Setup VLAN with TP-LINK WR1043ND v1.6 (LibreCMC)

As mentioned before, I have flashed LibreCMC on TP-LINK WR1043ND v1.6 with WiFi disabled. It is my backup router.  Because my ISP support 2 IPs, and the new cable modem does come with 2 ethernet ports, I have one port connecting to my DIR-882 (using Padavan firmware) serving the main floor and my bedroom in 2nd floor with WiFi enabled.  The 2nd port is now connected to TP-Link WR1043 in the study room.  Now, I want to create a separate VLAN for miner, so, it is separated from my test equipment.  So, I update LibreCMC to 1.5.14.  It requires the "Keep Settings" to be unchecked for the upgrade.  Please check the link below before proceed.  Since it was a backup router, it does not matter for me if the settings are wiped.  

Releases - Gogs (librecmc.org)

There is not many guides in the internet for LibreCMC.  Since it is based on OpenWrt 19.x, I check the youtube guide below.  

How to Create a VLAN - A Beginner's Guide // OpenWrt Router (Up to 19.x) - YouTube

How to configure OpenWrt as Firewall for your home network and Guest Wifi and IPTables explained - YouTube

First step is to go to Network > Switches.  You will see VLAN 1 and 2 populated already.  Now, add a new switches with VLAN 5.  I pick LAN port 3 for VLAN 5 which will be used by the miner.  VLAN 1 will be used for test equipment (LAN port 1, 2 4). 

Second step is to go to Network > Interfaces.  Click "Add new Interface" to add a new interface named  VLAN_5.  Below are the rest of settings.

Protocol: static addresses

For my setup, "Create a bridge over Multiple Interfaces" is unchecked since WiFi is disable.  

Cover the following interfaces: select eth0.5 (automatically created when VLAN 5 is created in previous step)

Then, go to Network > Interfaces again.  Click on the VLAN_5 interface and apply the settings below.

Protocol: Static address

Bring up on Boot: checked

IPv4 address: default gateway for subnet VLAN 5

IPv4 subnet mask: select the subnet mask

Then scroll down to DHCP server section.

Select the range for DHCP client IP address and the lease time. 

Click on Advance Settings under DHCP section.  Make sure Dynamic DHCP is checked.  

Now, click on Physical Settings tab.  In my case, Bridge Interface is unchecked since WiFi is turned off and the correct Interface eth0.5 is selected for VLAN 5.  

Next, go to Firewall Settings Tab.  Create a new firewall zone called VLAN5 for VLAN 5.  

Lastly is to config firewall.  For VLAN_5, I don't want the miner to reach the router other than getting IP and DNS resolution but will have access to internet.  Also, it cannot reach to VLAN 1.  

So, setup VLAN5 zone to allow VLAN5 forwarding to WAN to get internet access.  Input and forward are set to reject and Output is set to accept.  

To allow client (miner) in VLAN_5 to reach to router for DHCP and DNS, setup a rule to "Accept Input" from VLAN_5 to router IP at 53, 67 and 68.

There are other exception rules predefined.  You can disable them based on your requirement.  

Cable Modem TC4400 overheated?

Switch to TC4400 cable modem for a few months because DOCSIS 3.0 will not be supported by my cable company.  This is the only one not using Puma chipset and supported by my cable company.  It worked fine until recently.  The internet connection drops few times day.  When I touch it, the modem is really hot.  The quick fix is to put a little 15mm by 15mm fan on the top of modem to draw the heat away from it.  Now, it is much better and has not experienced any more connection drop.  

Securely eraseing disk and file

 I used Hiren's Boot Disc and DBAN boot disc to erase my HDD securely most of the time.  I did use dd command but found out there were few other useful commands recommended in this link.  

The first one mentioned in the article is quite useful.  It will overwrite the disk five times and add a final overwrite with zero to hide shredding.

 # shred -n 5 -vz /dev/hda

The command below will use shred and /dev/urandom as the source of random data.

 


shred -v --random-source=/dev/urandom -n1 /dev/sda

 

Another option is to install scrubbing program like scrub in Unix.  You can use it to erase a single file with algorithm.  

scrub -p nnsa|dod|bsi|old|fastold|gutmann|random|random2 fileNameHere

 

Or you can even use it to erase disk with dod standard.  

scrub -p dod /dev/sda

 

*** WARNING: Please test the commands before running it on your data.  Commands mentioned in this article will delete the data permanently.  *** 


  

custom firmware with old TP-LINK WR1043ND

It has been 3 yrs from my last update.  Pretty busy with storage and backup migration.  Now, prepare for next migration ..... probably hybrid cloud.

