Convert Microsoft to LINUX: OpenWrt Linux Router

Setting up openvpn on a Linksys WRT54G/GS Router with OpenWrt

Several Linksys routers come with a firmare chip that can be updated to install the latest Linux OpenWrt distribution. This is particularly made for routers, is Debian based and includes many add on packages. For details of installing it go here. Here is a rough summary of how to do this:

  1. Install the latest OpenWrt which is White Russian version ".9".
  2. Install the addon package called Webif^2. This is known as the enhanced web interface.
  3. You can use the web interface and it will work out of the box. This assumes you wish to bridge the wireless and lan network. However, if you wish to seperate them, click on the enable split from lan under the Network | Wifi-lan item.
  4. In order to make this work properly, so that NAT happens on the wireless interface you need to modify the S35firewall file in the /etc/init.d/ directory.
  5. You need to create a new variable WIFI defined by the following lines. Note, the first line should already be there at the top of the file.
    LAN="$(nvram get lan_ifname)"
    WIFI="$(nvram get wifi_ifname)"
    You also need to add these two lines to the FORWARDING Section at the end of the #allow sub section:
    # allow
    iptables -A FORWARD -i br1 -o br1 -j ACCEPT
    iptables -A FORWARD -i $WIFI -o $WAN -j ACCEPT
    For the full S35firewall file click here. You will additionally need the corrected S41wpa file for wireless encryption on an isolated network. The above assumes the wireless network "br1"is isolated from the lan "br0". You will also want to use this file S46openvpn instead of the S50openvpn one that comes with the package.
    If you are doing aliasing on your router, hosting virtual IP websites use a file called S42aliases in the /etc/init.d directory. This is typically used with SSL on port 443.
    Here is a sample firewall file, created by using the Webif^2 GUI interface. It resides at /etc/config/firewall
  6. Lastly you can install the modules for openvpn if you desire to have this too. The only cumbersome part here is generating all the server side certificates. You can do this using a graphical interface called tinyca2 which is available on Ubuntu by typing:
    apt-get install tinyca2
    You can then upload the certificates to the router using the Webif^2 graphical interface. i.e. In a browser go to:
    http://192.168.1.1
  7. Just to make sure you have everything right, here are my settings for the nvram . I installed these packages on the router. Finally this is my server.conf and client.conf file for openvpn. Note, the server.conf file goes on the router. The client.conf file goes on your laptop. They both are in a directory called /etc/openvpn
    Enjoy!