WEB server

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 00:32, 14 April 2009 (edit)
Soulstace (Talk | contribs)
(Procedure - Caution! Management pages could be accessible from the WAN.)
← Previous diff
Current revision (19:08, 27 April 2015) (edit) (undo)
Rogerdpack (Talk | contribs)
(note moving old web server optional)
 
(10 intermediate revisions not shown.)
Line 2: Line 2:
Please remember that opening WEB server to the world could be potential security problem.<br> Please remember that opening WEB server to the world could be potential security problem.<br>
-=Assumptions=+= WEB server with v24-preSP2 =
 + 
 +Under v24-preSP2 it is possible to serve static HTML pages '''using the existing (configuration) web server''' by symlinking them into the www/user directory.
 + 
 +==Assumptions==
- You have telnet and [http://en.wikipedia.org/wiki/Secure_Shell SSH] enabled on your router. See [[Telnet/SSH_and_the_Command_Line]].<br> - You have telnet and [http://en.wikipedia.org/wiki/Secure_Shell SSH] enabled on your router. See [[Telnet/SSH_and_the_Command_Line]].<br>
- You can send files via SSH to and from your desktop (e.g with WinSCP)<br> - You can send files via SSH to and from your desktop (e.g with WinSCP)<br>
Line 8: Line 12:
- I will assume you are installing to the jffs partition. If you are not, replace '''jffs''' with '''mmc''' or some other folder<br> - I will assume you are installing to the jffs partition. If you are not, replace '''jffs''' with '''mmc''' or some other folder<br>
- You have the "'''Enable Info Site'''" enabled (Administration -> Management -> WEB Access)<br> - You have the "'''Enable Info Site'''" enabled (Administration -> Management -> WEB Access)<br>
-- Optional: you have the "'''Wireless GUI Access'''" enabled (Wireless -> Advanced Settings)<br>+- You MUST name your index file index.htm (note: all lower case letters)<br>
-- You '''MUST''' name your index file '''Info.htm''' (note upper case "I", thus "Info.htm" and NOT "info.htm") <br>+
-<br>+
-'''How will this work?'''<br>+
-- We will move the router's web admin to port 81<br>+
-- We will start your WEB server at port 80<br>+
-- Optional: we will open port 80 to the world<br>+
==Procedure== ==Procedure==
-<div style="text-align: center; margin: 1em 10%; background: #fa8072; border: #8b0000 1px solid;">For DD-WRT V23 SP2, the Info.htm doesn't work. Disable Info Site, and stay away of the router main pages or it will override your webpages. Please see the relevant discussion on the [[:{{NAMESPACE}} talk:{{PAGENAME}}|talk page]] for further details.</div>+Create static pages under /jffs or under some other persistent partition you have configured. Symlink your www-root to /www/user. For example:
-'''1)''' Copy your files to the router, i.e. to the /jffs folder<br>+ mkdir /jffs/www
-'''2)''' Open web admin Administration -> Diagnostics, press "Run"<br>+ echo "test page" > /jffs/www/test.htm
-'''3)''' Enter these lines to the Commands field:<br>+ ln -sf /jffs/www /www/user
- killall httpd+Arrange to create the symbolic link on startup, then pages from jffs/www can be served up as http://router.address/user/test.htm.
- cd /www+
- httpd -p 81 -h /www+
- cd /jffs+
- httpd -h /jffs+
-'''4)''' Press "Save Startup", the router will reboot or reboot it manually.<br><br>+==Pros==
-<br>+- Simplest to set up.<br>
-'''Optional:''' open to the world<br>+- Saves both the complexities and the memory usage of running two HTTP servers.<br>
-<br>+
-'''1)''' Open web admin Administration -> Diagnostics, press "Run"<br>+
-'''2)''' Enter this line to the Commands field:<br>+
- /usr/sbin/iptables -I INPUT 1 -p tcp --dport 80 -j logaccept+==Cons==
 +- No support for cgi-bin. <br>
 +- Your info site & DD-WRT management page will be available on the same http server, so choose a strong password. <br>
 +- You can't get link to your site included in admin pages.<br>
-'''3)''' Press "Save Firewall", the router will reboot or reboot it manually.<br>+<div style="text-align: center; margin: 1em 10%; background: #fa8072; border: #8b0000 1px solid;">For DD-WRT V24 pre SP2 (svn 12533+) CGI support has been disabled as a fix for an exploit. See this [http://svn.dd-wrt.com:8000/dd-wrt/ticket/1182 ticket] if you would like support reintroduced.</div>
-'''Congratulations!!!''', you have your own web server running.<br>+= Separate httpd-server for your site =
-Please remember your router's config pages are now at 192.168.1.1''':81'''<br>+For the best result it is better to use separate httpd-server for your site. There are several possibilities: install vlighttpd e.g. with [[Optware, The Right Way]] or install [[Optware-ByHand]] and after that busybox (for simple httpd) or install lighttpd.
-<br>+
-<br>+
-'''How to cancel this?'''<br>+
- +
-Telnet to the router and type:<br>+
- nvram set rc_startup=""+
- nvram set rc_firewall=""+
- nvram commit+
- reboot+
- +
-=WEB server with v24 RC5=+
- +
-DD-WRT runs a small httpd server used for configuring the router. This guide will show how to use it to serve you own pages to your LAN or to the world.+
-Please remember that opening WEB server to the world could be potential security problem.<br>+
==Assumptions== ==Assumptions==
- You have telnet and [http://en.wikipedia.org/wiki/Secure_Shell SSH] enabled on your router. See [[Telnet/SSH_and_the_Command_Line]].<br> - You have telnet and [http://en.wikipedia.org/wiki/Secure_Shell SSH] enabled on your router. See [[Telnet/SSH_and_the_Command_Line]].<br>
-- You can send files via SSH to and from your router (e.g with WinSCP)<br>+- You can install additional httpd-server to your router.<br>
-- You have jffs enabled and enough free space to store your files or you have working mmc mod.<br>+- You can send files via SSH to and from your desktop (e.g with WinSCP)<br>
-- I will assume you are installing to the jffs partition. If you are not, replace '''jffs''' with '''mmc''' or some other folder. <br>+- You have jffs enabled and enough free space to store your files or you have some other persistent partition e.g. mmc mod or usb drive.<br>
-- Optional: you have the "'''Wireless GUI Access'''" enabled (Wireless -> Advanced Settings)<br>+
-- You '''MUST''' name your index file '''index.htm''' (note: all lower case letters)<br>+
-<br>+
-'''How will this work?'''<br>+
-- We will move the router's web admin to port 81<br>+
-- We will start your WEB server on port 80<br>+
-- Optional: we will open port 80 to the world<br>+
==Procedure== ==Procedure==
-'''1)''' Copy your files to the router, i.e. to the /jffs folder<br>+'''1)''' Install additional www-server of your choice e.g. busybox httpd, lighttpd or vlighttpd from optware<br>
-'''2)''' Open web admin Administration -> Diagnostics, press "Run"<br>+'''2)''' Move default httpd away from port 80 (optional). Easiest is just to disable web administration via http, https uses port 443. Other option is to set the http_lanport nvram variable in the nvram:
-'''3)''' Enter these lines to the Commands field:<br>+
- killall httpd+ nvram set http_lanport=81
- httpd -p 81 -h /www+ nvram commit
- httpd -h /jffs+ reboot
 + 
 +'''Note''': Even if you plan to use secondary IP for your own site, you need to move the built-in httpd away from the port 80, as it listens it's port on all IP:s.
-'''4)''' Press "Save Startup", the router will reboot or reboot it manually.<br><br>+'''3)''' Optional: open to the world
-<br>+
-'''Optional:''' open to the world+
<font color=#F88017>'''Caution!'''</font> The following steps could make the router's management pages accessible from the WAN (for example http://Your.WAN.IP/Management.asp). The password should be required however, so make sure it is strong. <font color=#F88017>'''Caution!'''</font> The following steps could make the router's management pages accessible from the WAN (for example http://Your.WAN.IP/Management.asp). The password should be required however, so make sure it is strong.
-'''1)''' Open web admin Administration -> Diagnostics, press "Run"<br>+* Open web admin Administration -> Diagnostics, press "Run"<br>
-'''2)''' Enter this line to the Commands field:<br>+* Enter this line to the Commands field:<br>
/usr/sbin/iptables -I INPUT 1 -p tcp --dport 80 -j logaccept /usr/sbin/iptables -I INPUT 1 -p tcp --dport 80 -j logaccept
-'''3)''' Press "Save Firewall", the router will reboot or reboot it manually.<br>+* Press "Save Firewall", the router will reboot or reboot it manually.<br>
-'''Congratulations!!!''', you have your own web server running.<br>+* '''How to cancel this?'''<br>
- +
-Please remember your router's config pages are now at 192.168.1.1''':81'''+
- +
-'''How to cancel this?'''<br>+
Telnet to the router and type:<br> Telnet to the router and type:<br>
- nvram set rc_startup="" 
nvram set rc_firewall="" nvram set rc_firewall=""
nvram commit nvram commit
reboot reboot
-=How to access/edit pages=+== Pros ==
- +- You have full control of your site. You can run cgi, php etc. <br>
-====I.====+
-You can add your own pages to /tmp/www folder and then access them with http://192.168.1.1/user/Yourpage.asp+
- +
-Only static html pages, but if you need dynamic pages you can use CGI scripts (sh scripts or some binary file) +
- +
-Create the directory /tmp/www/cgi-bin+
- +
-Then create a script like:+
- +
- #!/bin/sh +
- echo "<html><body>hello world</body></html>"+
- +
-Save your script as script.cgi and+
- chmod +x /tmp/www/cgi-bin/script.cgi+
-You can execute the page going to http://192.168.1.1/user/cgi-bin/script.cgi+
- +
-Reference: [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=29673 this thread]+
-====II.====+
- +
-Shellscripts with .sh will work in folder /tmp/www/cgi-bin as well...+
- +
-example would be:+
- +
-<pre>+
-#!/bin/sh+
-echo '<HTML><HEAD><TITLE>Custom Script Test</TITLE></HEAD>'+
-echo '<BODY>'+
-nvram get router_name+
-echo ' sample custom script:<br>'+
- +
-NOW=`date +%s`+
- +
-echo "Unix-Time here on this device is ${NOW}. Nothing usefull...<br>"+
-echo "Just a test..."+
-</pre>+
- +
-save this as<br>+
-/tmp/www/cgi-bin/custom.sh<br>+
-and make it executable:<br>+
-chmod +x /tmp/www/cgi-bin/custom.sh<br>+
-and point your browser to it:<br>+
-http://ROUTER.IP.HERE/user/cgi-bin/custom.sh<br>+
- +
-and you should see the generated output...+
- +
-This is tested with<br>+
-DD-WRT v24-sp2 (10/22/08) mega - build 10564M NEWD Eko+
-Reference: [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=25015&p=220539#220539 CaScAdE]+== Cons ==
 +- Complex to set up<br>
 +- Requires more memory and processing power from your router<br>
-Note: In these examples, we created scripts in the /tmp directory which is actually pointing to SDRAM. Any pages or scripts in this directory will be lost upon router reboot and/or power loss, unless you back them up first in jffs2/mmc/nvram. 
=Change SSL cert for HTTPS certificates= =Change SSL cert for HTTPS certificates=
Line 164: Line 85:
See forum topics [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=27979 Change SSL cert for HTTPS certificates] and [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=27968 Adding user created ssl certificates]. See forum topics [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=27979 Change SSL cert for HTTPS certificates] and [http://www.dd-wrt.com/phpBB2/viewtopic.php?t=27968 Adding user created ssl certificates].
-[[Category:English documentation]]+[[Category:Applications]]
 +[[Category:Management]]
[[Category:Advanced tutorials]] [[Category:Advanced tutorials]]

Current revision

DD-WRT runs a small httpd server used for configuring the router. This guide will show how to use it to serve you own pages to your LAN or to the world. Please remember that opening WEB server to the world could be potential security problem.

Contents

[edit] WEB server with v24-preSP2

Under v24-preSP2 it is possible to serve static HTML pages using the existing (configuration) web server by symlinking them into the www/user directory.

[edit] Assumptions

- You have telnet and SSH enabled on your router. See Telnet/SSH_and_the_Command_Line.
- You can send files via SSH to and from your desktop (e.g with WinSCP)
- You have jffs enabled and enough free space to store your files or you have working mmc mod.
- I will assume you are installing to the jffs partition. If you are not, replace jffs with mmc or some other folder
- You have the "Enable Info Site" enabled (Administration -> Management -> WEB Access)
- You MUST name your index file index.htm (note: all lower case letters)

[edit] Procedure

Create static pages under /jffs or under some other persistent partition you have configured. Symlink your www-root to /www/user. For example:

mkdir /jffs/www
echo "test page" > /jffs/www/test.htm
ln -sf /jffs/www /www/user

Arrange to create the symbolic link on startup, then pages from jffs/www can be served up as http://router.address/user/test.htm.

[edit] Pros

- Simplest to set up.
- Saves both the complexities and the memory usage of running two HTTP servers.

[edit] Cons

- No support for cgi-bin.
- Your info site & DD-WRT management page will be available on the same http server, so choose a strong password.
- You can't get link to your site included in admin pages.

For DD-WRT V24 pre SP2 (svn 12533+) CGI support has been disabled as a fix for an exploit. See this ticket if you would like support reintroduced.

[edit] Separate httpd-server for your site

For the best result it is better to use separate httpd-server for your site. There are several possibilities: install vlighttpd e.g. with Optware, The Right Way or install Optware-ByHand and after that busybox (for simple httpd) or install lighttpd.

[edit] Assumptions

- You have telnet and SSH enabled on your router. See Telnet/SSH_and_the_Command_Line.
- You can install additional httpd-server to your router.
- You can send files via SSH to and from your desktop (e.g with WinSCP)
- You have jffs enabled and enough free space to store your files or you have some other persistent partition e.g. mmc mod or usb drive.

[edit] Procedure

1) Install additional www-server of your choice e.g. busybox httpd, lighttpd or vlighttpd from optware
2) Move default httpd away from port 80 (optional). Easiest is just to disable web administration via http, https uses port 443. Other option is to set the http_lanport nvram variable in the nvram:

nvram set http_lanport=81
nvram commit
reboot

Note: Even if you plan to use secondary IP for your own site, you need to move the built-in httpd away from the port 80, as it listens it's port on all IP:s.

3) Optional: open to the world

Caution! The following steps could make the router's management pages accessible from the WAN (for example http://Your.WAN.IP/Management.asp). The password should be required however, so make sure it is strong.

  • Open web admin Administration -> Diagnostics, press "Run"
  • Enter this line to the Commands field:
/usr/sbin/iptables -I INPUT 1 -p tcp --dport 80 -j logaccept
  • Press "Save Firewall", the router will reboot or reboot it manually.
  • How to cancel this?

Telnet to the router and type:

nvram set rc_firewall=""
nvram commit
reboot

[edit] Pros

- You have full control of your site. You can run cgi, php etc.

[edit] Cons

- Complex to set up
- Requires more memory and processing power from your router


[edit] Change SSL cert for HTTPS certificates

See forum topics Change SSL cert for HTTPS certificates and Adding user created ssl certificates.