the size of the
    382367binary image file to see if it is small enough to fit into flash memory of your
    383 embedded system. Furthermore there is a directory \file{package/}, which
     368WLAN router. Furthermore there is a directory \file{package/}, which
    384369contains all base and add--on packages.
    385370
    … …  
    399384   GNU make 3.80 too old.
    400385   Please install GNU make 3.81 or higher to continue.
    401    You can override this check, see http://www.freewrt.org/faq for details.
     386   You can override this check, see http://www.freewrt.de for details.
    402387   It is suggested to upgrade your copy of bison to
    403388   GNU Bison 2.3 because of its bug fixes.
    … …  
    412397
    413398If you encounter any compilation errors, then first try to reproduce the error.
    414 First update your ADK tree via \command{svn update}, to be sure that the error
    415 is not already fixed in the subversion repository. After that do a
     399First update your ADK tree via \command{git pull}, to be sure that the error
     400is not already fixed in the GIT repository. After that do a
    416401\command{make clean \&\& make}, to reproduce your problem.
    417402
    … …  
    456441        \item the router has to be powered on
    457442        \item your computer needs to be connected to one of the LAN ports
    458                 (using IP address \file{192.168.1.2})
     443                (using IP address \file{192.168.1.2/24})
    459444\end{itemize}
    460445
    … …  
    483468
    484469When everything went well, you can login using \app{ssh}. The default username
    485 is "\code{admin}". The default password for images created via WIB or ADK is
     470is "\code{admin}". The default password for images created via ADK is
    486471"\code{FreeWRT}". It is possible to change this password in the ADK, before
    487472image creation.
    … …  
    522507has to be done to write the firmware to flash:
    523508\begin{Verbatim}[label=write a previously downloaded new firmware-file into flash]
    524 # mtd -e linux -r write freewrt.bin linux &
     509# mtd -e firmware -r write freewrt.bin firmware &
    525510\end{Verbatim}
    526511Or via wget pipe:
    527512\begin{Verbatim}[label=download and write a new firmware-file into flash]
    528 # wget -O - http://www.yourserver.com/freewrt.bin | mtd -e linux -r write - linux &
     513# wget -O - http://www.yourserver.com/freewrt.bin | mtd -e firmware -r write - firmware &
    529514\end{Verbatim}
    530515The parameters explained in detail:
    531516\begin{description}
    532         \item[\command{-e linux}] erase existing data in flash
     517        \item[\command{-e firmware}] erase existing data in flash
    533518        \item[\command{-r}] trigger rebooting right after finishing work
    534519        \item[\command{write}] write the firmware image contained in the file
    … …  
    536521        \item[\command{freewrt.bin}] the actual image to write -- ignore the
    537522                suffix, it is detected at runtime
    538         \item[\command{linux}] this is an abstract identifier for a certain
     523        \item[\command{firmware}] this is an abstract identifier for a certain
    539524                partition in flash, so don't change this
    540525        \item[\command{\&}] put the process into background, to prevent
    … …  
    546531All supported target devices are shipped with a builtin bootloader, comparable
    547532to the BIOS of \term{x86} machines. This bootloader is used to bootstrap the
    548 system until it can boot a regular operating system. Besides the ability to
     533system until it can boot an regular operating system. Besides the ability to
    549534load the executable code from flash, it can be received from another node in
    550535the local area network via the famous TFTP protocol.
    … …  
    559544\end{itemize}
    560545
    561 Most of the hardware supported by FreeWRT 1.0 uses the second method.  Only the
     546Most of the hardware supported by FreeWRT 2.0 uses the second method.  Only the
    562547device \term{Netgear WGT634u} is using the first method, the bootloader
    563548provides a DHCP/TFTP client. Though this may be a little confusing to people
    … …  
    610595FreeWRT is managed via \app{Busybox}'s \app{ifupdown} implementation. \app{Busybox}'s builtin \app{ip}
    611596command configures the network interfaces. There is no \app{ifconfig} or \app{route}, you can activate
    612 it in the ADK menue, if you like.
     597it in the ADK menu, if you like.
    613598
    614599To show all configured network interfaces use:
    … …  
    653638
    654639\subsection{Switch/VLAN}
    655 The switch built-in into the most routers is capable of separating each port
     640The switch built-in into the most WLAN routers is capable of separating each port
    656641using VLAN tagging. You can configure the switch by simply adding the interface
    657 to the config file and giving the desired switch-ports:
     642to the config file and giving the desired switch-ports (FIXME):
    658643\begin{Verbatim}[label=\file{/etc/network/interfaces}]
    659644auto eth0.0
    … …  
    751736auto eth0.1
    752737iface eth0.1 inet dhcp
    753     switch-ports  0 5
     738    switch-ports 0 5
    754739\end{Verbatim}
    755740Typically this configures the WAN-Port to start a DHCP request on bootup.
