Slightly less Random Ramblings

July 1, 2016

Installing OpenWRT on a Cheap Laptop

Filed under: computing, Firewall, linux, OpenWRT, security — Tags: , , , , , , — Robert Wicks @ 4:20 pm

I got a deal ($125) on an Acer ES1-111M laptop. This class of laptop is intended to be a Windows-running equivalent to Google’s Chromebook. It came with 8GB of RAM and an embedded 32GB eMMC drive. I gave it to my daughter, until the shoddy trackpad made it too frustrating for her and I got her a newer and better laptop. I upgraded the onboard RAM to 8GB. I’ve run Windows 10 and Ubuntu on it, but I don’t really need another personal laptop. Considering the RAM, the light weight, the low temperature and power usage, along with onboard Gigabit Ethernet and a USB 3.0 port, I figured it might make a decent VPN gateway.

I first set it up as a router, which led to the discovery that the existing router in my house, a Buffalo WZR-HP-G300NH, was holding me back. I had a USB 3.0 Gigabit Ethernet dongle as the second interface for the laptop, and when I set up simple IP Masquerading on Ubuntu and pointed a computer at it, I found that my download speeds jumped from ~70Mb/s to ~170Mbs. That led me to look for a wife-friendly (i.e., free) way to improve things. My first choice was my favorite firewall software, OpenWRT. There is an x86 version which is developed alongside the embedded device versions I am so accustomed to using. I grabbed the ISO, then discovered the issue I’ve seen with other Linux distributions, it would not see the storage. Eventually, I installed it to a USB key, which was fine. Along the way, I upgraded to the trunk build and discovered that the OpenWRT which was running could now see the (unused) MMC storage. Perhaps it would now work.

Initially, I wrote an image to the eMMC storage, and booted, but it froze during the boot process. After a bit of tinkering, I found out that if you edit the grub entry so that root=/dev/mmcblk0p2 rather than UUID=-2, it would boot correctly. After booting, just mount /dev/mmcblk0p1 to /mnt, then edit /mnt/boot/grub/grub.cfg to change the UUID entry to /dev/mmcblk0p2, and everything works correctly. You will need to install kmod-usb-net-asix-ax88179 to use the USB Ethernet adaptor. From there, it’s a very normal OpenVPN setup.

May 17, 2014

A Chat on Cybersecurity

Filed under: encryption, Firewall, OpenVPN, OpenWRT, security, Truecrypt, Windows — Robert Wicks @ 5:47 pm

I was recently interviewed by Manuel Lora for on the topic of cybersecurity. You can listen to it here.

January 24, 2013

Windows 7 VPN Routing to StrongSwan

Filed under: encryption, linux, security — Tags: , , , , , , , , , , — Robert Wicks @ 12:41 am

One thing which always bugged me about my VPN setup is that whenever I used IPSec on Windows 7, I had to specify the route into my home network using a command prompt in Windows (with elevated permissions) where I had to use the “route add” command (you can view the link to see my example.) I finally have a way around this, by using the tip here. Just follow these directions, but instead of a script, specify the route command, with the flags “add mask” from the example in my VPN setup post. Check the box “run with highest permissions” and save it. Now, every time you connect to your VPN, the task will automatically set your route. Obviously, you could make this a script with any number of commands or multiple routes, so adjust things accordingly.

May 23, 2011

Strongswan 4.5.1 now in the OpenWRT Trunk

Filed under: encryption, linux, OpenWRT — Tags: , , , — Robert Wicks @ 6:49 pm

My issues with Strongswan in the OpenWRT trunk are now resolved. Strongswan 4.5.1-1 is available.

April 5, 2011

StrongSwan on OpenWRT

Filed under: linux, OpenWRT, security — Tags: , , , , , — Robert Wicks @ 8:45 am

I recently purchased a Buffalo WZR-HP-G300NH router and installed OpenWRT on it. I used the trunk version, but found that StrongSwan4 did not allow me to pass traffic, despite an identical configuration to my working Trendnet router. I can successfully connect, but my log files show an error “unable to add SAD entry.” My client indicated no proposal. Though I have not discovered the full nature of the issue, I did notice that the current OpenWRT trunk does not include the kmod-mod-imq module. Since the networking component has changed, I wondered if that might be related. When I installed the 10.03.1-rc4 version of OpenWRT instead, things worked again.

February 22, 2011

Setting up a VPN Gateway on the Cheap

I recently got a hand-me-down Trendnet TEW-652BRP router. The label on it indicates that it is version 1.1R. Doing a bit of research, it seems as if the one I have is actually identical to the TEW-632BRP, so I compiled OpenWRT for the TEW-632BRP, and it worked like a charm. The router uses an Atheros AR9130 rev2 chipset with a MIPS processor running at 400Mhz. It features wireless N in the 2.4GHz range, 4MB of flash, which is fairly typical, and 32MB of RAM, which is more than several I’ve seen. The processor is what intrigued me. It is well known that alternative, Linux-based firmwares exist for consumer routers, which can offer an array of new features. I have several compatible models myself. But most of the older Broadcom chipset models have fairly slow processors, so some applications, such as VPNs, perform only moderately well on them.

One of my favorite VPN products is OpenVPN. It performs well, and is simple to set up. A couple of years ago, an excellent analysis of the performance of OpenVPN on a consumer grade router was published. For most home connections, you will get plenty of throughput using either of the VPN solutions we will be setting up. In order to get this up and running, first you must flash the router to get rid of the firmware which came with it and replace it with something altogether more powerful: OpenWrt. Download the backfire image builder from the trunk. Support for this chipset is newer than the Broadcom chipsets in the original Linksys WRT-54G(L) and OpenWrt is under constant development, and the trunk build has run much better than the others on my router. The features I want really push the limits of the storage, so I had to just drop wifi support. Fortunately, I have other wireless routers which I can use for access points on my home network. So these directions are for a command-line-only, wired-access-only router and VPN endpoint. After you get the builder, run

“tar -jxvf OpenWrt-ImageBuilder-ar71xx-for-Linux-x86_64.tar.bz2;cd OpenWrt-ImageBuilder-ar71xx-for-Linux-x86_64”

After you get into the directory, run something like the make command below.

make image PROFILE=”TEW632BRP” PACKAGES=”base-files busybox ddns-scripts dnsmasq dropbear firewall hotplug2 ip iptables iptables-mod-conntrack iptables-mod-conntrack-extra iptables-mod-filter iptables-mod-imq iptables-mod-ipopt iptables-mod-ipsec iptables-mod-nat iptables-mod-nat-extra kernel kmod-button-hotplug kmod-crypto-aes kmod-crypto-authenc kmod-crypto-core kmod-crypto-des kmod-crypto-hmac kmod-crypto-md5 kmod-crypto-sha1 kmod-input-core kmod-input-gpio-buttons kmod-input-polldev kmod-ipsec kmod-ipsec4 kmod-ipt-conntrack kmod-ipt-conntrack-extra kmod-ipt-core kmod-ipt-filter kmod-ipt-imq kmod-ipt-ipopt kmod-ipt-ipsec kmod-ipt-nat kmod-ipt-nat-extra kmod-ipt-nathelper kmod-iptunnel4 kmod-leds-gpio kmod-sched kmod-textsearch kmod-tun libc libgcc libgmp libiptc liblzo libnl-tiny libopenssl libpthread librt libuci libxtables mini-snmpd miniupnpd mtd openvpn opkg qos-scripts strongswan4 strongswan4-app-charon strongswan4-app-pluto strongswan4-mod-aes strongswan4-mod-attr strongswan4-mod-des strongswan4-mod-dnskey strongswan4-mod-fips-prf strongswan4-mod-gmp strongswan4-mod-hmac strongswan4-mod-kernel-netlink strongswan4-mod-md5 strongswan4-mod-pem strongswan4-mod-pgp strongswan4-mod-pkcs1 strongswan4-mod-pubkey strongswan4-mod-random strongswan4-mod-resolve strongswan4-mod-sha1 strongswan4-mod-sha2 strongswan4-mod-stroke strongswan4-mod-updown strongswan4-mod-x509 strongswan4-mod-xcbc strongswan4-utils tc uci udevtrigger -vsc7385-ucode-ap83 -vsc7385-ucode-pb44 -vsc7395-ucode-ap83 -vsc7395-ucode-pb44 zlib -kmod-ath9k -wpad-mini”

This will install Strongswan and OpenVPN, but, due to only have 4MB of flash storage to work with, will not install the web interface, so we will be doing everything from the command line. After the command above gives you your image, you will need to choose the appropriate one to flash your router. If you are going from the factory firmware, you need to use the recovery image, which, when I build it, is called “openwrt-ar71xx-generic-tew-632brp-recovery-squashfs-factory.bin.”

You can then flash your firmware by unplugging it, holding down the reset button, plugging it in while the reset button is held down for about 10 seconds, then setting your computer’s IP address to and browsing to Upload the file and flash away. The router will eventually reboot and have an IP address of

You can then set your computer’s IP address to and telnet into The router will allow you in with no password. You can issue the “passwd” command to set the root password, which I recommend. Once you do this, however, you will have to use SSH to log into the router, as telnet is disabled when the root password is set.

OpenVPN Setup

OpenVPN is a very easy to configure, cross-platform, open source VPN, and it now has wide support on third party firmwares such as OpenWRT, DD-WRT, and Tomato (but you will need either TomatoVPN or TomatoUSB). IPSec has the advantage of being a standard which can interoperate with a variety of devices and operating systems where OpenVPN is not available. I figure why not do both? We are going to use certificates to authenticate both of them, so with a bit of care, we can use the exact same certifcates and keys on our router for both services, saving us a little bit of storage. I did my certificate generation on Ubuntu 10.10, but you could use anything which runs OpenVPN and OpenSSL. On Ubuntu, run

sudo apt-get install openvpn

After the installation completes, copy the entire /usr/share/doc/openvpn/examples/easy-rsa/2.0 directory into your home directory with

cp -r /usr/share/doc/openvpn/examples/easy-rsa/2.0 $HOME/

This will give you a “2.0” directory in your home directory. Cd into that directory, and edit the vars file so that it has your organization and personalized information (this is optional). Then edit the openssl.cnf file. You will modify it so that the certificates it generates will be suitable for both OpenVPN and Windows 7’s implementation of IPSec. Go to line 196 in the file, the extendedKeyUsage line. You will also add a new line after this one. Together, they read:

extendedKeyUsage=clientAuth, serverAuth,

In place of Your.Internet.DNS.Hostname, put your computer’s hostname. If you are on a home Internet connection, you should use one of the dynamic DNS providers such as These lines will enable the Windows 7 IKEv2 VPN client to work with StrongSwan. Be sure to follow the directions here. You can then run the following commands.

. ./vars
mkdir keys
./build-key-server Your.Internet.DNS.Hostname
./build-key-pkcs12 client1

As before, replace the Your.Internet.DNS.Hostname with your Internet hostname. One of the good things about the build-key-pkcs12 script is that it generates everything you will need for OpenVPN clients on both Windows and Linux. You will find client1.key, client1.csr, client1.crt, and client1.p12 under the keys directory after running the last command. You will also see files with the same extensions (except the p12 file) prefixed by your Internet hostname. Those files will be installed on your OpenWRT VPN endpoint. The client1 files will be installed on your laptop (or whatever will be connecting into your VPN endpoint). First, we need to copy the server keys we generated into the appropriate places. We will use the default paths for StrongSwan, but OpenVPN will also use them. Run:

scp keys/Your.Internet.DNS.Hostname.crt root@:/etc/ipsec.d/certs/Your.Internet.DNS.Hostname.crt

