Topic: ALFA R36 Router Hacking

Hello,

I am looking for some advice or at least a point in the right direction regarding how to put OpenWRT on my ALFA R36 router.

A little background first though. I am a 17 year old who loves electronics and hacking but I am better at hardware than with software. I currently use linux as my main OS and I have some experience with embedded linux (on a Gumstix board). I recently bought a ALFA R36 router specifically to hack it. I have a 1w ALFA wifi dongle that works together with the R36, but my ultimate goal is to get OpenWRT on the R36 and connect the serial port to an Arduino. I want to be able to use the router as a mini computer to control stuff like robots. Unfortunately, I couldn't find ANY documentation on the R36 router.

I picked the ONE router that has never been hacked! sad    I am not sure why though, this little router looks like it has a lot of potential. TWO LONG range wifi radios in one router system for about $100!

Here is a link to the ALFA R36 product page: http://www.alfa.com.tw/in/front/bin/ptdetail.phtml?Part=R36&Category=0

Here are some pictures that I took of it:
http://www.flickr.com/photos/58936758@N04/6023779077/in/photostream
http://www.flickr.com/photos/58936758@N04/6024331996/in/photostream
http://www.flickr.com/photos/58936758@N04/6023778775/in/photostream

So here is everything that I came up with regarding the R36 hardware:

Processor: Ralink RT3050F @ 320Mhz
Flash: MXIC MX29LV640EBTI-70G (not sure what size)
RAM: EtronTech EM63A165TS-6G

One USB port
One Serial Port @ 115200bps
One WAN
One LAN
2 buttons - reset to factory default and one for the WPS thing
at least 6 LEDs
wifi - i believe it's built into the processor (there is an amplifier because the baord can put out 350mW I believe).

So the first thing I did was hook up my Bus Pirate as a plain serial to usb bridge. I used putty to communicate with the serial interface on the router. Here is a log of the boot up over the serial port:

----------------------------------------------------------------------------------


U-Boot 1.1.3 (Oct  4 2010 - 15:34:52)


Board: Ralink APSoC DRAM:  32 MB

relocate_code Pointer at: 81fb0000

flash_protect ON: from 0xBF000000 to 0xBF01D423

flash_protect ON: from 0xBF030000 to 0xBF030FFF

*** Warning - bad CRC, using default environment


============================================

Ralink UBoot Version: 3.3

--------------------------------------------

ASIC 3052_MP2 (Port5<->None)

DRAM component: 256 Mbits SDR

DRAM bus: 16 bit

Total memory: 32 MBytes

Flash component: NOR Flash

Date:Oct  4 2010  Time:15:34:52

============================================

icache: sets:256, ways:4, linesz:32 ,total:32768

dcache: sets:128, ways:4, linesz:32 ,total:16384


##### The CPU freq = 320 MHZ ####


SDRAM bus set to 16 bit

SDRAM size =32 Mbytes


Please choose the operation:

   1: Load system code to SDRAM via TFTP.

   2: Load system code then write to Flash via TFTP.

   3: Boot system code via Flash (default).

   4: Entr boot command line interface.

   9: Load Boot Loader code then write to Flash via TFTP.

 1  0

   

3: System Boot system code via Flash.

## Booting image at bf050000 ...

   Image Name:   Linux Kernel Image-1.2.0.6-0

   Created:      2011-05-23   3:11:36 UTC

   Image Type:   MIPS Linux Kernel Image (lzma compressed)

   Data Size:    5427136 Bytes =  5.2 MB

   Load Address: 80000000

   Entry Point:  80294000

   Verifying Checksum ... OK

   Uncompressing Kernel Image ... OK

No initrd

## Transferring control to Linux (at address 80294000) ...

## Giving linux memsize in MB, 32


Starting kernel ...


LINUX started...

THIS IS ASIC - AWB
Linux version 2.6.21-gb9609c50-dirty (root@minglinlee-Studio-1558) (gcc version 3.4.2) #5 Mon May 23 10:34:04 CST 2011

The CPU feqenuce set to 320 MHz
CPU revision is: 0001964c
Determined physical RAM map:
memory: 02000000 @ 00000000 (usable)
Built 1 zonelists.  Total pages: 8128
Kernel command line: console=ttyS1,115200n8 root=/dev/mtdblock4
Primary instruction cache 32kB, physically tagged, 4-way, linesize 32 bytes.
Primary data cache 16kB, 4-way, linesize 32 bytes.
Synthesized TLB refill handler (20 instructions).
Synthesized TLB load han fastpath (32 instructions).
Synthesized TLB store handler fastpath (32 instructions).
Synthesized TLB modify handler fastpath (31 instructions).
Cache parity protection disabled
cause = 80800000, status = 1100ff00
PID hash table entries: 128 (order: 7, 512 bytes)
calcung r4koff... 00138800(1280000)
CPU frequency 320.00 MHz
Using 160.000 MHz high precision timer.
Dentry cache hash table entries: 4096 (order: 2, 16384 bytes)
Inode-cache hash table entries: 2048 (order: 1, 8192 bytes)
Memory: 29612k/32768k available (2321k kernel code, 3156k reserved, 314k data, 116k init, 0k highmem)
Mount-cache hash table entries: 512
NET: Registered protocol family 16
usbcore: registered new interface driver usbfs
usbcore: registered new interface driver hub
usbcore: registered new device driver usb
Time: MIPS clocksource has been installed.
NET: Registered protocol family 2
IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
TCP established hash table entries: 1024 (order: 1, 8192 bytes)
TCP bind hash table entries: 1024 (order: 0, 4096 bytes)
TCP: Hash tables configured (established 1024 bind 1024)
TCP reno registered
squashfs: version 3.2-r2 (2007/01/15) Phillip Lougher
squashfs: LZMA suppport for slax.org by jro
fuse init (API version 7.8)
io scheduler noop registered (default)
Ralink gpio driver initialized
HDLC line discipline: version $Revision: 1.1.1.1 $, maxframe=4096
N_HDLC line discipline registered.
Serial: 8250/16550 driver $Revision: 1.3 $ 2 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0xb0000500 (irq = 37) is a 16550A
serial8250: ttyS1 at I/O 0xb0000c00 (irq = 12) is a 16550A
loop: loaded (max 8 devices)
rdm_major = 254
PPP generic driver version 2.4.2
PPP Deflate Compression module registered
PPP BSD Compression module registered
PPP MPPE Compression module registered
NET: Registered protocol family 24
ralink flash device: 0x800000 at 0x1f000000
Ralink SoC physically mapped flash: Found 1 x16 devices at 0x0 in 16-bit bank
Amd/Fujitsu Extended Query Table at 0x0040
number of CFI chips: 1
cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.
Creating 6 MTD partitions on "Ralink SoC physically mapped flash":
0x00000000-0x00030000 : "Bootloader"
0x00030000-0x00040000 : "Config"
0x00040000-0x00050000 : "Factory"
0x00050000-0x00120000 : "Kernel"
0x00120000-0x007f0000 : "RootFS"
0x007f0000-0x00800000 : "Data3G"
block2mtd: version $Revision: 1.1.1.1 $
nf_conntrack version 0.5.0 (256 buckets, 2048 max)
IPv4 over IPv4 tunneling driver
GRE over IPv4 tunneling driver
ip_tables: (C) 2000-2006 Netfilter Core Team, Type=Restricted Cone
arp_tables: (C) 2002 David S. Miller
TCP cubic registered
NET: Registered protocol family 1
NET: Registered protocol family 10
NET: Registered protocol family 17
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
GDMA1_MAC_ADRH -- : 0x00000000
GDMA1_MAC_ADRL -- : 0x00000000
Ralink APSoC Ethernet Driver Initilization. v2.00  256 rx/tx descriptors allocated, mtu = 1500!
GDMA1_MAC_ADRH -- : 0x000000c0
GDMA1_MAC_ADRL -- : 0xca49c69c
PROC INIT OK!
VFS: Mounted root (squashfs filesystem) readonly.
Freeing unused kernel memory: 116k freed
Algorithmics/MIPS FPU Emulator v1.5
devpts: called with bogus options
[BC_Data]Init:Start=========
[BC_Data]Command_Initt:BC_next_empty_sector=1
[BC_Data]Init:Print SM informaiton.
pSMBC_Data->next_empty_sector=1
============BC_ParamShow=========
total_sum_elapsed_time=[    0.000000]
sum_3g_data_xfer=[    0.000000]
this_elapse=[    0.000000]
rxqual=[    0.000000]
RX_payload=[    0.000000]
TX_payload=[    0.000000]
systime=[ 10100002000.00]
reserved2=[         nan]
============BC_Flash_ParamShow:End=========
[BC_Data]Init:End=========
dwc_otg: version 2.72a 24-JUN-2008
DWC_otg: Core Release: 2.66a
DWC_otg: Periodic Transfer Interrupt Enhancement - disabled
DWC_otg: Multiprocessor Interrupt Enhancement - disabled
DWC_otg: Using DMA mode
DWC_otg: Device using Buffer DMA mode
dwc_otg lm0: DWC OTG Controller
dwc_otg lm0: new USB bus registered, assigned bus number 1
dwc_otg lm0: irq 18, io mem 0x00000000
DWC_otg: Init: Port Power? op_state=1
DWC_otg: Init: Power Port (0)
usb usb1: configuration #1 chosen from 1 choice
hub 1-0:1.0: USB hub found
hub 1-0:1.0: 1 port detected
mount: mounting usbfs on /proc/bus/usb failed: Device or resource busy
mount: mounting devpts on /dev/pts failed: Device or resource busy
Jan  1 00:00:02 udevd[637]: add_matching_files: unable to open '/etc/udev/rules.d': No such file or directory

Sat Jan  1 00:00:00 UTC 2011
set date/time -> Sat Jan  1 00:00:00 UTC 2011
date: invalid date '10100002000.00'
Sat Jan  1 00:00:00 UTC 2011
echo "1024 65000" >/proc/sys/net/ipv4/ip_local_port_range
echo "49576" > /proc/sys/fs/file-max
echo "5" > /proc/sys/net/netfilter/nf_conntrack_icmp_timeout
echo "2048" > /proc/sys/net/ipv4/netfilter/ip_conntrack_max


BusyBox v1.12.1 (2011-05-23 11:09:55 CST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

# echo "30" > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout
echo "120" > /proc/sys/net/ipv4/netfilter/ip_conntrack_udp_timeout_stream
echo "1" > /proc/sys/net/ipv4/tcp_ecn
echo "5" > /proc/sys/net/ipv4/tcp_fin_timeout
echo "3" > /proc/sys/net/ipv4/tcp_syn_retries
echo "2" > /proc/sys/net/ipv4/tcp_retries1
echo "1" > /proc/sys/net/ipv4/tcp_tw_recycle
echo "uuid=75802409-bccb-40e7-0c43-00c0ca49c69d" > /etc/uuid.dat
echo "serial=75802409" > /etc/serial.dat
session.sh
sh: session.sh: not found
internet.sh
WLAN DAEMON : Stop USB WLAN Detection Daemon fail.
Password for 'admin' changed
do nothing!!!
insmod: bridge.ko: module not found
insmod: mii.ko: module not found
insmod: raeth.ko: module not found
rtl8187L:
Linux kernel driver (v2023) for RTL8187L based WLAN cards
rtl8187L: Copyright (c) 2004-2005, Realtek
rtl8187L: Copyright (c) 2011, Island Consulting, Inc. (www.thewirie.com)
rtl8187L: Wireless extensions version 22
rtl8187L: Initializing proc filesystem
usbcore: registered new interface driver rtl8187L

phy_tx_ring = 0x01e9c000, tx_ring = 0xa1e9c000

phy_rx_ring = 0x00000000, rx_ring = 0x00000000
RT305x_ESW: Link Status Changed
CDMA_CSG_CFG = 81000007
GDMA1_FWD_CFG = 710000
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
ifconfig: ioctl 0x8913 failed: No such device
rmmod: rt2860v2_ap: No such file or directory
rmmod: rt2860v2_sta: No such file or directory
Commit crc = b81310d3
rt2860v2_ap: module license 'unspecified' taints kernel.


=== pAd = c00f1000, size = 504256 ===

<-- RTMPAllocAdapterBlock, Status=0
rmmod: nf_nat_pptp: No such file or directory
rmmod: nf_conntrack_pptp: No such file or directory
rmmod: nf_nat_proto_gre: No such file or directory
rmmod: nf_conntrack_proto_gre: No such file or directory
RX DESC a18b5000  size = 2048
<-- RTMPAllocTxRxRingMemory, Status=0
Key1Str is Invalid key length(0) or Type(0)
Key2Str is Invalid key length(0) or Type(0)
Key3Str is Invalid key length(0) or Type(0)
Key4Str is Invalid key length(0) or Type(0)
1. Phy Mode = 9
2. Phy Mode = 9
3. Phy Mode = 9
MCS Set = ff 00 00 00 00
Main bssid = 00:c0:ca:49:c6:9e
<==== rt28xx_init, Status=0
0x1300 = 00064380
insmod: 8021q.ko: module not found
eth2.2: Setting MAC address to  00 c0 ca 49 c6 9d.
device eth2 entered promiscuous mode
VLAN (eth2.2):  Setting underlying device (eth2) to promiscious mode.
ifconfig: ioctl 0x8913 failed: No such device
brctl: bridge br0: No such device or address
##### config RT3052 vlan partition (WLLLL) #####
### usage USB Wireless No Vlan (0) ###
switch reg write offset=14, value=5555
switch reg write offset=40, value=1001
switch reg write offset=44, value=1001
switch reg write offset=48, value=1001
switch reg write offset=4c, value=1
switch reg write offset=50, value=2001
switch reg write offset=70, value=ffffffff
switch reg write offset=98, value=7f7f
switch reg write offset=e4, value=7f
device ra0 entered promiscuous mode
====== LAN_PRE =========
WLAN DAEMON : Start USB WLAN Detection Daemon....
br0: port 2(eth2) entering learning state
br0: port 1(ra0) entering learning state
ifconfig: ioctl 0x8914 failed: Cannot assign requested address
ifconfig: ioctl 0x8914 failed: Cannot assign requested address
==================== wpa_supplicant.conf ===========================
SSID=FQKRN
AUTHTICATION=2
ENCRYPTION=99
NETWORKTYPE=1
BSSID=00:26:B6:03:3D:08
====================================================================
/sbin/wpa_supplicant.sh KEY1: use hex key. > /dev/console
WLAN DAEMON : Turn ON USB Power....
WLAN DAEMON : check module fail
WLAN DAEMON : Insert Module & Driver
insmod: cannot insert '/lib/modules/2.6.21-gb9609c50-dirty/kernel/drivers/net/wireless/rtl8187l/r8187l.ko': invalid parameters
WLAN DAEMON : Turn ON USB Power....
killall: udhcpd: no process killed
Set: phy[1].reg[0] = 3900
Set: phy[1].reg[0] = 3100
====== LAN_PRE:end =========
====== LAN_POST =========
## stop lld2d ##
## restart lld2d ##
## stop igmpproxy ##
## restart igmpproxy ##
## stop miniupnpd ##
## restart miniupnpd ##
## stop radvd ##
Jan  1 00:00:12 miniupnpd[1113]: HTTP listening on port 5555
Jan  1 00:00:12 miniupnpd[1113]: Listening for NAT-PMP traffic on port 5351
Jan  1 00:00:12 miniupnpd[1113]: chain port_forward not found
Jan  1 00:00:12 miniupnpd[1113]: chain port_forward not found
## restart radvd ##
ifconfig: ioctl 0x8913 failed: No such device
## stop pppoe-relay ##
## restart pppoe-relay ##
## stop dnsmasq ##
## restart dnsmasq ##
====== LAN_POST:end =========
===== To Fix Coutnry Code does not depend on MFG procedure ====
Commit crc = b81310d3
WLAN DAEMON : wlan0 now is down...
ifconfig: ioctl 0x8913 failed: No such device
WLAN DAEMON : device not exists.
sh: 1: unknown operand
killall rt2860apd 1>/dev/null 2>&1
insmod /lib/modules/2.6.21/kernel/net/netfilter/xt_webstr.ko
iptables -F -t filter 1>/dev/null 2>&1
iptables -D FORWARD -j macipport_filter 1>/dev/null 2>&1
iptables -F macipport_filter 1>/dev/null 2>&1
iptables -D FORWARD -j web_filter  1>/dev/null 2>&1
iptables -F web_filter  1>/dev/null 2>&1
iptables -P INPUT ACCEPT
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -t filter -N web_filter 1>/dev/null 2>&1
iptables -t filter -N macipport_filter 1>/dev/null 2>&1
iptables -t filter -N port_forward 1>/dev/null 2>&1
iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 1>/dev/null 2>&1
iptables -A INPUT -i wlan0 -p tcp --dport 80 -j DROP
iptables -t nat -D PREROUTING -i ppp0 -j port_forward 1>/dev/null 2>&1
iptables -t nat -D PREROUTING -i eth2.2 -j port_forward 1>/dev/null 2>&1
iptables -t nat -F port_forward  1>/dev/null 2>&1; iptables -t nat -X port_forward  1>/dev/null 2>&1
iptables -t nat -D PREROUTING -i ppp0 -j DMZ 1>/dev/null 2>&1
iptables -t nat -D PREROUTING -i eth2.2 -j DMZ 1>/dev/null 2>&1
iptables -t nat -F DMZ 1>/dev/null 2>&1; iptables -t nat -X DMZ  1>/dev/null 2>&1
iptables -t nat -N port_forward 1>/dev/null 2>&1; iptables -t nat -I PREROUTING 1 -i wlan0 -j port_forward 1>/dev/null 2>&1
iptables -t nat -N DMZ 1>/dev/null 2>&1; iptables -t nat -I PREROUTING 2 -i wlan0 -j DMZ 1>/dev/null 2>&1
greenap.sh init
Jan  1 00:00:17 crond[1488]: crond (busybox 1.12.1) started, log level 6

/etc/init.d/cron.sh ok
ddns.sh
route delete 239.255.255.250 1>/dev/null 2>&1
killall wscd 1>/dev/null 2>&1
killall -9 wscd 1>/dev/null 2>&1
iwpriv ra0 set WscConfMode=0 1>/dev/null 2>&1
killall -q klogd
killall -q syslogd
syslogd -C8 1>/dev/null 2>&1
klogd 1>/dev/null 2>&1
killall -q zebra
killall -q ripd
/bin/qos_run
/etc/init.d/ntp.sh ntp_update

##### USB init #####
storage.sh admin
sh: storage.sh: not found
webs: Listening for HTTP requests at address 192.168.2.1
br0: topology change detected, propagating
br0: port 2(eth2) entering forwarding state
br0: topology change detected, propagating
br0: port 1(ra0) entering forwarding state
WLAN DAEMON : Turn ON USB Power....
WLAN DAEMON : wlan0 now is down...
ifconfig: ioctl 0x8913 failed: No such device
WLAN DAEMON : device not exists.

#
#
# ls
bin     etc     home    lib     mnt     sbin    tmp     var
dev     etc_ro  init    media   proc    sys     usr
# ls 0a  -all
drwxr-xr-x   16 admin    admin         171 May 23  2011 .
drwxr-xr-x   16 admin    admin         171 May 23  2011 ..
-rw-r--r--    1 admin    admin         539 May 23  2011 .config
drwxr-xr-x    2 admin    admin        1124 May  9  2011 bin
drwxr-xr-x    3 admin    admin         586 May 23  2011 dev
drwxr-xr-x    8 admin    admin           0 Jan  1 00:00 etc
drwxr-xr-x   13 admin    admin         351 May 16  2011 etc_ro
drwxr-xr-x    2 admin    admin           3 May 23  2011 home
lrwxrwxrwx    1 admin    admin      11 May 23  2011 init -> bin/busybox
drwxr-xr-x    5 admin    admin         880 May 23  2011 lib
drwxr-xr-x    2 admin    admin           0 Jan  1  2000 media
drwxr-xr-x    2 admin    admin           3 May 23  2011 mnt
dr-xr-xr-x   40 admin    admin           0 Jan 2000 proc
drwxr-xr-x    2 admin    admin        1005 May 23  2011 sbin
drwxr-xr-x   10 admin    admin           0 Jan  1  2000 sys
drwxr-xr-x    2 admin    admin           0 Jan  1 00:00 tmp
drwxr-xr-x    8 admin    admin          82 May 23  2011 usr
drwr-x    6 admin    admin           0 Jan  1 00:00 var
#
#
-------------------------------------------------------------------------------------------------

So that's the output. I see that I could possibly load OpenWRT with the U-Boot TFTP option, but what version of OpenWRT should I use? Is there any version that will fully support this router? If not, can you give me a high level explanation of what I would need to do to get OpenWRT working on this router? I am still in the process of reading the documents on the OpenWRT wiki, but so far they are just confusing me. Any advice would be greatly appreciated.

Thanks for the help.
CoytHV

Re: ALFA R36 Router Hacking

I'm interested in hacking on this same router. Waiting for a serial > jtag cable and then I'll be getting started. I grabbed the openwrt source and got into the menuconfig, appears the chipset is supported, so I might get a working build made shortly. I'll make sure to update as I progress.

--badger

Re: ALFA R36 Router Hacking

Any news?

Re: ALFA R36 Router Hacking

Hi, I own an R36, and I'm trying to access it by SSH. There is a way to access it by SSH via Network interfaces, not by serial port? How is going the work in Openwrt?
Thank you, mille.

Re: ALFA R36 Router Hacking

All,

Waiting on my bus pirate to get access to the JTAG headers, but I think I'll have a working openwrt image for it in a couple weeks.

Re: ALFA R36 Router Hacking

Hi to all,

I have good news, I have put openwrt in my R36 big_smile

I don't know if it's 100% ok, but it seems to work.

The only error that show up is:

ramips-wdt: timeout value 60 must be 0 < timeout < 40

But I don't think it is a mayor concern.

The "trick" is know that R36 works with the same values that "Aztech HW550-3G"

You need the files "openwrt-ramips-rt305x-uImage.bin" and "openwrt-ramips-rt305x-root.squashfs", I have compiled from svn, but they are available here


Step by step procedure:

1.- Copy the 2 files to your tftp server directory
2.- Add 10.10.10.3 ip address to your server
3.- Connect serial cable, ethernet cable and power to the R36 board
4.- Wait fot the u-boot messages

U-Boot 1.1.3 (Jan 20 2010 - 11:24:04)

Board: Ralink APSoC DRAM:  32 MB
relocate_code Pointer at: 81fb0000
flash_protect ON: from 0xBF000000 to 0xBF01D423
flash_protect ON: from 0xBF030000 to 0xBF030FFF
*** Warning - bad CRC, using default environment

============================================ 
Ralink UBoot Version: 3.3
-------------------------------------------- 
ASIC 3052_MP2 (Port5<->None)
DRAM component: 256 Mbits SDR
DRAM bus: 16 bit
Total memory: 32 MBytes
Flash component: NOR Flash
Date:Jan 20 2010  Time:11:24:04
============================================ 
icache: sets:256, ways:4, linesz:32 ,total:32768
dcache: sets:128, ways:4, linesz:32 ,total:16384 

 ##### The CPU freq = 320 MHZ #### 

SDRAM bus set to 16 bit 
SDRAM size =32 Mbytes

Please choose the operation: 
   1: Load system code to SDRAM via TFTP. 
   2: Load system code then write to Flash via TFTP. 
   3: Boot system code via Flash (default).
   4: Entr boot command line interface.
   9: Load Boot Loader code then write to Flash via TFTP.

5.- Select "command line interface", 4 option

You choosed 4
4: System Enter Boot Command Line Interface.

U-Boot 1.1.3 (Oct  4 2010 - 15:34:52)

RT3052 #

6.- Set the boot args enviroment variable, typing:

RT3052 # setenv bootargs 'console=ttyS1,115200n8 root=/dev/mtdblock4 board=HW550-3G rootfstype=squashfs,jffs2 noinitrd'
RT3052 # saveenv
Saving Environment to Flash...
File: env_flash.c, Func: saveenv, Line: 302
copy old content: sect_addr: BF030000  env_addr: BF030000  offset: 00000000
Protect off BF030000 ... BF03FFFF
 b_end =BF7FFFFF
Un-Protecting sectors 10..10 in bank 1
Un-Protected 1 sectors
Erasing Flash...
 b_end =BF7FFFFF
Erase Flash from 0xbf030000 to 0xbf03ffff in Bank # 1 
 erase sector  = 10 
sect = 10,s_last = 10,erase poll = 834588
 done
Erased 1 sectors
Writing to Flash... done
 b_end =BF7FFFFF
Protecting sectors 10..10 in bank 1
Protected 1 sectors

RT3052 #

7.- Load the kernel file to ram

RT3052 # tftp 0x80600000 openwrt-ramips-rt305x-uImage.bin
 netboot_common, argc= 3 
 NetTxPacket = 0x81FE5640 
 KSEG1ADDR(NetTxPacket) = 0xA1FE5640 
 NetLoop,call eth_halt ! 
 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)
 Waitting for RX_DMA_BUSY status Start... done
 Header Payload scatter function is Disable !! 
 ETH_STATE_ACTIVE!! 
Using Eth0 (10/100-M) device
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'openwrt-ramips-rt305x-uImage.bin'.
 TIMEOUT_COUNT=10,Load address: 0x80600000
Loading: Got ARP REPLY, set server/gtwy eth addr (00:50:fc:24:42:21)
Got it
T #
 first block received  
################################################################
     #################################################################
     ############################
done
Bytes transferred = 804342 (c45f6 hex)
NetBootFileXferSize= 000c45f6

RT3052 #

Important: c45f6 is the size of my file. If you use a diferent file this number can be different. This size value is used later on the 9th step.

8.- Erase the destination flash memory:

RT3052 # erase 0xbf050000 0xbf11ffff
 b_end =BF7FFFFF
Erase Flash from 0xbf050000 to 0xbf11ffff in Bank # 1 
 erase sector  = 12 
.
.
.
 erase sector  = 24 
sect = 24,s_last = 24,erase poll = 946923
 done
Erased 13 sectors

RT3052 #

9.- Copy the kernel from file memory to the flash, notice, the size number must be the same as before (in these case c45f6)

RT3052 # cp.b 0x80600000 0xbf050000 c45f6
Copy to Flash... 
 Copy 804342 byte to Flash... 
 addr = 0xBF0B1C74 ,cnt=403842 
 addr = 0xBF1138E4 ,cnt=3346 done
RT3052 #

10.- Load rootfs to ram. For some extrange reason my board sometimes don't load the second file and I need to reboot, and then select the 4 option once again and continue in this step

RT3052 # tftp 0x80600000 openwrt-ramips-rt305x-root.squashfs
 netboot_common, argc= 3 
 KSEG1ADDR(NetTxPacket) = 0xA1FE5640 
 NetLoop,call eth_halt ! 
 NetLoop,call eth_init ! 
Trying Eth0 (10/100-M)
 ETH_STATE_ACTIVE!! 
Using Eth0 (10/100-M) device
TFTP from server 10.10.10.3; our IP address is 10.10.10.123
Filename 'openwrt-ramips-rt305x-root.squashfs'.
 TIMEOUT_COUNT=10,Load address: 0x80600000
Loading: Got ARP REPLY, set server/gtwy eth addr (00:50:fc:24:42:21)
Got it
checksum bad
checksum bad
Got ARP REQUEST, return our IP
checksum bad
T #
 first block received  
################################################################
     #################################################################
     #################################################################
     #################################################################
     #################################################################
     ########
done
Bytes transferred = 1703936 (1a0000 hex)
NetBootFileXferSize= 001a0000

RT3052 #

Important: Remeber 1a0000 is the file size.

11.- Erase the destination flash memory:

RT3052 # erase 0xbf120000 0xbf7fffff
.
.
.
 erase sector  = 133 
sect = 133,s_last = 134,erase poll = 960332
 erase sector  = 134 
sect = 134,s_last = 134,erase poll = 950492
 done
Erased 110 sectors
RT3052 #

12.- Copy the rootfs from file memory to the flash, file size 1a0000

RT3052 # cp.b 0x80600000 0xbf120000 1a0000
Copy to Flash... 
 Copy 1703936 byte to Flash... 
 addr = 0xBF181C74 ,cnt=1303436 
 addr = 0xBF1E38E8 ,cnt=902936 
 addr = 0xBF24555C ,cnt=502436 
 addr = 0xBF2A77D8 ,cnt=100392 done
RT3052 #

13.- Reset the board to reboot them

RT3052 # reset

I hope this help someone. This is just a dirty-hack, I hope some one add official support for this board.

Re: ALFA R36 Router Hacking

Thanks for these useful informations!

Is there any chance to flash w/o a serial cable? And how can I find a serial cable for R36?

Re: ALFA R36 Router Hacking

Hi, i successfully connected to r36 via rs232. I can see the boot process, but when i should press 4, to enter the command line interface, the boot process chooses automatically the third option to boot from kernel image. This is done in less then a second, and i cannot press 4 in time. There is a way to stop the automatic booting process?
@erriko, i managed it connecting by 3 wires the serial port of the r36 to my serial port of the pc, to pins 2,3 and 5. You can find infos of this connection on google. @All others... is this type of connection good enough or i need the bus pirate?

Thank you, Mille.

Re: ALFA R36 Router Hacking

Hi millenovanta,

You don't need bus pirate, you only need a serial connection. A ttl (3V) to rs232 cable. If your computer hasn't serial port you can use an usb to rs232 converter.

You have an perfect cable, but IMHO it's damaged. It works the Rx, but not the Tx.

If you wait, at the end of the boot process you can interact with a command line. You can see an example in the first post.

Of course, you can use bus pirate if you want to, but isn't mandatory.

I hope this helps you.

Re: ALFA R36 Router Hacking

Hi ma.terol,

Thanks for your very thorough post.  I was able to successfully get all the steps accomplished, but the version of the two files your link pointed to didn't work for me.  Watching the boot process via a serial connection showed messages concerning "kernal panic" and that the squashfs couldn't be used with newer devices.  I am clueless as to what this means.  Can you point me in the right direction?  Perhaps even to the exact files you used?  Thank you so much for any help you can provide - and for having patience with a noob.   :-)

Re: ALFA R36 Router Hacking

Hi,
i spoke with the alfa support, who sent me a link to a page on the openwrt site.
It seems openwrt is compatible with the W502U board, which is the unboxed board of the r36.
This is the link http://wiki.openwrt.org/toh/start#alfa.network .
The compatbility begins from the svn build n R29615: https://dev.openwrt.org/changeset/29615/trunk .

I hope it will be a point of change for this device.
I'm waiting for a rs232 to ttl converter, to connect by serial and flash it.
I have to study on how to compile image from svn, because it seems that version is the best for the r36.

In the openwrt wiki doesn't exist the topic on how to flash, ma.terol, you could write it.

Bye, Mille

Re: ALFA R36 Router Hacking

I've seen now is supported (https://dev.openwrt.org/changeset/29615).
As far as you know, can I use a cable like this http://www.ebay.it/itm/PL2303-USB2-0-to … 43ac218284 to flash my r36?

Re: ALFA R36 Router Hacking

Hello,

Got backfire running on the Alpha R36 with LuCI without too many issues.  The instructions above work fine as long as you see the board= W502U in boot args.
Also... for me anyway (i have done this several times on my board) I see seem to get checksum errors on the kernel image unless i burn it after the squashfs image.

I built the images from sources to get LuCI built into the image.

So.. the wifi (acesspoint) and LAN side of things seem to be working fine.  However, I can't seem to get WAN to work.

ifconfig is reporting the correct mac address for the WAN port.  and traffic is being sent out of the port. but nothing ever comes back.

here are the default /etc/config/network settings.

config 'interface' 'loopback'
        option 'ifname' 'lo'
        option 'proto' 'static'
        option 'ipaddr' '127.0.0.1'
        option 'netmask' '255.0.0.0'

config 'interface' 'lan'
        option 'ifname' 'eth0.1'
        option 'type' 'bridge'
        option 'proto' 'static'
        option 'ipaddr' '192.168.1.1'
        option 'netmask' '255.255.255.0'
        option 'macaddr' '00:c0:ca:49:bb:7c'

config 'interface' 'wan'
        option 'ifname' 'eth0.2'
        option 'proto' 'dhcp'
        option 'macaddr' '00:c0:ca:49:bb:7d'


and here is an ifconfig

root@OpenWrt:/etc/config# ifconfig -a
br-lan    Link encap:Ethernet  HWaddr 00:C0:CA:49:BB:7C
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2358 errors:0 dropped:193 overruns:0 frame:0
          TX packets:1464 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:307659 (300.4 KiB)  TX bytes:259682 (253.5 KiB)

eth0      Link encap:Ethernet  HWaddr 00:C0:CA:49:BB:7C
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2403 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1837 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:321013 (313.4 KiB)  TX bytes:421059 (411.1 KiB)
          Interrupt:5

eth0.1    Link encap:Ethernet  HWaddr 00:C0:CA:49:BB:7C
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:2403 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1464 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:321013 (313.4 KiB)  TX bytes:259682 (253.5 KiB)

eth0.2    Link encap:Ethernet  HWaddr 00:C0:CA:49:BB:7D
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:373 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:150319 (146.7 KiB)

ifb0      Link encap:Ethernet  HWaddr D6:B0:F2:11:FB:09
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ifb1      Link encap:Ethernet  HWaddr CA:BB:16:52:FE:3F
          BROADCAST NOARP  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:8497 errors:0 dropped:0 overruns:0 frame:0
          TX packets:8497 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:578476 (564.9 KiB)  TX bytes:578476 (564.9 KiB)


i have confirmed that the mac addresses are correct by loading the original R36 image and then doing an ifconfig.  On the original image i have no problem acquiring a DHCP address for the WAN port.

I have also tries setting a static IP address for the WAN and still unable to get out.

I thought for a while that it might be a firewall issue but creating rules to allow everything through also fails.

Anyone out there having any luck?

--luis

Re: ALFA R36 Router Hacking

one last strange thing...

if i have both the pc in the lan and the wan hooked up to my router when I boot up the R36 the pc gets an IP address from the WAN.  Its like the two ehternet ports are bridged.  Removeing the word bridge from /etc/config/networks seems to make no difference.

--luis

Re: ALFA R36 Router Hacking

Hello All,

Anyone out there having any luck with the wan port (eth0.2)?   Everything else on the board seems to work.  The WIFI works fine so does eth0.1 (the lan port) the lights etc.

There are no errors in any of the log files.  The kernel sees eth0.2 just fine.   The interface can be brought up/down with ifconfig without error.  If config shows packets going out the network interface but nothing received (as shown in the post above).   I have tried configuring the interace for both static and dhcp.    On the network side of the box none of the arp broadcast are seen by machines on the same network.   So.. it really seems that the WAN interface is not transmitting.  The kernel thinks it is but nothing is coming out of the RJ45.

Physically the two ethernet ports look like they are bridged.  If I have the the WAN cable connected to the device and a PC connected to the LAN port the PC acquires an IP address from the WAN router (not the R36).  Data is transparently passed between the two ports.   To get the R36 to handout a DHCP address to the LAN based PC I must have the WAN cable disconnected.  Once this is done the PC acquires a DHCP address from the R36.

I have looked at the openwrt mods made for the W502U board
https://dev.openwrt.org/changeset/29615/trunk#file12
and see nothing in the configuration that would prevent the wan from being configured correctly.

My guess is that there is some switch in the menuconfig that needs to be set to make this work.  Any pointers on resolving this issue would greatly be appreciated.  Just news that someone has this working would be appreciated.

The two ports work fine when booting the stock R36 image so I know its not an issue with the hardware.

Take care.

--luis

16 (edited by madisi 2012-01-28 16:07:37)

Re: ALFA R36 Router Hacking

Hello everybody, I've just successfully flashed my R36 with Openwrt (builded from svn): I have to thank a lot for the precious help of this forum; I'd like to share some useful (in my opinion) links and info

1) http://alfanetworkinc.blogspot.com/2012/01/r36-recovery-guide.html

For coming back from a bad flash procedure.

Look at the picture: it's important for the following item.

2) Correct pinout R36 TTL internal connector  (from AlfaNetwork):

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
That is our web blog where RED is VDD, Black is GND, Orange is RX, and Green is TX.
Best Regards
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

3) http://www.nslu2-linux.org/wiki/HowTo/AddASerialPort

About using a mobile phone data cable to connect R36 to a serial port (or to a usb-serial adapter)


I've used a modified DLR-3P data cable to connect R36 to a usb-serial adapter.


4) http://www.wifi-ita.com/forum/viewtopic.php?f=9&t=13088

About setting up a repeater bridge by the "relayd" package: I think this can help lsoltero to solve his problems with wan port...

Re: ALFA R36 Router Hacking

Glad you got openwrt running on the R36.  It works quite well.  I have luci and perl installed on my unit and its working well.

My problem is that I can't get the WAN port working.   I am not trying to use relayd.  I am just trying to get the WAN port to talk to the network.  the LAN port and WIFI work fine.  I have the unit configured as a WIFI hotspot and can connect to it and get DHCP addresses without issue.  I can also route traffic between the WIFI and the LAN port.    The problem is that the WAN is is not transmitting data over the network. 

When assigning a static IP address to the WAN ethernet device (eht0.2) the kernel acts like the device is working properly.  You can bring the internface up/down with ifconfig and change the network parameters.  The kernel also transmits data to the device as shown by the network counters.  However, nothing comes in through the port. If you are on the network using a sniffer (wireshark or other) you don't see arp broadcasts or any other traffic emanating from the WAN port.


if you hook up a PC to the LAN port and have the WAN connected then data passes from the PC to the WAN bypasing the router. i.e. data is not routed to the WAN its bridged.

I will be interested to hear if you are able to get the WAN working.

Take care.

--luis

Re: ALFA R36 Router Hacking

My personal experience on getting the WAN port working...hoping this can help.

1) Physical connection: R36 hooked up to 2 PCs by lan cables (one on lan port and the other on wan port); R36 usb port connected to Alfa AWUS036H 1000mW adapter (internet from here)

2) Network settings parameters like follow:

root@OpenWrt:/etc/config# ifconfig -a
br-lan    Link encap:Ethernet  HWaddr XX:YY:ZZ:RR:NN:FF 
          inet addr:192.168.1.1  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:9673 errors:0 dropped:2 overruns:0 frame:0
          TX packets:8238 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:937962 (915.9 KiB)  TX bytes:1294167 (1.2 MiB)

eth0      Link encap:Ethernet  HWaddr XX:YY:ZZ:RR:NN:FF 
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:25242 errors:0 dropped:0 overruns:0 frame:0
          TX packets:24114 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2505888 (2.3 MiB)  TX bytes:4345777 (4.1 MiB)
          Interrupt:5

eth0.1    Link encap:Ethernet  HWaddr XX:YY:ZZ:RR:NN:FF 
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:25242 errors:0 dropped:0 overruns:0 frame:0
          TX packets:22232 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:2505888 (2.3 MiB)  TX bytes:3458702 (3.2 MiB)

eth0.2    Link encap:Ethernet  HWaddr XX:YY:ZZ:RR:NN:FG 
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1882 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:758446 (740.6 KiB)

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:1 errors:0 dropped:0 overruns:0 frame:0
          TX packets:1 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:76 (76.0 B)  TX bytes:76 (76.0 B)

mon.wlan0 Link encap:UNSPEC  HWaddr XX:YY:ZZ:RR:NN:FH-00-00-00-00-00-00-00-00-00-00 
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:103 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32
          RX bytes:6412 (6.2 KiB)  TX bytes:0 (0.0 B)

wlan0     Link encap:Ethernet  HWaddr XX:YY:ZZ:RR:NN:FF 
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:7 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:32
          RX bytes:0 (0.0 B)  TX bytes:994 (994.0 B)

3) IP reservation for PCs mac address on R36 (192.168.1.123 and 192.168.1.127)

Tested different cases (connecting only one PC first to the lan port and later to the wan, both connected and so on): it worked, I got the correct reserved ip address on each machine.

Asap I'd like to test a configuration with dsl router hooked on R36 wan port.

Re: ALFA R36 Router Hacking

hello madisi,

i am not sure this is working for you... take a look at the counters on the wan interface (eth0.2)

eth0.2    Link encap:Ethernet  HWaddr XX:YY:ZZ:RR:NN:FG 
          RX bytes:0 (0.0 B)  TX bytes:758446 (740.6 KiB)

Note that the txmit counter is showing that data is going out the interface but its never coming in.

also... i am not seeing an IP address for the WAN.   Only for the LAN. (192.168.1.1)

I think what you are seeing is that the LAN and WAN ports are "bridged"  so that traffic from one is seen on the other.  Both PCs have the same subnet address. They should be different. 

In my testes I assigned a static IP address to the WAN port... i was unable to get an machine on the WAN side of the network to communicate with the R36.

Anyway... i will be interested to see if you can make the unit work with your DSL router.

--luis

Re: ALFA R36 Router Hacking

hm... is it possible that this fixes the issue with the WAN port?

https://dev.openwrt.org/changeset/29969

it was just posted and the patch does seem to address the WAN.

unfortunately I am out of town for the next week starting tomorrow and will not be able to test it... 

--luis

Re: ALFA R36 Router Hacking

svn update and recompile fixed the WAN. 

thanks all for your help.

--luis

Re: ALFA R36 Router Hacking

Hello Isoltero, you were right: eth0.2 was not receiving in my last configuration; I've followed your suggestion and rebuilding from last svn has solved the issue.
Now I need a little help to configure R36 network parameters to be able to repeat (via wireless) internet connection from another wireless router: I can only connect to internet by lan cable but not via wireless (the radio signal is on and I can see my R36 wireless network); I've tried to check the previous configuration of R36 (with the original AlfaNetwork firmware) that was like below:


# ifconfig -a
apcli0    Link encap:Ethernet  HWaddr 00:C0:CA:71:D8:GF                             
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

br0       Link encap:Ethernet  HWaddr 00:C0:CA:71:D8:GC                                 
          inet addr:192.168.2.1  Bcast:192.168.2.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:87 errors:0 dropped:0 overruns:0 frame:0
          TX packets:70 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:10152 (9.9 KiB)  TX bytes:19117 (18.6 KiB)

eth2      Link encap:Ethernet  HWaddr 00:C0:CA:71:D8:GC
          UP BROADCAST RUNNING PROMISC MULTICAST  MTU:1500  Metric:1
          RX packets:105 errors:0 dropped:0 overruns:0 frame:0
          TX packets:73 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:13666 (13.3 KiB)  TX bytes:17393 (16.9 KiB)
          Interrupt:3

eth2.1    Link encap:Ethernet  HWaddr 00:C0:CA:71:D8:GC                                   
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:492 (492.0 B)

eth2.2    Link encap:Ethernet  HWaddr 00:C0:CA:71:D8:GD                                   
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:6 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:492 (492.0 B)

gre0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-E0-1E-00-00-00-00-00-00-00
-00
          NOARP  MTU:1476  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

lo        Link encap:Local Loopback
          inet addr:127.0.0.1  Mask:255.0.0.0
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

ra0       Link encap:Ethernet  HWaddr 00:C0:CA:71:D8:GE                                   
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:9 errors:0 dropped:0 overruns:0 frame:0
          TX packets:21 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:406 (406.0 B)  TX bytes:0 (0.0 B)
          Interrupt:4

tunl0     Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-17-00-00-00-00-00-00-00
-00
          NOARP  MTU:1480  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wds0      Link encap:Ethernet  HWaddr 00:C0:CA:71:D8:GE
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wds1      Link encap:Ethernet  HWaddr 00:C0:CA:71:D8:GE
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wds2      Link encap:Ethernet  HWaddr 00:C0:CA:71:D8:GE
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wds3      Link encap:Ethernet  HWaddr 00:C0:CA:71:D8:GE
          BROADCAST MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:0 (0.0 B)  TX bytes:0 (0.0 B)

wlan0     Link encap:Ethernet  HWaddr 00:C0:CA:2D:E4:CG                                 
          inet addr:192.168.1.128  Bcast:192.168.1.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:23 errors:0 dropped:11 overruns:0 frame:0
          TX packets:32 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2953 (2.8 KiB)  TX bytes:5259 (5.1 KiB)


I've read a lot on Openwrt forum but I cannot understand if I've to replicate the configuration above or follow different direction; I've some knowledge of networking but I'm not a technician. Any help will be greatly appreciated.

Marco

Re: ALFA R36 Router Hacking

hi Marco,

Not sure if I will be able to help you.  I have the wifi setup as an accesspoint and its working fine for me.   My guess is that you have not setup the firewall zones correctly and so you are probably able to connect to the unit but not able to supply DHCP addresses.   It did take some work to get the wifi setup...

The good news is that the wifi hardware is working fine and I have 2 clients connected to the R36... So its just a matter of figuring out what buttons to push to make your setup work.

--luis

Re: ALFA R36 Router Hacking

Glad you've solved your troubles, thank you anyway Luis.

Marco

Re: ALFA R36 Router Hacking

Hi all has any one made an .img file and tried to up load it via the web interface?