    … …  
    757742\subsection{WLAN}
    758743A router containing a WLAN interface has an additional ethernet device
    759 representing it. On Broad\-com-based hardware it is typically \code{eth1}
    760 (\term{Linksys}),\code{eth2} (\term{Asus WL500gP}) or on \term{Netgear WGT634u}
    761 which has a Madwifi WLAN chip, it is \code{ath0}, \code{ath1}, etc. You can use
    762 these interfaces standalone or bridged with other devices, e.g. the internal
     744representing it. On Broad\-com-based hardware it is typically \code{wlan0}
     745or on \term{Netgear WGT634u} which has a Madwifi WLAN chip, it is \code{ath0}, \code{ath1}, etc.
     746You can use these interfaces standalone or bridged with other devices, e.g. the internal
    763747LAN.
    764748
    765 \subsubsection{Basic Settings}
    766 
    767 Mandatory options and default parameters are in bold font.
    768 
    769 \begin{tabular}{l|l|p{10cm}}
    770 \strong{Option} & \strong{Parameter} & \strong{Description} \\
    771 \hline\hline
    772 \code{\strong{type}} & \code{broadcom} & Broadcom based card \\
    773                      & \code{atheros}  & Madwifi driver \\
    774 \hline
    775 \code{\strong{mode}} & \code{ap}       & Access point mode \\
    776                      & \code{sta}      & Client mode \\
    777                      & \code{adhoc}    & Ad-Hoc mode \\
    778                      & \code{wds}      & WDS point-to-point link over wireless\\
    779                      & \code{monitor}  & The node acts as a passive monitor and
    780                                          only receives packets \\
    781 \hline
    782 \code{\strong{ssid}} & \code{<String>} & Set the SSID (Network Name) \\
    783 \hline
    784 \code{country}       & \code{\{ALL|DE|JP|US|\ldots\}} & The country code used
    785                                                         to determine the
    786                                                         regulatory settings. \\
    787 \hline
    788 \end{tabular}
    789 
    790 \subsubsection{Security Settings}
    791 \begin{longtable}{l|l|p{10cm}}
    792 \strong{Option} & \strong{Parameter} & \strong{Description} \\
    793 \hline\hline
    794 \code{\strong{security}} & \code{none}    & No authorization \\
    795                          & \code{wep}     & WEP key \\
    796                          & \code{wpa-psk} & WPA with preshared key \\
    797                          & \code{8021x}   & IEEE 802.1X authentication \\
    798 \hline
    799 \code{\strong{authorization}} &                 & \strong{wpa-psk} \\
    800                               & \code{psk}      & WPA PSK \\
    801                               & \code{psk2}     & WPA2 PSK \\
    802                               & \code{psk psk2} & WPA PSK and WPA2 PSK \\
    803                               &                 & \strong{8021x} \\
    804                               & \code{wpa}      & WPA with RADIUS \\
    805                               & \code{wpa2}     & WPA2 with RADIUS \\
    806                               & \code{wpa wpa2} & WPA and WPA2 \\
    807 \hline
    808 \code{\strong{encryption}} &                 & \strong{wep} \\
    809                            & ---             & not needed, automatically by key size \\
    810                            &                 & \strong{wpa-psk} \\
    811                            & \code{tkip}     & RC4 encryption \\
    812                            & \code{aes}      & AES encryption \\
    813                            & \code{aes+tkip} & support both \\
    814                            &                 & \strong{8021x} \\
    815                            & \code{wep}      & RC4 encryption (static) \\
    816                            & \code{tkip}     & RC4 encryption \\
    817                            & \code{aes}      & AES encryption \\
    818                            & \code{aes+tkip} & support both \\
    819 \hline
    820 \code{eap-type} &                     & \strong{8021x} \\
    821                 & \code{\strong{tls}} & Transport Layer Security \\
    822                 & \code{ttls}         & Tunnelled TLS \\
    823                 & \code{peap}         & Protected EAP \\
    824                 & \code{leap}         & Cisco Wireless \\
    825 \hline
    826 \code{key} &                            & \strong{wep} \\
    827            &\code{\{\strong{1}|2|3|4\}} & Select WEP key to use. \\
    828 \hline
    829 \code{key[1..4]} &                 & \strong{wep} \\
    830                  & \code{<String>} & WEP key.  The key must be 5, 13 or 16
    831                                      bytes long, or 10, 26, 32, or 64 hex
    832                                      digits long.  The encryption algorithm is
    833                                      automatically selected based on the key
    834                                      size. key1 is the key for WEP client mode.
