done! (mostly)

At this point, I've mostly finished my WRTSL54GS project. The only thing left is the DMZ subnet, but as I don't have a server to put in it yet, it's not a big deal.

As I'm an ubergeek, I've created a network diagram of the new setup. As I'm a lazy geek, the diagram is, of course, not 100% accurate. I actually allocated a physical port on each OpenWrt box to be in the wifi vlan (vlan3), which I've been using to attempt to penetrate my wireless network with a knoppix install & nmap. Next I'll try something else - nessus or something more "black hat".

I intended to keep more notes here, but like I said, I'm lazy. Here's the highlights -

• shfs absolutely rules. it's easy to setup and makes backups a snap. the most difficult part was trying to get the passwordless auth to work. I *believe* I ended up generating the keypair with ssh-keygen on my CentOS box, compiling dropbear on CentOS and following some notes on how to convert the OpenSSH keys to the dropbear format using dropbearconvert. However, I did it on my previous OpenWrt install and since the backups worked so well, I've been using the same keys ever since.
• I'm being absolutely draconian about the usage of the wifi subnet, so I've setup iptables rules to DROP all packets from the wifi subnet to the other private subnets. For some reason, packets kept flowing when adding the -j DROP rules to the FORWARD table, so I've added them to the INPUT table (input_rule table on OpenWrt) and that's done the trick. I *think* it might be because they're coming from the bridge interface (wifi is br0 - a bridge between eth2 and vlan3) and not a direct interface.
  
• I have to sing the praises of OpenVPN once again, as well as the OpenVPN GUI for Windows. Reliable, secure, flexible, simple - what more could one ask for? I made the VPN'd wifi subnet one number higher in the third octet of my lan subnet, so it's now a /23 in my hosts.allow, etc. etc. instead of the /24 it used to me. Simple, yet secure.
• Setting up the second OpenWrt box as a WDS repeater was pretty simple, as the instructions are good. The major tweaks were:
• Had to comment out portions of /etc/init.d/S05nvram, as it kept on putting back default variables I wanted un-set
• Disabled S35firewall, S50httpd, S50telnet and S60dnsmasq as the other OpenWrt box is doing the majority of the work
• Created an S35noipforward script with the contents being "echo 0 > /proc/sys/net/ipv4/ip_forward" as we don't want to do routing across vlans on the repeater here - let it shuffle the packets on to the primary one.
• And of course, the vlan setup for the WDS repeater:
  

  root@remote:~# nvram show | sort | grep ^vlan
  size: 1782 bytes (30986 left)
  vlan0hwname=et0
  vlan0ports=0t 2 3 4 5*
  vlan3hwname=et0
  vlan3ports=0t 1 5

  To be complete, here's the config for the primary router:

  root@lightsaber:~# nvram show | sort | grep ^vlan
  size: 3887 bytes (28881 left)
  vlan0hwname=et0
  vlan0ports=0 3t 5*
  vlan1hwname=et0
  vlan1ports=4 5
  vlan2hwname=et0
  vlan2ports=1 5
  vlan3hwname=et0
  vlan3ports=2 3t 5

  OpenWrt port 3 of the primary is connected to OpenWrt port 0 of the WDS repeater. vlan tagging is awesome.

100 hits and OpenWrt updates

I recently got my 100th hit on WheresGeorge.com. I'm an ubergeek for sticking with it, but hey - it's addictive.

I've also made progress on my OpenWrt install. Thanks to mbm's awesome switch/interface diagram, I've gotten all my VLANs setup and thrown my WRTSL54GS live with WhiteRussian 0.9. I've got my old WRT54G 2.2 mostly setup as well to be the switch/repeater in the other room, but I want to test my iptables rules that prevent the wifi network from accessing the local lan, except if you're using OpenVPN. The only reason for the trepidation is that they changed to iptables from a simple "-i $WAN" setup of setting the interface to a "-A prerouting_wan" chain and I want to be sure I don't foul it up.

P.S. I didn't end up using the flash memory card on my WRTSL54GS. I had to give the flash reader to my in-laws for their digital camera. Maybe one day I'll resurrect that end of the project for more storage there.

xubuntu issues, round 1

the notebook was not powering off after shutdown. in some message board threads, "acpi=off" or "acpi=force" as grub args were recommended. what worked was adding the line "apm power_off=1" in /etc/modules.

what's next is to find out what's wrong with the pcmcia xircom network card. i still have to eject & insert the card in order to make it pick it up.

giving xubuntu a try

I'm nuking my crappy WindowsXP install on ye olde notebook - a Toshiba Satellite 4090XDVD. Since I fixed the VPN at work with OpenVPN, I don't need it to connect to the stupid Firebox PPTP (pronounced "PoPToP") VPN anymore. So I'm giving Xubuntu a try because it's supposed to be a lighter desktop.

One gotcha that I encountered on the install is that it didn't initially like my Xircom 10/100+56k modem network card. But I found a tip buried deep in a message board - eject the card, re-insert in and then tell the installer to redetect the network, and it works fine.

Another gotcha was the software dependencies. I am not exactly sure what went wrong, but it failed to install all the dependencies correctly on the first pass. I just told it to re-install again and it was fine. (shrug)