IPsec and VPN's

There are several ways to isolate users/groups in a network. One of the neatest ways however is by setting up VPN's (virtual private networks). This is where IPsec comes in.IPsec is a protocol which sits on top of the Internet Protocol (IP) layer. It allows two or more hosts to communicate in a secure manner (hence the name).

There are several online guides to setting up IPsec VPN's:

Creating a VPN between two networks, separated by the Internet, using FreeBSD gateways.

Linux:
Linux IPsec HOWTO
IPsec tools

Windows:
Setting up a windows XP client
IPsec and you

Mixing Different Clients and Servers (Windows/Linux):
Jacco's networking stuff
OpenSwan setup for Linux server and Linux/Windows clients
FreeSwan setup for Linux server and Linux/Windows clients

Example System:
IPSec Secure Tunnel at Mathnet

OLSR

It seems that Mobilemesh is dying a slow painful death and its time to look for something else. OLSR seems to be a suitable replacement and it has been compiled for WRT54G! See: http://www.seattlewireless.net/index.cgi/OpenWrt and http://www.olsr.org/index.cgi?action=download

Interesting Blog on Mesh

Click Here

Setting up WDS on the linksys

Wow it's been a while since a posting on this blog ... it's time to start testing out some linksys ideas again.

Always wanted to test the performance of WDS vs pure mesh. HEre are some good links on setting up WDS

1. The sveasoft WDS tutroial - a little old - April 2004
2. Tutorial with some nice picures
3. Good overall technical information on WDS from Orinioco

Lets add wireless cameras to the mesh

So far the best chepaest solution is again from our friends at Linksys

The WVC54G

The Linksys Wireless-G Internet Video Camera sends live video with sound through the Internet to a web. it contains its own web server, so it can connect directly to a network, either over Wireless-G (802.11g) networking, or over 10/100 Ethernet cable. MPEG-4 video compression produces a high-quality, high-framerate, up to 640x480 audio/video stream.

Quick price search on Froogle revealed price range from: $180 to $200, a Froogle price search on our WRT54G gave a price range of $70 to $85.

With the current price of the Linksys WRT54G at R700, my estimate is that we will get this wireless web enabled camera for around R1800 in South Africa - still checking with BuillionIT and Westcon.

I searched Eagles web site for similar products and they range from R5500 to R10000.

And guess what: I downloaded the source for the wireless camera - looks like linksys are sticking to their GPL ethic for all their products - this is a huge advantage - it means we can play with compressions ratios, the web interface, the camera settings - basically turn the box into anything we want

CNN.com - Cities find Wi-Fi future - Oct 18, 2004

CNN.com - Cities find Wi-Fi future - Oct 18, 2004

linksys: adding files to the code.bin firmware

Community I developed a script to add custom files into the Linksys filesystem. This was needed, for example, to add ripd.conf and zebra.conf to /usr/local/etc for the zebra routing daemon.

This is how it works ($LINKSYS_SRC is the directory of your linksys source code eg. /home/djohnson/downloads/linksys/sveasoft/Alchemy-2.3.4/)

1. Copy the script (makeimage.sh) to $LINKSYS_SRC/src/router
2. Copy files that you need to the $LINKSYS_SRC/src/router/mipsel-uclibc/target directory (you can make directories and add/delete files in here)
3. Execute the makeimage.sh script from the $LINKSYS_SRC/src/router directory
4. A new code.bin will be built which can be uploaded to the linksys box

The makeimage.sh script looks as follows:

#$include .config
#iLINUIXDIR=(shell pwd)
#echo $LINUXDIR
#export LINUXDIR
#export PLATFORMDIR := $(TOP)/$(PLATFORM)
#export INSTALLDIR := $(PLATFORMDIR)/install
#export TARGETDIR := $(PLATFORMDIR)/target

../linux/linux/scripts/squashfs/mksquashfs mipsel-uclibc/target mipsel-uclibc/target.squashfs -noappend
cp ../linux/linux/arch/mips/brcm-boards/bcm947xx/compressed/vmlinuz mipsel-uclibc
../../tools/trx -o mipsel-uclibc/linux.trx mipsel-uclibc/vmlinuz mipsel-uclibc/target.squashfs

cp ../linux/linux/arch/mips/brcm-boards/bcm947xx/compressed/zImage mipsel-uclibc
dd conv=sync bs=64k < mipsel-uclibc/zImage > mipsel-uclibc/linux.bin
cat mipsel-uclibc/target.squashfs >> mipsel-uclibc/linux.bin

cp mipsel-uclibc/linux.trx ../../image/linux.trx
cp ../../image/linux.trx ../../image/code.bin

De-bricking Linksys WRT54G

Thanks Andrew for the help on this one

1. Enter directory with code.bin
2. Start tftp
3. >connect 192.168.1.1
4. >binary
5. >trace
6. >rexmt 1
7. >status

Should display
Connect to 192.168.1.1
Mode: octet Verbose: on Tracing: on
Rexmt-interval: 1 seconds, Max-timout: 25 seconds

