Alix - RHEL5 instead of OpenWRT
Keith Lofstrom
thing after another not working as expected - I cravenly gave
up and installed my favorite distro (Scientific Linux 5, a
RHEL5 clone) on my ALIX board. In one day, I am farther along
than I was with OpenWRT. That may be my familiarity with the
old stuff rather than flaws in OpenWRT, but I suspect many
of the Kamikaze/X86 packages are only lightly tested and I
may be pushing a few into unknown territory.
What finally drove me batty with OpenWRT was being unable to get
a dhcp lease from Verizon FIOS - after many, many other troubles.
The udhcpc program just doesn't do the job compared to good old
dhclient. I was slowly learning all the interesting ways that
OpenWRT configures itself, but it is far easier to copy all my
existing config files off my existing SL5 firewall.
Of course, I had to make changes - noatime, serial console,
ramdisk /tmp, etc - but they were relatively minor. It is
amazing how well an X86 linux system moves between machines,
especially if you are not supporting a display. In fact,
I installed from the distro DVD onto an X86 desktop (the
CF card was in a USB-to-CF adapter), and then modified
/boot/grub/menu.lst and /etc/fstab and /etc/inittab and
I was ready to boot on the ALIX.
I am using the 8GB Kingston CF cards that Fry's was selling this
weekend for $20. Their major downside is that it takes 6 hours
to write a complete image for one of these monsters; it is
faster just to install and load the difference files. I also
learned that it is silly to do the base install then remove
unneeded packages - after a lot of work, I got the footprint
for SL5 down from 1.1GB to 1.0GB . Next time I want to build
one of these, I will just use a smaller card or only the first
2GB of one of these cheap big ones. Just for giggles, I
made an extra copy of all the original installed files onto
the card, as well as all the files on my previous firewall,
onto the card as well. Now I am up to 50% usage. This is
huge compared to OpenWRT, but big cards are damned cheap.
If only they wrote faster ...
Perhaps another option with the big cards is some kind of RAID
system. As I understand it, flash wears out at the bit level,
and it is only a few of the bits that go flaky early. With a
3X redundancy software RAID system, plus error correction,
I imagine a flash memory will last a much longer time.
I will probably deploy tomorrow. I still have to copy some of
the configuration directories, and get a few obscure packages
like denyhosts running. Also, I need to install something like
nocat for the AP running on the DMZ port. I will probably
compile a new kernel for the ALIX with the AMD Geode crypto
engine stuff patched in. I am tempted to do something like
squashfs and jffs for the immutability and flash-friendliness,
but for now I just want to move on to something else!
With all the good brains and experience in PTP, OpenWRT is
probably still the distro of choice for deploying multiple
PTP nodes - however, it is probably comforting to know that
if OpenWRT fails or development is delayed, you can use
pretty much the same software load as you deployed on a
nucab on one of the ALIX boards.
Question: for the very simplest PTP portal, enough to support
a PTP splash page and an "I agree" button, what is the portal
software of choice these days? Should I even bother to log
usage or send it somewhere?
Keith
--
Keith Lofstrom kei...@keithl.com Voice (503)-520-1993
KLIC --- Keith Lofstrom Integrated Circuits --- "Your Ideas in Silicon"
Design Contracting in Bipolar and CMOS - Analog, Digital, and Scan ICs
Russell Senior
Keith> After beating my head against the OpenWRT wall for weeks - one
Keith> thing after another not working as expected [...]
Not to say there isn't a learning curve with OpenWrt, but ... you
could have asked me more questions! I am a willing resource, if
possessing finite capacity, but I would certainly be (have been) eager
to try to help.
Keith> Question: for the very simplest PTP portal, enough to support a
Keith> PTP splash page and an "I agree" button, what is the portal
Keith> software of choice these days? Should I even bother to log
Keith> usage or send it somewhere?
The very simplest (other than "none") to operate is probably
nocatsplash. Jason is the resident expert with it. I've personally
never used it.
http://nocat.net/downloads/NoCatSplash/
Back in the land of OpenWrt, the simplest to install is probably
wifidog, though that would require some coordination with me (the
keeper of the wifidog auth server) unless you wanted to install and
run your own auth server which is probably more overhead than makes
sense.
The other oldie-but-goodie is nocatauth. We use it on the nucabs. It
is written in Perl and so long as your firmware has Perl, that would
work as well. The version we use on the nucabs is stable. I am not
completely certain it is identical in every way to what you'll find
here:
http://nocat.net/downloads/NoCatAuth/
Feel free to ask if you have trouble.
--
Russell Senior, Secretary
rus...@personaltelco.net
Keith Lofstrom
> >>>>> "Keith" == Keith Lofstrom <kei...@kl-ic.com> writes:
> Keith> After beating my head against the OpenWRT wall for weeks - one
> Keith> thing after another not working as expected [...]
On Tue, Jan 06, 2009 at 03:02:26AM -0800, Russell Senior wrote:
> Not to say there isn't a learning curve with OpenWrt, but ... you
> could have asked me more questions! I am a willing resource, if
> possessing finite capacity, but I would certainly be (have been) eager
> to try to help.
Again, the stumper was related to the Verizon connection and udhcpc,
and that is a real bastard of a problem to help with remotely. I
was having trouble enough trying to get tcpdump to provide useful
data - as I understand it, it won't listen to a port before it is
up, and it is the DHCP handshake that I care about. Lots of quick
juggling of cables before software timed out. The tasks following
that would have involved SSL and OpenVPN, and probably porting a
couple of apps. The barriers seemed far too high, especially for
a heterodox solution when a "just like all the other machines"
solution seems to work. The only real problem is that the distro
image is bigger, and it takes much longer to write a CF card than
the tiny squashfs OpenWRT image does.
For simpler setups doing what OpenWRT does best, then of course
that is the right way to go for PTP. In fact, if you someday
want to try out a solution to the Verizon DHCP Problem, bring a
CF card by and we will try it. I can give you the MAC address
of my WAN port off the list. But if Verizon FIOS is not needed
for any PTP nodes right away, you can safely defer that problem.
The "Scientific ALIX" process is going well, mostly since it is an
almost direct copy of something working (I would not want to try it
with a non-X86, small RAM/Flash machine). In fact, I mentioned what
I was doing on the Scientific Linux mailing list, and I've already
gotten emails from a few of them, wanting to copy the setup for
scientific experiments. With a solar panel, one of those laptop
extender batteries, and a daytime-only radio in the miniPCI slot,
the ALIX makes a great remote data taking and massaging system,
and with all the scientific and mathematical additions to Scientific
Linux, that is an easy platform to develop on. With a couple of
high gain antennas, it could be miles from the grid, or possibly
even connect through multiple hops in a mesh, given ALIX repeater
boards with two miniPCI slots.
BTW, this might be something to talk to the Humaninet people about.
I imagine the ALIX/OpenWRT combo would be really handy in a mesh
system in the field, and could be made more theft-resistant than a
PC or laptop-based solution.
Russell Senior
Keith> After beating my head against the OpenWRT wall for weeks - one
Keith> thing after another not working as expected [...]
Russell> Not to say there isn't a learning curve with OpenWrt, but
Russell> ... you could have asked me more questions! I am a willing
Russell> resource, if possessing finite capacity, but I would
Russell> certainly be (have been) eager to try to help.
Keith> Again, the stumper was related to the Verizon connection and
Keith> udhcpc, and that is a real bastard of a problem to help with
Keith> remotely.
I'd be happy to come out there some afternoon and help diagnose.
Keith> I was having trouble enough trying to get tcpdump to provide
Keith> useful data - as I understand it, it won't listen to a port
Keith> before it is up, and it is the DHCP handshake that I care
Keith> about.
From the Alix, it works for me. I just got my Alix (w/ OpenWrt
r12615) out and tried. I hooked up a serial console. Without eth0
plugged into the Alix, I boot up to a console. The I run:
# tcpdump -i eth0 -s0 -w/tmp/capture.pcap
then plug the cat5 into eth0, wait 15-30 seconds, and then stop
tcpdump with a Ctrl-C and scp the capture.pcap somewhere with
wireshark and decode it. I see something like this:
root@OpenWrt:/tmp# tcpdump -i eth0 -s0 -w /tmp/capture.pcap
device eth0 entered promiscuous mode
tcpdump: WARNING: eth0: no IPv4 address assigned
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytseth0: link up, 100Mbps, full-duplex, lpa 0x45E1
^Cdevice eth0 left promiscuous mode
7 packets captured
7 packets received by filter
0 packets dropped by kernel
That will give you half of what you need. The other half is a similar
packet capture with the working device (the Actiontec or whatever).
For that, you'll probably need a network *hub* (or a linux bridge[1]
or similar) in between the CPE and the working router, and a laptop or
something to capture the packets.
Then compare what is going back and forth. Since you need to set that
up anyway to compare, you might as well do that for both devices.
I've got a 10Mbps hub if you need one. My wild-assed guess is that
the Verizon is looking for some hostname option or something.
The udhcpc in OpenWrt is from busybox. It's got a bunch of options.
To get a listing, try:
# udhcpc --help
to get a listing. I suspect some appropriate tweaking to those things
will get it fixed up, but a packet capture comparison will let you
converge a lot faster on exactly what "appropriate" means in this
context.
[1] It occurs to me that one of these 3-port Alix could make a cool
transparent bridge for this kind of sniffing. Use one of the ports to
ssh in from your laptop, and use the other two bridged together to do
your sniffing. With the right incantation, you could use the Alix to
do all the sniffing: as an end-point when you are testing it; as a
man-in-the-middle when you are figuring out what the Actiontec is
doing differently.