OpenWrt 19.07

https://openwrt.org/releases/19.07/notes-19.07.0

by zdw • 7 years ago

208 116 7 years ago

nemosaltat• 7 years ago

I just installed this today and have been struggling with the WPA3 on my Linksys all evening. I finally gave up for the evening, and opened HN, to find these release notes at the top of the front page.

Some of my specific issues were addressed, if I had simply bothered to read the release notes carefully. Instead, I found my update file, and updated. When WPA3 didn’t show up, I poked around forums for workarounds and finally found some answers that helped. Now my other clients couldn’t connect/stay connected, even to the WPA2. These notes clearly mention this, as well as the libup issue I solved via - -force-upgrading

mangix2• 7 years ago

Those linksys routers have a driver that has had its development killed by the NXP buyout of Marvell.

slau2• 7 years ago

Please note that the popular TP-Link Archer C7 v2 is affected by a bug or two which drops 5Ghz WiFi performance significantly. Some people are reporting the link quality is so bad even SSH is unusable.

As always, back up your config, and make a note of your working firmware before upgrading. I’m going to sit this one out for a bit :).

mangix2• 7 years ago

I run OpenWrt on this router. I have not seen this issue.

slau2• 7 years ago

There’s a number of hardware revisions of this particular router, and the origin of the bug(s) is not yet identified. Maybe it only affects specific configurations, or specific hardware revisions using certain configurations.

dzhiurgis• 7 years ago

My short story with router above:

Get one for my parents, flash it with OpenWRT - 200mbps down - not crazy but enough for them
One year later, update with an "optimized" version - 600mbps down - amazed
One year later, update with latest - down to 200mbps and can't find the build I've used previously!

klingonopera4• 7 years ago

Always, always, always save those ROMs. Same for BIOS/UEFI updates for your mobos.

You won't regret it.

spookthesunset2• 7 years ago

Life pro tip: make sure you are only paying the ISP for the bandwidth you can actually consume. Don’t pay for 600mbps when you can’t even use that speed.

Comcast was more than happy to charge me for a half gigabit for several years. All the while the modem I was renting from them only supported like 200mbit.

odiroot• 7 years ago

Interesting, I have a router with exactly the same chip.

5GHz is okay but flashing anything other than official firmware breaks the 2.4GHz.

Suddenly all of my ESP8266 are disconnected. My Brother printer also cannot reach the WiFi.

yepguy• 7 years ago

They switched to ath10k-ct[1], a patched version of the ath10k driver and firmware. If you run into issues I think you can use the package manager to switch back.

[1] https://github.com/greearb/ath10k-ct

amq• 7 years ago

I'm running 19.07 since the first release candidate on Ubiquiti gear, no issues so far, with uptimes of weeks.

raphattack• 7 years ago

So does openwrt replace the edgeos on Ubiquiti gear? Trying to understand the advantages of this over the os it comes with.

19962• 7 years ago

Free software with full control

ptsneves2• 7 years ago

As ubiquiti is the apple of routers and they do have very good routers and software, what is the motivation for putting openwrt?

fignews• 7 years ago

Run OpenWRT on some Edgerouter Xs in my house and for me it’s consistency of the interface/configuration between all of my network devices and also full control. Runs OpenWRT quite well.

tssva2• 7 years ago

Although their hardware is good I find their software to be a bug filled mess. The EdgeOS 2 series in particular has been disappointing. Impactful bugs that have been extremely slow to address and loss of functionally on some devices which was promised to be resolved but still hasn't. I still can't get IPv6 to work on my Verizon FiOS connection because EdgeOS doesn't support the required options despite years of customers requesting the options being supported.

At the same time as this they have attempted to slip a call home function in unnoticed and stopped living up to their obligation to provide source code under the GPL.

Edit: I checked after posting this comment and Ubiquity is once again making the GPL source archive available. It had disappeared for quite a while and there was a bit of an outcry regarding it.

IntelMiner• 7 years ago

How hard is it to get devices included into OpenWRT's Table of Hardware, or official releases?

