Custom firmware build for R9000

[Lord_Vader]

One remark for OpenVPN client users:

https://www.myopenrouter.com/comment/41894#comment-41894

You can try to tweak your ovpn file to get increase of the speed (kamoj experience).

Voxel.

Again thank you. I'll check out the link. If I wan't to disable VPN service someday I read in your guide to put a file "disable" in /openvpn-client. Just a empty .txt file named "disable" or a file with no suffix in the folder?

 

[Lord_Vader]

Unfortunately upon a reboot it dosen't connect again. Time says "Current Time: Thursday, Jan 01, 1970 01:06:53"

I've tried changing timezone and daylight saving and applied. Stays the same. Any other way to change time, or should I do a factory reset?

 

[Voxel]

Again thank you. I'll check out the link. If I wan't to disable VPN service someday I read in your guide to put a file "disable" in /openvpn-client. Just a empty .txt file named "disable" or a file with no suffix in the folder?

Any file with no suffix (no extension) with name "disable".

Unfortunately upon a reboot it dosen't connect again. Time says "Current Time: Thursday, Jan 01, 1970 01:06:53"

I've tried changing timezone and daylight saving and applied. Stays the same. Any other way to change time, or should I do a factory reset?

Rather no. Try to play with NTP server settings

"(*) Set your preferred NTP server".

instead of default NETGEAR's (WebGUI).

If does not help, probably it is necessary to set somewhere date close to current (not 1970, but e.g. Jan 2017) in startup script (/etc/init.d/) or modify /etc/init.d/openvpn-client script adding e.g. "sleep 180" to wait until router will set proper date.

Voxel.

 

[Lord_Vader]

I have elaborated a bit, and it might be that the router reboots and don't get correct time until some minutes has passed. Or does my DNS choice affects VPN-client? Tried to use DNS from my ISP's and then back to Open VPN.

I'm not into Linux or programming at all, can you please suggest some code, for example delay of VPN-client to start? Sorry to bother you anymore

 

[Voxel]

I'm not into Linux or programming at all, can you please suggest some code, for example delay of VPN-client to start? Sorry to bother you anymore

Well. You have to somehow edit the file /etc/init.d/openvpn-client adding delay before it start OpenVPN connection:

. . .
# Check if tun0 interface already exists
ifconfig | grep -q tun0
if [ $? -eq 0 ]; then
echo "Error: tun0 interface exists. OpenVPN client is probably already started." | tee -a $LOG_FILE
exit 1
fi
# Start OpenVPN client
/bin/sleep 120
/usr/sbin/taskset -c 1 $PROG --writepid $PID_FILE --cd $OPENVPN_CONF_DIR --log-append $LOG_FILE --config $OVPN_CLIENT_CONF --script-security 2 --up /etc/openvpn/ovpnclient-up.sh --down /etc/openvpn/ovpnclient-down.sh --daemon
echo "Please wait..."
sleep 20
ifconfig | grep -q tun0
. . .

red line is what to add. "120" means 120 second delay before actual client start. You can try to change this delay.

Voxel.

 

[Lord_Vader]

Thanx Voxel, but I belive that this is way beyond my knowledge. I can telnet into R7800 and get log from VPN, start/stop VPN-client but that's it.

Every time i reboot my R7800 the time is changed. Maybe faulty, or isn't there a backup for time and date as for all other settings?

 

[Voxel]

Thanx Voxel, but I belive that this is way beyond my knowledge. I can telnet into R7800 and get log from VPN, start/stop VPN-client but that's it.

Every time i reboot my R7800 the time is changed. Maybe faulty, or isn't there a backup for time and date as for all other settings?

Well. You can run from telnet:

sed '49 a /bin/speep 120' /etc/init.d/openvpn-client > /tmp/openvpn-client
cp /tmp/openvpn-client /etc/init.d
chmod +x /etc/init.d/openvpn-client

After this check /etc/init.d/openvpn-client file: there should be added line after line #49 with "sleep 120" i.e. after line with

. . .
# Start OpenVPN client
/bin/sleep 120
. . .

How to check: command "more /etc/init.d/openvpn-client".

If something is wrong you can restore original /etc/init.d/openvpn-client file:

cp -p /rom/etc/init.d/openvpn-client /etc/init.d

Voxel.

 

[Lord_Vader]

Thank you Voxel, Ill give that a try!

I guess that the red line should be sleep..?
sed '49 a /bin/speep 120' /etc/init.d/openvpn-client > /tmp/openvpn-client
cp /tmp/openvpn-client /etc/init.d
chmod +x /etc/init.d/openvpn-client

This is the log from when restarting client upon reboot due to date failure (haven't applied your code yet)

root@R7800:/$ /etc/init.d/openvpn-client start

Please wait...

Done!

Starting Firewall...

Done!

iptables: No chain/target/match by that name.

iptables: No chain/target/match by that name.

iptables: Bad rule (does a matching rule exist in that chain?).

iptables: No chain/target/match by that name.

Thu Jan 1 01:00:40 1970 library versions: OpenSSL 1.0.2n 7 Dec 2017, LZO 2.10

Thu Jan 1 01:00:40 1970 NOTE: the current --script-security setting may allow

this configuration to call user-defined scripts

Thu Jan 1 01:00:40 1970 RESOLVE: Cannot resolve host address: sweden.privatein

ternetaccess.com:1198 (Name or service not known)

Thu Jan 1 01:00:40 1970 RESOLVE: Cannot resolve host address: sweden.privatein

ternetaccess.com:1198 (Name or service not known)

Thu Jan 1 01:00:40 1970 Could not determine IPv4/IPv6 protocol

Thu Jan 1 01:00:40 1970 SIGUSR1[soft,init_instance] received, process restarti

ng

Thu Jan 1 01:00:45 1970 NOTE: the current --script-security setting may allow

this configuration to call user-defined scripts

Thu Jan 1 01:00:45 1970 RESOLVE: Cannot resolve host address: sweden.privatein

ternetaccess.com:1198 (Name or service not known)

Thu Jan 1 01:00:45 1970 RESOLVE: Cannot resolve host address: sweden.privatein

ternetaccess.com:1198 (Name or service not known)

Thu Jan 1 01:00:45 1970 Could not determine IPv4/IPv6 protocol

Thu Jan 1 01:00:45 1970 SIGUSR1[soft,init_instance] received, process restarti

ng

Thu Jan 1 01:00:50 1970 NOTE: the current --script-security setting may allow

this configuration to call user-defined scripts

Thu Jan 1 01:00:50 1970 TCP/UDP: Preserving recently used remote address: [AF_

INET]5.153.233.26:1198

 

[Voxel]

I guess that the red line should be sleep..?

Yes, sorry. Misprint.

Check my new release 44SF if you are using R7800 (but use the thread for R9000). Regarding sleep etc.

Voxel.

 

[primitivo]

@Voxel would there be any way to install Astrill VPN applet like it is possible on Tomato, DD-WRT or MerlinWRT supported routers? You can check it here. That would be fantastic. Their features are great, like none other VPNs and they have also special RouterPro (OpenVPN optimized) protocol in place, through which you can reach 2-3 higher speeds than normal OpenVPN. That's in addition to advanced policy routing etc.

 

[Voxel]

@Voxel would there be any way to install Astrill VPN applet like it is possible on Tomato, DD-WRT or MerlinWRT supported routers? You can check it here. That would be fantastic. Their features are great, like none other VPNs and they have also special RouterPro (OpenVPN optimized) protocol in place, through which you can reach 2-3 higher speeds than normal OpenVPN. That's in addition to advanced policy routing etc.

OK, I'check this. But not today/tonight...

Voxel.

 

[Voxel]

@Voxel would there be any way to install Astrill VPN applet like it is possible on Tomato, DD-WRT or MerlinWRT supported routers? You can check it here. That would be fantastic. Their features are great, like none other VPNs and they have also special RouterPro (OpenVPN optimized) protocol in place, through which you can reach 2-3 higher speeds than normal OpenVPN. That's in addition to advanced policy routing etc.

Sorry, no. As far as I understand they have applets for concrete versions of firmware. It is not standalone of Open Source applet.

Voxel.

 

[RMerlin]

And I doubt Astrill could implement it if they wanted, since they can't interface with the webui like they can do with Asuswrt/DD-WRT/etc...

 

[jrfaulkin]

Voxel, any idea what iptable rules are being pushed to make these error messages?

root@SAGAN:/etc/openvpn/config/client$ startvpn
Please wait...
Generating Rules...
Done!
Starting Firewall...
Done!
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: No chain/target/match by that name.
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: No chain/target/match by that name.
iptables: Bad rule (does a matching rule exist in that chain?).
root@SAGAN:/etc/openvpn/config/client$

 

[Voxel]

Voxel, any idea what iptable rules are being pushed to make these error messages?

root@SAGAN:/etc/openvpn/config/client$ startvpn
Please wait...
Generating Rules...
Done!
Starting Firewall...
Done!
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: No chain/target/match by that name.
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: Bad rule (does a matching rule exist in that chain?).
iptables: No chain/target/match by that name.
iptables: Bad rule (does a matching rule exist in that chain?).
root@SAGAN:/etc/openvpn/config/client$

IMO you should ignore this. NG's firewall just does not check if rule already exists or not. Even if iptables displays the error/warning message. These messages are not because of my changes, but are displayed even in stock firmware when stopping/starting firewall.

If you really need to know what causes this (debugging) you should provide some scheme with replacing iptables binary by script (with a name "iptables") which will store arguments it gets in some log file and then pass them to original iptables binary.

Voxel.

 

[primitivo]

Sorry, no. As far as I understand they have applets for concrete versions of firmware. It is not standalone of Open Source applet.

Voxel.

Thanks.
Does your FW support VPN policy routing? If not, are you planning to add it?

 

[Voxel]

Thanks.
Does your FW support VPN policy routing? If not, are you planning to add it?

No nearest plans. I know some guys are doing something similar. You can check this article, it is for R7800 but the same is for R9000:

https://www.myopenrouter.com/article/how-set-openvpn-client-netgear-r7800-voxels-custom-firmware

but it is manual job. I am limited in GUI modification due to lack of codes.

Voxel.

 

[iPrey06]

Can someone link me where I can see what this custom firmware looks like? Screenshots maybe and what options I have etc.

Thanks

Sent from my SM-T817V using Tapatalk

 

[RMerlin]

Can someone link me where I can see what this custom firmware looks like? Screenshots maybe and what options I have etc.

Thanks

Sent from my SM-T817V using Tapatalk

Exactly the same as the stock NG firmware.

 

[Voxel]

Exactly the same as the stock NG firmware.

Yes almost the same.

Voxel.