Linksys AC Series Router Configuration Tips for OpenWRT: Difference between revisions

mNo edit summary
 
(87 intermediate revisions by the same user not shown)
Line 1: Line 1:
This subject(s) of this article are the AC Series of routers manufactured by Linksys and the OpenWRT Firmware designed for themThe Linksys AC Routers include the WRT1200AC, WRT1900AC v1, WRT1900AC v2, WRT1900ACS v2, WR1900ACS v2, WRT3200ACM, and WRT32XThe WRT1900AC v2 is essentially a WRT1900ACS v1 and the WRT3200ACM and WRT32X are duplicate hardware models with different firmware (from Linksys) and the former blue / black and the latter black /grayThe models are sometimes referred to with out the suffix letters as WRT1200, WRT1900, WRT3200.   
This article has gotten huge.  Well, not really.  Actually yes.  It's an aggregation article that has a bunch of other articles on the same subject which links to and displays the content of the other pagesThere is a lot of information hereIt is in large part a brain dump of learned knowledge.  This means that there hasn't been a lot of editing or neatening up of what's writtenSorry, there just isn't enough time.  Maybe one day.   


Information covered in this article was written for and tested on both the WRT1900ACS v1, WRT1900ACS v2, and WRT3200ACMHowever the information applies to the other models as well.   
Anyway, what you'll find here is a bunch of information collected on a bunch of different subjectsMany of them relate to very difficult problems that have solutions which will hopefully be valuable and help anyone that can't figure out an issue or how to make something they've pictured in their head but aren't sure how to implement.   


All models are available on eBay and the ACS, ACM, and 32X series are available new as of the writing of this article in 2020.  The most powerful and expensive models are the WRT3200ACM and the WRT32X.  The best bargain used in terms of cost and "horsepower" is the ACS seriesOccasionally it is possible to find a less than observant vendor on eBay selling an ACS model that is advertised as an AC modelThose are the best deals.   
This subject(s) of this article are the AC Series of routers manufactured by Linksys and the OpenWRT Firmware designed for them.  The Linksys AC Routers include the WRT1200AC, WRT1900AC v1, WRT1900AC v2, WRT1900ACS v2, WR1900ACS v2, WRT3200ACM, and WRT32X (A and B versions, one generic, the other marketed to X-Box owners).  The WRT1900AC v2 is essentially a WRT1900ACS v1 and the WRT3200ACM and WRT32X are duplicate hardware models with different firmware (from Linksys)All have a blue / black color scheme except for the WRT32X which is all blackThe models are sometimes referred to without the suffix letters as WRT1200, WRT1900, WRT3200.   


Details on each model are very nicely summarized on the OpenWRT website here: https://openwrt.org/toh/linksys/wrt_ac_series?s[]=wrt1200ac
Information covered in this article was written for and tested on various models, including the WRT1900ACS v1, WRT1900ACS v2, WRT3200ACM, and WRT32X.  The information applies to all of the models with some variations on the technical details. 
 
All models are available used on eBay.  The ACS, ACM, and 32X series are still available new as of the writing of this article in 2020.  The most powerful and expensive models are the WRT3200ACM and the WRT32X.  The best bargain used in terms of cost and "horsepower" is the ACS series.  Occasionally it is possible to find a less than observant vendor on eBay selling an ACS model that is advertised as an AC model.  Those are the best deals. 
 
Details on each model are very nicely summarized on the OpenWRT website.  Here's a link for the 1200 series: https://openwrt.org/toh/linksys/wrt_ac_series?s[]=wrt1200ac


As it started out, this article was intended to be a quick how to on a couple of items, but then grew to enormous proportions.  There was some consideration on breaking it into smaller sections, but the Mediawiki interface with its table of contents mitigates that need to an acceptable level.
As it started out, this article was intended to be a quick how to on a couple of items, but then grew to enormous proportions.  There was some consideration on breaking it into smaller sections, but the Mediawiki interface with its table of contents mitigates that need to an acceptable level.


The information in this article comes from many sources and also from hard earned experience.  It was collected in orderd to have a definitive repository of knowledge on the subject.
The information in this article comes from many sources and also from hard earned experience.  It was collected in order to have a definitive repository of knowledge on the subject.


==Quick C (as in Quick Configuration)==
==Quick S (as in Quick Start)==
Because this article contains a lot of information in addition to "How to..." tutorials, this sections summarizes and provides links to the major "How to..." sections below.
Because this article contains a lot of information in addition to "How to..." tutorials, this sections summarizes and provides links to the major "How to..." sections below.


*Upgrade Firmware from Linksys to OpenWRT
*Upgrade Firmware from Linksys to OpenWRT.  The instructions on the OpenWRT website for upgrading from the stock Linksys firmware to OpenWRT are a bit behind the changes that Linksys is making with their GUI.  What that means is one might have to hunt around a bit to find where Linksys has tucked away the firmware upgrade functionality.
*Install a several basic software packages that add very useful utilities and access to USB and eSATA storage device (Flash Drive, HDD enclosures, and even mSATA and M.2 NGFF & NVMe SSDs in USB 3.0 enclosures).  This includes backup software too.
*Install several basic software packages that add very useful utilities.  This includes software related to USB and eSATA storage device (Flash Drive, HDD enclosures, and even mSATA and M.2 NGFF & NVMe SSDs in USB 3.0 enclosures) and backup software.  A suggested strategy is to install a bunch of basic utilities that can be used to recover from any issues related to an external USB Flash drive.
**And now a quick side note that you'll read about in more detail later in this article.  OpenWRT makes it possible to install a big chunk of the "operating system" (OS) for a router on a USB 3.0 Flash Drive.  The partition volume it is mounted as is referred to as an "overlay" (again, more on this later).  In a simple definition for this instance, which glosses over a lot of details, an ''overlay'' partition in OpenWRT can be equated to a ''[[wikipedia:Non-RAID_drive_architectures#Concatenation_(SPAN,_BIG)|spanned]]'' disk drive / volume.  Essentially the internal Flash Drive and an additional USB 3.0 Flash Drive are combined / "[[wikipedia:Concatenation_(disambiguation)|concated]]" (sort of).  In this simplistic comparison, the BIOS portion of a computer is equated to the internal Flash Drive and the disk drive is equated to the external USB Flash Drive.  An ''overlay'' allows for a much larger "disk drive" to be used instead of relying on and being limited to the internal USB Flash Drive (although the same ''overlay'' technology is used to mount the internal Flash Drive if no external drive is available).  Think of it like this, the basic Windows (or Linux) OS is installed on the Internal Flash Drive.  It includes all of the basics to get things up and running.  Then additional stuff is installed on the external USB 3.0 Flash Drive.  The internal Flash Drive can still function, even if the external USB 3.0 Flash Drive is removed, albiet with reduced functionality (probably).  It becomes advantageous in recovery / disaster scenarios to install as many utilities as possible on the internal Flash Drive that are focused on recovering a malfunctioning external USB 3.0 Flash Drive.  Below are the recommended utilities to install.  Note, they will also have to be installed on the ''overlay'' partition / volume once that is configured (again, it's covered later in this article).
**Run the below commands to install the following items (but first, run opkg update). They're broken down into groups;
***General Utilities: opkg install wget htop nano coreutils-dd netcat restic shadow-passwd shadow-useradd shadow-groupadd shadow-chsh lsof bash
***Disk Related: opkg install block-mount e2fsprogs kmod-fs-ext4 kmod-usb-storage kmod-usb2 kmod-usb3 ntfs-3g usbutils gdisk cfdisk tune2fs kmod-fs-exfat dosfstools kmod-fs-vfat f2fs-tools kmod-fs-f2fs lsblk ntfs-3g-utils fdisk sfdisk wipefs hdparm
***GUI Interface / Tools for "built-in" services: opkg install luci-app-advanced-reboot luci-app-uhttpd
***Ease of Use Software: opkg install samba4-server samba4-utils luci-app-samba4 (of all the utilities to install, this is by far the largest in terms of storage space consumed)
***Optional (if there's space or a need): opkg install mwan3 luci-app-mwan3 kmod-macvlan
***Other Items to consider: "Packages that begins with ''coreutils''", "Packages that begins with ''coreutils''", "Other LuCI GUI Packages"
*Partition and Configure OpenWRT to use external storage drives, not just for storage, but also as a replacement / addition to the internal non-volitile storage
*Partition and Configure OpenWRT to use external storage drives, not just for storage, but also as a replacement / addition to the internal non-volitile storage


Line 266: Line 278:


===Recommended Hardware Devices===
===Recommended Hardware Devices===
The best recommendation for a USB Flash Drive is the SanDisk Ultra Fit USB 3.1 Flash Drive Series.  And the recommendation is NOT because it is the fastest.  They brag speeds up to 130 MB/S.  Maybe downhill in a tornado, but under normal systems, that speed is a joke for this piece of hardware.  So why recommend it?  Well as it turns out, the fastest drive, USB, eSATA, or otherwise that has been tested on the AC Series is about 70 MB/S (this has been confirmed for eSATA) and around 45 MB/S for USB 3.0 (using a Patriot SuperSonic Rage Elite USB 3.1 Flash Drive that has been verified multiple times at over 200 MB/S sustained).  Based on that and the below reviews it seems the Ethernet Switch may be topping out at about 70 MB/S, which is quite respectable.
The best recommendation for a USB Flash Drive is the SanDisk Ultra Fit USB 3.1 Flash Drive Series.  And the recommendation is NOT because it is the fastest.  They brag speeds up to 130 MB/S.  Maybe downhill in a tornado, but under normal systems, that speed is a joke for this piece of hardware.  So why recommend it?  Well as it turns out, the fastest drive, USB, eSATA, or otherwise that has been tested on the AC Series is about 70 MB/S (this has been confirmed for eSATA) and around 45 MB/S for USB 3.0 (using a Patriot SuperSonic Rage Elite USB 3.1 Flash Drive that has been verified multiple times at over 200 MB/S sustained).  Based on that and the below reviews it seems the Ethernet Switch may be topping out at about 70 MB/S, which is quite respectable.[[File:Sabrent USB 3.0 Hub.jpg|alt=Sabrent USB 3.0 Hub (HB-R3MB)|thumb|158x158px|Sabrent USB 3.0 Hub|left]]Some reviews have the USB 3.0 speeds and eSATA speeds about the same at around 70 MB/S: https://www.eteknix.com/linksys-wrt3200acm-router-review/10/
 
Some reviews have the USB 3.0 speeds and eSATA speeds about the same at around 70 MB/S: https://www.eteknix.com/linksys-wrt3200acm-router-review/10/


Others have the USB 3.0 speeds measured considerably slower at about 20 MB/S: https://www.kitguru.net/peripherals/james-morris/linksys-wrt3200acm-ac3200-wireless-router-review/4/
Others have the USB 3.0 speeds measured considerably slower at about 20 MB/S: https://www.kitguru.net/peripherals/james-morris/linksys-wrt3200acm-ac3200-wireless-router-review/4/
Line 274: Line 284:
Anyway, the above mentioned SanDisk device tops out at about 70 MB/S on every system that the above mentioned Patriot device tops out at over 200 MB/S.  Notice that 70 MB/S speed mentioned twice?  Once for the SanDisk device and once for the AC Series.  The next item to consider is price.  The SanDisk is not the cheapest, but it is fairly low.  When price and performance are both considered, it turns out the SanDisk device beats everyone.  And since the AC series router and SanDisk USB Flash Drive both top out at around 70 MB/S, that makes it the perfect match.
Anyway, the above mentioned SanDisk device tops out at about 70 MB/S on every system that the above mentioned Patriot device tops out at over 200 MB/S.  Notice that 70 MB/S speed mentioned twice?  Once for the SanDisk device and once for the AC Series.  The next item to consider is price.  The SanDisk is not the cheapest, but it is fairly low.  When price and performance are both considered, it turns out the SanDisk device beats everyone.  And since the AC series router and SanDisk USB Flash Drive both top out at around 70 MB/S, that makes it the perfect match.


If one is considering using the USB Flash Drive for other purposes, go with the Patriot USB Flash Drive.  If using the USB flash drive as a dedicated device for an AC series routers then go with the SanDisk USB flash drive.  Plus it's also much smaller and has a lower profile than the patriot device.  Both drives claim speeds about double what they can deliver.  The final joke is that the Patriot device is USB 3.0 and the SanDisk is a USB 3.1 device.
If one is considering using the USB Flash Drive for other purposes, go with the Patriot USB Flash Drive.  If using the USB flash drive as a dedicated device for an AC series routers then go with the SanDisk USB flash drive.  Plus it's also much smaller and has a lower profile than the patriot device.  Both drives claim speeds about double what they can deliver.  The final joke is that the Patriot device is USB 3.0 and the SanDisk is a USB 3.1 device.[[File:USB 3.0 Extension.jpg|alt=USB 3.0 Extension|thumb|120x120px|USB 3.0 Extension|left]]Another nice item, which isn't necessary, but makes nice neat way to connect several USB flash drives to a router is a Sabrent USB 3.0 Hub (model HB-RBM3).  From [https://www.walmart.com/ip/Sabrent-Premium-3-Port-Aluminum-Mini-USB-3-0-90-180-Degree-Rotatable-HB-R3MB/114811464 Wal-Mart], only about $12.  There are other similar device, but this one is much higher quality.  Sadly, even with its ability to rotate, it won't plug into the router without blocking several of the Ethernet ports (including the WAN port) or the power connector.  Thanks to the overhang on the rear of the AC Series router, it can't be rotated up.  This is not the fault of the Sabrent USB 3.0 Hub, but the design of the Linksys Router that causes the issue.  It is also worth pointing out that in tests, there was ''no'' drop in transfer speeds between a single USB Flash Drive plugged directly into the router's USB 3.0 port and the same drive plugged into the router via the Sabrent USB 3.0 hub.
[[File:USB to mSATA.jpg|alt=USB to mSATA|left|thumb|120x120px|USB to mSATA Enclosure]]
 


Another nice item, which isn't necessary, but makes nice neat way to connect several USB flash drives to a router is a Sabrent USB 3.0 Hub (model HB-RBM3).  From [https://www.walmart.com/ip/Sabrent-Premium-3-Port-Aluminum-Mini-USB-3-0-90-180-Degree-Rotatable-HB-R3MB/114811464 Wal-Mart], only about $12.  There are other similar device, but this one is much higher quality.  Sadly, even with its ability to rotate, it won't plug into the router without blocking several of the Ethernet ports (including the WAN port) or the power connector.  Thanks to the overhang on the rear of the AC Series router, it can't be rotated up.
[[File:Sabrent USB 3.0 Hub.jpg|alt=Sabrent USB 3.0 Hub|none|thumb|158x158px|Sabrent USB 3.0 Hub]]
[[File:USB 3.0 Extension.jpg|alt=USB 3.0 Extension|none|thumb|120x120px|USB 3.0 Extension]]
But there is a solution...  A USB 3.0 A Male to A Female Adapter (Part # 1206-N, UPC 848076012233) from a company named CMPLE.  It is available from several places: [https://www.walmart.com/ip/Cmple-USB-3-0-A-Male-to-A-Female-Adapter/172246645 Wal-Mart], [https://www.ebay.com/itm/NEW-USB-3-0-A-MALE-TO-A-FEMALE-M-F-ADAPTER-CONNECTOR-NEW-/362695174727 eBAy], and from the company that appears to have it manufactured (in China), [https://www.cmple.com/ProductsBySKU/1206-N CMPLE].  Even at about $3.00 it is a bit more expensive than other similar products (and there are only a few).  But it has one advantage in that the orientation of the male and female part of the connector are arranged such that the above noted 3 Port USB 3.0 hub from Sabrent can connect and be in the "up" position.  All other similar items found require that the hub be rotated to the left, right, or down.  Down isn't a choice unless one's router is on the edge of a table.  Left and right are good as the adapter provides enough clearance for the hub so it doesn't contact the power cord or the Ethernet cable on the WAN port.
But there is a solution...  A USB 3.0 A Male to A Female Adapter (Part # 1206-N, UPC 848076012233) from a company named CMPLE.  It is available from several places: [https://www.walmart.com/ip/Cmple-USB-3-0-A-Male-to-A-Female-Adapter/172246645 Wal-Mart], [https://www.ebay.com/itm/NEW-USB-3-0-A-MALE-TO-A-FEMALE-M-F-ADAPTER-CONNECTOR-NEW-/362695174727 eBAy], and from the company that appears to have it manufactured (in China), [https://www.cmple.com/ProductsBySKU/1206-N CMPLE].  Even at about $3.00 it is a bit more expensive than other similar products (and there are only a few).  But it has one advantage in that the orientation of the male and female part of the connector are arranged such that the above noted 3 Port USB 3.0 hub from Sabrent can connect and be in the "up" position.  All other similar items found require that the hub be rotated to the left, right, or down.  Down isn't a choice unless one's router is on the edge of a table.  Left and right are good as the adapter provides enough clearance for the hub so it doesn't contact the power cord or the Ethernet cable on the WAN port.
[[File:90 Degree Cable.jpg|alt=90 Degee Cable|left|thumb|121x121px|90 Degee Cable]]
And did locate a cable that has chance (didn't test it by buying it) of fitting behind the above 90° USB 3.0 Hub noted above.  The cable would also then have to bend at quite an angle to clear what ever the router was mounted on or sitting on.  But it seems possible.  It's from this company: http://www.wire-cable-solution.com/showing_2395_2071/ESATA-7Pin-small-90-to-SATA-First-generation.html
Watch out for other idiot sellers that list an "eSATA" cable that isn't.  Look closely and you'll see that it's an internal SATA connector.  The best tip when searching is to switch to Google or Bing images to find the proper cable.
Google also gives some false hope when searching for a cable like this when it shows just the item, but the link is dead or is redirected to generica SATA cables.
<br />
====Bottom Line====
Use an mSATA SSD in a USB 3.0 enclosure.
A quick test using the DD utility to copy a "Zero Byte" file to various devices (Flash Drive, mSATA SSD, etc.) resulted in the following speeds;
*Average USB 3.0 Flash Drive: 26 MB/S
*Good USB 3.0 Flash Drive: 45 MB/S
*mSATA SSD: 300 MB/S (in this enclosure: https://www.newegg.com/riitop-mstu3c-zhi-enclosure/p/0VN-006F-00017?Item=9SIA6V86C51798)
...not even close.  An mSATA SSD in the above enclosure blew everything else out of the water.  And it was just an average mSATA SSD (https://www.newegg.com/vaseky-v800-128gb/p/0D9-00D6-00008?Item=9SIAGKC7VJ8289).  Together, maybe a bit more expensive than a similar sized good Flash Drive, but as DeadPool said, "...worth it!"
===Overlay===
===Overlay===
Before getting into the "how" with an external storage device, it is worth pointing out one of the more useful features available in OpenWRT.
Before getting into the "how" with an external storage device, it is worth pointing out one of the more useful features available in OpenWRT.
Line 305: Line 335:


*opkg update
*opkg update
*opkg install block-mount e2fsprogs kmod-fs-ext4 kmod-usb-storage kmod-usb2 kmod-usb3 ntfs-3g usbutils gdisk cfdisk tune2fs kmod-fs-exfat dosfstools kmod-fs-vfat f2fs-tools kmod-fs-f2fs lsblk ntfs-3g-utils fdisk sfdisk wipefs blkidmkfs
*opkg install block-mount e2fsprogs kmod-fs-ext4 kmod-usb-storage kmod-usb2 kmod-usb3 ntfs-3g usbutils gdisk cfdisk tune2fs kmod-fs-exfat dosfstools kmod-fs-vfat f2fs-tools kmod-fs-f2fs lsblk ntfs-3g-utils fdisk sfdisk wipefs blkid mkf2fs hdparm (block-mount is the package that enables the "Mount Points" menu to appear in the LuCI GUI interface, and a reboot is necessary after installation)


Please note, all of the above packages are not necessary.  But they do represent a broad range of tools that are very useful.  And since they don't take up a lot of space, it's worth installing them.  They don't run as active services or anything either, so no extra RAM or CPU usage unless one types the command.  Reboot after installing all of the above software.
Please note, all of the above packages are not necessary.  But they do represent a broad range of tools that are very useful.  And since they don't take up a lot of space, it's worth installing them.  They don't run as active services or anything either, so no extra RAM or CPU usage unless one types the command.  Reboot after installing all of the above software.
Line 368: Line 398:
Change a Volume Label;
Change a Volume Label;


*tune2fs -L WhatEverName /dev/sdaX
*For EXT4: tune2fs -L WhatEverName /dev/sdaX
*For NTFS: ntfslabel /dev/sdXy WhatEverLabelName
*For a Swap File (opkg install swap-utils): swaplabel /dev/sdXy WhatEverLabelName


====Performance Tuning for ExtX====
====Performance Tuning for ExtX====
Line 374: Line 406:


*tune2fs -o journal_data_writeback /dev/sdaX
*tune2fs -o journal_data_writeback /dev/sdaX
*tune2fs -O ^has_journal /dev/sdaX
*tune2fs -O has_journal /dev/sdaX


====Performance Tuning for NTFS====
====Performance Tuning for NTFS====
Line 383: Line 415:
*If compression is also desired, add this in the above noted location: big_writes,compression
*If compression is also desired, add this in the above noted location: big_writes,compression


===Clone a Partition===
===Resizing a Parition (and then resize the file system (ext4, etc.))===
Use CFDISK to resize the partition.  It's easy, just run CFDISK, use arrow keys to select resize, change the size of the partition (16G will result in a 16 Gigabyte Parition)
 
Then resize the files system to take advantage of the extra space: resize2fs /dev/sdXY (opkg install resize2fs if it isn't installed), example resize2fs /dev/sda1 (will resize file system to the full size of the partition), example resize2fs /dev/sda1 32G (will resize file system to 32 Gigabytes, note, partition must be at least 32 Gigabytes for this to work without an error).
 
===Clone a Partition (see DD section below Restic Section way down)===
It is recommended to make sure the destination partition is the same size or larger of course.  Be prepared to wait a while, even on a USB 3.0 port.  
It is recommended to make sure the destination partition is the same size or larger of course.  Be prepared to wait a while, even on a USB 3.0 port.  


Line 457: Line 494:
Various commands to "see" the available internal Flash Memory partitions;
Various commands to "see" the available internal Flash Memory partitions;


*ls -la /dev/ub* : A directory listing of UBI devices
*ls -la /dev/ub*<span> </span>: A directory listing of UBI devices
*cat /proc/mtd : A list of the various MTD ([https://openwrt.org/docs/techref/mtd Memory Technology Device]) Partitions
*cat /proc/mtd<span> </span>: A list of the various MTD ([https://openwrt.org/docs/techref/mtd Memory Technology Device]) Partitions
*UBI (Unsorted Block Images) Commands;
*UBI (Unsorted Block Images) Commands;
**ubinfo - provides information about UBI devices and volumes found in the system
**ubinfo - provides information about UBI devices and volumes found in the system
Line 548: Line 585:


====Mounting Internal Partitions====
====Mounting Internal Partitions====
'''WARNING:''' As of late 2021, with a WRT32X Model Router, it has been demonstrated that simply using the ''ubiattach'' command will render a partition unbootable and cause a "Bad Linux ARM zImage magic!" error message (Note: That error message is not a joke, it is a direct copy and paste, the magic is bad.).  As a result of that finding, it is recommended to NOT use the ''ubiattach'' command.  And there are exactly 6 results from Google that note this issue, with only one having any relavence (but with no solution other than reflashing an image, it only mentions the issue): https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=326162&sid=8eb66fb3cac5eebe932ce578eb34cacb
To view information about available UBI devices and partitions;
To view information about available UBI devices and partitions;


*ls -la /dev/ub* : A directory listing of UBI devices
*ls -la /dev/ub*<span> </span>: A directory listing of UBI devices
*cat /proc/mtd : A list of the various MTD ([https://openwrt.org/docs/techref/mtd Memory Technology Device]) Partitions
*cat /proc/mtd<span> </span>: A list of the various MTD ([https://openwrt.org/docs/techref/mtd Memory Technology Device]) Partitions


See http://www.linux-mtd.infradead.org/doc/ubi.html for additional information about UBI
See http://www.linux-mtd.infradead.org/doc/ubi.html for additional information about UBI
Line 1,083: Line 1,122:


=====Additional Notes=====
=====Additional Notes=====
Whenever the DNSMASQ service is started it overwrites the /tmp/resolve.conf file with it's own version of that same file.  It will also delete any symbolic link at /tmp/resolv.conf which typically points to /tmp/resolv.conf.auto.  When the DNSMASQ service is stopped it "politely" recreates that symbolic link.  An explanation is given here: https://forum.openwrt.org/t/solved-dnsmasq-resolv-conf-inconsitent/13972/2  Basically the site is saying that if the DNSMASQ service is started and you have your own "DNS Service", why do you need to use external DNS Servers (which makes sense).   
Whenever the DNSMASQ service is started it overwrites the /tmp/resolv.conf file with it's own version of that same file.  It will also delete any symbolic link at /tmp/resolv.conf which typically points to /tmp/resolv.conf.auto.  When the DNSMASQ service is stopped it "politely" recreates that symbolic link.  An explanation is given here: https://forum.openwrt.org/t/solved-dnsmasq-resolv-conf-inconsitent/13972/2  Basically the site is saying that if the DNSMASQ service is started and you have your own "DNS Service", why do you need to use external DNS Servers (which makes sense).   


A side effect of the above behavior is it overwrites MWAN3 settings that are stored in /tmp/resolv.conf.auto.  If one has custom external DNS servers enabled for multiple WAN ports they will no longer be used.  This is not a flaw with OpenWRT, just a behavior to be aware of.  If one needs to configure specific upstream DNS servers, any custom DNS servers configured with MWAN can be configured within DNSMASQ.  Again, this is just something to be aware of.
A side effect of the above behavior is it overwrites MWAN3 settings that are stored in /tmp/resolv.conf.auto.  If one has custom external DNS servers enabled for multiple WAN ports they will no longer be used.  This is not a flaw with OpenWRT, just a behavior to be aware of.  If one needs to configure specific upstream DNS servers, any custom DNS servers configured with MWAN can be configured within DNSMASQ.  Again, this is just something to be aware of.


The following is not an issue IF a custom /etc/dhcpd.conf file exists (IE, if the default OpenWRT method for configuring DHCPD is used via the /etc/config/dhcp file):  There is a problem if one wishes to use DHCPD and NAMED / BIND instead of DNSMASQ as the DHCPD service is not as "polite" as the DNSMASQ service (NAMED / BIND does not cause any conflict).  When the DHCPD service starts, as with DNSMASQ, the /tmp/resolv.conf file is replaced.  The settings DHCPD configures in the file are the same as DNSMASQ.  However, when the DHCPD service is stopped, as noted above, it is as "polite" as DNSMASQ because the symbolic link that directs /tmp/resolv.conf to /tmp/resolv.conf.auto is not recreated.  This leaves the /tmp/resolv.conf file configured with the setting ''nameserver 127.0.0.1''.  This can be an issue with BIND / NAMED if it is not configured to "answer" (listen and do recursive lookups) on 127.0.01 IP Address.  So make sure the BIND / NAMED configuration file includes 127.0.0.1 IP Address in both the allow-recursion and listen-on-port sections.
The following is not an issue IF a custom /etc/dhcpd.conf file exists (IE, if the default OpenWRT method for configuring DHCPD is used via the /etc/config/dhcp file):  There is a problem if one wishes to use DHCPD and NAMED / BIND instead of DNSMASQ as the DHCPD service is not as "polite" as the DNSMASQ service (NAMED / BIND does not cause any conflict).  When the DHCPD service starts, as with DNSMASQ, the /tmp/resolv.conf file is replaced.  The settings DHCPD configures in the file are the same as DNSMASQ.  However, when the DHCPD service is stopped, as noted above, it is not as "polite" as DNSMASQ because the symbolic link that directs /tmp/resolv.conf to /tmp/resolv.conf.auto is not recreated.  This leaves the /tmp/resolv.conf file configured with the setting ''nameserver 127.0.0.1''.  This can be an issue with BIND / NAMED if it is not configured to "answer" (listen and do recursive lookups) on 127.0.01 IP Address.  So make sure the BIND / NAMED configuration file includes 127.0.0.1 IP Address in both the allow-recursion and listen-on-port sections.


Oddly, when doing a Google, Bing, etc search for these three terms: "resolvfile" "openwrt" "isc_dhcpd" NOTHING exists on the internet.  Until now that is.
Oddly, when doing a Google, Bing, etc search for these three terms: "resolvfile" "openwrt" "isc_dhcpd" NOTHING exists on the internet.  Until now that is.
Line 1,289: Line 1,328:
====Additional Information====
====Additional Information====
Make sure the BIND / NAMED configuration file includes 127.0.0.1 IP Address in both the allow-recursion and listen-on-port sections.  This can cause issues with DHCPD if it is not configured correctly.  See the MWAN3 and DHCPD sections for additional information.
Make sure the BIND / NAMED configuration file includes 127.0.0.1 IP Address in both the allow-recursion and listen-on-port sections.  This can cause issues with DHCPD if it is not configured correctly.  See the MWAN3 and DHCPD sections for additional information.
When operating a dual WAN router with multiple IP Addresses assigned to multiple interfaces using MWAN and a switch configured to operate three separate LAN subnets, there can be issues when restarting the router or network services.  The solution is to also restart BIND / NAMED.  This can be done automatically using the "hotplug.d" functionality available in OpenWRT (see https://openwrt.org/docs/guide-user/base-system/hotplug for additional information).  Below is a short script to add in /etc/hotplug.d/iface/80-named;<syntaxhighlight lang="text">
#!/bin/sh
[ "$ACTION" = ifup ] || exit 0
/etc/init.d/named enabled && /etc/init.d/named stop && /etc/init.d/named start
</syntaxhighlight>Adding the following to the /etc/rc.local file may be necessary too, when restarting the router: /etc/init.d/named enabled && /etc/init.d/named stop && /etc/init.d/named start


===DHCPD (AKA isc-dhcp-server-ipv4, etc.)===
===DHCPD (AKA isc-dhcp-server-ipv4, etc.)===
Line 1,328: Line 1,375:
The Default Configuration File can be over-ridden by placing the DHCPD configuration file here: /etc/dhcpd.conf
The Default Configuration File can be over-ridden by placing the DHCPD configuration file here: /etc/dhcpd.conf


Default Leases File: /tmp/dhcpd.leases
Default Leases File: /tmp/dhcpd.leases (an odd recommendation to make, but even though it is in the /tmp directory, delete this file before using DHCPD, it will be recreated automatically)


DHCPD Executable / Binary File: /usr/sbin/dhcpd
DHCPD Executable / Binary File: /usr/sbin/dhcpd
Line 1,346: Line 1,393:


But also keep in mind the settings changes in the /etc/init.d/dhcpd startup script only affect the DHCPD service.  The /etc/resolv.conf File still derives its settings from the /etc/config/dhcp File when the DHCPD service is restarted or the router is rebooted (same for DNSMASQ).  IE, the /etc/config/dhcp File should not be completely dismissed as useless.
But also keep in mind the settings changes in the /etc/init.d/dhcpd startup script only affect the DHCPD service.  The /etc/resolv.conf File still derives its settings from the /etc/config/dhcp File when the DHCPD service is restarted or the router is rebooted (same for DNSMASQ).  IE, the /etc/config/dhcp File should not be completely dismissed as useless.
====Restricting the DHCPD Service to only Answer / Listen on Desired Interfaces====
To restrict the DHCPD service to a specific interface, edit the /etc/init.d/dhcpd file, scroll way down to the start_service section, and look for the following line;
*procd_set_param command $PROG -q -f -cf $config_file -lf $lease_file $dhcp_ifs
Change it in similar manner to the below examples;
*   procd_set_param command $PROG WhatEverAdapterName WhatEverOtherAdapterName -q -f -cf $config_file -lf $lease_file $dhcp_ifs
*   procd_set_param command $PROG eth0.1 br-LAN1_1 -q -f -cf $config_file -lf $lease_file $dhcp_ifs
Many sites suggest that creating a blank / empty zone for the subnet (on a multi-homed device) will make it so DHCPD doesn't answer for those interfaces.  But testing has prooven otherwise.  The below settings in /etc/dhcpd/dhcpd.conf will '''''00000000000000000000000000''''' prevent the DHCPD service from answering on the interface associated with the W.X.Y.Z IP Address;<syntaxhighlight lang="text">
subnet W.X.Y.Z netmask 255.255.255.0 {
}
</syntaxhighlight>The Edit Network Interfaces Button and Interfaces File Type setting in Webmin will not work with OpenWRT.


====Special Note====
====Special Note====
Line 1,360: Line 1,422:
*If a custom /etc/dhcpd.conf file is NOT being used and the standard OpenWRT method of using /etc/config/dhcp method is used (again, HINT: Use a custom /etc/dhcpd.conf file), the DHCPD startup script erases the symbolic link that connects /tmp/resolv.conf --> /tmp/resolv.conf.auto in favor of its own custom /tmp/resolv.conf file (/etc/resolv.conf).  This can break DNS settings for networking in general and MWAN3.
*If a custom /etc/dhcpd.conf file is NOT being used and the standard OpenWRT method of using /etc/config/dhcp method is used (again, HINT: Use a custom /etc/dhcpd.conf file), the DHCPD startup script erases the symbolic link that connects /tmp/resolv.conf --> /tmp/resolv.conf.auto in favor of its own custom /tmp/resolv.conf file (/etc/resolv.conf).  This can break DNS settings for networking in general and MWAN3.