    835                                      \\
    836 \hline
    837 \code{wpa-key} &          & \strong{wpa-psk} \\
    838                & <String> & Password to use with WPA/WPA2 PSK (at least 8, up
    839                             to 63 chars) \\
    840 \hline
    841 \code{wpa-gtk-rekey} &                              & \strong{wpa-psk},
    842                                                       \strong{8021x} \\
    843                      & \code{<Int>} (\strong{3600}) & Rekeying interval in
    844                                                       seconds. \\
    845 \hline
    846 \code{\strong{radius-ipaddr}} &                  & \strong{8021x} \\
    847                               & \code{<a.b.c.d>} & IP to connect. \\
    848 \hline
    849 \code{radius-port} &                              & \strong{8021x} \\
    850                    & \code{<Int>} (\strong{1812}) & RADIUS-Port no. to connect
    851                                                     \\
    852 \hline
    853 \strong{radius-key} &                 & \strong{8021x} \\
    854                     & \code{<String>} & Shared Secret for connection to the
    855                                         Radius server \\
    856 \hline
    857 \end{longtable}
    858 
    859 \subsubsection{MAC filter}
    860 \begin{tabular}{l|l|p{10cm}}
    861 \strong{Option} & \strong{Parameter} & \strong{Description} \\
    862 \hline\hline
    863 \code{macmode} & \code{\{0|1|2\}} & 0: Disable MAC address matching. \\
    864                &                  & 1: Deny association to stations on the MAC
    865                                        list. \\
    866                &                  & 2: Allow association to stations on the MAC
    867                                        list. \\
    868 \hline
    869 \code{maclist} & \code{<MAC1> \ldots <MACn>} & List of space separated mac
    870                                                addresses to allow/deny
    871                                                according to \code{macmode}.
    872                                                Addresses should be entered with
    873                                                colons, e.g.:
    874                                                "\code{00:02:2D:08:E2:1D
    875                                                00:03:3E:05:E1:1B}"\\
    876 \end{tabular}
    877 
    878 \subsubsection{Wireless Distribution System (WDS)}
    879 \begin{tabular}{l|l|p{10cm}}
    880 \strong{Option}       & \strong{Parameter}          & \strong{Description} \\
    881 \hline\hline
    882 \code{lazywds}        & \code{\{0|1\}}              & Accept WDS connections
    883                                                       from anyone \\
    884 \hline
    885 \code{wds-bridge}     & \code{br\{X\}}              & Add WDS peers to bridge
    886                                                       brX \\
    887 \hline
    888 \code{wds-security}   & \code{\{wpa-psk\}}          & secure the wds bridge
    889                                                       with WPA (optional)\\
    890 \hline
    891 \code{wds-encryption} & \code{\{aes|tkip\}}         & Use AES or TKIP as
    892                                                       cipher\\
    893 \hline
    894 \code{wds-wpa-key}    & \code{<String>}             & Password to use with WPA
    895                                                       PSK (at least 8, up to 63
    896                                                       chars) \\
    897 \hline
    898 \code{wds}            & \code{<MAC1> \ldots <MACn>} & List of WDS peer mac
    899                                                       addresses
    900                                                       (\code{xx:xx:xx:xx:xx:xx},
    901                                                       space separated) \\
    902 \hline
    903 \end{tabular}
    904 
    905 \subsubsection{Miscellaneous}
    906 \begin{longtable}{l|l|p{10cm}}
    907 \strong{Option} & \strong{Parameter} & \strong{Description} \\
    908 \hline\hline
    909 \code{channel}  & \code{\{1--14\}}  & The wifi channel \\
    910 \hline
    911 \code{maxassoc} & \code{\{1--255\}} & Maximum number of associated clients \\
    912 \hline
    913 % TODO: add descriptions to the different gmode settings
    914 \code{gmode} &                      & Set the 54g Mode \\
    915              & \code{\strong{Auto}} & default \\
    916              & \code{LegacyB}       & \\
    917              & \code{GOnly}         & \\
    918              & \code{BDeferred}     & \\
    919              & \code{Performance}   & \\