scp keys/Your.Internet.DNS.Hostname.key root@:/etc/ipsec.d/certs/Your.Internet.DNS.Hostname.key

scp keys/ca.crt root@:/etc/ipsec.d/cacerts/ca.crt

scp keys/dh1024.pem root@:/etc/openvpn/

SSH into your OpenWRT router and run:

vi /etc/openvpn/my-vpn.conf

This will create the configuration file you will use, which you will fill with something like this:

proto udp
port 1194
dev tun0
comp-lzo adaptive
keepalive 15 60
verb 2
push “route”
ca /etc/ipsec.d/cacerts/ca.crt
dh /etc/openvpn/dh1024.pem
cert /etc/ipsec.d/certs/Your.Internet.DNS.Hostname.crt
key /etc/ipsec.d/private/Your.Internet.DNS.Hostname.key
tls-auth /etc/openvpn/ta.key 0

You should customize the route to reflect the IP scheme of your internal network. You can also alter the server line to any arbitrary private network. Finally, you can change your port to something other than 1194. Notice that the last line refers to a file, ta.key, which we have not yet created. We can do that on the router itself with the command:

openvpn –genkey –secret /etc/openvpn/ta.key

Adding this to your OpenVPN configuration will defend against port scanning and DOS attacks. You will need to copy this file to your laptop as well. Your laptop’s OpenVPN configuration will contain something like this:

dev tun
proto udp
remote Your.Internet.DNS.Hostname 1194
resolv-retry infinite
ca /etc/ipsec.d/cacerts/ca.crt
dh /etc/openvpn/dh1024.pem
cert /etc/ipsec.d/certs/Your.Internet.DNS.Hostname.crt
key /etc/ipsec.d/private/Your.Internet.DNS.Hostname.key
tls-auth ta.key 1
verb 3

You now have a working OpenVPN configuration, but you still need to modify your firewall rules to allow traffic through. Run

vi /etc/config/firewall

Add the following lines to the end:

config ‘rule’

option ‘src’ ‘wan’
option ‘target’ ‘ACCEPT’
option ‘proto’ ‘udp’
option ‘dest_port’ ‘1194’

Save the file. This will configure your firewall to accept inbound OpenVPN traffic. In order to pass the tunneled packets through, we edit the firewall.user file:

vi /etc/firewall.user

Add the following lines to that file:

/usr/sbin/iptables -I INPUT -i tun+ -j ACCEPT
/usr/sbin/iptables -I FORWARD -i tun+ -j ACCEPT

This will allow your VPN to work. Just reboot the router and OpenVPN should work. Now, let’s get to IPSec.

IPSec Setup

IPSec is actually more difficult to configure than OpenVPN, but, being a cross-platform standard, and enjoying kernel-level support, is still a nice feature to have on an Internet gateway. The crypto files have already been put in place, so we just need to edit the configuration. Run:

vi /etc/ipsec.conf

Modify the files so that it contains:

config setup


conn %default


conn nat-t


Edit your /etc/ipsec.secrets file and fill it with:

: RSA Your.Internet.DNS.Hostname.key

Now, we allow the appropriate connections to the firewall. Edit the /etc/config/firewall file and add:

config ‘rule’

option ‘src’ ‘wan’
option ‘proto’ ‘esp’
option ‘target’ ‘ACCEPT’

config ‘rule’

option ‘src’ ‘wan’
option ‘proto’ ‘udp’
option ‘dest_port’ ‘500’
option ‘target’ ‘ACCEPT’

config ‘rule’

option ‘src’ ‘wan’
option ‘proto’ ‘udp’
option ‘dest_port’ ‘4500’
option ‘target’ ‘ACCEPT’

config ‘rule’

option ‘src’ ‘wan’
option ‘proto’ ‘ah’
option ‘target’ ‘ACCEPT’

Finally, add the following to /etc/firewall.user to enable all the traffic to pass, even to the OpenWRT router itself:

/usr/sbin/iptables -I INPUT  -m policy –dir in –pol ipsec –proto esp -j ACCEPT
/usr/sbin/iptables -I FORWARD  -m policy –dir in –pol ipsec –proto esp -j ACCEPT
/usr/sbin/iptables -I FORWARD  -m policy –dir out –pol ipsec –proto esp -j ACCEPT
/usr/sbin/iptables -I OUTPUT   -m policy –dir out –pol ipsec –proto esp -j ACCEPT

This gives full access to all the tunneled traffic. On a Windows 7 client, you can follow this guide. Note that you will have to manually add the route for your home network on Windows 7, due to the limitations of the Agile VPN client. I run a command prompt as administrator and run

route add mask

after I connect. Traffic then passes. Things are much easier if you are using StrongSwan as the client. Just edit the /etc/ipsec.conf file on your Linux laptop client to contain the following:

config setup


conn roadwarrior


As you can see, you will be copying your router cert (and only the cert, not the private key) to your client. You will also copy your client1 key and cert. In a similar manner to the router, your /etc/ipsec.secrets file will contain

: RSA client1.key

You can read more on the Strongswan client configuration here. Once you have Strongswan configured, you can start ipsec, then issue

ipsec up roadwarrior

to start the tunnel.

Final Notes and Tips

You can actually replace the rightcert line with “rightid=%any” which is a better practice, from what I gather from the StrongSwan mailing list. That is how I have modified my own setup. Also, note that the Ubuntu package is actually broken, because it does not use socket-raw. To fix this, remove /usr/lib/ipsec/plugins/libstrongswan-socket-d* and restart the daemon. Or, you can do what I did and build the latest StrongSwan from source.

Be sure to look at the various documentation pages for OpenWRT, OpenVPN, and Strongswan. They have a lot of very useful information. One of the nice things you can do when you have your VPN setup working fully is completely disable all other remote access to your network. You can make your router invisible on the Internet, yet still allow full access to your home resources. With more powerful routers, especially ones with more storage, you can add useful packages to allow full SNMP support, traffic monitoring, the GUI interface, or port knocking.

If you have any questions, please post them in the comments or email me.

July 19, 2010

Automounting Truecrypt in Linux

Filed under: computing, encryption, linux, Truecrypt, ubuntu — Tags: , , — Robert Wicks @ 12:35 am

I have a dual boot system with Windows 7 and Ubuntu 10.04. In order to secure the system, I have system encryption with Truecrypt and encrypted LVM in Ubuntu. I need to access my Windows files from within Ubuntu. After a bit of searching around the Internet, I pieced together this command line, which I put in /etc/rc.local. Since my system is fully encrypted and used by only me, I’m not concerned about the password being in /etc/rc.local. I installed the Truecrypt console version.

I added the following line to /etc/rc.local:

echo “MyTruecryptPassPhrase” | /usr/local/bin/truecrypt -t -m system -k “” -p ”” –protect-hidden=no –fs-options=rw,noatime,umask=000 –filesystem=ntfs-3g /dev/<windows partition> /<local mount point>

By echoing the passphrase and piping it to the Truecrypt command, we avoid having it show up in the ‘ps -ef’ command. The filesystem will be mounted with 0777 permissions.

I have found that it is even possible to mount outer partitions (with hidden partitions inside) using this method, and protecting the hidden partition. The command is as follows:

echo “HiddenPartitionPassphrase\n\nOuterPartitionPassphrase” | /usr/bin/truecrypt -t -k “” -p “”  –protect-hidden=yes –fs-options=rw,noatime,umask=000  /dev/sda2 /windows

By using the hidden OS feature in Truecrypt, it is possible to triple boot your computer, with all data on the drive except for the /boot partition in Linux being encrypted. Since no secret information is stored in /boot, this is not a problem.

April 22, 2010

Ubuntu thumb drive

Filed under: linux — Tags: , , , , , — Robert Wicks @ 9:44 pm

I recently installed Ubuntu 10.04 beta 2 (Lucid Lynx) on an Imation 4GB thumb drive. Ubuntu has a feature to install the live CD onto a thumb drive, but I have always found that solution a bit unsatisfying. I wanted an installation which could be updated and modified as I see fit. So, I wanted to use the thumb drive like a hard drive. Most of what I do allows me to forgo persistent local storage, but I did want that option, so I encrypted my home directory, which is an install option. One of the potential problems with that plan is the fact that flash storage, especially cheap flash storage, like the kind in a thumb drive, has a limited number of writes before it fails.

installing Ubuntu onto a thumb drive, using it like a hard drive, is simple. Just run the normal install, clicking on the “Advanced” tab on the screen prior to the beginning of the actual install. The subsequent screen allows you to choose the location for the boot sector. Simply change the boot sector to the thumb device, and you are done there. For further details, go here.

After the install, you can update your Ubuntu install as normal. Now, the next step is to do things which will extend the life of your thumb drive. Obviously, you do not want to have a swap file. I formatted the swap partition which Ubuntu automatically created and mounted that partition as /home. I also made use of tmpfs to mount some of the more heavily written areas in RAM, discarding them on each reboot. Here is what I did in /etc/fstab:

tmpfs /var/tmp tmpfs noatime,rw,mode=1777 0 0
tmpfs /tmp tmpfs noatime,rw,mode=1777 0 0
tmpfs /var/cache/apt tmpfs noatime,rw 0 0
tmpfs /var/log tmpfs noatime,rw 0 0

Additionally, I added this to /etc/rc.local:

mkdir -p /var/cache/apt/archives/partial
mkdir /var/log/apt

This means that the heavily written stuff, like logs, and the update cache for software, are written to RAM and discarded. The /etc/rc.local line is needed because apt-get requires both the archives and archives/partial directories to function correctly.

Once I had the system up and running, I found Firefox performance to be bad. Using the ever-trusty lsof, I found that Firefox uses multiple sqlite databases to hold stuff like preferences. The solution I decided on was to move my home directory onto a ramdisk. Since I had a small /home partition, I added the following things to my /etc/fstab:

UUID=f39t7wj8-v872-4dc9-ik47-nve73hv923nbsw1 /home2           ext4    rw,noatime        0       2
tmpfs /home tmpfs noatime,rw 0 0

Your uuid will differ, but the idea is to mount your original /home partition on /home2 instead, and mount /home as a ramdisk. I also added the following to /etc/rc.local:

rsync -a /home2/ /home/

This syncs the contents of /home2 (which is on the flash) with /home (which is in ram, and discarded at every boot). If I make an important change to my home directory, I log out of my GUI session, open another virtual terminal (by pressing ctrl-alt-F1), log in as root (you will need to set your root password to allow this), and run:

rsync -a /home/ /home2/

This will sync the changes you made back to the flash card. You should only rarely have to do this. One useful way to save files is to use the free Ubuntu One service which is included with Lucid. That makes it easy to save small files and sync them to the cloud, which ends the worry associated with having your home directory in RAM. Save any files you want to the Ubuntu One directory, and they will be saved offsite.

If you have any issues with doing any of this, feel free to contact me at Also, I would greatly appreciate corrections and suggestions. I may experiment with AUFS in the future. That may be a good alternative to tmpfs alone on some of the filesystems.

January 11, 2009

Sharing all your music with Firefly Media Server

Filed under: DAAP, firefly, linux, mp3, songbird, ubuntu — Robert Wicks @ 12:27 am

I have a cross-platform household. My wife and daughter use Windows, I use Windows for work and Ubuntu for meaningful things ;). I have a lot of music and audiobooks, mostly in mp3 format, but a few things in ogg, flac, and mp4. Everyone likes to listen to something, but how to share all the files? There are many solutions, of course, but the most convenient one for me was the one which allowed my wife to easily access the music with iTunes. The solution was the Firefly Media Server. Installing this under Ubuntu could hardly be simpler. From a command line, as root, type:

apt-get install mt-daapd ffmpeg

This will get you the software you need. After the packages are installed, edit the /etc/mt-daapd.conf file and change the location of your media files to wherever you keep them. After saving the file, issue

/etc/init.d/mt-daapd restart

I have occasionally found cases where Ubuntu starts services immediately after installing them. Restart means it will stop the process first, if there is an active one.

Wait a couple of minutes, for Firefly to scan your media files, and they should be accessible via DAAP. iTunes will discover the new server automatically, if the computer is on the same subnet as the server. I am told that Songbird works well with Firefly as well.

July 22, 2008

Cheap solid state router using Endian Firewall

Filed under: Firewall, linux — Robert Wicks @ 2:55 am
I wanted to run Endian Firewall on compact flash, something which is not explicitly supported, apparently. I had 1.5GB of RAM, and Endian runs in 512 with no problem, so I figured I could use tmpfs to do /var and /tmp, helping prevent the card wearing out. I could not get Endian to install to a USB device, but a $12 CF-IDE adapter allowed me to install it on a 2GB flash card with no problem. It will disable swap automatically. You can either pop it out after you install, or you can boot off a Knoppix CD next so that you can make some modifications to your installation. If you are using the CF card via USB (I could not get Endian to install on a USB connected CF card, but I imagine I could get it to boot and run, once I installed it over IDE. After you perfect the installation, you can just dd the boot sector and each partition so that you can clone your install to new media), mount /dev/sdb3 to /mnt to access the root directory (/). Once you mount the / partition for editing, change the etc/fstab file on the CF card to read something like this:

/dev/hdb1 /boot ext3 nodev,nosuid,noatime 1 2
/dev/hdb3 / ext3 noatime 1 1
/dev/hdb4 /varperm ext3 noatime,mand 1 1
none /var tmpfs noatime,mand 0 0
none /tmp tmpfs defaults 0 0
none /home tmpfs defaults 0 0
none /proc proc defaults 0 0
none /dev/pts devpts gid=5,mode=620 0 0
/dev/cdrom /mnt/cdrom udf,iso9660 noauto,owner,kudzu,ro 0 0

Note that I moved /var to /varperm and /home to /homeperm. You can mkdir those directories under your root partition which has been mounted to /mnt.
Next, edit the etc/rc.d/rc.sysinit file. Locate the line which reads

mount -a

Add three lines immediately below it:

######copy stuff to the tmpfs filesystems
/usr/bin/rsync -a /varperm/ /var/
/usr/bin/rsync -a /homeperm/ /home/

I also added /etc/cron.d/syncflash to /etc/rc.d/rc.halt, right after the “Shutting down” line at the top of the file so that I flush to flash whenever I shut down.

This will get the necessary directories and files on boot from the flash to RAM so that scripts start correctly. That’s all which is actually required! You can (and probably should) add a cron job (under /etc/cron.{minutely|hourly|daily} to periodically rsync stuff from /var to /varperm to keep historical logs. This is in /etc/cron.d/syncflash on my system:

/usr/bin/rsync -a /var/ /varperm/
/usr/bin/rsync -a /home/ /homeperm/

I’d probably exclude the gzipped stuff, myself, but that depends on the amount of space you have. Since tmpfs allocates half your RAM by default, we effectively have a 750MB combined /tmp and /var filesystem. This is plenty, really. We can even enable the proxy and ntop, so long as we set the limits to something reasonable. I may hack it further to keep longer logs on flash and continually flush tmpfs, but what I have works for now. I think this may be a really good solution for a dedicated router box, maybe using something like a Fit PC. Addendum: Fit PC does not have enough memory for this application. But an old laptop and a PC Card CF reader might do the trick. I also had to change the options from defaults in the /var line to enable mandatory locks. Havp would not start without this setting, which kept squid from working correctly.

Older Posts »

Create a free website or blog at

%d bloggers like this: