Linux Firmware For Some 802.11b Access Points

drwho writes "This just unveiled at the BAWUG meeting tonight: Linux firmware for Access Points. Check this URL for more info. I haven't tried it yet but it looks great!" The upshot is that certain Access Points can be flashed with a stripped-down Linux system, which makes them more flexible than they'd be under the included firmware. There are even some screenshots of a modded access point booting up.

Comments

2.4.x

[tulare]

A quick thought - iptables on an access point? That I like. Think of all the possiblities...

Re:2.4.x

[1010011010]

Another thought:

IPSec on the access point. Screw WEP!

Re:2.4.x

[tulare]

Not a bad point, actually. I don't imagine that you could run all the packets through some 500-line list of various netfilter errata. What I had in mind would be more like

1. iptables -A INPUT -s --source-mac [mac address of my allowed devices] -j ACCEPT
2. 
   iptables -P INPUT DROP
   iptables -t nat -A POSTROUTING -o [er, whatever the interface is called] -j MASQUERADE

Not neccessarily complete or accurate in terms of syntax, but you get the gist. Nothing requiring too much memory usage, but enough to ensure you can limit the use of the access point to trusted devices.

Re:2.4.x

[louissypher]

With the embedded processor that those access points have (16.4 BogoMips), forget IPSEC.

firewall replacement

[47PHA60]

One thing that irks me to no end is that my home firewall is a noisy old Pentium 200 with disks and fans. I've been looking into embedded systems to do this, and the current access points I've seen are not effective firewalls at all; no logging, and they don't _reall_ block everything, even though they say they do. A small Linux kernel which does not need to be built up with support for PCI, two ethernet cards, disks and multiple filesystems might just do the trick.

Slogan

[Hougaard]

I Like their slogan:

"All your base stations are belong to us"

.. Sense of humor :)

Mirror of Screenshots

[NewbieSpaz]

Here: http://kevindustries.com/screens.html

Hmm, security?

[RC514]

After the initial install with the SRAM card the access point can be upgraded over the network.

Does that mean the vendors of access points do not write protect the operating system on the hardware level? Or are future modifications only possible when the jumper remains in the upgrade position? If the jumper becomes meaningless after the upgrade, its implementation is a serious design flaw and an undetected rooting waiting to happen.

Hardware

[Cybersonic]

in case your curious, this works on access points using the Eumitcom WL11000SA-N boards...
( ref: http://opensource.instant802.com/hardware.php )
Tested: US Robotics 2450, SMC EZconnect 2652W

Time to buy an SMC for me :)

Re:How are they doing bridging?

[irregular_hero]

The "bridging code" is standard Linux bridging. I think what you're referring to is the "Host AP" or "Infrastructure" mode of the wireless card inside the AP.

If the card is based on the Prism chipset, there's already a Linux driver that will operate the card in Host AP mode by implementing some of the functions normally present in the access point's Infrastructure mode in user space. Other things are handled by the card.

For example, the card itself will handle time-dependent functions like beacon-sending. And it will handle hardware-dependent functions like WEP encrypt-decrypt (optionally). But the association table and all the rest of the functions are part of user space.

Incidentally, you don't need the Host AP driver for your Wireless card to operate a bridged network. Oddly enough, the bridge code in the Linux kernel functions just fine with a wireless card in Peer-to-Peer mode -- it is, after all, just another interface to the kernel itself. What you won't get in peer to peer is sophisticated association handling -- that means that the signal strength meter in your wireless tools won't work exactly right in most commercial packages.

You can build an AP on a PC:

[burntfungus]

You can build a Linux Access point on a PC or laptop, pehaps even a PDA:

http://people.ssh.com/jkm/Prism2/

Bridging software: http://bridge.sourceforge.net

Use serial port for modem backup?

[Fencepost]

One of the features that I like about the MultiTech router/switch I have is that a modem can be hung off the serial port and used as a backup connection. What would it take to do the same with this, and is there a getty out there that would support operating both ways (i.e. use a modem for dialout, but if a terminal was connected instead then allow login).