8. put code.bin
9. Power cycle the Linksys - Hopefully it should upload the new firmware
10. Hold down the reset button until power light flashes

Linksys WRT54G specs summary

Specs

Ports:

* WAN: One 10/100 RJ-45 port for WAN connectivity
* LAN: Four 10/100 RJ-45 Auto-MDI(X) switched ports
* WLAN: 54mbps 802.11g on a MiniPCI card (1.0)/built-in (1.1) with dual external RP-TNC antenna ports

LED Indicators (1.0):

* Power, DMZ, Diag
* WLAN: Act, Link
* LAN: Link/Act, Full/Col, 100
* Internet: Link/Act, Full/Col, 100

Channels: 1-11 (USA)

System requirements: One PC (200MHz or Faster Processor) with: 64MB RAM, Internet Explorer 4.0 or Netscape Navigator 4.7 or Higher for Web-based Configuration, CD-ROM Drive, Microsoft Windows 98, Me, 2000, or XP, a 802.11g or 802.11b Wireless Adapter with TCP/IP Protocol Installed or Network Adapter with Category 5 Ethernet network cable and TCP/IP Protocol installed

In the box: Wireless-G Broadband Router, Power Adapter, Setup CD-ROM with User Guide, Ethernet Network Cable, Quick Installation guide, Registration Card

Device details:

* Width: 7.32 inches
* Height: 1.89 inches
* Depth: 6.89 inches
* Warranty, parts: 1-year limite
* Warranty, labor: 1-year limited

Transmit Power: 15 dBm (Can be increased to 20db/84mw) (FIX: 84mw=19.24db) Info: 15db=31mW 17db=50mW 20db=100mW

Receiver Sensitivity (unconfirmed):

* -65db for ofdm 802.11g 54 megs
* -80db for dsss 802.11b 11 megs

Power (1.0?): 5V @ 2.0A, center

Power (2.0): 12V @ 1.0A, center positive. (Regulated internally down to 3.3V by an AnaChip? 1501-33, so the unit should be very tolerant of input fluctuations from 5 to 40 volts. Get the polarity right and it'll make do with whatever you give it.)

To turn on ripd and zebra, go to Advanced -> Routing -> Dynamic Routing and click Apply."

How to set up Linksys as a RIP2 router with client mode

How to set up Linksys as a RIP2 router with client mode

1. Load Alchemy pre-release 5.2.3 onto the linksys

2. Set the Linksys Wireless interface to Client mode and set SSID to "pta-mesh"

Using the web interface select Wireless - Basic Settings
Wireless Mode : Client
SSID: pta-mesh
Select Save Settings - continue

3. Choose your IP addresses for the Wireless interface and the LAN interface

I chose the following
WAN interface: 10.50.1.13
LAN interface: 10.3.11.1

Using the Web interface select Setup - Basic Setup
Internet Connection Type: Static IP
Internet IP Address: 10.50.1.13
Subnet Mask: 255.255.255.0
Router Name: Something you like eg. david_home
Local IP Address: 10.3.11.1
Subnet Mask: 255.255.255.0

Select Save Settings - continue

4. Add router configuration files to the target directory

Enter the router directory ($LINKSYS/src/router)
# cd /mipsel-uclibc/target
# mkdir /usr/local
# mkdir /usr/local/etc

Download my RIP configuration files for linksys
ripd.conf
zebra.conf

Copy these files to $LINKSYS/src/router/mipsel-uclibc/target/usr/local/etc

Download my image making script which will build files in the code.bin image
makeimage.sh

Copy this script to $LINKSYS/src/router
Run the script
./makeimage.sh

You should now have a code.bin with the router config files in /usr/local/etc
Upload this new firmware to the linksys

5. Add commands to rc_startup to startup RIP, Flush iptables (so that RIP messages can arrive on RIP port) and remove NAT

zebra -d -f /usr/local/etc/zebra.conf
ripd -d -f /usr/local/etc/ripd.conf
iptables -F
iptables -F -t nat

8. You should now have a rip enabled linksys client - Try ping the network connected to the wireless interface from a machine connected to the LAN


Things to improve in this recipe
1. Don't flush all iptables - just enable the port for RIP routing
2. Find location in Makefile where the code.bin image is made - don't need my custom script

New Order - computer security and networking portal

Nice Wifi-security related article

Compiling Satori 4.0 with latest tool chain

To compile using the latest toolchain:

1) Apply this patch (also fixes zebra):
http://www.greyskydesigns.com/~lonewolf/satori_fix.patch

