Alternative OpenWrt/MTKSDK build for the WITI board [WIP]

[stas2z]

@adrianrobotka
mwan3 is supplied with this firmware as a separate package (check packages folder under download folder), trunk version needs scripts modifying to work properly

@maurer

what crypto settings did you use to get to this numbers?AES ? MD5 ?

AES_CBC_128/HMAC_SHA1_96 (esp=aes128-sha1)

[freespirit]

Well this should be the performance! Can you post your strongswan and xl2tpd configuration ?

p.s. can you also include login in busybox setup in the next firmware release ? Just to enable password prompt also on serial console ( https://forum.openwrt.org/viewtopic.php?id=16900 )

[stas2z]

p.s. can you also include login in busybox setup in the next firmware release ? Just to enable password prompt also on serial console ( https://forum.openwrt.org/viewtopic.php?id=16900 )

ive made it better way
like in lede it will be controlled by ttylogin option in /etc/config/system

option ttylogin 0 is by default, switching it to 1 will cause loging prompt for tty
to make it possible - update yr firmware with this build
https://yadi.sk/d/lzrjbkjSn2AH4/3.4/MtWrt-16111114

remove /etc/inittab before updating to prevent restoring old version
add option ttylogin 0 or option ttylogin 1 under config system section

if you already updated it and not removed /etc/inittab before, just replace ::askconsole:/bin/ash --login with ::askconsole:/usr/libexec/login.sh

also this version includes smp_affinity optimizations for better utilizing cpu cores

[freespirit]

Well faster than light! Thanks I'll try, remember to post also the strongswan + xl2tpd configuration

[stas2z]

post also the strongswan + xl2tpd configuration

server
ipsec.conf

conn l2tp
        esp=aes128-sha1
	ike=aes128-sha1
        authby=secret
        rekey=yes
        keyingtries=3
        type=transport
        rekey=no
        left=%any
        leftprotoport=udp/%any
        right=%any
        rightprotoport=udp/%any
        auto=add
        keyexchange=ikev1

xl2tpd.conf

[global]
port = 1701
access control = no

[lns default]
ip range = 10.10.1.2-10.10.1.10
local ip = 10.10.1.1
refuse pap = yes
require authentication = yes
name = l2tpd
pppoptfile = /etc/ppp/options.xl2tpd
;ppp debug = yes
length bit = yes

options.xl2tpd

require-mschap-v2
ms-dns 8.8.8.8
ms-dns 8.8.4.4
auth
mtu 1410
mru 1410
crtscts
modem
name l2tpd
proxyarp
lcp-echo-interval 30
lcp-echo-failure 4

client
conn ipsec

    esp=aes128-sha1
    ike=aes128-sha1
    authby=secret
    rekey=no
    keyingtries=3
    type=transport
    rekey=no
    left=%defaultroute
    leftprotoport=udp/%any
    right=##server-ip##
    rightprotoport=udp/%any
    auto=add
    keyexchange=ikev1

xl2tpd configuration done by luci
/etc/config/network

config interface 'ipsec'
	option proto 'l2tp'
	option server '##server-ip##'
	option username 'ipsecclient'
	option password 'ipsecpass'
	option peerdns '0'
	option dns '8.8.8.8 8.8.4.4'
	option defaultroute '1'

and don't forget to add PSK to /etc/ipsec.secrets and ppp user to /etc/ppp/chap-secrets

[adrianrobotka]

Thanks (specially the fast reply),

I've downloaded and installed the mwan3*.ipk and luci-app-mwan3*.ipk files from https://yadi.sk/d/lzrjbkjSn2AH4/newgen/r62/WITI-16042307/packages but I get the following error while I tried to run mwan3 command:
sh: ]: unknown operand

Should I try to fix mwan3 sh files or is there another way?

[stas2z]

try it from here
https://yadi.sk/d/lzrjbkjSn2AH4/3.4/MtWrt-16111114/packages

[stas2z]

which could be useful

oh, thats nice but late:) tried to find that gsw doc for a long time

[freespirit]

Both client and server, I can't ask more, thanks a lot! Oh by the way I have a working link to mt7621 programming guide if someone is interested send me a pm...

[build000]

@stas2z:
Listen pal, if:
1) you could still not cover the lack of time (he ... for over a year! ... good) and do something about what you all ask?
- Throw at the end of the source of his work with the version 3.4 on git, it certainly will go faster development of the fork
2) would welcome a genuine documentation/description of activities/etc. for your compilation in the form of digestible for most people (eg. a PDF) and updating the first post about the recent changes, new builds, etc. (real changelog)

Jumping after hundreds of posts (not necessarily in order of their creation) does not serve the interest on does not look like getting better (if not best) fork on WiTi - frankly authors/creators of the device in the world simply forgive myself making a good software for this device - briefly saying your work is the only viable alternative for owners of this "miracle" that is WiTi.
Feel a little liability to others for your code and overall creative work - I say bluntly - stop being such an asshole what many in the network and stand at the end of the challenge! (haha)
AMEN.

[freespirit]

option ttylogin 0 is by default, switching it to 1 will cause loging prompt for tty
to make it possible - update yr firmware with this build
https://yadi.sk/d/lzrjbkjSn2AH4/3.4/MtWrt-16111114

also this version includes smp_affinity optimizations for better utilizing cpu cores

Just to know in this firmware is the dns working ? Wan goes up with dhcpc but dns seems broken, tried also to disable firewall...

p.s. has anybody an idea why using pivot root on external drive every time I flash a new firmware external fs the external root does not get mount again (I have to edit manually the /etc/fstab and reboot) ?!?

[email protected]:/# nslookup www.libero.it 8.8.8.8
Server: 8.8.8.8
Address 1: 8.8.8.8

nslookup: can't resolve 'www.libero.it': Try again
[email protected]:/#

[email protected]:/# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=46 time=22.234 ms
64 bytes from 8.8.8.8: seq=1 ttl=46 time=21.699 ms
64 bytes from 8.8.8.8: seq=2 ttl=46 time=21.761 ms
64 bytes from 8.8.8.8: seq=3 ttl=46 time=21.672 ms

[stas2z]

Just to know in this firmware is the dns working ?

sure it works

[email protected]:~# nslookup www.libero.it 8.8.8.8
Server:    8.8.8.8
Address 1: 8.8.8.8 google-public-dns-a.google.com

Name:      www.libero.it
Address 1: 37.9.239.32


[email protected]:~# nslookup www.libero.it
nslookup: can't resolve '(null)': Name does not resolve

Name:      www.libero.it
Address 1: 37.9.239.32

[email protected]:~# ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: seq=0 ttl=58 time=3.531 ms
64 bytes from 8.8.8.8: seq=1 ttl=58 time=3.286 ms
64 bytes from 8.8.8.8: seq=2 ttl=58 time=3.382 ms
64 bytes from 8.8.8.8: seq=3 ttl=58 time=3.259 ms
64 bytes from 8.8.8.8: seq=4 ttl=58 time=3.248 ms
64 bytes from 8.8.8.8: seq=5 ttl=58 time=3.218 ms
^C
--- 8.8.8.8 ping statistics ---
6 packets transmitted, 6 packets received, 0% packet loss
round-trip min/avg/max = 3.218/3.320/3.531 ms

seems like a firewall issue, if yr router can ping but can't connect dns, check port 53 availability for outside connections

[freespirit]

Sorry fake alarm, strongswan had changed resolv.conf with vpn's nameservers and due to a crash they hadn't probably been removed (don't ask me why nslookup does not work even by passing the dns server).
Another question: is there any guru of ipsec routing ? I am trying to configure this IkeV2 vpn with strongswan (it's free https://community.hide.me/tutorials/ipsec-ikev2-with-strongswan-non-gui-method.43/ ), I managed to connect and establish the ipsec tunnel, yet "no default route is installed" and the traffic is not relayed through vpn. I tried also the same configuration on ubuntu and it works flawlessly relaying automatically all traffic. Can anyone try to setup the same vpn on the witi and check if routes all traffic to vpn (just execute "traceroute www.google.com" before and after setting up the vpn connection to see the two routes) ?

[adrianrobotka]

https://yadi.sk/d/lzrjbkjSn2AH4/3.4/MtWrt-161111

I tried those packages.
Under your 3.10 kernel I got a bunch of errors like this for mwan3 start:

ipset v6.24: Kernel error received: Invalid argument
iptables v1.4.21: Kernel module xt_set is not loaded in.

Under your 3.4 kernel It works fine.

Can this work under 3.10 kernel?

[stas2z]

ipset v6.24: Kernel error received: Invalid argumentiptables v1.4.21: Kernel module xt_set is not loaded in.

ok, ive checked, seems like kmod-ipt-ipsec is broken and missed in all "newgen" builds

[stas2z]

ok, its done
for 3.10 kernel fans r62 reborn edition has been built

https://yadi.sk/d/lzrjbkjSn2AH4/newgen/r62-reborn
integrates latest switch code/wifi driver, some new/updated packages and several fixes from 3.4 builds
includes kmod-ipt-ipset so mwan3 works flawlessly

but ive tested it for an hour, can't garantee it's bugless, u know

upd. reuploaded with several fixes (add multicast kernel options/m2u bridge capability)

[adrianrobotka]

Thank you. It works!

[stas2z]

latest 3.4 build: https://yadi.sk/d/lzrjbkjSn2AH4/3.4/MtWrt-16112215
75% packages updated, several backports from LEDE
kernel upstream backports

as it changed a lot, can be buggy

upd: a little note for adblock users, ive removed full wget from default build (too much fetch clients preinstalled, uclient/wget/curl) and kept only busybox version, but forget to include a tiny libustream-openssl library required for adblock to fetch data via uclient-fetch

install it manually to make it work again

if you already have full wget package installed, it's ok too

[rizla3066]

What package source can we use for both 3.4 and 3.10 builds? Can i use openwrt snapshot packages?

I need to build some binarys myself that are not included in the package list so is there any toolchains specific for the 3.4 or 3.10 builds? Can i use openwrt toolchain for both versions?

[stas2z]

can we use for both 3.4 and 3.10 builds?

most latest builds use musl 1.1.14 and mips1004k arch
latest snapshot builds use musl 1.1.15 but it works anyway, so you can use snapshots repo for additional packages (except kernel modules)
https://downloads.openwrt.org/snapshots/trunk/ramips/mt7621/
or
use old mirror with 1.1.14 musl based packages ftp://ftp.stw-bonn.de/pub/openwrt/snapshots/trunk/ramips/mt7621/ (in case of any problems with packages compiled with 1.1.15 musl)

add proper links to /etc/opkg/customfeeds.conf and setup arches
arch all 100
arch ramips 150
arch ramips_24kec 200
arch ramips_1004kc 300

also u can use snapshots toolchain for sure
ftp://ftp.stw-bonn.de/pub/openwrt/snapshots/trunk/ramips/mt7621/OpenWrt-Toolchain-ramips-mt7621_gcc-5.3.0_musl-1.1.14.Linux-x86_64.tar.bz2

upd.
about archs:
all - generic code independed packages (like shell scripts)
ramips is a "generic" arch, = code is compatible with any mipsel (mips, little endings byte order) SoC
ramips_24kec is an arch for packages optimized for MIPS 24KEc SoC
ramips_1004kc is an arch for packages optimized for MIPS 1004Kc SoC

ramips_24kec packages ARE compatible with ramips_1004kc SoC (MT7621), but it's a one way compatibility