DD-WRT

All posts tagged DD-WRT

Using ASUSWRT for Local DNS and DHCP

Posted by Ripdubski on 2015.05.26
Posted in: Router. Tagged: , , , , , , . 5 Comments

A little background on ASUSWRT.  ASUSWRT is the firmware ASUS ships on current routers.  It started as a fork of the Tomato firmware project.  Tomato is similar to DD-WRT.  ASUSWRT-Merlin is an enhanced, and fixed (some), version of the ASUS supplied ASUSWRT.

 

Post Switch Concerns

After switching to ASUSWRT from DD-WRT I thought I would be losing the ability to serve local DNS.    I was wrong.  I loaded ASUSWRT-Merlin on my ASUS RT-N66U.  After some trial and error configuration I discovered local DNS is alive and well in ASUSWRT-Merlin.

There is one minor caveat in that local DNS only works for DHCP served addresses, unless you further modify the dnsmasq configuration from the command line.  I spent a lot of time managing non-DHCP addresses in that fashion with DD-WRT, and want to make management as simple as possible.  The dnsmasq service used by ASUSWRT operates as a masquerading forwarding DNS server.

With DD-WRT I had non-DHCP addresses allocated in a certain range (0-99), and DHCP addresses from 100 to 255.  Within the DHCP addresses I reserved the first 20 (via DHCP reservations) for our devices.  Which let any guests pickup other addresses.  Why?

With DD-WRT I broke the DHCP range into two and had QOS rules in place for each group.  Guest addresses received tighter restrictions and lower bandwidth.   Managing these in DD-WRT was a pain. The ASUSWRT makes it a lot simpler to accomplish the same things.

 

Local DNS Setup

I couldn’t find any definitive guides on setting this up, only that it could be done.  So heres how.  Before proceeding, to make things easier, make sure all devices in the ASUS Client list have a name showing up.  If the name doesn’t show up, click it’s MAC address  (top one) and define it in the pop-up window that appears.

Open the LAN menu, and “DHCP Server” tab.  A few things to note:

a) “Enable the DHCP Server” should be Yes.

b) The routers Domain Name can be blank or you can set it to what you want, just don’t use one of the top level domains like com, net, org, etc.  I chose “home”.  This makes all hosts on my network resolvable as “hostname.home”.

c) Set the DHCP starting and ending range, for example 192.168.1.10 to 192.168.1.150.  The subnet and final address are blocked out in the image.  For the subnet, it should be the same as the routers defined subnet.  If you defined the routers address as 192.168.1.1 then the IP range should be on subnet 1.  I don’t use 1.

d) The “Default Gateway” is the gateway that clients will route through.

e) Now the DNS settings need special attention:

If you select Yes for “Advertise routers IP in addition to user specified DNS”, then the routers address will be appended to the DNS address list given to the clients when they lease an IP address.  I said “appended” meaning it will be LAST!

So if you want to be able to resolve names on your network without specifying the routers address as the name server to do the resolution (i.e.: nslookup – 192.168.1.1), then you should make sure the Advertise setting is set to No, and put the routers address in “DNS Server 1”.  This puts the router in the list FIRST!  Apply your secondary (if any) in “DNS Server 2”.

The last thing surrounding DNS, which ties into the router domain defined above, is the “Forward local domain queries to upstream DNS”.  This should be No.  You don’t want a query for “xbox.home” to be passed up to be resolved at the internet level.  You want it to stay on your network.

With DNS setup in this way, your hosts (blah.home) are answered first from the local DNS cache while external hosts (www.apple.com) are answered from your ISP (or OpenDNS, Google, etc) DNS servers.

 

ASUSWRT-LocalDNS

f) Click the Apply button when done.

DHCP

I typically assign a static address to devices that I want to always be at a certain address (like a printer, NAS drive, etc).  I typically setup appliances like streaming players and TV’s with static addresses too since they really don’t need to change.

I still wanted to resolve the problem where these non-DCHP devices (devices with static IP assignments) could be resolved on the network WITHOUT having to modify configuration from the command line.  Remember, simple, low maintenance.

To resolve this I changed all devices with static IP’s to DHCP.  Bonus that makes device setup simpler too.  I then setup DHCP reservations for them within the DHCP pool in a particular range (99 or less). This way I can easily identify “appliances” from computing devices.

a) Set the “Enable Manual Assignment” to Yes.

b) Use the dropdown to select a device, which will have the MAC address or device name (if it was given by the requesting client or defined manually on the ASUSWRT Client list).

 

c) Set the address (it will default to whatever it was assigned by the server).  If you want to change it, change it.

d) Click the + button.

e) Click the Apply button.

ASUSWRT-DHCPStatic

Traffic Control

With DD-WRT I had devices setup in ranges with guest range relegated to low bandwidth and peer to peer services blocked.  I want the same thing with ASUSWRT.  I also had my devices defined with particular classes of service.

The ASUSWRT firmware has defaults based on traffic type, mainly surrounding file transfer.

Once enabled you can delete the default ones, and add custom ones.

I added the peer to peer services using the service name drop down and selecting the common ones.  To add, select it, set the priority, and click the + sign icon.

I then added my devices, this time using the Source IP or Mac dropdown.  The name will show up if it was offered by the requesting client or was manually defined on the ASUS Client list.  This makes it a cinch to add, unlike DD-WRT where you add each device by MAC address only.

ASUSWRT-TrafficPriority

Once defined, click the Apply button.

So what about the lower priority guest traffic?  With ASUSWRT, any traffic not matching a rule gets routed to the “Low” setting.  I have my low and lowest settings set to use very little bandwidth.

I now have ASUSWRT doing everything DD-WRT was doing, and without command line management.

 

Oh, and now is a good time to backup the configuration using the Administration/Save feature.

 

Leaving DD-WRT

Posted by Ripdubski on 2015.05.21
Posted in: DD-WRT. Tagged: , , . 6 Comments

In this post I explain why I recently chose to leave DD-WRT, and instead opt for the ASUSWRT.

First, DD-WRT (http://www.dd-wrt.com) is an alternative firmware for many routers.  It offers many features and benefits over many of the manufacturer firmwares that ship with routers.  I’ve run DD-WRT on my primary router for the past 5+ years with a great deal of satisfaction in both features and performance.

Some of the key features I use:

  • DHCP : This router “standard” feature gives hosts on the network an IP address for a period of time.  It manages which host has which address, and the renewals when they expire.
  • Local DNS : This gives the ability to lookup local hosts on the network by name rather than by their IP address.  The version in DD-WRT (DNSMasq) integrates with DHCP giving the ability to lookup names without maintaining a manual table.  This was the number one reason I went to DD-WRT.
  • VPN: Many routers offer Virtual Private Networking.  With VPN a secure connection can be made to the router from anywhere with Internet access such as a Hotel.  Think of it as a secure route to your home network.  DD-WRT was no exception.  DD-WRT allowed multiple VPN sessions whereas many routers only allow one.  I only need one at any given time so the number supports isn’t a big deal.
  • QOS: Quality Of Service is not something all routers offer.  With QOS individual hosts can be given different priorities to the available WAN connection bandwidth.  In addition to hosts, network protocols can be prioritized as well.  This is especially useful for degrading peer to peer (P2P) traffic such as bit-torrent if needed, or upgrading voice over IP (VOIP) traffic.
  • Filtering: Filtering give the ability to block access to sites containing certain words in their body content or URL.  It can also be used to completely block certain traffic such as P2P.  DD-WRT allow these to be applied in ranges.  I had a range for devices I own, and a range for guest devices (managed through DHCP reservations).  The guest devices had all P2P traffic blocked.
  • DDNS: DDNS is Dynamic DNS.  This allows the router to send WAN IP address updates to a service provider of your choice when the WAN IP address changes.  The service provider could be a DNS provider.  For example if you host a web site from a machine in your home, you have a leased WAN IP address (most common), and have a domain name myawesomewebsitemachine.com, updating the DNS record is mandatory if you want/need continual access to it.  In my case I was pushing updates to DNS-O-Matic (http://www.dnsomatic.com), which in turn updated OpenDNS (http://www.opendns.com) so my content filtering continues to abide by my rule definitions (since its based on incoming WAN IP match).
  • Traffic Monitor: This gives the ability to see how much bandwidth is being sent in and out of the WAN connection.  Initially I was using this to monitor the monthly usage as there was a usage cap set by my ISP.  Later it just become trivia to get an idea of the household usage.

 

So why would I want to leave?

DD-WRT is actively being updated to add features and provide security fixes.  But…  There’s always a but.  As the router hardware gets older it sees less and less updates in favor of newer hardware.  There are exceptions to that.  In my case I am using an ASUS RT-N16 router.  In the entire time I was running DD-WRT, there was one update.  And that update was in 2010.

My DD-WRT firmware was almost 5 years old.  In the last year there have been several security issues surrounding VPN.  I don’t use VPN often, but when I do I want it to be secure.  The last time I used it was April 2015.  I was nervous leaving it on for the duration I needed it.

