Access To Modem Configuration
From DD-WRT Wiki
Revision as of 19:06, 8 March 2009 (edit) Olmari (Talk | contribs) m (→The way to follow) ← Previous diff |
Current revision (02:22, 29 August 2021) (edit) (undo) Kernel-panic69 (Talk | contribs) (→Introduction) |
||
(51 intermediate revisions not shown.) | |||
Line 1: | Line 1: | ||
__TOC__ | __TOC__ | ||
- | == | + | == Bridged modem == |
- | === | + | === Introduction === |
In this case the router itself creates the PPPoE connection to the ISP server; but to work, the connection between the modem and the router must have an IP address. Usually the modem gives an address to the client; but this address will never be used except to access the configuration interface of the modem. | In this case the router itself creates the PPPoE connection to the ISP server; but to work, the connection between the modem and the router must have an IP address. Usually the modem gives an address to the client; but this address will never be used except to access the configuration interface of the modem. | ||
- | My modem is a Speedtouch 510, is IP address is 10.0.0.138 and it gives the 10.0.0.1 address to the device connected to it. The easiest way to know these addresses is to connect the modem directly to your computer and take a look at your network card configuration. The default gateway is the Modem address and the Card address is the one provided by the modem. | + | My modem is a Speedtouch 510, is IP address is 10.0.0.138 and it gives the 10.0.0.1 address to the device connected to it. The easiest way to know these addresses is to connect the modem directly to your computer and take a look at your network card configuration. The default gateway is the Modem address and the Card address is the one provided by the modem. |
+ | |||
+ | '''Note: <font style="color:red">Many modems come configured to use the 192.168.1.x subnet. This is the same subnet that DD-WRT uses for the LAN by default. You need to either set the modem to use a different subnet or set the router's LAN to use an IP in a different subnet such as 192.168.2.1 so that they're not using the same subnet.</font>''' | ||
So it looks like this. | So it looks like this. | ||
- | < | + | <center>[[image:access.to.modem.png]]</center> |
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | + | ||
- | </ | + | |
By default if you type the IP address of the modem you have an "Impossible to contact the server" error. | By default if you type the IP address of the modem you have an "Impossible to contact the server" error. | ||
- | === | + | '''NOTE:''' ''For all methods below, you may need to substitute $(nvram get wan_ifname) for `nvram get wan_ifname)` if `nvram get wan_ifname)` does not work.'' |
- | ''' | + | |
- | * Go to | + | === Primary Method === |
+ | '''Replace the 10.0.0.2 with an IP in the same range as the modem. If your modem is 10.0.0.1, you should use 10.0.0.2. If your modem is 192.168.0.1, use 192.168.0.2''' | ||
+ | |||
+ | * Go to Administration -> Commands | ||
* Enter | * Enter | ||
- | ifconfig | + | ifconfig `nvram get wan_ifname`:0 10.0.0.2 netmask 255.255.255.0 |
- | and click on | + | and click on [Save Startup] |
- | + | ||
- | | + | iptables -t nat -I POSTROUTING -o `nvram get wan_ifname` -j MASQUERADE |
- | and click on | + | and click on [Save Firewall] |
+ | <span style="color: Red">'''On builds newer than 42755 you may need to change the above code and enter both lines under the firewall settings instead of splitting them:'''</span> | ||
- | + | ifconfig `nvram get wan_ifname`:0 10.0.0.2 netmask 255.255.255.0<br>iptables -t nat -I POSTROUTING -o `nvram get wan_ifname` -j MASQUERADE | |
- | [ | + | and click on [Save Firewall] |
'''Notes:''' | '''Notes:''' | ||
- | # | + | # `nvram get wan_ifname` gets the WAN port of your router automatically. If you wish to enter it manually, you should run '''echo `nvram get wan_ifname`''' to get your WAN interface name. |
- | ==== | + | ==== Success Report ==== |
- | + | '''Environment''' | |
- | * Log in via ssh | + | * ADSL2+ service with static IP (no PPPoE or DHCP) |
+ | * TP-LINK TD-8817 ADSL2+ Modem Router, ''configured as bridge'', web page at 192.168.1.1 | ||
+ | * Linksys E1200v2 with DD-WRT 21676, LAN address 192.168.2.1, WAN admin port 8080 | ||
+ | |||
+ | '''Objective''' | ||
+ | |||
+ | WAN access to modem on external IP port 8081 in addition to LAN access<br>(with WAN access to DD-WRT on external IP port 8080). | ||
+ | |||
+ | '''Administration > Commands''' | ||
+ | ifconfig `nvram get wan_ifname`:0 192.168.1.2 netmask 255.255.255.0 | ||
+ | [Save Startup] | ||
+ | iptables -t nat -I POSTROUTING -o `nvram get wan_ifname` -j MASQUERADE | ||
+ | [Save Firewall] | ||
+ | |||
+ | '''On builds newer than 42755 (Smart DNS implemented) you may need to change the above code and enter both lines under the firewall settings instead of splitting them:''' | ||
+ | |||
+ | '''Administration > Commands''' | ||
+ | ifconfig `nvram get wan_ifname`:0 192.168.1.2 netmask 255.255.255.0<br>iptables -t nat -I POSTROUTING -o `nvram get wan_ifname` -j MASQUERADE | ||
+ | [Save Firewall] | ||
+ | |||
+ | '''NAT / QoS > Port Forwarding''' | ||
+ | <table cellpadding="2" cellspacing="0"> | ||
+ | <tr> | ||
+ | <td style="color: #FFFFFF; background-color: #808080"> Application </td> | ||
+ | <td style="color: #FFFFFF; background-color: #808080"> Protocol </td> | ||
+ | <td style="color: #FFFFFF; background-color: #808080"> Source Net </td> | ||
+ | <td style="color: #FFFFFF; background-color: #808080"> Port from </td> | ||
+ | <td style="color: #FFFFFF; background-color: #808080"> IP Address </td> | ||
+ | <td style="color: #FFFFFF; background-color: #808080"> Port to </td> | ||
+ | <td style="color: #FFFFFF; background-color: #808080"> Enable </td> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td style="border: 1px solid #000000"> DSL Modem</td> | ||
+ | <td style="border: 1px solid #000000"> Both</td> | ||
+ | <td style="border: 1px solid #000000"> </td> | ||
+ | <td style="text-align: center; border: 1px solid #000000">8081</td> | ||
+ | <td style="text-align: center; border: 1px solid #000000">192.168.1.1</td> | ||
+ | <td style="text-align: center; border: 1px solid #000000">80</td> | ||
+ | <td style="border: 0 solid #000000">☑</td> | ||
+ | </tr> | ||
+ | </table> | ||
+ | |||
+ | [so modem web page can be accessed from WAN on port 8081 (as well as LAN on port 80)] | ||
+ | |||
+ | <span style="color: DarkRed"><strong>Important</strong>: With WAN access enabled, set <em>strong</em> | ||
+ | passwords in both modem and DD-WRT.</span> | ||
+ | |||
+ | ===Alternate Method=== | ||
+ | An alternate way to execute the above commands on startup if you have JFFS enabled is the following: | ||
+ | * Log in via ssh/telnet | ||
* create a file with the following content: | * create a file with the following content: | ||
#!/bin/sh | #!/bin/sh | ||
- | ifconfig | + | ifconfig `nvram get wan_ifname`:0 10.0.0.2 netmask 255.255.255.0 |
* save it as "/jffs/etc/config/modem.startup" | * save it as "/jffs/etc/config/modem.startup" | ||
* create another file with the following content: | * create another file with the following content: | ||
#!/bin/sh | #!/bin/sh | ||
- | | + | iptables -t nat -I POSTROUTING -o `nvram get wan_ifname` -j MASQUERADE |
* save it as "/jffs/etc/config/modem.wanup" | * save it as "/jffs/etc/config/modem.wanup" | ||
- | * make them | + | * make them executable: |
chmod +x /jffs/etc/config/modem.* | chmod +x /jffs/etc/config/modem.* | ||
+ | |||
+ | === Tertiary Method === | ||
+ | You can replace the 10.0.0.254 with an IP in the same range as the modem. If your modem is 10.0.0.1, you can use 10.0.0.254. If your modem is 192.168.0.1, you can use 192.168.0.254. | ||
+ | |||
+ | * Go to Administration -> Commands | ||
+ | * Enter | ||
+ | ip addr add 10.0.0.254/24 dev eth0 brd + | ||
+ | and click on ''Save Startup'' | ||
+ | * Enter | ||
+ | iptables -t nat -I POSTROUTING -o eth0 -d 10.0.0.0/24 -j MASQUERADE | ||
+ | and click on ''Save Firewall'' | ||
+ | |||
+ | '''Notes:''' | ||
+ | in the example given eth0 is WAN interface name. On the Setup --> Networking --> Port setup --> WAN Port Assignment you can check your WAN name and replace it according to your port configuration. | ||
+ | If you have Guest WiFi (VAP) you should block guest access to your modem like this: | ||
+ | |||
+ | iptables -I FORWARD -i ath0.1 -d 10.0.0.1/255.255.255.0 -m conntrack --ctstate NEW -j DROP | ||
+ | |||
+ | ===SSH Method=== | ||
+ | |||
+ | A good, secure method for accessing modem interface (configuration) is SSH port forwarding, which can be accomplished with the following steps (with ''Apply Settings'' on each screen): | ||
+ | |||
+ | 1. '''DD-WRT build with working SSH''' | ||
+ | |||
+ | SSH broken in 21061, fixed in builds >21676 | ||
+ | |||
+ | 2. '''Enable SSH service''' | ||
+ | |||
+ | DD-WRT: Services > Services > Secure Shell > SSHd > Enable | ||
+ | |||
+ | * No need to enable ''SSH TCP Forwarding'' for inbound connections. | ||
+ | * If ''Password Login'' is enabled, set a ''strong'' administrative password (12-14 random characters), and SSH login to the "root" account with that password. (See [[Telnet/SSH and the command line]]) | ||
+ | * Recommend changing ''Port'' to deter port scanners (e.g., 8022). | ||
+ | |||
+ | 3. '''Enable SSH remote management''' | ||
+ | |||
+ | DD-WRT: Administration > Remote Access > SSH Management > Enable | ||
+ | |||
+ | * Recommend changing ''SSH Remote Port'' to deter port scanners (e.g., 8022). | ||
+ | |||
+ | 4. '''Setup route to modem''' | ||
+ | |||
+ | DD-WRT: Administration > Commands | ||
+ | |||
+ | Assumes LAN subnet 192.168.2.nnn and modem at 192.168.1.1 (change as appropriate): | ||
+ | ifconfig `nvram get wan_ifname`:0 192.168.1.2 netmask 255.255.255.0 | ||
+ | [Save Startup] | ||
+ | |||
+ | 5. '''Configure SSH port forward''' | ||
+ | |||
+ | See Example below. | ||
+ | |||
+ | 6. '''Reboot DD-WRT and test''' | ||
+ | |||
+ | * [http://market.android.com/details?id=org.connectbot ConnectBot] is a good SSH client for Android. | ||
+ | * Mac OS X ''Terminal'' supports SSH. ([http://manas.tungare.name/blog/ssh-port-forwarding-on-mac-os-x/ guide]) | ||
+ | * [http://www.putty.org/ PuTTY] is a good SSH client for Windows. | ||
+ | |||
+ | '''Example''' | ||
+ | |||
+ | * Assumes LAN subnet 192.168.2.nnn and modem at 192.168.1.1 | ||
+ | * DD-WRT forward in PuTTY: L1080 192.168.2.1:80 (access at http://localhost:1080) | ||
+ | * Modem forward in PuTTY: L1081 192.168.1.1:80 (access at http://localhost:1081) | ||
+ | |||
+ | ===Notes=== | ||
+ | |||
+ | * <font style="color:red">'''Modem and LAN should be ''different'' subnets as in the examples above. It's ''not'' good network topology to have router WAN port and LAN ports on the same subnet (even when 'it works').'''</font> | ||
+ | |||
+ | [[Category:Wan]] | ||
+ | [[Category:Basic tutorials]] |
Current revision
Contents |
[edit] Bridged modem
[edit] Introduction
In this case the router itself creates the PPPoE connection to the ISP server; but to work, the connection between the modem and the router must have an IP address. Usually the modem gives an address to the client; but this address will never be used except to access the configuration interface of the modem.
My modem is a Speedtouch 510, is IP address is 10.0.0.138 and it gives the 10.0.0.1 address to the device connected to it. The easiest way to know these addresses is to connect the modem directly to your computer and take a look at your network card configuration. The default gateway is the Modem address and the Card address is the one provided by the modem.
Note: Many modems come configured to use the 192.168.1.x subnet. This is the same subnet that DD-WRT uses for the LAN by default. You need to either set the modem to use a different subnet or set the router's LAN to use an IP in a different subnet such as 192.168.2.1 so that they're not using the same subnet.
So it looks like this.

By default if you type the IP address of the modem you have an "Impossible to contact the server" error.
NOTE: For all methods below, you may need to substitute $(nvram get wan_ifname) for `nvram get wan_ifname)` if `nvram get wan_ifname)` does not work.
[edit] Primary Method
Replace the 10.0.0.2 with an IP in the same range as the modem. If your modem is 10.0.0.1, you should use 10.0.0.2. If your modem is 192.168.0.1, use 192.168.0.2
- Go to Administration -> Commands
- Enter
ifconfig `nvram get wan_ifname`:0 10.0.0.2 netmask 255.255.255.0
and click on [Save Startup]
iptables -t nat -I POSTROUTING -o `nvram get wan_ifname` -j MASQUERADE
and click on [Save Firewall]
On builds newer than 42755 you may need to change the above code and enter both lines under the firewall settings instead of splitting them:
ifconfig `nvram get wan_ifname`:0 10.0.0.2 netmask 255.255.255.0
iptables -t nat -I POSTROUTING -o `nvram get wan_ifname` -j MASQUERADE
and click on [Save Firewall]
Notes:
- `nvram get wan_ifname` gets the WAN port of your router automatically. If you wish to enter it manually, you should run echo `nvram get wan_ifname` to get your WAN interface name.
[edit] Success Report
Environment
- ADSL2+ service with static IP (no PPPoE or DHCP)
- TP-LINK TD-8817 ADSL2+ Modem Router, configured as bridge, web page at 192.168.1.1
- Linksys E1200v2 with DD-WRT 21676, LAN address 192.168.2.1, WAN admin port 8080
Objective
WAN access to modem on external IP port 8081 in addition to LAN access
(with WAN access to DD-WRT on external IP port 8080).
Administration > Commands
ifconfig `nvram get wan_ifname`:0 192.168.1.2 netmask 255.255.255.0
[Save Startup]
iptables -t nat -I POSTROUTING -o `nvram get wan_ifname` -j MASQUERADE
[Save Firewall]
On builds newer than 42755 (Smart DNS implemented) you may need to change the above code and enter both lines under the firewall settings instead of splitting them:
Administration > Commands
ifconfig `nvram get wan_ifname`:0 192.168.1.2 netmask 255.255.255.0
iptables -t nat -I POSTROUTING -o `nvram get wan_ifname` -j MASQUERADE
[Save Firewall]
NAT / QoS > Port Forwarding
Application | Protocol | Source Net | Port from | IP Address | Port to | Enable |
DSL Modem | Both | 8081 | 192.168.1.1 | 80 | ☑ |
[so modem web page can be accessed from WAN on port 8081 (as well as LAN on port 80)]
Important: With WAN access enabled, set strong passwords in both modem and DD-WRT.
[edit] Alternate Method
An alternate way to execute the above commands on startup if you have JFFS enabled is the following:
- Log in via ssh/telnet
- create a file with the following content:
#!/bin/sh ifconfig `nvram get wan_ifname`:0 10.0.0.2 netmask 255.255.255.0
- save it as "/jffs/etc/config/modem.startup"
- create another file with the following content:
#!/bin/sh iptables -t nat -I POSTROUTING -o `nvram get wan_ifname` -j MASQUERADE
- save it as "/jffs/etc/config/modem.wanup"
- make them executable:
chmod +x /jffs/etc/config/modem.*
[edit] Tertiary Method
You can replace the 10.0.0.254 with an IP in the same range as the modem. If your modem is 10.0.0.1, you can use 10.0.0.254. If your modem is 192.168.0.1, you can use 192.168.0.254.
- Go to Administration -> Commands
- Enter
ip addr add 10.0.0.254/24 dev eth0 brd +
and click on Save Startup
- Enter
iptables -t nat -I POSTROUTING -o eth0 -d 10.0.0.0/24 -j MASQUERADE
and click on Save Firewall
Notes: in the example given eth0 is WAN interface name. On the Setup --> Networking --> Port setup --> WAN Port Assignment you can check your WAN name and replace it according to your port configuration. If you have Guest WiFi (VAP) you should block guest access to your modem like this:
iptables -I FORWARD -i ath0.1 -d 10.0.0.1/255.255.255.0 -m conntrack --ctstate NEW -j DROP
[edit] SSH Method
A good, secure method for accessing modem interface (configuration) is SSH port forwarding, which can be accomplished with the following steps (with Apply Settings on each screen):
1. DD-WRT build with working SSH
SSH broken in 21061, fixed in builds >21676
2. Enable SSH service
DD-WRT: Services > Services > Secure Shell > SSHd > Enable
- No need to enable SSH TCP Forwarding for inbound connections.
- If Password Login is enabled, set a strong administrative password (12-14 random characters), and SSH login to the "root" account with that password. (See Telnet/SSH and the command line)
- Recommend changing Port to deter port scanners (e.g., 8022).
3. Enable SSH remote management
DD-WRT: Administration > Remote Access > SSH Management > Enable
- Recommend changing SSH Remote Port to deter port scanners (e.g., 8022).
4. Setup route to modem
DD-WRT: Administration > Commands
Assumes LAN subnet 192.168.2.nnn and modem at 192.168.1.1 (change as appropriate):
ifconfig `nvram get wan_ifname`:0 192.168.1.2 netmask 255.255.255.0
[Save Startup]
5. Configure SSH port forward
See Example below.
6. Reboot DD-WRT and test
- ConnectBot is a good SSH client for Android.
- Mac OS X Terminal supports SSH. (guide)
- PuTTY is a good SSH client for Windows.
Example
- Assumes LAN subnet 192.168.2.nnn and modem at 192.168.1.1
- DD-WRT forward in PuTTY: L1080 192.168.2.1:80 (access at http://localhost:1080)
- Modem forward in PuTTY: L1081 192.168.1.1:80 (access at http://localhost:1081)
[edit] Notes
- Modem and LAN should be different subnets as in the examples above. It's not good network topology to have router WAN port and LAN ports on the same subnet (even when 'it works').