Solution?  Add the following lines to the /etc/init.d/dhcpd startup script;<syntaxhighlight lang="text">
Solution?  Add the following lines to the /etc/init.d/dhcpd startup script to solve the above mentioned issue, plus some optional stuff;<syntaxhighlight lang="text">
# In the start_service() section after this line: config_file="/etc/dhcpd.conf"
# Add these two lines (completely option, not necessary);
 
echo -n $"Starting ISC-DHCPD with /etc/dhcpd.conf file"
echo
 
 
 
stop_service()
stop_service()
{
{
Line 1,366: Line 1,436:
rm /var/run/dhcpd.pid
rm /var/run/dhcpd.pid
}
}
</syntaxhighlight>And as of OpenWRT 22.0.Whatever, there's another issue.  The path for RESOLV.CONF has changed from /tmp/resolv.conf to /tmp/resolv.conf.d/resolv.conf.auto.  That change has been reflected in DNSMASQ, but it has NOT been reflected in DHCPD.  Solution: Modify the above noted code shown above for /etc/init/d/dhcpd file as follows;<syntaxhighlight lang="text">
ln -sf "/tmp/resolv.conf.d/resolv.conf.auto" /tmp/resolv.conf
</syntaxhighlight>The ''ln'' command corrects the symbolic link issue mentioned above.  And the ''rm'' command corrects the PID file issue that never goes away, again mentioned above.  Also note that if the DHCPD package is ever updated, the script will need to be modified again.  A startup script could be written, but haven't had time to write that yet.  This post gives a fairly goot hint on how to write it: https://askubuntu.com/questions/77149/how-to-find-text-and-replace-that-line-if-exists-with-terminal-otherwise-just-ap  Although regular expressions wouldn't be necessary, just a check to see if "stop_service" exists anywhere in the dhcpd startup script and if it doesn't, insert it at the end.
</syntaxhighlight>The ''ln'' command corrects the symbolic link issue mentioned above.  And the ''rm'' command corrects the PID file issue that never goes away, again mentioned above.  Also note that if the DHCPD package is ever updated, the script will need to be modified again.  A startup script could be written, but haven't had time to write that yet.  This post gives a fairly goot hint on how to write it: https://askubuntu.com/questions/77149/how-to-find-text-and-replace-that-line-if-exists-with-terminal-otherwise-just-ap  Although regular expressions wouldn't be necessary, just a check to see if "stop_service" exists anywhere in the dhcpd startup script and if it doesn't, insert it at the end.


Also keep in mind the LuCI GUI interface, under Network, Interface, Edit Button for X Interface, DHCP Tab will always show "No DHCP Server configured for this interface".  This is because the LuCI GUI is not able to detect DHCPD (only DNSMASQ and ODHCPD)
Also keep in mind the LuCI GUI interface, under Network, Interface, Edit Button for X Interface, DHCP Tab will always show "No DHCP Server configured for this interface".  This is because the LuCI GUI is not able to detect DHCPD (only DNSMASQ and ODHCPD)


===PPTP (Point to Point Tunneling Protocol) for Clients===
As with BIND / NAMED, when operating a dual WAN router with multiple IP Addresses assigned to multiple interfaces using MWAN and a switch configured to operate three separate LAN subnets, there can be issues when restarting the router or network services.  The solution is to also restart DHCPDThis can be done automatically using the "hotplug.d" functionality available in OpenWRT (see https://openwrt.org/docs/guide-user/base-system/hotplug for additional information).  Below is a short script to add in /etc/hotplug.d/iface/70-dhcpd;<syntaxhighlight lang="text">
OpenWRT defines the use of PPTP Clients on the LAN side of a router that wish to connect to a PPTP server via the internet as NAT traversal for PPTPDefault installations of OpenWRT do not have the capability to facilitate PPTP connections by clients (IE, computers on the LAN side of the router).  The following software package must be installed;
#!/bin/sh


*opkg update
[ "$ACTION" = ifup ] || exit 0
*opkg install kmod-nf-nathelper-extra


The instructions on enabling the capability is a bit lacking on the OpenWRT site, so below is an improved explanation. After installing the above package, do the following;
/etc/init.d/dhcpd enabled && /etc/init.d/dhcpd stop && /etc/init.d/dhcpd start
</syntaxhighlight>Adding the following to the /etc/rc.local file may be necessary too, when restarting the router: /etc/init.d/dhcpd enabled && /etc/init.d/dhcpd stop && /etc/init.d/dhcpd start


*Create a file named 20-nf-conntrack-helper.conf in /etc/sysctl.d: nano /etc/sysctl.d/20n-nf-conntrack-helper.conf
===SOCKD (Dante)===
*Add a single line of code in the 20-nf-conntrack-helper.conf file to enable the program: net.netfilter.nf_conntrack_helper = 1
It exists. And that's about it. There is some indication in the past the package was more complete, but as of 2020, the SOCKD package is single binary file (sockd).
*Save the file: CTRL + O, then exit nano: CTRL + X
*Restart the sysctl service: service sysctl restart


PPTP should now work for clients wishing to use PPTP connections.
Installation: opkg install sockd


As has been mentioned and will continue to be mentioned, it is understandable that the OpenWRT documentation may be lacking in some ways.  Creating and writing good documentation is difficult and time consuming.  The nice people responsible for OpenWRT spend most of their time making things work, improving functionality, adding new firmware for new routers, etc..  This leaves little time for good documentation.  So for all the nice people that work so hard on OpenWRT, thank you.  And no offense meant.  The rather cryptic several lines written by the author of the below noted article for more information very likely uses that "shortcut" to create files or may have thought it was helpful to present it in that way.  And it may work for some people.  But it was decided to present it here slightly differently as done above.
File included: /usr/sbin/sockd


More information on enabling the feature can be found here: https://openwrt.org/docs/guide-user/services/vpn/pptp/nat_traversal
Log file (after the below configuration is done): /var/log/sockd.log (/tmp/log/sockd.log)
 
Configuration: Nothing is included in the OpenWRT package.  It all has to be configured manually.  Thankfully, some really nice person (bjonas), created all of the configuration files that should be included in the SOCKD package for OpenWRT.  See this page for the "raw" / basic information: https://dev.archive.openwrt.org/ticket/21341#no1
 
The really amazing thing is that if one Googles "openwrt" and "sockd", there are a grand total of 73 results (with most of those results being useless trash aggregation websites whose creators do not deserve to have air to breathe).  Most Google results and searches of OpenWRT packages for a SOCKS5 proxy return a lot of stuff related to ''client'' SOCKs software (and not really abundantly clear that it is client software as opposed to a SOCKS server service / daemon).  DD-WRT has a functional version of the package, so why not OpenWRT?  The DD-WRT init.d script is very basic and relies on other functionality from DD-WRT to function, so isn't very useful for OpenWRT.
 
The configuration file written by "bjonas" is below, tested, and it functions.  The below script should be put in this file: /etc/init.d/sockd.  This allows the service to be started, stopped, etc. with the OpenWRT service command.  One modification from the original script was made.  The configuration file was moved from /etc/sockd.conf to /etc/sockd/sockd.conf and the appropriate line in the below script was modified from the original version.;<syntaxhighlight lang="text">
#!/bin/sh /etc/rc.common


==LAMP (sort of) - Web Server (Apache, LighttpD, Nginx, and / or uHTTPd) MariaDB (MySQL), and PHP==
START=90
OpenWRT has four different web server platforms available.  Apache, LighttpD, and Nginx are all full featured, whereas uHTTPd is more limited in its functionality.  uHTTPd also serves as the web server for the LuCI GUI interface for OpenWRT.  Apache does not have CGI or FastCGI built into the binary executable, but both Lighttpd and Nginx have CGI and FastCGI capability built in, making addon modules unecessary.


====Apache====
USE_PROCD=1
The Apache package in OpenWRT appears to only have CGI capability as the FastCGI module is not available.  However, there are additional proxy modules included with Apache in OpenWRT that allow for PHP-FPM functionality with FastCGI.
PROG=/usr/sbin/sockd


=====Installation for Apache=====
CONFIGFILE="/var/etc/sockd.conf"
opkg update


opkg install apache apache-utils apache-mod-ssl
xappend() {
        local value="$1"


=====Configuration for Apache=====
        echo "${value#--}" >> $CONFIGFILE
There is no LuCI GUI interface, so use text configuration files and / or Webmin (see below section on Webmin)
}


*Initilization Script: /etc/init.d/apache2
append_parm() {
*Configuration File: /etc/apache2/apache2.conf
        local section="$1"
*Default Server Root: /usr
        local option="$2"
*Default Document Root: /usr/share/apache2/htdocs
        local switch="$3"
*Executables / Binaries: /usr/lib/apache2
        local defval="$4"
*User / Group (/etc/group): apache / apache
        local _loctmp
        config_get _loctmp "$section" "$option"
        if [ -z "$_loctmp" ]; then
                [ -z "$defval" ] && return 0
                xappend "$switch:$defval"
        else
                xappend "$switch:$_loctmp"
        fi
}


Below is working configuration file for Apache with CGI capability;<div class="toccolours mw-collapsible mw-collapsed" style="overflow:auto; width:100%;">
sockd(){
<div style="font-weight:bold;line-height:1.6;">Code Block</div>
        local cfg="$1"
<div class="mw-collapsible-content"><syntaxhighlight lang="text">
        append_parm "$cfg" "clientmethod" "--clientmethod"
ServerRoot "/usr"
        append_parm "$cfg" "method" "--method"
        append_parm "$cfg" "user_privileged" "--user.privileged" "root"
        append_parm "$cfg" "user_notprivileged" "--user.notprivileged" "nobody"
        append_parm "$cfg" "logoutput" "--logoutput" "syslog"
        local _extif _intif _extip _intip
        config_get _extif "$cfg" "external"
        [ -z "$_extif" ] && _extif="wan"
        config_get _intif "$cfg" "internal"
        [ -z "$_intif" ] && _intif="lan"
        network_flush_cache
        network_get_ipaddr _extip $_extif
        xappend "--external:$_extip"
        network_get_ipaddr _intip $_intif
        local _port
        config_get _port "$cfg" "port" "1080"
        xappend "--internal:$_intip port = $_port"
        echo >> $CONFIGFILE
}


service_triggers() {
        procd_add_reload_trigger "sockd"
#      procd_add_network_trigger "wan"|"pppoe-wan"
}


Listen 192.168.2.66:80
boot() {
Listen 192.168.15.66:80
        # Will be launched through hotplug
Listen 192.168.22.66:80
        return 0
Listen 96.77.203.196:80
}
Listen 76.212.87.51:80


start_service() {
        include /lib/functions


        config_load sockd


TimeOut 3600
        procd_open_instance
        procd_set_param command $PROG -f $CONFIGFILE
        procd_set_param file $CONFIGFILE
        procd_set_param netdev wan
        procd_set_param respawn
        procd_close_instance


        echo "# auto-generated config file from /etc/config/sockd" > $CONFIGFILE
        [ -f /etc/sockd/sockd.conf ] && {
                cat /etc/sockd/sockd.conf >> $CONFIGFILE
        }


        config_foreach sockd sockd
}


reload_service() {
        return 0
}


stop_service() {
        return 0
}


</syntaxhighlight>After saving the above information, the SOCKD service should be displayed when the OpenWRT ''service'' command is typed.


#LoadModule mpm_event_module lib/apache2/mod_mpm_event.so
There are two ways to configure the SOCKD / Dante SOCKS5 proxy.  With a configuration file (/etc/sockd/sockd.conf) or a standard OpenWRT configuration file in /etc/config/sockd.  All of this capability is made possible by the startup script created by bjonas (there are indications the version of the script may have been based on past packages from OpenWRT).  If using the sockd.conf method, make sure the /etc/config/sockd file is blank / empty as directives in that file will be included in addition to anything in the sockd.conf file.  Below is the /etc/config/sockd file (again, don't use it if the sockd.conf file is used;<syntaxhighlight lang="text">
LoadModule mpm_prefork_module lib/apache2/mod_mpm_prefork.so
config sockd
#LoadModule mpm_worker_module lib/apache2/mod_mpm_worker.so
        option external                'wan'
LoadModule authn_file_module lib/apache2/mod_authn_file.so
        option internal                'lan'
#LoadModule authn_dbm_module lib/apache2/mod_authn_dbm.so
        option clientmethod            'none'
#LoadModule authn_anon_module lib/apache2/mod_authn_anon.so
        option method                  'none'
LoadModule authn_dbd_module lib/apache2/mod_authn_dbd.so
        option user_privileged          'root'
#LoadModule authn_socache_module lib/apache2/mod_authn_socache.so
        option user_notprivileged      'nobody'
LoadModule authn_core_module lib/apache2/mod_authn_core.so
        option logoutput                'syslog'
LoadModule authz_host_module lib/apache2/mod_authz_host.so
 
LoadModule authz_groupfile_module lib/apache2/mod_authz_groupfile.so
</syntaxhighlight>Below is a functional /etc/sockd/sockd.conf file.  Change the W.X.Y.Z IP Address to match whatever subnets / IP Addresses are used.  Some sections of the below configuration file could be combined and are somewhat redundant.  However, to match the original example it was kept in this format.  The configuration is not restrictive and essentially allows all connectivity from the source subnet to anywhere via the SOCKD server / daemon.<syntaxhighlight lang="text">
LoadModule authz_user_module lib/apache2/mod_authz_user.so
logoutput: stderr /var/log/sockd.log
#LoadModule authz_dbm_module lib/apache2/mod_authz_dbm.so
 
#LoadModule authz_owner_module lib/apache2/mod_authz_owner.so
# LAN IP Address of router
#LoadModule authz_dbd_module lib/apache2/mod_authz_dbd.so
internal: W.X.Y.Z port = 1080
LoadModule authz_core_module lib/apache2/mod_authz_core.so
 
#LoadModule authnz_ldap_module lib/apache2/mod_authnz_ldap.so
# WAN Interface name for router (ifconfig, whichever interface is configured with an external IP Address)
LoadModule access_compat_module lib/apache2/mod_access_compat.so
# Note, this won't work if one's router is behind another router unless ports are forwarded from the "perimeter" router)
LoadModule auth_basic_module lib/apache2/mod_auth_basic.so
external: eth1.2
#LoadModule auth_form_module lib/apache2/mod_auth_form.so
 
#LoadModule auth_digest_module lib/apache2/mod_auth_digest.so
socksmethod: username none #rfc931
#LoadModule allowmethods_module lib/apache2/mod_allowmethods.so
 
#LoadModule file_cache_module lib/apache2/mod_file_cache.so
clientmethod: none
#LoadModule cache_module lib/apache2/mod_cache.so
 
#LoadModule cache_disk_module lib/apache2/mod_cache_disk.so
# Client subnet
#LoadModule cache_socache_module lib/apache2/mod_cache_socache.so
# 0.0.0.0/0 equates to "Anywhere"
#LoadModule socache_shmcb_module lib/apache2/mod_socache_shmcb.so
client pass {
#LoadModule socache_dbm_module lib/apache2/mod_socache_dbm.so
        from: W.X.Y.Z/24 to: 0.0.0.0/0
#LoadModule socache_memcache_module lib/apache2/mod_socache_memcache.so
log: error # connect disconnect
#LoadModule socache_redis_module lib/apache2/mod_socache_redis.so
}
#LoadModule watchdog_module lib/apache2/mod_watchdog.so
 
#LoadModule macro_module lib/apache2/mod_macro.so
socks pass {
#LoadModule dbd_module lib/apache2/mod_dbd.so
        from: 0.0.0.0/0 to: W.X.Y.Z/24
#LoadModule dumpio_module lib/apache2/mod_dumpio.so
        command: bindreply udpreply
#LoadModule echo_module lib/apache2/mod_echo.so
        log: connect error
#LoadModule buffer_module lib/apache2/mod_buffer.so
}
#LoadModule data_module lib/apache2/mod_data.so
 
#LoadModule ratelimit_module lib/apache2/mod_ratelimit.so
socks pass { 
LoadModule reqtimeout_module lib/apache2/mod_reqtimeout.so
        from: W.X.Y.Z/24 to: 0.0.0.0/0
#LoadModule ext_filter_module lib/apache2/mod_ext_filter.so
        command: bind connect udpassociate bindreply udpreply
#LoadModule request_module lib/apache2/mod_request.so
        log: error # connect disconnect iooperation
#LoadModule include_module lib/apache2/mod_include.so
}
LoadModule filter_module lib/apache2/mod_filter.so
 
#LoadModule reflector_module lib/apache2/mod_reflector.so
</syntaxhighlight>As for starting the service, bjonas elected to create a "hot plug" method.  Below is the configuration file that should be placed here: /etc/hotplug.d/iface/60-sockd;<syntaxhighlight lang="text">
#LoadModule substitute_module lib/apache2/mod_substitute.so
#!/bin/sh
#LoadModule sed_module lib/apache2/mod_sed.so
 
#LoadModule charset_lite_module lib/apache2/mod_charset_lite.so
[ "$ACTION" = ifup ] || exit 0
#LoadModule deflate_module lib/apache2/mod_deflate.so
 
LoadModule xml2enc_module lib/apache2/mod_xml2enc.so
/etc/init.d/sockd enabled && /etc/init.d/sockd start
LoadModule proxy_html_module lib/apache2/mod_proxy_html.so
</syntaxhighlight>Executing the ''service sockd start'' command should start the service at this point.  The log file in /var/log/sockd.log will indicate any configuration issues.  Additionally the service / daemon can be run with this command line for troubleshooting: sockd -f /etc/sockd/sockd.conf
LoadModule mime_module lib/apache2/mod_mime.so
 
#LoadModule ldap_module lib/apache2/mod_ldap.so
==LAMP (sort of) - Web Server (Apache, LighttpD, Nginx, and / or uHTTPd) MariaDB (MySQL), and PHP==
LoadModule log_config_module lib/apache2/mod_log_config.so
OpenWRT has four different web server platforms available.  Apache, LighttpD, and Nginx are all full featured, whereas uHTTPd is more limited in its functionality.  uHTTPd also serves as the web server for the LuCI GUI interface for OpenWRT.  Apache does not have CGI or FastCGI built into the binary executable, but both Lighttpd and Nginx have CGI and FastCGI capability built in, making addon modules unecessary.
#LoadModule log_debug_module lib/apache2/mod_log_debug.so
 
#LoadModule log_forensic_module lib/apache2/mod_log_forensic.so
====Apache====
#LoadModule logio_module lib/apache2/mod_logio.so
The Apache package in OpenWRT appears to only have CGI capability as the FastCGI module is not available.  However, there are additional proxy modules included with Apache in OpenWRT that allow for PHP-FPM functionality with FastCGI.
#LoadModule lua_module lib/apache2/mod_lua.so
 
LoadModule env_module lib/apache2/mod_env.so
=====Installation for Apache=====
LoadModule mime_magic_module lib/apache2/mod_mime_magic.so
opkg update
#LoadModule expires_module lib/apache2/mod_expires.so
 
LoadModule headers_module lib/apache2/mod_headers.so
opkg install apache apache-utils apache-mod-ssl
#LoadModule usertrack_module lib/apache2/mod_usertrack.so
 
#LoadModule unique_id_module lib/apache2/mod_unique_id.so
OR for a more complete installation: opkg install apache apache-icons apache-mod-deflate apache-mod-http2 apache-mod-ldap apache-mod-lua apache-mod-proxy apache-mod-proxy-html apache-mod-session-crypto apache-mod-ssl apache-mod-suexec apache-mod-webdav apache-suexec apache-utils
LoadModule setenvif_module lib/apache2/mod_setenvif.so
 
LoadModule version_module lib/apache2/mod_version.so
=====Configuration for Apache=====
#LoadModule remoteip_module lib/apache2/mod_remoteip.so
There is no LuCI GUI interface, so use text configuration files and / or Webmin (see below section on Webmin)
#LoadModule proxy_module lib/apache2/mod_proxy.so
 
#LoadModule proxy_connect_module lib/apache2/mod_proxy_connect.so
*Initilization Script: /etc/init.d/apache2
#LoadModule proxy_ftp_module lib/apache2/mod_proxy_ftp.so
*Configuration File: /etc/apache2/apache2.conf
#LoadModule proxy_http_module lib/apache2/mod_proxy_http.so
*Default Server Root: /usr
#LoadModule proxy_fcgi_module lib/apache2/mod_proxy_fcgi.so
*Default Document Root: /usr/share/apache2/htdocs
#LoadModule proxy_scgi_module lib/apache2/mod_proxy_scgi.so
*Executables / Binaries: /usr/lib/apache2
#LoadModule proxy_uwsgi_module lib/apache2/mod_proxy_uwsgi.so
*User / Group (/etc/group): apache / apache
#LoadModule proxy_fdpass_module lib/apache2/mod_proxy_fdpass.so
*For Redhat or
#LoadModule proxy_wstunnel_module lib/apache2/mod_proxy_wstunnel.so
 
#LoadModule proxy_ajp_module lib/apache2/mod_proxy_ajp.so
Below is working configuration file for Apache with CGI capability;<div class="toccolours mw-collapsible mw-collapsed" style="overflow:auto; width:100%;">
#LoadModule proxy_balancer_module lib/apache2/mod_proxy_balancer.so
<div style="font-weight:bold;line-height:1.6;">Code Block</div>
#LoadModule proxy_express_module lib/apache2/mod_proxy_express.so
<div class="mw-collapsible-content"><syntaxhighlight lang="text">
#LoadModule proxy_hcheck_module lib/apache2/mod_proxy_hcheck.so
ServerRoot "/usr"
#LoadModule session_module lib/apache2/mod_session.so
 
#LoadModule session_cookie_module lib/apache2/mod_session_cookie.so
Listen 192.168.1.1:80
#LoadModule session_crypto_module lib/apache2/mod_session_crypto.so
 
#LoadModule session_dbd_module lib/apache2/mod_session_dbd.so
TimeOut 3600
#LoadModule slotmem_shm_module lib/apache2/mod_slotmem_shm.so
 
#LoadModule slotmem_plain_module lib/apache2/mod_slotmem_plain.so
#LoadModule mpm_event_module lib/apache2/mod_mpm_event.so
#LoadModule ssl_module lib/apache2/mod_ssl.so
LoadModule mpm_prefork_module lib/apache2/mod_mpm_prefork.so
#LoadModule dialup_module lib/apache2/mod_dialup.so
#LoadModule mpm_worker_module lib/apache2/mod_mpm_worker.so
#LoadModule http2_module lib/apache2/mod_http2.so
LoadModule authn_file_module lib/apache2/mod_authn_file.so
#LoadModule md_module lib/apache2/mod_md.so
#LoadModule authn_dbm_module lib/apache2/mod_authn_dbm.so
#LoadModule lbmethod_byrequests_module lib/apache2/mod_lbmethod_byrequests.so
#LoadModule authn_anon_module lib/apache2/mod_authn_anon.so
#LoadModule lbmethod_bytraffic_module lib/apache2/mod_lbmethod_bytraffic.so
LoadModule authn_dbd_module lib/apache2/mod_authn_dbd.so
#LoadModule lbmethod_bybusyness_module lib/apache2/mod_lbmethod_bybusyness.so
#LoadModule authn_socache_module lib/apache2/mod_authn_socache.so
#LoadModule lbmethod_heartbeat_module lib/apache2/mod_lbmethod_heartbeat.so
LoadModule authn_core_module lib/apache2/mod_authn_core.so
LoadModule unixd_module lib/apache2/mod_unixd.so
LoadModule authz_host_module lib/apache2/mod_authz_host.so
#LoadModule heartbeat_module lib/apache2/mod_heartbeat.so
LoadModule authz_groupfile_module lib/apache2/mod_authz_groupfile.so
#LoadModule heartmonitor_module lib/apache2/mod_heartmonitor.so
LoadModule authz_user_module lib/apache2/mod_authz_user.so
#LoadModule dav_module lib/apache2/mod_dav.so
#LoadModule authz_dbm_module lib/apache2/mod_authz_dbm.so
LoadModule status_module lib/apache2/mod_status.so
#LoadModule authz_owner_module lib/apache2/mod_authz_owner.so
LoadModule autoindex_module lib/apache2/mod_autoindex.so
#LoadModule authz_dbd_module lib/apache2/mod_authz_dbd.so
#LoadModule asis_module lib/apache2/mod_asis.so
LoadModule authz_core_module lib/apache2/mod_authz_core.so
#LoadModule info_module lib/apache2/mod_info.so
#LoadModule authnz_ldap_module lib/apache2/mod_authnz_ldap.so
#LoadModule suexec_module lib/apache2/mod_suexec.so
LoadModule access_compat_module lib/apache2/mod_access_compat.so
<IfModule !mpm_prefork_module>
LoadModule auth_basic_module lib/apache2/mod_auth_basic.so
#LoadModule cgid_module lib/apache2/mod_cgid.so
#LoadModule auth_form_module lib/apache2/mod_auth_form.so
</IfModule>
#LoadModule auth_digest_module lib/apache2/mod_auth_digest.so
<IfModule mpm_prefork_module>
#LoadModule allowmethods_module lib/apache2/mod_allowmethods.so
LoadModule cgi_module lib/apache2/mod_cgi.so
#LoadModule file_cache_module lib/apache2/mod_file_cache.so
</IfModule>
#LoadModule cache_module lib/apache2/mod_cache.so
#LoadModule dav_fs_module lib/apache2/mod_dav_fs.so
#LoadModule cache_disk_module lib/apache2/mod_cache_disk.so
#LoadModule dav_lock_module lib/apache2/mod_dav_lock.so
#LoadModule cache_socache_module lib/apache2/mod_cache_socache.so
LoadModule vhost_alias_module lib/apache2/mod_vhost_alias.so
#LoadModule socache_shmcb_module lib/apache2/mod_socache_shmcb.so
#LoadModule negotiation_module lib/apache2/mod_negotiation.so
#LoadModule socache_dbm_module lib/apache2/mod_socache_dbm.so
LoadModule dir_module lib/apache2/mod_dir.so
#LoadModule socache_memcache_module lib/apache2/mod_socache_memcache.so
LoadModule actions_module lib/apache2/mod_actions.so
#LoadModule socache_redis_module lib/apache2/mod_socache_redis.so
#LoadModule speling_module lib/apache2/mod_speling.so
#LoadModule watchdog_module lib/apache2/mod_watchdog.so
#LoadModule userdir_module lib/apache2/mod_userdir.so
#LoadModule macro_module lib/apache2/mod_macro.so
LoadModule alias_module lib/apache2/mod_alias.so
#LoadModule dbd_module lib/apache2/mod_dbd.so
LoadModule rewrite_module lib/apache2/mod_rewrite.so
#LoadModule dumpio_module lib/apache2/mod_dumpio.so
 
#LoadModule echo_module lib/apache2/mod_echo.so
 
#LoadModule buffer_module lib/apache2/mod_buffer.so
 
#LoadModule data_module lib/apache2/mod_data.so
 
#LoadModule ratelimit_module lib/apache2/mod_ratelimit.so
<IfModule unixd_module>
LoadModule reqtimeout_module lib/apache2/mod_reqtimeout.so
 
#LoadModule ext_filter_module lib/apache2/mod_ext_filter.so
User apache
#LoadModule request_module lib/apache2/mod_request.so
Group apache
#LoadModule include_module lib/apache2/mod_include.so
 
LoadModule filter_module lib/apache2/mod_filter.so
#LoadModule reflector_module lib/apache2/mod_reflector.so
#LoadModule substitute_module lib/apache2/mod_substitute.so
#LoadModule sed_module lib/apache2/mod_sed.so
#LoadModule charset_lite_module lib/apache2/mod_charset_lite.so
#LoadModule deflate_module lib/apache2/mod_deflate.so
LoadModule xml2enc_module lib/apache2/mod_xml2enc.so
LoadModule proxy_html_module lib/apache2/mod_proxy_html.so
LoadModule mime_module lib/apache2/mod_mime.so
#LoadModule ldap_module lib/apache2/mod_ldap.so
LoadModule log_config_module lib/apache2/mod_log_config.so
#LoadModule log_debug_module lib/apache2/mod_log_debug.so
#LoadModule log_forensic_module lib/apache2/mod_log_forensic.so
#LoadModule logio_module lib/apache2/mod_logio.so
#LoadModule lua_module lib/apache2/mod_lua.so
LoadModule env_module lib/apache2/mod_env.so
LoadModule mime_magic_module lib/apache2/mod_mime_magic.so
#LoadModule expires_module lib/apache2/mod_expires.so
LoadModule headers_module lib/apache2/mod_headers.so
#LoadModule usertrack_module lib/apache2/mod_usertrack.so
#LoadModule unique_id_module lib/apache2/mod_unique_id.so
LoadModule setenvif_module lib/apache2/mod_setenvif.so
LoadModule version_module lib/apache2/mod_version.so
#LoadModule remoteip_module lib/apache2/mod_remoteip.so
#LoadModule proxy_module lib/apache2/mod_proxy.so
#LoadModule proxy_connect_module lib/apache2/mod_proxy_connect.so
#LoadModule proxy_ftp_module lib/apache2/mod_proxy_ftp.so
#LoadModule proxy_http_module lib/apache2/mod_proxy_http.so
#LoadModule proxy_fcgi_module lib/apache2/mod_proxy_fcgi.so
#LoadModule proxy_scgi_module lib/apache2/mod_proxy_scgi.so
#LoadModule proxy_uwsgi_module lib/apache2/mod_proxy_uwsgi.so
#LoadModule proxy_fdpass_module lib/apache2/mod_proxy_fdpass.so
#LoadModule proxy_wstunnel_module lib/apache2/mod_proxy_wstunnel.so
#LoadModule proxy_ajp_module lib/apache2/mod_proxy_ajp.so
#LoadModule proxy_balancer_module lib/apache2/mod_proxy_balancer.so
#LoadModule proxy_express_module lib/apache2/mod_proxy_express.so
#LoadModule proxy_hcheck_module lib/apache2/mod_proxy_hcheck.so
#LoadModule session_module lib/apache2/mod_session.so
#LoadModule session_cookie_module lib/apache2/mod_session_cookie.so
#LoadModule session_crypto_module lib/apache2/mod_session_crypto.so
#LoadModule session_dbd_module lib/apache2/mod_session_dbd.so
#LoadModule slotmem_shm_module lib/apache2/mod_slotmem_shm.so
#LoadModule slotmem_plain_module lib/apache2/mod_slotmem_plain.so
#LoadModule ssl_module lib/apache2/mod_ssl.so
#LoadModule dialup_module lib/apache2/mod_dialup.so
#LoadModule http2_module lib/apache2/mod_http2.so
#LoadModule md_module lib/apache2/mod_md.so
#LoadModule lbmethod_byrequests_module lib/apache2/mod_lbmethod_byrequests.so
#LoadModule lbmethod_bytraffic_module lib/apache2/mod_lbmethod_bytraffic.so
#LoadModule lbmethod_bybusyness_module lib/apache2/mod_lbmethod_bybusyness.so
#LoadModule lbmethod_heartbeat_module lib/apache2/mod_lbmethod_heartbeat.so
LoadModule unixd_module lib/apache2/mod_unixd.so
#LoadModule heartbeat_module lib/apache2/mod_heartbeat.so
#LoadModule heartmonitor_module lib/apache2/mod_heartmonitor.so
#LoadModule dav_module lib/apache2/mod_dav.so
LoadModule status_module lib/apache2/mod_status.so
LoadModule autoindex_module lib/apache2/mod_autoindex.so
#LoadModule asis_module lib/apache2/mod_asis.so
#LoadModule info_module lib/apache2/mod_info.so
#LoadModule suexec_module lib/apache2/mod_suexec.so
<IfModule !mpm_prefork_module>
#LoadModule cgid_module lib/apache2/mod_cgid.so
</IfModule>
<IfModule mpm_prefork_module>
LoadModule cgi_module lib/apache2/mod_cgi.so
</IfModule>
</IfModule>
 
#LoadModule dav_fs_module lib/apache2/mod_dav_fs.so
ServerName wrt3200acm.fullspectrum.lan:80
#LoadModule dav_lock_module lib/apache2/mod_dav_lock.so
 
LoadModule vhost_alias_module lib/apache2/mod_vhost_alias.so
 
#LoadModule negotiation_module lib/apache2/mod_negotiation.so
DocumentRoot "/usr/share/apache2/htdocs"
LoadModule dir_module lib/apache2/mod_dir.so
LoadModule actions_module lib/apache2/mod_actions.so
#LoadModule speling_module lib/apache2/mod_speling.so
#LoadModule userdir_module lib/apache2/mod_userdir.so
LoadModule alias_module lib/apache2/mod_alias.so
LoadModule rewrite_module lib/apache2/mod_rewrite.so
 
<IfModule unixd_module>
 
User apache
Group apache
 
</IfModule>
 
ServerName wrt3200acm.fullspectrum.lan:80
 
 
DocumentRoot "/usr/share/apache2/htdocs"
<Directory "/usr/share/apache2/htdocs">
<Directory "/usr/share/apache2/htdocs">
DirectoryIndex index.php index.html index.htm
DirectoryIndex index.php index.html index.htm
Line 1,765: Line 1,971:
find /usr/share/apache2 -type f -exec chmod 644 {} \;
find /usr/share/apache2 -type f -exec chmod 644 {} \;
</syntaxhighlight>
</syntaxhighlight>
=====Notes for Apache=====
=====Additional Notes for Apache Installation=====
In other installations, such as Redhat or CentOS, apache or apache2 is referred to as HTTPD in binary / executables, configuration files, commands, etc.
In other installations, such as Redhat or CentOS, apache or apache2 is referred to as HTTPD in binary / executables, configuration files, commands, etc.


Line 1,775: Line 1,981:
*LoadModule proxy_scgi_module lib/apache2/mod_proxy_scgi.so (Module does NOT exist for OpenWRT)
*LoadModule proxy_scgi_module lib/apache2/mod_proxy_scgi.so (Module does NOT exist for OpenWRT)
*LoadModule cgid_module lib/apache2/mod_cgid.so (does NOT seem to work, even when setting the ScriptSock Directive)
*LoadModule cgid_module lib/apache2/mod_cgid.so (does NOT seem to work, even when setting the ScriptSock Directive)
For Redhat / CentOS / RockyOS and similar users who are used to having HTTPD stuff located in /var/www/html by default, below are some commands to put in the Startup of OpenWRT to make Apache stuff easier to find (if you're on 'auto pilot');
*mkdir /tmp/www
*ln -s /usr/share/apache2/htdocs /var/www/html
*ln -s /usr/share/apache2/cgi-bin /var/www/cgi-bin
*ln -s /usr/share/apache2/error /var/www/error
*ln -s /usr/share/apache2/icons /var/www/icons
...and the reason it's in startup is because the VAR Directory in OpenWRT is actually the TMP Directory (IE, VAR is a softlink / shortcut to TMP), so it disappears after rebooting.
Firewall: Open ports on the firewall if public availability is desired.


====Lighttpd====
====Lighttpd====
Line 1,860: Line 2,078:
opkg update
opkg update


opkg install php7 php7-cgi php7-cli php7-fastcgi php7-fpm The php-cli (PHP Command Line) is not necessary, but is useful for troubleshooting.  Most examples utilizing the PHP command line program refer to it as just php, not php-cli.  OpenWRT installs it as php-cli, so instead of having to remember that, it maybe useful to create a symbolic link with this command: ''ln -s /usr/bin/php-cli /usr/bin/php''
opkg install php7 php7-cgi php7-cli php7-fastcgi php7-fpm snmp-mibs The php-cli (PHP Command Line) is not necessary, but is useful for troubleshooting.  Most examples utilizing the PHP command line program refer to it as just php, not php-cli.  OpenWRT installs it as php-cli, so instead of having to remember that, it maybe useful to create a symbolic link with this command: ''ln -s /usr/bin/php-cli /usr/bin/php''


=====PHP Configuration in /etc/php.ini=====
=====PHP Configuration in /etc/php.ini=====
Line 2,121: Line 2,339:
As noted previously, but worth mentioning again, OpenWRT names the interactive command line interface for PHP ''php-cli''.  Most sites give examples that use the command ''php'', so to make it easier create a symbolic link with this command: ln -s /usr/bin/php-cli /usr/bin/php  
As noted previously, but worth mentioning again, OpenWRT names the interactive command line interface for PHP ''php-cli''.  Most sites give examples that use the command ''php'', so to make it easier create a symbolic link with this command: ln -s /usr/bin/php-cli /usr/bin/php  


====MariaDB Server====
====MariaDB Server (AKA MySQL)====


=====Installing=====
=====Installing=====
Line 2,132: Line 2,350:
**Move the database to an external eSATA drive: datadir        = /mnt/sdb3/mysql
**Move the database to an external eSATA drive: datadir        = /mnt/sdb3/mysql
**Move the tmp directory to an external eSATA drive: datadir        = /tmp (This directory is relative to the datadir, in that it will be created at the same level as the mysql directory, so this is not an abolute path where it will utilize the /tmp directory in the root of the file system)
**Move the tmp directory to an external eSATA drive: datadir        = /tmp (This directory is relative to the datadir, in that it will be created at the same level as the mysql directory, so this is not an abolute path where it will utilize the /tmp directory in the root of the file system)
*To create the default database: mysql_install_db --force --basedir=/usr
*To create the default database: mysql_install_db --force --basedir=/usr (basedir refers to where the binary files are, not where the database(s) will be)
*Start the service: service mysqldb start
*And of course from the beginning, OpenWRT doesn't have the proper permissions set for the /etc/mysql Service / Daemon files, so: chmod 644 -R /etc/mysql
*Start the service: service mysqld start
*And if there is an error, try this command again: mysql_install_db --force --basedir=/usr
*To create a password for the current user (blank if not configured): /usr/bin/mysqladmin -u root password 'new-password'
*To create a password for the current user (blank if not configured): /usr/bin/mysqladmin -u root password 'new-password'
*Log into the command line for the database: mysql -u root -p or use phpMyAdmin see below
*Log into the command line for the database: mysql -u root -p or use phpMyAdmin see below
Line 2,160: Line 2,380:
Show available storage engines: SHOW ENGINES\G or show engines;
Show available storage engines: SHOW ENGINES\G or show engines;


===phpMyAdmin===
===phpMyAdmin (make sure Apache or another web server is installed and functional)===


*opkg update
*opkg update
*opkg install php7-mod-mbstring php7-mod-json php7-mod-hash php7-mod-ctype php7-mod-zip php7-mod-gd php7-mod-mysqli php7-mod-session php7-mod-snmp zoneinfo-northamerica (if one is in North America, if not, choose another zone and remember, phpMyAdmin will display a blank page with no error if a zoneinfo-WhatEverZone is not installed in addition to the zoneinfo-core package, see additional information below, dependencies will also be installed automatically).
*opkg install php7-mod-mbstring php7-mod-json php7-mod-hash php7-mod-ctype php7-mod-zip php7-mod-gd php7-mod-mysqli php7-mod-session php7-mod-snmp zoneinfo-northamerica (if one is in North America, if not, choose another zone and remember, phpMyAdmin will display a blank page with no error if a zoneinfo-WhatEverZone is not installed in addition to the zoneinfo-core package, see additional information below, dependencies will also be installed automatically).


Make sure the /usr/share/apache2/htdocs/phpMyAdmin/tmp has 777 permissions, otherwise Apache based phpMyAdmin sites may stop responding: chmod 777 /usr/share/apache2/htdocs/phpMyAdmin/tmp
Make sure the /usr/share/apache2/htdocs/phpMyAdmin/tmp has 755 permissions (if 755 doesn't work, try 777, phpMyAdmin will whine about 'world permissions', otherwise Apache based phpMyAdmin sites may stop responding: chmod 755 /usr/share/apache2/htdocs/phpMyAdmin/tmp


The following item is VERY important, hence it's typeface in '''BOLD''' CAPITAL letters.  If the appropirate additional time zone module is not installed it can cause a completely invisible error (IE, no error in Apache, Lighttpd, or PHP logs).  IE, it only displays a blank page.  Even using a command line instance of PHP will not reveal the error.  This line in the /phpMyAdmin/libraries/classes/Core.php file: date_default_timezone_set(@date_default_timezone_get()); is the source of the issue (Note, this is not the fault of phyMyAdmin, but it would be nice if they wrote a bit of code to address this situation).  The error message that can be coaxed out of Lighttpd by taking that line of code and placing it in a file by itself is: Timezone database is corrupt – this should ''never'' happen! (thanks to this site for a key bit of information on that issue: https://e3fi389.wordpress.com/2014/12/07/timezone-database-is-corrupt-date-error-in-openwrt/)
The following item is VERY important, hence it's typeface in '''BOLD''' CAPITAL letters.  If the appropirate additional time zone module is not installed it can cause a completely invisible error (IE, no error in Apache, Lighttpd, or PHP logs).  IE, it only displays a blank page.  Even using a command line instance of PHP will not reveal the error.  This line in the /phpMyAdmin/libraries/classes/Core.php (or Common.php) file: date_default_timezone_set(@date_default_timezone_get()); is the source of the issue (Note, this is not the fault of phyMyAdmin, but it would be nice if they wrote a bit of code to address this situation).  The error message that can be coaxed out of Lighttpd by taking that line of code and placing it in a file by itself is: Timezone database is corrupt – this should ''never'' happen! (thanks to this site for a key bit of information on that issue: https://e3fi389.wordpress.com/2014/12/07/timezone-database-is-corrupt-date-error-in-openwrt/)


*'''ALSO MAKE SURE TO INSTALL THE APPROPRIATE TIME ZONE MODULE, IN ADDITION TO THE DEFAULT''' zoneinfo-core: opkg install zoneinfo-northamerica (for example)
*'''ALSO MAKE SURE TO INSTALL THE APPROPRIATE TIME ZONE MODULE, IN ADDITION TO THE DEFAULT''' zoneinfo-core: opkg install zoneinfo-northamerica (for example)
Line 2,174: Line 2,394:


*wget <nowiki>https://files.phpmyadmin.net/phpMyAdmin/4.9.5/phpMyAdmin-4.9.5-english.tar.gz</nowiki> (or whatever the latest version is)
*wget <nowiki>https://files.phpmyadmin.net/phpMyAdmin/4.9.5/phpMyAdmin-4.9.5-english.tar.gz</nowiki> (or whatever the latest version is)
*If not installed, wget needs: opkg install libustream-mbedtls20150806 (or whatever other version, type opkg list libustream* to see available packages)
*If not installed, wget needs: opkg install ca-certificates
*tar -xzvf phpMyAdmin-4.9.5-english.tar.gz
*tar -xzvf phpMyAdmin-4.9.5-english.tar.gz
*mv WhatEverUnTarredDirectory /usr/share/apache/htdocs OR WhatEverLighttpd Directory
*mv WhatEverUnTarredDirectory /usr/share/apache/htdocs OR WhatEverLighttpd Directory
Line 2,219: Line 2,439:
**post_max_size = 128M
**post_max_size = 128M
**max_file_uploads = 20
**max_file_uploads = 20
*If using FPM, change the following in /etc/php7-fpm.d/www.conf (Corrects a non-responsive condition with .PHP Files, perhaps due to how fast OpenWRT cleans up unused chlidren, but root cause unknown, only increasing resources solves the issue)
**pm.max_children = 50
**pm.min_spare_servers = 4
**pm.start_server = 5
**pm.max_spare_servers = 6
**If MIN and MAX aren't set appropriately, this error will occur: ALERT: [pool www] pm.start_servers(5) must not be less than pm.min_spare_servers(1) and not greater than pm.max_spare_servers(3)
*Make sure bzip2 is installed or the myAdminPHP will complain.
*PHP.ini: Add this line: extension=mysql.so
*To diagnose any issues when attempting to access the phpMyAdmin setup this will display the error message (look for the line that says WarnMissingExtension to spot missing modules): php-cli /usr/share/apache2/htdocs/phpMyAdmin/setup/index.php
*To diagnose any issues when attempting to access the phpMyAdmin setup this will display the error message (look for the line that says WarnMissingExtension to spot missing modules): php-cli /usr/share/apache2/htdocs/phpMyAdmin/setup/index.php
*One final note on Blank Page errors: Watch out for any minor typos in the config.inc.php file like a missing double quote ( " ) or single quote ( ' ) / AKA apostrophe.  It will cause a 'blank page error', with nothing in the PHP, Apache, or other error logs.


=====LetsEncrypt / ACME=====
=====LetsEncrypt / ACME=====
Line 2,260: Line 2,489:
*opkg list procps*
*opkg list procps*


Additional commands are hidden in various other non-intuitive locations.  If a desired command or utility isn't available, search for it by name in the LuCI GUI interface, System, Software, Filter Field and then install the package it is contained in.  Use caution as some package names and descriptions are a bit misleading and may install undesired programs.
And thankfully OPKG doesn't support installing utilities via wildcards.  Solution?  Up, see example below using ''coreutils-'' (which always has a dash after coreutils);<syntaxhighlight lang="text">
opkg list | grep coreutils- | awk '{print $1}' | xargs opkg install
</syntaxhighlight>Additional commands are hidden in various other non-intuitive locations.  If a desired command or utility isn't available, search for it by name in the LuCI GUI interface, System, Software, Filter Field and then install the package it is contained in.  Use caution as some package names and descriptions are a bit misleading and may install undesired programs.


====Alternate Shells====
====Alternate Shells====
Line 2,299: Line 2,530:


=====ZSH=====
=====ZSH=====
=====Changing Shells=====
Install "Change Shell": opkg install shadow-chsh
List available shells: cat /etc/shells OR chsh -l (NOTE: The chsh -l command doesn't work in OpenWRT as it does in other Linux distributions because chsh was compiled without the -l option, presumably for space considerations)
Change shell: chsh -s /bin/bash (this will also allow history commands to persist too.) OR just type chsh and it will prompt you to change to a different shell.


=====Profiles=====
=====Profiles=====
Line 2,335: Line 2,573:
*opkg install samba36-server OR opkg install samba4-server samba4-utils
*opkg install samba36-server OR opkg install samba4-server samba4-utils
*opkg luci-app-samba OR opkg install luci-app-samba4
*opkg luci-app-samba OR opkg install luci-app-samba4
*For additional Samba related tools: opkg install samba4-client samba4-admin samba4-utils
*smbpasswd -a root (or whatever user is desired)
*smbpasswd -a root (or whatever user is desired)


Line 2,402: Line 2,641:
         # Below is the key to getting Samba Server to work with Windows 10
         # Below is the key to getting Samba Server to work with Windows 10
         map to guest = Never
         map to guest = Never
</syntaxhighlight></div></div>There are so many different sources that babble about solving the Samba / Windows 10 issues that include ntlm = true, server min protocol = SMB3, min protocol = SMB3, blah, blah, blah.  Nothing works.  All of these items seem to be set correctly with default values as of a version of Samba sometime after 2019, so they do not fix the issue.  For the "You can't access this shared folder because your organization's security policies block unauthenticated guest..." Error Message, the above noted ''map to guest = Never'' solves the issue
</syntaxhighlight></div></div>There are so many different sources that babble about solving the Samba / Windows 10 issues that include ntlm = true, server min protocol = SMB3, min protocol = SMB3, blah, blah, blah.  Nothing works.  All of these items seem to be set correctly with default values as of a version of Samba sometime after 2019, so they do not fix the issue.  For the "You can't access this shared folder because your organization's security policies block unauthenticated guest..." Error Message, the above noted ''map to guest = Never'' solves the issue.  And whenever creating new shared directories, uncheck "Allow guests" (OpenWRT enables this by default).


Then dd a Network Share: In LUCI GUI, Service, Network Shares, General Settings or Edit Template Tab, enter a Name and a Path, the other defaults are fine.
Then dd a Network Share: In LUCI GUI, Service, Network Shares, General Settings or Edit Template Tab, enter a Name and a Path, the other defaults are fine.
Line 2,409: Line 2,648:


And lastly, remember if one attempts to share the "Root Directory" ( / ), none of the sub directories will open, because of the way the OpenWRT file system works.
And lastly, remember if one attempts to share the "Root Directory" ( / ), none of the sub directories will open, because of the way the OpenWRT file system works.
====Free Space Tip for Samba====
In some circumstances Samba will not report the correct amount of free space.  This can be quite frustrating when one knows there is enough free space to copy a file, but an obnoxious error message pops up declaring that there needs to be X amount of more free space.
This can occur when one is accessing an external USB Flash Drive under /mnt (for example /mnt/sda1).  Samba will report the free space of the root drive of the router instead of the USB Flash Drive.  The root drive of the router is often time the internal NVRAM.  If one is using the overlay capability of OpenWRT (look it up), this often won't come up as the issue will be masked by the /overlay having an abundant amount of free space.
The hint was found here: https://superuser.com/questions/1423396/samba-reports-incorrect-disk-space-when-on-shared-mount-points-not-directly-bene
And that person was kind enough to cite the Samba Documentation: https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html#idm2835<nowiki/>(although they didn't include the anchor link at the end, but it was added here so there wouldn't be any need to scroll down to find it, plus the Samba people that created the documentation page were also kind enough to include a name (ID would work too) attribute so a URL anchor could be used).
Below is the code (minus the comments if one wishes) that can be added in the LuCI GUI, Services, Network Shares, Edit Template Tab.<syntaxhighlight lang="text">
### The dfree command refers to a script (next two lines) that cause Samba to correctly calculate free space for each
### Directory.  This comes into play when accessing an external USB Flash Drive under /mnt/sda1 for instance.  Samba
### will incorrectly report the internal NVRAM size instead of the USB Flash Drive free space.
### #!/bin/sh
### df  $1 | tail -1 | awk '{print $2" "$4}'
dfree command = /usr/local/samba/dfree
</syntaxhighlight>Don't forget to create the script file (see code above or below);<syntaxhighlight lang="text">
#!/bin/sh
df  $1 | tail -1 | awk '{print $2" "$4}'
</syntaxhighlight>
====WINS (Windows Internet Naming Service) for Samba====
{{:OpenWRT_WINS_with_Samba}}


===POPTOP / PPTPD===
===POPTOP / PPTPD===
First a warning so no one gets frustrated. Right out of the box, the configuration for PPTPD from OpenWRT is broken.  The hint for correcting it was found here: https://forum.openwrt.org/t/default-config-file-for-pptpd-lacks-logwtmp-option/4795 And as of 8.2020 it is still busted. How to fix it?  Well, follow the below directions.  Hint, this is the key setting in the /etc/config/pptpd file to get it functional (see below for more information): option 'logwtmp' '0'
First a warning so readers don't get frustrated: Out of the box (as in a virgin installation of the POPTOP / PPTPD Package), the configuration for PPTPD from OpenWRT as of 8.2020 is broken and will not functionCredit and thanks to this web site for a hint on correcting the default configuration was found here: https://forum.openwrt.org/t/default-config-file-for-pptpd-lacks-logwtmp-option/4795  How to fix it?  Well, follow the below directions.  Hint: The key is setting the ''option 'logwtmp' '0''' directive in the /etc/config/pptpd file (see below for more information).
 
And yes, for all the haters out there, PPTP is essentially broken as of 2021 and nobody is planning on fixing it or updating anything, so use OpenVPN to be secure.  But...  It is still useful to have this as a backup method of access to a router.  Plus the firewall can be configured such that the PPTP ports are only open to certain IP Addresses.  And given that we live in a world where the weakest link in any system is the human being, not technology, it's OK to have PPTP available if one needs it.  So to all the nay sayers: Shhhhhhh.  Because even if one is using PPTP and it has been compromised, guess what?  If one is using Secure Shell / SSH or the LuCI GUI over HTTPS then it doesn't matter that PPTP has been compromised.  So again, shhhhhh...


====Installation====
====Installation====
See the PPTP for Clients a couple of sub sectins below and make sure the package (opkg install kmod-nf-nathelper-extra) for that is installed and configured (read in the PPTP Client Section above) too.  The client software may or may not be necessary for the Server service to work. 
opkg install pptpd ppp (dependencies will automatically be installed if just pptpd is installed)
opkg install pptpd ppp (dependencies will automatically be installed if just pptpd is installed)


There is no LuCI GUI available.  Oddly, given there is no LuCI GUI, OpenWRT configuration of PPTPD is done through an /etc/config/ppptd file (usually this is only reserved for services that have a companion LuCI GUI available)
There is no LuCI GUI available.  Given there is no LuCI GUI it is a bit odd the configuration of PPTPD is done through an /etc/config/ppptd file, which is usually reserved for services that have a companion LuCI GUI available.  There is a dependency package named luci-proto-ppp that gets installed, but there doesn't seem to be any GUI interface other than maybe something in the System, Realtime Graphs section of the LuCI GUI for PPP traffic (and that's just speculation) .


====Configuration and other PPTPD Related File Locations====
====POPTOP / PPTPD Configuration Files and other Related File Locations====


*OpenWRT PPTPD Configuration File: /etc/config/pptpd
*OpenWRT PPTPD Configuration File (Hint: Make use of this one, even though there is no LuCI GUI interface, see information later in this section): /etc/config/pptpd
*PPTPD Configuration File: /etc/pptpd.conf* (BIG Asterisk here, see below) (as part of the /etc/init.d/pptpd startup script, this file is copied to /var/etc/pptpd.conf.  This could be changed in the startup script, but to keep things withing the OpenWRT configuration paradigm things can be left as they are, but just know this is going on behind the scenes.)
*PPTPD Configuration File: /etc/pptpd.conf* (BIG Asterisk here, see below) (as part of the /etc/init.d/pptpd startup script, this file is copied to /var/etc/pptpd.conf.  This could be changed in the startup script, but to keep things withing the OpenWRT configuration paradigm things can be left as they are, but just know this is going on behind the scenes.)
*PPP Configuration Files: /etc/ppp
*PPP Configuration Files: /etc/ppp
Line 2,430: Line 2,697:


====Configuring PPTPD====
====Configuring PPTPD====
Again a reminder that there is no LuCI GUI for PPTP (maybe there once was, but not likely to see one in the future).  But it's still better to configure things within the confines of the OpenWRT system.
First, configure the /etc/config/pptpd file.  Below is a working example;<syntaxhighlight lang="text">
First, configure the /etc/config/pptpd file.  Below is a working example;<syntaxhighlight lang="text">
config service 'pptpd'
config service 'pptpd'
Line 2,451: Line 2,720:
*/etc/ppp/options (this can be left with default OpenWRT settings)
*/etc/ppp/options (this can be left with default OpenWRT settings)
*/etc/ppp/options.pptpd (see below for a working version of this file, slightly different than the default OpenWRT version)
*/etc/ppp/options.pptpd (see below for a working version of this file, slightly different than the default OpenWRT version)
*/etc/ppp/chap-secrets: This is actually a symbolic link to /var/etc/chap-secrets, and that file is in turn dynamically generated from the information in /etc/config/pptp


Below is a working example of the /etc/pptpd.conf file;<syntaxhighlight lang="text">
Below is a working example of the /etc/pptpd.conf file;<syntaxhighlight lang="text">
Line 2,531: Line 2,801:
option src 'wan'
option src 'wan'
option proto '47'
option proto '47'
</syntaxhighlight>The above ''list dest_ip 'W.X.Y.Z'<nowiki/>'' are only needed if using MWAN3 and can be eliminated from firewall configurations that don't have to consider multiple WAN ports.


And one last thing to configure are couple of things the startup / shutdown script does not do.
# ...and while you're in here add the below to the CONFIG ZONE named 'lan' (more information in the next section)


*It does not delete / clean up the /var/run/pptpd.pid file
list device 'ppp+'
*It does not delete the /etc/var/chap-secrets file that is generated.  The interesting fallout from this is that every time the PPTPD service is stopped an started, it appends the information in the 'login' section of the /etc/config/pptpd file to /var/etc/chap-secrets.  If there are several user names and the service is restarted a couple of times, the number of redundant logins increases quite quickly.
</syntaxhighlight>The above ''list dest_ip 'W.X.Y.Z'<nowiki/>'' are only needed if using MWAN3 and can be eliminated from firewall configurations that don't have to consider multiple WAN ports.  If configured it would be set to the WAN IP Addresses of the router.
 
Also in the /etc/config/firewall file is a setting that needs to be added to the 'lan' zone;<syntaxhighlight lang="text">
list device 'ppp+'
 
OR
 
option device 'ppp+'
 
...below is an example of a complete 'lan' zone as it is usually configure within OpenWRT with the 'ppp+' setting at the end;
 
config zone 'lan'
option name 'lan'
option input 'ACCEPT'
option output 'ACCEPT'
option forward 'ACCEPT'
option family 'ipv4'
option network 'lan'
list device 'ppp+'
 
</syntaxhighlight>The above ''list device 'ppp+'<nowiki/>'' directive is needed for proper routing between remote clients and the router's local subnet.
 
See here for some additional documentation on /etc/config/firewall settings: https://openwrt.org/docs/guide-user/firewall/firewall_configuration
 
And one last thing to configure are couple of things the startup / shutdown script does not do.
 
*It does not delete / clean up the /var/run/pptpd.pid file
*It does not delete the /etc/var/chap-secrets file that is generated.  The interesting fallout from this is that every time the PPTPD service is stopped an started, it appends the information in the 'login' section of the /etc/config/pptpd file to /var/etc/chap-secrets.  If there are several user names and the service is restarted a couple of times, the number of redundant logins increases quite quickly.


Insert the following code into the /etc/init.d/pptpd file to correct those issuea;<syntaxhighlight lang="text">
Insert the following code into the /etc/init.d/pptpd file to correct those issuea;<syntaxhighlight lang="text">
Line 2,550: Line 2,846:
This option for the /etc/ppp/options.pptpd is NOT supported by the OpenWRT PPTPD service: require-mppe-128 (an error message of: In file /var/etc/options.pptpd: unrecognized option 'require-mppe-128' error will occur if it is included).  It should also be noted that the mppe-128 is built into the OpenWRT /usr/sbin/pptpd binary / executable file, thus making the setting unneccessary as it is enabled by default (pptp-server.log if enabled shows this: MPPE 128-bit stateless compression enabled).  So do not include require-mppe-128 in the /etc/ppp/options.pptpd.
This option for the /etc/ppp/options.pptpd is NOT supported by the OpenWRT PPTPD service: require-mppe-128 (an error message of: In file /var/etc/options.pptpd: unrecognized option 'require-mppe-128' error will occur if it is included).  It should also be noted that the mppe-128 is built into the OpenWRT /usr/sbin/pptpd binary / executable file, thus making the setting unneccessary as it is enabled by default (pptp-server.log if enabled shows this: MPPE 128-bit stateless compression enabled).  So do not include require-mppe-128 in the /etc/ppp/options.pptpd.


===OpenVPN===
And finally, just because the example given in the OpenWRT tuturoial, is so convoluted and opaqe, is their example (from here: https://openwrt.org/docs/guide-user/services/vpn/pptp/server) explained;<syntaxhighlight lang="text">
This section is written for people that are experienced with OpenVPN.
uci rename firewall.@zone[0]="lan" <-- Rename the first zone in the /etc/config/firewall file as 'lan'


The LuCI interface provides a nice interface for keeping track of OpenVPN Server and Client configuration, plus editing and enabling and disabling a specific Server or Client configuration file. OpenVPN for OpenWRT operates as it did for CentOS 6 where a single "OpenVPN Service" would "spawn" multiple instances of the OpenVPN binary / executable depending on how many Server and Client configuration files there are.  CentOS 7 and newer has it configured such that each instance of an OpenVPN Server and / or Client configuration file requires a separate service.
uci rename firewall.@zone[1]="wan" <-- Rename the second zone in the /etc/config/firewall file as 'lan'


====Installation====
uci del_list firewall.lan.device="ppp+" <-- Delete the list device 'ppp+' directive in the 'lan' zone of the /etc/config/firewall file


*opkg update
uci add_list firewall.lan.device="ppp+" <-- Add that same directive back to the same spot (no it doesn't seem to make much sense to deleted it above, but adding it is a good choice if it isn't there already)
*opkg install openvpn-easy-rsa openvpn-openssl (Any dependencies will automatically be installed, also see Notes section below)
*Install the LuCI GUI interface for OpenVPN manually (see note below on the LuCI, System, Software installation for the OpenVPN LuCI GUI below)
**opkg download luci-app-openvpn
**opkg install WhatEverTheFileNameThatGetsDownloaded


====Files & Directories====
uci -q delete firewall.pptp <-- Delete any zone titled pptp in the /etc/config/firewall file (maybe to make sure there aren't any incorrect legacy settings, but this assumes the zone is named 'pptp' and won't help if it is named differently


*/etc/config/openvpn: File for OpenVPN connections configured within the LuCI GUI interface AND "includes" for additional OpenVPN configuration files
uci set firewall.pptp="rule" <-- Create a new rule with the below settings;
*/etc/openvpn: Directory for storing all other OpenVPN settings and OpenSSL settings related to OpenVPN
uci set firewall.pptp.name="Allow-PPTP"
*/etc/openvpn/keys: Common directory name for storing OpenVPN certificates. Manually create.
uci set firewall.pptp.src="wan"
*/etc/openvpn/ccd: Common directory name for storing OpenVPN client configuration settings. Manually create.
uci set firewall.pptp.dest_port="1723"
*/etc/openvpn/client: Unused by the OpenWRT version of OpenVPN, sometimes used with other Linux distributions (CentOS, etc.).  It is recommended to store all Server and Client configuration files in /etc/openvpn as that is the only directory scanned by the /etc/init.d/openvpn OpenVPN Service startup script.
uci set firewall.pptp.proto="tcp"
*/etc/openvpn/server: Unused by the OpenWRT version of OpenVPN, sometimes used with other Linux distributions (CentOS, etc.)It is recommended to store all Server and Client configuration files in /etc/openvpn as that is the only directory scanned by the /etc/init.d/openvpn OpenVPN Service startup script.
uci set firewall.pptp.target="ACCEPT"
*etc/openvpn/openvpn-ssl.cnf: Common configuration file name for OpenSSL settings when creating certificates for OpenVPN
uci commit firewall
</syntaxhighlight>Hint: The same settings can be configured with far fewer keystrokes by simply editing the /etc/config/firewall file. The example could also be made far more cleary by directly editing the /etc/config/firewall file, instead of blindly entering a bunch of command, some of which are uselessAdditionaly, some won't work correctly if the 'lan' and 'wan' zones aren't at index 0, and 1, as they are by default (IE, if someone has manually added additional zones).


====Configuration====
====PPTP (Point to Point Tunneling Protocol) for PPTPD / Server and Clients (IE Clients behind the Router using a remote PPTP system)====
OpenWRT LuCI Configuration File (/etc/config/openvpn) for a single OpenVPN Service instance;<syntaxhighlight lang="text">
Again, to be clear, this section is not just about getting PPTP / POPTOP service / daemon working on a router, although it is necessaryThis section is also about a router allowing PPTP connections to pass through it, IE if you're not worried about a PPTPD / Server, but you want clients on an internal network to "dial out" to another PPTPD / Server, this is needed.
config openvpn 'Server'
option config '/etc/openvpn/Server.conf'
option enabled '1'
</syntaxhighlight>
The LuCI GUI can be used in a myriad of waysThe most basic of which is to manage OpenVPN configuration files that are created in a text editor.


Working example of an OpenVPN Server configuration file (not to be confused with the OpenWRT Luci configuration file, see above);<syntaxhighlight lang="text">
OpenWRT defines the use of PPTP Clients on the LAN side of a router that wish to connect to a PPTP server via the internet as NAT traversal for PPTP. Default installations of OpenWRT do not have the capability to facilitate PPTP connections by clients (IE, computers on the LAN side of the router).  The following software package must be installed;
dev tun2
port 1194
proto udp
verb 3
push "route 192.168.1.0 255.255.255.0"
client-config-dir ccd
client-to-client
tls-server
keepalive 15 120
ca /etc/openvpn/keys/CA.for.WRT3200ACM/ca.crt
cert /etc/openvpn/keys/CA.for.WRT3200ACM/server.wrt3200acm.crt
key /etc/openvpn/keys/CA.for.WRT3200ACM/server.wrt3200acm.key
dh /etc/openvpn/keys/CA.for.WRT3200ACM/dh2048.pem
</syntaxhighlight>In the above configuration file, it is assumed the local subnet is 192.168.1.0/24 and that keys have already been generated (see below section for using Webmin to generate certificates).  The above storage location for keys is just an example that can be customized to any directory.


=====Firewall=====
*opkg update
And don't forget to open up the appropriate ports on the firewall;
*opkg install kmod-nf-nathelper-extra


*Use the LuCI GUI, Network, Firewall, Traffic Rules Interface to configure
The instructions on enabling the capability is a bit lacking on the OpenWRT site, so below is an improved explanation.  After installing the above package, do the following;


OR
*Create a file named 20-nf-conntrack-helper.conf in /etc/sysctl.d: nano /etc/sysctl.d/20n-nf-conntrack-helper.conf
*Add a single line of code in the 20-nf-conntrack-helper.conf file to enable the program: net.netfilter.nf_conntrack_helper = 1
*Save the file: CTRL + O, then exit nano: CTRL + X
*Restart the sysctl service: service sysctl restart


*Edit the /etc/config/firewall File
PPTP should now work for clients wishing to use PPTP connections.


The standard OpenVPN Server Port is 1194 UDP
As has been mentioned and will continue to be mentioned, it is understandable that the OpenWRT documentation may be lacking in some ways.  Creating and writing good documentation is difficult and time consuming.  The nice people responsible for OpenWRT spend most of their time making things work, improving functionality, adding new firmware for new routers, etc..  This leaves little time for good documentation.  So for all the nice people that work so hard on OpenWRT, thank you.  And no offense meant.  The rather cryptic several lines written by the author of the below noted article for more information very likely uses that "shortcut" to create files or may have thought it was helpful to present it in that way.  And it may work for some people.  But it was decided to present it here slightly differently as done above.


