Open Source Wifi Hotspot

Implementation Tyler Sondag and Jim Feher

The goal of this paper is to describe a design—includ- other hardware. The routing functions of the WRT54GS
ing the hardware, software, and configuration––for an were not used in this implementation. The servers need not
be anything special; older hardware will work just fine. For
open source wireless network. The network designed will this implementation, decommissioned 900 MHz units with
require authentication. While care will be taken to keep 512MB of RAM and 40GB hard drives were used.
the authentication exchange secure, the network will oth-
erwise transmit data without encryption.
N Wireless router software

W
ireless networks are an essential tool for provid-
ing service for colleges and libraries. This paper In order to provide the functionality required, the units
will explain the setup of a wireless network had their firmware flashed with an open-source, Linux-
using open-source software and inexpensive commodity based operating system available from OpenWrt for the
hardware. Open-source software was employed exclu- Linksys routers (http://www.openwrt.org). Support is also
sively. This allowed for flexibility in design and reduction available for other wireless devices. “The firmware from
in expense while also providing a platform for students to OpenWrt provides a fully writable file system with pack-
learn more about the internal workings of the system by age management. This allows developers the freedom to
examining particular sections of code in which they have customize the devices by choosing only the packages and
interest. Standard commodity hardware was used as a software that are necessary for their applications.”1 As the
means of saving cost. This should allow others to repeat routers have limited storage, being able to hand select only
this design with a minimum of funding. the necessary components is a definite advantage.
The purpose of a network, like any resource, is to
provide a service for those who own it; in this case, the
patrons of a library, or students, faculty, and staff at a col-
lege. To ensure that this network serves its owners, users
will be required to authenticate before gaining access.
N Server software
Once authenticated, the central captive portal can pro- For the operating system on the servers, Fedora Core
vide different levels of service for specific user groups, was chosen.2 Fedora provides the Yellow Dog Updater,
including guest access, if desired. For this system, ease Modified (yum), which eases the updating of all pack-
of access for users was the primary concern; other than ages installed on the system, including kernel updates.3
using the Secure Socket Layer for authentication, the This aids security by providing a platform for easily and
remainder of the traffic was unencrypted. frequently updating the system. Fedora Core is an open-
Other than the base nodes, the remaining access points source distribution that is available for free. Fedora Core
were connected to each other using a wireless connection also comes with many other open-source packages that
in order to avoid physically connecting all access points were used in this design, such as the Apache Web server.
across campus and to further reduce the expense for the While the designers had more familiarity with Fedora,
deployment of the network. This was accomplished using other distributions are also available that provide simi-
the WDS (wireless distributed system) feature on the lar benefits (Suse, Ubuntu, OpenBSD, Debian, etc.). The
wireless routers. All access points connect to a centralized server was run in command line mode with no graphical
set of servers that provide: DHCP, Web-caching proxy, user interface in order to reduce the load on the server
DNS caching, radius, Web server, a captive portal, and and save space on the hard drive.
logging of network traffic.

N Hardware
N Captive portal
In order to require authentication before gaining access
Requirements for the network were relatively modest, to the network, a captive portal was used. Some of the
using inexpensive wireless routers along with several
Linux servers built upon older Pentium 3 desktop systems.
Linksys WRT54GS routers were chosen as the access points
as they are inexpensive, readily available, and possess the Jim Feher ([email protected]) is an Associate Professor
ability to run custom open-source firmware. Other access of Computer Science at McKendree College in Lebanon, Illinois.
points could be used; however, the configuration sugges- Tyler Sondag ([email protected]), is a senior in
tions are specific to the WRT54GS and may not apply to Computer Science at McKendree College.

OPEN SOURCE WIFI HOTSPOT IMPLEMENTATION | SONDAG AND FEHER 35

desired features in the choice of the captive portal were: to the rest of the network (appendix A). SSH login for root
encrypted authentication, traffic logging, and the ability was also disabled at this time for added security.
to provide different levels of service for different user
groups. Logging traffic allows the system administrators
to identify accounts that have been misusing the network.
Those who inadvertently misuse the system or perhaps
have had their accounts compromised can have their
N Server #1 configuration
access temporarily disabled until they can be contacted For server #1, very little setup was required. Since this
with instructions concerning acceptable use of the net- server works mainly as a router, the only major items that
work. As the network must be shared by all, those who went into its configuration were the iptables rules, which
habitually abuse the resource can have their accounts per- are shown and described in appendix B.7 Rules were set
manently disabled. The captive portal should also redi- up to:
rect Web traffic to a login page that is served on the Secure
Socket Layer until the user logs in. Chillispot was chosen N set up network address translation;
as it possesses all of the features mentioned above.4 N allow traffic to flow within the network;
N log the traffic from the wireless portion of the net-
work;

N allow for the transparent setup of the Web proxy

N

Server layout server; and

N set up port knocking before allowing users to log into
As can be seen in appendix A, three servers were used the router via SSH.8
for this implementation. The first server was used as
the main router to the Internet. The second server ran A reference to this script was placed in the /etc/rc.d/
a Squid Web caching server.5 It also ran a DNS cach- rc.local file so that it would run when the server boots.
ing server and the FreeRADIUS server.6 The third was Last was the setup of the three network interfaces in
used for the captive portal. Three servers were used for the machine. This can be done during system installation
various reasons. First, this distributed the load. Second, or afterwards on the Fedora Core based server by editing
portions of the network that were not behind the cap- the configuration files in the /etc/sysconfig/networking-
tive portal could more easily use the services on the scripts/ directory. One of the configuration files used in
second server running Squid, DNS, and FreeRADIUS. It this implementation can be seen in appendix C. Of course
should be noted that three independent servers are not the configuration will change as the topology of the net-
required; many of the services could be consolidated on work changes.
two or even one single server to reduce the hardware
requirements. The implementation depends upon the
specific needs for the network.
N Server #2 configuration

N Server installation
The second server required significantly more setup to
configure all of the necessary services that it runs. The
first service added for this implementation was the Web-
Installing the operating system (Fedora Core) on each caching proxy server, Squid. Squid’s default configura-
server is a relatively straightforward procedure. Each tion file (/etc/squid.conf) is quite large; fortunately it
machine was partitioned with 1024 MBs of swap space requires little modification to get a simple server up and
with the rest of the drive being an ext3 partition with running.9 The changes made for this implementation can
the mount point “/”. Only the minimal set of packages be seen in appendix D. The most important lines in this
required were installed at this time. The first server, configuration are the last few, which enable it to act as a
server #1 (router), was given three network interfaces, transparent proxy server, making it invisible to the users
one for the Internet connection, one to connect to a switch and requiring no setup of their browsers.
that then connects to server #2 (Web/DNS caching and As there was no need for an authoritative DNS server,
radius) as well as other machines that do not connect just DNS caching for the network, dnsmasq, which is
through the captive portal, and one connecting to server easy to configure and can handle both DHCP services as
#3 (captive portal machine). The second server, server #2, well as DNS caching, was chosen.10 In this instance, the
only needs one interface, but the third, server #3, requires captive portal was used to provide DHCP services for the
two interfaces, one for the master wireless access point, wireless clients; however dnsmasq was used for dynamic
and one to connect to the switch connecting this machine clients on the remaining portion of the network. Dnsmasq

36 INFORMATION TECHNOLOGY AND LIBRARIES | JUNE 2007

is relatively easy to configure, requiring only one change be configured and copied to the proper directory, the
in its default configuration file, which points to the file in main configuration file and the login file.
which the DNS server addresses are stored, in this case The configuration file, chilli.conf, is located in the
/etc/dnsmasq_resolv.conf. directory that contains the source files. Move this file to
Next is the configuration of FreeRADIUS server. the /etc/ directory and make the necessary changes. In
There are two files that need to be modified for the radius this implementation, the file required several changes
server; both are in the /etc/raddb/ directory. The first is (appendix G). One of the more significant alterations was
clients.conf (appendix E). In this file at least two clients to change the default network range of 192.168.182.0/24,
must be listed, one for localhost (this machine) and one which would be limited to less than 256 addresses.
for the captive portal machine. For each machine, a pass- The address range was for the DHCP server was also
word must be specified as well as the hostname for that expanded to allow for more users. The lower portion of
machine. This establishes the shared key that is used to the network range was left to make room for addresses
encrypt communication between the captive portal and that could be assigned to the wireless access points. An
the radius server. The second is the users file (appendix entry was added to allow the access points to obtain a
F). In this file, each user for the captive portal system static IP address in that lower range.
must be listed with his/her password. This implementa- After this, settings must be changed for the DNS
tion also included a class, a session timeout (dhcp lease addresses given out to clients, and the address of the
time), idle timeout, accounting interim interval, and radius server. There is also a setting in the Chillispot
the maximum upload and download speeds. If guest configuration file that allows users to access a certain list
access is required, one or several guest accounts should of domains without logging in. For this implementation,
be added to this file along with entries for the registered the decision was to allow the users access to the campus
users. An entry was added for each access point so that network, as well as to the DNS server. Next, the “radi-
they can obtain an IP address from the DHCP server. ussecret” must be set. This is the same password that was
Finally for this machine, the interface configuration file entered into the clients.conf file on the radius server for
was changed according to the network specifications. For this machine. It is also necessary to set the address of the
this machine the configuration is simple since it only has page to which users will be directed. Two lines must also
one interface, and the only requirement for its address be added to allow authentication using the physical or
is that it be on the same network as the interface on the media access control (mac) address for the access points.
main router server to which it is connected. All of the access points shared a common password.
Chillispot passes the physical address of the access point
to the radius server along with this password. A separate

N Server #3 configuration
entry must exist in the radius configuration file for each
IP/physical address combination.
For this setup, the redirect page was placed on this
The third server required the installation of the captive server, therefore Apache (using yum) was also installed,
portal software, in this case Chillispot. In order to install and this server’s address was added as the Web address
Chillispot, if Fedora was used for the base system, it may for the redirect page (also note that the https module may
be possible to install it as a prepackaged binary in the be required for apache if it does not automatically install).
form an RPM package manager (rpm) file. Otherwise, if Rather than write a new page at this time, the sample
you find that you need to compile Chillispot from source page (hotspotlogin.cgi) from the Chillispot source folder
code, you may need to deviate from a minimal installa- was copied and modified slightly (appendix H). In addi-
tion of the operating system and base components and tion, a Secure Socket Layer (SSL) certificate was installed
also include the GNU compiler collection (gcc). on this server. This is not necessary, but it helps to avoid
When installing from source code, first download the the warnings that pop up when a client attempts to access
code from the Chillispot Web site. Once the code is down- the login page with a browser.
loaded, unzipped and untarred, installing the Chillispot A few iptables rules need to be added. The first com-
daemon is done by entering the directory containing the mand needs to be executed in order to utilize Network
source files and entering the standard commands: Address Translation (NAT) and have the server forward
packets to the outside network.
./configure
/sbin/iptables -t nat -A POSTROUTING -o eth0 \
make
-j MASQUERADE
make install
The next is used to drop all outbound traffic originating
When Chillispot is on the system, either by compiling from the access points. This prevents anyone spoofing
from source or through an rpm file, two more files must the physical address of the access point from accessing

PUBLIC LIBRARIES AND

OPEN
INTERNET
SOURCEACCESS
WIFI HOTSPOT
| JAEGER,
IMPLEMENTATION
BERTOT, MCCLURE,
| SONDAG
AND RODRIGUEZ
AND FEHER 37
the Internet, while still allowing the access points and All of this is detailed in appendix J. A final set of com-
the Chillispot server to communicate for configuration mands, which were needed for the WRT54GS, are included
and monitoring. to allow the access point to obtain its IP address from the
DHCP server. These commands may not be necessary
/sbin/iptables -A FORWARD -s 192.168.182.0/24 \
depending upon the type of access point used. Since extra
-j DROP
wireless access points are available, if an access point fails
These commands need to be executed when the or is having problems for some reason, it is simply a matter
Chillispot machine boots, so they were placed into the of running a script similar to the one found in the appendix
/etc/rc.d/rc.local file. It may also be necessary to ensure on one of the extra routers and swapping it out.
that the machine can forward network traffic. This can be
accomplished with the following command, which is also
found as the first executable command from the script in
appendix B: N Security
echo “1” > /proc/sys/net/ipv4/ip_forward
Unfortunately this system is not very secure. Only the
Finally, the configuration files for the interfaces were login credentials are encrypted via SSL. General data
set up. packets are in no way encrypted, so any information
being transmitted is available to anyone sniffing the
channel. WEP and WPA could be used for encryption,
but they have known vulnerabilities. Other methods exist

N OpenWrt installation and

configuration
for securing the network such as WPA with RADIUS or
the use of a Virtual Private Network, however the client
setup for such systems may not be considered trivial
Several ways exist to replace the default Linksys firmware
for the typical user. Therefore it was decided that it was
with the OpenWrt firmware.11 The tftp protocol can be
better to inform the users that the data was not being
used with both Windows and Linux, and one such method
encrypted and let them act accordingly, rather than use
can be found in Appendix I.12 In addition, other methods
encryption with known flaws or invest the time required
for using the standard Web interface can be found on
to train the general population on how to configure their
the OpenWrt Web site.13 There are several versions of the
mobile units to use a more secure form of encryption. As
OpenWrt firmware available; the newest version that uses
the main goal of this particular network was connectivity
the squashfs filesystem was chosen because it utilizes com-
and not security, it was felt that this was a fair trade-
pression that frees more space on the access point.
off. As new standards for wireless communication are
OpenWrt comes with a default Web interface that can
developed and commodity hardware that supports them
be used for configuration, however, ssh was enabled and
becomes available, this may change so that encrypted
a script using the nvram command was used to configure
channels can be employed more easily.
each access point (see appendix J). Before ssh can be used,
you must telnet into the router and change the default
password (which for Linksys routers is ‘admin’).
NOTE: Even if you decide to use the Web interface,
you should still change the default password.
N Conclusion
As several services that were installed with the
This implementation is in no way completed. It is a work
default configuration were not used in the implementa-
in progress, with many goals still in mind. Also, as new
tion, they were disabled once the firmware was flashed
features are desired, parts of the system will change to
by removing the modules that boot at startup: the Web
accommodate these requirements. Current plans for the
interface, dnsmasq, and the firewall. This is done by
future are first to develop scripts to check the status of the
deleting their entries in the /etc/init.d directory. Changes
access points and display this information to a Web page.
were needed to set the mode of the access point, to turn
These scripts will also notify network administrators
on and configure the clients needing to use WDS, to set
when access points go offline. This will help the adminis-
the network information for the access point and then
trators in making sure the system is up at all times. After
to save these settings. All of the wireless access points
this, scripts will be developed to parse the log files to find
that communicate with each other via a wireless connec-
abusive activity (spamming, viruses, etc). However, the
tion must have their physical addresses entered using a
current project as described is complete and has already
nvram command. For example, the command used for
functioned successfully for nearly a year providing con-
the main access point for the library would be:
nectivity for the library and portions of the McKendree
nvram set w10_wds=”MAC_4_lib1 MAC_4_lib2” College campus.

38 INFORMATION TECHNOLOGY AND LIBRARIES | JUNE 2007

References and Notes 8. Thomas Eastep, “Port Knocking and Other Uses of ‘Recent
Match.’” www.shorewall.net/PortKnocking.html (accessed
1. OpenWrt, Wireless Freedom. www.openwrt.org (accessed Aug. 11, 2006).
June 16, 2006). 9. Squid Web Proxy Cache, “SQUID Frequently Asked
2. The Fedora Project. www.fedora.redhat.com (accessed Questions: Interception Caching/Proxying.” www.squid-cache.
Nov. 29, 2005). org/Doc/FAQ/FAQ-17.html (accessed Aug. 8, 2006).
3. Yum: Yellow dog Updater, Modified. www.linux.duke. 10. Dnsmasq—A DNS Forwarder for NAT Firewalls. www.
edu/projects/yum (accessed July 22 2006). thekelleys.org.uk/dnsmasq/doc.html (accessed June 1, 2006).
4. ChilliSpot—Open Source Wireless LAN Access Point 11. Linksys.com. www.linksys.com (accessed Dec. 15, 2005).
Controller. www.chillispot.org (accessed June 23, 2006). 12. OpenWrtDocs/Installing/TFTP—OpenWrt. wiki.open-
5. Squid Web Proxy Cache. www.squid-cache.org (accessed wrt.org/OpenWrtDocs/Installing/TFTP?action=show&redirect
June 1, 2006). =OpenWrtViaTfp (accessed Aug. 2, 2006).
6. FreeRADIUS—Building the Perfect RADIUS Server. www. 13. OpenWrtDocs/Installing—OpenWrt. wiki.openwrt.org/
freeradius.org (accessed June 28, 2006). OpenWrtDocs/Installing (accessed Aug. 2, 2006).
7. Netfilter/iptables Project Homepage—The netfilter.org
Project. www.netfilter.org (accessed Aug. 8, 2006).

Appendix A. Network configuration

PUBLIC LIBRARIES AND

OPEN
INTERNET
SOURCEACCESS
WIFI HOTSPOT
| JAEGER,
IMPLEMENTATION
BERTOT, MCCLURE,
| SONDAG
AND RODRIGUEZ
AND FEHER 39
Appendix B. iptables script—Server #1 iptables -A INPUT -p tcp --dport 1234 -m recent \
--name SSH --set -j DROP
# this particular bit must be set to one to allow the iptables -A INPUT -p tcp --dport 1235 -m recent \
# network to forward packets --name SSH --remove -j DROP
echo “1” > /proc/sys/net/ipv4/ip_forward
# drop all packets that do not match a rule above by default
# set up path to the internal network from Internet if the iptables -A INPUT -j DROP
# internal network initiated the connection
iptables -A FORWARD -i eth0 -o eth1 -d 10.4.0.0 \
-m state --state ESTABLISHED,RELATED -j ACCEPT
# Same for the Chillispot subnet Appendix C. Server configuration for first
iptables -A FORWARD -i eth0 -o eth2 -d 10.5.0.0 \
network card (ethernet 0)
-m state --state ESTABLISHED,RELATED -j ACCEPT
# /etc/sysconfing/networking-scripts/ifcfg-eth0 -
# allow the internal subnets to communicate with one another
# Server #1
iptables -A FORWARD -i eth1 -d 10.5.0.0 -o eth2 \
#
-j ACCEPT
DEVICE=eth0
iptables -A FORWARD -i eth2 -d 10.4.0.0 -o eth1 \
BOOTPROTO=static
-j ACCEPT
BROADCAST=66.128.109.63
HWADDR=00:11:22:33:44:66
# allow subnet containing server 2 to reach the Internet
IPADDR=66.128.109.60
iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT
NETMASK=255.255.255.248
NETWORK=66.128.109.56
# Chillispot – accept and forward packets
ONBOOT=yes
iptables -A FORWARD -i eth2 -s 10.5.3.30 -j ACCEPT
TYPE=Ethernet
# Set up transparent proxy for wireless network, but allow
# connections that go through to the campus network
# to bypass proxy
iptables -t nat -A PREROUTING -i eth2 ! \ Appendix D. /etc/squid.conf—Server #2
-d 66.99.172.0/23 -p tcp --dport 80 -s 10.5.0.0/16 \
-j DNAT --to-destination 10.4.1.90:3128 #default squid port
http_port 3128
# nat
iptables -t nat -A POSTROUTING -o eth0 \ # settings changed to specify memory for squid
-j MASQUERADE cache_mem 32 MB
cachedir ufs /var/spool/squid 1000 16 256
# simple port knocking to allow port 22 connection adapted
# from www.shorewall.net/PortKnocking.html1 another # allow assess to squid for all within our network
# excellent document can be found at acl all src 0.0.0.0/0.0.0.0
# www.debian-administration.org/articles/26814 http_access allow all
# once connection started let it continue http_reply_access allow all
iptables -A INPUT -m state --state \
ESTABLISHED,RELATED -j ACCEPT # internal host with no externally known name so we put
# our internal host name
# if name SSH has been set, then allow connection visible_hostname hostname
iptables -A INPUT -p tcp --dport 22 -m recent \ # specifications needed for transparent proxy2
--rcheck --name SSH -j ACCEPT httpd_accel_port 80
httpd_accel_host virtual
# Surround the port that opens ssh so that a sequential port httpd_accel_with_proxy on
# scanners will end up closing it right after opening it. httpd_accel_uses_host_header on
iptables -A INPUT -p tcp --dport 1233 -m recent \
–-name SSH --remove -j DROP

