Divested-WRT: No-nonsense hardened builds for Linksys WRT series

digital_mystik · 2021-05-26T23:59:06.542Z

if anyone can find a solution to the disconnects, be sure to ping us .. I have no idea what it could be so I'm not much use lol

RuralRoots · 2021-05-31T03:01:14.098Z

Can anyone point me to where I might find something about the two below messages that came up when I flashed the build I made today?
Not something I was expecting.

Network Bridge Config Migration795×164 12.5 KB

Network ifname configuration migration792×169 12.3 KB

anon50098793 · 2021-05-31T03:02:21.255Z

http://lists.openwrt.org/pipermail/openwrt-devel/2021-May/035353.html

Mini tutorial for DSA network config Network and Wireless Configuration

Update from 2021-05-31: Option ifname was renamed to device This tutorial is valid for 21.02-rc2 (or newer) and recent snapshots Introduction DSA stands for Distributed Switch Architecture and is Linux kernel subsystem for network switches. It's an upstream replacement for OpenWrt's swconfig framework and many new routers use DSA drivers instead of swconfig drivers. In DSA each switch port is a separated Linux interface. It means ip / ifconfig command will show interfaces like lan1, lan2, w…

anomeome · 2021-05-31T03:22:18.223Z

commit, was to overcome a migration issue.

RuralRoots · 2021-05-31T04:04:30.334Z

Thanks @anon50098793. I recognized the changes were about DSA after reading the Mini tutorial a short while ago about the Simple ports bridging section and my network added a same config device section after the migration.

Thanks @anomeome I hadn't seen the commit and didn't hear any noise here about it.

rmilecki · 2021-05-31T05:56:31.724Z

RuralRoots:

Can anyone point me to where I might find something about the two below messages that came up when I flashed the build I made today?

See netifd changes:

bridge: rename "ifname" attribute to "ports"
interface: support "device" attribute and deprecate "ifname"

Maybe for better understanding see also:

base-files: generate "device" UCI type section for bridge
base-files: generate network config with "device" options

LuCI uses the new syntax only so it offers users a migration.

wifinoob · 2021-05-31T19:02:43.529Z

Has anyone gotten a working Guest WLAN config working? I just upgraded from an old david build, and I'm trying to reconfigure everything as before.
I tried following the following guides:

OpenWrt Wiki – 14 Aug 17

Guest Wi-Fi using CLI

Guest Wi-Fi using CLI See also: Guest Wi-Fi extras This page provides a script that creates an additional separated guest network and a new guest firewall zone for your OpenWrt device. That is, to create a guest WLAN, that only has Internet access...

OpenWrt Wiki – 25 Jan 11

Guest Wi-Fi basics

Guest Wi-Fi basics This article relies on the following: * Accessing OpenWrt CLI * Managing configurations * Managing packages * Managing services Introduction * Guest Wi-Fi provides an isolated wireless network which is independent...

but they don't work. When I tried connecting, the device doesn't get any connectivity. On windows ipconfig shows no IPv4 address assigned.

User34 · 2021-05-31T19:22:51.240Z

I have noticed the exact issue (noticing the ipv4 failed assignment) and posted elsewhere about help with the config. Still no solution.

User34 · 2021-06-02T18:11:44.316Z

For those interested, I was able to fix my issue:

First I created a new network bridge br-lan2 with lan4, removing lan4 from br-lan. I had to assign the mac address to the same lan networks. Then I assigned this bridge as the base device on the "Guest" network interface. Next I had to fix undo a hardening customization in the Divested configuration by commenting the interface=br-lan line in /etc/dnsmasq.conf (aka add a # before the line of code). Then I rebooted my network (MUST reboot to take effect).

User34 · 2021-06-04T17:52:12.502Z

Did anyone have to do something special to get a network share setup with samba4 and block-mount up and running. I followed instructions I used to set up samba4 on my previous 19.07 David build, but I was unable to get it up and running. I have no idea where I went wrong. What are the required/necessary packages?

phinn · 2021-06-04T22:22:24.653Z

I couldn't get it working with this build either, maybe because of some missing kmods or security. If you need that install the newly released OpenWrt 21.02-rc2. Then just install them from there. I'm running that now it works great.