Code:
lonewolf@lonewolf:/data4/wrt54g/satori/WRT54G$ patch -p1 --dry-run
patching file src/router/rc/writeimage.c
patching file src/router/zebra/Makefile
patching file src/router/zebra/lib/Makefile
patching file src/router/zebra/ospfd/Makefile
patching file src/router/zebra/ripd/Makefile
patching file src/router/zebra/zebra/Makefile
lonewolf@lonewolf:/data4/wrt54g/satori/WRT54G$ patch -p1
patching file src/router/rc/writeimage.c
patching file src/router/zebra/Makefile
patching file src/router/zebra/lib/Makefile
patching file src/router/zebra/ospfd/Makefile
patching file src/router/zebra/ripd/Makefile
patching file src/router/zebra/zebra/Makefile
lonewolf@lonewolf:/data4/wrt54g/satori/WRT54G.orig$


2) Run 'make'

3) When 'make' errors out, run 'for i in src/router/iproute2/lib/*.a; do mipsel-uclibc-ranlib $i; done'

4) Run make again

5) for i in src/router/iproute2/tc/*.a; do mipsel-uclibc-ranlib $i; done

6) make yet again

Check out here for the forum discussion at sveasoft on the topic

Zebra Routing on the linsys

Advnaced Linux routing
Setting up RIP on zebra
Zebra manual

Great site for Linux wireless LAN driver info

Wirless LAN resources for Linux

Setting up a remote sniffer on the linksys

How to setup kismet on linksys

How to route between WLAN and LAN on the linksys box

Make sure you have installed Sveasoft Alchemy 5.2.4

Go to Administration - Diagnostics and enter the following into the command line
brctl delif br0 eth1
ifconfig eth1 down
ifconfig eth1 up
if addr add 192.168.2.1/24 dev eth1

Click on "save startup"
Reboot linksys

This will create a new subnet for the wireless side of the router on the 192.168.2.0 network
The LAN side of the router will remain on the 192.168.1.0 network

The revolution has begun

Here is a list of all the people registered on www.nodedb.com in Johburg and Pretoria with wifi access points. Disorganised collection of people with all sorts of AP's - no one doing any meshing as yet. Question is - does the CSIR reveal their network to the general population - register on nodedb.com?? Security issues could prohibit and we have a different purpose - namely Removing the barriers to enable bottom-up creation of access infrastructure through use of wireless mesh netwirking - their purpose is similar to CB radio - just make a community network. It might be good though to involve a few of these nodes in Pta if the can help on linux/linksys coding side - we could isolate them from the csir network.

List of all active Pretoria nodes

List of all active Johannesburg nodes

Also thanks Albert for pointing our JAWUG (Johannesburg Area Wireless User Group)
JAWUG

The vision of JaWug is to create the largest Community run Wireless Network in the Johannesburg area.

JaWug is a not-for-profit effort to develop a wireless broadband community network in Johannesburg - a free, locally owned wireless backbone.

To get aroung any legal attacks they put a discalimer on their site: Please Note: We do NOT sell Internet connectivity!

There is also a lot of actiuvity and interest in Pretoria - apparently a network called FreeNet - can't find a URL - found this long discussion on the south african myadsl forum

Discussion about sharing ADSL through WiFi in Pta

Here's an idea for assigning IP addresses to houses

Got this idea from CU wireless

"We will assign numbers to stations from 10.0/16. The last 16 bits are the XOR of the first two octets of the MAC number, the second two octets, and the third octets, where the bytes are taken in 'reading order.' That is, we produce numbers 10.0.A.B from the MAC numbers. If the MAC produces A = 0, B = 0 or A = 255, B = 255, then A and B are assigned randomly. The netmask is /16. (We compute numbers from the MAC to begin with because in the common case, a station will boot with the same A and B every time, which is useful for diagnostic purposes.) The host networks are assigned from 10/8. We assign to each Ethernet interface, a network 10.A.B.0, where A and B are computed as above from the Ethernet MAC number. If A = 0, we re-assign it randomly. The netmask is /24."

Here's an idea for assigning IP addresses to houses

Got this idea from CU wireless

"We will assign numbers to stations from 10.0/16. The last 16 bits are the XOR of the first two octets of the MAC number, the second two octets, and the third octets, where the bytes are taken in 'reading order.' That is, we produce numbers 10.0.A.B from the MAC numbers. If the MAC produces A = 0, B = 0 or A = 255, B = 255, then A and B are assigned randomly. The netmask is /16. (We compute numbers from the MAC to begin with because in the common case, a station will boot with the same A and B every time, which is useful for diagnostic purposes.) The host networks are assigned from 10/8. We assign to each Ethernet interface, a network 10.A.B.0, where A and B are computed as above from the Ethernet MAC number. If A = 0, we re-assign it randomly. The netmask is /24."

The old wire segment feed. I ran netstumbler after installing the new feed. There seems to be a slight increase in gain, but a definate improvement in bandwidth , i.e. I get better gain in the higher and lower channels as opposed to just channel 6.