Getting access to the nifty CUWiN web interface

Thanks for the tips, will keep in mind the 192.168.0.1 alias.

I do have several questions thought......

1. If SSH only runs on the local NIC, how does an admin handle multiple CUWiN boxes on a network? Without the SSH connection, they can't be controlled from a central location.

2. Can the box be set up to ignore DHCP requests? If you are deploying the tech into an insecure environment, allowing a local user to set up a DHCP box, kick over the hub and start assigning IPs onto the local wireless lan could be bad, he or she could do all kinds of nasty, nasty things if they set up, say a sniffer and a DNS server.

3. Instead of bringing the signal down to the location via CAT-5 can the ID of the ethernet device be disabled and a second wireless card added? Say you want to run a mesh backbone on 802.11a and provide local service on 802.11g? This is our plan here in Lawrence, but we haven't hacked on the CUWiN boxes for a while (setting up basic LDAP, DNS, DHCP, SMTP, FW, etc at the moment). Is this possible and if so do you want changes pumped back into the source.

At $500 or so each, the Metrix boxes aren't an ideal solution if you have to put one on each service point. We are looking at 25,000 users in Lawrence and most would be unwilling to put up this much cash. If we can set up the mesh as the backbone, however, and use cheap hardened D-Link G810s on the homes, a city wide network becomes possible.

What is the team's outlook on getting this packed down to a size appropriate for a Linksys image hack?

____________________________
Lawrence Freenet Project
Lawrence, KS
http://www.lawrencefreenet.org

oojoshua wrote on Sat, 2005-06-18 01:24:

Thanks for the tips, will keep in mind the 192.168.0.1 alias.

I do have several questions thought......

1. If SSH only runs on the local NIC, how does an admin handle multiple CUWiN boxes on a network? Without the SSH connection, they can't be controlled from a central location.

The ssh server listens on the wireless interfaces too. I was just saying the 192.168.0.1 alias will only resolve to localhost (the node you are receiving a DHCP address from via the wired interface). If you want to access the web interface of some other node you can:

ssh -L 8000:localhost:80 guest@10.x.x.x

and then open your browser to http://localhost:8000

2. Can the box be set up to ignore DHCP requests? If you are deploying the tech into an insecure environment, allowing a local user to set up a DHCP box, kick over the hub and start assigning IPs onto the local wireless lan could be bad, he or she could do all kinds of nasty, nasty things if they set up, say a sniffer and a DNS server.

I'm not sure quite what you are describing with respect to "assigning IPs onto the local wireless lan". The CUWiN box will only assign DHCP addresses to things connected through it's wired interface. Anything assigned a DHCP will be routable on the network. You could put another router, firewall, access point, whatever behind the CUWiN box to address any security concerns.

3. Instead of bringing the signal down to the location via CAT-5 can the ID of the ethernet device be disabled and a second wireless card added? Say you want to run a mesh backbone on 802.11a and provide local service on 802.11g? This is our plan here in Lawrence, but we haven't hacked on the CUWiN boxes for a while (setting up basic LDAP, DNS, DHCP, SMTP, FW, etc at the moment). Is this possible and if so do you want changes pumped back into the source.

This has been talked about several times on the CUWiN development list (you can subscribe and check out the archives, see the Development lists here)

From what I remember the developers thought this was a doable (with maybe a couple weeks of work) and desirable thing to do, but just wasn't high on the priority list for them. I'm sure they'd be happy to accept patches to implement inclusion of an access point on a 2nd wireless interface. The development list (see above) is the place to ask about this sort of thing.

At $500 or so each, the Metrix boxes aren't an ideal solution if you have to put one on each service point. We are looking at 25,000 users in Lawrence and most would be unwilling to put up this much cash. If we can set up the mesh as the backbone, however, and use cheap hardened D-Link G810s on the homes, a city wide network becomes possible.

What is the team's outlook on getting this packed down to a size appropriate for a Linksys image hack?

~$500 would get you a Mark II that has two wireless cards and 2 N connector ports. If you just want backhaul, the Mark I will suffice at about $275 (-10% for non-profit partners). With antenna, mounting hardware, etc, that takes you to probably $325. It may be worthwhile to investigate wrapbox as an alternative.

I know "miniaturization" to get the install image down to a size practical for AP flash rom type installs is a long term goal. You'll get better info from the developers on the dev mailing list about how easy this will be to do. Though the target platform has to have a supported wireless chipset.. I think linksys might be out of the question because of the lack of open drivers (broadcom), but I don't know about the DLink you mentioned.

Bill

--
Bill Comisky
bcomisky@pobox.com