Fon/Fon+ Newbie Guide to Installlation of Jasager 1.0 Firmware

[nmaas87]

Pre Info:

This guide has been made with an Fon+ (2201), but should work with any other

Fonera Classic as well. Only limitation is that I have Problems with my

Jasager in Terms of SSIDs, there seems to be a Problem which hasn't been

addressed by Digininja, but the Rest should work.

(Problem described here: http://hak5.org/forums/index.php?showtopic=13883 )

This guide should be quite useful and has been written by using guides and

stuff from this Forum, I just wrote it together and added my own experiances.

Maybe that will turn out as a good starting point and help some newbies.

This Guide ain't perfect and if you think I could add some info - just write me,

I would be happy to provide more accurate Information to make life for new Jasager Friends easier!

Good Luck,

Yours, Xeno

0.) Get it started!

- Get the Jasager 1.0 Firmware from Digininja

http://www.digininja.org/jasager/download.php

- Built an Serial Adapter

Its not that hard and you should built one - so you can recover an dead Fonera.

I.e. http://www.dd-wrt.com/wiki/index.php/LaFon...rial-Cable-Port

I built that myself ("the ugly one") and it works.

Just to add two things:

i) You need to wire RS232 TX to the RX of the Serial (S2) and RS232 RX to the TX

(S3) of the Serial Connector (and 5 is the Ground)

ii) If you use an Fon+ (2201), the Serial Connector on the Phone is like that:

ethernet port

c x VCC 3,3 V MEMORY

a x TX

s x RX CPU

e x GND

1.) Flashing the Fon+ to Jasager

a) With Serial Port only:

- Extract the two Firmware Files onto your PC

- Connect to Serial (9600 baud, 8 Bit Data, 1 Stop Bit, No Software/Hardware Flow Control)

- Power Up the Fonera and Press CTRL+C (within 2 Seconds)

You end up in RedBoot>

Enter fconfig and press Enter until you come to the point Console Baud Rate.

Change the 9600 to 115200. Press enter again till the end and accept the flash with y.

Enter Reset and change the Serial Port settings to 115200 baud.

Repower the Fonera and Press CTRL+C (within 2 Seconds)

You end up in RedBoot>

Enter these Commands:

// Complete Kill of the Fonera Software:

fis init -f

// Download the Firmware Header and Root (fis can take about 20 Minutes!)

load -r -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma -m xmodem

fis create -e 0x80041000 -r 0x80041000 vmlinux.bin.17

load -r -b %{FREEMEMLO} openwrt-atheros-root.squashfs -m xmodem

fis create -l 0x6F0000 rootfs

// Configure Bootup, enter:

fconfig

// Enter Bootup Script, enter these two lines and press Enter a third time

fis load -l vmlinux.bin.17

exec

// The complete Config should look like that (nothing else changed as the Bootup Script!)

RedBoot> fconfig

Run script at boot: true

Boot script:

Enter script, terminate with empty line

>> fis load -l vmlinux.bin.17

>> exec

>>

Boot script timeout (1000ms resolution): 2

Use BOOTP for network configuration: false

Gateway IP address:

Local IP address: 192.168.1.1

Local IP address mask: 255.255.255.0

Default server IP address: 192.168.1.254

Console baud rate: 9600

GDB connection port: 9000

Force console for special debug messages: false

Network debug at boot time: false

Update RedBoot non-volatile configuration - continue (y/n)? y

... Erase from 0xa87e0000-0xa87f0000: .

... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .

RedBoot>

// Reboot, you're done with flashing!

reset

B) With Serial Port and Tftp Server:

- Extract the two Firmware Files onto an reachable tftp Server

- Connect the Wan Port to your Network

- Connect to Serial (9600 baud, 8 Bit Data, 1 Stop Bit, No Software/Hardware Flow Control)

- Power Up the Fonera and Press CTRL+C (within 2 Seconds)

You end up in RedBoot>

Enter these Commands:

// First IP is the Fonera IP/Subnet, Second is the TFTPServer

ip_address -l 192.168.2.99/24 -h 192.168.2.8

// Complete Kill of the Fonera Software:

fis init -f

// Download the Firmware Header and Root (fis can take about 20 Minutes!)

load -r -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma

fis create -e 0x80041000 -r 0x80041000 vmlinux.bin.17

load -r -b %{FREEMEMLO} openwrt-atheros-root.squashfs

fis create -l 0x6F0000 rootfs

// Configure Bootup, enter:

fconfig

// Enter Bootup Script, enter these two lines and press Enter a third time

fis load -l vmlinux.bin.17

exec

// The complete Config should look like that (nothing else changed as the Bootup Script!)

