Divested-WRT: No-nonsense hardened builds for Linksys WRT series

Hello your link is broken, something about IT stack??

Anyways do you have a new build by any chance, hopefully it has wget-ssl, nano, and tcpdump-mini? A complete build if possible for WRT1900ACS V2. Very intrigued to test.

Thank you

Please take this as a reminder that this topic is intended for questions specific to this community build only.

For other community builds, please open a new topic.

1 Like

for those struggling w/ bridging lan and wlan using DSA I posted my steps here

Thank you to @InkblotAdmirer for the ./config/network

I am now running No-Nonsense (w/ kernel 5.4.110) - excited to see how she goes

One thing I have immediately noticed is that with kernels 5.4.110 and 5.10.28 SQM w/ cake the throughput is slower for some reason.

My connection is 950/500 (fibre to the house)
kernel 4.14.x : 750-900 / 450-500
kernel 5.4 & 5.10 : 500-600 / 400-450

As soon as I disable SQM my speeds jump back to 880-950 / 450-500+

It does not matter what iface I use, as soon as cake is enabled it slows down. I tried fq_codel and whilst the speed was mostly back I had worse bufferbloat vs SQM disabled.

Is there anything I can do about this?

EDIT: by enabling this in ./network I was able to squeeze 60-80Mbps more on the download

option packet_steering '1'

EDIT2: I am getting this same behaviour on 21.02 so must be a kernel thing. Does cake get updated or has it been left too long and gone stale? :wink:

1 Like

Cake is recommend it over anything else at this point they have even said fq_codel is obsolete, so hopefully cake gets updated/improved within OpenWrt:

Good info about it here:
https://www.bufferbloat.net/projects/codel/wiki/Cake/

Yes - I have cake tuned nicely on 19.07 w/ kernel 4.14.x. It's a shame I lose 200-300+Mbps download on kernel 5.x.

Looking at git it seems there have been changes related to cake made to the 5.x kernel over the past year and a bit ...???? I wish I understood this all better.

Might be worth submitting an OpenWrt bug report with these findings, that's a significant regression. Common understanding is almost no routers can do 800+Mbits with SQM cake and if these are in that category that's amazing. I always placed it around 600Mbtis but since my cable caps out at 500Mbits I never knew for sure.

This is pretty good for 7pm on a Friday night....

Test done on kernel 4.14.224

No-Nonsense w/ kernel 5.4.110 results - appears I am having a good night tonight...

2 Likes

@pSych0bUNny

If you are compiling from my guide, please make a test build with the defconfig hardening patches disabled:
0002-kernel-generic-5.4-config-hardening.patch
0003-kernel-generic-5.10-config-hardening.patch

they are fully expected to reduce performance at the benefit of security.

Yes, I'll I need to retest as I thought I had rolled a fresh 21.02 with all defaults but then realised if the firmware on the alternate partition does not have SQM then when I go back to my 19.07 it only has fq_codel available as a qdisc shaper. I thought I made another 21.02 image w/ SQM, but I need to improve my naming conventions as I cannot find it now.

@SkewedZeppelin Happy to make a 'soft' config test image. I have followed the steps in your build guide to a 'T' and I am hoping you could be so kind as to advise the best way to un-"git am" patches as it'll save me heaps of time searching the innerwebs. Thank you in advance.:+1:

un-"git am" patches

git rebase HEAD~8 -i
change pick to drop on the commits you don't want

3 Likes

that's handy to know thank you - if you know of a good git tutorial on how to keep clean and manage multiple branches I'd be keen. :+1:

I removed the hardening patches for the kernels and rebuilt using kernel 5.4.110, however the results were the same as above - (image recopied here)

I built a fresh 21.02 and whilst speeds were a bit better (720/460) I would get these crazy high latency spikes - it just was not smooth for some reason which would affect my score. If I disabled SQM my download was horrible however my upload went up over 520 but latency was really bad in these cases.

So either there is a kernel thing or my builds are off somehow.

Part of the reason I mentioned the git tutorial recommendation is that I am probably not be using git right when trying to change branches to create the different builds. I sometimes run in to compilation errors when using "make -j8" and have to revert to "-j1" or get messages that my config is out of sync (which I 'fix' by running nconfig and resaving the config).

I do a "git clean" and a "make clean"

  • change branch
  • pull
  • update & install scripts
  • then nconfig
  • make download
  • make

Which is probably not right. I need to invest some time in to learning more about git, and just being consistent/methodical in my approach.

EDIT: Actually I can probably run tests using the master branch with the different kernels and now I know how to easily add/remove patches I won't need to run two builds just different configs which I can probably manage :wink: I'll start a new thread on this based on what I find.

1 Like

Can anyone rocking a WRT1900ACv2 please post the max speed achieved in pure wired mode with SQM enabled (both up and down) on this build? Also any details - PPPoE vs DHCP, max CPU load, "parasitic" effects on VoIP line while testing, etc

Obviously a Gigabit link would be best, but if not just post what you have...

TIA

I am curious to hear feedback on the April 20 build as I cannot get over 100Mbps on the upload.

I have found if I remove this commit - 10aacb9a6c - my upload returns to normal (410Mpbs+)

1 Like

Does anybody have a problem with building a custom image with syslog-ng? I need something to pass logs to a graylog instance, but including it ends with the following error(building from 20210420-00/ config file & all patches):

libtool:   error: error: relink 'modules/afsocket/libafsocket.la' with the above command before installing it

Is it something related with hardening features, upstream errors or something else?
Alternatively: do you recommend other ways to pass logs to this kind of a central server?

Leaving this commit in and adding kmod-sched from kernel > network support my upload goes back to full speed.

More testing required though.

1 Like

Hi - i noticed with the current version i am getting a warning:

"Tue Apr 27 10:44:20 AWST 2021 upgrade: The device is supported, but this image is incompatible for sysupgrade based on the image version (1.1->2.0). Tue Apr 27 10:44:20 AWST 2021 upgrade: Partition design has changed compared to older versions (up to 19.07) due to kernel size restrictions. Upgrade via sysupgrade mechanism is not possible, so new installation via factory style image is required. Image check failed.

The uploaded image file does not contain a supported format. Make sure that you choose the generic image format for your platform."

What is the expected way to patch to this version? Full system upgrade? can you keep your old settings?

Cheers

*** Cancel that. I just needed to actually read the whole thing..

ok i now notice 3 wireless devices on my wrt-32x. As far as i can tell, the first 2 are (and always were):

Marvell 88W8964 802.11acn
AC wireless

Marvell 88W8964 802.11bgn
N Wireless

But this one im not sure of:
Marvell 88W8887 802.11acbgn
Looks like its using both AC and BGN but I am not sure how to configure it? Same ssid as the others? I tend to keep my 2.4 and 5.4 separate.
What is this 3rd radio that i never new i had? I take it it was always there but possibly turned into a separate 3rd radio? Use case? Best way to configure?

Aside from that, its running very well. Wifi is very responsive and switching between the difference AC points as i walk around is seamless and no noticeable dropouts as i had experienced in previous releases.

@skitts24
You must've been on an old build.
The 3rd radio for the WRT32* was enabled in the 0206 build.
You can use it, it is just quite slow. Just don't change its channel or it conflicts iirc.

What is the expected way to patch to this version?

You very likely can simply force flash and keep settings: Increasing mamba and venom kernel partition to 6MB - #102 by bmork

1 Like