=====Network=====
More information on enabling the feature can be found here: https://openwrt.org/docs/guide-user/services/vpn/pptp/nat_traversal
<br />
=====Certificate Management for OpenVPN with Webmin (see Webmin Section below)=====
First the reminders;


*Do NOT use Webmin for OpenVPN settings.  Instead use the LuCI GUI and / or edit text files (starting and stopping the service is fine)
===OpenVPN===
*ONLY use it for Certificate management for OpenVPN.
This section is written for people that are experienced with OpenVPN.
*Watch out when clicking the "Keys list" link as it is very close to the Remove link.  If the Remove link is clicked, there is no confirmation about deleting the entire Certificate infrastructure.


======Configuring a Certificate Authority Infrastructure (Certificate Authority, Server Certificate, Client Certificate(s)======
REMEMBER (It will make sense later, and is worth pointing out at the beginning):Certificates are a requirement of encrypted communication for OpenVPN.  That part of OpenVPN is made possible by OpenSSLTwo things to remember are these;
For some odd reason (possibly troubleshooting), it is possible to create an OpenVPN infrastructure that transmits information ''without'' encryption.  That's a bit too "open"In order to encrypt communication one must create a "Certificate Infrastructure".  This includes first, a Certificate Authority (CA), then a certificate for a Server, then certificate(s) for clients.


There are many tutorials on this, all of them use the command lineWebmin makes it very easy to do and keep track of certificates.  Even with that capability, keeping things in an organized structure is importantThis includes naming conventions. A CA could be named Mary PoppinsBut that isn't very helpful as a name for a CA if others are involved in managing an infrastructure.
*The /etc/openvpn/openvpn-ssl.cnf file contains a major flaw as it delivered by OpenWRT in the software package.  There is a directive line (default_md    = md5) that will not work with the version of OpenVPN provided by OpenWRT (it's actually been that way for several versionsThe directive instructs OpenSSL to produce certificates using a method that has been deemed comprimisedThe line should instead read: default_md    = sha256
*There's also a frustrating issue that comes up with a newly created certificate that won't work until the next daySolution? Set the time of the router to a day or so in the pastNow that can be an adventure because it can't be done via the LuCI GUI.  It can of course be done via the command line or Webmin.


If the Webmin module is configured as noted below, the entire certificate infrastructure (minus OpenSSL settings) will be stored in /etc/openvpn/keys
The LuCI interface provides a nice interface for keeping track of OpenVPN Server and Client configuration, plus editing and enabling and disabling a specific Server or Client configuration file.  OpenVPN for OpenWRT operates as it did for CentOS 6 where a single "OpenVPN Service" would "spawn" multiple instances of the OpenVPN binary / executable depending on how many Server and Client configuration files there are.  CentOS 7 and newer has it configured such that each instance of an OpenVPN Server and / or Client configuration file requires a separate service.


*Create a Certificate Authority
====Installation====


====Webmin for OpenVPN and Certificate Management====
*opkg update
Only some features of the Webmin Module are usefulFirst and foremost is the Certificate management. Works greatAs noted above, watch out when clicking the "Keys list" link as it is very close to the Remove linkIf the Remove link is clicked, there is no confirmation about deleting the entire Certificate infrastructure. Bad design, oh, well.
*opkg install openvpn-easy-rsa openvpn-openssl (Any dependencies will automatically be installed, also see Notes section below)
*Install the LuCI GUI interface for OpenVPN manually (see note below on the LuCI, System, Software installation for the OpenVPN LuCI GUI below)
**opkg download luci-app-openvpn
**opkg install WhatEverTheFileNameThatGetsDownloaded
 
====Files & Directories====
 
*/etc/config/openvpn: File for OpenVPN connections configured within the LuCI GUI interface AND "includes" for additional OpenVPN configuration files
*/etc/openvpn: Directory for storing all other OpenVPN settings and OpenSSL settings related to OpenVPN
*/etc/openvpn/keys: Common directory name for storing OpenVPN certificatesManually create.
*/etc/openvpn/ccd: Common directory name for storing OpenVPN client configuration settings.  Manually create.
*/etc/openvpn/client: Unused by the OpenWRT version of OpenVPN, sometimes used with other Linux distributions (CentOS, etc.)It is recommended to store all Server and Client configuration files in /etc/openvpn as that is the only directory scanned by the /etc/init.d/openvpn OpenVPN Service startup script.
*/etc/openvpn/server: Unused by the OpenWRT version of OpenVPN, sometimes used with other Linux distributions (CentOS, etc.)It is recommended to store all Server and Client configuration files in /etc/openvpn as that is the only directory scanned by the /etc/init.d/openvpn OpenVPN Service startup script.
*etc/openvpn/openvpn-ssl.cnf: Common configuration file name for OpenSSL settings when creating certificates for OpenVPN


Between the LuCI GUI and Certificate Management portion of Webmin, all aspects of OpenVPN can be conveniently controlled via a GUI interface.
====Configuration====
OpenWRT LuCI Configuration File (/etc/config/openvpn) for a single OpenVPN Service instance;<syntaxhighlight lang="text">
config openvpn 'Server'
option config '/etc/openvpn/Server.conf'
option enabled '1'
</syntaxhighlight>
The LuCI GUI can be used in a myriad of ways.  The most basic of which is to manage OpenVPN configuration files that are created in a text editor.


The log display doesn't work properly, even when log files are configured properly.
Working example of an OpenVPN Server configuration file (not to be confused with the OpenWRT Luci configuration file, see above);<syntaxhighlight lang="text">
#If more than one WAN then use multihome directive
#multihome
dev tun2
topology subnet
push "topology subnet"
mode server
ifconfig W.X.Y.Z 255.255.255.0
ifconfig-pool W.X.Y.100 W.X.Y.199 255.255.255.0
route-gateway W.X.Y.Z
push "route-gateway W.X.Y.Z"
port 1194
proto udp
verb 3
route W.X.Y.Z 255.255.255.0
#Can be handled in CCD files
#push "route 192.168.1.0 255.255.255.0"
client-config-dir ccd
client-to-client
tls-server
keepalive 15 120
ca /etc/openvpn/keys/WhatEverPath/ca.crt
cert /etc/openvpn/keys/WhatEverPathserver/WhatEverCrt.crt
key /etc/openvpn/keys/WhatEverPath/WhatEverKey.key
dh /etc/openvpn/keys/WhatEverPath/dh2048.pem
</syntaxhighlight>In the above configuration file, it is assumed that keys have already been generated (see below section for using Webmin to generate certificates).  The above storage location for keys is just an example that can be customized to any directory.


Editing and managment of the OpenVPN service
=====PID File (if needed)=====
If there's a situation where a PID file is needed to keep track of OpenVPN functionality, thankfully OpenWRT has not included that in their init.d configuration.  But it can be added.  Below is what needs to be added to the /etc/init.d/openvpn file.  It can also be added to the configuration file for an instance of OpenVPN Server or Client.<syntaxhighlight lang="text">
...in the "openvpn_add_instance" section, add the line in between --->  <----.  The rest of the surrounding code for that single line is already there and is just put here for reference.  An obviously don't include the ---> or <--- "arrows";


The Webmin module for OpenVPN & Certificate management is not a "standard module".
openvpn_add_instance() {
local name="$1"
local dir="$2"
local conf="$3"


*Install in the Webmin interface: Webmin, Webmin Configuration, Webmin Modules, Install from Local File, Select File, Install Module.
procd_open_instance "$name"
**Download the module if the Webmin interface doesn't populate with available modules
procd_set_param command "$PROG" \
***wget https://www.webmin.com/cgi-bin/search_third.cgi?modules=1
--syslog "openvpn($name)" \
****If wget displays an error, make sure the full version of wget is installed (not the one built into BusyBox): opkg install wget
--status "/var/run/openvpn.$name.status" \
****If a certificate error occurs, add this to the end of the wget line: --no-check-certificate
--cd "$dir" \
***Site: https://www.webmin.com/cgi-bin/search_third.cgi?modules=1
--->    --writepid "/var/run/openvpn.$name.pid" \    <----
***OpenVPN & Certificate Management Module Link (version 3.2): http://www.openit.it/downloads/OpenVPNadmin/openvpn-3.2.wbm.gz
--config "$conf"
***Sometimes the interface seems to work, sometimes it doesn't.  Possibly due to Wemin site issues or Perl issues on a local machine.
procd_set_param file "$dir/$conf"
*By default, the OpenVPN... Module is located in Servers.  Given that it deals with Networking and an equivalent Module (PPTP) is located in Networking, it makes sense to relocate the Module to Networking
procd_set_param term_timeout 15
**Webmin, Webmin Configuration, Reassign Modules, OpenVPN..., Networking, Save
procd_set_param respawn
procd_append_param respawn 3600
procd_append_param respawn 5
procd_append_param respawn -1
procd_close_instance
}


Below is a working configuration file for the OpenVPN & Certificate Authority Module (/etc/webmin/openvpn)<syntaxhighlight lang="text">
openvpn_path=/usr/sbin/openvpn
br_start_cmd=
openssl_version=1.1.1g
default_server=
br_end_cmd=
zip_cmd=/usr/bin/gzip
openssl_home=/etc/openvpn/openvpn-ssl.cnf
tail_cmd=
openvpn_pid_path=/var/run
log_refresh=
status_cmd=
start_cmd=/etc/init.d/openvpn start
openvpn_version=2.4.7
openvpn_clients_subdir=client
down_root_plugin=
openssl_path=/usr/bin/openssl
openvpn_pid_prefix=openvpn
openvpn_keys_subdir=keys
openvpn_home=/etc/openvpn
log_lines=9999
stop_cmd=/etc/init.d/openvpn stop
openvpn_servers_subdir=server
</syntaxhighlight>


====Notes====


*Use the OpenSSL version of OpenVPN (openvpn-openssl), not the mbedTLS (openvpn-mbedtls), and definately not openvpn-nossl (there is no security, but possibly good for testing configuration files). See [https://community.openvpn.net/openvpn/wiki/Using-mbedtls?__cf_chl_jschl_tk__=ff3c180e8bbe2b915b0183749a92b047e7d74777-1595651545-0-AX2laPnquTrHAziLcg-vt2ugt_LSqNFn5HBLAiMbNYHMAMochho8hSmQ7j94L_lu71l0UE4riG5ue4jwMfskumWXabSBHXcSICCRTMPy1isqlrz6XYDWZZg4sa7cpHJ1clUqABtwFpMLy4jJYqIGdq0MOqmzBR46YCIHim-bxfB_JtAqi4ZpLEfqyF1TSaEYaEaHn0sqxvx2T-8L6d6M3OcHUoL0SL3aoAokmm-mweQTmUWRXSlz4h94_u7DakllFWkPk_xpIAhCKsSNPon3M5Fd62uoFpZCPRFTHP8_nNuWT98oo-IbkeHi8oxbYKU1OQ here] for additional information
...and at the bottom of the file, add the following (it removes the PID file after the OpenVPN service / daemon is stopped;
*If the /etc/config/openvpn file contains any sort of syntax error (if the file has been modified in a text editor for example), the configuration file will upload, but it will not be displayed as available in the LuCI OpenVPN GUI.
*There's a bit of an issue with the OpenVPN LuCI interface when using the OVPN configuration file upload.  When the Browse button is clicked, the initial "Choose File to Upload" dialogue selects .ovpn as the default file extension.  This might lead one to believe that any files uploaded should have a file name that ends in .ovpn.  This is not the case.  A quick inspection of the /etc/init.d/openvpn file for the OpenVPN service reveals that it scans for files ending in .conf. So make sure any files uploaded via the LuCI GUI interface for OpenVPN end in .conf.
*The /etc/openvpn Directory contains two sub-directories: client and server.  These are default OpenVPN directories, but it also implies that Server and Client configuration files should be placed in these directories.  This is not the case.  An examination of the /etc/init.d/openvpn OpenVPN configuration file revealse that it only scans the /etc/openvpn Directory for configuration files.  Additionally, the LuCI GUI interface for OpenVPN places the files in /etc/openvpn and does not scan the sever and client sub-directories for additional configuration files.
*As of 8.2020, there is also an issue with the version number of of the LuCI GUI for OpenVPN (luci-app-openvpn).  The package version displayed via the System, Software page in the LuCI GUI displays git-2.229...  Downloading the IPK file manually (opkg download luci-app-openvpn) results in version git-2.234...  Additionally, the installation or upgrade via the LuCI GUI for the OpenVPN LuCI GUI interface seems to be unreliable.  The recommendation is to download manually (opkg download luci-app-openvpn) and install the downloaded file (opkg install WhatEverTheNameOfTheFileIs)
*Sadly, possibly due to space constraints and the desire to have the smallest binary / executable file possible for OpenVPN, the OpenWRT version does not contain any "help" information (IE, openvpn --help produces no output)


To install OpenVPN with OpenSSL and the LUCI GUI for it (under VPN)
stop_service()
{
rm /var/run/openvpn*
}
</syntaxhighlight>


*opkg update
=====Firewall=====
*opkg install openvpn-openssl openvpn-easy-rsa luci-app-openvpn luci-ssl-openssl (openssl-util and other dependencies will automatically install)
And don't forget to open up the appropriate ports on the firewall;
*OpenVPN will be available under LuCI GUI, VPN, OpenVPN (Remember to refresh the web browser window to display the new category (Firefox: CTRL + Refresh) or log out and log back into the LuCI GUI)


===ProFTPD===
*Use the LuCI GUI, Network, Firewall, Traffic Rules Interface to configure
ProFTPD does not seem to be available as an OpenWRT package anymore.  At some point (appx. 2012 or earlier) it was, as evidenced by: https://openwrt.org/docs/guide-user/services/nas/ftp.overview


Use vsFTPD instead.
OR


===vsFTPD===
*Edit the /etc/config/firewall File


====Installation====
The standard OpenVPN Server Port is 1194 UDP
opkg update


opkg install vsftpd
=====Network=====
...this section not complete (among others)


====Configuration====
/etc/config/firewall;
Configuration File: /etc/vsftpd.conf


*Be sure to read the
config zone
*The default configuration file (/etc/vsftpd.conf) for VSFTPD will never work under any circumstances for an OpenWRT router that is in a "normal" / default configuration in regards to its firewall and several other items.  It is understood that the OpenWRT developers have better things to do than configuring an old FTP server, but they may as well leave the configuration file blank or perhaps include all of the options, but comment everything out rather than having a configuration file that does nothing more than give an end user false hope.
*The OpenWRT Package creates an /etc/vsftpd Directory, but it isn't used.  Case in point: The default userlist_file name for the OpenWRT version of VSFTPD is /etc/vsftpd.user_list.  For other platforms such as CentOS, that file is located in the /etc/vsftpd Directory, but for OpenWRT it is located in the /etc Directory.  So why is the /etc/vsftpd Directory created (with nothing in it)?  Best guess is that since other Platforms like CentOS that put configuration files in the /etc/vsftpd Directory, there might be some "template" in the vsftpd source code that creates that Directory by default and the OpenWRT developers forgot to disable that function.
*The /etc/init.d/vsftpd startup script is very simple.  So simple in fact that it requires a setting (listen=YES) in the .conf file for vsFTPD for vsFTPD that documentation indicates is set to "yes" if vsFTPD is NOT run via an init.d script.  In OpenWRT's case, the startup script is so simple it essentially runs vsFTPD as if it were starting from the command line.  This causes no issues, but is a bit counter intutive if one reads the vsFTPD documentation on the "listen" directive.


Below is a working configuration file;<syntaxhighlight lang="text">
   option name 'OpenVPN'
listen_address=W.X.Y.Z
ftp_data_port=20
listen_port=21


# Remember to configure Firewall settings with equivalent values
   option input 'ACCEPT'
pasv_enable=YES
pasv_address=W.X.Y.Z
pasv_min_port=10012
pasv_max_port=10021


session_support=NO
   option forward 'ACCEPT'


# OpenWRT Oddity: Even though the vsFTPD Service / Daemon is started via an init.d script, it is a very simple script that essentially does the same thing as starting vsFTPD from the command line, so the following must be set to YES;
   option output 'ACCEPT'
listen=YES


# Banner display does not appear to function in an modern web browser
   option network 'TUN002 TUN1'
ftpd_banner=Hello
banner_file=/etc/vsftpd1.banner_file


dirmessage_enable=YES
config rule
message_file=.message
 
   option dest_port '1194'
 
   option src 'wan'
 
   option name 'OpenVPN_TCP_UDP_1194_WRT1900ACS'


max_login_fails=3
   list dest_ip <nowiki>''</nowiki>
anonymous_enable=NO
check_shell=NO


#
   option target 'ACCEPT'
chroot_local_user=YES
write_enable=NO
allow_writeable_chroot=YES
local_umask=022


# Equivalent to "Run As" Service / Daemon
   option family 'ipv4'
background=YES


# Set logged items go to the vsFTPD log instead of the system message log
   list proto 'tcp'
syslog_enable=NO


log_ftp_protocol=YES
   list proto 'udp'
xferlog_std_format=YES
xferlog_enable=YES
dual_log_enable=YES
vsftpd_log_file=/var/log/vsftpd1.standard.log
xferlog_file=/var/log/vsftpd1.xfer.log


local_enable=YES
config forwarding
userlist_enable=NO
userlist_deny=NO


# In OpenWRT, the default location is: userlist_file=/etc/vsftpd.user_list (this is very odd given that OpenWRT creates an /etc/vsftpd Directory)
   option dest 'OpenVPN'
# On other platforms, like CentOS, the default location is /etc/vsftpd/vsftpd.conf
# Do NOT create the list in anything other than VI or NANO (IE, don't use Windows Explorer, Directory Opus, etc. to create a new file) as there is an issue with Carriage Return / Line Feeds.
# Editing with TextPad later is fine as it seems to respect how the file was created in terms of using CR/LF VS just LF.
userlist_file=/etc/vsftpd1.user_list


</syntaxhighlight>In the above working example, of course replace W.X.Y.Z with an appropriate IP Address.  Astute readers will notice all the file names that might generally start have "vsftpd" in their names instead have "vsftpd1".  The reason for that is because the above working configuration file was used in a situation where a router is configured with two WAN interfaces, with two IP Addresses on two different networks.  See the section on Dual WAN vsFTPD for additional information.
   option src 'lan'


The /etc/vsftpd1.user_list contains a list of users that will be allowed to login if the userlist_enable=YES and userlist_deny=NO settings are present.
config forwarding


NOTE 1: If any of the above referenced files (vsftpd1.user_list, etc.) are not present, the vsftpd service will start and appear to be functioning (PS, TOP, HTOP, etc. will all show it as running), but...  There will be nothing displayed on client FTP software.
   option dest 'lan'


NOTE 2: Users and Groups can be managed by editing the /etc/passwd (User File) and /etc/group (Group File).  If Webmin (see below) is installed and properly configured, Users & Groups can be managed through its interface.  The useradd command can be added with: opkg install shadow-useradd
   option src 'OpenVPN'


NOTE 3: Remember, OpenWRT also uses the /etc/shadow file to store user passwords with MD5 ($1) encryption.
config forwarding


====Firewall====
   option dest 'lan'
Below are the pertienent settings for vsFTPD in the /etc/config/firewall file;<syntaxhighlight lang="text">
config rule
option dest_port '20'
option src 'wan'
option name 'FTP_TCP_20'
list dest_ip 'W.X.Y.Z'
option target 'ACCEPT'
option family 'ipv4'
list proto 'tcp'


config rule
   option src 'wan'
option dest_port '21'
option src 'wan'
option name 'FTP_TCP_21'
list dest_ip 'W.X.Y.Z'
option target 'ACCEPT'
option family 'ipv4'
list proto 'tcp'


config rule
/etc/config/network
option src 'wan'
option name 'FTP_PASV'
list dest_ip 'W.X.Y.Z'
option target 'ACCEPT'
option family 'ipv4'
list proto 'tcp'
option dest_port '10012:10021'
</syntaxhighlight>And as usual, substitute a functional IP Address for W.X.Y.Z.  The above configuration includes settings necessary for Passive FTP (see [[wikipedia:File_Transfer_Protocol#Communication_and_data_transfer|here]] for an explanation) used by clients behind a firewall.


====Internet Explorer Workaround====
config interface 'TUN1'
If one is using Internet Explorer's FTP capability, there will be an issue if userlist_enable=YES and userlist_deny=NO are set.  Solution?  Add the users 'anonymous' in the vsftpd.user_list file.  Thanks to a top tip from a user named JAYCLEN here: https://bbs.archlinux.org/viewtopic.php?id=158184


====vsFTPD for a dual WAN router====
   option ifname 'tun1'
According to documentation, the vsFTPD Service / Daemon can only "listen" on a single IP Address (listen_address=W.X.Y.Z).  This also appears to apply to Passive FTP settings (pasv_address=W.X.Y.Z).  There is a solution.  Run multiple instances of vsFTPD.  Easy to say, but a bit more complex to accomplish.


Because of the simplicity of the /etc/init.d/vsftpd startup script, it is not possible to use the same binary / executable File (/usr/sbin/vsftpd) for multiple vsFTPD instances.  The solution is to create two symbolic links to the /usr/sbin/vsftpd binary / executable File.  Be sure to set the permissions on the new startup script to 755: chmod 755 WhatEverScriptFileName (chmod 755 /etc/init.d/vsftpd)
   option proto 'static'


*ln -s /usr/sbin/vsftpd /usr/sbin/vsftpd1
   option ipaddr 'W.X.Y.Z'
*ln -s /usr/sbin/vsftpd /usr/sbin/vsftpd2


This allows one to create two startup scripts in /etc/init.d for vsFTPD (vsftpd1 and vsftpd2) that contain the following (below is the vsftpd1 example);<syntaxhighlight lang="text">
   option netmask '255.255.255.0'<br />
#!/bin/sh /etc/rc.common
# Copyright (C) 2006-2011 OpenWrt.org


# Remember: There are two symbolic links in /usr/sbin, vsftpd1 and vsftpd2, that point to /usr/sbin/vsftpd
=====Certificate Management for OpenVPN with Webmin (see Webmin Section below)=====
First the reminders;


START=50
*Do NOT use Webmin for OpenVPN settings.  Instead use the LuCI GUI and / or edit text files (starting and stopping the service is fine)
*ONLY use it for Certificate management for OpenVPN.
*Watch out when clicking the "Keys list" link as it is very close to the Remove link.  If the Remove link is clicked, there is no confirmation about deleting the entire Certificate infrastructure.


start() {
======Configuring a Certificate Authority Infrastructure (Certificate Authority, Server Certificate, Client Certificate(s)======
# /var/run/vsftpd is the secure_chroot_dir default value that vsFTPD requires to run
For some odd reason (possibly troubleshooting), it is possible to create an OpenVPN infrastructure that transmits information ''without'' encryption.  That's a bit too "open".  In order to encrypt communication one must create a "Certificate Infrastructure".  This includes first, a Certificate Authority (CA), then a certificate for a Server, then certificate(s) for clients.
# It can be shared amongst multiple instances of vsFTPD
mkdir -m 0755 -p /var/run/vsftpd
service_start /usr/sbin/vsftpd1 /etc/vsftpd1.conf
}


stop() {
There are many tutorials on this, all of them use the command lineWebmin makes it very easy to do and keep track of certificatesEven with that capability, keeping things in an organized structure is importantThis includes naming conventionsA CA could be named Mary Poppins.  But that isn't very helpful as a name for a CA if others are involved in managing an infrastructure.
service_stop /usr/sbin/vsftpd1
}
</syntaxhighlight>For the other startup script (vsftpd2), copy and change the above references of vsftpd1 to vsftp2Be sure to enable (service vsftpd1 enable AND service vsftpd2 enable) both scripts for automatic startupThe reason for needing the above symbolic links can be seen in the above init.d startup scriptSpecifically the "service_stop /usr/sbin/vsftpd" (minus the 1 or 2 naming convention)If there were two startup scripts using the same /usr/sbin/vsftpd reference, two instances could be started, but when stopping the service / daemon, weird things happen.


Make sure there are two configuration files for each vsFTPD service / daemon as they'll have some unique settings, like IP Addresses, etc.
If the Webmin module is configured as noted below, the entire certificate infrastructure (minus OpenSSL settings) will be stored in /etc/openvpn/keys


Also make sure any additional files that are referenced (userlist_file=/etc/vsftpd1.user_list, etc) are duplicated (userlist_file=/etc/vsftpd2.user_list) for each service.
*Create a Certificate Authority
 
And finally, make sure the /etc/config/firewall file has the additional IP Address included.  Simply insert an additional ''list dest_ip 'A.B.C.D'<nowiki/>'' line after each ''list dest_ip 'W.X.Y.Z''' line in the above firewall example (of course substitute A.B.C.D with an appropriate IP Address).


====Webmin====
======Tips======
Download the module using WGET: wget http://www.bit-worker.com/download/vsftpd.tar.gz


Install using the Webmin interface: Webmin, Webmin configuration, Webmin Modules, Install from, From local file
*Change the date before configuring any CA infrastructure or Certificate to at least the previous day as sometimes a frustrating problem occurs where the created certificate is not yet valid.
*Routers with Multiple WAN Ports
**For any OpenVPN Server File, use this directive: multihome (research it or Google it)
*Had a "magic / matrix" moment happen when installing the LuCI GUI for OpenVPN.  OpenWRT instead downloaded the .ipk file and saved it in the /etc/init.d directory. That messed up all the init.d scripts after that


Available under: Server, vsftpd
====Webmin for OpenVPN and Certificate Management====
Only some features of the Webmin Module are useful.  First and foremost is the Certificate management.  Works great.  As noted above, watch out when clicking the "Keys list" link as it is very close to the Remove link.  If the Remove link is clicked, there is no confirmation about deleting the entire Certificate infrastructure.  Bad design, oh, well.


Webmin configuration;<syntaxhighlight lang="text">
Between the LuCI GUI and Certificate Management portion of Webmin, all aspects of OpenVPN can be conveniently controlled via a GUI interface.
openssl=/usr/bin/openssl
path=/etc/vsftpd1.conf


</syntaxhighlight>
The log display doesn't work properly, even when log files are configured properly.
Also note that vsFTPD module has a behavior where it will add items that are left blank in the GUI interface as commented out configuration items in the /etc/vsftpd.conf file.


For multiple vsFTPD instances, Webmin allows for cloning modules.  Remember to change the configuration file location if taking advantage of this feature.
Editing and managment of the OpenVPN service


====CAUTION!====
The Webmin module for OpenVPN & Certificate management is not a "standard module".


*If the configuration of vsFTPD includes the use of userlist_enable or userlist_deny, make sure that the /etc/vsftpd.user_list File is created with VI or NANO as opposed to a Windows utility through Samba. The reason is vsFTPD will not be able to read the file properly if it contains CR/LF (Carriage Return / Line Feeds).
*Install in the Webmin interface: Webmin, Webmin Configuration, Webmin Modules, Install from Local File, Select File, Install Module.
*If one reads any documentation about the CentOS (possible others) version of vsFTPD, there are references to using the included "user_list" file and a custom named version of the file. After some experimentation, it was determined that it may not work in the fashion noted for the OpenWRT version of vsFTPD as it does for other platforms. Feel free to experiment.
**Download the module if the Webmin interface doesn't populate with available modules
*It is worth repeating this warning: If any of the files (/var/run/vsftpd, vsftpd1.user_list, etc.) referenced in a vsFTPD configuration file are not present, the vsftpd service will start and appear to be functioning (PS, TOP, HTOP, etc. will all show it as running), but..There will be nothing displayed on client FTP software.
***Go to: https://www.webmin.com/cgi-bin/search_third.cgi?search=openvpn, then download the module using wget and the URL, as of 11.2020, wget http://www.openit.it/downloads/OpenVPNadmin/openvpn-3.2.wbm.gz
*If the background= setting is configured as background=NO (as one might do for troubleshooting), it will prevent a router from starting any services after vsFTPD.  Since vsFTPD's "start order" is 50, any services after that will not start.
****If wget displays an error, make sure the full version of wget is installed (not the one built into BusyBox): opkg install wget
*Several older forum postings and other web sites, as far back as 2007, make references to installing various additional pieces of software such as kmod-nf-ipvs-<ins>ftp</ins> along with other kernel modules. They are not necessary.
****If a certificate error occurs, add this to the end of the wget line: --no-check-certificate
*Remember, OpenWRT provides two different vsFTPD packages, one without FTPS capability (opkg install vsftpd) and one with FTPS capability (opkg install vsftpd-tls)
***Site: https://www.webmin.com/cgi-bin/search_third.cgi?modules=1
***OpenVPN & Certificate Management Module Link (version 3.2): http://www.openit.it/downloads/OpenVPNadmin/openvpn-3.2.wbm.gz
***Sometimes the interface seems to work, sometimes it doesn'tPossibly due to Wemin site issues or Perl issues on a local machine.
*By default, the OpenVPN... Module is located in Servers.  Given that it deals with Networking and an equivalent Module (PPTP) is located in Networking, it makes sense to relocate the Module to Networking
**Webmin, Webmin Configuration, Reassign Modules, OpenVPN..., Networking, Save


====Notes & Questions====
Below is a working configuration file for the OpenVPN & Certificate Authority Module (/etc/webmin/openvpn/config)<syntaxhighlight lang="text">
It seems very odd that the choice for FTP server that OpenWRT provides is vsFTPD as the latest version is half a decade old. Why not use something that still gets updated on a regular basis like ProFTPD?  Perhaps the developers of OpenWRT are attempting to send a quiet message that FTP is not a good thing to use because it is not encrypted. But if that's the case, why not remove every FTP server package that doesn't contain SFTP (SSH FTP) or FTPS (SSL/TSL FTP) functionality?
openvpn_path=/usr/sbin/openvpn
br_start_cmd=
openssl_version=1.1.1g
default_server=
br_end_cmd=
zip_cmd=/usr/bin/gzip
openssl_home=/etc/openvpn/openvpn-ssl.cnf
tail_cmd=
openvpn_pid_path=/var/run
log_refresh=
status_cmd=
start_cmd=/etc/init.d/openvpn start
openvpn_version=2.4.7
openvpn_clients_subdir=client
down_root_plugin=
openssl_path=/usr/bin/openssl
openvpn_pid_prefix=openvpn
openvpn_keys_subdir=keys
openvpn_home=/etc/openvpn
log_lines=9999
stop_cmd=/etc/init.d/openvpn stop
openvpn_servers_subdir=server
</syntaxhighlight>


====Tips for Troubleshooting====
====Notes====
As with anything related to computers, it can be difficult to figure out what is wrong with a configuration of a service and why it isn't working as expected.  vsFTPD is no exception.  To eliminate a potential issue, namely the firewall, consider configuring vsFTPD to listen on a LAN interface.  This will eliminate problems related to PASV / Passive FTP issues.  Also consider using a command line version of FTP as opposed to a browser version.  Command line versions of FTP will often times display more error information than a web browser that has FTP capability.


===Telnet===
*Use the OpenSSL version of OpenVPN (openvpn-openssl), not the mbedTLS (openvpn-mbedtls), and definately not openvpn-nossl (there is no security, but possibly good for testing configuration files)See [https://community.openvpn.net/openvpn/wiki/Using-mbedtls?__cf_chl_jschl_tk__=ff3c180e8bbe2b915b0183749a92b047e7d74777-1595651545-0-AX2laPnquTrHAziLcg-vt2ugt_LSqNFn5HBLAiMbNYHMAMochho8hSmQ7j94L_lu71l0UE4riG5ue4jwMfskumWXabSBHXcSICCRTMPy1isqlrz6XYDWZZg4sa7cpHJ1clUqABtwFpMLy4jJYqIGdq0MOqmzBR46YCIHim-bxfB_JtAqi4ZpLEfqyF1TSaEYaEaHn0sqxvx2T-8L6d6M3OcHUoL0SL3aoAokmm-mweQTmUWRXSlz4h94_u7DakllFWkPk_xpIAhCKsSNPon3M5Fd62uoFpZCPRFTHP8_nNuWT98oo-IbkeHi8oxbYKU1OQ here] for additional information
TelnetD is supported (and works) on DD-WRT, but OpenWRT has essentially discontinued use of telnet in the name of securityIt is possible to [https://openwrt.org/inbox/howto/telnet_enable build] a custom version of the OpenWRT firmware that supports telnetd (and telnet the client), but they've effectively made it very difficult (sad, but probably as it should be)The below section of the source configuration file for OpenWRT says it all;<div class="toccolours mw-collapsible mw-collapsed" style="overflow:auto; width=100%">
*If the /etc/config/openvpn file contains any sort of syntax error (if the file has been modified in a text editor for example), the configuration file will upload, but it will not be displayed as available in the LuCI OpenVPN GUI.
<div style="font-weight:bold;line-height:1.6;">Code Block</div>
*There's a bit of an issue with the OpenVPN LuCI interface when using the OVPN configuration file upload.  When the Browse button is clicked, the initial "Choose File to Upload" dialogue selects .ovpn as the default file extension.  This might lead one to believe that any files uploaded should have a file name that ends in .ovpn.  This is not the case.  A quick inspection of the /etc/init.d/openvpn file for the OpenVPN service reveals that it scans for files ending in .conf. So make sure any files uploaded via the LuCI GUI interface for OpenVPN end in .conf.
<div class="mw-collapsible-content"><syntaxhighlight lang="text">
*The /etc/openvpn Directory contains two sub-directories: client and server.  These are default OpenVPN directories, but it also implies that Server and Client configuration files should be placed in these directories.  This is not the caseAn examination of the /etc/init.d/openvpn OpenVPN configuration file revealse that it only scans the /etc/openvpn Directory for configuration files.  Additionally, the LuCI GUI interface for OpenVPN places the files in /etc/openvpn and does not scan the sever and client sub-directories for additional configuration files.
bool "telnetd"
*As of 8.2020, there is also an issue with the version number of of the LuCI GUI for OpenVPN (luci-app-openvpn).  The package version displayed via the System, Software page in the LuCI GUI displays git-2.229... Downloading the IPK file manually (opkg download luci-app-openvpn) results in version git-2.234...  Additionally, the installation or upgrade via the LuCI GUI for the OpenVPN LuCI GUI interface seems to be unreliable.  The recommendation is to download manually (opkg download luci-app-openvpn) and install the downloaded file (opkg install WhatEverTheNameOfTheFileIs)
default BUSYBOX_DEFAULT_TELNETD
*Sadly, possibly due to space constraints and the desire to have the smallest binary / executable file possible for OpenVPN, the OpenWRT version does not contain any "help" information (IE, openvpn --help produces no output)
select BUSYBOX_CONFIG_FEATURE_SYSLOG
*Do NOT use periods in the name of an OpenVPN instance in the /etc/config/openvpn file, ''config openvpn'' 'WhatEverName' directive. OpenVPN will work, but you won't see it in the LuCI GUI.
help
  A daemon for the TELNET protocol, allowing you to log onto the host
  running the daemon. Please keep in mind that the TELNET protocol
  sends passwords in plain text. If you can't afford the space for an
  SSH daemon and you trust your network, you may say 'y' here. As a
  more secure alternative, you should seriously consider installing the
  very small Dropbear SSH daemon instead:
        http://matt.ucc.asn.au/dropbear/dropbear.html


  Note that for busybox telnetd to work you need several things:
To install OpenVPN with OpenSSL and the LUCI GUI for it (under VPN)
  First of all, your kernel needs:
          CONFIG_UNIX98_PTYS=y


  Next, you need a /dev/pts directory on your root filesystem:
*opkg update
*opkg install openvpn-openssl openvpn-easy-rsa luci-app-openvpn luci-ssl-openssl (openssl-util and other dependencies will automatically install)
*OpenVPN will be available under LuCI GUI, VPN, OpenVPN (Remember to refresh the web browser window to display the new category (Firefox: CTRL + Refresh) or log out and log back into the LuCI GUI)


          $ ls -ld /dev/pts
===ProFTPD===
          drwxr-xr-x  2 root root 0 Sep 23 13:21 /dev/pts/
ProFTPD does not seem to be available as an OpenWRT package anymore.  At some point (appx. 2012 or earlier) it was, as evidenced by: https://openwrt.org/docs/guide-user/services/nas/ftp.overview


  Next you need the pseudo terminal master multiplexer /dev/ptmx:
Use vsFTPD instead.


          $ ls -la /dev/ptmx
===vsFTPD===
          crw-rw-rw-  1 root tty 5, 2 Sep 23 13:55 /dev/ptmx


  Any /dev/ttyp[0-9]* files you may have can be removed.
====Installation====
  Next, you need to mount the devpts filesystem on /dev/pts using:
opkg update


          mount -t devpts devpts /dev/pts
opkg install vsftpd


  You need to be sure that busybox has LOGIN and
====Configuration====
  FEATURE_SUID enabled. And finally, you should make
Configuration File: /etc/vsftpd.conf
  certain that Busybox has been installed setuid root:


        chown root.root /bin/busybox
*Be sure to read the
        chmod 4755 /bin/busybox
*The default configuration file (/etc/vsftpd.conf) for VSFTPD will never work under any circumstances for an OpenWRT router that is in a "normal" / default configuration in regards to its firewall and several other items.  It is understood that the OpenWRT developers have better things to do than configuring an old FTP server, but they may as well leave the configuration file blank or perhaps include all of the options, but comment everything out rather than having a configuration file that does nothing more than give an end user false hope.
*The OpenWRT Package creates an /etc/vsftpd Directory, but it isn't used.  Case in point: The default userlist_file name for the OpenWRT version of VSFTPD is /etc/vsftpd.user_list.  For other platforms such as CentOS, that file is located in the /etc/vsftpd Directory, but for OpenWRT it is located in the /etc Directory.  So why is the /etc/vsftpd Directory created (with nothing in it)?  Best guess is that since other Platforms like CentOS that put configuration files in the /etc/vsftpd Directory, there might be some "template" in the vsftpd source code that creates that Directory by default and the OpenWRT developers forgot to disable that function.
*The /etc/init.d/vsftpd startup script is very simple.  So simple in fact that it requires a setting (listen=YES) in the .conf file for vsFTPD for vsFTPD that documentation indicates is set to "yes" if vsFTPD is NOT run via an init.d script.  In OpenWRT's case, the startup script is so simple it essentially runs vsFTPD as if it were starting from the command line.  This causes no issues, but is a bit counter intutive if one reads the vsFTPD documentation on the "listen" directive.


  with all that done, telnetd _should_ work....
Below is a working configuration file;<syntaxhighlight lang="text">
</syntaxhighlight></div></div>
listen_address=W.X.Y.Z
Finding a version of BusyBox that includes TelnetD will not suffice as there are additional items that need to be configured for it to work. However, a telnet client program seems appropriate. See the "signoff" on TELNET here: https://github.com/openwrt/openwrt/commit/a35a7afc9f15b4c084c996ab0dbcd833b45f30d5  But there is an alternative (see the next section)
ftp_data_port=20
listen_port=21


===NETCAT or NC===
# Remember to configure Firewall settings with equivalent values
opkg update
pasv_enable=YES
pasv_address=W.X.Y.Z
pasv_min_port=10012
pasv_max_port=10021


opkg install netcat
session_support=NO


Use as a Telnet Client: nc -T -v W.X.Y.Z (-T = Answer using telnet negotiation, -v = Verbose)
# OpenWRT Oddity: Even though the vsFTPD Service / Daemon is started via an init.d script, it is a very simple script that essentially does the same thing as starting vsFTPD from the command line, so the following must be set to YES;
listen=YES


Instead of simply pressing the Enter Key in NETCAT, one must instead using the following key commands: CTRL+V, CTRL+M, ENTER (That equates to pressing the ENTER Key. OpenWRT's version of NETCAT in BusyBox does not include the -C switch which allows for easy "carriage returns")
# Banner display does not appear to function in an modern web browser
ftpd_banner=Hello
banner_file=/etc/vsftpd1.banner_file


===Statistics===
dirmessage_enable=YES
CollectD
message_file=.message
<br />


===Task Scheduling with Cron===
max_login_fails=3
Additional Information: https://openwrt.org/docs/guide-user/base-system/cron
anonymous_enable=NO
check_shell=NO


===BackUps===
#
chroot_local_user=YES
write_enable=NO
allow_writeable_chroot=YES
local_umask=022


====Restic====
# Equivalent to "Run As" Service / Daemon
opkg install restic
background=YES


To create a backup repository: restic init --repo "WhatEverRepositoryPath"
# Set logged items go to the vsFTPD log instead of the system message log
syslog_enable=NO


To make a backup: restic -r "WhatEverRepositoryPath" --verbose backup /WhatEverPathToBackUp
log_ftp_protocol=YES
xferlog_std_format=YES
xferlog_enable=YES
dual_log_enable=YES
vsftpd_log_file=/var/log/vsftpd1.standard.log
xferlog_file=/var/log/vsftpd1.xfer.log


*Example: restic -r "/mnt/sdb2/RESTIC/WRT3200ACM/" --verbose --tag "What Ever Note" backup /overlay
local_enable=YES
userlist_enable=NO
userlist_deny=NO


To view backups: restic -r "WhatEverRepositoryPath" snapshots
# In OpenWRT, the default location is: userlist_file=/etc/vsftpd.user_list (this is very odd given that OpenWRT creates an /etc/vsftpd Directory)
# On other platforms, like CentOS, the default location is /etc/vsftpd/vsftpd.conf
# Do NOT create the list in anything other than VI or NANO (IE, don't use Windows Explorer, Directory Opus, etc. to create a new file) as there is an issue with Carriage Return / Line Feeds.
# Editing with TextPad later is fine as it seems to respect how the file was created in terms of using CR/LF VS just LF.
userlist_file=/etc/vsftpd1.user_list


*Example: restic -r "/mnt/sdb2/RESTIC/WRT3200ACM/" snapshots
</syntaxhighlight>In the above working example, of course replace W.X.Y.Z with an appropriate IP Address.  Astute readers will notice all the file names that might generally start have "vsftpd" in their names instead have "vsftpd1".  The reason for that is because the above working configuration file was used in a situation where a router is configured with two WAN interfaces, with two IP Addresses on two different networks.  See the section on Dual WAN vsFTPD for additional information.


To restore a backup: restic -r "WhatEverRepositoryPath" restore WhatEverID --target /WhatEverPathToRestoreTo --no-cache (the ID can be obtained from the above "snapshots" command, the target does not have to be the original source, --verbose doesn't work)
The /etc/vsftpd1.user_list contains a list of users that will be allowed to login if the userlist_enable=YES and userlist_deny=NO settings are present.


There is a really frustrating problem with Restic on OpenWRT when restoring a backup. Many websites recommend setting the TMPDIR environment variable to a location with a lot of space. Sadly that does not work.  With careful observation, it was noticed that Retic sets up a cache file in the current user's "home / root" directory.  If one is logged on as the "root" user, then this will be the /root, AKA ~ (tilde), Directory. If one has booted up the router using from the internal flash drive while attempting to recover a backup that normally resides on a USB Flash Drive and is normally mounted on /overlay, the 60 or 70 some odd MB on the internal Flash Drive will quickly fill up and cause a no space left on device" error.  The simple solution when restoring is to use the --no-cache directive as shown in the above example.  For additional information, see here: https://restic.readthedocs.io/en/latest/manual_rest.html (scroll down to the Caching section)Also make sure plenty of RAM is available.  IE, the 512 MB built in may not be sufficient, so be sure to enable a SWAP File or SWAP Partition (see section above on SWAP)
NOTE 1: If any of the above referenced files (vsftpd1.user_list, etc.) are not present, the vsftpd service will start and appear to be functioning (PS, TOP, HTOP, etc. will all show it as running), but...  There will be nothing displayed on client FTP software.


Additional Information: https://restic.readthedocs.io/en/stable/ (Note: In some of their examples a tilde ( ~ ) is used, which is a user's home directory)
NOTE 2: Users and Groups can be managed by editing the /etc/passwd (User File) and /etc/group (Group File).  If Webmin (see below) is installed and properly configured, Users & Groups can be managed through its interface.  The useradd command can be added with: opkg install shadow-useradd


====DD====
NOTE 3: Remember, OpenWRT also uses the /etc/shadow file to store user passwords with MD5 ($1) encryption.
DD is a program that functions as a cloning utility, among other capabilities and functions (noted in an earlier section for a different purpose).  When cloning an entire drive (SSD in the form of an mSATA, M.2 (NVME, NGFF), etc. device) / disk / flash drive* (* the term "drive" used later in this section will apply to whatever storage medium is being cloned), the image file should of couse be cloned to a separate device as with any other cloning software.  DD is capable of cloning an entire drive, etc. or a single partition


Note, the DD command is built into BusyBox, but does not have all options available. To take advantage of all the options DD offers, install the full package with this command: opkg install corutils
====Firewall====
Below are the pertienent settings for vsFTPD in the /etc/config/firewall file;<syntaxhighlight lang="text">
config rule
option dest_port '20'
option src 'wan'
option name 'FTP_TCP_20'
list dest_ip 'W.X.Y.Z'
option target 'ACCEPT'
option family 'ipv4'
list proto 'tcp'


Below is a generic example command to clone a partition from one drive to another (remember, any data on the destination will be overwritten);
config rule
option dest_port '21'
option src 'wan'
option name 'FTP_TCP_21'
list dest_ip 'W.X.Y.Z'
option target 'ACCEPT'
option family 'ipv4'
list proto 'tcp'


*dd if=/dev/sdXy of=/dev/sdXy bs=64K conv=noerror,sync status=progress
config rule
**sdXy = X is the drive (as in sda, sdb, sdc, etc.) and y is the partition (sda1, sdb1, sdb3, sdc2, etc.), In Linux, sd = Storage Device, sda is the first storage device which is more or less equivalent to C: in Windows, see https://en.wikipedia.org/wiki/Device_file#Naming_conventions for more information.
option src 'wan'
**if = source
option name 'FTP_PASV'
**of = destination
list dest_ip 'W.X.Y.Z'
**conv=noerror,sync = Don't stop for any read errors and make sure any data stored in RAM / Buffers is written to the physical drive
option target 'ACCEPT'
**status = Show progress
option family 'ipv4'
**bs=block size, amount of source data to be read and then written, IE read 64K at a time, then write that, and repeat.
list proto 'tcp'
**conv = noerror = Don't stop on read errors, sync = If an error occurs use zeros or nuls to pad file, progress=show the progress
option dest_port '10012:10021'
</syntaxhighlight>And as usual, substitute a functional IP Address for W.X.Y.Z. The above configuration includes settings necessary for Passive FTP (see [[wikipedia:File_Transfer_Protocol#Communication_and_data_transfer|here]] for an explanation) used by clients behind a firewall.


=====Tip for Preparing a Drive or Partition for Cloning to an Image File=====
====Internet Explorer Workaround====
Before cloning a partition to an image file, to save space on the image file, "zero out" all unallocated space.
If one is using Internet Explorer's FTP capability, there will be an issue if userlist_enable=YES and userlist_deny=NO are set.  Solution?  Add the users 'anonymous' in the vsftpd.user_list file.  Thanks to a top tip from a user named JAYCLEN here: https://bbs.archlinux.org/viewtopic.php?id=158184


With every file system there are potentially sections of the drive that have had data written to them at some point in time that has since been erased.  And as we all know, when a file is "erased" from a drive, the actual file itself is left on the drive and the space it occupied is simply marked as available in a file systemDD has no method of determining alocated or unallocated space. It copies everythingAnd in the below example where everything it copies is put into a compressed TAR file, compressing a bunch of zeros is very easy to make quite smallIE, "zeroing out" unallocated space on a disk drive really reduces the size of an image file in a compressed fileAdvanced cloning utilities like Acronis True Image, Clonezilla, etc. take care of this automatically.  But since DD is a multifaceted utility that isn't specifically designed for cloning, it does not have this capability built in.
====vsFTPD for a dual WAN router====
According to documentation, the vsFTPD Service / Daemon can only "listen" on a single IP Address (listen_address=W.X.Y.Z)This also appears to apply to Passive FTP settings (pasv_address=W.X.Y.Z)There is a solutionRun multiple instances of vsFTPDEasy to say, but a bit more complex to accomplish.


The below example writes 0s / zeros to a file named ZeroByteFile in a directory named overlay (that happens to be located on a USB Flash Drive) in 64 Kilobyte chunks (of all the words like portion, segment, section, piece, etc., chunk is the most commonly used word in this instance with block coming in second)
Because of the simplicity of the /etc/init.d/vsftpd startup script, it is not possible to use the same binary / executable File (/usr/sbin/vsftpd) for multiple vsFTPD instances.  The solution is to create two symbolic links to the /usr/sbin/vsftpd binary / executable File.  Be sure to set the permissions on the new startup script to 755: chmod 755 WhatEverScriptFileName (chmod 755 /etc/init.d/vsftpd)


*dd if=[[wikipedia:/dev/zero|/dev/zero]] bs=64K conv=noerror,sync status=progress of=/overlay/ZeroByteFile (change the destination to suit your needs)
*ln -s /usr/sbin/vsftpd /usr/sbin/vsftpd1
*sync (this writes any unwritten files stored in RAM / Buffer to the physical media)
*ln -s /usr/sbin/vsftpd /usr/sbin/vsftpd2
*rm ZeroByteFile (this deletes the "Zero Byte File" to free up space as the above DD command made the ZeroByteFile as large as all of the available free space on the drive.)


=====Partition Cloning Example=====
This allows one to create two startup scripts in /etc/init.d for vsFTPD (vsftpd1 and vsftpd2) that contain the following (below is the vsftpd1 example);<syntaxhighlight lang="text">
The below example(s) copies a single partition (on a drive that contains multiple partitions) in 64K chunks to an image in a compressed (TAR / GZ (GunZip)) file.
#!/bin/sh /etc/rc.common
# Copyright (C) 2006-2011 OpenWrt.org


*Generic Example: dd if=/dev/sdXy conv=sync,noerror bs=64K status=progress | gzip -c  > /WhatEverPath/WhatEverFile.img.gz (-c=Do not change files)
# Remember: There are two symbolic links in /usr/sbin, vsftpd1 and vsftpd2, that point to /usr/sbin/vsftpd
**Example: dd if=/dev/sdb1 conv=sync,noerror bs=64K status=progress | gzip -c  > /mnt/sdb2/DD/EXT4a-9.20.2020.img.gz (this file is named after the partition it exists on and the date, but can be named anything)


Remember, the TAR/GZ file will contain a single image file, which in turn contains all of the individual files and directories from the source partition or drive (similar to an ISO File or files created by other cloning software).
START=50


=====Tip for Configuring a Cloned Drive after Cloning=====
start() {
WARNING: When cloning an entire drive, ''everything'' will be cloned, including the [[wikipedia:Universally_unique_identifier|UUID]] of the partition.  One of the "U"s in UUID stands for "unique".  After a drive is cloned, the UUID isn't "unique" anymore.  Two drives will have the same UUID.  If the second flash drive is being used for the sole purpose of backing up settings with the intent of disconnecting the drive and putting it aside, the UUID can be left as it is. If the second drive is left connected the UUID should be changed to to prevent confusion with the source drive.  The below command will change the UUID to a random ID (see above section for installing the tune2fs utility)
# /var/run/vsftpd is the secure_chroot_dir default value that vsFTPD requires to run
# It can be shared amongst multiple instances of vsFTPD
mkdir -m 0755 -p /var/run/vsftpd
service_start /usr/sbin/vsftpd1 /etc/vsftpd1.conf
}


*tune2fs -U random /dev/sdXy*
stop() {
*It might be necessary to run this command first: e2fsck -f /dev/sdXy (this is equivalent to CHKDSK in windows, where sdXy should be changed to match the appropriate drive, sda1, sdb2, etc.)
service_stop /usr/sbin/vsftpd1
}
</syntaxhighlight>For the other startup script (vsftpd2), copy and change the above references of vsftpd1 to vsftp2.  Be sure to enable (service vsftpd1 enable AND service vsftpd2 enable) both scripts for automatic startup.  The reason for needing the above symbolic links can be seen in the above init.d startup script.  Specifically the "service_stop /usr/sbin/vsftpd" (minus the 1 or 2 naming convention).  If there were two startup scripts using the same /usr/sbin/vsftpd reference, two instances could be started, but when stopping the service / daemon, weird things happen.


This command will change the UUID to the one specified;
Make sure there are two configuration files for each vsFTPD service / daemon as they'll have some unique settings, like IP Addresses, etc.


*tune2fs -U UUID /dev/sdXy* (where UUID is the actual UUID)
Also make sure any additional files that are referenced (userlist_file=/etc/vsftpd1.user_list, etc) are duplicated (userlist_file=/etc/vsftpd2.user_list) for each service.


To verify the change, use the following command;
And finally, make sure the /etc/config/firewall file has the additional IP Address included.  Simply insert an additional ''list dest_ip 'A.B.C.D'<nowiki/>'' line after each ''list dest_ip 'W.X.Y.Z''' line in the above firewall example (of course substitute A.B.C.D with an appropriate IP Address).


*blkid /dev/sdXy
====Webmin====
Download the module using WGET: wget http://www.bit-worker.com/download/vsftpd.tar.gz


<nowiki>*</nowiki> In the above examples X and y should be replaced with actual mount point references.  IE, sda1, sdb3, sde2, etc.
Install using the Webmin interface: Webmin, Webmin configuration, Webmin Modules, Install from, From local file


=====Accessing an Image File (IE, mount it like a drive)=====
Available under: Server, vsftpd
In the above example where a partition was cloned to an image file, utilities like WinRAR, WinImage, etc. cannot be used to access the file.  Since the image file represents an entire drive or partition, it can be mounted just like a physical drive.


To mount a partition (not a drive);
Webmin configuration;<syntaxhighlight lang="text">
openssl=/usr/bin/openssl
path=/etc/vsftpd1.conf


*mkdir /tmp/MyMountPoint (the directory can be any directory or file name, an advantage to using the /tmp directory is one doesn't have to worry about dismounting the image as it will not be mounted after a router reboot because the mount point is in the /tmp directory, the image file will exist of course, assuming it is not also in the /tmp directory)
</syntaxhighlight>
*mount -o loop -t WhatEverFileSystem /WhatEverPath/WhatEverImage.img /tmp/MyMountPoint
Also note that vsFTPD module has a behavior where it will add items that are left blank in the GUI interface as commented out configuration items in the /etc/vsftpd.conf file.
**-t = the type of file system (this could be -t vfat, -t ntfs, -t ext2, -t ext4 etc., and it should obviously match the type of the original file system, no experiments were done to see if mount utility could "auto detect" the file system, but it may have the capability)
**-o = Option (let the mount command know it is a "loop" device)


The mounted image file will be accessible at the
For multiple vsFTPD instances, Webmin allows for cloning modules.  Remember to change the configuration file location if taking advantage of this feature.


====Good 'ole Fashion, just make a copy====
====CAUTION!====
Forget all the fancy backup stuff for this one.  Sometimes it's good just to make a manual copy of things.  This method works great for configuration files.  Not so much to avoid a failed drive, but more to preserve a working copy of a known good configuration file.  The idea is whenever one embarks on an upgrade or a major change (even a minor one too) to a service, sometimes it's good to make a copy of a working configuration file.  For instance, using the /etc/config/network configuration file: cp /etc/config/network /etc/config/network-09.30.2020  There, a copy of the original file with a date on the end of it.  Simple and effective if one needs to take a "single step back", instead of walking through the complexity of restoring files from Restic or a DD Tar.GZ file.


==Border Mail System (Postfix, MailScanner, MailWatch, ClamD,==
*If the configuration of vsFTPD includes the use of userlist_enable or userlist_deny, make sure that the /etc/vsftpd.user_list File is created with VI or NANO as opposed to a Windows utility through Samba.  The reason is vsFTPD will not be able to read the file properly if it contains CR/LF (Carriage Return / Line Feeds).
*If one reads any documentation about the CentOS (possible others) version of vsFTPD, there are references to using the included "user_list" file and a custom named version of the file.  After some experimentation, it was determined that it may not work in the fashion noted for the OpenWRT version of vsFTPD as it does for other platforms.  Feel free to experiment.
*It is worth repeating this warning: If any of the files (/var/run/vsftpd, vsftpd1.user_list, etc.) referenced in a vsFTPD configuration file are not present, the vsftpd service will start and appear to be functioning (PS, TOP, HTOP, etc. will all show it as running), but...  There will be nothing displayed on client FTP software.
*If the background= setting is configured as background=NO (as one might do for troubleshooting), it will prevent a router from starting any services after vsFTPD.  Since vsFTPD's "start order" is 50, any services after that will not start.
*Several older forum postings and other web sites, as far back as 2007, make references to installing various additional pieces of software such as kmod-nf-ipvs-<ins>ftp</ins> along with other kernel modules.  They are not necessary.
*Remember, OpenWRT provides two different vsFTPD packages, one without FTPS capability (opkg install vsftpd) and one with FTPS capability (opkg install vsftpd-tls)


===Postfix===
====Notes & Questions====
It seems very odd that the choice for FTP server that OpenWRT provides is vsFTPD as the latest version is half a decade old.  Why not use something that still gets updated on a regular basis like ProFTPD?  Perhaps the developers of OpenWRT are attempting to send a quiet message that FTP is not a good thing to use because it is not encrypted.  But if that's the case, why not remove every FTP server package that doesn't contain SFTP (SSH FTP) or FTPS (SSL/TSL FTP) functionality?


====Files & Permissions====
====Tips for Troubleshooting====
Configuration: /etc/postfix (that's a directory, not a file)
As with anything related to computers, it can be difficult to figure out what is wrong with a configuration of a service and why it isn't working as expected.  vsFTPD is no exception.  To eliminate a potential issue, namely the firewall, consider configuring vsFTPD to listen on a LAN interface.  This will eliminate problems related to PASV / Passive FTP issues.  Also consider using a command line version of FTP as opposed to a browser version.  Command line versions of FTP will often times display more error information than a web browser that has FTP capability.


Startup Script: /etc/init.d/postfix
===Telnet===
TelnetD is supported (and works) on DD-WRT, but OpenWRT has essentially discontinued use of telnet in the name of security.  It is possible to [https://openwrt.org/inbox/howto/telnet_enable build] a custom version of the OpenWRT firmware that supports telnetd (and telnet the client), but they've effectively made it very difficult (sad, but probably as it should be).  The below section of the source configuration file for OpenWRT says it all;<div class="toccolours mw-collapsible mw-collapsed" style="overflow:auto; width=100%">
<div style="font-weight:bold;line-height:1.6;">Code Block</div>
<div class="mw-collapsible-content"><syntaxhighlight lang="text">
bool "telnetd"
default BUSYBOX_DEFAULT_TELNETD
select BUSYBOX_CONFIG_FEATURE_SYSLOG
help
  A daemon for the TELNET protocol, allowing you to log onto the host
  running the daemon. Please keep in mind that the TELNET protocol
  sends passwords in plain text. If you can't afford the space for an
  SSH daemon and you trust your network, you may say 'y' here. As a
  more secure alternative, you should seriously consider installing the
  very small Dropbear SSH daemon instead:
        http://matt.ucc.asn.au/dropbear/dropbear.html


Main Binary / Executable Files: /usr/sbin/post*
  Note that for busybox telnetd to work you need several things:
  First of all, your kernel needs:
          CONFIG_UNIX98_PTYS=y


Additional Binary / Executable Files: /usr/sbin/sendmail* (sendmail related compatibility)
  Next, you need a /dev/pts directory on your root filesystem:


Other Binary / Executalbe Files: /usr/bin/mailq, mailq.postfix, newaliaases, newaliases.postfix (sendmail related compatibility)
          $ ls -ld /dev/pts
          drwxr-xr-x  2 root root 0 Sep 23 13:21 /dev/pts/


Library (sub-function) Files: /usr/libexec/postfix
  Next you need the pseudo terminal master multiplexer /dev/ptmx:


There is no LuCI GUI or any sort of OpenWRT configuration paradigm. Everything can be configured via text files and all safely done with Webmin.
          $ ls -la /dev/ptmx
          crw-rw-rw- 1 root tty 5, 2 Sep 23 13:55 /dev/ptmx


Postfix User and Group items are configured in /etc/passwd and /etc/group automatically.
  Any /dev/ttyp[0-9]* files you may have can be removed.
  Next, you need to mount the devpts filesystem on /dev/pts using:


Owner for /etc/postfix: root:root
          mount -t devpts devpts /dev/pts


Permissions for /etc/postfix: 644
  You need to be sure that busybox has LOGIN and
  FEATURE_SUID enabled. And finally, you should make
  certain that Busybox has been installed setuid root:


====Commands====
        chown root.root /bin/busybox
        chmod 4755 /bin/busybox


*postconf -d (configuration settings)
  with all that done, telnetd _should_ work....
*postmap /etc/postfix/transport (updates the transport.db file)
</syntaxhighlight></div></div>
**Note: Most linux distributions name the transport database file transport.db, but by default the OpenWRT version of Postfix names it transport.cdb
Finding a version of BusyBox that includes TelnetD will not suffice as there are additional items that need to be configured for it to work. However, a telnet client program seems appropriate.  See the "signoff" on TELNET here: https://github.com/openwrt/openwrt/commit/a35a7afc9f15b4c084c996ab0dbcd833b45f30d5  But there is an alternative (see the next section)
*postfix reload (after changes are made to master.cf file, or just restart the service)


====Warnings====
===NETCAT or NC===
The below warning message(s) are displayed each time Postfix is started.  This is because OpenWRT left the default setting ''smtputf8_enable = 0'' when Postfix was compiled.  The ''smtputf8_enable'' setting relates to other text encoding (UTF8), etc.  According to documentation it creates a much larger binary / executable for Postfix.  Since OpenWRT focuses on small and compact service files this makes sense.  But the fix is easy.  Add this line to the /etc/postfix/main.cf file: smtputf8_enable = no<syntaxhighlight lang="text">
opkg update
postfix: warning: smtputf8_enable is true, but EAI support is not compiled in
postsuper: warning: smtputf8_enable is true, but EAI support is not compiled in
postfix/postlog: warning: smtputf8_enable is true, but EAI support is not compiled in
postfix/postfix-script: starting the Postfix mail system
</syntaxhighlight>


===MailScanner===
opkg install netcat
Download the latest version from: https://github.com/MailScanner/v5/releases (The year this was written was 2020, so if they've moved onto v6, check the URL)


tar -xvzf WhatEverTheNameOfTheTarGzFile
Use as a Telnet Client: nc -T -v W.X.Y.Z (-T = Answer using telnet negotiation, -v = Verbose)


The installation script ./install.sh relies on the full BASH shell (OpenWRT includes the [[wikipedia:Almquist_shell|ASH]] shell by default): opkg install bash, then type the command ''bash ./install.sh'' (plain ASH won't work, they even explicitly state the [[wikipedia:Shebang_(Unix)|shebang]] of their file as ''#!/bin/bash'', not #!/bin/sh, and just for the fun of it attempted to run it with ASH, and it errors out) Read here for more information or to change it permanently: https://www.howtogeek.com/669835/how-to-change-your-default-shell-on-linux-with-chsh/
Instead of simply pressing the Enter Key in NETCAT, one must instead using the following key commands: CTRL+V, CTRL+M, ENTER (That equates to pressing the ENTER Key. OpenWRT's version of NETCAT in BusyBox does not include the -C switch which allows for easy "carriage returns")


===NTP (Network Time Protocol)===
===Statistics===
By default OpenWRT provides an NTP Client ''and Server'' (suprise, suprise, and a really good thing) within [[wikipedia:BusyBox|BusyBox]].  Since most routers (if any) do not provide a method (IE, battery) of maintaining an internal clock when the router is off a method must exist to set the proper time for the router when it starts up.  This client service is supplied within the BusyBox version of ntpclient.
CollectD
<br />


It is also possible to install the full version of ntpclient (opkg install ntpclient) along with a LuCI GUI (opkg install luci-app-ntpc).  No research was done on the difference between the two versions of the ntp client as the BusyBox version of ntpclient satisfied all functional needs.
===Task Scheduling with Cron===
Additional Information: https://openwrt.org/docs/guide-user/base-system/cron


For and NTP Daemon / Server, the BusyBox also includes NTPD.  A full version of NTPD can be installed (opkg install ntpd), but there is no LuCI GUI inteface as there is with the client.  An alternative NTP client, CHRONYD can be installed (opkg install chonry) instead of NTPD.  But since the daemon / server version of NTPD in BusyBox will function for client NTP devices (including Windows) no further research was done on alternative NTP daemons / services like NTPD or CHRONYD.
===BackUps===


One additional note worth mentioning relates to internet service providers.  Some providers, such as AT&T, block client devices attempting to using the NTP protocol to syncronize clocks.  Some websites indicate this is a "slow-down" or some other type of limit imposed on the NTP protocol, but the end result is the same.  And that end result is the NTP protocol does not work.  And that means devices, computers, etc. are not able to syncronize with a time server.  AT&T claims this is for security reasons.  HA!  See more information about it here: https://about.att.com/sites/broadband/network
====Restic====
opkg install restic


==Webmin==
To create a backup repository: restic init --repo "WhatEverRepositoryPath"
Webmin can be successfully installed on OpenWRT, '''AND IT IS USEFUL''' (unlike so many other ignorant (notice the word 'stupid' wasn't used, but they are) web posters claim or question).  The end of the previous sentence is in all CAPS and '''BOLD''' because of the large number websites and posts that do nothing more than question why anyone would want to install Webmin on OpenWRT instead of just answering the original question of how to install it.  Sometimes it is just nice to have a GUI.  The editor for config files alone is worth it.


There is however a word of caution to address: Do NOT use Webmin for any OpenWRT services that have an associated LuCI GUI or /etc/config/WhatEverConfigurationFile because modifications made by Webmin will be wiped out by changes made via LuCI or the /etc/config/Files...  There are many, many services such as BIND / NAMED, Apache / HTTPD, ProFTPD, OpenSSL for OpenVPN Certificate generation that have no LuCI GUI, nor are they "controlled" or configured via the /etc/config/ Files.  That means these services are safe to configure via text or by GUI.
To make a backup: restic -r "WhatEverRepositoryPath" --verbose backup /WhatEverPathToBackUp


===Pre-Installation Tasks for Installing Webmin===
*Example: restic -r "/mnt/sdb2/RESTIC/WRT3200ACM/" --verbose --tag "What Ever Note" backup /overlay
Download the Webmin ...tar.gz file: wget https://prdownloads.sourceforge.net/webadmin/webmin-1.953.tar.gz


Unzip and UnTAR the file;
To view backups: restic -r "WhatEverRepositoryPath" snapshots


*The location chosen when unzipping and untarring Webmin ''can'' be the installation directory where the program runs;
*Example: restic -r "/mnt/sdb2/RESTIC/WRT3200ACM/" snapshots
**Typical installation locations for other Linux distributions (do NOT use the /tmp directory or it will be gone when the router reboots);
***CentOS typical location: /usr/libexec/webmin
***Debian: /usr/share/webmin
***Locations suggested by Webmin tutorials: /usr/libexec/webmin, /usr/local/webmin
***Location noted by https://doxfer.webmin.com/Webmin/Installation_-_the_old_fashioned_way as the most common for "TAR" Installations: /usr/local/webmin
*gunzip webmin-1.955.tar.gz and tar xvf webmin-1.955.tar


OR
To restore a backup: restic -r "WhatEverRepositoryPath" restore WhatEverID --target /WhatEverPathToRestoreTo --no-cache (the ID can be obtained from the above "snapshots" command, the target does not have to be the original source, --verbose doesn't work)


*tar zxvf webmin-1.955.tar
There is a really frustrating problem with Restic on OpenWRT when restoring a backup.  Many websites recommend setting the TMPDIR environment variable to a location with a lot of space.  Sadly that does not work.  With careful observation, it was noticed that Retic sets up a cache file in the current user's "home / root" directory.  If one is logged on as the "root" user, then this will be the /root, AKA ~ (tilde), Directory.  If one has booted up the router using from the internal flash drive while attempting to recover a backup that normally resides on a USB Flash Drive and is normally mounted on /overlay, the 60 or 70 some odd MB on the internal Flash Drive will quickly fill up and cause a no space left on device" error.  The simple solution when restoring is to use the --no-cache directive as shown in the above example.  For additional information, see here: https://restic.readthedocs.io/en/latest/manual_rest.html (scroll down to the Caching section). Also make sure plenty of RAM is available. IE, the 512 MB built in may not be sufficient, so be sure to enable a SWAP File or SWAP Partition (see section above on SWAP)


(be patient, there are a LOT of files, even on a fast USB 3.0 flash drive it takes a couple of minutes.
Additional Information: https://restic.readthedocs.io/en/stable/ (Note: In some of their examples a tilde ( ~ ) is used, which is a user's home directory)


*If "untarred" a directory other than the installation, do one of the following;
====DD====
**Move the untarred directory to the desired location
DD is a program that functions as a cloning utility, among other capabilities and functions (noted in an earlier section for a different purpose).  When cloning an entire drive (SSD in the form of an mSATA, M.2 (NVME, NGFF), etc. device) / disk / flash drive* (* the term "drive" used later in this section will apply to whatever storage medium is being cloned), the image file should of couse be cloned to a separate device as with any other cloning software. DD is capable of cloning an entire drive, etc. or a single partition
**When installing use the command (not yet): ./setup.sh /WhatEverPath
 
*Before running the setup program;
**Add the bin Group to /etc/group using this: bin:x:10000:
**Make sure PERL is installed with necessary modules
***opkg update
***opkg install perl perlbase-http-tiny coreutils-stty perlbase-gdbm-file perlbase-extutils perlbase-storable
**Possible Errors & Solutions during and after Installation;
***"Perl Socket module not installed" Error will occur if perlbase-http-tiny is not installed.
***"stty: not found" / "Login password: ./setup.sh: line 396: stty: not found" (the line number may be different depending on the version of the setup script an Webmin being installed) Error will occur if coreutils-stty is not installed
***"The Perl SSLeay library is not installed. SSL not available" Error will occur because the PERL SSLeay module is not available in OpenWRT
***"Can't locate Time/Local.pm in" / "you may need to install the Time::Local module" will occur if the perlbase-time module is not installed
***"No dbm on this machine at" error will occur if perlbase-gdbm-file
***"Error - Perl execution failed  Undefined subroutine &main::get_miniserv_config called at /usr/local/webmin/authentic-theme/session_login.cgi line 17" and / or ""GET / HTTP/1.1" 500 166" (in miniserv.log file) error occurs if perlbase-storable is not installed
***"Can't locate ExtUtils/CBuilder.pm in @INC (you may need to install the ExtUtils::CBuilder module" error occurs if perlbase-extutils is not installed
***" can't open '/var/log/webmin/miniserv.pid': No such file or directory" error occurs when stopping Webmin with /etc/webmin/stop


====A Special note on HTTPS (not the Module) for Webmin: Do NOT worry about it.  Forget it.  Almost impossible to get working.====
Note, the DD command is built into BusyBox, but does not have all options availableTo take advantage of all the options DD offers, install the full package with this command: '''''opkg install coreutils-dd'''''
During installation, Webmin states the Net::SSLeay Perl Module is necessary for HTTPS to workIf not, the Webmin site is only accessible via HTTP.


The instructions on the Webmin site for enabling this functionality are here (Hint: It won't work): http://www.webmin.com/ssl.html
Below is a generic example command to clone a partition from one drive to another (remember, any data on the destination will be overwritten);


Here's why;
*dd if=/dev/sdXy of=/dev/sdXy bs=64K conv=noerror,sync status=progress
**sdXy = X is the drive (as in sda, sdb, sdc, etc.) and y is the partition (sda1, sdb1, sdb3, sdc2, etc.), In Linux, sd = Storage Device, sda is the first storage device which is more or less equivalent to C: in Windows, see https://en.wikipedia.org/wiki/Device_file#Naming_conventions for more information.
**if = source
**of = destination
**conv=noerror,sync = Don't stop for any read errors and make sure any data stored in RAM / Buffers is written to the physical drive
**status = Show progress
**bs=block size, amount of source data to be read and then written, IE read 64K at a time, then write that, and repeat.
**conv = noerror = Don't stop on read errors, sync = If an error occurs use zeros or nuls to pad file, progress=show the progress
 
=====Tip for Preparing a Drive or Partition for Cloning to an Image File=====
Before cloning a partition to an image file, to save space on the image file, "zero out" all unallocated space.
 
With every file system there are potentially sections of the drive that have had data written to them at some point in time that has since been erased.  And as we all know, when a file is "erased" from a drive, the actual file itself is left on the drive and the space it occupied is simply marked as available in a file system.  DD has no method of determining alocated or unallocated space.  It copies everything.  And in the below example where everything it copies is put into a compressed TAR file, compressing a bunch of zeros is very easy to make quite small.  IE, "zeroing out" unallocated space on a disk drive really reduces the size of an image file in a compressed file.  Advanced cloning utilities like Acronis True Image, Clonezilla, etc. take care of this automatically.  But since DD is a multifaceted utility that isn't specifically designed for cloning, it does not have this capability built in.
 
The below example writes 0s / zeros to a file named ZeroByteFile in a directory named overlay (that happens to be located on a USB Flash Drive) in 64 Kilobyte chunks (of all the words like portion, segment, section, piece, etc., chunk is the most commonly used word in this instance with block coming in second)
 
*dd if=[[wikipedia:/dev/zero|/dev/zero]] bs=64K conv=noerror,sync status=progress of=/overlay/ZeroByteFile (change the destination to suit your needs)
**When the /overlay partition is full DD will produce an error (IE, the partition is full, which is the objective, so this is a good "error")
*sync (this writes any unwritten files stored in RAM / Buffer to the physical media)
*rm /overlay/ZeroByteFile (this deletes the "Zero Byte File" to free up space as the above DD command made the ZeroByteFile as large as all of the available free space on the drive.)
 
=====Backing Up a Partition using DD Example (AKA Imaging OR IE, Partition Cloning via a TAR / GZ File)=====
The below example(s) copies a single partition (on a drive that contains multiple partitions) in 64K chunks to an image in a compressed (GZ (GunZip), no need to "TAR" it as there is just a single image file that will be created) file.
 
*Generic Example: dd if=/dev/sdXy conv=sync,noerror bs=64K status=progress | gzip -9 -c  > /WhatEverPath/WhatEverFile.img.gz (-c=Do not change files, -9=Best Compression, but slower)
**Example: dd if=/dev/sdb1 conv=sync,noerror bs=64K status=progress | gzip -c  > /mnt/sdb2/DD/EXT4a-9.20.2020.img.gz (this file is named after the partition it exists on and the date, but can be named anything)
 
Remember;


*The Net::SSLeay Perl Module is not available in OpenWRT, nor is and trying to build said modules results the error "fatal error: EXTERN.h: No such file or directory".  OpenWRT does not include some of the GCC files necessary. Several sites (https://www.perlmonks.org/?node_id=1227113) mention using an external cross compile computer as a method of solving the issue
*The TAR/GZ file will contain a single image file, which in turn contains all of the individual files and directories from the source partition or drive (similar to an ISO File or files created by other cloning software).
*Crypt::SSLeay is not available either, becuase there seems to be an issue (https://rt.cpan.org/Public/Bug/Display.html?id=120862) with the Crypt-SSLeay-0.72.tar.gz version that is attempted to download during compile. But even the newer version (https://cpan.metacpan.org/authors/id/N/NA/NANIS/) doesn't work either.  Downloading the newer version (https://cpan.metacpan.org/authors/id/N/NA/NANIS/Crypt-SSLeay-0.73_06.tar.gz) and changing the Makefile.PL line ( unless( require( catfile qw(inc IO Interactive Tiny.pm) ) ) { ) to ( unless( require( catfile qw(IO Interactive Tiny.pm) ) ) { ), to get rid of the inc corrects the issue.  But then there's a "fatal error: openssl/opensslv.h" issue that is similar to the above mentioned Net:SSLeay issue where OpenWRT does not make certain Devel files available, in this case for OpenSSL, so the cross compiling method is the only solution available.
*If DD is used with out GZ, the resulting file produced by DD will be exactly the same size as the partition it is "cloning". This is because DD has no facility to do data compression.
*Some information suggests IO::Socket::SSL as an alternative (http://www.cpan.org/authors/id/N/NA/NANIS/Crypt-SSLeay-0.72.readme), but in order to build it, the Net:SSLeay Module is necessary, so that's a circular issue.
*Use the above noted (in the section immediately above this one) method to "zero out" unused space as this will aid in reducing the final GZ file size.
*The GZ method has the distinct advantage of allowing one to open the GZ file and extract out single files (after it is mounted of course, look a couple of sections down).


*
=====Restoring a Partition using DD Example=====


====Installing Webmin====
*gzip -dk WhatEverFileName.img.gz
Run the setup and configuration questions during setup (Note: OpenWRT does not provide the NET::SSLeay Perl Module, so SSL will not be available for Webmin);
*dd if=/mnt/sdb1/EXT4b-08.08.2020.img of=/dev/sda1 conv=sync,noerror bs=64K status=progress


*Detailed instructions to install "The Old Fashion Way..." can be found here: https://doxfer.webmin.com/Webmin/Installation_-_the_old_fashioned_way
=====Tip for Configuring a Cloned Drive after Cloning=====
*In chosen Webmin installation directory, run: ./setup.sh /WhatEverPathToInstallWebmin (see above for potential locations)
WARNING: When cloning an entire drive, ''everything'' will be cloned, including the [[wikipedia:Universally_unique_identifier|UUID]] of the partition. One of the "U"s in UUID stands for "unique". After a drive is cloned, the UUID isn't "unique" anymore.   Two drives will have the same UUID. If the second flash drive is being used for the sole purpose of backing up settings with the intent of disconnecting the drive and putting it aside, the UUID can be left as it is.  If the second drive is left connected the UUID should be changed to to prevent confusion with the source drive.  The below command will change the UUID to a random ID (see above section for installing the tune2fs utility)
**Config Directory: /etc/webmin
**Log file directory: /var/log/webmin (NOTE: This directory is actually a symbolic link for /tmp, so it will not persist across reboots of a router.  If permanent logs for Webmin are desired, change the path)
**Full path to perl: /usr/bin/perl
**MiniServe Configuration (the web process for webmin): /etc/webmin/miniserv.conf
**Configure OS as: 110 - Generic Linux
***OS Choices available when installing Webmin: Pick 110) Geric Linux for OpenWRT;
<syntaxhighlight lang="text">
  1) Pardus Linux          2) SmartOS                3) Sun Solaris         
  4) Lycoris Desktop/LX    5) Caldera OpenLinux eS  6) Caldera OpenLinux   
  7) Asianux Server        8) Asianux                9) Whitebox Linux     
10) Tao Linux            11) CentOS Linux          12) Springdale Linux   
13) Virtuozzo Linux      14) Scientific Linux      15) Gralinux           
16) NeoShine Linux        17) Endian Firewall Linu  18) Oracle Enterprise Li
19) Oracle Linux          20) Oracle VM            21) XenServer Linux     
22) CloudLinux            23) MostlyLinux          24) Cloudrouter Linux   
25) Sangoma Linux        26) Citrix Hypervisor    27) Redhat Enterprise Li
28) Redhat Linux Desktop  29) AlphaCore Linux      30) X/OS Linux         
31) Haansoft Linux        32) cAos Linux            33) Wind River Linux   
34) Amazon Linux          35) Redhat Linux          36) Fedora Linux       
37) White Dwarf Linux    38) Slamd64 Linux        39) Slackware Linux     
40) Xandros Linux        41) APLINUX              42) BigBlock           
43) Ubuntu Linux          44) Mepis Linux          45) Devuan Linux       
46) Raspbian Linux        47) Linux Mint            48) Debian Linux       
49) SuSE OpenExchange Li  50) SuSE SLES Linux      51) SuSE Linux         
52) United Linux          53) Corel Linux          54) TurboLinux         
55) Cobalt Linux          56) Mandrake Linux Corpo  57) pclinuxos Linux     
58) Mageia Linux          59) Mandrake Linux        60) Mandriva Linux     
61) Mandriva Linux Enter  62) Conectiva Linux      63) ThizLinux Desktop   
64) ThizServer            65) MSC Linux            66) SCI Linux           
67) LinuxPPC              68) Trustix SE            69) Trustix             
70) Tawie Server Linux    71) TinySofa Linux        72) Cendio LBS Linux   
73) Ute Linux            74) Lanthan Linux        75) Yellow Dog Linux   
76) Corvus Latinux        77) Immunix Linux        78) Gentoo Linux       
79) Secure Linux          80) OpenNA Linux          81) SoL Linux           
82) Coherent Technology  83) Playstation Linux    84) StartCom Linux     
85) Yoper Linux          86) Caixa Magica          87) openmamba Linux     
88) FreeBSD              89) DragonFly BSD        90) OpenBSD             
91) NetBSD                92) BSDI                  93) HP/UX               
94) SGI Irix              95) DEC/Compaq OSF/1      96) IBM AIX             
97) SCO UnixWare          98) SCO OpenServer        99) macOS Catalina     
100) macOS Mojave          101) macOS High Sierra    102) macOS Sierra       
103) OS X                  104) Mac OS X              105) Darwin             
106) OpenDarwin            107) Cygwin                108) Sun Java Desktop Sys
109) Synology DSM          110) Generic Linux        111) Windows
</syntaxhighlight>


*Version: 4
*tune2fs -U random /dev/sdXy*
*It might be necessary to run this command first: e2fsck -f /dev/sdXy (this is equivalent to CHKDSK in windows, where sdXy should be changed to match the appropriate drive, sda1, sdb2, etc.)


The running Webmin service when viewed by PS or equivalent: {miniserv.pl} /usr/bin/perl /usr/local/webmin/miniserv.pl /etc/webmin/miniserv.conf
This command will change the UUID to the one specified;


====Post Installation====
*tune2fs -U UUID /dev/sdXy* (where UUID is the actual UUID)
Webmin seems to have an issue detecting ARM CPUs in the Marvell SoC with OpenWRT.  This results in an Error 500 Perl execution failed... ...proc::list_processes.  To correct the issue modify the /overlay/webmin/proc/module.info File as follows (It disables the Webmin Processor Module because that module does not run correctly on OpenWRT for the AC Series of routers) by removing the generic-linux or *-linux setting;<syntaxhighlight lang="text">
Original Line: os_support=solaris generic-linux hpux freebsd osf1 irix unixware openserver macos aix netbsd openbsd windows


OR
To verify the change, use the following command;


Original Line: os_support=solaris *-linux hpux freebsd osf1 irix unixware openserver macos aix netbsd openbsd windows
*blkid /dev/sdXy


Modified Line: os_support=solaris hpux freebsd osf1 irix unixware openserver macos aix netbsd openbsd windows
<nowiki>*</nowiki> In the above examples X and y should be replaced with actual mount point references.  IE, sda1, sdb3, sde2, etc.


</syntaxhighlight>
=====Accessing an Image File (IE, mount it like a drive)=====
Verify the /etc/webmin/config file contains the following settings;<syntaxhighlight lang="text">
In the above example where a partition was cloned to an image file, utilities like WinRAR, WinImage, etc. cannot be used to access the file. Since the image file represents an entire drive or partition, it can be mounted just like a physical drive.
os_type=generic-linux
os_version=4
real_os_type=OpenWRT
real_os_version=19.07.03
</syntaxhighlight>
Alternative Method of Configuring Webmin settings in /etc/webmin/config file;<syntaxhighlight lang="text">
os_type=linux
os_version=4
real_os_type=OpenWRT
real_os_version=19.07.03
</syntaxhighlight>...however, this necessitates that any Webmin modules that require certain operating systems (apache, bind, etc.) need to have their module.info files modified to include the os_type of linux.


And again, the /overlay/webmin/proc/module.info will need to be modified as above.
NOTE: If it is a compressed GZ file, the image must be extracted from the compressed file first: gzip --verbose -d WhatEverFileName (BusyBox has a version of GZIP installed with it, the full gzip utility can be installed with: opkg install gzip)  And remember, whereever the file is decompressed, it must have enough space for the original image which will be the size of the partition imaged.


Also, most of the Webmin modules will need to be custom configured for the OpenWRT environment in order to function properly.  See below...
NOTE: The below example is for mounting an Image that was made from a partition, not an entire disk/SSD/USB Flash Drive.


===Adding and Configuring Webmin Features & Modules===
To mount a partition (not a drive);
Before any modules are moved from the Unused-Modules Category, they must be properly configured for Webmin to detect.


====Date and Time====
*mkdir /tmp/WhatEverMountPoint (the directory can be any directory or file name, an advantage to using the /tmp directory is one doesn't have to worry about dismounting the image as it will not be mounted after a router reboot because the mount point is in the /tmp directory, the image file will exist of course, assuming it is not also in the /tmp directory)
The LuCI GUI does not provide a method to manually change the date or time (see https://openwrt.org/docs/guide-user/services/ntp/client-server).  The reason appears to be that the AC Series of routers, among many other router models, lacks the hardware capability to maintain an internal clock when the router is off or unplugged. Instead, it syncronizes with a known NTP (Network Time Protocol) server after booting up.  This seems to be confirmed, in that during booting, part of the boot process is to set the clock to midnight January 1, 1970 (see https://openwrt.org/toh/linksys/linksys_wrt3200acm).
*mount -o loop -t WhatEverFileSystem /WhatEverPath/WhatEverImage.img /tmp/WhatEverMountPoint
**-t = the type of file system (this could be -t vfat, -t ntfs, -t ext2, -t ext4 etc., and it should obviously match the type of the original file system, no experiments were done to see if mount utility could "auto detect" the file system, but it may have the capability)
**-o = Option (let the mount command know it is a "loop" device)


Once booted, the the Webmin interface provides a relatively easy method to configure the date and time when the module is properly configured properly. In the default Webmin Dashboard, Time on System;
When accessing the mounted image file, the directories shown at the first level may not be familiary as they are organized in the fashion that OpenWRT "sees" them.  Open the directory titled ''upper'' and you should see all of the directories one is accustomed to seeing at the root level directory.  


*CLOCK, Settings Icon (the gear at the top left of the configuration payne), System configuration, System time setting format, YYYYMMDDHHMM.SS Radio Button
====Good 'ole Fashion, just make a copy====
Forget all the fancy backup stuff for this one.  Sometimes it's good just to make a manual copy of things.  This method works great for configuration files.  Not so much to avoid a failed drive, but more to preserve a working copy of a known good configuration file.  The idea is whenever one embarks on an upgrade or a major change (even a minor one too) to a service, sometimes it's good to make a copy of a working configuration file.  For instance, using the /etc/config/network configuration file: cp /etc/config/network /etc/config/network-09.30.2020  There, a copy of the original file with a date on the end of it.  Simple and effective if one needs to take a "single step back", instead of walking through the complexity of restoring files from Restic or a DD Tar.GZ file.


OR
====LuCI GUI BackUp====
And of course one can also use the LuCI GUI under System, BackUp / Flash Firmware to create a copy of configuration files and even MTDBLOCK contents.


*/etc/webmin/config: dateformat=dd/mon/yyyy
==Border Mail System (Postfix, MailScanner, MailWatch, ClamD,==


Remember, the modified time will not persist across reboots.  The setting for the format in Webmin will persist, but the AC series of routers, as most others, does not maintain an internal clock when off or unplugged.  The time is set by accessing an NTP server when the router boots up.
===Postfix===


====Users and Groups====
====Files & Permissions====
System, Users and Groups, Settings;
Configuration: /etc/postfix (that's a directory, not a file)


Password File (User & Password File): /etc/passwd (/etc/passwd- seems to be the OpenWRT template file for passwd)
Startup Script: /etc/init.d/postfix


Group file: /etc/group
Main Binary / Executable Files: /usr/sbin/post*
 
Additional Binary / Executable Files: /usr/sbin/sendmail* (sendmail related compatibility)


====Webmin Performance====
Other Binary / Executalbe Files: /usr/bin/mailq, mailq.postfix, newaliaases, newaliases.postfix (sendmail related compatibility)
To decrease the Webmin CPU load on the OpenWRT router (this isn't really necessary for the AC router series as there is "horsepower" to spare);


*Disable Real-Time Monitoring: Webmin, Webmin Configuration, Themes, Real-time monitoring options, Enable real-time monitoring, NO
Library (sub-function) Files: /usr/libexec/postfix
*Reduce Real-Time Monitoring Refresh: Interval for performing update, 10000 (Increasing the default value of 1000 (ms) will also cause delays in information in certain categories, such as Network I/O to be displayed slowly)


====Other Notes for Webmin====
There is no LuCI GUI or any sort of OpenWRT configuration paradigm.  Everything can be configured via text files and all safely done with Webmin.
Some modules, such as NAMED / BIND, may not accurately show the Stop / Start status after a stop or start until after a screen refresh, which is possibly related to the Monitoring Refresh time mentioned above, if increased.


====Apache / Apache2 / HTTPD Webmin Module (/etc/webmin/apache/config)====
Postfix User and Group items are configured in /etc/passwd and /etc/group automatically.
<div class="toccolours mw-collapsible mw-collapsed" style="width:400px; overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Code Block</div>
<div class="mw-collapsible-content"><syntaxhighlight lang="text">
allow_virtualmin=0
apply_cmd=/etc/init.d/apache2 restart
test_apachectl=1
pid_file=/var/run/apache2/httpd.pid
httpd_path=/usr/sbin/apache2
test_manual=0
apachectl_path=/usr/sbin/apachectl
auto_mods=1
httpd_dir=/etc/apache2
test_config=1
stop_cmd=/etc/init.d/apache2 stop
max_servers=100
mime_types=/etc/apache2/mime.types
start_cmd=/etc/init.d/apache2 start
graceful_cmd=/etc/init.d/apache2 reload
httpd_version=2.4.43
httpd_conf=/etc/apache2/apache2.conf


</syntaxhighlight></div></div>
Owner for /etc/postfix: root:root


====BIND / BIND8 / NAMED Webmin Module (/etc/webmin/bind8/config);====
Permissions for /etc/postfix: 644
The below Code Block contains the settings to customize the Webmin interface for BIND / NAMED;
 
<div class="toccolours mw-collapsible mw-collapsed" style="width:400px; overflow:auto;">
====Commands====
<div style="font-weight:bold;line-height:1.6;">Code Block</div>
 
<div class="mw-collapsible-content"><syntaxhighlight lang="text">
*postconf -d (configuration settings)
rndc_conf=/etc/bind/rndc.conf
*postmap /etc/postfix/transport (updates the transport.db file)
force_random=0
**Note: Most linux distributions name the transport database file transport.db, but by default the OpenWRT version of Postfix names it transport.cdb
keygen=/usr/sbin/dnssec-keygen
*postfix reload (after changes are made to master.cf file, or just restart the service)
rev_def=0
 
tmpl_dnssec_dt=1
====Warnings====
spf_record=0
The below warning message(s) are displayed each time Postfix is started.  This is because OpenWRT left the default setting ''smtputf8_enable = 0'' when Postfix was compiled.  The ''smtputf8_enable'' setting relates to other text encoding (UTF8), etc.  According to documentation it creates a much larger binary / executable for Postfix.  Since OpenWRT focuses on small and compact service files this makes sense.  But the fix is easy.  Add this line to the /etc/postfix/main.cf file: smtputf8_enable = no<syntaxhighlight lang="text">
by_view=0
postfix: warning: smtputf8_enable is true, but EAI support is not compiled in
other_slaves=1
postsuper: warning: smtputf8_enable is true, but EAI support is not compiled in
updserial_def=0
postfix/postlog: warning: smtputf8_enable is true, but EAI support is not compiled in
soa_start=0
postfix/postfix-script: starting the Postfix mail system
rndc_cmd=/usr/sbin/rndc
</syntaxhighlight>
whois_cmd=
 
allow_wild=1
===MailScanner===
updserial_man=1
Download the latest version from: https://github.com/MailScanner/v5/releases (The year this was written was 2020, so if they've moved onto v6, check the URL)
records_order=0
 
checkzone=/usr/sbin/named-checkzone
tar -xvzf WhatEverTheNameOfTheTarGzFile
updserial_on=1
 
dnssec_period=21
The installation script ./install.sh relies on the full BASH shell (OpenWRT includes the [[wikipedia:Almquist_shell|ASH]] shell by default): opkg install bash, then type the command ''bash ./install.sh'' (plain ASH won't work, they even explicitly state the [[wikipedia:Shebang_(Unix)|shebang]] of their file as ''#!/bin/bash'', not #!/bin/sh, and just for the fun of it attempted to run it with ASH, and it errors out) Read here for more information or to change it permanently: https://www.howtogeek.com/669835/how-to-change-your-default-shell-on-linux-with-chsh/
ndc_cmd=
 
allow_long=0
===NTP (Network Time Protocol)===
tmpl_dnssec=0
By default OpenWRT provides an NTP Client ''and Server'' (suprise, suprise, and a really good thing) within [[wikipedia:BusyBox|BusyBox]].  Since most routers (if any) do not provide a method (IE, battery) of maintaining an internal clock when the router is off a method must exist to set the proper time for the router when it starts up.  This client service is supplied within the BusyBox version of ntpclient.
allow_underscore=1
 
rev_must=0
It is also possible to install the full version of ntpclient (opkg install ntpclient) along with a LuCI GUI (opkg install luci-app-ntpc).  No research was done on the difference between the two versions of the ntp client as the BusyBox version of ntpclient satisfied all functional needs.
master_ttl=1
 
confirm_zone=1
For and NTP Daemon / Server, the BusyBox also includes NTPD.  A full version of NTPD can be installed (opkg install ntpd), but there is no LuCI GUI inteface as there is with the client.  An alternative NTP client, CHRONYD can be installed (opkg install chonry) instead of NTPD.  But since the daemon / server version of NTPD in BusyBox will function for client NTP devices (including Windows) no further research was done on alternative NTP daemons / services like NTPD or CHRONYD.
restart_cmd=/etc/init.d/named reload
 
short_names=0
One additional note worth mentioning relates to internet service providers.  Some providers, such as AT&T, block client devices attempting to using the NTP protocol to syncronize clocks.  Some websites indicate this is a "slow-down" or some other type of limit imposed on the NTP protocol, but the end result is the same.  And that end result is the NTP protocol does not work.  And that means devices, computers, etc. are not able to syncronize with a time server.  AT&T claims this is for security reasons. HA!  See more information about it here: https://about.att.com/sites/broadband/network
max_zones=999
 
no_chroot=1
==Webmin==
soa_style=0
Webmin can be successfully installed on OpenWRT, '''AND IT IS USEFUL''' (unlike so many other ignorant (notice the word 'stupid' wasn't used, but they are) web posters claim or question).  The end of the previous sentence is in all CAPS and '''BOLD''' because of the large number websites and posts that do nothing more than question why anyone would want to install Webmin on OpenWRT instead of just answering the original question of how to install it.  Sometimes it is just nice to have a GUI.  The editor for config files alone is worth it.
master_dir=/etc/bind/masters
 
confirm_rec=1
There is however a word of caution to address: Do NOT use Webmin for any OpenWRT services that have an associated LuCI GUI or /etc/config/WhatEverConfigurationFile because modifications made by Webmin will be wiped out by changes made via LuCI or the /etc/config/Files...  There are many, many services such as BIND / NAMED, Apache / HTTPD, ProFTPD, OpenSSL for OpenVPN Certificate generation that have no LuCI GUI, nor are they "controlled" or configured via the /etc/config/ Files.  That means these services are safe to configure via text or by GUI.
reversezonefilename_format=ZONE.rev
 
support_aaaa=1
===Pre-Installation Tasks for Installing Webmin===
start_cmd=/etc/init.d/named start
Download the Webmin ...tar.gz file: wget https://prdownloads.sourceforge.net/webadmin/webmin-1.953.tar.gz (that's the version number as of this writing, so adjust as they update and locate an updated URL)
stop_cmd=/etc/init.d/named stop
 
largezones=0
Unzip and UnTAR the file;
dnssectools_rollmgr_pidfile=
dnssectools_conf=
signzone=/usr/sbin/dnssec-signzone
no_pid_chroot=0
relative_paths=0
ipv6_mode=1
checkconf=/usr/sbin/named-checkconf
named_conf=/etc/bind/named.conf
dnssectools_rollrec=
slave_dir=/etc/bind/masters
dnssectools_keydir=
rndcconf_cmd=/usr/sbin/rndc-confgen
show_list=1
pid_file=/tmp/run/named/named.pid
named_path=/usr/sbin/named
forwardzonefilename_format=ZONE.hosts
allow_comments=0
extra_forward=
file_owner=bind:bind
default_view=
this_ip=
keys_dir=
extra_reverse=
slave_file_perms=
named_group=
default_master=
named_user=
extra_slaves=
auto_chroot=
chroot=
free_nets=
default_prins=
file_perms=
zones_file=


</syntaxhighlight></div></div>
*The location chosen when unzipping and untarring Webmin ''can'' be the installation directory where the program runs;
Sadly, for the BIND / NAMED module, it didn't seem that OpenWRT included the ''named-compilezone'' command.  However, after some quick research with a major hint (from here: http://www.linuxfromscratch.org/blfs/view/svn/server/bind.html) which included a notation that the ''named-compilezone'' command was a symbolic link, then a quick check on a CentOS system which showed the /usr/sbin/named-compilezone pointing to /usr/sbin/named-checkzone, which confirmed the utility as a standalone file does NOT exist, but is simply a softlink to another file.  The solution is to add this line to the rc.local file: ln /usr/sbin/named-checkzone /usr/sbin/named-compilezone  That way the command is available to Webmin.
**Typical installation locations for other Linux distributions (do NOT use the /tmp directory or it will be gone when the router reboots);
 
***CentOS typical location: /usr/libexec/webmin
Another feature that doesn't work "out of the box" is the View Records File Button.  This error message is displayed when clicking on the button: ''This zone is in raw binary format, and so cannot be displayed as text''.  But this is not the fault of Webmin, well, not exactly.  If they rewrote the code for the module to detect whether the zone file was stored in binary or text format, this issue wouldn't be an issue.  The claim by BIND is that storing information in a binary format is better for performance.  However, this only applies to very busy DNS servers.  For "average" DNS servers, storing the zone records in plain text format will not be an issue.  Thanks to a hint from this site: http://geekdom.wesmo.com/2014/06/05/bind9-dns-slave-file-format/, it indicated the setting below applied to both master and slave zone files. To enable the button functionality add the following line to the named.conf file;
***Debian: /usr/share/webmin
***Locations suggested by Webmin tutorials: /usr/libexec/webmin, '''/usr/local/webmin'''
***Location noted by https://doxfer.webmin.com/Webmin/Installation_-_the_old_fashioned_way as the most common for "TAR" Installations: /usr/local/webmin
*gunzip webmin-1.955.tar.gz and tar xvf webmin-1.955.tar
 
OR


*masterfile-format text;
*tar zxvf webmin-1.955.tar.gz OR tar zxvf webmin-1.955.tar.gz -C /WhatEverPath/WhatEverDirectory (Example: tar zxvf webmin-1.955.tar.gz -C /usr/local/)


The above setting can be applied on a zone by zone basis or it can be placed in the main ''options'' section to apply to all zones.  And again, even though the name of the setting seems to apply to master zone files, it also changes the format setting for slave zone files (IE, there is no slavefile-format directive / command).
(be patient, there are a LOT of files, even on a fast USB 3.0 flash drive it takes a couple of minutes.


====PPTP VPN Server Webmin Module (AKA PPTPD / POPTOP)====
*If "untarred" a directory other than the installation, do one of the following;
This module can be used for everything except the PPP Accounts (It ''can'' be used, but any changes will not persist across router reboots).  The reason is that the /etc/ppp/chap-secrets file (actually a symbolic link to /tmp/etc/chap-secrets) that it accesses is dynamically configured by the /etc/init.d/pptpd startup script based on information in the /etc/config/pptpd file.  The Webmin module can be used to view the information, but as noted, do NOT use it to modify user names and passwords for PPTPD.  Instead change user names and passwords in the /etc/config/pptpd file.
**Move the untarred directory to another location than the untarred location, if desired, not necessary
**When installing use the command (not yet): ./setup.sh /WhatEverPath (/usr/local/webmin seems to be a fairly standard location, but of course it can be placed anywhere)


As noted above in the PPTPD section, OpenWRT does not support the ''require-mppe-128'' option in the /etc/ppp/options.pptpd file.  Webmin will insert that value if the "Use 128-bit MPPE encryption?" is set to "Must be used" and that will "break" PPTPD. Leave it set to Default (Allowed). It should also be noted that the mppe-128 is built into the OpenWRT /usr/sbin/pptpd binary / executable file, thus making the setting unneccessary as it is enabled by default (pptp-server.log if enabled shows this: MPPE 128-bit stateless compression enabled).
*Before running the setup program;
**Add the bin Group to /etc/group using this directive: bin:x:1000: (OR, use the groupadd command: groupadd bin, the opkg install shadow-groupadd will be necessary for the groupadd command)
**Make sure PERL is installed with necessary modules (dependencies will automatically download, and not all of the below are necessary for a base installation of webmin, but come in handy later, and if installing on a USB Flash Drive, as you should be, instead of internal storage, space is not a consideration)
***opkg update
***opkg install perl perlbase-http-tiny coreutils-stty perlbase-gdbm-file perlbase-extutils perlbase-storable perlbase-time perl-device-serialport perl-encode-locale perlbase-perlio perlbase-anydbm-file perlbase-anydbm-file perlbase-benchmark perlbase-charnames perlbase-db-file perlbase-dbm-filter perlbase-filecache perlbase-filetest perlbase-getopt perlbase-hash perlbase-sdbm-file perlbase-tap perlbase-test perlbase-unicode
***...and because the above list was trial and error and as Webmin has progressed over the months and years, it needs more PERL (yes, I know about the caps thing) modules, just throw the fistful of darts and install most perl stuff so these in addition too (will need to break it down into two lines probably because of line length limit): opkg install perlbase-bigint perlbase-bignum perlbase-blib perlbase-bytes perlbase-compress perlbase-data perlbase-db perlbase-devel perlbase-diagnostics perlbase-digest perlbase-dumpvalue perlbase-dumpvar perlbase-encoding perlbase-english perlbase-env perlbase-fatal perlbase-fields perlbase-filter perlbase-json-pp perlbase-math perlbase-memoize perlbase-meta-notation perlbase-module perlbase-mro perlbase-next perlbase-o perlbase-open perlbase-ops perlbase-pod perlbase-search perlbase-sigtrap perlbase-sort perlbase-term perlbase-thread perlbase-threads perlbase-universal perlbase-user perlbase-version
**Possible Errors & Solutions during and after Installation;
***Most errors will be due to missing PERL modules.  So if space isn't an issue, just see the above 'throw all the darts at the dart board strategy' and install all PERL modules.  Thanks Webmin for not making a complete list of all the necessary modules and also having your script not properly detect missing modules either.
***"Perl Socket module not installed" Error will occur if perlbase-http-tiny is not installed.
***"stty: not found" / "Login password: ./setup.sh: line 396: stty: not found" (the line number may be different depending on the version of the setup script an Webmin being installed) Error will occur if coreutils-stty is not installed
***"The Perl SSLeay library is not installed. SSL not available" Error will occur because the PERL SSLeay module is not available in OpenWRT
***"Can't locate Time/Local.pm in" / "you may need to install the Time::Local module" will occur if the perlbase-time module is not installed
***"No dbm on this machine at" error will occur if perlbase-gdbm-file
***"Error - Perl execution failed  Undefined subroutine &main::get_miniserv_config called at /usr/local/webmin/authentic-theme/session_login.cgi line 17" and / or ""GET / HTTP/1.1" 500 166" (in miniserv.log file) error occurs if perlbase-storable is not installed
***"Can't locate ExtUtils/CBuilder.pm in @INC (you may need to install the ExtUtils::CBuilder module" error occurs if perlbase-extutils is not installed
***" can't open '/var/log/webmin/miniserv.pid': No such file or directory" error occurs when stopping Webmin with /etc/webmin/stop
***failed to open /var/webmin/miniserv.error<span> </span>: No such file or directory at /usr/local/webmin/miniserv.pl line XYZ: This is because webmin wants to put its error log at the /var/webmin location.  Nope, how about conforming to some standards and putting in the /var/log directory by default?  Up to the end user to configure here: /etc/webmin/miniserv.conf


Below are settings for the PPTPD Module (etc/webmin/pptp-server/config);<syntaxhighlight lang="text">
====A Special note on HTTPS (not the Module) for Webmin: Do NOT worry about it.  Forget it. Almost impossible to get working.====
pid_file=/var/run/pptpd.pid
During installation, Webmin states the Net::SSLeay Perl Module is necessary for HTTPS to work. If not, the Webmin site is only accessible via HTTP.
pptpd=/usr/sbin/pptpd
log_file=/var/log/ppp.pptpd
file=/etc/pptpd.conf
pap_file=/etc/ppp/chap-secrets
ppp_options=/etc/ppp/options
start_cmd=/etc/init.d/pptpd start
stop_cmd=/etc/init.d/pptpd stop
pptp_ppp_options=/etc/ppp/options.pptpd


</syntaxhighlight>The Active Connections feature also appears to be broken for the same reason Webmin can't show processor information with the PROC module.  It results in an error of: HTTP/1.0 500 Perl execution failed Server: MiniServ/1.955 Content-type: text/html; Charset=utf-8 Connection: close. Error - Perl execution failed, Undefined subroutine &proc::list_processes called at ./pptp-server-lib.pl
The instructions on the Webmin site for enabling this functionality are here (Hint: It won't work): http://www.webmin.com/ssl.html
====DHCPD Webmin Module (/etc/webmin/dhcpd/config)====
 
As noted in the main DHCPC section, there is no LuCI GUI, nor is there any good reason to stay within the OpenWRT managment paradigm (at least for DHCPD).  Unlike some other instances like Samba Server where it makes sense to maintain the "OpenWRT management style" of services, with DHCPD every aspect of Webmin can be utilized.  Below are the configuration settings for the DHCPD Webmin Module;<syntaxhighlight lang="text">
Here's why;
lease_file=/tmp/dhcpd.leases
group_name=0
dhcpd_conf=/etc/dhcpd.conf
pid_file=/var/run/dhcpd.pid
dhcpd_path=/usr/sbin/dhcpd
desc_name=0
lease_tz=0
show_mac=0
dhcpd_nocols=5
show_ip=0
lease_sort=0
display_max=100
dhcpd_version=4.4.1
dhcpd_size=2249541
dhcpd_mtime=1598660246
lease_refresh=
start_cmd=/etc/init.d/dhcpd start
stop_cmd=/etc/init.d/dhcpd stop
restart_cmd=/etc/init.d/dhcpd reload
version=
add_file=
interfaces_type=
hostnet_list=
</syntaxhighlight>Items such as dhcpd_version can be modified to reflect whatever version of DHCPD is available in the future.  No modifications need to be made to the /overlay/webmin/dhcpd/module.info (assuming the root path of Webmin is /overlay) file as this Module seems to be compatible with every version of DHCPD on every Linux distribution.


====Samba Server Webmin Module (/etc/webmin/samba/config)====
*The Net::SSLeay Perl Module is not available in OpenWRT, nor is and trying to build said modules results the error "fatal error: EXTERN.h: No such file or directory".  OpenWRT does not include some of the GCC files necessary.  Several sites (https://www.perlmonks.org/?node_id=1227113) mention using an external cross compile computer as a method of solving the issue
First, if it hasn't already been stated, a LuCI GUI (Services, Network Shares) for Samba existsAND it makes sense to stay within the OpenWRT management / configuration paradigm for services (/etc/config/samba3 or samba4).  Having noted that, the LuCI GUI does not have all the bells and whistles of Webmin, but what is there looks a whole lot better.  So for this one, a hybrid approach is best.
*Crypt::SSLeay is not available either, becuase there seems to be an issue (https://rt.cpan.org/Public/Bug/Display.html?id=120862) with the Crypt-SSLeay-0.72.tar.gz version that is attempted to download during compileBut even the newer version (https://cpan.metacpan.org/authors/id/N/NA/NANIS/) doesn't work either.  Downloading the newer version (https://cpan.metacpan.org/authors/id/N/NA/NANIS/Crypt-SSLeay-0.73_06.tar.gz) and changing the Makefile.PL line ( unless( require( catfile qw(inc IO Interactive Tiny.pm) ) ) { ) to ( unless( require( catfile qw(IO Interactive Tiny.pm) ) ) { ), to get rid of the inc corrects the issueBut then there's a "fatal error: openssl/opensslv.h" issue that is similar to the above mentioned Net:SSLeay issue where OpenWRT does not make certain Devel files available, in this case for OpenSSL, so the cross compiling method is the only solution available.
*Some information suggests IO::Socket::SSL as an alternative (http://www.cpan.org/authors/id/N/NA/NANIS/Crypt-SSLeay-0.72.readme), but in order to build it, the Net:SSLeay Module is necessary, so that's a circular issue.


Making so Webmin recognizes the Samba Module as an active module requires editing the /overlay/webmin/samba/module file (assuming /overlay is the root of the Wemin installation path chosen).  For some reason the wildcard version of Linux (*-linux) setting is not respected with OpenWRT / Webmin.  That makes it necessary to add the full name of the os_type setting in the /etc/webmin/config file (which should be ''generic_linux'') into the /overlay/webmin/samba/module file os_support setting.  See below;
*


*Original line: os_support=solaris *-linux aix hpux freebsd osf1 irix openserver unixware openbsd macos netbsd
====Installing Webmin====
*New line: os_support=solaris generic-linux *-linux aix hpux freebsd osf1 irix openserver unixware openbsd macos netbsd
Run the setup and configuration questions during setup (Note: OpenWRT does not provide the NET::SSLeay Perl Module, so SSL will not be available for Webmin);


The below configuration for the Samba Webmin Module allows for management of Samba features not included in the LuCI GUIThe Webmin GUI for Samba also provides a path to overstep what should be configured with Samba via Webmin, so use the "restraint" items noted below the configuration section;<syntaxhighlight lang="text">
*Detailed instructions to install "The Old Fashion Way..." can be found here: https://doxfer.webmin.com/Webmin/Installation_-_the_old_fashioned_way
smb_conf=/etc/samba/smb.conf.template
*In the Webmin installation directory, run: ./setup.sh /WhatEverPathToInstallWebmin (see above for potential locations)
samba_server=/usr/sbin/smbd
**Config Directory: /etc/webmin
smb_passwd=/etc/samba/smbpasswd
**Log file directory: /var/log/webmin (NOTE: This directory is actually a symbolic link for /tmp, so it will not persist across reboots of a routerIf permanent logs for Webmin are desired, change the path)
net=
***/var/log/webmin (note, this directory is actually located here: /tmp/log/webmin, and needs to be created each time the router is booted as the /tmp directory is just that, temporary)
samba_password_program=/usr/bin/smbpasswd
***As of the 11.2020 version of Webmin, the default location seems to be /var/webmin, so watch out for that and change it to /var/log/webmin, otherwise, other items described in this article won't work, because Webmin won't start without the correct log path.
dont_convert=-499
***The Log File path can also be created in the /etc/init.d/webmin startup script
pdbedit=
**Full path to perl: /usr/bin/perl
text_lists=0
**MiniServe Configuration (the web process for webmin): /etc/webmin/miniserv.conf
run_from_inetd=0
**Configure OS as: 110 - Generic Linux (it changed to 111 some time in late 2020, and in late 2021 the Webmin installation script seems to now autodetect OpenWRT at Generic Linux, OS version 5.4)
name_server=/usr/sbin/nmbd
***OS Choices available when installing Webmin: Pick 110) Geric Linux for OpenWRT (note, the number changes as Webmin adds OSs, so adjust as necessary);
sort_mode=0
<syntaxhighlight lang="text">
swat_path=
  1) Pardus Linux          2) SmartOS                3) Sun Solaris         
samba_status_program=/usr/bin/smbstatus
  4) Lycoris Desktop/LX    5) Caldera OpenLinux eS  6) Caldera OpenLinux   
list_printers_command=lpc status | grep "[A-z0-9]:" | sed -e 's/://g'
  7) Asianux Server        8) Asianux                9) Whitebox Linux     
smbgroupedit=
10) Tao Linux            11) CentOS Linux          12) Springdale Linux   
start_cmd_wb=fuckytheducky
13) Virtuozzo Linux      14) Scientific Linux      15) Gralinux           
stop_cmd=/etc/init.d/samba4 stop
16) NeoShine Linux        17) Endian Firewall Linu  18) Oracle Enterprise Li
stop_cmd_wb=
19) Oracle Linux          20) Oracle VM            21) XenServer Linux     
start_cmd=/etc/init.d/samba4 start
22) CloudLinux            23) MostlyLinux          24) Cloudrouter Linux   
winbind_server=
25) Sangoma Linux        26) Citrix Hypervisor    27) Redhat Enterprise Li
restart_cmd=/etc/init.d/samba4 restart
28) Redhat Linux Desktop  29) AlphaCore Linux      30) X/OS Linux         
 
31) Haansoft Linux        32) cAos Linux            33) Wind River Linux   
</syntaxhighlight>Notice a key item in the above configuration settings: smb_conf=/etc/samba/smb.conf.template (NOT smb.conf).  This is the key in allowing the Samba Webmin Module to control many Webmin settings.  The down side of this is that none of the shared resources will be displayed.  But that's OK, because the LuCI GUI interface does display shared resources.  Plus any changes made with the Samba Webmin Module would not be persistent and would be overwritten each time the Samba service or router is restarted.
34) Amazon Linux          35) Redhat Linux          36) Fedora Linux       
37) White Dwarf Linux    38) Slamd64 Linux        39) Slackware Linux     
40) Xandros Linux        41) APLINUX              42) BigBlock           
43) Ubuntu Linux          44) Mepis Linux          45) Devuan Linux       
46) Raspbian Linux        47) Linux Mint            48) Debian Linux       
49) SuSE OpenExchange Li  50) SuSE SLES Linux      51) SuSE Linux         
52) United Linux          53) Corel Linux          54) TurboLinux         
55) Cobalt Linux          56) Mandrake Linux Corpo  57) pclinuxos Linux     
58) Mageia Linux          59) Mandrake Linux        60) Mandriva Linux     
61) Mandriva Linux Enter  62) Conectiva Linux      63) ThizLinux Desktop   
64) ThizServer            65) MSC Linux            66) SCI Linux           
67) LinuxPPC              68) Trustix SE            69) Trustix             
70) Tawie Server Linux    71) TinySofa Linux        72) Cendio LBS Linux   
73) Ute Linux            74) Lanthan Linux        75) Yellow Dog Linux   
76) Corvus Latinux        77) Immunix Linux        78) Gentoo Linux       
79) Secure Linux          80) OpenNA Linux          81) SoL Linux           
82) Coherent Technology  83) Playstation Linux    84) StartCom Linux     
85) Yoper Linux          86) Caixa Magica          87) openmamba Linux     
88) FreeBSD              89) DragonFly BSD        90) OpenBSD             
91) NetBSD                92) BSDI                  93) HP/UX               
94) SGI Irix              95) DEC/Compaq OSF/1      96) IBM AIX             
97) SCO UnixWare          98) SCO OpenServer        99) macOS Catalina     
100) macOS Mojave          101) macOS High Sierra    102) macOS Sierra       
103) OS X                  104) Mac OS X              105) Darwin             
106) OpenDarwin            107) Cygwin                108) Sun Java Desktop Sys
109) Synology DSM          110) Generic Linux        111) Windows
</syntaxhighlight>
 
*Version: 4
 
The running Webmin service when viewed by PS or equivalent: {miniserv.pl} /usr/bin/perl /usr/local/webmin/miniserv.pl /etc/webmin/miniserv.conf


The general rule of what NOT to configure within Webmin is as follows;
====Post Installation====
PID File: By default the PID file for Webmin will be here:var/log/webmin/miniserv.pid  That makes sense (NOT).  The PID is to indicate whether a process is running, which should go in /var/run.  /var/log is for log files.  Come on!  Really?!  It's OK to leave it in the default location, but to put it in a place that makes more sense, modify the /etc/webming/miniserv.conf file and change the pidfile= setting to /var/run/minserv.pid
 
The setup script may display some errors, the following is related to having Webmin start automatically and an easy fix);


*If it can be configured within the LuCI GUI interface, do NOT configure it with Webmin.
*Error: Failed to open /etc/rc.d/init.d/webmin for writing<span> </span>: No such file or directory
*If there is an item / setting within the /etc/samba/smb.conf.template of visible within Webmin that is deliniated with a leading and trailing pipe symbol ( | ), do NOT configure it with Webmin.
*If the Webmin Module is configured correctly with the /etc/samba/smb.conf.template file as the configuration file, not the /etc/samba/smb.conf file, then configuration of shared resources (directories, printers, etc) will not be an issue as they will not be available within the Webmin interface for configuration.


Additional information can be found here: https://openwrt.org/docs/guide-user/services/nas/samba  It also illustrates the limits of the what the LuCI GUI interface can and can't do.  And it demonstrates at which point editing of the smb.conf.template via a text editor (available within the LuCI GUI on the Edit Template Tab) or in this case Webmin is necessary.
There is a choice for solving the above error, choose one of the following two items;


====Postfix Server Webmin Module (/etc/webmin/postfix/config)====
*In /etc/rc.local (or using LuCI GUI, System, Startup, Local Startup), add the following line: /etc/webmin/start
There is no OpenWRT LuCI GUI interface for Postfix.  Nor is there any sort of OpenWRT service managment paradigm implimented in /etc/config for Postfix as there is for many other services.  That means it is 100% OK to administer with Webmin with no limitations or fear of interfering with anything else.  PERIOD


Below are the configuration settings for the Webmin Postfix Module;<syntaxhighlight lang="text">
OR
delete_confirm=1
fwd_mode=0
max_records=999
postfix_master=/etc/postfix/master.cf
perpage=999
prefix_cmts=0
max_maps=999
postfix_config_command=/usr/sbin/postconf
postfix_aliases_table_command=/usr/sbin/postalias
mailq_sort=0
postfix_super_command=/usr/sbin/postsuper
postfix_lookup_table_command=/usr/sbin/postmap
postfix_queue_command=/usr/sbin/postqueue
columns=2
mailq_count=0
wrap_width=80
mailq_cmd=/usr/sbin/postqueue -p
mailq_dir=/var/spool/postfix
ldap_doms=0
postfix_control_command=/usr/sbin/postfix
postfix_config_file=/etc/postfix/main.cf
check_config=1
top_buttons=1
index_check=1
delete_warn=1
show_cmts=0
sort_mode=0
postfix_newaliases_command=/usr/bin/newaliases
postcat_cmd=/usr/sbin/postcat
mysql_host=
ldap_attrs=
ldap_id=
ldap_user=
mysql_pass=
reload_cmd=/etc/init.d/postfix reload
mysql_user=
init_name=
ldap_pass=
stop_cmd=/etc/init.d/postfix stop
ldap_host=
start_cmd=/etc/init.d/postfix start
ldap_class=


</syntaxhighlight>
*Create the File /etc/init.d/webmin with the following directives;
 
<syntaxhighlight lang="text">
====Third Party Modules (OpenVPN Certificate Authority, not OpenVPN itself as that is configured via LuCI or /etc/config, etc)====
Install via the Webmin GUI and remember to configure the module.info file if necessary and settings
 
OpenVPN (/etc/webmin/openvpn/config);<div class="toccolours mw-collapsible mw-collapsed" style="overflow:auto; width:100%;">
<div style="font-weight:bold;line-height:1.6;">Code Block</div>
<div class="mw-collapsible-content"><syntaxhighlight lang="text">
status_cmd=systemctl status openvpn@%s
openvpn_servers_subdir=servers
start_cmd=/etc/init.d/openvpn start
openvpn_home=/etc/openvpn
br_end_cmd=/usr/share/webmin/openvpn/br_scripts/bridge_end
openvpn_keys_subdir=keys
stop_cmd=/etc/init.d/openvpn stop openvpn@%s
down_root_plugin=/usr/share/webmin/openvpn/ovpn_plugin/openvpn-plugin-down-root.so
openvpn_pid_path=/var/run
openvpn_version=2.4.7
openvpn_path=/usr/sbin/openvpn
zip_cmd=/usr/bin/gzip
br_start_cmd=/usr/share/webmin/openvpn/br_scripts/bridge_start
log_lines=200
openvpn_clients_subdir=clients
openvpn_pid_prefix=openvpn/
openssl_home=/etc/openvpn/openvpn-ssl.cnf
openssl_path=/usr/bin/openssl
openssl_version=1.1.1g
 
</syntaxhighlight></div></div>
 
===Starting and Stopping Webmin===
Start: /etc/webmin/start
 
Stop: /etc/webmin/stop
 
Additonally, /etc/webmin/start can be added to the /etc/rc.local file to automatically start Webmin at boot.
 
A service can even be created in /etc/init.d/webmin with the following code;<syntaxhighlight lang="text">
#!/bin/sh /etc/rc.common
#!/bin/sh /etc/rc.common


Line 3,533: Line 3,691:


reload() {
reload() {
        /etc/webmin/reload
/etc/webmin/reload
}
}


restart() {
restart() {
        /etc/webmin/restart
/etc/webmin/restart
}
}


start() {
start() {
        mkdir -p -m 0750 /var/log/apache2
mkdir -p -m 0750 /var/log/webmin
        /etc/webmin/start
mkdir -p -m 0750 /var/webmin
/etc/webmin/start
# And don't forget to configure the logfile and errorlog settings in /etc/webmin/miniserv.conf to reflect the above OR leave the Webmin version of the miniserv.conf file as it is and make sure the ...0750 /var/webmin line is above too (then hunt for your log files somewhere besides in a log directory)
 
# In fact, best to leave that /var/webmin directory creation in place too as webmin puts other temporary crap in there that isn't related to log files.
}
}


stop() {
stop() {
        /etc/webmin/stop
/etc/webmin/stop
}
}
</syntaxhighlight>
</syntaxhighlight>
The above directories are created for logging and the Webmin PID file.


==Sources==
chmod 755 /etc/init.d/webmin (changes the permissions of the above created file), then service webmin enable
https://forum.openwrt.org/t/script-mount-alternate-nand-firmware-linksys/33588


https://forum.openwrt.org/t/solved-how-to-mount-ubifs-in-openwrt-kirkwood/32443/4
The second method has the advantage of making it so these commands work: service webmin stop, service webmin start, as opposed to /etc/webmin/start, /etc/webmin/stop


==Startup Scripts==
It also may claim that it has started webmin (immediately after the installation), but sometimes it doesn't really do that, so: /etc/webmin/stop, then /etc/webmin/start
/etc/rc.local


LuCI, System, Startup, Local Startup
This seems to have been corrected with Webmin versions as of approxomately early 2021: <s>Webmin seems to have an issue detecting ARM CPUs in the Marvell SoC with OpenWRT.  This results in an Error 500 Perl execution failed... ...proc::list_processes.  To correct the issue modify the /overlay/webmin/proc/module.info File as follows (It disables the Webmin Processor Module because that module does not run correctly on OpenWRT for the AC Series of routers) by removing the generic-linux or *-linux setting;</s>


Some useful startup items;<syntaxhighlight lang="text">
NOTE: As of 11.2020, a newer version of Webmin overcomes the issue OR version 19.07.04 of OpenWRT's perl corrects the issue (didn't test which one it was, just noticed it)<syntaxhighlight lang="text">
# In order to make the named-compilezone command work for webmin, add the following line (research indicated it was a symbolic link)
Original Line: os_support=solaris generic-linux hpux freebsd osf1 irix unixware openserver macos aix netbsd openbsd windows
ln /usr/sbin/named-checkzone /usr/sbin/named-compilezone


OR


# Create a TEMP Folder for phpMyAdmin
Original Line: os_support=solaris *-linux hpux freebsd osf1 irix unixware openserver macos aix netbsd openbsd windows
mkdir /tmp/phpMyAdmin
chmod 777 /tmp/phpMyAdmin


Modified Line: os_support=solaris hpux freebsd osf1 irix unixware openserver macos aix netbsd openbsd windows


# If it is desirable to have the non-active Flash Memory RootFS2 partition available on a WRT3200ACM, then do the following;
</syntaxhighlight>
#ubiattach -m 8
<s>Verify the /etc/webmin/config file contains the following settings;</s><syntaxhighlight lang="text">
#mkdir /mnt/MTD8
os_type=generic-linux
#mount -t ubifs /dev/ubi2_1 /mnt/MTD8
os_version=4
real_os_type=OpenWRT
real_os_version=19.07.03
</syntaxhighlight>
<s>Alternative Method of Configuring Webmin settings in /etc/webmin/config file;</s><syntaxhighlight lang="text">
os_type=linux
os_version=4
real_os_type=OpenWRT
real_os_version=19.07.03
</syntaxhighlight><s>...however, this necessitates that any Webmin modules that require certain operating systems (apache, bind, etc.) need to have their module.info files modified to include the os_type of linux.</s>


<s>And again, the /overlay/webmin/proc/module.info will need to be modified as above.</s>


# If an external drive is used as the overlay, the mtb9 / syscfg partition is attached and mounted by default as /tmp/syscfg as UBI1, so these commands aren't needed, but achieve the same result.  This appears to be a minor flaw in the OpenWRT boot process.;
<s>Also, most of the Webmin modules will need to be custom configured for the OpenWRT environment in order to function properly.  See below...</s>
#ubiattach -m 9
#mkdir /tmp/MTD9
#mount -t ubifs /dev/ubi1_0 /tmp/MTD9


As of mid 2021, none of the above items seem to be a concern anymore (at least with a WRT3200ACM, the only one tested thus far with this new tidbit of information).  The default /etc/webmin/config file works fine;<syntaxhighlight lang="text">
passwd_pindex=1
passwd_mindex=4
passwd_uindex=0
passwd_file=/etc/shadow
ld_env=LD_LIBRARY_PATH
path=/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin
find_pid_command=ps auwwwx | grep NAME | grep -v grep | awk '{ print $2 }'
by_view=0
passwd_cindex=2
tempdelete_days=7
os_type=generic-linux
os_version=5.4
real_os_type=Generic Linux
real_os_version=5.4
lang=en
log=1
referers_none=1
md5pass=1
theme=authentic-theme
product=webmin
</syntaxhighlight>
===Adding and Configuring Webmin Features & Modules===
Before any modules are moved from the Unused-Modules Category, they must be properly configured for Webmin to detect.
====Date and Time====
The LuCI GUI does not provide a method to manually change the date or time (see https://openwrt.org/docs/guide-user/services/ntp/client-server).  The reason appears to be that the AC Series of routers, among many other router models, lacks the hardware capability to maintain an internal clock when the router is off or unplugged.  Instead, it syncronizes with a known NTP (Network Time Protocol) server after booting up.  This seems to be confirmed, in that during booting, part of the boot process is to set the clock to midnight January 1, 1970 (see https://openwrt.org/toh/linksys/linksys_wrt3200acm).
Once booted, the the Webmin interface provides a relatively easy method to configure the date and time when the module is properly configured properly.  In the default Webmin Dashboard, Time on System;
*CLOCK, Settings Icon (the gear at the top left of the configuration payne), System configuration, System time setting format, YYYYMMDDHHMM.SS Radio Button
*...but wait, as of late 2021, something has changed with Webmin or OpenWRT, the above setting now needs to be: MMDDHHMMYY  Radio Button
OR
*/etc/webmin/config: dateformat=dd/mon/yyyy


# Webmin Related
Remember, the modified time will not persist across reboots.  The setting for the format in Webmin will persist, but the AC series of routers, as most others, does not maintain an internal clock when off or unplugged.  The time is set by accessing an NTP server when the router boots up.
# Added as a SERVICE, so not needed
#mkdir /tmp/log/webmin
#/etc/webmin/start


====Users and Groups====
System, Users and Groups, Settings;


Password File (User & Password File): /etc/passwd (/etc/passwd- seems to be the OpenWRT template file for passwd)


# OpenWRT puts the Apache directory in an unusual location for those with a CentOS / RedHat background.  Instead of modifying all of the default
Group file: /etc/group
# locations, it is easier to set up a softlink to the more familiar CentOS locations.  Remember, VAR redirects to TMP, hence the mkdir /tmp/www instead
# of mkdir /var/www
mkdir /tmp/www
ln -s /usr/share/apache2/htdocs /var/www/html
ln -s /usr/share/apache2/cgi-bin /var/www/cgi-bin
ln -s /usr/share/apache2/error /var/www/error
ln -s /usr/share/apache2/icons /var/www/icons


</syntaxhighlight>
====Webmin Performance====
To decrease the Webmin CPU load on the OpenWRT router (this isn't really necessary for the AC router series as there is "horsepower" to spare);


==Console Connectivity==
*Disable Real-Time Monitoring: Webmin, Webmin Configuration, Themes, Real-time monitoring options, Enable real-time monitoring, NO
Console connectivity on the AC Series of routers can be made via a 6 pin JST-PH 2.0 [[wikipedia:Electrical_connector|electrical connector]] (2.0 refers to the 'pitch' or space between the pins, not a version number) that provides a [[wikipedia:Port_(circuit_theory)|port]] with [[wikipedia:Serial_communication|serial communication]] capability.
*Reduce Real-Time Monitoring Refresh: Interval for performing update, 10000 (Increasing the default value of 1000 (ms) will also cause delays in information in certain categories, such as Network I/O to be displayed slowly)
 
====Other Notes for Webmin====
Some modules, such as NAMED / BIND, may not accurately show the Stop / Start status after a stop or start until after a screen refresh, which is possibly related to the Monitoring Refresh time mentioned above, if increased.
 
====Apache / Apache2 / HTTPD Webmin Module (/etc/webmin/apache/config)====
<div class="toccolours mw-collapsible mw-collapsed" style="width:400px; overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Code Block</div>
<div class="mw-collapsible-content"><syntaxhighlight lang="text">
allow_virtualmin=0
apply_cmd=/etc/init.d/apache2 restart
test_apachectl=1
pid_file=/var/run/apache2/httpd.pid
httpd_path=/usr/sbin/apache2
test_manual=0
apachectl_path=/usr/sbin/apachectl
auto_mods=1
httpd_dir=/etc/apache2
test_config=1
stop_cmd=/etc/init.d/apache2 stop
max_servers=100
mime_types=/etc/apache2/mime.types
start_cmd=/etc/init.d/apache2 start
graceful_cmd=/etc/init.d/apache2 reload
httpd_version=2.4.43
httpd_conf=/etc/apache2/apache2.conf
 
</syntaxhighlight></div></div>
 
====BIND / BIND8 / NAMED Webmin Module (/etc/webmin/bind8/config)====
The below Code Block contains the settings to customize the Webmin interface for BIND / NAMED;
<div class="toccolours mw-collapsible mw-collapsed" style="width:400px; overflow:auto;">
<div style="font-weight:bold;line-height:1.6;">Code Block</div>
<div class="mw-collapsible-content"><syntaxhighlight lang="text">
rndc_conf=/etc/bind/rndc.conf
force_random=0
keygen=/usr/sbin/dnssec-keygen
rev_def=0
tmpl_dnssec_dt=1
spf_record=0
by_view=0
other_slaves=1
updserial_def=0
soa_start=0
rndc_cmd=/usr/sbin/rndc
whois_cmd=
allow_wild=1
updserial_man=1
records_order=0
checkzone=/usr/sbin/named-checkzone
updserial_on=1
dnssec_period=21
ndc_cmd=
allow_long=0
tmpl_dnssec=0
allow_underscore=1
rev_must=0
master_ttl=1
confirm_zone=1
restart_cmd=/etc/init.d/named reload
short_names=0
max_zones=999
no_chroot=1
soa_style=0
master_dir=/etc/bind/masters
confirm_rec=1
reversezonefilename_format=ZONE.rev
support_aaaa=1
start_cmd=/etc/init.d/named start
stop_cmd=/etc/init.d/named stop
largezones=0
dnssectools_rollmgr_pidfile=
dnssectools_conf=
signzone=/usr/sbin/dnssec-signzone
no_pid_chroot=0
relative_paths=0
ipv6_mode=1
checkconf=/usr/sbin/named-checkconf
named_conf=/etc/bind/named.conf
dnssectools_rollrec=
slave_dir=/etc/bind/masters
dnssectools_keydir=
rndcconf_cmd=/usr/sbin/rndc-confgen
show_list=1
pid_file=/tmp/run/named/named.pid
named_path=/usr/sbin/named
forwardzonefilename_format=ZONE.hosts
allow_comments=0
extra_forward=
file_owner=bind:bind
default_view=
this_ip=
keys_dir=
extra_reverse=
slave_file_perms=
named_group=
default_master=
named_user=
extra_slaves=
auto_chroot=
chroot=
free_nets=
default_prins=
file_perms=
zones_file=
 
</syntaxhighlight></div></div>
Sadly, for the BIND / NAMED module, it didn't seem that OpenWRT included the ''named-compilezone'' command.  However, after some quick research with a major hint (from here: http://www.linuxfromscratch.org/blfs/view/svn/server/bind.html) which included a notation that the ''named-compilezone'' command was a symbolic link, then a quick check on a CentOS system which showed the /usr/sbin/named-compilezone pointing to /usr/sbin/named-checkzone, which confirmed the utility as a standalone file does NOT exist, but is simply a softlink to another file.  The solution is to add this line to the rc.local file: ln /usr/sbin/named-checkzone /usr/sbin/named-compilezone  That way the command is available to Webmin.
 
Another feature that doesn't work "out of the box" is the View Records File Button.  This error message is displayed when clicking on the button: ''This zone is in raw binary format, and so cannot be displayed as text''.  But this is not the fault of Webmin, well, not exactly.  If they rewrote the code for the module to detect whether the zone file was stored in binary or text format, this issue wouldn't be an issue.  The claim by BIND is that storing information in a binary format is better for performance.  However, this only applies to very busy DNS servers.  For "average" DNS servers, storing the zone records in plain text format will not be an issue.  Thanks to a hint from this site: http://geekdom.wesmo.com/2014/06/05/bind9-dns-slave-file-format/, it indicated the setting below applied to both master and slave zone files.  To enable the button functionality add the following line to the named.conf file;
 
*masterfile-format text;
 
The above setting can be applied on a zone by zone basis or it can be placed in the main ''options'' section to apply to all zones.  And again, even though the name of the setting seems to apply to master zone files, it also changes the format setting for slave zone files (IE, there is no slavefile-format directive / command).
 
Also Note: The Setup RDNC Button in Webmin seems to work (IE, it generates the rndc.conf file, updates the named.conf file, etc.), but the format it applies in the named.conf doesn't seem to work.  Syntax wise it is correct, but it doesn't work.  Solution?  Run the rndc-config command manually;
 
*rndc-config > /etc/bind/rndc.conf
*...then open the rndc.conf file and copy the section at the bottom into the named.conf file.
 
====PPTP VPN Server Webmin Module (AKA PPTPD / POPTOP)====
This module can be used for everything except the PPP Accounts (It ''can'' be used, but any changes will not persist across router reboots).  The reason is that the /etc/ppp/chap-secrets file (actually a symbolic link to /tmp/etc/chap-secrets) that it accesses is dynamically configured by the /etc/init.d/pptpd startup script based on information in the /etc/config/pptpd file.  The Webmin module can be used to view the information, but as noted, do NOT use it to modify user names and passwords for PPTPD.  Instead change user names and passwords in the /etc/config/pptpd file.
 
As noted above in the PPTPD section, OpenWRT does not support the ''require-mppe-128'' option in the /etc/ppp/options.pptpd file.  Webmin will insert that value if the "Use 128-bit MPPE encryption?" is set to "Must be used" and that will "break" PPTPD.  Leave it set to Default (Allowed).  It should also be noted that the mppe-128 is built into the OpenWRT /usr/sbin/pptpd binary / executable file, thus making the setting unneccessary as it is enabled by default (pptp-server.log if enabled shows this: MPPE 128-bit stateless compression enabled).
 
Below are settings for the PPTPD Module (etc/webmin/pptp-server/config);<syntaxhighlight lang="text">
pid_file=/var/run/pptpd.pid
pptpd=/usr/sbin/pptpd
log_file=/var/log/ppp.pptpd
file=/etc/pptpd.conf
pap_file=/etc/ppp/chap-secrets
ppp_options=/etc/ppp/options
start_cmd=/etc/init.d/pptpd start
stop_cmd=/etc/init.d/pptpd stop
pptp_ppp_options=/etc/ppp/options.pptpd
 
</syntaxhighlight>The Active Connections feature also appears to be broken for the same reason Webmin can't show processor information with the PROC module.  It results in an error of: HTTP/1.0 500 Perl execution failed Server: MiniServ/1.955 Content-type: text/html; Charset=utf-8 Connection: close.  Error - Perl execution failed, Undefined subroutine &proc::list_processes called at ./pptp-server-lib.pl
====DHCPD Webmin Module (/etc/webmin/dhcpd/config)====
As noted in the main DHCPC section, there is no LuCI GUI, nor is there any good reason to stay within the OpenWRT managment paradigm (at least for DHCPD).  Unlike some other instances like Samba Server where it makes sense to maintain the "OpenWRT management style" of services, with DHCPD every aspect of Webmin can be utilized.  Below are the configuration settings for the DHCPD Webmin Module;<syntaxhighlight lang="text">
lease_file=/tmp/dhcpd.leases
group_name=0
dhcpd_conf=/etc/dhcpd.conf
pid_file=/var/run/dhcpd.pid
dhcpd_path=/usr/sbin/dhcpd
desc_name=0
lease_tz=0
show_mac=0
dhcpd_nocols=5
show_ip=0
lease_sort=0
display_max=100
dhcpd_version=4.4.1
dhcpd_size=2249541
dhcpd_mtime=1598660246
lease_refresh=
start_cmd=/etc/init.d/dhcpd start
stop_cmd=/etc/init.d/dhcpd stop
restart_cmd=/etc/init.d/dhcpd reload
version=
add_file=
interfaces_type=
hostnet_list=
</syntaxhighlight>Items such as dhcpd_version can be modified to reflect whatever version of DHCPD is available in the future.  No modifications need to be made to the /overlay/webmin/dhcpd/module.info (assuming the root path of Webmin is /overlay) file as this Module seems to be compatible with every version of DHCPD on every Linux distribution.
 
The Edit Network Interfaces Button and Interfaces File Type setting in Webmin will not work with OpenWRT.
 
====Samba Server Webmin Module (/etc/webmin/samba/config)====
First, if it hasn't already been stated, a LuCI GUI (Services, Network Shares) for Samba exists.  AND it makes sense to stay within the OpenWRT management / configuration paradigm for services (/etc/config/samba3 or samba4).  Having noted that, the LuCI GUI does not have all the bells and whistles of Webmin, but what is there looks a whole lot better.  So for this one, a hybrid approach is best.
 
Making so Webmin recognizes the Samba Module as an active module requires editing the /usr/local/webmin/samba/module file (assuming /usr/local is the root of the Wemin installation path chosen).  For some reason the wildcard version of Linux (*-linux) setting is not respected with OpenWRT / Webmin.  That makes it necessary to add the full name of the os_type setting in the /etc/webmin/config file (which should be ''generic_linux'') into the /usr/local/webmin/samba/module.info file os_support setting.  See below;
 
*Original line: os_support=solaris *-linux aix hpux freebsd osf1 irix openserver unixware openbsd macos netbsd
*New line: os_support=solaris generic-linux *-linux aix hpux freebsd osf1 irix openserver unixware openbsd macos netbsd
 
The below configuration for the Samba Webmin Module allows for management of Samba features not included in the LuCI GUI.  The Webmin GUI for Samba also provides a path to overstep what should be configured with Samba via Webmin, so use the "restraint" items noted below the configuration section;<syntaxhighlight lang="text">
smb_conf=/etc/samba/smb.conf.template
samba_server=/usr/sbin/smbd
smb_passwd=/etc/samba/smbpasswd
net=
samba_password_program=/usr/bin/smbpasswd
dont_convert=-499
pdbedit=
text_lists=0
run_from_inetd=0
name_server=/usr/sbin/nmbd
sort_mode=0
swat_path=
samba_status_program=/usr/bin/smbstatus
list_printers_command=lpc status | grep "[A-z0-9]:" | sed -e 's/://g'
smbgroupedit=
start_cmd_wb=fuckytheducky
stop_cmd=/etc/init.d/samba4 stop
stop_cmd_wb=
start_cmd=/etc/init.d/samba4 start
winbind_server=
restart_cmd=/etc/init.d/samba4 restart
 
</syntaxhighlight>Notice a key item in the above configuration settings: smb_conf=/etc/samba/smb.conf.template (NOT smb.conf).  This is the key in allowing the Samba Webmin Module to control many Webmin settings.  The down side of this is that none of the shared resources will be displayed.  But that's OK, because the LuCI GUI interface does display shared resources.  Plus any changes made with the Samba Webmin Module would not be persistent and would be overwritten each time the Samba service or router is restarted.
 
The general rule of what NOT to configure within Webmin is as follows;
 
*If it can be configured within the LuCI GUI interface, do NOT configure it with Webmin.
*If there is an item / setting within the /etc/samba/smb.conf.template of visible within Webmin that is deliniated with a leading and trailing pipe symbol ( | ), do NOT configure it with Webmin.
*If the Webmin Module is configured correctly with the /etc/samba/smb.conf.template file as the configuration file, not the /etc/samba/smb.conf file, then configuration of shared resources (directories, printers, etc) will not be an issue as they will not be available within the Webmin interface for configuration.
 
Additional information can be found here: https://openwrt.org/docs/guide-user/services/nas/samba  It also illustrates the limits of the what the LuCI GUI interface can and can't do.  And it demonstrates at which point editing of the smb.conf.template via a text editor (available within the LuCI GUI on the Edit Template Tab) or in this case Webmin is necessary.
 
====Postfix Server Webmin Module (/etc/webmin/postfix/config)====
There is no OpenWRT LuCI GUI interface for Postfix.  Nor is there any sort of OpenWRT service managment paradigm implimented in /etc/config for Postfix as there is for many other services.  That means it is 100% OK to administer with Webmin with no limitations or fear of interfering with anything else.  PERIOD
 
Below are the configuration settings for the Webmin Postfix Module;<syntaxhighlight lang="text">
delete_confirm=1
fwd_mode=0
max_records=999
postfix_master=/etc/postfix/master.cf
perpage=999
prefix_cmts=0
max_maps=999
postfix_config_command=/usr/sbin/postconf
postfix_aliases_table_command=/usr/sbin/postalias
mailq_sort=0
postfix_super_command=/usr/sbin/postsuper
postfix_lookup_table_command=/usr/sbin/postmap
postfix_queue_command=/usr/sbin/postqueue
columns=2
mailq_count=0
wrap_width=80
mailq_cmd=/usr/sbin/postqueue -p
mailq_dir=/var/spool/postfix
ldap_doms=0
postfix_control_command=/usr/sbin/postfix
postfix_config_file=/etc/postfix/main.cf
check_config=1
top_buttons=1
index_check=1
delete_warn=1
show_cmts=0
sort_mode=0
postfix_newaliases_command=/usr/bin/newaliases
postcat_cmd=/usr/sbin/postcat
mysql_host=
ldap_attrs=
ldap_id=
ldap_user=
mysql_pass=
reload_cmd=/etc/init.d/postfix reload
mysql_user=
init_name=
ldap_pass=
stop_cmd=/etc/init.d/postfix stop
ldap_host=
start_cmd=/etc/init.d/postfix start
ldap_class=
 
</syntaxhighlight>
 
====Third Party Modules (OpenVPN Certificate Authority, not OpenVPN itself as that is configured via LuCI or /etc/config, etc)====
Install via the Webmin GUI and remember to configure the module.info file if necessary and settings too.  IE, download the module from the Webmin website, and then under the Webmin, Wemin Configuration, Webmin Modules menu, select From uploaded file, and Install Module
 
OpenVPN (/etc/webmin/openvpn/config);<div class="toccolours mw-collapsible mw-collapsed" style="overflow:auto; width:100%;">
<div style="font-weight:bold;line-height:1.6;">Code Block</div>
<div class="mw-collapsible-content"><syntaxhighlight lang="text">
status_cmd=systemctl status openvpn@%s
openvpn_servers_subdir=servers
start_cmd=/etc/init.d/openvpn start
openvpn_home=/etc/openvpn
br_end_cmd=/usr/share/webmin/openvpn/br_scripts/bridge_end
openvpn_keys_subdir=keys
stop_cmd=/etc/init.d/openvpn stop openvpn@%s
down_root_plugin=/usr/share/webmin/openvpn/ovpn_plugin/openvpn-plugin-down-root.so
openvpn_pid_path=/var/run
openvpn_version=2.4.7
openvpn_path=/usr/sbin/openvpn
zip_cmd=/usr/bin/gzip
br_start_cmd=/usr/share/webmin/openvpn/br_scripts/bridge_start
log_lines=200
openvpn_clients_subdir=clients
openvpn_pid_prefix=openvpn/
openssl_home=/etc/openvpn/openvpn-ssl.cnf
openssl_path=/usr/bin/openssl
openssl_version=1.1.1g
 
</syntaxhighlight></div></div>
 
====Cron====
It works with one minor exception.  For older versions of Webmin, the "Display running status of jobs?" may not work.  Other than that, the below configuration /etc/webmin/cron/config file works;<syntaxhighlight lang="text">
show_comment=1
hourly_only=
match_mode=
cron_dir=
run_parts=
cron_input=1
cron_delete_command=
cron_copy_command=
show_time=1
single_file=/etc/crontabs/root
cronfiles_dir=
cron_allow_file=
cron_edit_command=
max_jobs=
cron_get_command=
match_user=
cron_deny_all=
max_len=
cron_deny_file=
kill_subs=
vixie_cron=0
show_next=1
system_crontab=
show_run=2
add_file=
</syntaxhighlight>
 
===Starting and Stopping Webmin===
Start: /etc/webmin/start
 
Stop: /etc/webmin/stop
 
Additonally, /etc/webmin/start can be added to the /etc/rc.local file to automatically start Webmin at boot.
 
A service can even be created in /etc/init.d/webmin with the following code;<syntaxhighlight lang="text">
#!/bin/sh /etc/rc.common
 
START=99
 
reload() {
        /etc/webmin/reload
}
 
restart() {
        /etc/webmin/restart
}
 
start() {
        mkdir -p -m 0750 /var/log/apache2
        /etc/webmin/start
}
 
stop() {
        /etc/webmin/stop
}
</syntaxhighlight>
 
==Sources==
https://forum.openwrt.org/t/script-mount-alternate-nand-firmware-linksys/33588
 
https://forum.openwrt.org/t/solved-how-to-mount-ubifs-in-openwrt-kirkwood/32443/4
 
==Startup Scripts==
/etc/rc.local
 
LuCI, System, Startup, Local Startup
 
Some useful startup items;<syntaxhighlight lang="text">
# In order to make the named-compilezone command work for webmin, add the following line (research indicated it was a symbolic link)
ln /usr/sbin/named-checkzone /usr/sbin/named-compilezone
 
 
# Create a TEMP Folder for phpMyAdmin
mkdir /tmp/phpMyAdmin
chmod 777 /tmp/phpMyAdmin
 
 
# If it is desirable to have the non-active Flash Memory RootFS2 partition available on a WRT3200ACM, then do the following;
#ubiattach -m 8
#mkdir /mnt/MTD8
#mount -t ubifs /dev/ubi2_1 /mnt/MTD8
 
 
# If an external drive is used as the overlay, the mtb9 / syscfg partition is attached and mounted by default as /tmp/syscfg as UBI1, so these commands aren't needed, but achieve the same result.  This appears to be a minor flaw in the OpenWRT boot process.;
#ubiattach -m 9
#mkdir /tmp/MTD9
#mount -t ubifs /dev/ubi1_0 /tmp/MTD9
 
 
# Webmin Related
# Added as a SERVICE, so not needed
#mkdir /tmp/log/webmin
#/etc/webmin/start
 
 
 
# OpenWRT puts the Apache directory in an unusual location for those with a CentOS / RedHat background.  Instead of modifying all of the default
# locations, it is easier to set up a softlink to the more familiar CentOS locations.  Remember, VAR redirects to TMP, hence the mkdir /tmp/www instead
# of mkdir /var/www
mkdir /tmp/www
ln -s /usr/share/apache2/htdocs /var/www/html
ln -s /usr/share/apache2/cgi-bin /var/www/cgi-bin
ln -s /usr/share/apache2/error /var/www/error
ln -s /usr/share/apache2/icons /var/www/icons
 
</syntaxhighlight>
 
==Console Connectivity==
Console connectivity on the AC Series of routers can be made via a 6 pin JST-PH 2.0 [[wikipedia:Electrical_connector|electrical connector]] (2.0 refers to the 'pitch' or space between the pins, not a version number) that provides a [[wikipedia:Port_(circuit_theory)|port]] with [[wikipedia:Serial_communication|serial communication]] capability.


Unlike many models of routers that require a similar connector be soldered to a circuit board, the AC Series of routers has this feature installed during manufacturing.  Even though the cost is quite small per unit, it can add up to a significant amount of money with a large production run.  This implies Linksys was anticipating the router would be used by a modding community.  So thank you to the Linksys engineers and management that made sure that feature was included with the router.  On the cynical "bean counter" side of things, including a feature which makes it easier to salvage a "[[wikipedia:Brick_(electronics)|bricked]]" router, also probably cuts down on the number customers attempting to return "failed" units to Linksys.
Unlike many models of routers that require a similar connector be soldered to a circuit board, the AC Series of routers has this feature installed during manufacturing.  Even though the cost is quite small per unit, it can add up to a significant amount of money with a large production run.  This implies Linksys was anticipating the router would be used by a modding community.  So thank you to the Linksys engineers and management that made sure that feature was included with the router.  On the cynical "bean counter" side of things, including a feature which makes it easier to salvage a "[[wikipedia:Brick_(electronics)|bricked]]" router, also probably cuts down on the number customers attempting to return "failed" units to Linksys.


===Serial Ports and TTL Serial Communication===
==Serial TTL Cable and Connectors==
Even thought this port provides serial communication, it should not be confused with a Serial Port ([[wikipedia:D-subminiature|DE-9]], AKA DB-9 or DB9) as found on older personal computer or with a USB to Serial Port adapter.  A Serial Port on a computer utilizes the [[wikipedia:RS-232|RS-232]]<nowiki/>standard for communication.  The port on the AC Series of routers uses a similar [[wikipedia:Single-ended_signaling|single-ended signaling]] method, but with lower voltages (typically 3.3 V - 5.0 V VS voltages up to 15 V for RS-232) often referred to as a [[wikipedia:Single-ended_signaling|TTL]] or more accurately as a TTL Serial Port or Port using [[wikipedia:Transistor–transistor_logic#Interfacing_considerations|TTL Serial Communication]].  Many [[wikipedia:System_on_a_chip|SOC]] (System on a Chip) and [[wikipedia:Microcontroller|MCU]] (MicroController Unit) systems besides Linksys use TTL Serial ports as a method of communication and control.
{{:Serial_TTL_Cable_and_Connectors}}
 
 
CAUTION: If one connects an RS-232 Serial Port directly to a "TTL Serial Port", at best gibberish will be displayed by whatever terminal / serial console software is being used ([[wikipedia:PuTTY|PuTTY]], [[wikipedia:SecureCRT|SecureCRT]], Windows [[wikipedia:HyperACCESS|HyperTerminal]], etc.).  At worst, the higher voltage may permananently damage electronic components on the router's circuit board, rendering it unusable.
===Serial Ports and TTL Serial Communication===
 
Even thought this port provides serial communication, it should not be confused with a Serial Port ([[wikipedia:D-subminiature|DE-9]], AKA DB-9 or DB9) as found on older personal computer or with a USB to Serial Port adapter.  A Serial Port on a computer utilizes the [[wikipedia:RS-232|RS-232]]<nowiki/>standard for communication.  The port on the AC Series of routers uses a similar [[wikipedia:Single-ended_signaling|single-ended signaling]] method, but with lower voltages (typically 3.3 V - 5.0 V VS voltages up to 15 V for RS-232) often referred to as a [[wikipedia:Single-ended_signaling|TTL]] or more accurately as a TTL Serial Port or Port using [[wikipedia:Transistor–transistor_logic#Interfacing_considerations|TTL Serial Communication]].  Many [[wikipedia:System_on_a_chip|SOC]] (System on a Chip) and [[wikipedia:Microcontroller|MCU]] (MicroController Unit) systems besides Linksys use TTL Serial ports as a method of communication and control.
===Connection with a PC===
 
There are several methods of connecting a PC (Windows, Linux, etc.) to an AC Series router.  The simplest of which is a USB to TTL Adapater (originally created by [[wikipedia:FTDI|FTDI]]).  USB Adapters typically have a Fanout Pigtail (a term often used when referring to Fiber Optic cables) which allows individual connections to pins on a circuit board port as there is no standard ordering of pins of a TTL Port between manufacturers.  Another method utilizes a Serial to TTL Adapter which will likely include a [[wikipedia:MAX232|MAX232]] (or descendant) IC.
CAUTION: If one connects an RS-232 Serial Port directly to a "TTL Serial Port", at best gibberish will be displayed by whatever terminal / serial console software is being used ([[wikipedia:PuTTY|PuTTY]], [[wikipedia:SecureCRT|SecureCRT]], Windows [[wikipedia:HyperACCESS|HyperTerminal]], etc.).  At worst, the higher voltage may permananently damage electronic components on the router's circuit board, rendering it unusable.
 
 
The COM port settings are as follows;
===Connection with a PC===
 
There are several methods of connecting a PC (Windows, Linux, etc.) to an AC Series router.  The simplest of which is a USB to TTL Adapater (originally created by [[wikipedia:FTDI|FTDI]]).  USB Adapters typically have a Fanout Pigtail (a term often used when referring to Fiber Optic cables) which allows individual connections to pins on a circuit board port as there is no standard ordering of pins of a TTL Port between manufacturers.  Another method utilizes a Serial to TTL Adapter which will likely include a [[wikipedia:MAX232|MAX232]] (or descendant) IC.
*115200 bits per second
 
*Data bits: 8
The COM port settings are as follows;
*Parity: None
 
*Stop bits: 1
*115200 bits per second
*Flow Control: None
*Data bits: 8
 
*Parity: None
===The Real Pin # 1===
*Stop bits: 1
Many website tutorials, YouTube videos, diagrams, and even images on the OpenWRT website show the TTL Serial Port for the AC series of routers numbered from left to right, starting with "pin 1", as viewed from the top / front of the circuit board.  This is NOT correct, although both the names / labels of the pins and what their function is (Ground, TX (Transmit), and RX (Receive)), ''are correct''. It is an industry standard to identify "Pin 1" on a circuit board in several manners. The most common methods includes a triangle printed on the circuit board closest to "Pin 1" and a square solder connection (as viewed from the bottom). Another convention that is typically followed, but is not an absolute rule, is putting "Pin 1" closest to the nearest edge of a circuit board. The AC Series of routers all have a square solder connection on the bottom and a triangle printed on top of the circuit board for "Pin 1" on the right side of the connector, as viewed from the top. Since there is no pinout standard for that type of connector, the manufacturer (Linksys in this case) gets to define where "Pin 1" is located. And per the triangle marking, pin closest to edge, and square solder connection pin number one is located as indicated by the below image. PERIOD. Image is courtesy of: http://wtarreau.blogspot.com/2018/
*Flow Control: None
===Additional Information===
 
[[File:PinOut.png|alt=Pinout for TTL Connector on AC Series of Routers|left|thumb|Pinout for TTL Connector]]
===Hardware for Serial Connection===
OpenWRT article for WRT3200ACM that applies to other models too: https://openwrt.org/toh/linksys/linksys_wrt3200acm#serial1
After much research and examination of the internal physical layout of the AC Series of routers, the these items seemed the best fit for easily connecting a computer to the router.  It allows one to connect everything with no soldering, using standard USB cables.  There are of course many other choices, using different hardware ranging from USB to Serial Adapter (with TTL), 9 pin serial ports, etc.
 
 
For a detailed explanation of Serial Ports: https://en.wikipedia.org/wiki/Serial_port
Link as of late 2020: https://www.ebay.com/itm/Switchcraft-EHUSBBABX-USB-B-to-A-EH-Panel-Mount-Feed-Thru-Connector-Black/153365243032
 
[[File:USBA.jpg|alt=USB A Connector|none|thumb|126x126px|USB A Connector]]
[[wikipedia:JST_connector|JST Connector]] Specifications: http://www.jst-mfg.com/product/pdf/eng/ePH.pdf
[[File:USBB.jpg|alt=USB B Connector|none|thumb|126x126px|USB B Connector]]
 
OR
Various comparisons between RS-232 and TTL: https://learn.sparkfun.com/tutorials/serial-communication/wiring-and-hardware
[[File:USBABCable.jpg|none|thumb|126x126px|USB B to USB A with Cable]]
 
Link as of Late 2020:https://www.ebay.com/itm/PL2303TA-USB-to-TTL-RS232-COM-UART-Module-Serial-Cable-Adapter-for-Arduino/233559278066
A general tuturial on configuring connectivity with an AC Series router: http://wtarreau.blogspot.com/2018/ (this person has the pin numbers labeled correctly and everyone else's incorrect opinion labeled as "theoretical", see image)
[[File:PL2303TA.jpg|none|thumb|126x126px|USB PL2303TA Serial to 2.54mm Pitch Molex "70553 Style" Female Pigtail]]
 
[[File:JSTPH2mmFemale.jpg|left|thumb|126x126px|JST-PH 2.0mm Pitch 6 Pin Female Connector (notice the striped wires that are soldered.]]
<br />
<br />
 
 
==History==
 
One question that has never been precisely determined is this: Which version of Linux is OpenWRT based on?  Yes, it is known that the Linksys WRT54G started it all, but what version of Linux in the all the different [[wikipedia:List_of_Linux_distributions|distributions]] and branches is OpenWRT based on?  OpenWRT is on the [[wikipedia:List_of_Linux_distributions|chart]] at the bottom, but no lines are drawn to it.
 
 
 
Perhaps a better question would be: What did Linksys use way back in the early noughties as the basis of their OS for the WRT54G?
 
 
 
As of early 2021, there doesn't appear to be anyone that manufactures a 6 pin 2.0mm pitch JST-PH female connector / adapter / converter to a "pigtail" 2.54 breadboard / jumper Molex "70553 style" male connector.  And that was just when you thought everything existed in the world. Oh, well.
 
The best "non-soldering" / "plug it all together" solution is the above noted "USB B to USB A with Cable" Connector + the PL2303TA USB (the USB version of a MAX3232) to 2.54 breadboard / jumper Molex "70553 style" female connector to the JST-PH 2.0mm Pitch 6 Pin Female Connector.  The stripped off wires that are soldered with fit nicely into the "70553 style" female connector.  Everything else is just plugged together, minus the hole in the side of the router for the USB connector.  In the end, once put together, it makes it so a router can be connected to a computer via an ordinary USB cable.
 
===The Real Pin # 1===
Many website tutorials, YouTube videos, diagrams, and even images on the OpenWRT website show the TTL Serial Port for the AC series of routers numbered from left to right, starting with "pin 1", as viewed from the top / front of the circuit board.  This is NOT correct, although both the names / labels of the pins and what their function is (Ground, TX (Transmit), and RX (Receive)), ''are correct''. It is an industry standard to identify "Pin 1" on a circuit board in several manners.  The most common methods includes a triangle printed on the circuit board closest to "Pin 1" and a square solder connection (as viewed from the bottom).  Another convention that is typically followed, but is not an absolute rule, is putting "Pin 1" closest to the nearest edge of a circuit board. The AC Series of routers all have a square solder connection on the bottom and a triangle printed on top of the circuit board for "Pin 1" on the right side of the connector, as viewed from the top.  Since there is no pinout standard for that type of connector, the manufacturer (Linksys in this case) gets to define where "Pin 1" is located.  And per the triangle marking, pin closest to edge, and square solder connection pin number one is located as indicated by the below image.  PERIOD.  Image is courtesy of: http://wtarreau.blogspot.com/2018/
===Additional Information===
[[File:PinOut.png|alt=Pinout for TTL Connector on AC Series of Routers|left|thumb|Pinout for TTL Connector]]
OpenWRT article for WRT3200ACM that applies to other models too: https://openwrt.org/toh/linksys/linksys_wrt3200acm#serial1
 
For a detailed explanation of Serial Ports: https://en.wikipedia.org/wiki/Serial_port
 
[[wikipedia:JST_connector|JST Connector]] Specifications: http://www.jst-mfg.com/product/pdf/eng/ePH.pdf  And a nice video on the subject: https://www.youtube.com/watch?v=wn3ixZ-sv5w
 
Various comparisons between RS-232 and TTL: https://learn.sparkfun.com/tutorials/serial-communication/wiring-and-hardware
 
A general tuturial on configuring connectivity with an AC Series router: http://wtarreau.blogspot.com/2018/ (this person has the pin numbers labeled correctly and everyone else's incorrect opinion labeled as "theoretical", see image)
 
<br />
 
==History==
One question that has never been precisely determined is this: Which version of Linux is OpenWRT based on?  Yes, it is known that the Linksys WRT54G started it all, but what version of Linux in the all the different [[wikipedia:List_of_Linux_distributions|distributions]] and branches is OpenWRT based on?  OpenWRT is on the [[wikipedia:List_of_Linux_distributions|chart]] at the bottom, but no lines are drawn to it.
 
Perhaps a better question would be: What did Linksys use way back in the early noughties as the basis of their OS for the WRT54G?
 
Here are some of the first discussions on the subject;
 
*https://hardware.slashdot.org/story/03/06/08/1749217/is-linksys-violating-the-gpl
*https://hardware.slashdot.org/story/03/07/06/2121234/linksys-releases-gpled-code-for-wrt54g
 
One aptly named project that preceeds the WRT54G and OpenWRT is this: https://en.wikipedia.org/wiki/Linux_Router_Project
 
The Linux distribution that would seem to be the most modern descendant and perhaps relative of OpenWRT is [[wikipedia:Alpine_Linux|Alpine Linux]].
 
==Package Installation==
Here's an all in one line for installing a bunch of useful package.  Keep in mind this should only be done if one is using an external USB Flash Drive as even the internal flash storage of a WRT3200ACM won't be enough;
 
opkg update
 
opkg install luci-app-advanced-reboot block-mount e2fsprogs kmod-fs-ext4 kmod-usb-storage kmod-usb2 kmod-usb3 ntfs-3g usbutils gdisk cfdisk tune2fs kmod-fs-exfat dosfstools kmod-fs-vfat f2fs-tools kmod-fs-f2fs lsblk ntfs-3g-utils fdisk sfdisk wipefs samba4-server samba4-utils install luci-app-samba4
 
==Tethering==
{{:OpenWRT_Tethering}}
 
==DDNS (Dynamic DNS) Client==
{{:OpenWRT_DDNS}}
 
==MWAN Failover==
{{:OpenWRT_MWAN_Failover}}
 
==Samba Scare on WAN==
{{:OpenWRT_Samba_Scare_on_WAN}}
 
==NMAP Utility (Port Scanner)==
{{:OpenWRT_NMAP_Utility}}
 
==PPPoE (Point to Point over Ethernet)==
{{:OpenWRT_PPPoE}}
 
==Wireless Client Bridge Mode with OpenWRT==
{{:WRT_Router_Series_Wireless_Client_Bridge_Mode_with_OpenWRT}}
 
==Monitoring Services with Monit==
{{:WRT_Router_Series_Monit}}
 
==eXtplorer==
{{:EXtplorer_on_OpenWRT}}
 
==De Brick or Un Bricking a WRT Series Router==
{{:De_Brick_or_Un_Bricking_a_WRT_Series_Router}}
 
==WRT Series COPY MTD Partitions==
{{:WRT_Series_COPY_MTD_Partitions}}
 
==AC Series Recommended Software and Utilities==
{{:AC_Series_Recommended_Software_and_Utilities}}
 
==U Boot for WRT Series==
{{:U_Boot_for_WRT_Series}}
 
==Serial Port Communication on Linksys AC Series with OpenWRT==
{{:Serial_Port_Communication_on_Linksys_AC_Series_with_OpenWRT}}
 
==User Names and Passwords
 
opkg update
opkg install shadow-passwd shadow-useradd shadow-groupadd
 
===Resetting a Password for OpenWRT with systems that use /overlay===
Simply remove the encrypted password from the /etc/shadow file;


Here are some of the first discussions on the subject;
Before: root:$1EncryptedPassword#@#asoi41:18475:0:99999:7:::


*https://hardware.slashdot.org/story/03/06/08/1749217/is-linksys-violating-the-gpl
After: root::18475:0:99999:7:::<br />
*https://hardware.slashdot.org/story/03/07/06/2121234/linksys-releases-gpled-code-for-wrt54g


One aptly named project that preceeds the WRT54G and OpenWRT is this: https://en.wikipedia.org/wiki/Linux_Router_Project
===Weak Passwords===
Not that one would ever want to configure a "weak password", and out of the box, the OpenWRT GUI doesn't allow that.  As it should be.  But the frustrating part is having that limitation imposed with no way around it.  Maybe there is a good reason to temporarily configure a weak password.  Is that possible with the OpenWRT LuCI GUI interface?  No, not by default.  Is there a way around it?  Not via that same GUI as far as Google is concerned.  But there is a way...


The Linux distribution that would seem to be the most modern descendant and perhaps relative of OpenWRT is [[wikipedia:Alpine_Linux|Alpine Linux]].
Install the above passwd command, and at a command prompt type: passwd (then enter whatever password one wants)


*
*