I have an End-Of-Life'd SG-1000 from PFsense developer NetGate https://www.netgate.com/solutions/pfsense/sg-1000.html

The thing no longer gets updates as of October 2019 and was never particularly well supported, but feels like an absolutely perfect OpenWRT target

I've poked at it on and off with regard to getting Linux running, as it seems to be heavily based off a standard, old Ti SoC "evaluation board" and it /mostly/ works

The problem I've run into though with the upstream kernel is the ethernet NIC's appear to be linked. If you unplug either interface, they both stop responding until they are both reconnected to active devices. I'm not well-versed enough with ARM DeviceTree to figure out what the issue is, nor do I want to buy the Ti hardware SDK to test it with

The old 4.4.3-yocto files Netgate sent me do appear to work with it, and the DeviceTree even works up to 4.19-LTS with minimal modification https://intelminer.com/pflin.zip

softblush• 7 years ago

Maybe it would be easier to get help when you ask this on the OpenWRT mailing list or IRC https://openwrt.org/contact

moomin• 7 years ago

It might be, but most people’s experience of mailing lists involves them getting their head blown off for daring to ask a question without three year’s solid experience in the area.

(I have no idea if OpenWRT in particular is like this, but there’s enough out there that people don’t make them their first port of call.)

fencepost4• 7 years ago

The fact that there's no wireless in it may make it simpler, but being an eol niche product may mean that there are only single digit potential users. It may all come down to whether an existing generic for the processor family will work on it.

daneel_w• 7 years ago

Interesting bug observed in 19.07 by users of some routers: the unit will perpetually boot into failsafe mode despite not being triggered to do so. Recompiling with the failsafe module removed from the build solves the problem, but exposes what is possibly the root cause - configuration changes remain only as long as the router is powered on despite being saved, nothing persists through a reboot of the router, and the unit will always start up with the default config.

I had to test it on my (deprecated) Netgear EX2700 and could confirm the exact same problem. Other than the lack of configuration persistence, 19.07 performs just great and I was pleased with many of the new features and changes. Unfortunately I'll have to stick with 18.06.6 as I have power outtages every now and then.

sam42• 7 years ago

Sounds like this known issue, mentioned in the release notes:

Images for some device became too big to support a persistent overlay, causing such models to lose configuration after a reboot. If you experience this problem, please report the affected device in the forum and consider downgrading to OpenWrt 18.06 or using the Image Builder to pack a smaller custom image.

blocktrron• 7 years ago

This sounds like the Flag for the buttons GPIO is wrong (ACTIVE_LOW instead of ACTIVE_HIGH / vice versa). This was unnoticed for a long time until a rewrite of the button handling.

If you are confident building your own image, try to inverse the button state here and test it out / send a patch: https://github.com/openwrt/openwrt/blob/master/target/linux/...

GiorgioG• 7 years ago

I’ve been disappointed with every consumer grade router out there. Countless bugs from annoying hiccups to a daily reboot. I feel like I’ve replaced my router every couple of years, never spending less than $150, up to $250.

Finally I splurged for a UniFi Dream Machine a couple of months ago and I could not be happier.

Nothing against the OpenWrt folks of course, but the reason these projects exist is the router vendors just suck. I won’t give them any more of my $ (Linksys, Netgear, ASUS in my case.)

Youden• 7 years ago

I generally agree but I'm heading back from a trip to Russia and I was surprised by how good Keenetic's [0] equipment was. It's a brand that apparently only operates in Russia, Ukraine and Turkey.

I was impressed because of how clean and workable the stock web UI is, as well as how many features it has. They have some of the more obscure normal things like IGMP proxying (with a very user-friendly UI for configuring it) but what really impressed me was that it even had WireGuard support as an official installable package.

I'll stick with my UBNT gear at home but still, for a consumer brand Keenetic is pretty nice.

[0] https://keenetic.com/global

jotm2• 7 years ago

MikroTik, too, but last time I checked the UI was pretty bad. Good hardware, reliability and features, though.

jotm2• 7 years ago

They should just all adopt OpenWRT (with their custom UI) and invest in it. Like Android for smartphones.

All router firmware is terrible in some ways, and has been for decades -_-

zantana• 7 years ago

That was my thinking with going with MerlinWRT. I splurged and got an Asus ax88u, then spent two weeks trying to get it to work before returning it. I do think part of the issue is WiFi technology is diverse enough that the latest and greatest are optimized around 5Ghz and newer specs whereas a lot of IOT (which I use) is still old school 2.4. Anyway I tried OpenWRT for a while but went back to DD-WRT on an Archer C9 which has been just about perfect for my usage.

zeroping• 7 years ago

I agree that much of the problem is the hardware. I went through several cheap routers before I finally found one that was stable after a year of use. That one worked great for >8 years.

I just upgraded, and went with a device intended to be a commercial AP, but since it has two Ethernet jacks, it makes a great router under Openwrt. So far, it seems pretty good, but I'll be happier if I see uptimes of more than a year.

ice32• 7 years ago

Couldn't agree more. Consumer grade routers are all buggy or have some proprietary features that just don't work with Openwrt.

I've been using ASUS based routers for the last ~10 years (with Openwrt) and a few months ago decided to upgrade to something else.

After researching what routers are out there, I ended up getting a Turris Omnia [~320 eur]. It's running a fork of Openwrt. Can probably run vanilla Openwrt without too many issues.

There's also Turris Mox - a modular design from the same people, but I ended up getting Turris Omnia, since they pack 2gb of RAM into that router and it has 3 miniPCIe slots on it.

fencepost4• 7 years ago

Consumer grade routers are all buggy or have some proprietary features that just don't work with Openwrt.

Not sure how much it's still the case, but for a long time there were a bunch that worked just fine with OpenWRT as long as it was the forked 3 generation old version that was the official firmware.

3guk• 7 years ago

I must admit I’m a big fan of the UniFi stuff too - for prosumer use it’s excellent, has a tonne of features and for the most part is fairly stable. Just a shame that sometimes they abandon hardware a bit too soon, or promise features that never materialise.

eddyg• 7 years ago

It’s worth noting that OpenWRT doesn’t just run on “embedded”/“dedicated” OEM router hardware: it works great on any x86-based system (often sold as “pfSense” boxes, etc.) as well and offers a lot of great functionality.

Dunedan• 7 years ago

pfSense is a completely different product and not related to OpenWrt at all. It even isn't based on Linux, but on FreeBSD.

kn0where• 7 years ago

Yes, but the parent is just saying that x86 based hardware that sells itself as being a “pfSense box” also runs OpenWRT.

auxym• 7 years ago

I assume GP is aware of that, and from what I understand, he is pointing out that OpenWRT also happens to run great on various x86 hardware/SBCs sold as "pfsense boxes".

klingonopera4• 7 years ago

I was thinking of trying this out, but I imagine, with VDSL(2), there aren't any significant latency bonuses when doing it. There are way to few VDSL2 PCI-E cards available, if at all.

Edit: ...or does VDSL2 run with the ethernet protocol and just needs a standard nic? The VLAN ID tag makes me think so, but the GDMT993.5 (Vectoring) tells me it could be something more...

keeperofdakeys2• 7 years ago

VDSL needs its own NIC, as it operates very differently to ethernet. Recently I discovered that my telephone line was operating on one wire, but VDSL was still operating in a degraded fashion. Suffice to say this would totally prevent ethernet from working.

ADSL could only encapsulate ATM frames (hence using PPPoA), VDSL includes a new mode called PTM that can encapsulate ethernet frames. This may be what you were reading about.

nolok4• 7 years ago

While we're on an OpenWrt thread: what's the best way if any to get a view of "who's using the bandwidth right now" on it ?

Not the process, not the remote host, not the monthly agreggate, but which connected device wifi or lan is using what, total or by host.

(use case; figuring out whose phone/laptop/tablet/tv/whatever is suddenly eating all the bandwidth in my home from time to time)

I'm using 18.06.05. A nice view in LuCI would be perfect but something that need to ssh is fine too.

gsich6• 7 years ago

ntopng. It doesn't run on OpenWrt though. I have tried, but you have troubles compiling it and resource constraints depending on the device. Might be lucky if you have ARM and enough space.

But I have long searched for something similar. The answers were mostly useless e.g. most if not all were for the combined bandwidth.

I now run ntopng on another x86 device and use port mirroring to capture the traffic that goes through the OpenWrt device.

nolok4• 7 years ago

Sounds / looks like it's exactly it.

What kind of resource needs are we talking about here ? The router I use at home is a R6220 (OpenWrt description "It comes with a large 128 MB NAND ROM with space for many packages and a single core (dual thread) MIPS CPU powered by 128 MB RAM"), do you reckon there is a chance for it to run there ?

kim0• 7 years ago

bandwidthd did that job for me!

nolok4• 7 years ago

Does it have an instant view (or a way to refresh it at current data) ?

flas9sd3• 7 years ago

On openwrt I like small utils. As ssh is fine: having a look adhoc who is a bandwith hog, I check with iftop and press "t" to cycle to one-line-sent view and "s" to aggregate to the receiver see https://openwrt.org/docs/guide-user/services/network_monitor... - there's no key yet to toggle per item total amount, but this can be had by using "show-totals" in an .iftoprc file:

    line-display: one-line-sent
    hide-source: yes
    dns-resolution: yes
    show-totals: yes
    show-bars: yes
    use-bytes: yes
    sort: 10s

downside is: iftop as far as I know can't filter multiple interfaces, so you'd need to check them separately with -i eth0 / -i wlan0. If you're mainly concerned about latency, give the package "sqm-scripts" a try. You're sacrificing a bit of bandwith for active queue management. So a VoIP session is not affected by a download.

nolok4• 7 years ago

Thanks, that seems to be exactly what I wish !

Already using sqm (and I love it) but it's for use cases like when a laptop that hasn't been used in a while is started by someone to charge before watching a movie and steam/dropbox/windows on said laptop start hogging everything. In a residential area where we're still depending on ~10 Mbps adsl, identifying the device can be a need.

downside is: iftop as far as I know can't filter multiple interfaces, so you'd need to check them separately with -i eth0 / -i wlan0.

Since I care only about lan <=> wan, doesn't that mean I just need to check on wan ? And all clients would be there, no matter if they're connected to the router through lan or by wifi ?

jibiji2• 7 years ago

Simple answer: `opkg install luci-app-nlbwmon` and you get instant bandwidth stats in the LuCI web interface.

Otherwise there is documentation on all other possible tools you can use:

https://openwrt.org/docs/guide-user/services/network_monitor... https://openwrt.org/docs/guide-user/network/wan/wwan/bandwit...

est312• 7 years ago

Got WPA3 working with it, yaay! https://gist.github.com/est31/d92d17acbb4ea152296f9b38764cd7...

flas9sd3• 7 years ago

to encourage others.. wpa3 for me was install of one package (opkg install --force-overwrite hostapd-openssl) and changing one config line (encryption = 'sae'). Client had no issue connecting (wpa_supplicant 2.9 on ubuntu 19.10, though only nmcli shows the connection as wpa3). The various dragonblood attacks are mitigated in current hostapd if I'm not mistaken.

est312• 7 years ago

If you only have WPA3-capable devices on your network, setting encryption=sae is fine. I have to support WPA3 incapable devices and thus need to use the sae-mixed option (also the wpa_supplicant patch I use requires wpa2-psk support).

ncmncm3• 7 years ago

Nothing is very clear, but I get the impression that:

- targets labeled "ar71xx" can only use the old driver, and will probably not be supported in future releases. Consider replacing such equipment.

- targets labeled "ath79" have already been ported (or started out?) with the new driver, and owners may ignore the whole topic.

- targets labeled "ar71xx-to-ath79" have a commitment for support for the new driver, so that all future releases should work with this hardware (even though this latest release still uses the old driver).

Can somebody confirm whether this is an accurate understanding?

I have tp-link AC1750v5 routers, identified with the third bullet above. Can I ignore this, or do I have to do something to switch it to the new driver?

jibiji2• 7 years ago

There is no driver change, only changes in the way the device is supported by the kernel (mach files in ar71xx, Device Tree in ath79)

The "ar71xx-ath79" target is used in the wiki for devices that are supported both in ar71xx and ath79, there should be 19.07.0 images for both.

In any case, use ath79 for new devices, and migrate from ar71xx to ath79 on existing devices.

There is a guide here: https://openwrt.org/docs/guide-user/installation/ar71xx.to.a...

ncmncm3• 7 years ago

OK, so it appears that changing to the new "driver configuration" mainly affects what names the devices have in /dev and /sys, which would make your current router configuration not work, without some active translation, first.

So, when you install the new boot image, you choose which, and if you choose the ath79 one, then when you restore the configuration, something runs to translate it for the new names. Presumably, then, if everything seems to work, you make a new backup with the new settings, and everybody can forget the old names.

ncmncm3• 7 years ago

What is this about a LEDE / openwrt fork? Should I be looking at LEDE instead?

What about the FreeWRT fork? Is it alive / lively / up-to-date / running ahead?

dddddaviddddd• 7 years ago

LEDE merged back into OpenWRT https://en.m.wikipedia.org/wiki/OpenWrt#History

h2odragon• 7 years ago

Not that I've tried to make it do anything fancy, but I've been using it since the -rc1 and it has been flawless for me. Just posted about it http://snafuhall.com/home-lan-2-openwrt-router.html

I really appreciate the effort the OpenWRT folks have put in to collecting useful snippets of documentation for odd cases and uses. Sure it might could be better organized but it's there at least.

manuelmagic• 7 years ago

There was a time when I had the free time to install dd-wrt on a brand "new" Linksys WRT54G and fiddle with tons of features but today I'm completely satisfied by my FRITZ!Box(1) that requires near zero active maintenance. I don't get thousand of features, but all the ones I need at home.

I'm honestly curious: why do you guys use OpenWRT, dd-wrt, tomato etc.? Re-using old hardware? Flashing bugged cheap routers that work bad with official firmware (that's never going to be fixed probably)? Need a specific feature not normally available on home net devices? Just enthusiast about the project or simply enjoying the hacking?

(1) I spent a few euros more on it than the typical home network appliances but I gained them back in quality, reliability, active support and development: no crappy hardware, no bugged software and zero issue with my 15+ WiFi devices in my house in a year.

mindslight• 7 years ago

I similarly wanted lower hassle, but went in a different direction of just moving routing back to a full amd64 box running Debian. Now all tinkering is standard configuration, will cleanly carry across upgrades, and lives in git.

I still use OpenWRT/DD-WRT on a few standalone access points, because I'd rather have a standard webui than dealing with manufacturer idiosyncrasies. Although when it's upgrade time I'll be tempted to move further in the amd64/hostapd direction.

nickysielicki• 7 years ago

I updated my router to this release today. Then I setup:

1. DNS over HTTPS to cloudflare so that my DNS doesn't leak.

2. Hurricane Electric's tunnelbroker, so that I can access the IPv6 web.

3. Dynamic DNS so that I can address my home connection anywhere, even if my IP changes.

4. Wiregaurd so that I can access everything on my home network.

I tend to agree that most people should just buy Ubiquiti SOHO gear and be done with it, but at least for me, this is cheaper and a bit more fun.

Trias11• 7 years ago

For #3 I use ZeroTier (but this of course won't let me access fridge of coffee machine remotely because i can't install ZT on them :) )

but anything else goes, especially #4 WireGuard.

LargoLasskhyfv2• 7 years ago

Though i have to concur they usually do their job, the Fritten annoy me to no end. First i don't like their UI, then i don't like the company AVM for taking a hostile stance against the opensource/modder community. I don't need their features for integrating their smarthome stuff. Yet i can't disable their broadcasts in my LAN when they try to find other AVM stuff. AVMs comment to other users who complained about the same: 'Block it in your firewall.' In older versions their IPv6 support was shitty. They disabled Telnet/SSH. They are a monoculture for users in blissful ignorance. Their design is ugly. If they come from the ISP they gather which devices are connected internally in regular intervals and get that wrong. For instance the ethernet of some docking station is recognized as a Playstation from Sony. They clash with my opinion of how my internal network has to look and operate.

That they are considered as one of the better options just shows how crappy the market in general is.

And therefore alternatives like OpenWrt are needed!

boring_twenties• 7 years ago

1) The default firmware on the consumer routers I've had failed to support even the most basic features, like VLANs and virtual wifi interfaces. Forget about custom routes, firewall rules, dnsmasq options, dynamic DNS or anything else.

2) It doesn't come with the source, so it fundamentally cannot be trusted. A router that can't be trusted isn't very useful, and so proprietary router firmwares are simply unacceptable on their face.

josteink2• 7 years ago

OpenWRT is great.

This release brings all devices up to the same (mostly) unpatched Linux kernel, 4.14.

For the popular Tp-link Archer C7 routers (and family?) you finally get soft off-loading with the new ath79 device-tree, meaning the device can now handle routing 600mbps+ where it before would only route 350mbps+. That’s massive!

The new client-side GUI is noticeably snappier on slow routers.

I’ve already upgraded all the 5 units I have in my home network, and I’m feeling it. I’ve kept settings despite recommendations against doing so, and I’ve had zero problems. Super-smooth!

Props to the team and everyone involved. Despite their modesty this was quite a release!

mikepurvis• 7 years ago

I have an old C7v2 to that was the basis of my household's network until I upgraded to an EdgeRouter + Unifi APs.

The C7 was fine for a while but in the end got extremely unreliable, even in partial roles as only a router (with wifi disabled) and then later as only a an AP (with the DHCP server disabled). Currently it's unplugged because any time it was turned on, devices would roam to it and get stuck there with no connectivity.

I should try upgrading it to the latest OpenWRT and see if things are any better.

rshnotsecure• 7 years ago

How does everyone feel about the security of OpenWRT? vs Tomato?

What about say configuring my own OpenBSD server to act as a router? I am out of my intellectual depth here but I feel like that would be more secure than Linux in general if we are going for max security.

As governments and private equity groups continue to buy out whatever hosting provider, VPN, Registrar, etc they can find...I feel like Open Source is a pretty soft target in the grand scheme of things. I am trying to become somewhat ruthless in analyzing my dependencies when it comes to software.

NOTE: another commenter mentioned a TP-Link product. Those devices are absolutely insecure to the core of their firmware for the time being. 7 days ago I discovered their completely open production Elasticsearch API server for their entire camera and IOT platform in the United States. It has now been remediated but that event puts under suspicion anything else the company deals with via the TP-Link brand out of Shenzhen.

jt_snacks• 7 years ago

Any of the major distributions focused on simplicity and routing that also receive regular security updates should meet your needs.

A Google Wifi setup (with it's automatic updates) is probably better for privacy and security than the TP-Link. Better still would be pfsense, vyatta. Personally, I use an ER-X running a minor vyatta fork and it's rock solid.

mongol• 7 years ago

Interesting idea. I briefly searched for Ansible + OpenBSD + router and found some interesting links. Need to look into it. I was thinking to do this with Linux but for this purpose, OpenBSD could be better? But it was very long ago I last used OpenBSD.

1MachineElf• 7 years ago

I was able to accomplish this with OpenBSD in 2016 by simply using the official docs. With Linux you'd be googling around for WireGuard, etc.

josteink2• 7 years ago

another commenter mentioned a TP-Link product.

That may have been me.

Those devices are absolutely insecure to the core of their firmware for the time being.

Which is why you replace that firmware with OpenWRT, right?

chousuke2• 7 years ago

I can recommend building your own OpenBSD router. Installing OpenBSD is easy, and once you have it installed the base system contains everything you need to set up a router along with excellent documentation for everything. OpenBSD people also take security seriously, so if you stick with the base system, you'll be fine. That said, you'd be fine on Linux too, depending on the distribution; it's not like Linux-based systems are somehow fundamentally insecure.

I really can't stress enough how good the documentation is; in the Linux world I'm used to googling and wikis and whatnot because most man pages for the components of a distro are either nonexistent or incomplete, but with OpenBSD, you'll do fine with just man and apropos. It's considered a bug if the documentation is missing something.

OpenBSD is a fantastic OS for learning about all kinds of UNIX and networking stuff if you're not opposed to spending some time reading good quality documentation.

ac292• 7 years ago

Any recommendations for hardware to run an OpenBSD router on? Support for ARM and MIPS devices seems pretty limited, leaving x86 stuff like Protectli or PC-Engines (which are both pretty expensive for what you get).

Nextgrid2• 7 years ago

TP-Link is not alone in this. Pretty much any consumer-grade network equipment is built down to a price, with zero budget remaining for the actual firmware.

