Linksys Blue Box Router HOWTO

Eric Steven Raymond

[http://www.catb.org/~esr/] Thyrsus Enterprises

Copyright  2003 Eric S. Raymond
Revision History                                                             
Revision 1.0           2003-04-09            Revised by: esr                 
Initial release, reviewed by LDP.                                            


Linksys makes a line of cheap, ubiquitous router/firewall boxes (models
BEFSR41 and up) well-suited for use on a home DSL connection and popular
among Linux hackers. This HOWTO gives hints and tips for managing Linksys
routers from a Linux system, including the firmware upgrade procedure.

-----------------------------------------------------------------------------
Table of Contents
1. Introduction
    1.1. Why this document?
    1.2. New versions of this document
    1.3. License and Copyright
   
   
2. How and where to deploy
3. Lost the manual?
4. Configuration hints
5. Troubleshooting tips
    5.1. Occasional catatonia
    5.2. Mozilla interface quirks under 1.38 and earlier firmware
   
   
6. Upgrading the firmware
7. Related Resources

1. Introduction

1.1. Why this document?

Linksys makes a line of cheap, ubiquitous router/firewall boxes well-suited
for use on a home DSL connection and popular among Linux hackers. This HOWTO
gives hints and tips for managing Linksys routers from a Linux system.

The specific recipes described here are derived from experience with a
BEFSR41, the 4-port router/firewall box. I have configured a BEFW11S4v2, the
4-port router with 80211b wireless, and it behaves so similarly to the
BEFSR41 that I suspect they're using the firmware images mostly generated
from common source code ?? in fact, it wouldn't surprise me if it were the
same firmware, doing port tests to figure out what pieces of the user
interface it should enable. The firmware and web interfaces on all these blue
boxes are very similar, and most of the advice should generalize.
-----------------------------------------------------------------------------

1.2. New versions of this document

You can also view the latest version of this HOWTO on the World Wide Web via
the URL [http://www.tldp.org/HOWTO/Linksys-Blue-Box-Router-HOWTO.html]  http:
//www.tldp.org/HOWTO/Linksys-Blue-Box-HOWTO.html.
-----------------------------------------------------------------------------

1.3. License and Copyright

Copyright (c) 2003, Eric S. Raymond.

Permission is granted to copy, distribute and/or modify this document under
the terms of the GNU Free Documentation License, Version 1.2 or any later
version published by the Free Software Foundation; with no Invariant
Sections, no Front-Cover Texts, and no Back-Cover Texts. A copy of the
license is located at [http://www.gnu.org/copyleft/fdl.html] www.gnu.org/
copyleft/fdl.html.

Feel free to mail any questions or comments about this HOWTO to Eric S.
Raymond, <esr@snark.thyrsus.com>.
-----------------------------------------------------------------------------

2. How and where to deploy

The Linksys BEFSR41 and its higher-end siblings are designed to be used as
gateway boxes on a home Ethernet. Typically, you'll hook one up to a DSL or
cable modem, which will automatically switch into bridge mode and simply pass
packets between your ISP's router and the Linksys box.

If you want to use a general-purpose PC running Linux as a firewall, have fun
?? but these little boxes are more efficient. The nicest thing about Linksys
boxes is that they run out of firmware and are too stupid to be cracked.
Also, they don't generate fan noise or heat. Finally, they have no moving
parts, so you can expect a good long mean time between failures.

At minimum, your Linksys box will do the following things for you:

 1. Act as an Ethernet router. You can plug all your lines and hubs and hosts
    into it to exchange packets even when your outside link is down.
   
 2. Act as a smart gateway. When you configure the Linksys with a public
    static IP address (or tell it to grab a dynamic IP address from your ISP
    at startup time), it will gateway between hosts on your private network
    and the Internet, performing all the IP masquerading and address
    translation required to route your traffic.
   
 3. Firewall your connection. You can tell it to block out all but the
    minimum sevice channels you need. You can specify separately, for each
    service, to which of your internal machines the traffic should be routed.
   

Some of the higher-end versions will do extras like virtual private
networking and wireless.

I give my Linksys box the standard private-network gateway address,
192.186.1.1. I then give all my boxes 192.186.1.x addresses and tell them the
Linksys is their gateway. Everything works.

But these boxes are cheap, low-end devices. They have some limitations. It
has been reported that some key features, including DMZ and port forwarding,
are disabled if you have a dynamic address rather than a static (at least,
this was true of the BEFSR41 in 2000; later firmware upgrades might be more
capable).

There is a good article on configuring the BEFSR41, and its limitations, at
[http://www.arstechnica.com/reviews/3q00/linksys/befsr41-2.html]  Linksys
EtherFast Cable/DSL Router, Model BEFSR41. It dates from August of 2000.
-----------------------------------------------------------------------------

3. Lost the manual?

If you've lost the manual, or acquired a secondhand unit that doesn't have
one with it, never fear. Under the Help tab there are links to the PDF and to
the Linksys corporate website.
-----------------------------------------------------------------------------

4. Configuration hints

For security and performance, do these things:

Make sure the DMZ host feature is disabled (under Advanced->DMZ Host). Port
forward specific services instead, and as few of those as you can get away
with. A good minimum set is 22 (ssh), and 80 (http). If you want to receive
mail add 25. If you need to serve DNS queries, add 53.

Disable Universal Plug and Play (under Password). There is a radio button for
this under the "Password" tab. UPnP is a notorious security hole in Windows,
and up to at least firmware version 1.44 there was a lot of Web scuttlebutt
that the Linksys implementation is flaky. While this won't affect operating
systems written by competent people, there is no point in having traffic from
a bunch of script-kiddie probes even reach your network.
-----------------------------------------------------------------------------

5. Troubleshooting tips

5.1. Occasional catatonia

Linksys boxes freeze up occasionally (once every few months) and have to be
power-cycled. Suspect this is happening if your outside Web access suddenly
stops working; ping the Linksys box to check.

These catatonic episodes may be related to dirty power; at least, it seems to
happen more frequently in association with electrical storms. If you think
this has happened, just pull the power connector out of the back and plug it
back in. The Linksys should reboot itself within 30 seconds or so.
-----------------------------------------------------------------------------

5.2. Mozilla interface quirks under 1.38 and earlier firmware

Linksys blue boxes have a webserver embedded in their firmware. The normal
way to administer one is to point a browser at its IP address on your
network. You program the box by filling out HTML forms.

This is a nice bit of design that neatly avoids having OS-specific client
software. But some older versions of the webserver firmware have a quirk that
interacts with a bug in Mozilla (at least at release 1.0.1) to make the
interface almost unusable. Fortunately, the recovery procedure is trivial.
This bug was known to be present as late as 1.38; it is absent in 1.44 and a
good reason to upgrade.

The symptom you're likely to see is a broken-image icon at the upper left
hand corner of each page. The broken image is a series of file-folder tabs
for an image map. That image map is how you get to the other web pages.

You can recover by right-clicking on the broken-image icon. Select "View
Image", then back out. This will build the image map correctly.

You will almost always have to do this on the first page, but it often won't
trigger on later page loads.

Here's what's going on. Mozilla tries to stream multiple concurrent requests
at the webservers it talks to in order to speed up page loading. The
dimwitted little firmware webserver in the Linksys is only single-threaded
and doesn't handle concurrent requests. So there's a race condition. When you
hit the window just right, you get an aborted request and a broken graphic.

Most other browsers are immune to this problem. Konqueror doesn't trigger it.
-----------------------------------------------------------------------------

6. Upgrading the firmware

There are three ways you can upgrade your Linksys firmware.

One is to click the "Upgrade firmware" link on the help page. Unfortunately,
this required Java in the browser under the 1.38 firmware. That has changed
under 1.44. It looks as though you can now fill in the field that says "
Please select a file to upgrade:", click the Upgrade button, and have the
right thing happen.

Another way is to use one of Linkys's firmware-upgrade floppy images from
their website. This requires that you boot Windows or use WINE.

The third way is to use tftp. This is how I did it. There is a tftp client
included with Red Hat Linux. To upgrade your firmware this way, do the
following steps:

 1. Capture a copy of your settings. The firmware upgrade may wipe some of
    them. Older versions nuked everything back to factory defaults; newer
    versions preserve your basic settings but clear some advanced ones.
   
 2. Download a copy of the new firmware. You should find it at Firmware
    Upgrades for your Linksys Products on the Linksys site. Note that what
    you get may well be marked "For Windows Users" and be a zip archive. Open
    it in a scratch directory, because it will rudely create several Windows
    files wherever you unpack it. The file you need will be called CODE.BIN.
   
 3. Disable the router password Note that every attempt I made to do this
    with Mozilla failed (both under 1.38 and 1.44). Konqueror worked fine. Go
    to the Password tab, backspace over both sets of asterisks until both the
    Password and Confirm fields are blank, and click Apply.
   
 4. Cross your fingers and load the firmware The command session you want
    will to see will look something like this, with your router's IP address
    substituted for 192.186.1.1:
    tftp 192.186.1.1                                                         
    tftp> binary                                                             
    tftp> put code.bin                                                       
    Sent 386048 bytes in 10.3 seconds                                        
    tftp>                                                                    
   
    Don't panic if the client hangs for a bit before returning and do not
    abort the transfer. The command is writing to firmware, and the Linksys
    hasn't got much of a brain. Wait for it to finish.
   
 5. Re-enable your router password and other settings. You'll be able to tell
    the upgrade worked because the firmware version number has changed.
   

You're done.
-----------------------------------------------------------------------------

7. Related Resources

There is a site called [http://www.hansenonline.net/Networking/
linksysFW.html] HansenOnline.net that seems to be mainly devoted to tracking
and critiquing the LinkSys firmware releases. Alas, the monitoring software
it offers is for Windows.
