1. Introduction

2. How and where to deploy

The Linksys BEFSR41 and its higher-end siblings are designed to be used as gateway boxes on a home Ethernet. Typically, you'll hook one up to a DSL or cable modem, which will automatically switch into bridge mode and simply pass packets between your ISP's router and the Linksys box.

If you want to use a general-purpose PC running Linux as a firewall, have fun — but these little boxes are more efficient. The nicest thing about Linksys boxes is that they run out of firmware and are too stupid to be cracked. Also, they don't generate fan noise or heat. Finally, they have no moving parts, so you can expect a good long mean time between failures.

At minimum, your Linksys box will do the following things for you:

1. Act as an Ethernet router. You can plug all your lines and hubs and hosts into it to exchange packets even when your outside link is down.

2. Act as a smart gateway. When you configure the Linksys with a public static IP address (or tell it to grab a dynamic IP address from your ISP at startup time), it will gateway between hosts on your private network and the Internet, performing all the IP masquerading and address translation required to route your traffic.

3. Firewall your connection. You can tell it to block out all but the minimum sevice channels you need. You can specify separately, for each service, to which of your internal machines the traffic should be routed.

Some of the higher-end versions will do extras like virtual private networking and wireless.

I give my Linksys box the standard private-network gateway address, 192.168.1.1. I then give all my boxes 192.168.1.x addresses and tell them the Linksys is their gateway. Everything works.

3. Lost the manual?

If you've lost the manual, or acquired a secondhand unit that doesn't have one with it, never fear. Under the Help tab there are links to the PDF and to the Linksys corporate website.

Unfortunately, you're in trouble if you have to call Linksys tech support. On the one occasion that I called them, the first tech I raised couldn't even speak English, and the second was barely competent at it. Both were complete and utter idiots whose response to any nontrivial question was to put me on infinite hold while they went off to query someone else — and then garbled the answer.

4. Configuration hints

For security and performance, do these things:

First, make sure AOL Parental Controls (under Security) is turned off (off is the default); otherwise the Linksys won't pass packets for your Unix box at all.

For security, make sure the DMZ host feature is disabled (under Advanced->DMZ Host). Port forward specific services instead, and as few of those as you can get away with. A good minimum set is 22 (ssh), and 80 (http). If you want to receive mail add 25. If you need to serve DNS queries, add 53.

Disable Universal Plug and Play (under Password). There is a radio button for this under the "Password" tab. UPnP is a notorious security hole in Windows, and up to at least firmware version 1.44 there was a lot of Web scuttlebutt that the Linksys implementation is flaky. While this won't affect operating systems written by competent people, there is no point in having traffic from a bunch of script-kiddie probes even reach your network.

If you want to run a server, you also need to make sure stateful packet inspection is off — this feature restricts incoming packets to those associated with an outbound connection and is intended for heightened security on client-only systems. On the Filters page, make sure SPI is off. If you don't see a radiobutton for SPI, relax — the feature isn't present in all versions of the firmware, and in fact was removed in 1.43 for stability reasons.

To speed up sending of outbound mail, go to Advanced->Forwarding and click the Port Triggering button. Specify 25,25 a the trigger port range and 113,113 as its incoming-port range. What this will do is punch a temporary hole through the firewall during each outbound SMTP session that will allow the receiving system to get to port 113, which is identd service. This will enable the receiving SMTP to do an identd check on your connection rather than timing out.

Some bug was introduced in firmware revision 1.42.3 that broke traceroute. This was fixed in 1.42.6; just upgrade to the latest version.

5. Software

There is a Unix utility called linksysmon that talks with these boxes via SNMP. There is a Linksysmon project site.

Linksysmon is a tool for monitoring Linksys BEFSR41 and BEFSR11 firewalls under Linux and other Unix-like operating systems. It accepts log messages from the Linksys, and logs the messages to /var/log/linksys.log. It handles the standard activity logs, as well as the "secret" extended logging, and can handle logs from multiple firewalls. When using extended logging, it can detect external IP address changes (if you are using either DHCP or PPPOE) and can call an external program to process the change.

Link-n-Log is a similar tool that includes a GUI and logs to an SQL database. Details at the Link-n-Log project page.

6. Modding and reverse-engineering

There is a page that tells you how to casemod the Linksys wireless router (they just call it the WAP11 but it appears to be one of the BEFW11S4 variants.

The Linksys has Linux inside. Intrepid hacker Erik Andersen tells us:

#!/bin/sh
# This is what I did to open up the Linksys rom...

wget ftp://ftp.linksys.com/pub/network/WRT54G_1.02.1_US_code.bin

# I noticed a GZIP signature for a file name "piggy" at offset
# 60 bytes from the start, suggesting we have a compressed Linux
# kernel
dd if=WRT54G_1.02.1_US_code.bin bs=60 skip=1 | zcat > kernel

# Noticed there was a cramfs magic signature (bytes 45 3D CD 28
followed shortly by "Compressed ROMFS") at offset 786464
dd if=WRT54G_1.02.1_US_code.bin of=cramfs.image bs=786464 skip=1
file cramfs.image

sudo mount -o loop,ro -t cramfs ./cramfs.image /mnt
ls -la /mnt/bin
file /mnt/bin/busybox
strings /mnt/bin/busybox | grep BusyBox
# Use uClibc's ldd to get useful answers for non-x86 binaries
/usr/i386-linux-uclibc/bin/i386-uclibc-ldd /mnt/bin/busybox

Linksys now supplies source code on its site (I don't know what's in the various archives, though). Several other similar products, including the Buffalo Technology box, seem to use the same firmware.

There's an interesting site on hacking the Wrt54g by Seattle wireless.net.

7. Troubleshooting tips

8. Upgrading the firmware

Before you upgrade, here is a tip the documentation does not mention: disconnect all the patch cables except the one from the machine you are using to upgrade the box. Handling a lot of other network traffic while the firmware load is gong on can corrupt the firmware.

There are three ways you can upgrade your Linksys firmware.

One is to click the "Upgrade firmware" link on the help page. Unfortunately, this required Java in the browser under the 1.38 firmware. That has changed under 1.44. It looks as though you can now fill in the field that says " Please select a file to upgrade:", click the Upgrade button, and have the right thing happen.

Another way is to use one of Linkys's firmware-upgrade floppy images from their website. This requires that you boot Windows or use WINE.

The third way is to use tftp. This is how I did it. There is a tftp client included with Red Hat Linux. To upgrade your firmware this way, do the following steps:

You're done.

9. Related Resources

There is a site called HansenOnline.net that seems to be mainly devoted to tracking and critiquing the Linksys firmware releases. Alas, the monitoring software it offers is for Windows.

There is a Linksys tips and tricks FAQ; it's mostly Windows stuff, but a few of the war stories may be useful.

There is a good article on configuring the BEFSR41, and its limitations, at Linksys EtherFast Cable/DSL Router, Model BEFSR41. It dates from August of 2000.