Recently, I try to update my old TP-LINK WR1043ND v1.6 for my lab.  Doing some research in the forum and confirm couple of old firmware version are ok with h/w ver 1.x.  The latest version that has been tested successfully is r39290 based on the link below.
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=319186&highlight=r39230

So, I take a chance and flash r39296 using factory to ddwrt image.  The router boots up successfully.  Power cycle it again to confirm.

Looks like WEB GUI upgrade will not work after version r33375.  My future upgrade will have to go thru tftp option. 
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=62217&start=2445

I will test the rest of the function this weekend.

*** Tested the ethernet connection for a week.  No issue.  Will test the WiFi. (Aug 28, 2019)

*** Tested WIFI for a week and no issue found so far (Sep 8, 2019)
*** WIFI sometimes freeze after 6-8 hr of use.  Need a complete reboot of the router  (Sep 13, 2019)
=========================================================================

To flash Gargoyle firmware, first upload the original firmware vendor firmware back following the link below.
https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=315817&postdays=0&postorder=asc&start=0

Then, follow https://www.gargoyle-router.com/wiki/doku.php?id=tp-link-install to install the 1.10 stable version of the firmware.

*** Tested Gargoyle 1.10 and ethernet works great.  Management GUI responses much faster than ddwrt (Nov 10, 2019)

*** Tested WIFI next week.  WiFi is not great.  Perhaps due to insufficient CPU power.  

=========================================================================

Best option seems to be libreCMC.  Response and performance seem to be the best.  However, WiFi is not great as the others but libreCMC seems to be the best.  This is just a router for me on the 2nd network at home for testing.  So, WiFi is off most of the time.  You can also setup different VLAN with libreCMC.    (Sep 23, 2021)

D-LINK DIR882 with padavan firmware

I have the D-Link DIR-882 for almost half a yr.  ppl suggested the 1.2 firmware is ok.  It is working fine until recently.  The wireless is not very stable and the router reboots auto.  Sometimes, it happened after couple of days.  Sometimes, it lasted for a week before it rebooted by itself.  If I turn off wireless, I don't have any issue.  So, I decide to look for alternative.  The ddwrt is not too stable for DIR882.  Only certain build is ok.  Then, I see the padavan firmware for DIR882.  However, I only see instructions in Chinese to load padavan firmware in DIR-882.  So, I decide to give it a try.  Worst case, I use the old TL-WR1042ND (stock firmware) or TL-WR1043ND v1 (Gargoyle firmware).

Prerequisite
1) Putty
2) WinSCP
3) Download the older stable ddwrt build. (https://download1.dd-wrt.com/dd-wrtv2/downloads/betas/2018/08-09-2018-r36527/dlink-dir882-a1/factory-to-ddwrt.bin)  There are some stable build in May, 2020 based on the forum, pls check ddwrt forum if you decide to use ddwrt firmware rather than padavan.
4) Download a copy of breed.bin.  I find the link below is still working.
https://pan.baidu.com/s/1FH5pEl5VLKHRhzSzh7E1PA#list/path=%2F
5) Download a copy of padavan firmware for DIR882 (Thanks hanwckf)  I prefer to use one prepared by hanwcfk.  Fewer addon and the English translation in the GUI is done well.  
https://github.com/hanwckf/rt-n56u/releases
6) There is always a risk to load 3rd party custom firmware on the router.  It is not supported by the vendor.  Do it at your own risk!  
7) I don't find an English version of breed.bin.  That may be a problem because it only displays in Chinese.  You will need someone who know Chinese to complete step 17-19.  As you can see from the screenshot, it is displayed in Chinese.

Update steps
1) Power off the router (there is a power button from the back)
2) Use a toothpick to press the reset hole
3) Power on the router.  Wait for 10s and release the toothpick
4) Connect your desktop to LAN1 of the router
5) Change your desktop NIC IP to 192.168.0.11, subnet mask to 255.255.255.0 and Primary DNS to 192.168.0.1
6) Connect the browser (try to avoid Firefox) to 192.168.0.1.
7) Upload the ddwrt firmware and wait for it complete.  Always pick the factory-to-ddwrt.bin if the router is on D-LINK firmware. 

8) Change the desktop NIC IP to 192.168.1.11
9) Connect the browser to 192.168.1.1
10) Change the login and password from ddwrt GUI.  If you decide to use ddwrt firmware, you can stop here.   

11) Go to Service, enable Secure Shell.  Also make sure password login under Secure Shell is enabled.  Save the settings

12) Now, SSH to 192.168.1.1.  Run the command cat /proc/mtd 
13) Depending on the output, backup all the mtd# to /tmp
In my case, I have mtd0 to mtd6
Then, I run the commands below
dd if=/dev/mtd0 of=/tmp/u-boot.bin
dd if=/dev/mtd1 of=/tmp/u-boot-env.bin
...............................................

