MOLIETS WiFi FON_BASTIDE

[EN] Linux tools for Fonera+ - unlock, unbrick

Lama Bleu — Thu, 14 Aug 2008 11:55:00 +0200

New tools are now available for Fonera+

These tools are adapted from AP51-Easyflash from Freifunk.

A big thanks to Sven-Ola for giving us access to the sources, that allow us to adapt for Fonera+.
Thanks to skynetbbs for writing the doc.

Just follow the instructions on this page : http://www.fonboard.nl/wiki/HowTo_Foneraplus_unlocking2

You just need libcap, change the public-FON SSID to FON_UNLOCK, shut down your fonera+, launch the tool (use the good ethernet interface name as parameter i.e. eth0 or eth1) , power-on your Fonera+, and let's go.

No reflashing for unlock, it's quick and safe.

Others commands are available for FON public SSID:
FON_REINIT : will erase JFFS and restore your Fonera+ with default factory settings
FON_DIAG : will install diagnostic page on Advanced menu FON_REGISTER : will change the icon on status page after a reinit from "unregistered" to "Your fonera is successfully registered"

You can also restore a full FON-firmware using 2201-full-restore app all-in-one file (unlock is not included).

Restore firmware:

   sudo ./2201-full-restore eth1
image(size 0x00230004) + loader-image2(0x00150000) + 
config sums up to 0x003a0000 bytes

Peer MAC: 00:18:84:a0:xx:xx
Peer IP : 192.168.1.1
Your MAC: 00:ba:be:ca:ff:ee
Your IP : 192.168.1.0
Setting IP address...
Loading main 'image' partition...
Sending 'image', 4608 blocks...
Initializing partitions ...
Flashing 'image' partition ...
Loading loader + failsafe partitions...
Sending loader + failsafe, 2688 blocks...
Flashing failsafe 'image2'...
Flashing loader...
Setting boot_script_data...
Done. Restarting device...

Bienvenue à Moliets, place de la Bastide

Lama Bleu — Sun, 10 Aug 2008 17:15:00 +0000

Moliets - place de la Bastide - été/summer 2008

L'accès WiFi gratuit FON est accessible toute l'année place de la Bastide ( voir plus bas )

Un nouveau hotspot worldspot a été mis en place en 2008: propose pour le moment 90 mins d'accès hebdo gratuit pour tous, et accès 25h pour 14 jours, 60h/14 jours.

Restaurants/Bars :

pizzeria NoFish Today ( tél 05 58 49 18 26 )
Côté Kosy - bar - steack-house
grill TEX-MEX - Open cantina
le fameux Open Bar !
sandwiches Chez Neu-Neuf (ouvert en juillet/août)
restau-bar Le Singe en hiver
Discothèque Le Triangle d'Or (fermé l'hiver)
Villa-Coola

Pour se remettre de ses émotions, la Pharmacie de Moliets et pour travailler un peu le centre de séminaires

Wifi on Bastide

Utilisation du hotspot WiFi FON_BASTIDE :

- Accès libre 15 minutes par jour et pour tous après visualisation d'une publicité FON-Google ( vous devez vous enregistrer à la première connexion).

- Accès gratuit toute l'année H24 pour les membres de la communauté FON , Boingo et N@ufTelecom

- Accès libre au site de la ville de Moliets et Maa : www.moliets.com , à google.com, utilisateurs Skype , BT , bienvenue !

- Non-membres : accès complet par pass ( 1 pass = période de 24H) - paiement PayPal

1-day pass : 3€

5 x 1-day pass : 10 €

ou par SMS -1 hr/access

Utilisation du hotspot WORLDSPOT_BASTIDE :

- Accès gratuit 90min hebdo pour tous après enregistrement (nécessite un email valide)
- 25 heures à utiliser dans les 14 jours : 4,50€
- 60 heures pour 14 jours : 7,50€

Me contacter sur l'adresse de contact pour des accès spécifiques (saisonniers, séminaires)

Pas d'accès 24/24 sur WORLDSPOT_BASTIDE pour éviter les abus et vous permettre de profiter aussi du soleil, de la plage et des vagues.

Bonne vacances à tous !

FONERAM

Lama Bleu — Wed, 16 Apr 2008 14:22:00 +0200

OK sure, I must say I'm totally addict to RAM-boot and RAM-tools...

I developed my first tools in 1995 for my company: the goal was to backup from MS-DOS hundreds of computers (286 to 486 running LANMan, NFS, token-ring or Bull networks) to the new NT servers with a quick, homogen and safe method.
We used "MS-DOS network client" running on ramdisk from write-locked floppy disks with submenu to select interface cards to load for network.

Few months later this floppy disk RAM-tool was adapted to massif cloning of computers in a high school self-service classrooms, without human intervention.

Some years later we can find on internet nice tools based on ram-boot like bootdisk.com, portableapps, DamnSmall, BartPE, Buldows,and the famous hiren's bootCD.
More and more sophisticated, and still really fan of these products !

FONERAM is just the next try to develop a tool for Fonera(plus).
This version is a major improvement of ram-foneraplus.elf boot-file published here few months ago

Quid Foneram ?

Not a firmware, not an addon, just a tool

Directly boot OpenWRT kamikaze 7.06 on your Fonera+ from RAM in less than one minute, without reflashing.

LAN and WLAN networks are bridged in a single subnet (default 192.168.1.1) , and your Fonera+ will act as a classic router if WAN ethernet port is connected to internet. You can install packages directly from internet, tests your scripts without risk.
No reflashing, so at next reboot your Fonera+ will start as always: like a Fonera

CIFS support to backup raw format partitions, copy files to/from remote computer

Run, test and play with Webif² from X-Wrt with a little script "instwebif"

Access to squashfs and JFFS FON partitions ( /rom and /jffs)

New approach for unlocking a Fonera+: no firmware-version dependant, no reflashing, and very similar to HTML injection but here we speak about JFFS injection

And if you become addict to Foneram , customize yourself your conf by running a script at boot (stored on JFFS partition)

Why Foneram ?

Because it's just possible. Thanks to OpenWRT to implement ramdisk function in builder.

Because I need a tool to run my fonera and access "offline" the systemfile (ie make safe backups).
Because I want an open-system, but not to crash or replace it, just to understand "how it works", add some scripts.
Next model Fonera2.0 (based on same board) will be open, happy to learn FON is now ready to open their little boxes.

Read this first !

The goal of Foneram is NOT to reflash your Fonera+. Don't try to reflash with foneram ! No complaints !
If you plan to install OpenWRT then don't buy a fonera+, considere buying another router model for the same price.
Consider this a just a tool, no more, and enjoy running OpenWRT for few hours without reflashing.
There is no reason to brick your foneraplus running foneram, just be prudent and try to understand what you do.

Warnings !

