OpenFlow, OpenWRT and bro-ids on rb450g

OpenWRT, OpenFlow and bro-ids on Routerboard 450g

This small form factor board has a capacity to be used as enterprise CPE, no other hardware in this class has this much of RAM, CPU or flash storage (which are used for SOHO devices), where advance security features, routing features could be used.

• AR7161 680MHz Atheros CPU, could turbo boost to 800 Mghz
• 256MB RAM
• 512MB built-in NAND flash and a microSD slot, you can also boot RB from microSD if you are using bootloader ver 3.02.
• 4 x 1 port Athros ( AR8316 Switch )
• 1 WAN port
• 10-24V DC
• for more details you can check http://routerboard.com/RB450g and http://wiki.openwrt.org/toh/mikrotik/rb450g

OpenWrt is described as a Linux distribution for embedded devices. Instead of trying to create a single, static firmware, OpenWrt provides a fully writable filesystem with package management. This frees you from the application selection and configuration provided by the vendor and allows you to customize the device through the use of packages to suit any application. For developer, OpenWrt is the framework to build an application without having to build a complete firmware around it; for users this means the ability for full customization, to use the device in ways never envisioned.

My intention to port openwrt to routerboard 450G was to play and learn openflow protocol and learn new things about it about it.

The development platform I used is ubuntu vm on virtualbox.
lets start the build process:

Building the image

apt-get install build-essential binutils flex bison autoconf gettext texinfo sharutils subversion libncurses5-dev ncurses-term zlib1g-dev gawk 

mkdir ~/ofwrt
cd ~/ofwrt

svn co svn://svn.openwrt.org/openwrt/trunk/

cd trunk/

sudo ./scripts/feeds update -a

sudo ./scripts/feeds install -a

cd ~/ofwrt/

git clone git://gitosis.stanford.edu/openflow-openwrt

cd ~/ofwrt/trunk/packages/ 

ln -s ~/ofwrt/openflow-openwrt/openflow-1.0/

cd ~/ofwrt/trunk/ 

ln -s ~/ofwrt/openflow-openwrt/openflow-1.0/files

cd ~/ofwrt/

Apply Patch to kernel for making a larger parition on the NAND to fit the bigger kernel in

vi target/linux/ar71xx/files/drivers/mtd/nand/rb4xx_nand.c

locate the lines:

From: 

 



   {
      .name   = "kernel",
      .offset = (256 * 1024),
      .size   = (4 * 1024 * 1024) - (256 * 1024),
    },
To:

    {
        .name   = "kernel",
        .offset = (256 * 1024),
        .size   = (8 * 1024 * 1024) - (256 * 1024),
    },

 or you can also download the patch here and apply,

make menuconfig

• Select your platform for Target System (Atheros AR71xx)

• Select OpenFlow package under network
• Select tc package under network
• Select kmod-tun under Kernel Modules->Network Support
• in Target Images -> select  [ ] ramdisk  --->
• Save and Exit

Add support for queueing :

• make kernel_menuconfig 
• Under Networking Support->Networking options->QoS and/or fair queueing select Hierarchical Token Bucket (HTB)
• Save and Exit

Build the image

makeV=99 # to speed up compilation on multicore systems,

ionice -c 3 nice -n 20 make -j 2 #for quad-core CPU put -j 3

make sure internet is accessible from this machine this process will download neccessary source code if missing otherwise the process will not complete.

Flashing the Router

You need a tftp and dhcp server. I used tftpd32 it has built-in dhcp and tftp server, copy 'openwrt-ar71xx-nand-vmlinux-initramfs.elf' file from trunk/bin/ to tftp root directory,
and set the tftpd32 like this,

attached rb450g to your computer's serial port, on the boot menu select boot options-> Ethernet then nand flash, boot protocol -> dhcp

press 'x' on the main menu.

the router board will successfully boot from the ethernet, as the router is booted, make neccessary network configuration, e.g. connect ethernet (switch port to your computer, assign your computer the ip address 192.168.1.2/24) after succesful connectivity.