I started looking at updates for DD-WRT and found there may be one, but figuring out which firmware and where to get it was proving to be a difficult task – harder than it needs to be (links to links to links from the main DD-WRT site, and maintained by users only known by handles).  For me, it boiled down to a matter of trust at that point.  How do I know there was no backdoor embedded or other malicious code added?

 

What did I switch to?

I looked at some alternatives like Tomato (http://www.polarcloud.com/tomato) and OpenWRT (https://openwrt.org), but ultimately decided to use ASUS’ own firmware.  The firmware ASUS initially shipped on the RT-N16 was not the greatest.  If I recall correctly it was a 1.x version that last time I looked at it.  I also have an ASUS RT-N66U which serves as an access point.  I’ve seen their latest interface and have been happy with it and the updates it receives.  I looked at their latest offering for the RT-N16, which is now called ASUSWRT, and found that it is actively being updated and has basically the same version as the RT-N66U.  I chose this as my first option.  If I don’t like it in the long run, I’ll look at OpenWRT since it appears to be actively updated on the RT-N16 as well.

 

What is missing?

Of all the features of DD-WRT that I was using, the only feature not included in the current ASUSWRT firmware is local DNS.  This was the primary reason I went to DD-WRT.  I thought about how often I actually reference another machine by name, vs bookmark or other predefined link.  As it turns out, it’s not that often.  Thus, I committed to the ASUSWRT.

 

How did I convert?

  1. I backed up the the DD-WRT configuration to a file.  I also printed (to PDF) the contents of each of the interface configuration pages for reference.
  2. I logged into the router using the command line, and executed “erase nvram”.
  3. I then used DD-WRT update firmware to load the ASUSWRT firmware.  At completion, the router reboots itself.
  4. When it came back up, I renewed the lease on my computer so it could communicate with the router again, since the primary router address and subnet changed.
  5. I logged into ASUSWRT and used the reset router to factory defaults and rebooted again.
  6. This time when it was back up, I logged into ASUSWRT and immediately changed the routers primary address and subnet.  Then again, reboot.
  7. I renewed the lease on my computer again so I could again communicate with the router again, since the address and subnet had been changed again.
  8. I logged into ASUSWRT again, then went through all the settings and configuring what I needed.

 

What did I end up with?

DHCP: A given, standard feature of all routers.

VPN: Not as robust as the DD-WRT solution which supports multiple connections, but it is current and secure and supports the single connection I need from time to time.

QOS: Ability to prioritize different traffic on the network by protocol or host.

Filtering:  Ability to filter (block) websites based on content or URL.

DDNS: Ability to update external DNS or other services with the local WAN IP address when it changes.

Traffic Monitor: Ability to see traffic patterns on the network.  This screenshot shows the first day of usage:

ASUSWRT-Traffic24

+ Labeled QOS Entries: This was a pleasant bonus.  In DD-WRT, QOS entries are listed as MAC addresses only (no names), so you need a cross reference table to identify what device is what.  Having names makes it simple to see the Ooma VOIP phone and quickly setting it to highest priority.  There are 5 priorities: Highest, High, Medium, Low, and Lowest.

+ QOS Tuning: ASUSWRT gives the ability to tune the QOS priorities to bandwidth specifications you want for both upload and download.   All devices on my network are accounted for and given priorities from Highest to Medium.  Guest traffic will land on Low by default thanks to the next item (Unmatched QOS).  In this screenshot you can see I gave Low and Lowest extremely tight limits:

ASUSWRT-QOS

+ Unmatched QOS: Unmatched QOS traffic is automatically mapped to the “Low” setting.  You don’t have to worry about a non-accounted for device sucking up all the bandwidth.

+ The GUI interface is a lot nicer to look at than DD-WRT’s.  I like the status screen in particular:

ASUSWRT-Status

 

Summary

After the first two days I only ran into 1 instance where I tried to reference a device on the network by name.  Losing Local DNS has had minimal impact.  If it becomes too much of a problem I may look at enabling DNS on the Synology NAS.

The only complaint I have is that even though the wireless is turned off, it still shows the SSID.

There is also a modified version of ASUSWRT called “ASUSWRT-Merlin” (http://asuswrt.lostrealm.ca) that adds many features.  I may look at this in the future should I replace the RT-N16.

 

 

 

DD-WRT Web Server for Viewing All Network IPs

Posted by Ripdubski on 2014.04.14
Posted in: DD-WRT. Tagged: , , , , , , , , , . Leave a comment

dd-wrtNOTE: I no longer use DD-WRT and am unable to answer any questions about it.