Not tested on systems running JFFS filesystem-only.

use on classic fonera

Foneram will run on classic fonera (models 2100/2200) , but was not developed for. First, no RedBoot enabled, no way to enter Foneram.... This is not a problem on 2200 model .
Not working on classic fonera: ethernet port ! Not a problem of config, but ethernet driver is not the same.
Mounting FON filesystem (/rom /jffs) is working with scripts described here, but some existing files to edit may appear corrupted.
JFFS2_BBC compression is implemented on classic fonera only and not in FONERAM. Don't edit these files in case of trouble, but you can add, delete, or rename files without risk.
To unlock a 2200, just mount your JFFS, and imagine the nice one-line script to invent

Running Foneram with alternative firmware flashed.

No warranty accessing the JFFS. Partition "config" is taken from the last available block of JFFS while running FON firmware.
Size of JFFS displayed may appear shorten by 64kB ( 1 block) running foneram.

Sources

95% of tasks performed by foneram are not new ! Main source to compile is kamikaze 7.06 downloaded from svn.openwrt.org.
Ethernet driver for ar2313 is coming from FON foneraplus source. Check this nice page on LeFinnois website for more infos
Scripts for blinking LEDS and the Redboot-partition-scan patch (to display "config" partition) were also extracted from FON sources.
Lot of infos gathered through meraki and OpenWRT forums.

Thanks ...

First a big thanks to OpenWRT team for this nice open-source product!
Also to foneros, FON and Martin V. to make this hardware so popular..
And special thanks to all guys testing foneram since last weeks, especially skynetbbs and Davide Lenzarini who helped me for the last corrections of this doc..

How to run

Configure your computer: IP address 192.168.1.254

Download and extract file foneram-plus.elf from here (update 12-04-2008) to your TFTP directory server.

Access RedBoot console (default is 192.168.1.1 port 9000)

                RedBoot> load foneram-plus.elf
                Using default protocol (TFTP)
                Entry point 0x80271000, address range 0x80041000-0x80xxxxxx
                RedBoot> go

( serial access reports system boot)

Wait 1 minute leds POWER and WLAN are alternatively blinking orange.

Wifi network is WEP encrypted. WEP-key is the serial number of your Fonera+
Root password is the serial number of your Fonera+

Then try to connect Telnet/SSH to 192.168.1.1 on LAN port or WLAN


BusyBox v1.4.2 (2008-02-06 10:52:52 CET) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

  ______
 /\  ___\
 \ \ \__/  __     ___      __   _ __    __      ______
  \ \  _\/ __`\ /' _ `\  /'__`\/\`'__\/'__`\  /'__  __`\
   \ \ \/\ \_\ \/\ \/\ \/\  __/\ \ \//\ \_\.\_\ \ \ \ \ \
    \ \_\ \____/\ \_\ \_\ \____\\ \_\\ \__/.\_\\ \ \ \ \ \
     \/_/\/___/  \/_/\/_/\/____/ \/_/ \/__/\/_/ \_\ \_\ \_\

           ---------------------------------------------
             Based on OpenWrt - http://www.openwrt.org
                 Kamikaze 7.06 - kernel 2.6.19.2
               Ram-version for la Fonera+ - 01/2008
        ---------------------------------------------------



root@LamaBleu:/#

If WAN port is connected to internet through DHCP router, check connectivity with command "date" for example.
If you can't connect to internet, try to check if default route is OK.

FONERAM tour...

RedBoot partitions vs MTD spiflash

Example shown here is with a fonera+ running official FON firmware
Partitions list from RedBoot console:

        Name              FLASH addr  Mem addr    Length      Entry point
        RedBoot           0xA8000000  0xA8000000  0x00030000  0x00000000
        loader            0xA8030000  0x80100000  0x00010000  0x80100000
        image             0xA8040000  0x80040400  0x00230004  0x80040400 
        image2            0xA8660000  0xA8660000  0x00140000  0x80040400
        FIS directory     0xA87E0000  0xA87E0000  0x0000F000  0x00000000
        RedBoot config    0xA87EF000  0xA87EF000  0x00001000  0x00000000

and from shell:

        root@LamaBleu:~# cat /proc/mtd
        dev:    size   erasesize  name
        mtd0: 00030000 00010000 "RedBoot"
        mtd1: 00010000 00010000 "loader"
        mtd2: 00620000 00010000 "image"
        mtd3: 0056afc0 00010000 "rootfs"
        mtd4: 003f0000 00010000 "rootfs_data"
        mtd5: 00010000 00010000 "config"
        mtd6: 00140000 00010000 "image2"
        mtd7: 0000f000 00010000 "FIS directory"
        mtd8: 00001000 00010000 "RedBoot config"
        mtd9: 00010000 00010000 "board_config"

Ohhh ! Not the same result

At boot, spiflash utility will try to find (create dynamic) JFFS partition located at first available block (at the end of squashfs part for "image" partition) on flash.
JFFS "rootfs_data" and "config" partitions are ignored by RedBoot as in classic fonera.

A 64k-size (1 block) partition "config" is also created in last available block on flash memory.

This little partition is used by FON to store your config in a .gz file while upgrading firmware.

MTD image: mtd2 is 12bytes header + kernel + squashfs + rootfs_data (JFFS) + config
MTD rootfs: mtd3 is squashfs + rootfs_data
MTD rootfs_data: mtd4 is rootfs_data (JFFS)

Note spiflash "image" partition, and RedBoot "image" partition (FON firmware) are not equivalent. Size is really different...
RedBoot image partition is a (12-byte header + kernel + squashfs) only.

Access FON datas :

        root@LamaBleu:/# mtd-mount
        *** mount /dev/mtdblock3 on /rom (read-only)
        *** mount /dev/mtdblock4 on /jffs

Then take a look at /jffs and /rom Welcome to FON filesystem

Warning on classic Fonera: use of this script will work also but partition numbers are not the same. Use at own risk, no warranty

Umount :

        root@LamaBleu:/# mtd-umount
        *** umount /jffs
        *** umount /rom
        root@LamaBleu:/#

Use at own risk, if you try to manually mount partitions of wrong type you will corrupt "image" partition !
Only use the script OK ??

Install packages from internet

First run "ipkg update" command

  root@LamaBleu:/sbin# ipkg update
  Downloading http://downloads.openwrt.org/kamikaze/7.06/atheros-2.6/packages/Pa
  ckages
  Updated list of available packages in /usr/lib/ipkg/lists/OpenWrt
  Downloading http://downloads.x-wrt.org/xwrt/kamikaze/7.06/atheros-2.6/packages/
  Packages
  Updated list of available packages in /usr/lib/ipkg/lists/X-Wrt
  Done.

