Tag Info

Hot answers tagged

16

Things I like about it: Free Very stable Very easy to install on Linksys WRT54G routers Allows you to increase your wifi signal strength! UI is simpler and faster than the stock Linksys UI bandwidth monitor helps me to see how much bandwidth others are using on my network, so I know why hulu is skipping, etc The wireless survey is a nice, easy way to see ...


7

You'll want to upload and install tcpdump for tomato. You'll need to wget the file and host it somehow and then wget it onto your device. Put in /usr/local/bin or some /bin in your $PATH for easy keeping. See link for file: link Once you get it installed run something like this (modify for proper interface) tcpdump -i eth0 -n port 80 See tcpdump cheat ...


6

We have used DDWRT for over a year now and have never had an prob with it. We run it on a WRT54G that is on and open to the public 24/7. I may have had to restart it 3 times in the last year or so. We frequently have 15-25 wireless users. There is plenty of support for DDWRT online and I would definitely recommend it. If you have read anything about it ...


5

Setup reservations for the specific hosts using the dhcp-host option. Use tag options to flag those for a special set of options. This is completely un-tested, but I suspect your config might look something like this. Check the man page for full details. dhcp-host=00:15:99:27:f8:98,set:specialhosts,192.168.32.20 ...


4

We use them everywhere, I think we got about a hundred used in production, from simple firewalls to asterix nodes. We have standardized on ASUS WL-500GP hardware. We have developed some scripts in-house to handle upgrades and "config" snapshots. The only thing we really miss is accelerated crypto for OpenVPN.


4

Throw hardware at it :-) One option: Start with a home router/firewall device (not one with wifi though). Connect it to your cable modem. Get two wifi routers and plug the WAN port of each into LAN ports on the main router. Now, as long as you don't add any static routes to the main router you have two networks that can't "see" each other. Another option: ...


4

Yes it is possible, but it the performance improvement depends on your traffic patterns and configuration. Bonding will certainly work, how well it works will depend on how it is configured and if your switch also supports some form of bonding and how you configured the switch if it does. Another common usage of multiple interfaces is redundancy. This is ...


3

The Tomato firmware seems to be aimed mostly at use via the GUI, from a quick read over their FAQ. It is possible to do perform configuration tasks from the command line, but the documentation is somewhat sparse. It looks like command line access is there more for diagnostic purposes. Maybe it's time to give the more bare-bones OpenWRT a go? (I recently ...


3

Tomato is pretty much "fire and forget". The bandwidth graphs are nice, and it's really quite easy to configure. It lets you ssh in, if you want to fiddle with low level settings, but ever since I set it up, I don't think I've ever went back into the UI. It just works, and works well.


3

We use OpenWRT at work, both in the office and DC. It'll handle as many machines as your wireless bandwidth will support, as far as I can tell. I don't know how long we've been using it, it was here when I got here.


2

I think the biggest one for me is the Quality of Service support. Sure, you can do it on the Linksys firmware, but it's extremely limited. With Tomato, you can set your BitTorrent traffic to Lowest priority, your HTTP browsing to High and your Skype to Highest. That means that your HTTP and VOIP traffic will always be serviced before BT, which is nice if ...


2

I think most people run one of the alternate WRT firmwares (like Tomato, OpenWRT, DD-WRT, Packet Protector, etc) just for the geeky fun of it. However, there are some extra features that these firmwares have that are not available in the stock firmware. For example, others here have mentioned the ability to increase your radio output power beyond what's ...


2

Designating one of your "Lan" ports to be connected to the neighborhood wifi network shouldn't be too difficult if you use a firmware that gives you access to the underlying IP stack, such as DD-WRT. However... I'd then like to set up routing so than some traffic is routed to ADSL, and the rest to the Mikrotik. This is the tricky part—What you want to ...


2

You would need to re-flash the firmware with something like DD-WRT which can get you full access to the underlying Linux OS. From there you can configure the iptables, etc. to do whatever you wish on the different interfaces. You will need a firm understanding of Linux routing, this is not for the casual end-user. The main page for the DD-WRT project is ...