Expanding on my last post of setting up a static page, this post will create dynamic content (albeit at boot time) to be served statically using the embedded HTTP server in DD-WRT.

For small home networks with a mix of leased and non-leased IP addresses, it is sometimes useful to see all of the allocated addresses at one time.  Or maybe you can’t remember the name of a device in which name lookup does you no good.  You can use this method to create a static web page that has both hosts you define with static addresses, and hosts with dynamic addresses assigned by the DD-WRT DHCP server.  Of the latter, it will include DHCP addresses that have reservations.

Why separate the static addresses from the reserved DHCP addresses?

  • I assign hardware devices like printers, set top boxes, and game consoles with static addresses.  Set and forget, almost.  I use a range of address outside of the DHCP pool for this purpose and I keep track of it on a spreadsheet.  These devices should never have to change, ever, so I don’t need them managed by DHCP.
  • I have two ranges with a single DHCP pool for two different purposes.  The first is the equipment in our family; laptops, phones, etc.  I want these in the first range.  I want them to grab DNS and gateway information from the router as well as their address so I don’t have to maintain them at each device, but I also want them to have the same IP at each boot, so I set them up with reservations in DHCP (within the first range).  The second range is for guest equipment (visitors phones, etc).  I apply two different QOS (quality of service) settings to these ranges.  If you’re a guest, you get no P2P and your traffic has the lowest priority on my network.  Sorry.

 

End Result

What you’ll end up with is a web page that has two panes.  One pane shows all the static addresses you create, the other pane shows all the DHCP leases (at router boot time).  You will access it by entering the following URL into your device’s browser: “http://router_address/user/hosts.html”.  If you have setup the router so that DNSmasq resolves local DNS names, you can substitute the router address for its name on the network – I covered that in an earlier post here.  This is what the web page will look like when complete:

HostsPage

It’s simple, small, and fast.  You can customize the headers, footers, and titles to be as pleasing as you want.  Keep in mind the HTTP server doesn’t have all the bells and whistles you would normally have.

 

Setup, File Creation

First you need to create a hosts file containing the entries for the statically assigned (not reserved DHCP).  These are the printers, set top boxes, game consoles, etc.  Devices that don’t leave the house and have no reason to ever change.

  • Login to the router as the administrator.
  • Change directory to /jffs/www: “cd /jffs/www”
  • Create the hosts file with vi: “vi hosts”.  The syntax is IP address, tab, device name, device name alias.  The content will be similar to this:

192.168.56.20 dsnas nas
192.168.56.40 wii
192.168.56.41 xbox
192.168.56.60 zinohd bluray dvd
192.168.56.70 mg6120 printer

  •  Create the file that will be served by the HTTP server (hosts.html).  This will use a frame set, yes I know it can be done with CSS but I was keeping this pure HTML.  Still in the “/jffs/www” directory, using vi: “vi hosts.html”:

<!--DOCTYPE html>
<html>
<frameset cols="50%,50%">
<frame src="hoststat.html" />
<frame src="hostdhcp.html" />
</frameset>
</html>

  • Create a header stub file (“hosts_head.html”) which will be used in the dynamic creation of the pages contents.  In the same directory “/jffs/www”, again using vi: “vi hosts_head.html”:

<html>
<head>
<meta http-equiv="Content-Type" content="text/html" />
<title>DNS Hosts - home</title>
</head>
<body>

  • Create a footer stub file (“hosts_foot.html”) which will be used in the dynamic creation of the pages contents.  In the same directory “/jffs/www”, again using vi: “vi hosts_foot.html”:

</code>
</body>
</html>

  • Create the Static pane’s title file (“hosts_title_stat.html”).  In the same directory “/jffs/www”, again using vi: “vi hosts_title_stat.html”:

<h3>DNS Hosts (Static) - home</h3>
<code>

  • Create the DHCP (leased) pane’s title file (“hosts_title_dhcp.html”).  In the same directory “/jffs/www”, again using vi: “vi hosts_title_dhcp.html”:

<h3>DNS Hosts (Leased) - home</h3>
<code>

 

Setup, Activation

  • Now the router has to be told to create the pages at boot. You will utilize the boot script to do it. If you already have one, append this to it. If you don’t have one, create it.  In the directory “/jffs/bin”, again using vi: “vi boot_set.sh”:

# Setup DNS Host web page
# Copy the hosts.html file from /jffs/www to the serving location /tmp/www
cp /jffs/www/hosts.html /tmp/www/hosts.html
# Setup DNS Static web page frame
# Copy the header to a new file in /tmp/www as hoststat.html.
cp /jffs/www/hosts_head.html /tmp/www/hoststat.html
# Concatenate the title stub onto the new file.
cat /jffs/www/hosts_title_stat.html >> /tmp/www/hoststat.html
# Parse the contents of the hosts file you created above into the new file.
while read line; do
echo "${line}
" >> /tmp/www/hoststat.html
done < /jffs/etc/hosts
# Concatenate the footer stub onto the new file
cat /jffs/www/hosts_foot.html >> /tmp/www/hoststat.html
# Setup DNS Leased web page frame
# Copy the header to a new file in /tmp/www as hostdhcp.html.
cp /jffs/www/hosts_head.html /tmp/www/hostdhcp.html
# Concatenate the title stub onto the new file.
cat /jffs/www/hosts_title_dhcp.html >> /tmp/www/hostdhcp.html
# Parse the contents of the hosts file generated by DNSmasq into the new file.
while read line; do
echo "${line}
" >> /tmp/www/hostdhcp.html
done < /tmp/hosts
# Concatenate the footer stub onto the new file
cat /jffs/www/hosts_foot.html >> /tmp/www/hostdhcp.html

  • If you have just created the boot script, you need to tell DD-WRT to use it. I showed you how in a previous post here.
  • Reboot the router so it will go through the file generation steps.

 

That’s all there is to it. Enjoy!

Using DD-WRT to Serve Static Web Pages

Posted by Ripdubski on 2014.04.04
Posted in: DD-WRT. Tagged: , , , . 4 Comments

NOTE: I no longer use DD-WRT and am unable to answer any questions about it.

One thing DD-WRT can do, which is under-stated, is serve web pages (internally) via it’s built-in HTTP server. This post will demonstrate how to set it up with a simple static page which displays “Hello Home!” In another post I’ll show how to make something pretty useful with it. Stay tuned!

Pre-requisites

Before this will work and be of any use, the following must be enabled. If yours are not, enable them, then reboot the router.

a) JFFS. See my post on enabling JFFS if you need help.
b) Web Info Status page.

Storage and Access

After reboot, /www/user will be symlinked to /tmp/www. The static page will be served from this location. The access URL will be: http://router_address/user/static.html

Setup Steps

-Login to the router as root via ssh.
-Change directory: cd /jffs/bin
-Edit the startup script (if you don’t have one, create it – boot_set.sh). Add the following to the start of the file. This will copy the html file from the storage location to the serving location. to the html file we are going to serve:
# Copy static web page to serving location
cp /jffs/etc/static.html /tmp/www/static.html
-Change directory: cd /jffs/etc
-Now create the static page “/jffs/etc/static.html” with vi:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html" />
<title>Static Intranet Web Page Test</title>
</head>
<body>
<h3>Hello Home!</h3>
</body>
</html>
-Login to the routers web admin page and navigate to Administration > Commands.
-Enter “/jffs/bin/boot_set.sh” in the Command Shell/Commands section.
-Click the “Save Startup” button.
-Reboot by navigate to Administration > Management and click “Reboot Router” from the web interface.

Test

At this point the URL should be available and you should be able to bring up the page from a browser: http://router_address/user/static.html

Stay tuned to see how you can utilize this in a very useful way!

w

DD-WRT and OpenDNS

Posted by Ripdubski on 2014.03.24
Posted in: DD-WRT. Tagged: , , . Leave a comment

NOTE: I no longer use DD-WRT and am unable to answer any questions about it.

OpenDNS is a nice easy way to implement some degree of content control (filtering) on your home network.  They have two ways to accomplish it.

The first is a preconfigured set of filtering designed with family usage in mind.  It may filter more than you actually want to.  On the flip side it does not require an OpenDNS account.  It also cannot be used with the set described below.

The second is customized and relies on a configuration you set.  To do this they rely on your external IP address when the DNS query hits their servers.  If the address is not updated, you may not get your configured filtering.  So it’s important to keep your address updated within your OpenDNS account.  They have a utility which you can install that does an update when you logon to your computer, but that’s not ideal if you don’t use the computer configured to do the update every day.

If you use DD-WRT, a better solution exists.  You can have DD-WRT take care of it by coupling it with DNS-O-MATIC.  DNS-O-MATIC is a helper service offered by OpenDNS that provides updates to OpenDNS.  Here’s how.

First you need to create a DNS-O-MATIC account.  Sign in with your OpenDNS account credentials.  Associate your OpenDNS account and your OpenDNS configured network with DNS-O-MATIC.  Follow their instructions, it’s easy.

