Linksys AC Series Router Configuration Tips for OpenWRT: Difference between revisions

As it started out, this article was intended to be a quick how to on a couple of items, but then grew to enormous proportions.  There was some consideration on breaking it into smaller sections, but the Mediawiki interface with its table of contents mitigates that need to an acceptable level.

**Run the below commands to install the following items (but first, run opkg update).  They're broken down into groups;

***General Utilities: opkg install wget htop nano coreutils-dd netcat restic shadow-passwd shadow-useradd shadow-groupadd shadow-chsh lsof bash

***GUI Interface / Tools for "built-in" services: opkg install luci-app-advanced-reboot luci-app-uhttpd

***Ease of Use Software: opkg install samba4-server samba4-utils luci-app-samba4 (of all the utilities to install, this is by far the largest in terms of storage space consumed)

===Recommended Hardware Devices===

Others have the USB 3.0 speeds measured considerably slower at about 20 MB/S: https://www.kitguru.net/peripherals/james-morris/linksys-wrt3200acm-ac3200-wireless-router-review/4/

Anyway, the above mentioned SanDisk device tops out at about 70 MB/S on every system that the above mentioned Patriot device tops out at over 200 MB/S.  Notice that 70 MB/S speed mentioned twice?  Once for the SanDisk device and once for the AC Series.  The next item to consider is price.  The SanDisk is not the cheapest, but it is fairly low.  When price and performance are both considered, it turns out the SanDisk device beats everyone.  And since the AC series router and SanDisk USB Flash Drive both top out at around 70 MB/S, that makes it the perfect match.

[[File:USB to mSATA.jpg|alt=USB to mSATA|left|thumb|120x120px|USB to mSATA Enclosure]]

But there is a solution...  A USB 3.0 A Male to A Female Adapter (Part # 1206-N, UPC 848076012233) from a company named CMPLE.  It is available from several places: [https://www.walmart.com/ip/Cmple-USB-3-0-A-Male-to-A-Female-Adapter/172246645 Wal-Mart], [https://www.ebay.com/itm/NEW-USB-3-0-A-MALE-TO-A-FEMALE-M-F-ADAPTER-CONNECTOR-NEW-/362695174727 eBAy], and from the company that appears to have it manufactured (in China), [https://www.cmple.com/ProductsBySKU/1206-N CMPLE].  Even at about $3.00 it is a bit more expensive than other similar products (and there are only a few).  But it has one advantage in that the orientation of the male and female part of the connector are arranged such that the above noted 3 Port USB 3.0 hub from Sabrent can connect and be in the "up" position.  All other similar items found require that the hub be rotated to the left, right, or down.  Down isn't a choice unless one's router is on the edge of a table.  Left and right are good as the adapter provides enough clearance for the hub so it doesn't contact the power cord or the Ethernet cable on the WAN port.

====Bottom Line====

*opkg update

Please note, all of the above packages are not necessary.  But they do represent a broad range of tools that are very useful.  And since they don't take up a lot of space, it's worth installing them.  They don't run as active services or anything either, so no extra RAM or CPU usage unless one types the command.  Reboot after installing all of the above software.

Change a Volume Label;

====Performance Tuning for ExtX====

*tune2fs -o journal_data_writeback /dev/sdaX

====Performance Tuning for NTFS====

*If compression is also desired, add this in the above noted location: big_writes,compression

It is recommended to make sure the destination partition is the same size or larger of course.  Be prepared to wait a while, even on a USB 3.0 port.  

Various commands to "see" the available internal Flash Memory partitions;

*UBI (Unsorted Block Images) Commands;

**ubinfo - provides information about UBI devices and volumes found in the system

====Mounting Internal Partitions====

To view information about available UBI devices and partitions;

See http://www.linux-mtd.infradead.org/doc/ubi.html for additional information about UBI

=====Additional Notes=====

A side effect of the above behavior is it overwrites MWAN3 settings that are stored in /tmp/resolv.conf.auto.  If one has custom external DNS servers enabled for multiple WAN ports they will no longer be used.  This is not a flaw with OpenWRT, just a behavior to be aware of.  If one needs to configure specific upstream DNS servers, any custom DNS servers configured with MWAN can be configured within DNSMASQ.  Again, this is just something to be aware of.

Oddly, when doing a Google, Bing, etc search for these three terms: "resolvfile" "openwrt" "isc_dhcpd" NOTHING exists on the internet.  Until now that is.

The Default Configuration File can be over-ridden by placing the DHCPD configuration file here: /etc/dhcpd.conf

DHCPD Executable / Binary File: /usr/sbin/dhcpd

But also keep in mind the settings changes in the /etc/init.d/dhcpd startup script only affect the DHCPD service.  The /etc/resolv.conf File still derives its settings from the /etc/config/dhcp File when the DHCPD service is restarted or the router is rebooted (same for DNSMASQ).  IE, the /etc/config/dhcp File should not be completely dismissed as useless.

To restrict the DHCPD service to a specific interface, edit the /etc/init.d/dhcpd file, scroll way down to the start_service section, and look for the following line;

Change it in similar manner to the below examples;

Many sites suggest that creating a blank / empty zone for the subnet (on a multi-homed device) will make it so DHCPD doesn't answer for those interfaces.  But testing has prooven otherwise.  The below settings in /etc/dhcpd/dhcpd.conf will '''''00000000000000000000000000''''' prevent the DHCPD service from answering on the interface associated with the W.X.Y.Z IP Address;<syntaxhighlight lang="text">

*If a custom /etc/dhcpd.conf file is NOT being used and the standard OpenWRT method of using /etc/config/dhcp method is used (again, HINT: Use a custom /etc/dhcpd.conf file), the DHCPD startup script erases the symbolic link that connects /tmp/resolv.conf --> /tmp/resolv.conf.auto in favor of its own custom /tmp/resolv.conf file (/etc/resolv.conf).  This can break DNS settings for networking in general and MWAN3.

stop_service()

{

rm /var/run/dhcpd.pid

}

</syntaxhighlight>The ''ln'' command corrects the symbolic link issue mentioned above.  And the ''rm'' command corrects the PID file issue that never goes away, again mentioned above.  Also note that if the DHCPD package is ever updated, the script will need to be modified again.  A startup script could be written, but haven't had time to write that yet.  This post gives a fairly goot hint on how to write it: https://askubuntu.com/questions/77149/how-to-find-text-and-replace-that-line-if-exists-with-terminal-otherwise-just-ap  Although regular expressions wouldn't be necessary, just a check to see if "stop_service" exists anywhere in the dhcpd startup script and if it doesn't, insert it at the end.

/etc/init.d/dhcpd enabled && /etc/init.d/dhcpd stop && /etc/init.d/dhcpd start  

</syntaxhighlight>Adding the following to the /etc/rc.local file may be necessary too, when restarting the router: /etc/init.d/dhcpd enabled && /etc/init.d/dhcpd stop && /etc/init.d/dhcpd start

===SOCKD (Dante)===

opkg install apache apache-utils apache-mod-ssl

=====Configuration for Apache=====

*Executables / Binaries: /usr/lib/apache2

*User / Group (/etc/group): apache / apache

Below is working configuration file for Apache with CGI capability;<div class="toccolours mw-collapsible mw-collapsed" style="overflow:auto; width:100%;">

ServerRoot "/usr"

TimeOut 3600

#LoadModule mpm_event_module lib/apache2/mod_mpm_event.so

LoadModule alias_module lib/apache2/mod_alias.so

LoadModule rewrite_module lib/apache2/mod_rewrite.so

<IfModule unixd_module>

find /usr/share/apache2 -type f -exec chmod 644 {} \;

</syntaxhighlight>

In other installations, such as Redhat or CentOS, apache or apache2 is referred to as HTTPD in binary / executables, configuration files, commands, etc.

*LoadModule proxy_scgi_module lib/apache2/mod_proxy_scgi.so (Module does NOT exist for OpenWRT)

*LoadModule cgid_module lib/apache2/mod_cgid.so (does NOT seem to work, even when setting the ScriptSock Directive)

====Lighttpd====

opkg update

=====PHP Configuration in /etc/php.ini=====

As noted previously, but worth mentioning again, OpenWRT names the interactive command line interface for PHP ''php-cli''.  Most sites give examples that use the command ''php'', so to make it easier create a symbolic link with this command: ln -s /usr/bin/php-cli /usr/bin/php  

=====Installing=====

**Move the database to an external eSATA drive: datadir        = /mnt/sdb3/mysql

**Move the tmp directory to an external eSATA drive: datadir        = /tmp (This directory is relative to the datadir, in that it will be created at the same level as the mysql directory, so this is not an abolute path where it will utilize the /tmp directory in the root of the file system)

*To create a password for the current user (blank if not configured): /usr/bin/mysqladmin -u root password 'new-password'

*Log into the command line for the database: mysql -u root -p or use phpMyAdmin see below

Show available storage engines: SHOW ENGINES\G or show engines;

*opkg update

*opkg install php7-mod-mbstring php7-mod-json php7-mod-hash php7-mod-ctype php7-mod-zip php7-mod-gd php7-mod-mysqli php7-mod-session php7-mod-snmp zoneinfo-northamerica (if one is in North America, if not, choose another zone and remember, phpMyAdmin will display a blank page with no error if a zoneinfo-WhatEverZone is not installed in addition to the zoneinfo-core package, see additional information below, dependencies will also be installed automatically).

*'''ALSO MAKE SURE TO INSTALL THE APPROPRIATE TIME ZONE MODULE, IN ADDITION TO THE DEFAULT''' zoneinfo-core: opkg install zoneinfo-northamerica (for example)

*wget <nowiki>https://files.phpmyadmin.net/phpMyAdmin/4.9.5/phpMyAdmin-4.9.5-english.tar.gz</nowiki> (or whatever the latest version is)

*tar -xzvf phpMyAdmin-4.9.5-english.tar.gz

*mv WhatEverUnTarredDirectory /usr/share/apache/htdocs OR WhatEverLighttpd Directory

**post_max_size = 128M

**max_file_uploads = 20

*To diagnose any issues when attempting to access the phpMyAdmin setup this will display the error message (look for the line that says WarnMissingExtension to spot missing modules): php-cli /usr/share/apache2/htdocs/phpMyAdmin/setup/index.php

=====LetsEncrypt / ACME=====

*opkg list procps*

====Alternate Shells====

Install "Change Shell": opkg install shadow-chsh

=====Profiles=====

*opkg install samba36-server OR opkg install samba4-server samba4-utils

*opkg luci-app-samba OR opkg install luci-app-samba4

*smbpasswd -a root (or whatever user is desired)

         # Below is the key to getting Samba Server to work with Windows 10

         map to guest = Never

Then dd a Network Share: In LUCI GUI, Service, Network Shares, General Settings or Edit Template Tab, enter a Name and a Path, the other defaults are fine.

And lastly, remember if one attempts to share the "Root Directory" ( / ), none of the sub directories will open, because of the way the OpenWRT file system works.

===POPTOP / PPTPD===

First a warning so readers don't get frustrated:  Out of the box (as in a virgin installation of the POPTOP / PPTPD Package), the configuration for PPTPD from OpenWRT as of 8.2020 is broken and will not function.  Credit and thanks to this web site for a hint on correcting the default configuration was found here: https://forum.openwrt.org/t/default-config-file-for-pptpd-lacks-logwtmp-option/4795  How to fix it?  Well, follow the below directions.  Hint: The key is setting the ''option 'logwtmp' '0''' directive in the /etc/config/pptpd file (see below for more information).

====Installation====

opkg install pptpd ppp (dependencies will automatically be installed if just pptpd is installed)

====POPTOP / PPTPD Configuration Files and other Related File Locations====

====Configuring PPTPD====

First, configure the /etc/config/pptpd file.  Below is a working example;<syntaxhighlight lang="text">

config service 'pptpd'

*/etc/ppp/options (this can be left with default OpenWRT settings)

*/etc/ppp/options.pptpd (see below for a working version of this file, slightly different than the default OpenWRT version)

Below is a working example of the /etc/pptpd.conf file;<syntaxhighlight lang="text">

option src 'wan'

option proto '47'

</syntaxhighlight>The above ''list dest_ip 'W.X.Y.Z'<nowiki/>'' are only needed if using MWAN3 and can be eliminated from firewall configurations that don't have to consider multiple WAN ports.  If configured it would be set to the WAN IP Addresses of the router.

uci commit firewall

</syntaxhighlight>Hint: The same settings can be configured with far fewer keystrokes by simply editing the /etc/config/firewall file.  The example could also be made far more cleary by directly editing the /etc/config/firewall file, instead of blindly entering a bunch of command, some of which are useless.  Additionaly, some won't work correctly if the 'lan' and 'wan' zones aren't at index 0, and 1, as they are by default (IE, if someone has manually added additional zones).

===OpenVPN===

This section is written for people that are experienced with OpenVPN.

The LuCI interface provides a nice interface for keeping track of OpenVPN Server and Client configuration, plus editing and enabling and disabling a specific Server or Client configuration file.  OpenVPN for OpenWRT operates as it did for CentOS 6 where a single "OpenVPN Service" would "spawn" multiple instances of the OpenVPN binary / executable depending on how many Server and Client configuration files there are.  CentOS 7 and newer has it configured such that each instance of an OpenVPN Server and / or Client configuration file requires a separate service.

dh /etc/openvpn/keys/WhatEverPath/dh2048.pem

</syntaxhighlight>In the above configuration file, it is assumed that keys have already been generated (see below section for using Webmin to generate certificates).  The above storage location for keys is just an example that can be customized to any directory.

=====Firewall=====

*As of 8.2020, there is also an issue with the version number of of the LuCI GUI for OpenVPN (luci-app-openvpn).  The package version displayed via the System, Software page in the LuCI GUI displays git-2.229...  Downloading the IPK file manually (opkg download luci-app-openvpn) results in version git-2.234...  Additionally, the installation or upgrade via the LuCI GUI for the OpenVPN LuCI GUI interface seems to be unreliable.  The recommendation is to download manually (opkg download luci-app-openvpn) and install the downloaded file (opkg install WhatEverTheNameOfTheFileIs)

*Sadly, possibly due to space constraints and the desire to have the smallest binary / executable file possible for OpenVPN, the OpenWRT version does not contain any "help" information (IE, openvpn --help produces no output)

To install OpenVPN with OpenSSL and the LUCI GUI for it (under VPN)

DD is a program that functions as a cloning utility, among other capabilities and functions (noted in an earlier section for a different purpose).  When cloning an entire drive (SSD in the form of an mSATA, M.2 (NVME, NGFF), etc. device) / disk / flash drive* (* the term "drive" used later in this section will apply to whatever storage medium is being cloned), the image file should of couse be cloned to a separate device as with any other cloning software.  DD is capable of cloning an entire drive, etc. or a single partition

Below is a generic example command to clone a partition from one drive to another (remember, any data on the destination will be overwritten);

*rm /overlay/ZeroByteFile (this deletes the "Zero Byte File" to free up space as the above DD command made the ZeroByteFile as large as all of the available free space on the drive.)

**Example: dd if=/dev/sdb1 conv=sync,noerror bs=64K status=progress | gzip -c  > /mnt/sdb2/DD/EXT4a-9.20.2020.img.gz (this file is named after the partition it exists on and the date, but can be named anything)

=====Tip for Configuring a Cloned Drive after Cloning=====

=====Accessing an Image File (IE, mount it like a drive)=====

In the above example where a partition was cloned to an image file, utilities like WinRAR, WinImage, etc. cannot be used to access the file.  Since the image file represents an entire drive or partition, it can be mounted just like a physical drive.

To mount a partition (not a drive);

**-t = the type of file system (this could be -t vfat, -t ntfs, -t ext2, -t ext4 etc., and it should obviously match the type of the original file system, no experiments were done to see if mount utility could "auto detect" the file system, but it may have the capability)

**-o = Option (let the mount command know it is a "loop" device)

====Good 'ole Fashion, just make a copy====

Forget all the fancy backup stuff for this one.  Sometimes it's good just to make a manual copy of things.  This method works great for configuration files.  Not so much to avoid a failed drive, but more to preserve a working copy of a known good configuration file.  The idea is whenever one embarks on an upgrade or a major change (even a minor one too) to a service, sometimes it's good to make a copy of a working configuration file.  For instance, using the /etc/config/network configuration file: cp /etc/config/network /etc/config/network-09.30.2020  There, a copy of the original file with a date on the end of it.  Simple and effective if one needs to take a "single step back", instead of walking through the complexity of restoring files from Restic or a DD Tar.GZ file.

==Border Mail System (Postfix, MailScanner, MailWatch, ClamD,==

===Pre-Installation Tasks for Installing Webmin===

Unzip and UnTAR the file;

***CentOS typical location: /usr/libexec/webmin

***Debian: /usr/share/webmin

***Location noted by https://doxfer.webmin.com/Webmin/Installation_-_the_old_fashioned_way as the most common for "TAR" Installations: /usr/local/webmin

*gunzip webmin-1.955.tar.gz and tar xvf webmin-1.955.tar

OR

(be patient, there are a LOT of files, even on a fast USB 3.0 flash drive it takes a couple of minutes.

*If "untarred" a directory other than the installation, do one of the following;

*Before running the setup program;

**Add the bin Group to /etc/group using this directive: bin:x:1000: (OR, use the groupadd command: groupadd bin, the opkg install shadow-groupadd will be necessary for the groupadd command)

***opkg update

**Possible Errors & Solutions during and after Installation;

***"Perl Socket module not installed" Error will occur if perlbase-http-tiny is not installed.

***"stty: not found" / "Login password: ./setup.sh: line 396: stty: not found" (the line number may be different depending on the version of the setup script an Webmin being installed) Error will occur if coreutils-stty is not installed

***"Can't locate ExtUtils/CBuilder.pm in @INC (you may need to install the ExtUtils::CBuilder module" error occurs if perlbase-extutils is not installed

***" can't open '/var/log/webmin/miniserv.pid': No such file or directory" error occurs when stopping Webmin with /etc/webmin/stop

====A Special note on HTTPS (not the Module) for Webmin: Do NOT worry about it.  Forget it.  Almost impossible to get working.====

*Detailed instructions to install "The Old Fashion Way..." can be found here: https://doxfer.webmin.com/Webmin/Installation_-_the_old_fashioned_way

**Config Directory: /etc/webmin

**Log file directory: /var/log/webmin (NOTE: This directory is actually a symbolic link for /tmp, so it will not persist across reboots of a router.  If permanent logs for Webmin are desired, change the path)

***/var/log/webmin (note, this directory is actually located here: /tmp/log/webmin, and needs to be created each time the router is booted as the /tmp directory is just that, temporary)

***As of the 11.2020 version of Webmin, the default location seems to be /var/webmin, so watch out for that and change it to /var/log/webmin, otherwise, other items described in this article won't work, because Webmin won't start without the correct log path.

**Full path to perl: /usr/bin/perl

**MiniServe Configuration (the web process for webmin): /etc/webmin/miniserv.conf

<syntaxhighlight lang="text">

   1) Pardus Linux          2) SmartOS                3) Sun Solaris           

====Post Installation====

There is a choice for solving the above error, choose one of the following two items;

mkdir -p -m 0750 /var/log/webmin

mkdir -p -m 0750 /var/webmin

}

It also may claim that it has started webmin (immediately after the installation), but sometimes it doesn't really do that, so: /etc/webmin/stop, then /etc/webmin/start

NOTE: As of 11.2020, a newer version of Webmin overcomes the issue OR version 19.07.04 of OpenWRT's perl corrects the issue (didn't test which one it was, just noticed it)<syntaxhighlight lang="text">

</syntaxhighlight>

os_type=generic-linux

os_version=4

real_os_version=19.07.03

</syntaxhighlight>

os_type=linux

os_version=4

real_os_type=OpenWRT

real_os_version=19.07.03

===Adding and Configuring Webmin Features & Modules===

*CLOCK, Settings Icon (the gear at the top left of the configuration payne), System configuration, System time setting format, YYYYMMDDHHMM.SS Radio Button

OR

First, if it hasn't already been stated, a LuCI GUI (Services, Network Shares) for Samba exists.  AND it makes sense to stay within the OpenWRT management / configuration paradigm for services (/etc/config/samba3 or samba4).  Having noted that, the LuCI GUI does not have all the bells and whistles of Webmin, but what is there looks a whole lot better.  So for this one, a hybrid approach is best.

*Original line: os_support=solaris *-linux aix hpux freebsd osf1 irix openserver unixware openbsd macos netbsd

====Third Party Modules (OpenVPN Certificate Authority, not OpenVPN itself as that is configured via LuCI or /etc/config, etc)====

OpenVPN (/etc/webmin/openvpn/config);<div class="toccolours mw-collapsible mw-collapsed" style="overflow:auto; width:100%;">

</syntaxhighlight></div></div>

===Starting and Stopping Webmin===

Unlike many models of routers that require a similar connector be soldered to a circuit board, the AC Series of routers has this feature installed during manufacturing.  Even though the cost is quite small per unit, it can add up to a significant amount of money with a large production run.  This implies Linksys was anticipating the router would be used by a modding community.  So thank you to the Linksys engineers and management that made sure that feature was included with the router.  On the cynical "bean counter" side of things, including a feature which makes it easier to salvage a "[[wikipedia:Brick_(electronics)|bricked]]" router, also probably cuts down on the number customers attempting to return "failed" units to Linksys.

===Serial Ports and TTL Serial Communication===

[[File:USBABCable.jpg|none|thumb|126x126px|USB B to USB A with Cable]]

Link as of Late 2020:https://www.ebay.com/itm/PL2303TA-USB-to-TTL-RS232-COM-UART-Module-Serial-Cable-Adapter-for-Arduino/233559278066

<br />

===The Real Pin # 1===

Many website tutorials, YouTube videos, diagrams, and even images on the OpenWRT website show the TTL Serial Port for the AC series of routers numbered from left to right, starting with "pin 1", as viewed from the top / front of the circuit board.  This is NOT correct, although both the names / labels of the pins and what their function is (Ground, TX (Transmit), and RX (Receive)), ''are correct''.  It is an industry standard to identify "Pin 1" on a circuit board in several manners.  The most common methods includes a triangle printed on the circuit board closest to "Pin 1" and a square solder connection (as viewed from the bottom).  Another convention that is typically followed, but is not an absolute rule, is putting "Pin 1" closest to the nearest edge of a circuit board.  The AC Series of routers all have a square solder connection on the bottom and a triangle printed on top of the circuit board for "Pin 1" on the right side of the connector, as viewed from the top.  Since there is no pinout standard for that type of connector, the manufacturer (Linksys in this case) gets to define where "Pin 1" is located.  And per the triangle marking, pin closest to edge, and square solder connection pin number one is located as indicated by the below image.  PERIOD.  Image is courtesy of: http://wtarreau.blogspot.com/2018/

For a detailed explanation of Serial Ports: https://en.wikipedia.org/wiki/Serial_port

Various comparisons between RS-232 and TTL: https://learn.sparkfun.com/tutorials/serial-communication/wiring-and-hardware  

==MWAN Failover==

{{:OpenWRT_MWAN_Failover}}

==PPPoE (Point to Point over Ethernet)==

{{:OpenWRT_PPPoE}}

opkg update

opkg install shadow-passwd shadow-useradd shadow-groupadd

After: root::18475:0:99999:7:::<br />

*