2

Herea a shot in the dark, but if you look on ebay you can get some truly awesome deals on EoL'd Cisco's, I'm talking 2600/3600, with that you can do exactly what your proposing, There is a need for a little CLI config, but after that you will be truly impressed with what it can do for you, i.e shaping torrents to a minimum throughput during 5pm and 2am, but ...


2

It supports wireless bridging (WDS) if you want to set up more than one router to cover a large space. But the biggest thing is that it's very stable. I don't ever have to reboot the router because of a freeze or a problem.


2

Both hosts would appear to be in the same subnet in your example (as I'm assuming a /24 subnet). Without using a layer 2 filtering mechanism (like ebtables) you're not going to be able to filter that traffic. Hosts in the same subnet communicate to each other at layer 2 w/o needing a router to facilitate the communication. Because the router isn't involved ...


2

So in your previous setup I suspect your fully qualified domain name was something more then just the bare hostname. Perhaps router.local., or router.lan. or something else like that. With a fully qualified name defined, you could then the DNS search path setting for your network via your DHCP server. So your routers hostname would be router.local., and ...


2

The OpenVPN feature you're looking for, which will allow the server to authenticate clients based on both their certificate and a credential, is auth-user-pass-verify. This feature allows the server to pass the username/password provided by the remote user to a script that performs the authentication. At that point you can validate the credentials against ...


2

In the firewall's INPUT chain, logdrop line kills your connection. It is a catch-all chain for dropping all unwanted traffic. The rule processing never reaches the web rules. You must move the ACCEPT rules above the logdrop rule.


1

Well it sounds like your router is still acting to route between the various networks it knows about. Have you checked the routing tables on the device? Another option is to try to configure the firewall on the device to block traffic from the vpn network from traveling to other networks. So those are my two suggestions: check the routing table on the ...


1

#For each IP you need this command and this rule: /sbin/ifconfig vlan1:0 208.x.x.130 netmask 255.255.255.224 /usr/sbin/iptables -t nat -I PREROUTING 2 -d 208.x.x.130 -j WANPREROUTING #For each open port you need rules like these two: /usr/sbin/iptables -t nat -A WANPREROUTING -p tcp -d 208.x.x.130 --dport 80 -j DNAT --to-destination 192.168.1.130:80 ...


1

There are some mistakes in your iptables command: 1) you are trying to catch that in the OUTPUT table, but for a redirection like this you need to do it in PREROUTING 2) you are not redirecting to the port too. you are just telling iptables to send those packets to a certain IP without specifing the port. So your command should look like this: iptables ...


1

Have a look at rinetd it seems to do what you want. There is some more information on installation and usage here.


1

Cisco has just announced wifi routers that can do exactly that: http://homestore.cisco.com/en-us/products/linksys_stcVVcatId551966VVviewcat.htm


1

Thanks for your reply. Finally figured out that this behavior is as spec'd by the firmware. As part of a boot-up failsafe mode, the firmware always assumes 192.168.1.1 for about 5 seconds before assuming the programmed IP address. During this brief window, you can tftp a new firmware in case you accidentally bricked the router. It would take a very low ...


1

If you have a static IP with your Comcast business service you can assign that routable address to your Tomato box, hook it up to the SMC, and voila, no more NAT and public IP on your device. This is the best way to "bridge" with these devices. If you don't have a static, you can put the Tomato router in the DMZ of the SMC and you'll essentially have a ...


1

Firewalls control traffic that flow through them, so your internal LAN traffic should be unaffected as it doesn't or shouldn't flow through the firewall. Your inbound and outbound internet traffic is another matter though. does the Comcast router\modem support "bridging", or "passthrough" for all traffic, meaning can you turn off the firewall and NAT ...


1

If you don't need to apply any firewall rules for the second network, then you don't even need iptables, just a static route like.. ip route add 172.16.0.0/24 via 192.168.0.3 where 192.168.0.3 is the address assigned to the lan interface on the Mikrotik device. according to http://en.wikibooks.org/wiki/Tomato_(firmware)/Menu_Reference#Advanced there is ...



Only top voted, non community-wiki answers of a minimum length are eligible