Here you need to run the build process again and create an image that could be installed on the router, for this 

access the machine where you were building from the source, locate to trunk directory

• cd ~/ofwrt/trunk/
• make menuconfig
• under Target Images --->
• uncheck ramdisk --->
• make V=99

come back to your machine install babyftp or any other ftp or http server.

copy files 'openwrt-ar71xx-nand-vmlinux-lzma.elf' and 'openwrt-ar71xx-nand-rootfs.tar.gz' from trunk/bin/ar71xx/ to your ftp|http root.


come to openwrt shell on rb450g, type the following command,



wget2nand ftp://192.168.1.xxx/
wget2nand will automatically download the required files and burn them onto flash. If every thing goes successful it will prompt a success msg and ask you to reboot. simply reboot the device and it will give you access to openwrt shell runnning on rb450g.

next is to install openflow package you compiled to openwrt, download the package openflow_1.0.0-1_ar71xx.ipk and install via

opkg install openflow_1.0.0-1_ar71xx.ipk

start the openflow service...

/etc/init.d/openflow start

root@OpenWrt:~# /etc/init.d/openflow start
eth1.1
Configuring OpenFlow switch for out-of-band control
No need for further configuration for out-of-band control
Jan 25 12:52:24|00001|vlog|INFO|opened log file /var/log/ofprotocol.log
Jan 25 12:52:24|00002|secchan|INFO|OpenFlow reference implementation version 1.0.0
Jan 25 12:52:24|00003|secchan|INFO|OpenFlow protocol version 0x01
Jan 25 12:52:24|00004|secchan|WARN|new management connection will receive asynchronous messages
Jan 25 12:52:24|00005|rconn|INFO|unix:/var/run/dp0.sock: connecting...
Jan 25 12:52:24|00006|rconn|INFO|tcp:192.168.1.2:6633: connecting...
Jan 25 12:52:24|00007|rconn|INFO|unix:/var/run/dp0.sock: connected

root@OpenWrt:~# ps | grep of
3 root 0 SW [ksoftirqd/0]
1355 root 1268 S ofdatapath punix:/var/run/dp0.sock -i eth1.1 --no-lo
1371 root 1068 S ofprotocol unix:/var/run/dp0.sock tcp:192.168.1.2:66
1373 root 1500 S grep of

if you have successfully installed the package, both daemons ofdatapath and pfprotcol must be running.

lets install bro-ids

setup up your routerboard to internet access and execute the following command,

wget http://sysnet.org.pk/upload/rc_shrimpFiles/openwrt-bro.tar.gz

it will download and install dependencies.

thats all! i will upload a working lab in which

http://wiki.openwrt.org/doc/howto/buildroot.exigence

http://www.openflow.org/wk/index.php/OpenFlow_1.0_for_OpenWRT

Steal Belted Radius proxy realms

Proxy.ini

o   Under [Realms] tag define a name for the realm following equals to sign with pattern

§  E.g., iptv=*PTCL-IPTV (in this example iptv is the name of the realm used to reference realm throughout configurations. On the right side of the = sign is the pattern used to match certain usernames which will be directed to this realm.

Realm.pro

§  Create a file named realm name which is used in the proxy.ini as reference with its extension as pro.

§  E.g. we configured iptv as name in proxy.ini for the iptv realm

[Auth]

Enable = 1

TargetsSection = nameA

RoundRobin = 2

StripRealm = 0

RequestTimeout = 5

NumAttempts = 3

MessageAuthenticator = 0

UseMasterDictionary = yes

TargetsSection = nameA

name identifies a section called [name] that appears elsewhere in the .pro file. This section lists all the targets in a proxy realm.  When it receives a request for this proxy realm, Steel-Belted

Radius Carrier selects a target from this list. Having the TargetsSection setting available in the [Auth] and  [Acct] sections permits you to name different target selection parameters for proxy RADIUS authentication and accounting. Default value of name is AuthTargets, indicating the name of the  section is [AuthTargets].

[nameA]

Server = n

Server = n

where Server is the name of a server configured as a target for standard proxy

RADIUS forwarding, and n is explained in the next section.

Server must match a Proxy entry in the Steel-Belted Radius Carrier database. This

Proxy entry provides the address and shared secret for the target server. All other

settings in the Proxy entry (retry policy, proxy accounting) are overridden by the

settings that you configure in the RealmName.pro file.

Server name is configured using SBR administration panel.

please feel free to contact in case of any mistake or improvement.