RedBoot> fconfig

Run script at boot: true

Boot script:

Enter script, terminate with empty line

>> fis load -l vmlinux.bin.17

>> exec

>>

Boot script timeout (1000ms resolution): 2

Use BOOTP for network configuration: false

Gateway IP address:

Local IP address: 192.168.1.1

Local IP address mask: 255.255.255.0

Default server IP address: 192.168.1.254

Console baud rate: 9600

GDB connection port: 9000

Force console for special debug messages: false

Network debug at boot time: false

Update RedBoot non-volatile configuration - continue (y/n)? y

... Erase from 0xa87e0000-0xa87f0000: .

... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .

RedBoot>

// Reboot, you're done with flashing!

reset

c) Via Fon Flash:

- Get FonFlash (and install wpcap Drivers as well, are included in Wireshark)

- Start FonFlash

- Select your Network Interface Card

- Select Rootfs (openwrt-atheros-root.squashfs)

- Select Kernel (openwrt-atheros-vmlinux.lzma)

- Press Flash Router now and Power Up the Fonera.

- Takes approx. 20 Minutes

2.) Connect and Basic Settings

// telnet to 192.168.1.1 and change the root passwd to enable SSH.

telnet 192.168.1.1

passwd

ilovepineapples

ilovepineapples

3.) Fixing Webif

You got two Webinterfaces on the Jasager.

First the Karma/Jasager one at 192.168.1.1:1471,

and Second the Webif/X-Wrt on 192.168.1.1.

In Webif, you can change things like IP Adresses and watch a bunch of data.

Easy configuration for your Fon+ if you're not so used to the CLI in Linux.

Now that you have changed the root password and therefor have access to ssh,

you can use putty to connect to 192.168.1.1

a) Opkg

echo "src X-Wrt http://downloads.x-wrt.org/xwrt/kamikaze/8.../packages" >> /etc/opkg.conf

opkg update

opkg remove -recursive luci-*

opkg update

opkg install webif

reboot

B) Manual

// Remove Previous Install

opkg -recursive remove haserl

// Download and move these files to the tmp directory on the fon using winSCP

haserl_0.9.24-1_mips.ipk

webif_0.3-4709_mips.ipk

webif-theme-xwrt_0.3-4709_all.ipk

// Install the files using putty.

opkg install haserl_0.9.24-1_mips.ipk

opkg install webif_0.3-4709_mips.ipk

opkg install webif-theme-xwrt_0.3-4709_all.ipk

4.) Enable Wireless

uci set wireless.wifi0.disabled=0

uci commit wireless && wifi

reboot

5.) Duplicate Ports (only on Fon+ 2201)

This does enable you to use the Wan Port to connect the Jasager to an Wan Source

(i.e. another Router) - which does get its IP and Config via dhcp Client.

Than you can plug your PC \ Laptop to the Lan Port and can sniff there the Traffic

the Wifi User does create. So you don't need any ICS or Stuff anymore...

Its cool and easy, BUT BEWARE(!) - this cloning works in both directions -

So if YOU surf the net on your PC \ Laptop, the Wireless User can see it aswell!

(However, it did not yet work out for me...)