If you can't use OpenWrt then buy enterprise-grade equipment. Personally I'm using a combination of a Mikrotik router at the edge and then consumer-grade powerline access points with OpenWrt (not strictly needed for security as they're behind the firewall already, this was more for functionality to support 802.11r for Wi-Fi).

glogla2• 7 years ago

Does Mikrotik still require the windows-only utility for configuration? I remember it was a thing.

yborg• 7 years ago

I have a TP-Link device and am glad to see an alternative to the stock firmware since all of the consumer brands have been found to have gaping security issues over the years - at these price points and because consumers don't know/care about it, security is not a priority for most vendors.

All that said, I'm not sure how misconfigured TP-Link infrastructure would lead one to declare all their device firmware is bad.

dTal• 7 years ago

I am trying to become somewhat ruthless in analyzing my dependencies when it comes to software

This strikes me as both very difficult and very wise, in the way that choosing to run Linux on your desktop was 20 years ago.

tapper82• 7 years ago

security of OpenWRT vs Tomato? OpenWrt has a up-to-date Kernel. We try and be as safe as we can from first boot. We make you set your password to get up and running so no crappy passwords from the start. wifi is turnd off on boot so you don't get a unsafe wifi network with no security. The firewall is set up with a small rule set to be as safe as it can. The webinterface can be installed with https We have lots of packages to be even safer. BCP38, addblock, banip, dnscrypt, several proxy servers and dns over https.

I would not run Tomato? on a router in 2020 it runs with old Kernels and old packages.

Disclaimer: I am not a OpenWrt dev I just help out around the place like on Twitter forums PS if any one needs help pleas come to the forums we will help out as best as we can. Some people think that OpenWrt has devs that are not very tolerant. I can tell you that this is not true. there was a bug in LUCI the webinterface that made it hard to use with my screen reader I asked about it on irc and it was fixt in 3 hours.

GEEMAIL1801• 7 years ago

I'm using DD-WRT at home. I understand that the embedded Linux that it runs can become more of a full featured version by adding and properly formatting a hard drive to the router. I haven't been able to do this yet and I think it would be great if there were an image available that could be written to the disk for this purpose.

glogla2• 7 years ago

I'm curious what attack surface typical "wifi-router" has?

From the internet, nothing should be exposed - or maybe OpenVPN port or ssh?

From outside, usually you would see WPA2-PSK network. I know there are some attacks on WPA2, but I don't know if they're practical. I also know that WPS (that PIN thing) is very insecure, but that is hopefully disabled on most networks.

From inside the network, things get more difficult, because the router has to have a lot of services exposed - DNS, DHCP, whatever the thing that supports UPnP is, the admin web interface, ssh, etc.

This makes me think, that unless the manufacturer sneaks in a backdoor, things should be relatively secure from outside (both internet and physically). Am I missing something?

kjs33• 7 years ago

I've been using straight OpenBSD as a router/FW for years. It has served well, has been particularly stable & easy to maintain and runs well on relatively modest hardware. A couple of notes:

- It's so much easier if you keep it simple as possible. If it's your router/FW, don't run your web server, file server, streaming media server, etc. on it. I mean, you can, but that's just a lot of things that can go wrong.

- PF, the firewall in OpenBSD, is usually configured via CLI + conf txt files. The syntax is shall we say terse, but it's well documented and there are lots of examples. Yes, I know there are some 'PF GUIs' out there; I've never tried them on OpenBSD and don't know anyone who has. If that's a deal-breaker, then maybe look at pfSense (FreeBSD based).

- Pay close attention to the hardware compatibility list; not all WLAN chipsets are well supported.

- Read the documentation. Seriously. The community is at best 'difficult'; if you drop into their world asking questions that are in the doco expect active hostility. And OpenBSD is not Linux despite the superficial similarities. Don't expect everything to work like it does on Linux.

darkwater2• 7 years ago

Sooo... if I want to move my VPN (WireGuard) termination from my Raspbian to a more dedicated device like a royter, what are the option at a reasonable price (say, 100$ or €, as I am european) and reasonable power? Better if with integrated wifi controller and antennae. And which distribution besides OpenWRT? Thanks!

zymhan• 7 years ago

You should start with the OpenWRT wiki.

darkwater2• 7 years ago

Had already a look at it but I asked here because I wanted some opinions from the HN crowd. Nevermind...

OpenWrt 19.07

Related Stories