14) Use WinSCP to copy the backup (step 13) in /tmp of router to your computer.  Then, delete all the backup (step 13) in /tmp.
15) Copy breed.bin from desktop to /tmp of router
16) Then run the command below from putty.
cd /tmp
chmod 755 mtd-write
mtd -r write breed.bin u-boot

Now, you should be disconnected from putty.  

17) Connect the browser to 192.168.1.1

18) Select firmware backup then, EEPROM.  Save a copy on your local computer.

19) Select firmware update.  Then select the padavan firmware for the DIR882 from your desktop.  Then click upload.

20) Change the NIC to obtain IP and DNS auto.  Then, point to browser to 192.168.123.1 with credential admin/admin

21) Change the GUI to English.  First click on the Firmware version link found at the top right.

 Under Administration, scroll down and change the WebGUI language to English

Reference link (in Chinese)

1) https://post.smzdm.com/p/a07oxw8w/

2) https://blog.csdn.net/llwy1428/article/details/103582729

3) https://www.right.com.cn/forum/thread-745637-1-1.html

4) https://www.luyouwang.net/467.html

5) http://stussyxhuf.blogspot.com/2019/08/d-link-dir-882-breed-padavan.html

6) https://stussyxhuf.blogspot.com/2019/12/dir-882.html

7) https://post.smzdm.com/p/a839x3r7/

===============================================================

Firmware is quite stable after couple of the days.  Will update any issue after a month.  I don't have a new NIC card to test the 1.7G connection.  Some of the reference link showed it's possible.  

I suspect the router reboot maybe due to more load on WiFi.  I do have 4 more WiFi devices connecting to it rather than 1 or 2.  Maybe that cause the auto reboot of the router using stock firmware.  

===============================================================

5/24  I do see a WAN connection drop after 3 days.  Then reconnect within couple of seconds.  Search and do see that issue happen for some of the ASUS firmware.  So follow https://github.com/padavanfirmware/rt-n56u/issues/23 and apply the settings below.  Will update the result.

Hardware Offload NAT/Routing IPv4: to "Offload TCP/UDP for LAN/WLAN"

NAT Type (UDP only) to "Full Cone NAT"

For max connections, I leave it with 16348.
===============================================================
5/27 Checking hanwckf firmware link for all the issue.  Looks like MU-MIMO is not supported if channel bandwidth is running at 160MHz.
https://github.com/hanwckf/rt-n56u/issues/319
===============================================================
6/15  Running very stable since end of May. 
===============================================================

8/3    I see D-Link release firmware version 1.3.  However, I am very satisfied with Padavan firmware prepared by hanwckf and decide to stick with it.  Just check back hanwckf 's github.  There is no more update since May, 2020.  

12/27  I try Nov 2020 update but WhatsApp video is lagging after update.  Same for youtube.  Rollback to May 2020 update and things are back to normal.  

2021/5/18  Try the Nov 2020 update again.  Everything is fine this time.  

=======================================================

2022/8/3  See WAN connection drops recently.  Follow https://github.com/padavanfirmware/rt-n56u/issues/23 and try the following commands.  

In router's web GUI, simply go 
to menu path Administration --> Console and issue the following two commands, 
clicking the Refresh button right after typing each one:

nvram set detectWan=0
nvram commit

PMX spam filter server and recieve emails for multiple domains in your exchange server

Recently, we receive alert from ISP about mail latency. Check Exchange server logs and everything looks fine. Compare logs. The process time between PMX and Exchange is quite short. In this case, either spam filter or routing is the source of the problem. Double check and no one has made any changes to the router.

Check the PMX server. The load and iostat is high. Looks like the bottleneck is on the local disk. Increase memory does not really help. The only other option is to take the database out and migrate it to another server. However, we don't have enough space in the rack since we plan to retire one more rack. We get an appliance from Sophos ES4000. Very easy to setup. Once installed, no more performace issue.

We only config inbound email pt to the appliance. Outbound email will bypass the appliance. Basically make sure routing is setup correctly (point to your exchange server). If you are config to receive emails for multiple domain, make sure include those domain in the PMX config. No more sendmail.mc, pmx.conf modification and recompile. Other than routing setup on the appliance, make sure you have MX record setup correctly on your DNS server and ISP. Also, make sure your recipient policy in your Exchange server include the other domains you are going to receive emails in your Exchange server.

For example, your company has a domain called first.com. Your Exchange server is config to receive email sent to first.com. However, you register another domain for your other product called second.com. You can receive emails sent to second.com on your Exchange server. First, contact your isp to add a MX record (may take 1 to 24 hrs to replicate). Then go to your DNS server (most likely ur DC and add the MX record) . Basically, point the MX record for second.com to your exchange server for first.com (for example, mail.first.com). Add second.com to the accepting mail domain in your PMX appliance. Lastly, goto your Exchange server default recipient policy, add SMTP for second.com. Force update the recipient policy so you can receive emails immediately for your second.com.