// Enter UCI Commands

uci set network.wifi=interface

Fon+ has 3 interfaces lan, wan wifi – by default wifi interface is not configured

uci set network.wifi.ifname=ath0

uci set network.wifi.proto=static

uci set network.wifi.ipaddr=192.168.1.1

uci set network.wifi.netmask=255.255.255.0

// uci set network.wifi.dns=192.168.1.1 (If you want to set it)

uci set dhcp.cfg0875fa=dhcp

uci set dhcp.cfg0875fa.start=2

uci set dhcp.cfg0875fa.limit=250

uci set dhcp.cfg0875fa.leasetime=60m

uci set dhcp.cfg0875fa.ignore=0

uci set dhcp.cfg0875fa.interface=wifi

uci commit

// Activate External Firewall Rules

vi /etc/config/firewall

// uncomment the following line

# include a file with users custom iptables rules

config include

option path /etc/firewall.user

// Enter Firewall Rules to Allow Lan/Wlan Port "Crossover"

vi /etc/firewall.user

// Add the following lines

iptables -I zone_lan_forward -i br-lan -o br-lan -j ACCEPT

//Reboot

reboot

6.) There is no Step 6. Have fun!

[chasebadkids]

Great tutorial... Ive been going with option 1b... I tried 1c and never got it to say anything other than 'no packet' I get into redboot and then follow the steps you mention, only instead of saying

load -r -b %{FREEMEMLO} openwrt-atheros-vmlinux.lzma

I say

load -r -b %{FREEMEMLO} openwrt-atheros-2.6-vmlinux.lzma

and instead of

load -r -b %{FREEMEMLO} openwrt-atheros-root.squashfs

I say

load -r -b %{FREEMEMLO} openwrt-atheros-2.6-root.squashfs

everything seems to go well, but when I type fconfig, I enter the two commands you say to issue, press return twice, then it comes up immediately asking things about boot scropt timeout, ip addresses, etc etc... Ive followed through this, didnt change anything other than the default gateway to 192.168.1.1 since thats its address and its the default gateway, I press y at the very end to have it write and save the config file , and then I enter reset and it resets, Ive left it for a long period of time and nothing ever seems to happen. Ive done all of this on both the WAN and LAN ports... any help is greatly appreciated.

[nmaas87]

Hi chasebadkids!

Glad you like it.

I did download Digininjas Firmware Package again just to be sure - and my Filenames are correct.

I don't know where you get the openwrt-atheros-2.6-vmlinux.lzma and openwrt-atheros-2.6-root.squashfs from, but thats not the name thats used in the official package. So I would encourage you to download his Jasasger 1.0 Firmware Package from his website again and try it.

As for the boot settings, yeah sorry I did not mention it, but you should NOT set anything else.

It should look that way:

RedBoot> fconfig
Run script at boot: true
Boot script:
Enter script, terminate with empty line
>> fis load -l vmlinux.bin.17
>> exec
>>
Boot script timeout (1000ms resolution): 2
Use BOOTP for network configuration: false
Gateway IP address:
Local IP address: 192.168.1.1
Local IP address mask: 255.255.255.0
Default server IP address: 192.168.1.254
Console baud rate: 9600
GDB connection port: 9000
Force console for special debug messages: false
Network debug at boot time: false
Update RedBoot non-volatile configuration - continue (y/n)? y
... Erase from 0xa87e0000-0xa87f0000: .
... Program from 0x80ff0000-0x81000000 at 0xa87e0000: .
RedBoot>

So do NOT enter some Gateway. By the way - if you're Gateway at home is 192.168.1.1 - and you plugin the Jasager to your net, that will give some bang - as it also uses 192.168.1.1 - so just plug it in straight to your pc and test it - then it shall respond. And another thing - if you entry there 192.168.1.1 as gateway in redboot, and the jasager is using 192.168.1.1 as its own ip adress - maybe could cause some other problems, so just let it be, reflash your fonera with the orginal firmware package, correct the startup script and rest to the printout above and plug it straight into your pc (if you got an fon+, plug in to lan as it got 192.168.1.1) - and if you ever got problems - your serial cable will be your personal jesus/hero/whatever ;-).

good luck and thanks for the comment! ^^

[chasebadkids]

Bad news....

I got impatient and went ahead and changed settings in my fconfig,

Now I cant ping my fonera, Ive tried countless different ips, 192.168.10.1 192.168.1.1 192.168.1.254 , etc etc... Multiple times, Ive even used nmap to try to and pingscan on every single different address in the 192.168.*.* address.

At this point it looks like Im going to have to make a serial cable and hope that that works =[

I have a Fon + I believe (I bought it off craiglist), on the bottom it says its Model: Fon2201

Eeeks..

[nmaas87]

Well, *hit happens, but its not dead *yet*.

I'm a little wondering that you could change fconfig without an serial cable?! O.o''...

How did you manage to do that?

Yeah the 2201 is the Fon+.

There is an important thing to mention on Fon+:

Wan Port is on dhcp there, so if you plug in Network there, Jasager will try to supply you with an IP.

Lan Port is set fixed on 192.168.1.1. So If everything worked and got well, you can plug in there with an fixed IP of, lets say, 192.168.1.2 / 24 (255.255.255.0) and open up telnet. (Telnet first, as SSH is disabled as said on Step.. 2 or so...)

Yeah build yourself an serial cable, it shall come in handy on so damn many occassions. I did build my first serial cable for an WGT634U about 4 Years ago and so, any funny thing was, that the Pin Alligement was exact the same with the Fon+, so I could "recyle" it for the moment beeing as my Fon+ had not yet an built in Serial...

Just write back as soon as you got the serial cable and can access that little thingy.

Good Luck,

Xeno

[chasebadkids]

I managed to change the fconfig file through redboot by just connecting to the fon via telnet on port 9000 within the first few seconds of it booting up.

I just purchased

http://cgi.ebay.com/ws/eBayISAPI.dll?ViewI...em=220512140127

When it gets here, I will make the cable *hopefully i dont mess up* and then Ill try to hook that baby up and get into redboot, when I do, what should I read, where should I go, I want Jasager, or whatever best works/does what jasager does and more? :D

[nmaas87]

Aww.. that connector looks awesomely familiar:

http://www.digininja.org/projects/fon_serial_cable.php

Robin did also use that cable to build an serial thingy. Just follow and build after him, that should work.

First thing you should do: Correct the Redboot Settings again. And then just follow my guide from top to down and it should work ^^.

Greetings,

Xeno

[digininja]

Sorry, come in late on this discussion.

The cable is the one that I use. Bulk order them from China and they usually come in anywhere between a few days and a couple of weeks.

[chasebadkids]

Good news, I have not fallen off the edge of the Earth, turns out I ordered my cable from Hong Kong, thus leading to a very long and slow delivery, finally got my cable, Stripped it to the seperate cables, got my red, white and yellow cables connected up to my Fon as designated in the tutorial, instsalled the drivers for the cable that I ordered, and using putty Im trying to connect using the options specified, and Im getting a "Unable to oppen connection to COM1 Unable to open serial port" error.

help?!

[nmaas87]

Good thing!

Seems to be like you're trying to open on an Serial Connection that doesn't exist.

Putty is an good choice, so plug in your Serial Usb Adapter, and check in the Hardware Manager which "Com Port" your Usb Cable is... OR download TeraTerm Pro: http://www.heise.de/software/download/teraterm_pro/51776 and just start it - in the first menu it will ask you wheter it shall open an TCP/IP Connection or an Serial one. Choose Serial. And it will show which Serial Adaptors are installed. Choose your Cable and press ok. The rest of the settings should be ok as default should already be what its set too. If it doesn't show you any serial connection you seem to have not successfully installed the usb/serial cable.

And I had the problem with fon 2100 myself that both of ap51 and fonflash did NOT respond and gave the exact output you delivered. turned out that some variables in redboot were wrong - so I can encourage you here, you very well be thats the same case with yours! ^_^

fgreets,

xeno

[chasebadkids]

First off Xenomorph I wanted to stop and say THANK you for your assistance so far, in all my years of using message boards / forums Ive never come across such a helpful person ;) , usually its impossible to get anywhere with anyone!

Anyways, Got my serial cable working (AHH did that feel great!)

I went ahead and followed your instructions in regards to 1a (Flashing with only serial port)

It seemed to take the commands just fine, (which perplexes me since Im not exactly sure WHERE it pulled those files, I mean I have them on my laptop, but not anywhere that I would think it can find.

after initiating reset it boots back up and says

one it goes to boot up it says theres a timeout to get into redboot, I let it pass...

On its own it enters as a command:

redboot> "fis load -l vmlinux.bin.17"

then it says

"stream version is not supported.

lzma_decode failed. res=1

"

and then again on its own it initializes the

redboot> exec

then it states

"Now booting to linux kernel:

base address 0x80030000 Entry 0x80041000

Cmdline:

"

So, judging by this, have I done anything wrong,

When I download the correct images, where should they be extracted to?

should I have to assign a static IP address on my system?

Oh and P.S. In order to figure out what COM port to connect to via Serial, I used the windows "device manager" (right click my computer > manage > device manager " and then plugged in my cable, saw it needed a driver (again, I installed three different drivers off the cd that shipped with it in total) and then it stated in that menu which COM port it wanted, (which was 7)

Thanks!!!

-Kris

(Im so close, I can almost taste the pineapple!)

[chasebadkids]

note*** still troubleshooting, now realizing that it appears while my system in 'redboot' Im able to ping it at 192.168.1.1 but cannot telnet, as soon as its actually trying to boot the firmware, I am no longer able to ping!

*stay tuned*

****UPDATE*****

I used method 1b (serial + tftp) and finally got the image layed down!!! booted up, via the serial connection I am at the serial interface for the fon ( where it loads and says Busy Box and has fon written out with all the symbols)

anyways,

if I run ifconfig, eth0 has no assigned IP, so I manually set it to 192.168.1.1 , Ive put the cable into WAN and LAN, I cannot ping the system from my laptop, cant telnet, and cant get a webgui.

From the fon, I can now ping 192.168.1.1 (Its own address), but cannot ping out to my laptop,

same story with my laptop, it can ping itself 192.168.1.13 but will not ping 192.168.1.1

[digininja]

Try setting the IP on br-lan or br0, can't remember which is default. eth0 is bridged with ath0 so traffic can flow between the two, while in the bridge it is the bridge that needs the IP address.

[chasebadkids]

I dont see the devices br-lan or br0 listed.

I have

ath0

eth0

eth0.1

eth0.2

lo

wifi0

[digininja]

in which case put it on eth0.1 or .2. eth0 is the virtual interface, .1 and .2 refer to the two real ports.

Try running

brctl show

and see what that gives back

[chasebadkids]

brctl show returned

bridge name bridge id stp enabled interfaces

and nothing was listed underneath =[

[digininja]

so there isn't a bridge setup, thats ok, an IP on .1 or .2 should give you connectivity

[chasebadkids]

I've assigned eth0, eth0.1 and eth0.2 all a static ip address of 192.168.1.1 , tried it both on the WAN and LAN ports,

ill give you a sum of what ifconfig eth0.1 says right now

link encap: thernet HWaddr <MAC>

inet addr: 192.168.1.1 Bcast 102.168.1.255 Mask 255.255.255.0

UP BROADCAST RUNNING MULTICAST MTU: 1500 Metric: 1

RX packets: 117, errors: 0, dropped: 0, overruns:0 ,frames: 0

TX packets: 3, errors:0, dropped: 0, overruns:0, carrier:0

collissions: 0 txquelen:0

rx bytes: 14902 (14.5 kib) tx byes: 487.0b

Which leads me to believe, that since It is (RX) receiving, packets, its receiving my ping requests, but for some reason its not knowing to reply that yes, that is its own address?

[chasebadkids]

I've assigned eth0, eth0.1 and eth0.2 all a static ip address of 192.168.1.1 , tried it both on the WAN and LAN ports,

Ill give you a sum of what ifconfig eth0.1 says right now

link encap: thernet HWaddr <MAC>

inet addr: 192.168.1.1 Bcast 102.168.1.255 Mask 255.255.255.0

UP BROADCAST RUNNING MULTICAST MTU: 1500 Metric: 1

RX packets: 117, errors: 0, dropped: 0, overruns:0 ,frames: 0

TX packets: 3, errors:0, dropped: 0, overruns:0, carrier:0

collissions: 0 txquelen:0

rx bytes: 14902 (14.5 kib) tx byes: 487.0b

Which leads me to believe, that since It is (RX) receiving, packets, its receiving my ping requests, but for some reason its not knowing to reply that yes, that is its own address?

