I have a FON router which allow anyone to connect to Intenet via my network connection. I like the openess and idea behind FON but I do not want to get in trouble if someone do bad things and using my network connection.

One solution is to connect the FON accesspoint to a separate network segment and let all traffic from that network go through TOR, the onion router. 

Another feature is when I want to be anonymous on Internet I plugin my computer to that network segment.

Setup

I use OpenBSD as my firewall and the first step is to download, compile and configure TOR. I downloaded the tarball from https://www.torproject.org and used the normal procedure:

# wget https://www.torproject.org/dist/tor-0.2.2.35.tar.gz

# tar xzvf tor-0.2.2.35.tar.gz 

# cd tor-0.2.2.35                                                                                                                                                                

# ./configure&&make&&make install

Configure pf

I use a specific ethernet interface, fxp0, which will route all traffic into tor. 

--cut from /etc/pf.conf--

#Tor traffic

tor_if ="fxp0"

# Tor's TransPort

trans_port = "9040"

pass in quick on $tor_if inet proto udp to port domain rdr-to 127.0.0.1 port 5300 

pass in quick on $tor_if inet proto { tcp udp } to !($tor_if) rdr-to 127.0.0.1 port $trans_port

--end cut--

Configure tor

# cat /usr/local/etc/tor/torrc

VirtualAddrNetwork 10.192.0.0/10

AutomapHostsOnResolve 1

TransPort 9040

DNSPort 5300

Log notice syslog

#Log debug stderr

RunAsDaemon 1

Note: I know that best practice is to let the tor process run as non root user. That requires read access to /dev/pf and I did not bother to get it working.

Dhcpd config

I assume that a OpenBSD sysadmin knows how to setup dhcpd so I will just show the config addon I did to /etc/dhcpd.conf.

shared-network tor-net {

        option  domain-name "it-slav-tor-net";

        option  domain-name-servers 10.1.2.1;

        option  ntp-servers 10.1.2.1;

        subnet 10.1.2.0 netmask 255.255.255.0 {

                option routers 10.1.2.1;

                range 10.1.2.100 10.1.2.200;

        }

The ip-adress of the fxp0 interface is 10.1.2.1

Start tor

# /usr/local/bin/tor

Jan 10 20:52:48.880 [notice] Tor v0.2.2.35 (git-b04388f9e7546a9f). This is experimental software. Do not rely on it for strong anonymity. (Running on OpenBSD i386)

Jan 10 20:52:48.885 [warn] It's a little hard to tell, but you seem to have Libevent 1.4.0-beta header files, whereas you have linked against Libevent 1.4.14b-stable.  This will probably make Tor crash.

Jan 10 20:52:48.886 [notice] Initialized libevent version 1.4.14b-stable using method kqueue. Good.

Jan 10 20:52:48.886 [notice] Opening Socks listener on 127.0.0.1:9050

Jan 10 20:52:48.887 [notice] Opening Transparent pf/netfilter listener on 127.0.0.1:9040

Jan 10 20:52:48.887 [notice] Opening DNS listener on 127.0.0.1:5300

Final step

Plugin your fon router and enjoy!

Links

The hints to this article was found at:

•  https://trac.torproject.org/projects/tor/wiki/TheOnionRouter/TransparentProxy 

I wanted to use a 3G dongle with a twin SIM card as my Internet connection when I’m traveling. I have earlier decribed howto share the Internet connection and make it more flexible by using an OpenWRT router with USB interface as a bridge between Wlan and 3G/GPRS provided internet.

Unfortunatly Tele2s support personel cannot keep track of the unlogical rules among their different subscriptions so they fouled my to buy a twincard to my regular subscription and use that for data. After a couple of more calls to Tele2, including that they listened to a recording of when I ordered the twincard I have to give up that track because it was not possible. The twincard only works for phone calls, not data connections and especially not when I had a flatrate subscription on my master SIM card.

After some investigation I came to the conclusion that I have to use my Regular phone, a HTC Desire with Android as my connection to internet.

Unfortunatly the work done with getting the USB 3G dongle was a waste of time.

PreReq

An OpenWRT router with a working USB interface and a rndis enabled modem, I use a HTC Desire.

Installation

root@WRT160NL:~# opkg install kmod-usb-net-rndis

I also installed some USB packages, probably not all of them are necessery:

root@WRT160NL:~#opkg install kmod-ar9170 kmod-usb-acm kmod-usb-core kmod-usb-ohci kmod-usb-serial comgt
kmod-usb-serial-option kmod-usb-storage kmod-usb-uhci kmod-usb2  usb-switch

Add the following to /etc/config/network

config 'interface' 'usb0'
    option 'name' 'usb0'
    option 'proto' 'dhcp'
    option 'ifname' 'usb0'
    option 'defaultroute' '0'
    option 'peerdns' '0'
 

Use the same firewall rules with your 3G connection as your normal WLAN, add the yellow marked line to /etc/config/firewall:

config 'zone'
    option 'name' 'wan'
    option 'input' 'REJECT'
    option 'output' 'ACCEPT'
    option 'forward' 'REJECT'
    option 'masq' '1'
    option 'mtu_fix' '1'
    option 'network' 'wan usb0 ppp0'

Do a reboot
 

Test

To use your new connection, run ifup

root@WRT160NL:~# ifup usb0
udhcpc (v1.15.3) started
root@OpenWrt:~# Sending discover...
Sending select for 192.168.100.100...
Lease of 192.168.100.100 obtained, lease time 864000
udhcpc: ifconfig usb0 192.168.100.100 netmask 255.255.255.0 broadcast +
udhcpc: setting default routers: 192.168.100.254
udhcpc: setting dns servers: 192.168.100.254

root@WRT160NL:~# ping www.google.com
PING www.google.com (74.125.39.104): 56 data bytes
64 bytes from 74.125.39.104: seq=0 ttl=51 time=371.025 ms
64 bytes from 74.125.39.104: seq=1 ttl=51 time=388.617 ms
64 bytes from 74.125.39.104: seq=2 ttl=51 time=316.767 ms
^C
--- www.google.com ping statistics ---
4 packets transmitted, 3 packets received, 25% packet loss
round-trip min/avg/max = 316.767/358.803/388.617 ms

Shutdown the connection with ifdown

root@WRT160NL:~# ifdown usb0

Background

After waiting for the Hummingbird release for the LaFonera 2.0G a long time and discussed with the Fon support team when 3G dongles will work, I gave up and installed OpenWRT on my LaFonera 2.0G router.

I’m sorry FON, you have a cool idea and nice routers but your unlogical approach to the users and communtity, finally got me to install plain OpenWRT instead.

Installation

After alot of googling and testing and downloading, reading and so on, I finally run into a guide that worked for me.

Most of the descriptions and howto assumes that the RedBoot will accept to download a new firmware via TFTP, this is true with the early releases of 2.0G , but the one sold now do not have this feature.

The trick is to install a firmware that allows changing the RedBoot partition of the memory, change the RedBoot parttion and install OpenWRT via TFTP.

The guide is unfortunatly in French, but google translate helped me to translate it to English.

The pitfalls I run into is to reboot the device several timesafter installing the hacked version of FON firmware: FON2202_2.2.5.0_Flipper_RedBootC_VoteGOP.image

The only difference is that I used a later version of OpenWRT. I used Backfire 10.03 instead of Kamikaze 8.9.1

For the first time I felt that this is more than a phone, for the first time calender integration works, for the first time I can use the builtin GPS, for the first time accessing the web with a phone works, for the first time downloaded software really works.

My favorite apps so far is:

• Nagroid, to be able to view my op5 Monitor status
• FONMaps, find hotspots for LaFoneras
• Car Cast, listen and download podcasts
• MapDroid, to use preloaded OpenStreetmaps and GPS without using any bandwidth. Perfect when abroad because of the crazy price of data roaming outside Sweden.
• HTC Facebook, read and post on facebook
• FON Access, automatically connect to FON hotspots when traveling.
• GPS Logger, logg tracks in gpx format that almost any GPS software understand
• Sipdroid, to connect to my Asterisk PBX using 3G or WiFi

Of  cource the device is not perfect, I miss:

• The phone must be ‘rooted’ to be real useful, why? Open the phone so the community and others can develop apps that are real useful. Vendor lock-in always sucks.
• IPSec VPN so I can connect to my IPSec based OpenBSD firewall. The IPSec implementation in the phone sucks.
• OpenVPN, there exists OpenVPN apps but to use the the phone must be ‘rooted’
• Bluetooth modem, it is not possible to use the phone as a modem using bluetooth
• Screenshots, the phone must be rooted or using the SDK to take screenshoots. Why?