Then, Enable Dynamic DNS within DD-WRT:

  1. Go to Setup > DDNS
  2. Set DDNS Service to “Custom”
  3. Set DynDNS Server to “updates.dnsomatic.com”
  4. Set Username to DNS-O-Matic login (same as your OpenDNS account).
  5. Set Password
  6. Set Hostname to “all.dnsomatic.com”
  7. Set URL to “https://updates.dnsomatic.com/nic/update?&#8221;
  8. Set “Do not user external ip check” to Yes
  9. Set “Force Update Interval” to the number of days you want to force an update.  I recommend daily, or 1.
  10. Click “Apply Settings” button.
  11. Click “Save” button.

 

Now reboot the router.

  1. Go to the “Administration > Management” tab.
  2. Scroll to the bottom and click the “Reboot Router” button.

 

Once the router comes up, DD-WRT will send an update to DNS-O-MATIC once per day with your current external IP address.  DNS-O-MATIC will in turn update your OpenDNS configured network with it.

Now to customize the content filtering, login to OpenDNS and configure your network as you see fit, including blacklists and whitelists.  Enjoy!

 

Life with DD-WRT

Posted by Ripdubski on 2013.12.06
Posted in: DD-WRT. Tagged: , . Leave a comment
Backup and Restore

Backup and Restore (Photo credit: Wikipedia)

NOTE: I no longer use DD-WRT and am unable to answer any questions about it.

I’ve been a big advocate of DD-WRT.  It really works great and offers a lot of features in comparison to the stock router firmwares.  You can review my other posts on the subject or head over to http://www.dd-wrt.com/site/index for more information.  Installation is not for the in-experienced, but the outcome is well worth the effort.

Over the last 18 months I have experienced only 2 problems with DD-WRT.  Both times it was the same issue.  Both times it happened after saving / applying a change. The result was complete reset of the configuration to defaults.  Both times I did not have a current backup, though I did have old ones, of the configuration and was forced to rebuild it.  The problem as I see it occurs only if multiple saves or applies are performed in succession, not necessarily rapid, but back to back.

Though I regularly backup all my tablets and computers, the other devices were off my radar.  I’ve now added, at least, the routers and wireless access points to period backup schedules.  In the case of DD-WRT it takes several hours to get the configuration set up (for me), mainly because of the DHCP reservations, local DNS, QOS configuration, local HTTP hosting, to name but a few.

Todays lesson: Backup *ALL* your devices that have a backup ability.  In the case of DD-WRT, it only takes a minute to login to the GUI and do the backup.  Here is how:

  1. Login to the routers web interface.
  2. Select the Administration tab.
  3. Select the Backup tab.
  4. Click the Backup button.  The file “nvrambak.ini” will be saved to the location your browser is set to save files (in my case, the desktop).
  5. Move the file to a backup location such as a NAS drive, etc.

Using DD-WRT for Local DNS and DHCP

Posted by Ripdubski on 2013.03.26
Posted in: DD-WRT. Tagged: , , , , . 24 Comments
English: Screenshot of DD-WRT v24 SP2 mini bui...

English: Screenshot of DD-WRT v24 SP2 mini build running on a Linksys WRT160N. MAC address and WAN IP blanked out. (Photo credit: Wikipedia)

NOTE: I no longer use DD-WRT and am unable to answer any questions about it.

I’ve been slowly feeding you information on how to get the most out of the open-source DD-WRT router firmware.

In this article I’ll show you how to setup DD-WRT to act as a local name server on your home network and as a forwarder for external requests.  This will let you lookup names on your internal network (like xbox360, bluray, printer, etc) and continue to lookup names for external sites (like http://www.bing.com, http://www.opendns.com, http://www.apple.com, etc).

Before you begin you should have already enabled JFFS.  I showed you how here: Enable JFFS on DD-WRT

Enable DNS and DHCP

First you need to enable Local DNS and DHCP.  This turns on DNSMasq (built into DD-WRT) to do local network name resolution and distribute IP addresses via DHCP.  Pooled addresses get used and released via timed leases (devices using a pooled address may not always get the same IP address).  Static Addresses entered in the DHCP options are respected by DNSMasq and issued to the devices when they connect and request an IP address (devices using static addresses always get the same IP address).  Use a static address for devices that will never need to change, like your printer or a desktop computer.