I noticed too, that when I go into /www and do an LS -l , there are no files, do I have the wrong thing installed or something?????

it says:

busybox v1.14.4 (2009-10-25 02: 52:59) built in shell (ash)

open wrt...kamikaze, bleeding edge, r18255

10oz vodka

10 oz triple sec

10 oz lime juice!?!

Not sure if it will help or not, but I went ahead and had my terminal program write a log of everything, so If you want to check it out

http://pastebin.com/m1a30bad

it shows my bootup, plus me running ifconfig, assigning IP addresses, pinging, not getting reply, and another run of ifconfig..

Not sure if that would help diagnose my problem.

[chasebadkids]

Not sure if it will help or not, but I went ahead and had my terminal program write a log of everything, so If you want to check it out

http://pastebin.com/m1a30bad

it shows my bootup, plus me running ifconfig, assigning IP addresses, pinging, not getting reply, and another run of ifconfig..

Not sure if that would help diagnose my problem.

[chasebadkids]

ARGH!

So Sorry for the confusion, So I realized that I got too used to the "quick post" button, and was posting multiple thigns in a row, rather than keepin them all in one post, so I went to go back and edit my posts, but whenver I click on my last post, or my second to the last post, it goes to edi the first post ... ? and it wont let me delete any....

Anyways....

I fired up wireshark and pointed it to eth0

some source named: quantaco_30:0a:f9 sent out a BROADCAST arp request asking "Who has 192.168.1.1? tell 192.168.1.254"

then

some source named: fon_a0:c1:c0 sent a message to destination quantaco_30:-a:f9 an arp reply that 192.168.1.1 is at mac address: 00:18:84:a0:c1:c0 which, when I run an ifconfig on my fon, is the mac address for eth0, eth0.1 and eth0.2

then later,

from source: FON_a0 to desination Quantco, an arp request asking who has 192.168.1.254

and

from source: quantco to deisnation FON, an arp reply saying that 192.168.1.254 is at 00:23:8b:30:9a:f9

which IS the mac address of my ethernet NIC on my laptop.

So apparently communication is going on, theyre seeing eachother,

What do I do? :-X

[chasebadkids]

Honestly, right now Im not sure at all how the heck it decided to start working... I fired up wireshark on my laptop to figure out whats going on, and all of the sudden they systems can see eachotehr and ping back and forth.

Im trying to run opkg update right now and its not resolving any of the web addresses though, any idea why?

also, trying to TELNET doesnt work, but ssh does. Through my serial connection I was able to reset the password for my fon, and can login via ssh.

but now if I go to 192.168.1.1 in my browser, it says 404 not found, so it is finding my webserver, but since theres no files in www.....?

it wont establish a connection at 192.168.1.1:1471

***NOTE****

okay, so Id been doing this all day at my office and finally had to pack up for the day and come home, and now since being home, somethign got reset because now I cant ping, and I cant ssh.

[nmaas87]

mh ok to make it short:

as you tried flashing with serial cable only, it seemd like some crc error or something happend as the image is corrupted. thats why you got the error.

so, if i were you i would do the tfptboot flashing AGAIN.

sounds funny, but i had similar problems myself upon "first flash"

so try to flash it again if the jasager image from digininjas website.

and see wheter you got the bridge then!

and to your previous comment: I'm always glad wheter I can help out ^_^.

We get this thingy up in running, I'm sure! ^_^

[chasebadkids]

so I went ahead and reflashed with definitely freshly downloaded images, did it via SERIAL + tftp

edited fconfigs boot, got it to boot to the openwrt kamikaze screen, I now have a bridge device, as well as eth0, eth0.0 and eth0.1 , on both lan and wan , It sems br-lan got an ip on its own, (cool) but, when I try to ping it, no reply... I went ahead and manually set all the eth ports to the same ip, brought the interfaces down and up and got no result.

:-/

[digininja]

You can't put the same IP on multiple interfaces, that will break things.

Put an IP on eth0.1 and bring it up, see if you can ping it from the laptop, if not then change the cable to the other ethernet port and keep the ping going.

Do not use eth0, that won't work, it is just a virtual interface.