Firmware v1.8.1.7 CR2 [Oleg] - updated ( CR2a )

New custom firmware available for download. Up2date information is available at this page.

There are also firmware for the units in this directory. Consider them experimental.

Changes in this release:

• Fixed a problem with firewall not working correctly, when logging was active
• Fixed a bug in the stock firmware causing time synchronization fail with dyndns service active
• Applied a patch to fix problem with Genesys Logic usb chipset
• Telstra BigPond changes (thanks to Rod Whitby)
• Australian timezones patch (thanks to Rod Whitby)
• Added new option "Number of connections to track" to Internet Firewall | Basic Settings

Important notice for post-firewall users: post-firewall script should be adjusted, be carefull when adding rules with -A - this will no longer work correctly, due to unconditional rule at the end of table. Check the iptables -L -v output.

For 1.8.1.7-1 discussion check this thread.

Update: updated to 1.8.1.7-2a, there is no need to reupload firmware if you do not use dropbear. Links are also updated.

Hi Oleg,
thank you for your great work. Due to your effort this ASUS router is a real useful machine. Now to the probs I'm faced to. I installed 1.8.1.7-1 2 days ago and setup the router everything was fine except the topics already listed in the corresponding thread.

So today I installed the new release 1.8.1.7-2 and a new problem is appearing: the ssh daemon (dropbear) is running, but I can't login any longer. After typing in the password the session will hang. Here's the corresponding entry of the router logfiles:

Oct 19 18:34:59 (none) authpriv.err dropbear[124]: ioctl(TIOCSCTTY): Input/output error
Oct 19 18:34:59 (none) authpriv.err dropbear[124]: /dev/pts/0: No such file or directory
Oct 19 18:34:59 (none) authpriv.err dropbear[124]: open /dev/tty failed - could not set controlling tty: No such device or address

Nothing was changed but the loglevel was changed from 'none' to 'dropped' .This is happening on the router which was running fine under 1.8.1-7-1 and the same is happening on a naked router after the update and installing from the scratch. If you'll need more information or tests, please feel free to contact me.

CU Sigurd

Thank you for your report. Dropbear is completely broken in this release... Sources are ok, binary is bad.
Update: rebuild as 1.8.1.7-2a, there is no need to reupload firmware if you do not use dropbear. Links are also updated.

I feel a bit silly but I'm having troubbles getting write access through Samba with firmwares 1.8.1.7-2-pre1 and 1.8.1.7-2a.

When mounting the hidden share$, I can view the directorys and open files, but I'm unable to write files to the disk. This was working fine in 1.7.5.6 CR5.

Any ideas?

Edit 1: I can confirm that Dropbear is working just fine in the 2a release.

Edit 2: I have the following line in the 'post-boot' script to start a 2nd webserver which is not working

Code:

---

/usr/sbin/busybox_httpd -p 81 -h /tmp/harddisk/wwwroot

---

But when I execute the same command from the commandline the webserver starts normally. Any ideas on why this is not working from post-boot? Everything else is working fine from the post-boot script...

Hi ppl...

I'm now using 1.8.1.7-2a and having a little problem with manually assigning IPs through MAC. I've added all MACs and the respective IPs to the web interface table, however, only the wired PCs get it's correct IP and the wireless PCs get an IP from the DHCP pool...
I had the same poblem with 1.8.1.7-1, but not with 1.7.5.9-5.

Sorry if this isn't the right place to post this problem...

Thanks in advance

... is now working again (1.8.1.7-2a). Thank you Oleg.

Regards
Sigurd

by the way the link to the 1.8.1.7-2a.zip file is not working. I was only able to download the ...trx file from the other versions directory.

Quote:

---

Originally Posted by sleuther

by the way the link to the 1.8.1.7-2a.zip file is not working. I was only able to download the ...trx file from the other versions directory.

---

Repaired now.

Quote:

---

Originally Posted by virilius

I'm now using 1.8.1.7-2a and having a little problem with manually assigning IPs through MAC. I've added all MACs and the respective IPs to the web interface table, however, only the wired PCs get it's correct IP and the wireless PCs get an IP from the DHCP pool...

---

Please post your /etc/ethers file and MAC addresses of problematic clients. Also, it's possible, that wireless clients are requesting old IP addresses, static assignment does not work in this case.