40 INFORMATION TECHNOLOGY AND LIBRARIES | JUNE 2007

Appendix E. /etc/raddb/clients.conf— Appendix G. /etc/chilli.conf—Server #3
Server #2
# used to expand the network
client 127.0.0.1 { net 192.168.176.0/20
secret = password
shortname = localhost # used to expand the number of hosts that can connect
nastype = other # while still leaving a portion of the network for
} # infrastructure
client 10.5.3.30 { dynip 192.168.184.0/21
secret = password
shortname = other machine # used to give static addresses to the access points
} statip 192.168.182.0/24

# internal DNS followed by external DNS

dns1 10.4.1.90
dns2 24.217.0.3
Appendix F. /etc/raddb/users—Server #2
# radius server for the network
# example of an entry for a user
radiusserver1 10.4.1.90
joeuser Auth-Type:=Local, User-Password==”passwd”
radiusserver2 10.4.1.90
Class = 0702345678,
Session-Timeout = 3600,
# radius secret used
Idle-Timeout = 600,
radiussecret password
Acct-Interim-Interval = 60,
WISPr-Bandwidth-Max-Up = 128000,
# interface Chillispot server to listens to DHCP requests
WISPr-Bandwidth-Max-Down = 512000
dhcpif eth1

# specified default login page

# example of an entry for an access point
uamserver https://10.5.3.30/cgi-bin/hotspotlogin.cgi
# The physical/mac address listed below is for the
# lan side of the router/access point
# addresses that users can visit without authenticating
mac_address Auth-Type := Local, User-Password == “password”
uamallowed 10.4.1.90,24.217.0.3,66.99.172.0/24
Framed-IP-Address = 192.168.182.10,
Acct-Interim-Interval = 3600,
# this allows the access points to authenticate based on
Session-Timeout = 0,
# mac address only, this is required to log into the access
Idle-Timeout = 0
# points from the captive portal server
macauth

# this password corresponds with the password from the

# radius users file
macpasswd password

PUBLIC LIBRARIES AND

OPEN
INTERNET
SOURCEACCESS
WIFI HOTSPOT
| JAEGER,
IMPLEMENTATION
BERTOT, MCCLURE,
| SONDAG
AND RODRIGUEZ
AND FEHER 41
Appendix H. Redirection page

is available at: ftp://ftp.linksys.com/pub/network/

WRT54GS_3.37.2_US_code.zip
Appendix I. Method for flashing firmware N Download and unzip this file.
N Plug an Ethernet patch cable into link #1 on the router
of Linksys router (not the wan port) and the interface on your machine.
Set the IP address of your computer to a static IP
The firmware can be flashed using the built-in Web inter-
address in the 192.168.1.x range, not 192.168.1.1,
face or via tftp. While help is available online3 for this, the
which is used by the router.
procedure outlined here may also be helpful. On newer N Log into router by opening a browser window and
versions of the Linksys routers, an older version of the
putting 192.168.1.1 into the address bar. (NOTE: This
Linksys firmware must be installed first that supports a
is only for factory preset routers.)
bug in the ping function on the router. Once the older
Username: (leave blank)
version is installed, you can exploit a bug in the ping com-
Password: admin
mand on the router to enable “boot wait,” which enables N Click on "administration".
the router to accept a connection to flash its firmware as N Click on "Firmware upgrade".
it is booting. N Click "browse" and locate the old Linksys firmware
Detailed instructions for this installation are as fol-
on your machine.
lows: N Click "upgrade".
N Wait patiently while it flashes the firmware….
N First, download an old version of a Linksys firmware N Click "setup".
that supports the ping bug to enable boot wait. One N Click "basic setup".

42 INFORMATION TECHNOLOGY AND LIBRARIES | JUNE 2007

 N Choose "static ip" from the first box. ##192.168.182.21 lib02 00:11:22:33:44:33
N For the IP address put in "10.0.0.1". ##192.168.182.22 lib03 00:11:22:33:44:44
N For the netmask put in "255.0.0.0". ##192.168.182.30 car01 00:11:22:33:44:55
N For the gateway put in "10.0.0.2".
N You can leave everything else as their default set-
tings. ## SAME for all
N Choose save settings at the bottom of the page. nvram set wl0_mode=ap
N Click on "administration". nvram set wl0_ssid=McK_Wireless
N Click on "diagnostics". nvram set wl0_channel=9
N Click on "ping". nvram set lan_proto=dhcp

In the “address” box put the following commands in ## Sample configuration for a few access points.
one at a time and click on “ping”; ## Uncomment and run for the appropriate node.
if you see the message that the host was unreachable ## Make sure to
you have done something wrong. ## add a line for every access point you have.

;cp${IFS}*/*/nvram${IFS}/tmp/n ## UNIQUE for lib01

;*/n${IFS}set${IFS}boot_wait=on ## allow connections to/from lib02, and lib03
;*/n${IFS}commit #nvram set wl0_wds=”00:11:22:33:44:33
;*/n${IFS}show>tmp/ping.log 00:11:22:33:44:44”

N After the last command you will see a list of all the ## UNIQUE for lib02
nvram settings on the router, make sure that the line ## allow connections to/from lib01
for "boot_wait" is set to on #nvram set wl0_wds=”00:11:22:33:44:22”
N Unplug the router (the Linksys router will only look
for new firmware on boot). ## UNIQUE for lib03
N Use tftp on your Linux or Windows machine. ## allow connections to/from lib01
N If the openwrt0-wrt54gs-squashfs.bin file is not in #nvram set wl0_wds=”00:11:22:33:44:22”
this directory, copy the file to this directory
N Run the following commands at the prompt (below ## SAME for all
are the Linux commands) nvram commit

tftp 192.168.1.1 ## SAME for all

tftp> binary ## This needed to be done to allow each wrt54gs router
tftp> rexmt 1 ## to accept an IP address from a DHCP server. This is
tftp> timeout 60 ## only for the wrt54gs. Other access point/routers
tftp> trace ## may require something different.
tftp> put openwrt-xxx-x.x-xxx.bin # cd /etc/init.d
# rm S05nvram
N The router will now reboot (it may take a very long # cp /rom/etc/init.d/S05nvram .
time), when it is done rebooting, the DMZ light will # vi S05nvram
turn off ## place a # in front of (comment out)
## nvram set lan_proto=”static”
The new firmware is now loaded onto the router.

References
Appendix J. Nvram script for 1. Thomas Eastep, “Port Knocking and Other Uses of ‘Recent
wireless routers Match.’” www.shorewall.net/PortKnocking.html (accessed
Aug. 11, 2006)
## server information stored as comments 2. Ibid.
##192.168.182.10 mainap 00:11:22:33:44:00 3. OpenWrtDocs/Installing-OpenWrt, wiki.openwrt.org/
##192.168.182.11 cl202a 00:11:22:33:44:11 OpenWrtDocs/Installing (accessed Aug. 2, 2006).
##192.168.182.20 lib01 00:11:22:33:44:22

PUBLIC LIBRARIES AND

OPEN
INTERNET
SOURCEACCESS
WIFI HOTSPOT
| JAEGER,
IMPLEMENTATION
BERTOT, MCCLURE,
| SONDAG
AND RODRIGUEZ
AND FEHER 43