Internal Network Exposed

[Anonymous]

Just got Splash Free Router working okay. It assigns IP on 192.168.182.0 subnet no problem.

Issue is my 192.168.1.0 internal subnet is completly exposed. Ipconfig reveals DNS Server on local network. (see below)

What is missing or set incorrectly?

Microsoft Windows [Version 6.1.7601]

Copyright © 2009 Microsoft Corporation. All rights reserved.

C:UsersDonn>ipconfig /all

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . : key.chillispot.info

Description . . . . . . . . . . . : DW1501 Wireless-N WLAN Half-Mini Card

Physical Address. . . . . . . . . : 68-A3-C4-13-34-0F

DHCP Enabled. . . . . . . . . . . : Yes

Autoconfiguration Enabled . . . . : Yes

Link-local IPv6 Address . . . . . : fe80::8934:e936:cbdd:81b3%10(Preferred)

IPv4 Address. . . . . . . . . . . : 192.168.182.4(Preferred)

Subnet Mask . . . . . . . . . . . : 255.255.255.0

Lease Obtained. . . . . . . . . . : Sunday, December 18, 2011 4:07:56 PM

Lease Expires . . . . . . . . . . : Sunday, December 18, 2011 4:47:56 PM

Default Gateway . . . . . . . . . : 192.168.182.1

DHCP Server . . . . . . . . . . . : 192.168.182.1

DHCPv6 IAID . . . . . . . . . . . : 191407044

DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-14-F1-40-9A-F0-4D-A2-6D-40-66

DNS Servers . . . . . . . . . . . : 192.168.1.2

192.168.1.2

NetBIOS over Tcpip. . . . . . . . : Enabled

[Anonymous]

Hi,

I had the same. You actually describe two problems: 1) The internal network is exposed/accessible from the hotspot network. 2) It actually points out the existance of said internal network to the users by the DNS.

For the DNS issue, its very simple: Change your hotspot router to non-DHCP/static IP address, so you add the IP/GW/DNS manually. And then simply add 8.8.8.8 and 8.8.4.4 as DNS, or any other DNS you would like to use, like those of your ISP. In DD-WRT go to Setup->Basic setup to do this.

For the exposed network, I added the following 2 lines to the firewall (on DD-WRT). The first line was already present from HotSpotSystem.

Go to Admin->Commands, type all 3 lines in the Command box, and ‘Save as Firewall’

iptables -t mangle -A POSTROUTING -p tcp –tcp-flags SYN,RST SYN -m tcpmss –mss 1412:65535 -j TCPMSS –clamp-mss-to-pmtu

iptables -t nat -A PREROUTING -p tcp -m state –state NEW -s `nvram get hotss_net` -d `nvram get wan_gateway`/24 -j DROP

iptables -t nat -A PREROUTING -p tcp -m state –state NEW -s `nvram get lan_ipaddr`/24 -d `nvram get wan_gateway`/24 -j DROP

The two extra lines drop any new TCP socket from the hotspot to the local LAN. But any new socket from local LAN toward the hotspot would still work, which is nice for management if you have extra AP’s behind the hotspot. It drops traffic from both the virtual networks (the 182 net) and the actual network (the 20 net) so even hackers who sniff out the 20 net cannot get past it.

I had expected to also have to add a line to again accept traffic to the gateway itself, as indeed originally the DNS on the gateway is used. But it seems somehow the gateway is already exempted in some other firewall rule. So with above lines, your internal network is blocked, except the main gateway, That is still ‘exposed’ make sure you set a good password. I suspect its better that way anyway, it could be that if you cannot get to the gateway, you also may not get past it. At least there are no hints to its existance.

I was testing this only yesterday evening, but it seems to work on DD-WRT at least. But be careful, a wrong firewall statement could make your device unaccessible, and you would have to do a master reset. I am not responsible. Let me know your result.

[Anonymous]

Hi,

It looks like you have nailed the problem. This looks like it will work.

My issue now is I can’t get back into my router. Since i applied the ‘(In DD-WRT) Go to Wireless > Advanced wireless settings and enable AP isolation in your router so clients will not able to see each other.’ as recomended by support, the router no longer sees the gateway.

I’ve tried a master reset (30/30/30), but that seems to have no effect since I ran the ‘startup command’.

I think my only hope is to issue a:

erase nvram

reboot

through the hotspotsystem web site, and hope that the router and web site are talking to each other.

[Anonymous]

30/30/30 should work. In fact, just a 30 second reset may already work (if the OS is loaded properly, it too will already rebuild nvram)

Not sure what you mean with “since I ran the ‘startup command’.” , that seems unrelated to the topic above.

You did first enable WAN-side management access, right?

[Anonymous]

Marko pointed me to a dd-wrt forum article that suggested that the ECB-3500 needed a 60 second reset. That doesn’t work.Even tried a 60/60/60 that also didn’t work.

The start command refers to the Hotspotsystem installation process created in Manage > Locations > Hotspot Information > ROUTER SETUP COMMAND FOR THIS LOCATION

I did notice while doing a ping -t during the reset attempts, I got about a 2 second response from 192.168.1.1 during power on.

I was able to get to the RedBoot prompt and was able to re-install the linux.bin image from dd-wrt. This was done according to the manufactures instructions that came with the router, the same ones I used to install dd-wrt the first time.

To my suprise, it had no effect. Somehow, I think I need to erase nvram or something first when I get the RedBoot prompt. Any ideas?

[Anonymous]

Bummer. I lost contact with my TP-LINK WR941ND several times during my experiments, and always a 30 second reset was enough.

But you are able to get into redboot, thats good. I did that a while ago when I did my Fonera. It had an instruction on reset of the NVRAM from within Redboot. Probably/Maybe it also for you, though you may need to recalculate the exact hex memory position, and I am still not responsible.

Also, DD-WRT for the ECB-3500 is with activation, so I guess you paid for the activation, possibly you can expect a little help from them.

I selected TP-LINK myself. The WR941ND has the fast CPU speed and plenty memory like yours, but no activation needed, and not very expensive. I also have two WR740N’s. Dirt-cheap, and also 400MHz/32MB/8MB. But only v1/v2/v3 hardware can be put with DD-WRT, so buying them is a risk, you may get a V4. I agree they do not have the best radio’s, but I plan to use Ubiqity devices on the LAN ports anyway, the TP links local radio is for inside the house only,

—

Also, the first time I ran the setup command (on the FON2200, early experiment), it broke my device too. On second attempt, I manually took each of the commands that were in that command-string, analyzed the actual setup.sh after the wget, and found it referred to a network port that did not exist on atheros devices. So I manually tweaked the setup.sh before I ran it. (eth1 had to be replaced with ath0 or br0)

Since then, they actually fixed the script, its now compatible with atheros, but maybe you have something similar. Maybe your device does not have a br0, which would mean that when they fixed the script for atheros, they broke it for you…..

[Anonymous]

Donn was able to get the router back using the original firmware image. We are currently working on his configuration setting for the hotspot. What’s the current status Donn?

[Anonymous]

After successful image reload, — No Ip addresses were changed from the screenshots. I just changed the wan from static to DHCP-Automatic. I have now lost all contact with the device, both the wan and lan side.

Does anyone have all the correct settings for an ECB-3500? Or even correct sittings for a router with a single ethernet port?

I’ve ordered the "hotspot in a box" to try and get this proof of concept done, as it needs to be deployed in a resort in Nantucket very soon.

I’m going go re-flash the ECB-3500 with the Sputnik ddwrt image which has been customized and tested with this device.

I may also reload the original build of ddwrt and try to get back to the working router with the exposed network.