Hi it's me again.
if you select logging dropped files and use virtuell servers inside theres a problem:

logdrop all -- br0 ppp0 0.0.0.0/0 0.0.0.0/0
logdrop all -- ppp0 br0 0.0.0.0/0 0.0.0.0/0 <-----

The second logdrop rules is catching all transfer comming in a dropping it, the firewall ACCEPT rules for the forwarded ports are in following lines and will not be reached anytime. I did a workaroung in killing this rule and adding the necessary drop rules at the end... version 1.8.1.7-2a

CU Sigurd

Quote:

---

Originally Posted by sleuther

Hi it's me again.
if you select logging dropped files and use virtuell servers inside theres a problem:

logdrop all -- br0 ppp0 0.0.0.0/0 0.0.0.0/0
logdrop all -- ppp0 br0 0.0.0.0/0 0.0.0.0/0 <-----

---

This seems to be a bug in the original firmware... Could you please post entire /tmp/filter_rules?

Quote:

---

Originally Posted by Styno

I feel a bit silly but I'm having troubbles getting write access through Samba with firmwares 1.8.1.7-2-pre1 and 1.8.1.7-2a.

When mounting the hidden share$, I can view the directorys and open files, but I'm unable to write files to the disk. This was working fine in 1.7.5.6 CR5.

Any ideas?

---

I've had the same problem.
The solution I've found is to replace the user root by user admin in the line : force user =

Thanks to all for the nice job

Regards

Oldudu

Quote:

---

Originally Posted by oldudu

[I've had the same problem.
The solution I've found is to replace the user root by user admin in the line : force user =

Thanks to all for the nice job

Regards

Oldudu

---

Right, smb.conf has hardcoded root name, but it's provided as sample only. Well, I will probably fix this. For now either change user name to root or edit smb.conf file and save it to flashfs.

Thanks Oldudu. Will adding users to passwd file work with Samba?

Oleg, any ideas on how to solve my 2nd problem?

Quote:

---

Edit 2: I have the following line in the 'post-boot' script to start a 2nd webserver which is not working

Code:

---

/usr/sbin/busybox_httpd -p 81 -h /tmp/harddisk/wwwroot

---

But when I execute the same command from the commandline the webserver starts normally. Any ideas on why this is not working from post-boot? Everything else is working fine from the post-boot script...

---

Quote:

---

Originally Posted by Styno

Thanks Oldudu. Will adding users to passwd file work with Samba?

Oleg, any ideas on how to solve my 2nd problem?

---

Not yet. Try redirecting the output using something like this:

Code:

---

busybox_httpd ... > /tmp/log 2>&1

---

and check it after boot-up. Also, be sure you've #!/bin/sh at the top.

Hummm... Deleting dhcpd cache in each node did solve the problem... I did try that solution but not the right way...

Thanks a lot :)

Quote:

---

Originally Posted by Styno

Thanks Oldudu. Will adding users to passwd file work with Samba?

---

Hi, I don't know if it should work, but that's a good idea, I will try it later, and tell you the results later.

Oldudu

Quote:

---

Originally Posted by Styno

Thanks Oldudu. Will adding users to passwd file work with Samba?

---

If you mean adding root - yes, it should work.

Quote:

---

Originally Posted by Oleg

This seems to be a bug in the original firmware... Could you please post entire /tmp/filter_rules?

---

here it is:

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:logaccept - [0:0]
:logdrop - [0:0]
-A INPUT -m state --state INVALID -j logdrop
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -m state --state NEW -j ACCEPT
-A INPUT -i br0 -m state --state NEW -j ACCEPT
-A INPUT -p tcp -m tcp -d 84.128.179.237 --dport 21 -j ACCEPT
-A INPUT -p icmp -d 84.128.179.237 -j ACCEPT
-A INPUT -j logdrop
-A FORWARD -m state --state INVALID -j logdrop
-A FORWARD -i br0 -o br0 -j ACCEPT
-A FORWARD -p tcp --tcp-flags SYN,RST SYN -m tcpmss --mss 1453: -j TCPMSS --set-mss 1452
-A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
-A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
-A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
-A FORWARD -i br0 -o ppp0 -p tcp -s 192.168.252.1 -j ACCEPT
-A FORWARD -i br0 -o ppp0 -p udp -s 192.168.252.1 -j ACCEPT
-A FORWARD -i br0 -o ppp0 -p tcp -s 192.168.252.115 -j ACCEPT
-A FORWARD -i br0 -o ppp0 -p udp -s 192.168.252.115 -j ACCEPT
-A FORWARD -i br0 -o ppp0 -p tcp -s 192.168.252.116 -j ACCEPT
-A FORWARD -i br0 -o ppp0 -p udp -s 192.168.252.116 -j ACCEPT
-A FORWARD -i br0 -o ppp0 -j logdrop
-A FORWARD -i ppp0 -o br0 -p tcp --sport 20:130 -d 192.168.252.1 -j ACCEPT
-A FORWARD -i ppp0 -o br0 -p tcp -d 192.168.252.1 --dport 20:130 -j ACCEPT
-A FORWARD -i ppp0 -o br0 -j logdrop
-A FORWARD -p udp -m udp -d 255.255.255.255 --dport 47624 -j ACCEPT
-A FORWARD -p tcp -m tcp -d 192.168.252.1 --dport 20:21 -j ACCEPT
-A FORWARD -p tcp -m tcp -d 192.168.252.1 --dport 80 -j ACCEPT
-A FORWARD -p tcp -m tcp -d 192.168.252.1 --dport 443 -j ACCEPT
-A FORWARD -p tcp -m tcp -d 192.168.252.1 --dport 5900 -j ACCEPT
-A FORWARD -p tcp -m tcp -d 192.168.252.1 --dport 2506 -j ACCEPT
-A FORWARD -p tcp -m tcp -d 192.168.252.1 --dport 3389 -j ACCEPT
-A FORWARD -p tcp -m tcp -d 192.168.252.1 --dport 30660 -j ACCEPT
-A FORWARD -p udp --dport 6112 -j ACCEPT
-A logaccept -m state --state NEW -j LOG --log-prefix "ACCEPT " --log-tcp-sequence --log-tcp-options --log-ip-options
-A logaccept -j ACCEPT
-A logdrop -m state --state NEW -j LOG --log-prefix "DROP" --log-tcp-sequence --log-tcp-options --log-ip-options
-A logdrop -j DROP
COMMIT

Without the added rules for ports 20:130 the logdrop lines will receive all traffic and I couldn't get a connection. all rules after the logdrop are added by the virtual server web page. but will never be executed because of
-A FORWARD -i ppp0 -o br0 -j logdrop

Well, firewall between WAN & LAN is broken... Don't know why ASUS has done this in this way...
Do you need it at all?

Edit: fixed.

I have some problems undestanding the new layout of flashfs partition and how the boot script handles it:

As an example I will use /etc/smb.conf. On your wl500g.dyndns.org page you state:

Quote:

---

once you've made the changes to the ramfs system (/usr/local/ now also mapped to ramfs, you need to launch special command to store modified files permanently in the flash. During the next boot wl500g will extract these files for you. So, you can store whatever you need just like in real non-volatile file system. Consider using /usr/local/etc for files which is normally resides in /etc, /usr/local/sbin for "ASUS style" init scripts and /usr/local/sbin for executables files/scripts

---

As I understand right, any file in /usr/local/etc will be placed in /etc at boottime. This was working fine and dandy in firmware 1.7.5.9 CR5.

Now comes the confusing part:
I've copied /etc/smb.conf to /usr/local/etc/smb.conf, edited the file and saved it using 'flashfs save' and 'flashfs commit'. After reboot the /etc/smb.conf appears unchanged, but if I view the /usr/local/etc/smb.conf file I can clearly see the changes.

What am I doing wrong here?

Quote:

---

Originally Posted by Oleg

Not yet. Try redirecting the output using something like this:

Code:

---

busybox_httpd ... > /tmp/log 2>&1

---

and check it after boot-up. Also, be sure you've #!/bin/sh at the top.

---

I did the test and the result is:

Code:

---

cat log
busybox_httpd: can`t chdir to /tmp/harddisk/wwwroot: No such file or directory

---

It appears that the USB HDD is not mounted yet when running 'post-boot'...I think it should be.

Quote:

---

Originally Posted by Styno

As an example I will use /etc/smb.conf. On your wl500g.dyndns.org page you state:

As I understand right, any file in /usr/local/etc will be placed in /etc at boottime. This was working fine and dandy in firmware 1.7.5.9 CR5.

---

No, this never works this way. You just need to add /etc/smb.conf to the list of files (i.e. /usr/local/.files. You may want to check /sbin/flashfs - it's shell script, and it's called as "flashfs start" on boot.

Quote:

---

Originally Posted by Styno

I did the test and the result is:

Code:

---

cat log
busybox_httpd: can`t chdir to /tmp/harddisk/wwwroot: No such file or directory

---

It appears that the USB HDD is not mounted yet when running 'post-boot'...I think it should be.

---

Ok, I knew the answer. This is new asus know-how. They're mounting disks from the watchdog which runs once per second or so... Mount it manually or add sleep.

Quote:

---

Originally Posted by Oleg

No, this never works this way. You just need to add /etc/smb.conf to the list of files (i.e. /usr/local/.files. You may want to check /sbin/flashfs - it's shell script, and it's called as "flashfs start" on boot.

---

Oh yes, I was being really dumb there. Thanks for pointing it out. I'm back on track with this now.

Quote:

---

Originally Posted by Oleg

Ok, I knew the answer. This is new asus know-how. They're mounting disks from the watchdog which runs once per second or so... Mount it manually or add sleep.

---

OMG, thats a weird decision Asus made there. That makes the boot scripts not very reliable when USB HDD is involved...

I'll try to add some lines to post-boot script to let it wait for the disk to come online for a maximum of one minute or so. If not, the boot script will continue.

Hi!

trying to add:

iptables -t nat -I PREROUTING -p tcp -d "$2" --dport 80 -j DNAT --to "$2":8080

via telnet, here's the outpout I received:

iptables v1.2.7a: host/network `' not found
Try `iptables -h' or 'iptables --help' for more information.

Does someone could explain me what's wrong?

The following code can be put in the post-boot script. This will delay furter booting (up to 30 seconds) in order to let the watchdog mount your HDD. Once the script detects the HDD, it will resume booting. Enjoy!

Code:

---

i=0
while [ $i -le 30 ]; do
        if [ -d /tmp/harddisk/ftp_pub ] ; then
                break
        fi
        sleep 1
        i=(($i + 1))
done

---

BTW. this is my first shell script for Linux ever! It took me 2 hours but, boy, am I proud...

My tests show that the HDD is mounted approximately 10 seconds after the post-boot script is called.

Quote:

---

Originally Posted by Styno

BTW. this is my first shell script for Linux ever! It took me 2 hours but, boy, am I proud...

---

Congratulations to you. :)

Quote:

---

Originally Posted by Spot

Hi!

trying to add:

iptables -t nat -I PREROUTING -p tcp -d "$2" --dport 80 -j DNAT --to "$2":8080

via telnet, here's the outpout I received:

iptables v1.2.7a: host/network `' not found
Try `iptables -h' or 'iptables --help' for more information.

Does someone could explain me what's wrong?

---

The "$2" parameters are only valid when using it in post-firewall script. When running form command-line you should use the ethernet device instead, e.g. 'eth1'.

Is it possible to config a seperate Firewall for W-LAN and LAN?

Quote:

---

Originally Posted by Holli

Is it possible to config a seperate Firewall for W-LAN and LAN?

---

If you've read this thread you would have found:

Quote:

---

Originally Posted by Oleg

Well, firewall between WAN & LAN is broken... Don't know why ASUS has done this in this way...

---

Quote:

---

Originally Posted by Holli

Is it possible to config a seperate Firewall for W-LAN and LAN?

---

No. Downgrade to 1.7.x.x if you need this.

hi together,

i run the 1.8.1.7-2 Firmware by Oleg.
the situation:
A few days ago i swaped to another isp. i had to configured my wl500g with a static ip which shows to the DMZ ip of the router from my new isp.
(before that -ppoe-, everything was working fine)

1st BUG is shown here:
http://wl500g.info/showthread.php?t=1057
it is not the important one, but after power off...pls read yourself.

2nd BUG:
on monday i want to download a guest ticket for linuxworldexpo here in frankfurt. tried hp.com, but down...hmm...okay afterall i downloaded my ticket from suse.de sponsord by novel.
yesterday i tried to download adobe acrobat reader from adobe.com, but down(no ping or anything else)..hmm...fuck. first i tought it is a routing or dns problem from my isp, but its not, it is the wl500g.
Explanation:
the first point i figured out was that both adresses (hp and adobe) have an ip adress starting with 192.XXX.XXX.XXX. afterall i connected my computer directly to the sdsl router/modem(same ip, same dns), and what sould i say. my computer is connection perfectly to the adresses shown above.

so i thing there sould be a problem in firmware to handle with 192' ip adresses AND static ip. can somebody pls confirm that?

somebody who has a solution?
thx in advance for all quotes.

ps: sry because of my bad english.

Quote:

---

Originally Posted by xlephant

hi together,

the first point i figured out was that both adresses (hp and adobe) have an ip adress starting with 192.XXX.XXX.XXX. afterall i connected my computer directly to the sdsl router/modem(same ip, same dns), and what sould i say. my computer is connection perfectly to the adresses shown above.

so i thing there sould be a problem in firmware to handle with 192' ip adresses AND static ip. can somebody pls confirm that?

---

Can you tell us what your netmask is, both on the router as on you linux box?

Another question: Why have you configured the first modem/router to place the WL-500g in DMZ instead of using bridging?

Quote:

---

Originally Posted by Styno

Can you tell us what your netmask is, both on the router as on you linux box?

---

both should have 255.255.255.0 but because of the first bug(see pic in the thread for the first bug) im not sure if it is saved on the wl500g, i don't thinks so because it showns 255.0.0.0 (see this pic). but that should not be the problem or?

Quote:

---

Originally Posted by Styno

Another question: Why have you configured the first modem/router to place the WL-500g in DMZ instead of using bridging?

---

that is the only methode i can connect without port lockings directly to the blackbox, the router from my isp doesn't offer any other mode. but maybe i have to try that. but on the other hand it sould work, like i configured it, or not?!

@styno
in briging mod the same problem :(

Quote:

---

Originally Posted by xlephant

both should have 255.255.255.0 but because of the first bug(see pic in the thread for the first bug) im not sure if it is saved on the wl500g, i don't thinks so because it showns 255.0.0.0 (see this pic). but that should not be the problem or?

---

It seems to me that every address starting with 192.xxx.xxx.xxx is considered to be on the LAN by the modem/router. Try changing the netmask to 255.255.255.0.

Quote:

---

that is the only methode i can connect without port lockings directly to the blackbox, the router from my isp doesn't offer any other mode. but maybe i have to try that. but on the other hand it sould work, like i configured it, or not?!

---

If you configure your modem/router to do bridging then you can use MAC spoofing on the Asus router to let the ISP think the Asus is the router (e.a. the WL-500g has the same MAC as the modem/router). That should work.

i can't enter my router/modem. first of all its not allowed. 2nd there is no reaction if i ping or if i try telnet to it. so that doesn't work.

Quote:

---

It seems to me that every address starting with 192.xxx.xxx.xxx is considered to be on the LAN by the modem/router. Try changing the netmask to 255.255.255.0.

---

i tried that many times before. but it changes by itselfs to 255.0.0.0 thats why i think there is a bug.

its awful when an advertising is loading from a server which i can't enter, i have to wait for the time out and then the whole page is loading.

if i let receive the wl500g the ip adress by dhcp(Automatic IP) everything is working fine.b :confused:

Yes, this looks like a bug. Can you please post an output produces by

Code:

---

nvram show|grep netmask

---

hi oleg,

thx for your answer, here the code:

Code:

---

[root@(none) root]$ nvram show|grep netmask
wanx_netmask=255.0.0.0
lan_netmask=255.255.255.0
wan_netmask=255.0.0.0
dr_staticnetmask_x=0
wan_netmask_t=255.0.0.0
size: 8483 bytes (24285 left)
wan0_netmask=255.0.0.0
wan0_netmask_t=
lan_netmask_t=255.255.255.0
sr_netmask_x=
wan0_pppoe_netmask=

---

I can't check code right now, try this as workaround:

Code:

---

nvram set wanx_netmask=255.255.255.0
nvram set wan_netmask=255.255.255.0
nvram set wan_netmask_t=255.255.255.0
nvram set wan0_netmask=255.255.255.0
nvram set wan0_netmask_t=255.255.255.0
nvram commit
reboot

---

And check if it helps you.