I really hope that Google and/or HTC understand and use the power of the community to make the Android even more succesfull by open it even more.

I bought a Fonera 2.0g WLAN router and I wanted to extend the functionality to have the possibility to add packages from OpenWRT. I also wanted the possibility to manage my new router with ssh.

The way to achive this is by installing developer firmware.

Installing

I followed the instructions at Fons beta/developer wiki.

The image I used can be found here.

Test

I try to connect by using ssh

peter@peter-laptop:~$ ssh -l root 192.168.10.1
root@192.168.10.1's password: 

BusyBox v1.11.1 (2009-04-17 12:45:57 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.

                                        __
                                    _.-~  )
                         _..--~~~~,'   ,-/     _
                      .-'. . . .'   ,-','    ,' )
                    ,'. . . _   ,--~,-'__..-'  ,'
                  ,'. . .  (@)' ---~~~~      ,'
                 /. . . . '~~             ,-'
                /. . . . .             ,-'
               ; . . . .  - .        ,'
              : . . . .       _     /
             . . . . .          `-.:
            . . . ./  - .          )
           .  . . |  _____..---.._/ ____ Seal _
     ~---~~~~----~~~~             ~~                

                      Flipper                       

--------  Fonera 2.0 Firmware (v2.2.5.0) -----------
      * Based on OpenWrt - http://openwrt.org
      * Powered by FON - http://www.fon.com
----------------------------------------------------

When using a cool router software like OpenWRT it is a good idea to monitor the network usage. This article describe howto get SNMP on your OpenWRT based router.

1. Install

The easiest way is to use the webgui, http://<your router ip>

1. Log in as root/-<your password>
2. Click on Adminstrator to enable the Advnced menues
3. System->Software
4. Click on "Update Package List" (this require Internet access).
5. Install snmpd-static

2. Configure

Log in to the La Fonera using ssh:

peter@peter-laptop:~$ ssh -l root 192.168.0.159
root@192.168.0.159's password:

BusyBox v1.11.2 (2009-12-02 11:25:47 UTC) built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (8.09.2, r18961) -------------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@fon:~#

Start snmpd

root@fon:~# /etc/init.d/snmpd start

Make it start when rebooted:

root@fon:~# /etc/init.d/snmpd enable

If you want to change your SNMP configuration the configuration is located in:

/etc/config/snmpd.conf

3. Monitor

Now you can get the SNMP data and use your favorite Monitor tool, i.e. Nagios or op5 Monitor.

Below a screenshoot from op5 Monitor:

Useful links

• OpenWRT, an OpenSource router software
• Net-SNMP, an SNMP implementation
• Nagios, an OpenSource Monitoring software
• op5 Monitor, an Enterprise Class Monitoring software based on Nagios

 Background

I got an unused La Fonera router by a collegue. They can be bought from http://www.fon.com for approximately 40 Euro including freight. The purpose of the Fon community is to build a community of hotspots around the world so every owner of a La Fonera could use any other La Fonera router in the world.

I am curios about the legal aspect if someone in the Fon community uses my internet connection to do something bad, like download copyrighted software, hack CIA or whatever.

The La Fonera router is real cool because:

• Looks good so it has a high wife acceptance factor
• Hackable, the firmware could be replaced with for example OpenWRT, DD-WRT, Jasager and others…
• Even more hackable, there are several guides and howtos to modify the La Fonera hardware.
• Cheap, in the good old days it was possible to get one for free.

Install OpenWRT

I followed this guide, the only exception was that I used the latest OpenWRT in "Phase C":

 # ./ap51-flash-1.0-42 eth0 openwrt-atheros-root.squashfs openwrt-atheros-vmlinux.lzma

The files can be downloaded from OpenWRTs download section for atheros platform.