User34 · 2021-06-05T02:34:34.877Z

Thanks @phinn ! I was killing myself trying to get Samba4 running. Do you have a recommended 21.02.0-rc2 package list or configuration mods required to support our routers (WRT1900ACS)? I've not built from the bottom up yet, so I have no idea what patching that might entail. I know I'll want at least OpenVPN, Block-Mount, Samba4, WatchCat, and SMQ/Cake

I'll need to remember to:

Change 'enabled' from '0' to '1' in '/etc/config/irqbalance' for improved Wi-Fi performance.
Uncomment 'devcrypto=devcrypto' under the '[engine]' block in '/etc/ssl/openssl.cnf' for improved OpenSSL performance.

phinn · 2021-06-05T03:16:04.545Z

Didn't know about setting the irqbalance to 1, thanks. Yea I just ssh in and run these on a clean rc2, then I go in and configure everything in LuCI:

opkg update
opkg install nano irqbalance iperf3 luci-app-advanced-reboot luci-app-sqm luci-app-adblock luci-app-wireguard luci-app-upnp luci-app-samba4 block-mount kmod-usb-storage kmod-usb-storage-uas kmod-usb-ohci kmod-usb-ohci-pci kmod-usb-uhci kmod-usb3 kmod-ata-marvell-sata ntfs-3g fdisk luci-app-hd-idle luci-theme-material

The initial release had a broken Network Shares page from luci-app-samba4, that's now fixed, I posted about it on the rc2 thread. I won't discuss further on this, don't want to flood Divested builds they are great in their own right.

cdr · 2021-06-05T09:10:02.505Z

Thanks for this nice build!

When installing dnsmasq-full or upnpd I get the following error.

Collected errors:
 * pkg_hash_fetch_best_installation_candidate: Packages for kmod-nf-conntrack-netlink found, but incompatible with the architectures configured
 * satisfy_dependencies_for: Cannot satisfy the following dependencies for miniupnpd:
 * 	kernel (= 5.4.123-1-8d9ce5e20a3c98329cc239cef8178c2f)

Do I need a different opkg feed?

RuralRoots · 2021-06-09T20:44:20.153Z

@anomeome

Can you throw an old dog a bone?

I want to add this patch: https://patchwork.ozlabs.org/project/openwrt/patch/20201230220637.525822-1-me@irrelefant.net/ you referenced in the DSA Mini Tutorial.

I'm more than a little green when it comes to git, but I'm not coming up with exactly how to bring in this patch from above link. Can you expound a bit more?

I've already C/P it roundabout and into my buildroot/Files, and it's been quite useful to my understanding the tutorial.

anomeome · 2021-06-09T20:52:13.913Z

For patchworks I just use the mbox button and apply with:

patch -p1 < file.patch

it is mbox format so if you want you can use the git -am command; I don't care about the semantics around that rxxxxx+y, where y is the patches you are ahead of whatever HEAD. I'm a ol'codger so old habits be hardly dying.

I think for this one I grabbed it and moved it into the files/usr/sbin of my builldroot with the other scripts I carry in the image I build, as it looks you have done.

RuralRoots · 2021-06-10T19:01:57.341Z

Thank you very much! Exactly what i needed

anomeome:

I don't care about the semantics around that rxxxxx+y, where y is the patches you are ahead of whatever HEAD.

Nice to know - Thanks again.

wally_walrus · 2021-06-19T03:30:02.888Z

Quick question for the knowledgeable guys here... What package(s) are needed to have a working Wireguard client on the router? I have a standard installation of the Divested build, and it looks like MOST wireguard-related software is installed except for "wg-installer-client". Should I just install it, and if so - why is it missing from the build?

What about configuration - anything "luci-proto-wireguard" can do to configure the service, or is it all text based config files?

TIA

ninjanoir78 · 2021-06-19T08:59:40.788Z

You don't need the installer client.

wally_walrus · 2021-06-19T20:27:41.945Z

Thank you! So configuration is command-line only, no LuCI GUI for it?