    920              & \code{LRS}           & \\
    921 \hline
    922 \code{frameburst} & \code{\{\strong{0}|1\}} & Disable/Enable frameburst mode. \\
    923 \hline
    924 \code{txpower} & \code{\{0--255|\strong{$-1$}\}} & Set the transmit power in dBm \\
    925 \hline
    926 \code{rate} & \code{<Int> (\strong{$-1$})} & force a fixed rate \\
    927             &                              & valid values for 802.11a are (6,
    928                                              9, 12, 18, 24, 36, 48, 54) \\
    929             &                              & valid values for 802.11b are (1,
    930                                              2, 5.5, 11) \\
    931             &                              & valid values for 802.11g are (1,
    932                                              2, 5.5, 6, 9, 11, 12, 18, 24, 36,
    933                                              48, 54) \\
    934             &                              & $-1$ means automatically determine
    935                                              the best rate \\
    936 \hline
    937 \code{rts}          & \code{\{0-2347\}}       & Set the RTS threshhold. \\
    938 \hline
    939 \code{frag}         & \code{\{256-2346\}}     & Set the fragmentation
    940                                                 threshhold. \\
    941 \hline
    942 \code{afterburner}  & \code{\{\strong{0}|1\}} & Enable Afterburner capability
    943                                                 \\
    944 \hline
    945 \code{isolate}      & \code{\{\strong{0}|1\}} & Hide Clients from each other \\
    946 \hline
    947 \code{bridge-if}    & \code{\{br0..brX\}}     & The bridge interface (optional)
    948                                                 \\
    949 \hline
    950 \end{longtable}
    951 
    952 \subsubsection{Examples for wireless configuration}
    953 
    954 \paragraph{WLAN with WPA1/WPA2 AES+TKIP}
    955 
    956 This combination works with any kind of WPA client implementation.
    957 
    958 \begin{Verbatim}[label=\file{/etc/network/interfaces}]
    959 auto eth1
    960 iface eth1 inet static
    961         address 192.168.10.1
    962         netmask 255.255.255.0
    963         broadcast +
    964         wireless-type broadcom
    965         wireless-country DE
    966         wireless-mode ap
    967         wireless-ssid FreeWRT
    968         wireless-security wpa-psk
    969         wireless-authorization psk psk2
    970         wireless-encryption aes+tkip
    971         wireless-wpa-key 12345678
    972         wireless-channel 11
    973 \end{Verbatim}
    974 
    975 If you want to do MAC filtering, add the following to the sample above:
    976 \begin{Verbatim}[label=\file{/etc/network/interfaces}]
    977         wireless-macmode 2
    978         wireless-mac 00:01:02:03:04:05 06:07:08:09:0a:0b
    979 \end{Verbatim}
    980 this enables the filter and defines the list to contain addresses that should be allowed.
    981 
    982 \paragraph{WLAN without encryption}
    983 
    984 If you already use VPN to secure your connection, you can just use an unencrypted setup
    985 and setup the firewall on your embedded device.
    986 
    987 \begin{Verbatim}[label=\file{/etc/network/interfaces}]
    988 auto eth1
    989 iface eth1 inet static
    990         address 192.168.10.1
    991         netmask 255.255.255.0
    992         broadcast +
    993         wireless-type broadcom
    994         wireless-country DE
    995         wireless-mode ap
    996         wireless-ssid FreeWRT
    997         wireless-security none
    998         wireless-channel 11
    999 \end{Verbatim}
    1000 
    1001 \paragraph{WLAN client with WPA2 (AES)}
    1002 
    1003 This can only be used in routing mode, you can not bridge it with LAN or WAN interfaces.
    1004 
    1005 \begin{Verbatim}[label=\file{/etc/network/interfaces}]
    1006 auto eth1
    1007 iface eth1 inet static
    1008         address 192.168.10.1
    1009         netmask 255.255.255.0
    1010         broadcast +
    1011         wireless-type broadcom
    1012         wireless-country DE
    1013         wireless-mode sta
    1014         wireless-ssid FreeWRT
    1015         wireless-security wpa-psk
    1016         wireless-authorization psk2
    1017         wireless-encryption aes
    1018         wireless-wpa-key 12345678
    1019 \end{Verbatim}
    1020 
    1021 WLAN with WDS nodes, the WDS nodes need to have the same
    1022 SSID, channel and encryption parameters. The WDS connection is separetely
    1023 secured via WPA1 and AES. WPA2 for WDS connection security is \_not\_ working.
