Saturday, February 5, 2022

GLiNet Router and Captive Portal

GLiNet has a range of great travel routers.  Their routers are based on OpenWRT but with a simpler GUI.  Hence, they are very stable and customizable.

Recently, I was on a trip and was staying in a hotel for few days.  My GLiNet MT3000v2 was perfect for the event.  Its easy to use interface allowed me to set up the router to use Hotel's WiFi as WAN as well as provided WiFi LAN for my devices.  In addition, its VPN feature gave me a safer connection.

You may ask why I would bother to use and set up a travel router rather than connect to the Hotel WiFi directly.  Here are my reasons:

1) I only need to connect/register one device to the to hotel network, and everything else is connecting to my router with my preferred security settings.  This is particular useful when a hotel uses captive portal for its WiFi.  Instead of filling forms for each devices, I only need to do the registration once with my router.  Also some hotels may have restrictions on the number of devices using their free WiFi.  By using a travel router, I can get round this restriction.

2) I can secure my connections over a public network with VPN.  Although the connection between a device and the hotel router may seem secure as it may be protected by a WiFi Key, this WiFi Key is not unique to you but is shared by everyone on the network, i.e. a malicious user can packet sniffing and steal information.  With VPN, I can ensure my traffics between my router and the hotel router are encrypted and protected.

3) I can secure my connections over open WiFi network with VPN.  The hotel I stayed was using captive portal with no password.  This means the traffics are unencrypted.  By connecting to my router with VPN, all my traffics will be encrypted and will enjoy the same level of security.

Now, why I wrote this.  I was having troubles to connect to the hotel's captive portal due a few "good" settings I had on my router.  For instance, I had enabled the "kill switch" and custom DNS features on my router, however these two settings  prevented me to connect to the hotel's captive portal.  Hence, if you are in the similar situation like myself, here are few settings you may want to change in order to connect to a WiFi service restricted by a captive portal. (full details see https://docs.gl-inet.com/en/3/tutorials/connect_to_a_hotspot_with_captive_portal/)

 

1) Ensure the "Kill Switch" option is off.  This option stops internet access when VPN is not running.  This is a good thing normally, however, with captive portal, it means you cannot connect to the captive portal neither.



 
 
2) Disable "DNS Rebinding Attack Protection"
3) Switch off any options that use custom DNS service.  Captive Portal works by redirecting your initial connection to the portal for registrations by resolving all  URLs to the portal address.  By using your own custom DNS server, it prevents this redirection.
 


 

Hope this helps.

Monday, January 3, 2022

D-Link Decrypt and OpenWRT

Many D-Link routers such as DIR-2660 are great platforms for OpenWRT.  You can easily replace the default firmware with OpenWRT using its recovery GUI.

However, for whatever reason you need to revert the router back to its original firmware, it isn't that straightforward.  It seems recent D-Link firmware is encrypted but the recovery GUI can only take unencrypted firmware.  This means, the conversion is a one way trip.

Luckily, someone has developed a utility called "dlink-decrypt" overcoming this.

 

https://github.com/0xricksanchez/dlink-decrypt

 

As its name suggested, it decrypts the original firmware which can then used by the recovery GUI to revert the device back to its original setup.

Friday, October 1, 2021

Setting up a PiHole on an old Netbook

I used to run my Pi-Hole setup on a Raspberry Pi 3B+.  However I am about to pass the Pi to a family member, therefore I need something to run Pi-Hole on.


I have an old Netbook sitting around which I would like to make it useful again.  Unfortunately its processor is so old and is 32 bit only.  Many Linux distros are now being 64bit only so the options for running a modern OS on the this old computer seems getting slimmer and slimmer till I came around a web article said Debian is still distributing its 32bit version.

I get a copy of the 32bit version of the last Debian (Bullseye) from 

 


 

 http://debian.osuosl.org/debian-cdimage/11.0.0-live/i386/iso-hybrid/

 

After installed Debian, I install Pi-Hole as I would on my Pi using the instructions on the Pi-Hole website.

 https://github.com/pi-hole/pi-hole/#one-step-automated-install

 

Now, here are few things I have done to my install that I didn't do my my Pi before.


1) Disable the power saving features.  This is required to prevent the computer from falling into sleep expectively!

sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target



ref: https://www.unixtutorial.org/disable-sleep-on-ubuntu-server/

 

2) Add kernel parameter reboot=bios to fixed my reboot issue. My Netbook hangs at the stage just before the machine will reboot.   The reboot parameter fixes my problem, e.g.

sudo nano -e /etc/default/grub



Then run update-grub2 to apply the change.


ref: https://www.suse.com/support/kb/doc/?id=000017792

Situation

During a shutdown or reboot the system will shutdown appropriately but at the point where it should power off or begin the reboot it will hang.  The power must be manually turned off or cycled to boot the system back up.

Resolution

The kernel has a "reboot" parameter that will generally fix the problem.  Each of the options can be tested on bootup of the system by adding the parameter to the "Boot Options" in the GRUB menu.  Here is a list of all the options:

warm =  Don’t set the cold reboot flag
cold = Set the cold reboot flag
bios = Reboot by jumping through the BIOS (only for X86_32)
smp = Reboot by executing reset on BSP or other CPU (only for X86_32)
triple = Force a triple fault (init)
kbd = Use the keyboard controller. cold reset (this is the default)
acpi = Use the RESET_REG in the FADT
efi = Use efi reset_system runtime service
pci = Use the so-called “PCI reset register”, CF9
force = Avoid anything that could hang.

3) Edit the fstab to reduce the wear and tear to the SSD caused by EXT4 journal system.  See my another post at:

https://xpwithubuntu.blogspot.com/2020/05/linux-and-ssd.html

 

Hope you find this useful too.