Install a package (will be installed on ram only, FON system is left untouched, so this is valid until next reboot only)

        root@LamaBleu:~# ipkgsh install tcpdump

  Downloading http://downloads.openwrt.org/kamikaze/7.06/atheros-2.6/pac
  kages/./libpcap_0.9.4-1_mips.ipk ...
  Connecting to downloads.openwrt.org [195.56.146.238:80]
  libpcap_0.9.4-1_mips 100% |*****************************| 68956    --:--:-- ETA
  Done.
  Unpacking libpcap...Done.
  Configuring libpcap...Done.

  Downloading http://downloads.openwrt.org/kamikaze/7.06/atheros-2.6/pack
  ages/./tcpdump_3.9.4-1_mips.ipk ...
  Connecting to downloads.openwrt.org [195.56.146.238:80]
  tcpdump_3.9.4-1_mips 100% |*****************************|   293 KB 00:00:00 ETA
  Done.
  Unpacking tcpdump...Done.
  Configuring tcpdump...Done.

Unlock your FON Fonera+

        root@LamaBleu:/# 2201-unlock
        mount jffs on /jffs

        create directories on jffs...

        serial port access ...

        copying dropbear files (wait 2 mins)...

        dropbear auto-launch ...

        *** at next reboot, dropbear needs to generate keys,
                wait few minutes before connecting via dropbear ***
        OK, done !
        root@LamaBleu:/#

This script is running on all known firmware versions prior to 28 march 2008, but on foneraplus only
By this method we don't need to reflash original firmware or erase existing JFFS. All needed files are injected to JFFS.
At next FON reboot, wait few minutes before trying to connect to dropbear.
Your previous parameters are still intacts.

Restore default factory settings.

Exactly same method as classic fonera. All personal parameters will be erased and the foneraplus re-locked
From FONERAM, mount the jffs, then erase the contents.
Reboot and reconfigure your "new" Foneraplus.

          root@LamaBleu:/# mtd-mount
          *** mount /dev/mtdblock3 on /rom (read-only)
          *** mount /dev/mtdblock4 on /jffs
          root@LamaBleu:/# rm -Rf /jffs/*

CIFS remote shares, backup/restore fonera datas

CIFS: access to a remote computer

Take a look at /sbin/cifs simple script and adapt !

        mount -t cifs //$1/foneraplus /mnt -o user=foneraplus,passwd=foneraplus
        losetup /dev/loop0 /mnt/swapfonera
        swapon /dev/loop0

To use the script, create on your remote computer a new account user: foneraplus with same password.
Create and make share named "foneraplus" on your comuter.
Then run "cifs 192.168.1.254" to mount remote share "foneraplus" on /mnt
Adapt sharename and account properties

If you plan to use a swapfile to extend your memory, create your swapfile ( 8MB here):

- mount the CIFS share
- run commands:

          dd if=/dev/zero bs=1024 count=8192 of=/mnt/swapfonera
          losetup /dev/loop0 /mnt/swapfonera
          mkswap /dev/loop0
          swapon /dev/loop0

Backup/restore datas

Easy, and quick, I use CIFS share to preserve memory usage in /tmp for big files. You can also use SCP transfers to-from /tmp if you don't plan to use CIFS network filesystem.

Backup

mount a CIFS ressource in /mnt as described in previous section

Raw backup for your JFFS partition as raw format (partition dump):

      dd if=/dev/mtdblock4 of=/mnt/rootfs_data.bin   
                (this will create a 0x003f0000 file size : only your JFFS data)
      dd if=/dev/mtdblock2 of=/mnt/image.bin  
                (this will create a 0x00620000 file size)

Backup your JFFS partition as tgz format:

        root@LamaBleu:~# tar -czv -f /mnt/jffs_fon.tgz /jffs/
        tar: removing leading '/' from member names
        jffs/
        jffs/bin/
        jffs/bin/nul
        jffs/bin/mail
        jffs/bin/mount_nas
        jffs/bin/thinclient
        .........
        
        root@LamaBleu:~# ls -l /mnt/*.tgz
        -rw-r--r--    1 root     root      1395090 Mar 24 08:47 /mnt/jffs_fon.tgz

Remark : backuping only /etc/config directory is a quick and good solution to save your FON parameters.

Restore from previous backup

Use at own risk, be sure to understand first what you will do running flashing commands.
Reading the post "How to unbrick/revive a Foneraplus" may help you to have a better look of reflashing.

Before reflashing partitions, take care to check file size for example, or hex-comparing binaries (present on flash, and to reflash)
Examples here are shown using CIFS to restore from a NAS or remote computer.

RAW format : You can reflash from RedBoot these partitions previously saved as raw format

- image2, loader partitions
in brief: "load -r -b 0x80100000 image2.bin" then "fis create image2", same for loader partition
note that there is no reason to reflash these partitions unless your fonera is bricked

- reflash FON firmware + JFFS:

These commands are very similar to those described for unlocking/unbricking Fonera+ on wiki.fonboard.nl

From RedBoot:

          load -r -b 0x80100000 image.bin
          fis write -b 0x80100000 -f 0xa8040000 -l 0x00610000

last block (offset 0x00610000 - size 64kb) is "config" partition, and not used here to restore

Restoring raw dump from foneram shell:

This is just "reflashing from shell, not from RedBoot" Be sure /jffs is not mounted
Mount CIFS share to access files raw-backup files

               mtd write /mnt/image.bin image

Flashing time is long, be patient !

reflash JFFS only from a raw backup:

Reflashing JFFS may corrupt your FON configuration ! Be sure to have a good reason to do it, at own risk !
This will erase all datas on JFFS and restore a previous backup. Actual settings will be lost make a bakup first!
If reflashing from shell be sure JFFS (/dev/mtdblock4) is not mounted on filesystem.
Commands below are valid for firmware 1.1.x.x (where data size for firmware is 22* 64k-blocks)and subject to change ( actual file size for mtd4: 003f0000)
For JFFS restore prefer to restore from a .tgz file (previous backup) or full reflash ( finrmware + JFFS)

From Redboot

   load -r -b 0x80100000 rootfs_data.bin
   fis write -b 0x80320000 -f 0xa8260000 -l 0x003f0000

From shell

         mtd write /mnt/rootfs_data.bin image

- restore JFFS only from tgz backup:
Prefer to use this method, if you're only interested in restoring your JFFS personal datas (you don't need to reflash FON image partition at each time )
Using CIFS (remote share mounted on /mnt)
First erase your JFFS partition (previous data are erased), then restore datas

         rm -rf /jffs/
         tar -xzv -f /mnt/jffs_fon.tgz  -C /

If you don't want to use CIFS share access, SCP-transfer your .tgz backup on /tmp and launch the restore command.

Customize your FONERAM

Auto-launch of customizable script at foneram-boot

At boot, FONERAM will try to launch a script "script.sh" in /jffs/foneram

How to save the script.sh the first time :

use script "2201_mount" using foneram to mount (FON-)JFFS : content is available in /jffs
or while running FON on unlocked foneraplus JFFS is also avalaible in /jffs
Then create a directory /jffs/foneram
Create a new script "script.sh" in /jffs/foneram directory, and insert commands for your own customization. Make it executable (chmod +x script.sh)

Example: insert this lines to change subnet for bridge (LAN port and WiFi) from 192.168.1.0 to 192.168.22.0 at next foneram-boot

        uci set network.lan.ipaddr=192.168.22.1
        uci commit

Example: make foneram WLAN-client of another master-AP for internet access, and setup ethernet interfaces LAN and WAN as LAN port.

        uci set network.lan.ifname='eth0.0 eth0.1'
        uci set network.wan.ifname=ath0
        uci set wireless.wifi0.channel=0
        uci set wireless.cfg2.network=wan
        uci set wireless.cfg2.mode=sta
        uci set wireless.cfg2.ssid=master-ssid
        uci set wireless.cfg2.encryption=wep
        uci set wireless.cfg2.key=1
        uci set wireless.cfg2.key1=01234567890123456789012345
        uci commit
        killall udhcpc
        /etc/init.d/network reload

Semi-automatic startup for FONERAM

Lazy and tired accessing RedBoot console ? Want to launch Foneram without intervention ?
OK you can ask your fonera+ to download the foneram-plus.elf file at boot through TFTP directly from your computer.

Just launch your TFTP server with foneram-plus.elf file stored in the root TFTP server directory.
If you're fonera+ can't locate the TFTP server on network (not launched), then the FON partition will be loaded as usual.

So modify your boot script for RedBoot, at own risk, be prudent while re-typing the init script. This is inspired from Meraki boot.
If you want to boot FON partition (TFTP server not launched), the timeout is about 1 minute, maybe more, be patient.

        RedBoot> fconfig boot_script_data
        boot_script_data:
        .. fis load loader
        .. go 0x80100000
        Enter script, terminate with empty line
        >> load foneram-plus.elf
        >> go
        >> fis load loader
        >> go 0x80100000
        >>
        Update RedBoot non-volatile configuration - continue (y/n)? y
        ... Erase from 0xa87e0000-0xa87f0000: .
        ... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
        RedBoot>

more ClustrMaps

[EN] How to unbrick - revive your Foneraplus

Lama Bleu — Wed, 19 Dec 2007 15:16:00 +0100

Here you can find a little procedure to reflash all FON-partitions on your Fonera+.

I received lot of requests, following bad flashing, or unsuccessfull tries to run Fonera+ with alternative firmwares (as DD-WRT, OpenWRT).

Remember, never try to reflash directly native RedBoot partitions ( RedBoot, FIS Directory, RedBoot config), there is a risk to brick your Fonera+ .

If you do so : maybe only serial access may help you after this !

If you want to reflash your Fonera+ (with shell access) to have a second chance to join FON-folk follow these steps !

Congratulations to: Raymond Hui from Hong-Kong, Reynald F (France), David M (Spain), Negece (Italy), Paule (Germany), Mystique (France), and others for unbricking their Fonera+ with this procedure !

Comments and feedback welcome !

Pre-requisite

Fonera+ with RedBoot access and IP address for computer set to 192.168.1.254
Download loader and image2 (failsafe boot) partitions from here
Download main FON-firmware partition image here (FON firmware 1.1.1r1 and JFFS partition for shell access)
Extract downloaded files in your TFTP home directory server.

1. Check partitions on RedBoot

First perform a "fis list" command to check partitions structure.
Check name and adresses for loader, image, and image2 partitions
Here is a copy of "fis list" of default factory partitions on a new Fonera+

Name              FLASH addr  Mem addr    Length      Entry point
RedBoot           0xA8000000  0xA8000000  0x00030000  0x00000000
loader            0xA8030000  0x80100000  0x00010000  0x80100000
image             0xA8040000  0x80040400  0x00230004  0x80040400 
image2            0xA8660000  0xA8660000  0x00140000  0x80040400
FIS directory     0xA87E0000  0xA87E0000  0x0000F000  0x00000000
RedBoot config    0xA87EF000  0xA87EF000  0x00001000  0x00000000

2. Check and modify RedBoot init script

Perform a "fconfig -l -n" to display init informations.

Here is a default FON RedBoot init script:

RedBoot> fconfig -l -n
boot_script: true
boot_script_data:
.. fis load loader
.. go 0x80100000

boot_script_timeout: 2
bootp: false
bootp_my_gateway_ip: 0.0.0.0
bootp_my_ip: 192.168.1.1
bootp_my_ip_mask: 255.255.255.0 
bootp_server_ip: 192.168.1.254
console_baud_rate: 9600
gdb_port: 9000
info_console_force: false
net_debug: false
RedBoot>

If partition list in step1 and fconfig result in this step2 looks similar to your, try to jump directly to step 5.

If you reflash your Fonera+ with alternative firmware, you probably need to modify boot script.

Use the command "fconfig boot_script_data" to re-type the init script, end with a blank line (example with a previous DD-WRT init script):

RedBoot> fconfig boot_script_data
boot_script_data: 
.. fis load -l vmlinux.bin.l7
.. exec
Enter script, terminate with empty line
>> fis load loader
>> go 0x80100000
>>
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>

Take a minute to change delay for RedBoot access at boot, default is 2 seconds, modify this value to 5 ou 10 seconds.

To do this use the command : fconfig boot_script_timeout

Double-check a last time your config ( fconfig -l -n ) before jumping to next step !

3. Create FON partitions

First perform a "fis init" to erase all non-RedBoot partitions, then create your three FON-partitions:
RedBoot prompt truncated here ...

RB> fis init
About to initialize [format] FLASH image system - continue (y/n)? y
*** Initialize FLASH Image System 
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .

RB> fis create -f 0xa8030000 -l 0x00010000 -e 0x80100000 -r 0x80100000 -n loader
... Erase from 0xa87e0000-0xa87f0000: . 
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .

RB> fis create -f 0xa8660000 -l 0x00140000 -e 0x80040400 -n image2
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: . 

RB> fis create -f 0xa8040000 -l 0x00230004 -e 0x80040400 -r 0x80040400 -n image
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RB>

4. Flash "loader" and "image2" partitions

Load each file by TFTP to your Fonera+, and directly write file loaded to the flash ( RedBoot remembers last load command, we don't need to send memory addresses) :

Loader

load -r -b 0x80100000 loader.bin
fis create loader

image2

load -r -b 0x80100000 image2.bin 
fis create image2

For image2 partition, flashing time is about 10 minutes, be patient !

Optional: at this stage, failsafe mode for your Fonera+ should be working if you try to reboot your Fonera+ (Fonera+ IP address for failsafe mode is 192.168.1.1)

5. Flash main partition "image"

This is a 2-in-one command flashing, we are going to flash FON "image" partition ( kernel + squashfs) and JFFS partition at the same time.

So we use "fis write" command instead of classic "fis create" command. Flashing time is 15 minutes.

load -r -b 0x80100000 image.bin 
fis write -b 0x80100000 -f 0xa8040000 -l 0x00610000

6. Reboot and customize

That's it !
Now, you can reboot : RedBoot command is "reset", or just unplug your AC adapter, and power-on your La Fonera+

Cross fingers ...

For customization, check our multilingual guide at http://wiki.fonboard.nl

Good luck !

[EN] Fonera+ liberada news

Lama Bleu — Sun, 02 Dec 2007 15:52:00 +0100

Some news for unlocked Fonera+

One month after unlocking, here are some news, reported problems and tips for the unlocked Fonera+

* QoS, transfer rates.

Lot of foneros reported problems on transfer speeds on all ports.
This problems occurs on unlocked or not unlocked fonera+

First apply the good settings for QoS on LAN ports (uci parameters qos.wan.* )

Default is 2048DL/128UL. Take a look at he wiki .

If your problem is not solved apply Anton's mod, this post !

* Bug in dropbear 0.49

Dropbear window in PuTTY does'nt close while exiting shell session.

This problem is reported here in OpenWRT bugtracker : https://dev.openwrt.org/ticket/1651 (thanks to Giorgio for the search)

Updated ipk package for this same version of dropbear can be found here .
Reinstall package or directly replace the executable file:

cd /tmp
wget http://www.moliets-bastide.info/public/foneraplus/dropbear
chmod 755 /tmp/dropbear

Launch manually /tmp/dropbear , verify that there is no error message...

No error allowed here , since the there is a risk to loose SSH access !!

If OK, finally move and replace dropbear to the right place:

mv /tmp/dropbear /usr/sin/dropbear
and please reboot !!

* klogd and CPU load

Try the "top" command, and see your klogd process running at 90% CPU.

We have no known issue for the moment

* File editors.

Since vi is not implemented in the original version of Busybox, we DON'T really RECOMMEND upgrading Busybox to a more recent versions, just to get vi editor..
Keep in mind to try running (when possible) same versions as installed by FON, to stay 100% FON-compliant.

And upgrading Busybox will use an important memory space on your flash ( more than 10% of total space).

Try this

Install first package libncurses

And then choose the editor to install: "nano" editor, or "joe"

As always the good repository for download is : http://downloads.openwrt.org/kamikaze/7.06/atheros-2.6/packages/

except for kmod-*-atheros-1_mipks.ipk which you can't install on fonera+

* JFFS easy backup

Please once you've customized your Fonera+, take a minute to make a simple backup of your mods.
This is just a simple way to perform a backup without extra tool or mod.

Perhaps you will need this backup later, after a crash or firmware upgrade sent by FON.

cd /jffs
tar  -czv -f /tmp/save_jffs.tgz ./

Operation may take a minute or more depending of busy space on your JFFS.

Then simply copy the file to your computer by SCP.
Last step: remove the file from /tmp or reboot.

Fonera+ libérée

Lama Bleu — Mon, 29 Oct 2007 04:00:00 +0100

Here we are, we have a Free Fonera+ !

Now you can log-on to your Fonera+, discover and play with it. -- remote SSH and serial access

Since there is no firmware modification we hope Fon team will appreciate our work...
We hope this classic hack (same result as classic Fonera) will permit to development teams to write nice add-ons..

After hard beta testing period , howtos writing , translations , making scripts, tweakings and
mass email exchange between the team , finally the Fonera Plus hack has been released.

Multilingual Wiki is now avalaible for Linux, Windows, and Mac, please follow this link or this other link to get more information !

Fonblog.eu will be in the forthcoming days a hub for everyone who would collaborate and join the team to tweak and improve.
Contact me here for french or spanish support. (buscamos un fonero español para traducir el Wiki en castellano)

Many many thanks to all sympatics members of this nice project, giving lot of their free-time to translate, testing and so on.

First of all Anton, FON-blogger, our nice project manager, and coordinator of this european team.

Special thanks to Giorgio "Linux-man", Steven Leeman and Arjan for scripts and web support, all FreeWLAN team members and all others...
I just want to thank all the team , their families, friends and collegues for supporting us !

And .. thanks to Martin V., Iurgi, FON, OpenWRT, and Stefans for his nice documented work on kolofonium

That's all folks . We wish you a merry Fonera plus unlocking.

[EN] Running OpenWRT-kamikaze with ramdisk for LaFonera+ FON2201

Lama Bleu — Tue, 16 Oct 2007 12:55:00 +0200

IMPORTANT !

Update, new link http://www.moliets-bastide.info/post/FONERAM

Update 16-april-2008 : this post is now out-to-date and soon removed, replaced by FONERAM

~~Please update your file ram-foneraplus.elf !~~

Update 26-march-2008 : I'am on the way to release in next few days the new version of fully fontional RAM-boot for Fonera+ (kernel 2.6.19.2)
Lot of improvements to come. As always, no reflashing needed
Special thanks to japanese and korean readers (60% of downloads), especially those reporting this actual version is also running on classic fonera (ethernet is OK)...

Update 08-nov-2007 : for shell access to LaFonera+ running FON firmware click here !

Update 16-oct-2007 : new version of ramdisk boot now available.

Changes : WiFi will now launch at boot. Serial port is no longer needed to boot and access your Fonera+ via WiFi. DHCP now working for WiFi clients.
Serial port console still working
Little debugs on scripts, index.html test page added for HTTP server.

Unfortunately the ethernet interface is still not working. All seems OK ( try "ifconfig eth0 up"), but no RX packets on eth interfaces . Help from "experts" is welcome !!

This post was first written in french with more comments here.

This is just my ~~first~~ second try to run OpenWRT-kamikaze for LaFonera+ ( FON2201 ) on ramdisk without reflashing it.

My first goal is to make a little tool to get full access to my fonera with a risk free method, and connect storage disk on network, make backups, etc..

Hope this can give you some ideas to improve it ! Feedbacks are welcome !

You need:

- A computer with TFTP server running on ethernet port with static IP 192.168.1.254.

- extract and load this file and store it in your TFTP server directory.

- the remote computer is configured in my example to static IP 192.168.1.213 on WiFi interface, with a Window$ share named "fonera".

Step by step :

- Access to Redboot via ethernet on 192.168.1.1 . I assume you've previously downloaded ram-foneraplus.elf in your TFTP-server directory.

- Load ramdisk image and then launch it. WiFi interface will auto-start. You can access your fonera+ through WiFi, SSH and HTTP servers enabled on 192.168.1.1

Let's go.

- Power-up the LaFonera+ and connect to redboot via ethernet during the first two seconds after boot-up. Try, and re-try if necessary.
( telnet on 192.168.1.1 port 9000) If impossible to connect to Redboot, please read this page, with scripts to help you !

- You get the redboot prompt and type " load ram-foneraplus.elf". Once the file is downloaded to the RAM just type " go " and, look your fonera+ booting...

Wait 30 seconds .. If you have serial port, you can see kernel booting, log messages .. If not, just wait and look the new WiFi SSID, will appear ... To connect from remote computer to WLAN, DHCP will give your computer an IP address. SSH your Fonera+ to 192.168.1.1

From serial console, juste press "Enter".


 BusyBox v1.7.2 (2007-10-15 21:47:19 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge)-------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
Ramdisk version for La Fonera+ (FON 2201)
WiFi and serial port - Lama Bleu - Oct. 2007
root@LamaBleu:/#

root@LamaBleu:/# free
              total         used         free       shared      buffers
  Mem:        13664        10760         2904            0            0
 Swap:            0            0            0
Total:        13664        10760         2904

The amount of avalaible memory is very small.. So you can use "lsmod" and "rmmod <module>" to unload some unwanted modules.
You can also use swapfile to raise the amount of total memory (see below)

Little scripts you can use and/or adapt :

- If your IP computer is 192.168.1.213 with a Window$/samba "fonera" sharepoint the script "cifs" will mount the windows share on your fonera to /cifs .

Use of script /bin/mycifs: will permit you to connect to a Window$ share named "fonera". You can specify IP adress, and pass more parameters (note the quote for last parameters ) to the mount command :

root@LamaBleu:/# mycifs 192.168.1.214 '-o user=eric'
mkdir: cannot create directory '/cifs': File exists%%%

root@LamaBleu:/# mount
rootfs on / type rootfs (rw)
none on /proc type proc (rw)
none on /sys type sysfs (rw)
tmpfs on /dev type tmpfs (rw)
none on /dev/pts type devpts (rw)
\\192.168.1.214\fonera on /cifs type cifs  (rw,mand,unc=
     \\192.168.1.214\fonera,username=eric,uid=0,gid=0,rsize=16384,wsize=57344)

Store your own scripts, and repository directory for ipkg (edit /etc/ipkg.conf and configure httpd on 127.0.0.1 to /cifs/Packages ) on /cifs, use it as you want/need.

- SWAPFILE :

- Create swapfile for cifs.sh :

root@LamaBleu:/# dd if=/dev/zero bs=1024 count=8192 of=/cifs/swapfile 
8192+0 records in
8192+0 records out

--> 8Mb swap on /cifs through WiFi lol ..

- Format it :

root@LamaBleu:/# losetup /dev/loop3 /cifs/swapfile
root@LamaBleu:/# mkswap /dev/loop3
Setting up swapspace version 1, size = 8384512 bytes

- Use swap :

root@LamaBleu:/# swapon /dev/loop3
Adding 8184k swap on /dev/loop3.  Priority:-2 extents:1 across:8184k

Backup your fonera flash partitions and firmware to the remote computer :

"cat /proc/mtd" to see the flash partitions list. ( "image2" is failsafe-mode, "image" normal boot, squashfs).

root@LamaBleu:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "RedBoot"
mtd1: 00010000 00010000 "loader"
mtd2: 00230004 00010000 "image"
mtd3: 00140000 00010000 "image2"
mtd4: 0000f000 00010000 "FIS directory"
mtd5: 00001000 00010000 "RedBoot config"
root@LamaBleu:/#


mkdir /cifs/backup
cat /dev/mtdblock2 > /cifs/backup/image
cat /dev/mtdblock3 > /cifs/backup/image2

and so on.
Enjoy.

Final Notes :
New bugs I've just found today, sorry ( was OK on former version)
reboot and halt commands not working
ipkg list_installed not working

root@LamaBleu:/# ipkg list_installed
Done.
root@LamaBleu:/# reboot
root@LamaBleu:/#

Compilation of this ramdisk kernel made from the standard OpenWRT kamikaze trunk branche. Nothing coming from FON.

Please use your fonera as a fonera and keep FON-based functionality working.

Thanks to FON for recent publishing of sources, but more please, give us SSH access to our white-box toy to improve them as Meraki does !

[EN] Fonera+ : dump, mount, extract squashfs filesystem

Lama Bleu — Mon, 08 Oct 2007 10:40:00 +0200

This is the same method as described in my non-public post of 02 Sept 2007, but now directly from your running LaFonera+
This is also a risk-free method without reflashing.

You need to boot ramdisk following the instructions here to access your Window$ share through WiFi.

I assume /cifs (in your LaFonera+) is access to share \\<computer_IP>\fonera
Use the script mycifs.sh or adapt it !

First, find the start of squashfs filesystem in partition "image"

Make a dump to /cifs of your "image" partition.
File size is approx. 2.2 MB


root@LamaBleu:~# cat /dev/mtdblock2 > /cifs/mtdblock2

Find the magic header sqsh for the starting of squashfs filesystem. In my case (should differ for you, depending version running) :



root@LamaBleu:/cifs# hexdump -C /cifs/mtdblock2 | grep sqsh
000a5020  11 75 ff ff ec 70 0f f5  73 71 73 68 00 00 02 80  |.u...p..sqsh....|

offset is 0x000a5028 hexa ( "sqsh" position)
Take your hex-calc:

0A5028 / 8 = 14A05 --> 84485 (dec)

Extract the squasfs filesystem portion from /cifs/mtdblock2 to a new file on /cifs.

root@LamaBleu:/cifs# dd if=/cifs/mtdblock2 bs=8 skip=84485 of=/cifs/squashfs
202235+0 records in
202235+0 records out

Mount it in a empty directory of your fonera, using losetup to simulate block-device:

root@LamaBleu:/cifs# losetup /dev/loop1 /cifs/squashfs
root@LamaBleu:/cifs# mount -t squashfs /dev/loop1 /mnt
root@LamaBleu:/cifs# ls /mnt
bin   etc   lib   proc  sbin  tmp   var
dev   jffs  mnt   rom   sys   usr   www

Now you can browse the filesystem, just browse as read-only, not writable. Make a backup of /mnt to CIFS share with tar command.

Enjoy.
Lama BLeu.

[FR] FoneraPlus: OpenWRT-kamikaze en RAM

Lama Bleu — Sat, 29 Sep 2007 15:49:00 +0200

IMPORTANT !

Grosse mise à jour le 16-04-2008, désormais il vaut mieux aller voir : http://www.moliets-bastide.info/post/FONERAM

MàJ 16-04-2008 : cette page sera supprimée prochainement

English version is here

Edit 26/03/2008 : Une nouvelle version de Kamikaze en RAM pour la Fonera+ sera disponible ici dans quelques jours.
Complètement fonctionnelle et pas mal d'améliorations !
Comme d'hab pas besoin de reflasher, et c'est juste pour bricoler, pour jouer et découvrir Kamikaze juste le temps d'un boot, pour retourner chez FON au prochain reboot.

MàJ 08/11/2007 : Mise à jour de la version française de ce billet (enfin...)

Edit 16/10/2007 : Remise à jour du fichier ram-foneraplus.elf.
~~Si vous avez téléchargé le fichier de boot en RAM : ram-foneraplus.elf avant le 16/10/2007, remettez-le à jour !~~ Non, mieux vaut attendre hein
Le port série n'est plus nécessaire pour lancer le WiFi qui démarre maintenant au boot.
Hélàs rien de neuf concernant l'utilisation des ports ethernet.

Pour une utilisation de votre Fonera+ avec le firmware FON et l'accès au shell, c'est ici

Voici un petit outil à perfectionner, mais qui permettra déjà de démarrer tranquillement OpenWRT en RAM sur une fonera+ sans la reflasher.

Evidemment ce n'est qu'un petit bricolage, une compilation a moitié réussie seulement !

L'accès à la console série fonctionne, le WiFi également , l'accès aux partages d'un PC distant par montage CIFS.

Le gros hic est dans la partie Ethernet qui ne fonctionne pas du tout, mais notre ami Le Finnois aurait une soluce depuis quelques jours ...

De nombreuses options sont installées, chacun pourra jouer avec : httpd, ftp, telnet, SSH et il est possible d'installer/désinstaller des packages par ipkg.

Je vois un gros avantage à ne pas reflasher la fonera mais pouvoir jouer avec quand même, à chacun de s'inspirer de ce mini-kit pour en faire un outil de débrickage de fonera.

Il faut :

une fonera + (FON2201)
config ethernet du PC en 192.168.1.254 pour plus de facilité, serveur TFTP installé.
le PC qui servira de partenaire à la fonera une fois bootée devra avoir son IP pour le WiFi en 192.168.1.x, sauf 192.168.1.1 ( dans mon cas 192.168.1.213 ). Créer sur ce PC distant un point de partage "fonera", vide pour le moment.
télécharger et décompresser ce fichier

Sauvegarder le fichier dans le répertoire défini pour le serveur TFTP

Les différentes étapes seront les suivantes :

Accès à Redboot par le port Ethernet ou console série de la fonera+
Chargement de l'image de boot RAM en TFTP, puis boot : l'interface WiFi se lancera d'elle-même.
Quelques persos pour éviter les plantages et travailler tranquillement.

On y va !

Tenter d'accéder à Redboot par l'ethernet ( dans ce cas telnet 192.168.1.1 port 9000), ou éventuellement en série si vous disposez d'un câble adapté (attention, c'est du 3.3V et non pas du 5V)
Si le PC connecté en ethernet a bien son IP en 192.168.1.254 et le serveur TFTP lancé ,un simple " load ram-foneraplus.elf " devrait suffire, autrement il faut jouer avec ip_address sous Redboot ...
Taper "go", la fonera boote et finit par ouvrir une console série, ainsi qu'un SSID en WiFi qui apparaitra.
Se connecter en SSH (avec PuTTY par exemple) sur 192.168.1.1, ou directement la touche "Entrée" pour lancer la console depuis le port série.
Voilà , on est dans la console, passer quelques minutes pour se donner une idée !

Il est préférable d'attendre une ou deux minutes avant de tenter la connexion SSH. Le compte root a pour mot de pass "admin".
Le telnet peut aussi fonctionner si on lance un "telnetd" depuis une console SSH-WiFi


 BusyBox v1.7.2 (2007-10-15 21:47:19 CEST) built-in shell (ash)
Enter 'help' for a list of built-in commands.
  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge)-------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
Ramdisk version for La Fonera+ (FON 2201)
WiFi and serial port - Lama Bleu - Oct. 2007
root@LamaBleu:/#

J'ai rencontré des soucis de perte de WiFi par moments , mais je soupçonne plutôt ma clé USB WiFi. Un "ping -t 192.168.1.1" laissé dans un coin de l'écran m'a résolu le problème..

Et voici quelques persos qui vont permettre de récupérer des performances et fonctionnalités ( il ne reste pas beaucoup de RAM dispo)

Accès au partage mis en place sur le PC :

mount -t cifs //ip_du_pc/fonera /cifs -o user=toto,password=mon_mot de_passe

devrait convenir.

Le compte d'utilisateur doit exister sur la machine Windows distante
(il existe un script mycifs.sh à tester qui fait un mount vers 192.168.1.213 puis installe le swap, voir plus bas...)

On peut maintenant accéder sur /cifs au point de partage de son PC, y déplacer/tmp par un "mount -t tmpfs /cifs/tmp /tmp" par exemple.

Scripts maison et packages y trouveront bonne place après avoit modifié /etc/ipkg.conf en conséquence.

Mise en place d'un swapfile

Un fichier de swap sur /cifs permettra de donner plus de mémoire à la fonera. Quand même un swapfile qui transite par le WiFi c'est culotté, mais en attendant de faire fonctionner l'ethernet ...

Créer un fichier de swap ( à faire la première fois)

root@LamaBleu:/# dd if=/dev/zero bs=1024 count=8192 of=/cifs/newswap
8192+0 records in
8192+0 records out

Montage du swap ( qui se fait aussi par le (my)cifs.sh pour les feignants...)

root@LamaBleu:/# losetup /dev/loop3 /cifs/newswap

root@LamaBleu:/# mkswap /dev/loop3
Setting up swapspace version 1, size = 8384512 bytes

root@LamaBleu:/# swapon /dev/loop3
Adding 8184k swap on /dev/loop3.  Priority:-2 extents:1 across:8184k

root@LamaBleu:/# free
              total         used         free       shared      buffers
  Mem:        13696        10548         3148            0            4
 Swap:        12272          788        11484
Total:        25968        11336        14632

--> les pinailleurs me diront que le compte n'est pas bon, normal, il y a déja environ 4Mo de swap installés par ailleurs...

Sauvegarder les partitions de la fonera :

cat /proc/mtd permet d'afficher la liste des partitions ( image est le boot classique, image2 le failsafe mode).

root@LamaBleu:/# cat /proc/mtd
dev:    size   erasesize  name
mtd0: 00030000 00010000 "RedBoot"
mtd1: 00010000 00010000 "loader"
mtd2: 00230004 00010000 "image"
mtd3: 00140000 00010000 "image2"
mtd4: 0000f000 00010000 "FIS directory"
mtd5: 00001000 00010000 "RedBoot config"
root@LamaBleu:/#

mkdir /cifs/backup
cat /dev/mtdblock2 > /cifs/backup/image
cat /dev/mtdblock3 > /cifs/backup/image2

and so on

Pour conclure ..

Cette image a été réalisée à partir de la branche kamikaze de OpenWRT. Rien d'exceptionnel.
Aucun élément de FON n'est installé dessus.
Il est possible qu'elle fonctionne aussi sur la Meraki, feedback bienvenu !

A l'écoute de toutes suggestions concernant le fonctionnements des interfaces ethernet...

Après le dump du firmware, la publication des sources de la fonera+, voici une étape supplémentaire.
Souhaitons qu'un jour FON se décide à rendre de nouveau accessible l'accès SSH ce qui donnerait un plus grand succès encore à la Fonera, + ou non.
Avoir un accès SSH sur son matériel permet d'en personnaliser son fonctionnement sans pour autant enlever les fonctionnalités d'origine.

Mise en place d'un tunnel SSH vers une fonera

Lama Bleu — Thu, 05 Jul 2007 20:12:00 +0200

Voici une méthode presque simple pour ouvrir un accès en tunnel SSH vers sa fonera distante.

L'énorme avantage que je lui trouve est de pouvoir accéder à distance aux IP de son réseau local que l'on désignera ( notamment en HTTP) en n'ayant rien d'autre à ouvrir sur son routeur et la fonera que le port 22 SSH.
On évite ainsi toute manipulation parfois hasardeuse de son fichier /etc/firewall.user.

bien lire les avertissements de ce billet ...

Pour être plus court dans mes phrases ( sic ), ce que j'appelle le "PC client" est le PC sur lequel tu es ( au bureau si ton SI laisse sortir le port 22 , en vacances sur ton PC portable, etc ...) et qui te sert à te connecter à ta fonera via internet.

L'avantage n°1 c'est qu'il n'y a rien à installer sur la Fonera, et un simple client SSH type PuTTY sur le PC où tu te trouves !
L'inconvénient n°1 est la sécurité : il faut absolument pour l'accès SSH sur la fonera prévoir un mot de passe "costaud", ne le donner à personne, le renouveler régulièrement, ou mieux utiliser des certificats.
Un fonero averti en vaut ... au moins dix !

Fonctionnalités testées et avertissement:

accès à la page de config HTTP de la fonera en passant par le tunnel, donc sans avoir à ouvrir le port 80 sur la fonera ( et pas de redirection nécessaire pour routeur/modem/box à part le port 22 évidemment ..).
possibilté d'accès également à la config HTTP ou telnet du modem/routeur/box
un serveur FTP du réseau local devient aussi accessible
- il est également possible d'aller plus loin encore avec les transferts de flux vidéo, ou newsgroups par exemple depuis une fonera mais cette manip vous mettrait en irrégularité avec votre FAI sur vos conditions de ventes (les CGV), voire hors-la-loi, d'où l'importance de n'utiliser cette méthode que pour accéder au réseau local de la fonera. ( merci à mon compère de m'avoir permis de regarder télématin sur mon PC alors que je n'ai pas la TV ADSL...).

Donc dans ce cas il ne peut s'agir que d'un test de quelques minutes et rien de plus sous peine de s'attirer des ennuis, au mieux le FAI, le propriétaire de la fonera si ce n'est pas toi, au pire la justice ...
Et une fonera trop sollicitée chauffe, la bande passante de FAI n'est pas infinie, voici de bonnes raisons pour rester raisonnable.

Attention, ouvrir un tunnel SSH ne revient pas à fabriquer un proxy ou un ouvrir un tunnel VPN, c'est trompeur mais nous restons ici un niveau au dessous.
Il ne s'agit ici que de récupérer (remapper ?) sur un port local de sa machine un accès vers une IP et un port prédéfinis sur le(s) réseau(x) accessible(s) à la fonera .

Concrètement :

http://localhost:8181 (sur mon lieu de vacances ...) peut pointer au travers du tunnel SSH sur http://192.168.10.1 port 80 à mon domicile habituel. (dans le cas la console HTTP de la Fonera)

Bon, c'est parti ...

Pré-requis

- une fonera avec son accès SSH ouvert sur le port ethernet RJ45 ( la méthode est décrite partout sur les FON-sites du web ..)
- le modem, routeur, ou la "box" doit être configuré pour accepter/rediriger les connexions entrantes internet sur le port 22 de la-dite fonera ..
- la machine distante qui servira à se connecter par internet à la fonera distante n'aura besoin que du logiciel ( gratuit ) PuTTY

En résumé, il faut être capable de se connecter à distance en SSH à sa fonera, et rien de plus, ce que sait faire tout fonero bricoleur fréquentant les forums.

Du côté de la fonera :
Il n'y à aucun script à déployer, aucun package à installer. Il faut remplir les conditions du pré-requis, et s'assurer que la fonera accède à toutes les machines et/ou éléments réseau sur lesquels il faudra accéder depuis l'extérieur.

Pour le PC tout se joue dans la config de la session SSH sous PuTTY:
sur une session existante et fonctionnelle vers ta fonera tu vas pouvoir indiquer quels ports locaux de ton PC clients vont permettre d'accéder aux IP et ports désignés sur ta fonera.

Exemple concret (de ma config) :
la fonera est en IP : 169.254.255.1 et le modem ( simple modem pour du PPPoE, non routeur donc pas de DHCP) est sur 169.254.254.1 avec le masque de sous-réseau qui va bien...

-je prends le port 8282 de mon PC client pour le rediriger vers le port 80 de 169.254.255.1 ( la page de config HTTP de la fonera)
-je prends le port 8181 de mon PC client pour le rediriger vers le port 8080 de 169.254.254.1 ( la page de config HTTP du modem par exemple)

Copie d'écran :

Pour modifier les ports dans la session PuTTY, aller dans Connection/SSH/Tunnel, préciser pour "Source port" le port local à utiliser sur le PC client, et pour "Destination" l'adresse IP et le port qui doivent être contacté sur le lan distant ( format IP:port )

Bon ben voilà, c'est fait !

Il ne reste plus qu'à se connecter à la fonera en SSH de manière classique (pour ouvrir le tunnel), puis lancer ton navigateur favori et aller sur http://localhost:8181 pour accéder à la page de config HTTP de ton modem, et http://localhost:8282 pour accéder à ta Fonera en HTTP ...

Dernières remarques :

Il y a sûrement des limites et restrictions à l'utilisation de cette méthode. Aucune résolution DNS ne se fait par le biais du tunnel tu es donc limité à l'adresse IP indiquée dans la redirection.
Si une page présente un lien vers une autre adresse IP, tu ne pourras sûrement pas y accéder.
Dans mon cas précis, ma fonera n'est ni derrière un routeur, ni derrière une box, mais le principe est exactement le même ( avec un routeur ou une box il faudrait ouvrir le port 22 vers la fonera).
L'excellent Jojop a fait la manip au travers de sa box sans aucun problème. Ne pas se laisser perturber par le fait que les IP soient en 169.254.xx.yy pour cet exemple !

Cette méthode devrait fonctionner aussi pour les linksys sous OpenWRT.

Source intéressante qui m'a servi à mettre en place la connexion : ici

Il reste beaucoup à faire, à chacun d'adapter selon ses besoins.

Un grand merci à Jojop, fonero de son état, cobaye et utilisateur occasionnel de FON_BASTIDE