    1024 
    1025 WDS node 1 (MAC of Wireless \code{06:05:04:03:02:01})
    1026 \begin{Verbatim}[label=\file{/etc/network/interfaces}]
    1027 auto br0
    1028 iface br0 inet static
    1029         bridge-ifaces eth1
    1030         address 192.168.10.1
    1031         netmask 255.255.255.0
    1032         broadcast +
    1033         wireless-type broadcom
    1034         wireless-country DE
    1035         wireless-mode wds
    1036         wireless-ssid FreeWRT-WDS
    1037         wireless-security wpa-psk
    1038         wireless-authorization psk psk2
    1039         wireless-encryption aes+tkip
    1040         wireless-wpa-key apkey
    1041         wireless-lazywds 1
    1042         wireless-wds-security wpa-psk
    1043         wireless-wds-encryption aes
    1044         wireless-wds-wpa-key wdskey
    1045         wireless-wds 01:02:03:04:05:06
    1046         wireless-wds-bridge br0
    1047 \end{Verbatim}
    1048 WDS node 2 (MAC of Wireless \code{01:02:03:04:05:06})
    1049 \begin{Verbatim}[label=\file{/etc/network/interfaces}]
    1050 auto br0
    1051 iface br0 inet static
    1052         bridge-ifaces eth1
    1053         address 192.168.10.2
    1054         netmask 255.255.255.0
    1055         broadcast +
    1056         wireless-type broadcom
    1057         wireless-country DE
    1058         wireless-mode wds
    1059         wireless-ssid FreeWRT-WDS
    1060         wireless-security wpa-psk
    1061         wireless-authorization psk psk2
    1062         wireless-encryption aes+tkip
    1063         wireless-wpa-key apkey
    1064         wireless-lazywds 1
    1065         wireless-wds-security wpa-psk
    1066         wireless-wds-encryption aes
    1067         wireless-wds-wpa-key wdskey
    1068         wireless-wds 06:05:04:03:02:01
    1069         wireless-wds-bridge br0
    1070 \end{Verbatim}
    1071 
    1072 \paragraph{Peer-to-Peer/AdHoc mode (no encryption, IP must be static)}
    1073 \begin{Verbatim}[label=\file{/etc/network/interfaces}]
    1074 auto eth1
    1075 iface eth1 inet static
    1076         address 192.168.10.1
    1077         netmask 255.255.255.0
    1078         broadcast +
    1079         wireless-type broadcom
    1080         wireless-country DE
    1081         wireless-mode adhoc
    1082         wireless-ssid FreeWRT
    1083         wireless-security none
    1084         wireless-channel 11
    1085 \end{Verbatim}
    1086 
    1087 \subsection{Bridging}
    1088 
    1089 This is mostly needed to combine LAN and WLAN to a homogeneous network.
    1090 Be sure you have installed the package \app{bridge-utils}.
    1091 See the example for a bridging setup, WLAN is secured via WPA/WPA2.
    1092 
    1093 \begin{Verbatim}[label=\file{/etc/network/interfaces}]
    1094 auto eth0.0
    1095 iface eth0.0 inet manual
    1096         switch-ports 1 2 3 4 5*
    1097 
    1098 auto eth1
    1099 iface eth1 inet manual
    1100         wireless-type broadcom
    1101         wireless-country DE
    1102         wireless-mode ap
    1103         wireless-ssid FreeWRT
    1104         wireless-channel 11
    1105         wireless-security wpa-psk
    1106         wireless-authorization psk psk2
    1107         wireless-encryption aes+tkip
    1108         wireless-wpa-key MyWlanSecret
    1109         wireless-bridge-if br0
    1110 
    1111 auto br0
    1112 iface br0 inet static
    1113         bridge-ifaces eth0.0 eth1
    1114         address 192.168.1.1
    1115         netmask 255.255.255.0
    1116         broadcast +
    1117 \end{Verbatim}
    1118 
    1119 This creates a new bridging interface \code{br0} which combines the VLAN
    1120 interface \code{eth0.0} (representing the LAN-ports 1--4) and the WLAN interface
    1121 \code{eth1} (on some devices like \term{Asus WL500gP} this might be \code{eth2}).
    1122 The bridge interface needs always be the last one, otherwise it can not find
    1123 the interfaces in \code{bridge-ifaces}.
     749For AP mode and WEP/WPA/WPA2/WPA3 you need to select, configure and run hostapd.