  • Open a browser and point it to your router running DD-WRT.  Authenticate with the admin ID and password when needed.
  • Go to the “Setup > Basic Setup” tab.
  • In the “Network Setup > Router IP” section, enter the following details:
Local DNS = 0.0.0.0
  • In the “Setup > Basic” tab, in the “Network Address Server Settings (DHCP)” section, set the following options:
DHCP Type = DHCP Server
DHCP Server = Enable
Start IP Address = Whatever you want
Maximum DHCP Users = However big a pool you want. Do not overrun subnet!
Client Lease Time = 1440
Static DNS Addresses: 192.168.64.1, 208.67.220.220, 208.67.222.123
WINS = 0.0.0.0
Use DNSMasq for DHCP = Enable
Use DNSMasq for DNS = Enable
DHCP Authoritative = Enable

Note:  The Static DNS Addresses will be different for your network.  In this case I have set the address of the router itself (192.168.64.1) – fill in your routers address here (not the WAN one), and two OpenDNS name servers (208.67.220.220 and 208.67.222.123).  I’ll talk about OpenDNS in another post, but what these do is filter websites based on my custom criteria (*.220.220).  In the event that server does not respond in a timely manner, the request then goes to a more restrictive pre-configured filter supplied by OpenDNS FamilyShield (*.222.123).  The filtering effectively blocks access to sites deemed inappropriate.

  • In the “Services Management > DHCP Server” section, set the following options.  In this example I use “home.net” as the home network identifier.   You can replace “home” with whatever your like.  You can replace “.net” with a few different choices.  Home networks are most closely categorized into “.net” or “.info”.  If you are not registering a domain name to point to your WAN IP address, you can use whatever you want including “.com” or “.mil”.  You can, but don’t – home networks are not commercial or military.  Further, don’t use “.example”, “.test”, “.invalid”, or “.localhost” – these are reserved.  See the following link for a list you can choose from: top level domains.
Used Domain: LAN & WLAN
LAN Domain: home
Add any static leases you want or need.
  • In the “Services Management > DNSMasq” section, set the following options:
DNSMasq = Enable
Local DNS = Enable
  • There is a field for “Addition DNSMasq Options” in the DNSMasq section.  Set it as follows:
local=/home/
expand-hosts
domain-needed
bogus-priv
addn-hosts=/jffs/etc/hosts.home
strict-order

You may find these options useful as well:
no-poll : (may be useful to reduce system load on non embedded as well)
no-hosts : (we’re not going to read from any system generated hosts file on a ram disk) (for this configuration DO NOT set this!)

  • Click “Apply Settings”, then “Save”.

Create Static Hosts File

Now you need to create a hosts file that will be persistent across reboots for those devices which are you want using static IP addresses (like printers, routers, etc).

  • ssh into the router and login as root.
  • Change directory to jffs/etc: “cd /jffs/etc”
  • Create and edit the file “hosts.home” using vi (vi hosts.home).
  • Add the entries and save the file (with “ESC Z Z” or “:w!:q!”.  Entry formats are “xxx.xxx.xxx.xxx name” where xxx.xxx.xxx.xxx is the IP address you want to reserve and name is the device name you want referenced as.  Multiple names can be given, just enter them all on the same line separated by a space (xxx.xxx.xxx.xxx name1 name2 etc).

Reboot

Reboot the router by going to the “Administration > Management” tab in the browser interface.  Scroll to the bottom and click the “Reboot Router” button.

If all goes well, you should be able to lookup names on your network like “xbox360” or “xbox360.home” and get a result, as well as normal internet name resolution for external sites like “www.apple.com”.

If you can not resolve local names, you may need to release and re-acquire the IP and DNS information on the host your trying to resolve from.  The easiest way is to just reboot it as well.

Note: Netflix on iOS devices causes DNSMasq to think a DNS rebind attack is occurring and by default an option in DNSMasq is forcibly set that you can not override in the GUI. A special workaround is needed to remove that option when DNSMasq starts.  I showed you how to fix rebind here: Fixing DNS Rebind on DD-WRT

Fixing DNS Rebind on DD-WRT

Posted by Ripdubski on 2013.03.04
Posted in: DD-WRT. Tagged: , , , . 4 Comments

NOTE: I no longer use DD-WRT and am unable to answer any questions about it.

DNS rebinding is a form of computer attack.  The DNS service (dnsmasq) built into DD-WRT has protections against this which are turned ON by default.  You might need to disable it if you use Netflix on any iOS devices due to the way Netflix is implemented (if you can’t stream from an iOS device you probably need this turned off).

Since the current build (v24-sp2-14896) of DD-WRT for the ASUS RT-N16 router does not have the option to toggle DNS rebind protection on and off, and it can’t be set as a parameter, a post boot fix is required.  This is a show to setup a small script that will make the required changes.  It is executed after the router boots.  You must have previously enabled JFFS for this to work.

  • Login to the router as the administrator via ssh (command line not web interface).
  • Change directory to the bin directory under /jffs (create it if its not there):
cd /jffs/bin
  • Use vi to create the script (vi boot_set.sh), or you can create it elsewhere and scp for ftp it up to the router.  Just make sure its in the /jffs directory tree.  Contents should be:
#!/bin/sh
# Fix DNS Rebind

# Make a copy of the booted configuration
cp /tmp/dnsmasq.conf /tmp/dnsmasq.orig

# Copy the contents of the booted configuration to a new file
# but excluding the stop-dns-rebind line
cat /tmp/dnsmasq.conf | sed -e '/stop-dns-rebind/d' > /tmp/dnsmasq.norebind

# Kill off the dnsmasq service
killall -9 dnsmasq

# Wait 1 second
sleep 1

# Move the new configuration file over the booted one
mv /tmp/dnsmasq.norebind /tmp/dnsmasq.conf

# Restart the dns service (dnsmasq) and tell it where 
# the configuration file is
dnsmasq --conf-file=/tmp/dnsmasq.conf
  • Mark the file as executable
chmod 755 boot_set.sh
  • Logout of the command line with ‘exit’.
  • Now login to the web interface of the router.
  • Select ‘Administration > Commands’ from the menu tabs.
  • In the commands field of the “Command Shell” section (at the top) enter (assuming you put it in /jffs/bin):
/jffs/bin/boot_set.sh
  • Click the “Save Startup” button.
  • Select ‘Administration > Management’ from the menu tabs.
  • Scroll to the bottom of the page.
  • Click the “Reboot Router” button.

After the reboot, DNS rebinding should be disabled!

 

 

Enabling JFFS on DD-WRT

Posted by Ripdubski on 2013.02.24
Posted in: DD-WRT. Tagged: , . 10 Comments

NOTE: I no longer use DD-WRT and am unable to answer any questions about it.

On my ASUS RT-N16 router, I run the open source DD-WRT firmware rather than the ASUS firmware.  Why?  Well, lots of reasons actually.  This router, like the others, is on all the time so any service it provides is available all the time.  DD-WRT provides the following features the ASUS doesn’t.

  • Local DNS.  It can answer name queries for local devices on my network in addition to forwarding external name (ie: web) queries.
  • Custom DDNS updater.  At periodic intervals the router checks the WAN IP and reports any change to OpenDNS.  I use OpenDNS as part of allowed content filtering solution into the home.
  • Bandwidth management (QOS – quality of service) on a per device basis, as well as group settings
  • Web server (small but enough to serve some static pages).  I have a couple of pages that I serve up so any device can get access to them.
  • Network time server.  It stays in sync and all the network devices can query it.
  • Reporting.  At any given time I can see what the months ISP bandwidth utilization is.  In a world of data caps, this helps.  And the ability to see whats happening through the router in real time.

Enable JFFS:

Before you can really make use of the local DNS or web server functions, you have to enable JFFS2.  This will tell you how.  Follow it exactly.  It’s expected that the base configuration is already complete.

  1. Login to the router web page.
  2. Click Administration.
  3. Look for the “JFFS2 Support” section.
  4. For the JFFS2 option, click the Enable radio button.
  5. Click Save at the bottom. Wait a few seconds.  Once the screen refreshes, click Apply at the bottom and wait again.
  6. Look for the “JFFS2 Support” section again.
  7. For the “Clean JFFS” option, click the Enable radio button.
  8. DO NOT click “Save” at the bottom!   Instead, click Apply at the bottom.  The router will format the available space.  Wait until the web GUI is back which may take a minute or two.
  9. Look for the “JFFS2 Support” section again.
  10. For the “Clean JFFS” option, click the Disable radio button.
  11. Click Save at the bottom.
  12. Click the Administration tab.
  13. Click the Maintenance tab.
  14. Click Reboot Router at the bottom.

After the boot is complete there will be a “/jffs” filesystem present.  It will have a “tmp/ipkg” directory in it which you can ignore.  Just leave it there.

Populate Persistent Data:

Now you can create a storage location(s) in the JFFS filesystem to hold those things you want to preserve across boots (ie: hosts file, startup scripts, web pages, etc).
Login via ssh as root, then create the directories.  I created these.

cd /jffs
mkdir etc
mkdir bin
mkdir web

Now you can scp the files you need into those directories, or use vi and create them manually.

I’ll expand on making use of this in another post.