Linksys Hacked Firmware
Today I'm going to walk you through upgrading your router's firmware to the powerful open source DD-WRT firmware. Photo by puruan. Nov 19, 2018 - Instead of trying to create a single, static firmware, OpenWrt. The customer must have the possibility to install custom software on their devices.
Installing a custom firmware on your Wi-Fi router is like God Mode for your home network. You can see everything going on, boost your Wi-Fi signal, beef up your security, and even do advanced tricks like install your own VPN. Still, there are so many options available it can be tough to pick the right one. Here’s what you need to know.
Why Bother Anyway?
Installing your own custom firmware isn’t just an afternoon project for alpha-geeks looking for something cool to do—it actually makes your router better. Pick the right one and you can monitor your network in real time, make sure your roommate doesn’t slow down your Netflix binge by downloading music (but make sure your music downloads are nice and fast), make your network friendly to guests but unfriendly to intruders, and more. Open firmware gives you more control over your Wi-Fi performance, and most even let you crank up your Wi-Fi signal so that one corner of the house doesn’t have to be a dead zone anymore. You also get perks like the ability to run your own VPN at home (something you should definitely try), and are updated to fix security problems way more frequently than the manufacturer updates their stock software, both of which are huge for security.
Advertisement
Why You Should Be Using a VPN (and How to Choose One)
You may know what a VPN, or Virtual Private Network, is; you probably don’t use one. You really…
Read more ReadSure, it may take a little work, but if you’re up to the task, you’ll get a faster, more secure home network, and one you’re in total control over at all times. If your speed drops, you’ll know exactly why. You’ll be able to log and monitor your connection to make sure your service provider (like Comcast or Verizon) isn’t throttling you down because you dared to watch Netflix or fire up Spotify.
The Big Three: DD-WRT, OpenWRT, and Tomato
Advertisement
Some of the most popular open router firmwares are names you may have heard already, like DD-WRT, OpenWRT, and Tomato. We’ve shown you how to install DD-WRT on your router before, and shown you how to supercharge a router with Tomato, but here’s a quick refresher on how they differ:
How to Supercharge Your Router with DD-WRT
Few routers utilize their full potential out of the box because their firmware limits their…
Read more Read- OpenWRT is the firmware from which many others were born. It’s completely open source and customizable, based on the Linux kernel, supports package management and has tons of extra add-ons and utilities. It’s not the easiest to use and install, but it supports the broadest base of hardware, from powerful and high-end home routers to pocket-sized travel routers and even enterprise hardware. It offers the most features of any open firmware, but it can often be tricky to configure. For example, OpenWRT supports just about any Linux device you can put on a network (like printers, webcams, and more), has a rich interface, real-time network monitoring, built-in dynamic DNS (so you can access your home computers from afar), IP tunneling for a built-in VPN, built-in Quality of Service (QoS) that lets you prioritize some things (like streaming or VoIP calls) over others (like torrents or other downloads, for example), and so on. You can check out supported devices here.
- DD-WRT is based on OpenWRT. DD-WRT carries a lot of OpenWRT’s features, like real-time monitoring, access control, QoS, and the ability to set up your own VPN, all packaged behind a more user-friendly interface. You also get extra features like Wake-On-LAN, so you can put computers on your home network to sleep, but wake them up when you need to connect to them from abroad. It’s easier to install than OpenWRT, and a bit easier to manage as well. It doesn’t support as many devices as OpenWRT, but it does support some of the most common home routers. You can search to see if your router is supported here.
- Tomato Firmware is most notable because it’s super lightweight, its user interface is intuitive, and it’s even easier than DD-WRT to install and use., Its biggest strength is its real-time bandwidth and connection monitoring, which mean you can see everything that happens on your network as it’s happening, which is great for troubleshooting connection problems or making sure there’s no one creeping on your network. It’s also lean, and unlike other firmwares here, it’s designed so you don’t have to reboot the router after every little change. Similarly, it makes increasing your Wi-Fi signal strength easier than a lot of the others here. Even advanced features like firewall configuration and access controls are easy to approach, even by new users. Tomato’s only downside is that it supports relatively few devices. You can see if your router is supported here.
Advertisement
For most people, one of these three will support the device you have and give you all of the features you could possibly need. Of the three, DD-WRT is the most well-supported on home routers, and it’s relatively easy to install and set up. Tomato is the most user-friendly, and certainly the most attractive of the three, but it supports the fewest devices. OpenWRT supports the most gear in general, including stuff only a network engineer would use, but its learning curve can be steep. It’s also the most moddable and tweakable, and a good option if you have hardware that’s not supported by anything else. Even so, they’re not your only options by a long shot.
Other options for Tweakers and Hackers: Router-Specific or Dev-Friendly Firmwares
Advertisement
While those three may be the most well known and most popular, there are tons of others to choose from as well. Here’s a rundown of all of your options:
- Gargoyle is also based on OpenWRT, specifically designed to be lightweight and for Broadcom and Atheros-based router hardware. It’s tiny, easy to install, has a great-looking web management page, and supports a number of travel and portable routers. It’s most notable for its ability to limit bandwidth to certain IP addresses or give you unique insight into how your bandwidth is being used. Gargoyle is ideal for people who have travel routers, or if you’re the type who’s less concerned with stuff like security and Wi-Fi signal and more concerned with how everyone in your house is using your bandwidth. It’s perfect for people with bandwidth caps. You can check out supported routers here, or buy one of their open hardware routers with Gargoyle pre-installed from their site.
- LibreWRT is a completely free and open firmware that’s adheres to the Free Software Foundation’s Free System Distribution Guidelines. If you’re wondering what router firmware someone who lives and dies by open-source like Richard Stallman or Linus Torvalds would pick, this is probably it. LibreWRT is also designed to be a lightweight option for aspiring developers to get involved with and contribute to. It’s also based on OpenWRT, but it supports only a handful of devices (although you can certainly build it yourself, although it’s not a project for beginners.)
- DebWRT is another umbrella firmware that has a number of derivatives. Users of Debian-based Linux systems—like Ubuntu or Linux Mint—will appreciate it, since it’s essentially Debian, built on top of OpenWRT, and designed to run on home routers. It includes all of the basics you need, but it’s not the most feature-rich on its own. You’ll need to add packages and additional tools to make the most of it, and its command-line interface isn’t exactly the most beginner-friendly (although, if you’re already familiar with Debian, it’ll seem like home to you.) It also helps that it offers everything you would get in a standard Debian install, along with its package manager and any compatible utilities. Still, it’s probably not for the faint of heart.
Advertisement
These are just the largest derivatives of the three major players. They’re great, but if you like the look of OpenWRT but need something specific, check out its other derivatives. For example, Gargoyle was designed to give OpenWRT a friendly, usable web interface that made customizing and setting it up simpler. Many of these also support third-party plugins for features like an at-home VPN, mesh networking to connect your network with the home networks of your friends, or any other more complicated setup you may have in mind. If you’re willing to get your hands dirty and you have some coding experience, you can rebuild any of these to make your own tweaks, or add your own packages.
Build Your Own VPN to Pimp Out Your Gaming, Streaming, Remote Access, and Oh Yeah, Security
Even if you have no idea what a VPN is (it's a Virtual Private Network), the acronym alone…
Read more ReadStart with What Your Hardware Supports and Browse by Features
Advertisement
If you’re trying to decide between any of these firmware options, the first thing to consider is the router you have, and what open firmware supports it. If you’ve ever installed your own firmware, you know this already. Odds are yours—even if it’s a newer 802.11ac model is supported by one of these options, you just have to figure out which one.
Five Best Home Wi-Fi Routers
A good Wi-Fi router is essential for any solid home network. The best ones get great range and can…
Read more ReadIf you only find one option that supports your router, the decision is made for you. If you find several, choose based on your needs, but don’t forget to see how well supported the firmware is. Are there guides or documentation you can follow, or forums where you can get help? You want the best option for you, but you also don’t want to be out in the cold if you have trouble. “Once you’ve picked your firmware of choice, just follow the installation instructions they provide—but for more information, check out our guides on installing DD-WRT and Tomato here.
Advertisement
Where to Go for Help
Finally, if you’re still stuck, or you don’t know whether a particular firmware will do what you want it to do, do some digging. Like we mentioned, many of these projects have forums for users to discuss the project and troubleshoot one anothers’ issues. Beyond that, Google your router model and the firmware you’re looking at to find out if it’s compatible, or if anyone out there is complaining about it before you install it yourself. After all, once it’s installed and set up, it’ll be your gateway to the internet, so after you’ve done the job isn’t the time to start doing research.
Advertisement
If you can’t find an open firmware that supports your router, or the one you want doesn’t work with the router you have, you do have the option to buy a router specifically for the firmware you want to run. Check the compatibility list for the firmware you want to run and pick your favorite router model from that list. That way you know you’ll get a router that’ll work without trouble. Alternatively, you could buy a router with your firmware pre-installed. For example, Buffalo sells routers with DD-WRT pre-installed, and some VPN providers even sell routers with open firmware installed and their VPN set up and ready to go. TorGuard and SlickVPN both do this. Just make sure you get the features that matter to you in the router as well as the firmware you want before you buy.
Title image made using kentoh (Shutterstock), Viktorus (Shutterstock), and ridjam (Shutterstock). Additional images by audioreservoir, Arkadiusz Sikorski, Kevin Jarrett, and Thees.
Advertisement
1.1. Why this document?Linksys makes a line of cheap, ubiquitous router/firewall boxeswell-suited for use on a home DSL or cable connection and popular among Linuxhackers. This HOWTO gives hints and tips for managing Linksys routersfrom a Linux system.
The specific recipes described here are derived from long experiencewith a BEFSR41, the 4-port router/firewall box. I have also configured aBEFW11S4v2, the 4-port router with 80211b wireless, and the WRT54G, whichis the same box with 80211g; I'm currently using a WRT54G. The webinterfaces on all these blue boxes are very similar, and most of the adviceshould generalize.
In late 2004 the Linksys firmware underwent a major upgrade to 2.x(one easy way to spot this is the Cisco logo at the lower right). Ihaven't seen anything but a WRT54G running the new interface, but I'd be surprised if it weren't running on the BEFSR41 and kin as well. Thechanges are largely cosmetic. Some problematic features in earlierversions have been removed.
This HOWTO describes Linksys firmware version v2.02.7. At time ofwriting (January 2005) the current Linksys firmware version is v.3.01.3.I do not recommend upgrading! I've had a report thatenabling WEP on this version makes the box unable to talk to a Linuxmachine over a cable.
Also note that if you go looking for one of these now, be sure to getthe WRT54GL — note the L suffix. At Version 5 and up, the vanillaWRT54G is different hardware with less RAM that runs a proprietary VxWorks OS.
1.2. New versions of this documentYou can also view the latest version of this HOWTO on the World Wide Webvia the URL http://www.tldp.org/HOWTO/Linksys-Blue-Box-Router-HOWTO.html.
1.3. License and CopyrightCopyright (c) 2003, Eric S. Raymond.
Permission is granted to copy, distribute and/or modify this document under the terms of the GNU Free Documentation License, Version 1.2 or any later version published by the Free Software Foundation; with no Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the license is located at www.gnu.org/copyleft/fdl.html.
Feel free to mail any questions or comments about this HOWTO to EricS. Raymond,
The Linksys BEFSR41, BEFW11, WRT54G and their siblings are designedto be used as gateway boxes on a home Ethernet. Typically, you'll hook oneup to a DSL or cable modem, which will automatically switch into bridgemode and simply pass packets between your ISP's router and the Linksys box.
If you want to use a general-purpose PC running Linux as a firewall,have fun — but these little boxes are more efficient. The nicestthing about them is that they run out of firmware and, assuming you takethe elementary precautions we describe, are too stupid to be cracked.Also, they don't generate fan noise or heat. Finally, they run Linuxinside and can be customized and hacked in useful ways.
Linksys boxes used to have a good reputation for reliability.Something bad happened to their quality control after Cisco acquired thecompany in March 2003; I had two go silently dead on me in less than ayear, and I heard grumbling from others about similar problems.Unfortunately when I tried other low-end brands (Belkin, Buffalo) theyproved to have gross design errors. The Belkin had brain-damage in itsfirewall rules that interfered with local SMTP, and the Buffalointermittently refused connections for no apparent reason. So I went backwith Linksys, hoping my WRT54G wouldn't turn into a doorstop within a coupleof months. As of mid-2006, I've been OK for about 24 months.
(Building one of these puppies is not rocket science. I can only conjecture that the competitive pressure is driving the manufacturers to cutcosts to the bone by hiring programmers out of the bottom of the barreland having the manufacturing done by some low-end contract housein Indonesia or somewhere. The results, alas, tend to be unstablecrap. Caveat emptor.)
Note another consequence of the Cisco acquisition: Linksys is nowwhat marketers call a flank guard, a low-end brand designed to protect themargins and brand image of Cisco's commercial-grade networking products.This means that Linksys boxes are no longer acquiring new firmwarefeatures, and some old ones like stateful packet inspection almostcertainly won't be coming back. Provided you can live within these limits,this is actually good; simpler firmware is more stable firmware. And, inany case, the open-source replacement firnwares can give you back thefeatures abd complexity if you want them.
At minimum, a live Linksys box will do the following things foryou:
Act as an Ethernet router. You canplug all your lines and hubs and hosts into it to exchange packets evenwhen your outside link is down.
Act as a smart gateway. When youconfigure the Linksys with a public static IP address (or tell it to grab adynamic IP address from your ISP at startup time), it will gateway betweenhosts on your private network and the Internet, performing all the IPmasquerading and address translation required to route your traffic.
Firewall your connection. You cantell it to block out all but the minimum sevice channels you need. You canspecify separately, for each service, to which of your internal machinesthe traffic should be routed.
I give my Linksys box the standard private-network gatewayaddress, 192.168.1.1. I then give all my boxes 192.168.1.x addressesand tell them the Linksys is their gateway. Everything works.
If you've lost the manual, or acquired a secondhand unit that doesn'thave one with it, never fear. Under the Help tab in older versions thereare links to the PDF and to the Linksyscorporate website. Newer versions have reference documentationbuilt into the firmware, a good thing if your net connection isdown.
Unfortunately, you're in trouble if you have to bring in Linksys techsupport. On the one occasion that I called them (in 2003), the first techI raised couldn't even speak English, and the second was barely competentat it. Both were complete and utter idiots whose response to anynontrivial question was to put me on infinite hold while they wentoff to query someone else — and then garbled the answer. Judgingby their accents, my guess is that Linksys tech support has been outsourcedto some particularly benighted corner of the Third World.
I've heard somewhat better of their email support, but have nottested it myself.
For security, do these things through the Linksys web interface(probably at http://192.168.1.1 onyour network):
Change your administrativepassword. On 15 June 2004 it was widelyreported that turning off the remote admin feature doesn't work— you can still get at the administration page from the wirelessside. This bug is still present in the 2.02 firmware, October 2004. Itmeans that if you leave your password at default, any script kiddie canbreak in, steal your WEP, and scramble your configuration. The Linksyspeople get the moron medal with oak-leaf cluster for this screwup.
(I don't know if this bug is still present in the 3.x firmware. Itwould be a good idea to check.)
Make sure the DMZ host feature isdisabled, under
Port-forward specific services instead ofsetting up a DMZ, and as few of those as you can get away with.A good minimum set is 22 (ssh), and 80 (http). If you want to receive mailadd 25 (smtp). If you need to serve DNS queries, add 53. To serve identdso remote MTAs can verify your identity, enable 113.
Disable Universal Plug andPlay. Look under
There are two more steps for older firmware versions only. You canignore these if you have 2.x or later firmware.
Disable AOL Parental Controls.Make sure
Disable Stateful PacketInspection. If you want to run a server and are running1.42 or earlier firmware, you also need to make sure stateful packetinspection is off — this feature restricts incoming packets to thoseassociated with an outbound connection and is intended for heightenedsecurity on client-only systems. On the
Before you upgrade, here is a tip the documentation does not mention:disconnect all the patch cables except the one from the machine you areusing to upgrade the box. Handling a lot of other network traffic whilethe firmware load is going on can corrupt the firmware.
There are three ways you can upgrade your Linksys firmware.
One is to click the
Another way is to use one of Linkys's firmware-upgrade floppy imagesfrom their website. This requires that you boot Windows or useWINE. Not recommended.
The third way is to use
Write down your settings. The firmware upgrade may wipe some of them. Older versions nuked everything back to factory defaults; newer versions preserveyour basic settings but clear some advanced ones.
Download a copy of the new firmware.Follow the Downloads link from the Linkys main page. Note thatwhat you get may well be marked
Disable the router password. Notethat every attempt I made to do this with Mozilla failed (both under 1.38and 1.44). Konqueror worked fine, and Firefox works fine with the 2.xfirmware. Go to the Password tab, backspace over both sets of asterisksuntil both the Password and Confirm fields are blank, and clickApply.
Cross your fingers and load thefirmware. The command session you want will to see will looksomething like this, with your router's IP address substituted for192.168.1.1:
Don't panic if the client hangs for a bit before returning anddo not abort the transfer. The command is writing to firmware, and the Linksys hasn't got much of a brain.Wait for it to finish.
Re-enable your router password and othersettings. You'll be able to tell the upgrade worked becausethe firmware version number will have changed.
You're done.
Linksys boxes have firmware support for a serial console. The circuitboard has traces for two serial ports, but you have to do some fairlyserious modding to get them working. This page willshow you how.
Linksys routers run Linux from firmware. Linksys supplies sourcecode on its site; look for 'GPL Code Center' under technicalsupport.
There are several replacements for the WRT54G firmware. All add certain common features such as (a) the capability to ssh into theLinux running on the box, (b) European WiFi channels, and (c) VPNservice.
Linksys Software Download
Supports SNMP/mrtg. Said to have a good interface, convenient for home use.
Intended for Wireless ISPs, lots of stuff for routing and repeater operation.Open source, but you can buy support and private-release subscriptions.This outfit has been slammed for GPL noncompliance and apparently lost a lot of the good reputation it used to have.
A fork of the SveaSoft codebase from a few years back.
Linksys Wrt54g Hacked Firmware
Workbench for people who want to experiment with their own customizations.Provides a framework and a set of modular packages supporting particularfeatures.
Starts from the Linksys 3.01.3 firmware and adds a handful of features.Might be useful for those comfortable with the Linksys interface.
Another hacker's workbench, this one runs from RAMdisk so you don't have toreflash the box. Thus there's no chance of trashing your router. Thedisadvantage is that it has to be reloaded each time after you power-cycle.
Any of these can be installed using the firmware upgrade procedures.
Firmware for other Linksys hardware (notably the WAP54G) can be foundhere and here.
For a look at the techniques used to develop these firmwarealternatives, there's an interesting site on hacking theWrt54g by Seattle wireless.net.
There is a Unix utility called
Linksysmon is a tool for monitoring Linksys BEFSR41 and BEFSR11firewalls under Linux and other Unix-like operating systems. It acceptslog messages from the Linksys, and logs the messages to
Link-n-Log is a similar tool that includes a GUI and logs to an SQLdatabase. Details at the Link-n-Log projectpage.
9.1. Occasional catatonia and epilepsyLinksys boxes freeze up occasionally (once every few months) andhave to be power-cycled. Suspect this is happening if your outsideWeb access suddenly stops working; ping the Linksys box to check.
These catatonic episodes may be related to dirty power; at least,they seems to happen more frequently in association with electrical stormsand brownouts. If you think this has happened, just pull the powerconnector out of the back and plug it back in. The Linksys should rebootitself within 30 seconds or so.
There is a more severe failure mode that I've only seen once; it'smore like an epileptic seizure than catatonia, and involves strange blinkpatterns on the Link, Collision, and 100Mbit diagnostic lights (the 100Mbitlight should not normally ever blink).
If this happens, power-cycling the Linksys won't suffice; you'll haveto hard-reset the thing. Some versions (like the BEFSR41) have a reset pinthat you poke with a paperclip end through a small hole in the front panellabeled Reset. Some versions (like the BEFW11S4 and WRT54G) have a resetbutton on the back. You have to hold these down for about thirty secondsto hard-reset the nonvolatile RAM. This will lose your configurationsettings.
9.2. Mozilla interface quirks under 1.38 and earlier firmwareLinksys blue boxes have a webserver embedded in their firmware.The normal way to administer one is to point a browser at its IPaddress on your network. You program the box by filling out HTMLforms.
This is a nice bit of design that neatly avoids having OS-specificclient software. But some older versions of the webserver firmware have aquirk that interacts with a bug in Mozilla (at least at release 1.0.1) tomake the interface almost unusable. Fortunately, the recovery procedure istrivial. This bug was known to be present as late as 1.40, and alsointerfered with Netscape; it is absent in 1.44 and a good reason toupgrade. We have a report that Mozilla 1.3 fails with 1.43, so whateverchange fixed the problem likely came in with 1.44.
The symptom you're likely to see is a broken-image icon at theupper left hand corner of each page. The broken image is a series offile-folder tabs for an image map. That image map is how you get tothe other web pages.
You can recover by right-clicking on the broken-image icon.Select
You will almost always have to do this on the first page,but it often won't trigger on later page loads.
Here's what's going on. Mozilla tries to stream multipleconcurrent requests at the webservers it talks to in order to speed uppage loading. The dimwitted little firmware webserver in the Linksys isonly single-threaded and doesn't handle concurrent requests. So there'sa race condition. When you hit the window just right, you get an aborted request and a broken graphic.
Hyperwrt
Most other browsers are immune to this problem. Konquerordoesn't trigger it. Neither does Internet Explorer.
There's a large user-community website at LinksysInfo.org. It includesnews, support forums, and custom firmware downloads.
There is a Linksys tips and tricks FAQ; it's mostlyWindows stuff, but a few of the war stories may be useful.