    1124750
    1125751\subsection{PPP}
    … …  
    1235861Same semantics as above.
    1236862
    1237 
    1238 \section{Traffic Control}
    1239 
    1240 To aid in setting up Quality of Service and Traffic Shaping, FreeWRT provides a
    1241 configurable script via the \app{fwrtc} package. Though this package will allow
    1242 you to choose between different implementations of Queueing Disciplines, for
    1243 now there exists only a single implementation using HTB.
    1244 
    1245 \subsection{Concept}
    1246 
    1247 In general, \app{fwrtc} allows classifying of network traffic into three classes:
    1248 \begin{description}
    1249         \item[REAL] high priority, mid bandwidth \\
    1250                 use this for low delay applications like \app{SSH}, \app{VoIP}
    1251                 or \app{DNS}
    1252         \item[BULK] mid priority, high bandwidth \\
    1253                 this is a generic class for everything that doesn't fit above
    1254                 or below
    1255         \item[P2P] low priority, low bandwidth \\
    1256                 use this class for all unwanted traffic disturbing normal use
    1257                 of the internet connection (\app{P2P} and other parasites)
    1258 \end{description}
    1259 
    1260 \paragraph{Note} that fwrtc does not actually classify the traffic, it just
    1261 provides the classes above and allows comfortable configuration of the
    1262 necessary values. For classifying traffic, use \app{iptables} (see below for
    1263 more details).
    1264 
    1265 \subsection{Installation}
    1266 
    1267 This is done just like with any other FreeWRT package, so using the ADK to
    1268 integrate it into the firmware image right from the start or by installing it
    1269 afterwards using \app{ipkg}.
    1270 
    1271 \subsection{Configuration}
    1272 
    1273 \app{fwrtc} basically exists of two files:
    1274 \begin{itemize}
    1275         \item the script itself \file{/etc/hotplug.d/net/10-fwrtc}
    1276         \item a configuration file \file{/etc/fwrtc.conf}
    1277 \end{itemize}
    1278 It should not be necessary to touch the hotplug script, so adjusting the
    1279 configuration values should be enough to complete the first part of the setup
    1280 process.
    1281 
    1282 The second part consists of defining \app{iptables} rules for classifying
    1283 traffic. \app{fwrtc} provides three \app{tc}-filters (one for each class),
    1284 matching different firewall marks (see the \code{MARK} target of
    1285 \app{iptables}).
    1286 
    1287 See the example below to gather some inspiration on how to actually
    1288 implementing the rules:
    1289 
    1290 \begin{Verbatim}[label=sample set of iptables rules for fwrtc]
    1291 iptables -t mangle -A POSTROUTING -o eth0 -j tc
    1292 
    1293 ### match ip tos Minimum-Delay
    1294 iptables -t mangle -A tc -m tos --tos 0x10 -j MARK --set-mark 0x1
    1295 iptables -t mangle -A tc -m tos --tos 0x10 -j RETURN
    1296 
    1297 ## fish out tcp syn, syn-ack and ack packets (no piggyback!)
    1298 iptables -t mangle -A tc -p tcp -m length --length 44:84 \
    1299         --tcp-flags SYN,FIN,RST SYN -j MARK --set-mark 0x1
    1300 iptables -t mangle -A tc -p tcp -m length --length 44:84 \
    1301         --tcp-flags SYN,FIN,RST SYN -j RETURN
    1302 iptables -t mangle -A tc -p tcp -m length --length 44:84 \
    1303         --tcp-flags SYN,ACK,FIN,RST ACK -j MARK --set-mark 0x1
    1304 iptables -t mangle -A tc -p tcp -m length --length 44:84 \
    1305         --tcp-flags SYN,ACK,FIN,RST ACK -j RETURN
    1306 
    1307 ### prioritize icmp packets
    1308 iptables -t mangle -A tc -p icmp -j MARK --set-mark 0x1
    1309 iptables -t mangle -A tc -p icmp -j RETURN
    1310 
    1311 ### dns traffic
    1312 iptables -t mangle -A tc -p tcp --dport 53 -j MARK --set-mark 0x1
    1313 iptables -t mangle -A tc -p tcp --dport 53 -j RETURN
    1314 iptables -t mangle -A tc -p udp --dport 53 -j MARK --set-mark 0x1
    1315 iptables -t mangle -A tc -p udp --dport 53 -j RETURN
    1316 
    1317 ### games
    1318 iptables -t mangle -A tc -m layer7 --l7proto quake-halflife -j MARK --set-mark 0x1
    1319 iptables -t mangle -A tc -m layer7 --l7proto quake-halflife -j RETURN
    1320 iptables -t mangle -A tc -m layer7 --l7proto battlefield1942 -j MARK --set-mark 0x1
    1321 iptables -t mangle -A tc -m layer7 --l7proto battlefield1942 -j RETURN
    1322 iptables -t mangle -A tc -m layer7 --l7proto battlefield2 -j MARK --set-mark 0x1
    1323 iptables -t mangle -A tc -m layer7 --l7proto battlefield2 -j RETURN
    1324 
    1325 ### voip
    1326 iptables -t mangle -A tc -m layer7 --l7proto sip -j MARK --set-mark 0x1
    1327 iptables -t mangle -A tc -m layer7 --l7proto sip -j RETURN
    1328 iptables -t mangle -A tc -m layer7 --l7proto rtp -j MARK --set-mark 0x1
    1329 iptables -t mangle -A tc -m layer7 --l7proto rtp -j RETURN
    1330 iptables -t mangle -A tc -m layer7 --l7proto skypetoskype -j MARK --set-mark 0x1
    1331 iptables -t mangle -A tc -m layer7 --l7proto skypetoskype -j RETURN
    1332 
    1333 ### crappy p2p traffic
    1334 iptables -t mangle -A tc -m layer7 --l7proto bittorrent -j MARK --set-mark 0x3
    1335 iptables -t mangle -A tc -m layer7 --l7proto bittorrent -j RETURN
    1336 iptables -t mangle -A tc -m layer7 --l7proto edonkey -j MARK --set-mark 0x3
    1337 iptables -t mangle -A tc -m layer7 --l7proto edonkey -j RETURN
    1338 iptables -t mangle -A tc -m layer7 --l7proto fasttrack -j MARK --set-mark 0x3
    1339 iptables -t mangle -A tc -m layer7 --l7proto fasttrack -j RETURN
    1340 iptables -t mangle -A tc -m layer7 --l7proto gnutella -j MARK --set-mark 0x3
    1341 iptables -t mangle -A tc -m layer7 --l7proto gnutella -j RETURN
    1342 iptables -t mangle -A tc -m layer7 --l7proto napster -j MARK --set-mark 0x3
    1343 iptables -t mangle -A tc -m layer7 --l7proto napster -j RETURN
    1344 \end{Verbatim}
    1345 
    1346863\section{FWCF - FreeWRT Configuration Filesystem}
    1347864
    … …  
    1350867system or to commit changes to the fwcf partition.
    1351868
    1352 On bootup the script \file{/sbin/mount\_root} is executed, which calls
     869On bootup a script is executed, which calls
    1353870\command{fwcf setup} to setup \file{/etc/} as memory filesystem and overlay the
    1354871changes committed to the fwcf partition.
    … …  
    1357874required to execute \command{fwcf commit}. This will compress all changed or
    1358875new files in \file{/etc/} and write the result into the fwcf partition.  The
    1359 fwcf partition is 128 Kb in size. This size is not changeable at the moment.
    1360 
    1361 If you need more detailed information, please read the specification of FWCF,
    1362 which can be found at
    1363 \url{http://www.freewrt.org/trac/wiki/Documentation/Specs/FwCf}
     876fwcf partition is 256 Kb in size. This size is not changeable at the moment.
     877
     878If you need more detailed information, please read the specification of FWCF.
    1364879
    1365880If you want to remove all your changes and start your configuration from
    … …  
    1376891
    1377892IPKG uses a configuration file similar to \file{/etc/apt/sources.list}, which
    1378 contains a list of software repositories available via HTTP or FTP.  The
    1379 configuration file \file{/etc/ipkg.conf} contains the official FreeWRT 1.0
    1380 repository for your board and kernel version.
     893contains a list of software repositories available via HTTP or FTP. 
    1381894
    1382895To update the list of available packages execute following command as root:
    … …  
    1387900This command requires a working internet connection, because it will fetch a
    1388901package list from every repository declared in \file{/etc/ipkg.conf}.
     902It is also only working for JFFS2 based root filesystem. For squashfs root filesystem
     903embed your application and reflash.
    1389904
    1390905To install a new package use following command:
    … …  
    1394909
    1395910This will install the package \app{tcpdump} and all dependencies onto the
    1396 flash.  Where the data is saved depends on the root filesystem you decided to
    1397 use while installing FreeWRT. If you use jffs2 as root filesystem, then the
    1398 package is installed on the big linux partition. If you use squashfs-overlay,
    1399 then the package is installed on the mini-fo overlay filesystem which writes
    1400 its data to the jffs2 data partition. If you use a squashfs-symlinks
    1401 filesystem, then the package data is directly install into the jffs2 data
    1402 partition, containing symlinks to the read-only squashfs partition.
     911flash.
    1403912
    1404913You can also remove packages, but this is only useful if you are using jffs2 as
    … …  
    1411920\app{libpcap} is still installed after executing this command.  On jffs2 root
    1412921filesystem you should never remove any essential packages like \app{busybox},
    1413 \app{fwcf} or \app{uclibc}, otherwise you make the embedded system unusable.
     922\app{fwcf} or \app{uclibc}, otherwise you make the WLAN router unusable.
    1414923
    1415924Nearly the same as for removing packages, counts for \command{ipkg upgrade}.
    1416 Please \strong{never ever} use \command{ipkg upgrade} to update your embedded
    1417 system. This command is only useful to upgrade single packages on a jffs2
    1418 rootfilesystem or data partition.
     925Please \strong{never ever} use \command{ipkg upgrade} to update your WLAN
     926router. This command is only useful to upgrade single packages on a jffs2
     927rootfile system.
    1419928
    1420929\section{Startup scripts}
    … …  
    1471980Having this policy helps you to configure your FreeWRT embedded system without
    1472981shooting yourself in the foot. For example if you try to realize a firewall
    1473 system and trying to set the rules in \file{/etc/firewall.user}, which is read
     982system and trying to set the rules in \file{/etc/firewall.conf}, which is read
    1474983by \file{/etc/init.d/S45firewall}, if the iptables package is installed. You
    1475984can just reload the changed ruleset via \code{/etc/init.d/S45firewall restart}.
    … …  
    15421051\section{Failsafe Mode}
    15431052
    1544 Failsafe mode is very useful if you misconfigured your embedded system, so that
     1053Failsafe mode is very useful if you misconfigured your WLAN router, so that
    15451054you can not access it anymore. E.g. if you accidentially disabled secure shell
    15461055or misconfigured the firewall, so that you can not login any more.
    15471056
    15481057When in failsafe mode, the device won't interpret any networking setup files.
    1549 It stops even before the root filesystem gets mounted read--write, and fwcf is
    1550 set up. It will just set the LAN interface up and give it the IP address
     1058It stops even before fwcf is set up. It will just set the LAN interface up and give it the IP address
    15511059\file{192.168.1.1} and netmask \file{255.255.255.0}. Then it will start a
    15521060\app{telnet} daemon, so you get straight access (without depending on the
    … …  
    15661074\end{Verbatim}
    15671075
    1568 For some operating systems we provide ready to go binaries of failsafe.
    1569 Take a look at \url{http://www.freewrt.org/downloads/tools/failsafe}
    1570 
    15711076The tool just opens a network socket and waits for a special UDP packet
    1572 from the embedded device. FreeWRT sends the UDP packet via the first
     1077from the WLAN router. FreeWRT sends the UDP packet via the first
    15731078recognized network interface (eth0).
    15741079
    15751080\subsection{Enabling Failsafe Mode}
    15761081
    1577 Connect your computer to the embedded system via direct or crossed network
     1082Connect your computer to the WLAN router via direct or crossed network
    15781083cable. Use the failsafe port (in most cases one of the LAN ports), see the
    15791084device specific page for the exact network port.
    … …  
    15871092\end{Verbatim}
    15881093
    1589 After that power on your embedded system and wait for the following message in
     1094After that power on your WLAN router and wait for the following message in
    15901095your failsafe application running on your computer:
    15911096
    … …  
    15951100
    15961101As soon as this message is displayed you should push the reset button of
    1597 your embedded system. You have 2 seconds time to push the button. If you
     1102your WLAN router. You have 2 seconds time to push the button. If you
    15981103successfully enabled the failsafe mode, following message will be displayed:
    15991104
    … …  
    16021107\end{Verbatim}
    16031108
    1604 Now you should be able to login to your embedded system via a telnet
     1109Now you should be able to login to your WLAN router via a telnet
    16051110application. Just use:
    16061111
    … …  
    16121117
    16131118If you want to repair your configuration, you first need to mount the root
    1614 filesystem read--writeable. This is best done via:
     1119filesystem. This is best done via:
    16151120
    16161121\begin{Verbatim}
Note: See TracChangeset for help on using the changeset viewer.