Skip to content

Instantly share code, notes, and snippets.

@openfnord

openfnord/!openwrt-config.md

Forked from NiklasGollenstede/!openwrt-config.md
Created September 5, 2022 10:40
Show Gist options
  • Save openfnord/a399c6089d2f1c70b63656cbe443eeb1 to your computer and use it in GitHub Desktop.
Save openfnord/a399c6089d2f1c70b63656cbe443eeb1 to your computer and use it in GitHub Desktop.
Download ZIP
OpenWRT on GL.iNET GL-AR750/MT300N_V2 with eduroam, openVPN client, and hardware switch
Raw
!openwrt-config.md

This shows how to flash OpenWRT to a GL.iNET GL-AR750 or GL-MT300N_V2 and how to set up eduroam, openVPN client, and their hardware switch.

Please read the content for more information.

Raw
content.md

OpenWRT configuration

This describes my setup of a GL.iNET GL-AR750 or GL-MT300N_V2 with pure OpenWRT (instead of GL.iNET's modified version), eduroam client (university WiFi), OpenVPN client, hardware toggle (for VPN), ... (I may add functionality to this guide in the future)

The WAN interface is configured as DHCP client by default, so the router can simply be plugged between an existing router and the configuring computer. If the subnets of the two routers are different, both (and the Internet) should be reachable at the same time. Alternatively, the new router can be connected to a second physical interface, if the computer has another one and routes correctly.

Flashing OpenWRT on a GL.iNET GL-AR750 or GL-MT300N_V2

Connect OpenWRT as client to eduroam

"eduroam" is a WWPA2-EAP network that allows members of higher education and other institution around the world to use each others WiFi networks with their home credentials. As such, the setup is slightly more complicated than that of other WiFi clients. Especially, the wpad package needs to be upgraded:

  • Install the full version of wpad: opkg update; opkg remove wpad-mini; opkg remove wpad-basic; opkg install wpad; reboot (via SSH, but the web UI works as well).
  • Click "Scan" on either WiFi interface (but doing this for both seems to create problems with DHCP client) on http://192.168.8.1/cgi-bin/luci/admin/network/wireless, select "Join network" for any "eduroam" connection/AP.
  • Select the few possible settings as appropriate, enter anything as password for now, "submit".
  • Under "Wireless Security", select WWPA2-EAP as "Encryption", and set everything else according to your institutions eduroam configuration.

OpenWRT as OpenVPN client

  • Install openvpn-openssl and luci-app-openvpn, then reboot and reload the web interface.
  • To allow LAN devices to use the VPN, add the VPN's interface to the wan zone; with the default configuration, that can be done by running uci add_list firewall.@zone[1].device="tun0"; uci commit firewall; /etc/init.d/firewall restart.
  • Get your *.ovpn client config file.
  • Under "OVPN configuration file upload", enter an instance_name, select the file, and "Upload".
  • OpenVPN client configurations can list DNS servers (as dhcp-option DNS <ip> lines), but OpenWRT 19.07 currently ignores them. If different external DNS servers have to be used with and without the VPN, a fix that applies the listed entries to the internal dnsmasq (which is what will be advised to the DHCP clients) is outlined here, specifically, set VPN_CONFIG_NAME=<instance_name> and run this:
cat << "#EOF" > /etc/openvpn/${VPN_CONFIG_NAME:?}.sh
#!/bin/sh
env | sed -n -e "
/^foreign_option_.*=dhcp-option.*DNS/s//nameserver/p
/^foreign_option_.*=dhcp-option.*DOMAIN/s//domain/p
" | sort -u > /tmp/resolv.conf.vpn
case "${script_type}" in
    up) uci set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.vpn ;;
    down) uci set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.auto ;;
esac
/etc/init.d/dnsmasq restart
uci commit dhcp # commit to keep DNS and (hopefully committed) openvpn state in sync after restart
#EOF
chmod +x /etc/openvpn/${VPN_CONFIG_NAME:?}.sh
printf '%s' "
script-security 2
up /etc/openvpn/${VPN_CONFIG_NAME:?}.sh
down /etc/openvpn/${VPN_CONFIG_NAME:?}.sh
" >> /etc/openvpn/${VPN_CONFIG_NAME:?}.conf
/etc/init.d/openvpn restart
  • Under "OpenVPN instances", set the "Enabled" check mark, and click "Save & Apply".
  • Add /etc/openvpn/ as line on http://192.168.8.1/cgi-bin/luci/admin/system/flash to preserve the config when updating the system.
  • To enable the VPN from a terminal or script, run uci set openvpn.${VPN_CONFIG_NAME:?}.enabled=1; /etc/init.d/openvpn reload; uci commit openvpn. To disable it, run the same with 0 instead of 1.

GL.iNET (GL-AR750/GL-MT300N_V2) hardware switch

mkdir -p /etc/hotplug.d/button
cat << "#EOF" > /etc/hotplug.d/button/00-button
##
# Allows to specify button actions via UCI configuration, see:
# <https://openwrt.org/docs/guide-user/hardware/hardware.button#using_atheros_00-button_uci>
##

source /lib/functions.sh

check_button () {
    local button;  config_get button  "${1}" button
    local action;  config_get action  "${1}" action
    local handler; config_get handler "${1}" handler
    local min;     config_get min     "${1}" min
    local max;     config_get max     "${1}" max

    # logger "DEBUG: checking: { button: ${button}, action: ${action}, handler: ${handler}, }"

    [ "${ACTION}" = "${action}" -a "${BUTTON}" = "${button}" -a -n "${handler}" ] && ((
        [ -z "${min}" -o -z "${max}" ]
    ) || (
        [ -n "${min}" -a -n "${max}" ] && [ "${min}" -le "${SEEN}" -a "${max}" -ge "${SEEN}" ]
    )) && {
        # logger "DEBUG: running ${handler}"
        eval ${handler}
    }
}

logger "DEBUG: button ${BUTTON} was ${ACTION} after ${SEEN}s"

config_load system
config_foreach check_button button
#EOF
chmod +x /etc/hotplug.d/button/00-button
  • To configure the toggle slider (VPN client on/off in this example), run:
uci add system button # left/off ==> enabled='0'
uci set system.@button[-1].button="BTN_0" # from the "BUTTON" table in the Wiki, or from `cat /sys/kernel/debug/gpio`
uci set system.@button[-1].action="pressed" # also from the Wiki, or just try it, there are just two options: pressed & released
uci set system.@button[-1].handler="uci set openvpn.${VPN_CONFIG_NAME:?}.enabled=0; /etc/init.d/openvpn reload; uci commit openvpn"
uci add system button # right/on ==> enabled='1'
uci set system.@button[-1].button="BTN_0"
uci set system.@button[-1].action="released"
uci set system.@button[-1].handler="uci set openvpn.${VPN_CONFIG_NAME:?}.enabled='1'; /etc/init.d/openvpn reload; uci commit openvpn"
uci commit system
  • Add /etc/hotplug.d/button/00-button as line on http://192.168.8.1/cgi-bin/luci/admin/system/flash to preserve the config when updating the system.
  • Note that some buttons, like reset or WPS, may have preconfigured functionality (which can be disabled).

Misc

  • List explicitly installed or updated packages: ls /overlay/upper/usr/lib/opkg/info/*.list | sed -e 's/.*\///' | sed -e 's/\.list//'
  • set the default locale for WiFi hardware: iw reg set DE
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment