9 Jun
2019
9 Jun
'19
9:47 a.m.
Hi,
I love this project and have already set up a local mesh with a few
routers. My concern is that I want to be able to control who adds nodes to
the mesh, from what I can tell, just having a flashed router set up with
the correct Mesh ID adds it to the routing table, which is a worry if you
want a more controlled roll-out, i.e. how do you stop a malicious actor
adding a mesh router and just sniffing all the packets (assuming nobody
uses VPN or TLS of course, it's hypothetical)?
I tried to set up an encrypted mesh with 802.11s but the mesh netowrks
vanished after adding he packages and configuration change, I assume
because of the two-rdio issue described elsewhere. I was wondering if
something simpler, like a MAC whitelist or a node IP whitelist is possible
to simply make the network growth a bit more manageable?
I understand this goes against the "Libre" principle, and may not be viable
with a distributed network, but given I do not have the netowrk skill to
figure this out on my lonesome I thought I'd ask.
Cheers,
Martin
9 Jun
9 Jun
9:55 a.m.
Hi Martin,
On Sun, Jun 09, 2019 at 09:47:01PM +1200, Martin Buhr wrote:
Hi,
I love this project and have already set up a local mesh with a few
routers. My concern is that I want to be able to control who adds nodes to
the mesh, from what I can tell, just having a flashed router set up with
the correct Mesh ID adds it to the routing table, which is a worry if you
want a more controlled roll-out, i.e. how do you stop a malicious actor
adding a mesh router and just sniffing all the packets (assuming nobody
uses VPN or TLS of course, it's hypothetical)?
I tried to set up an encrypted mesh with 802.11s but the mesh netowrks
vanished after adding he packages and configuration change, I assume
because of the two-rdio issue described elsewhere. I was wondering if
something simpler, like a MAC whitelist or a node IP whitelist is possible
to simply make the network growth a bit more manageable?
We are using SAE with a pre-shared-key as well as BMX7 with signed
routing information to implement granular access control to our local
mesh and gateway here in Leipzig. Which issue are you refering to and
what do you mean by 'vanished'?
I understand this goes against the "Libre" principle, and may not be viable
with a distributed network, but given I do not have the netowrk skill to
figure this out on my lonesome I thought I'd ask.
Cheers,
Martin
_______________________________________________
lime-users mailing list
lime-users(a)lists.libremesh.org
https://lists.libremesh.org/mailman/listinfo/lime-users
10:47 a.m.
Hi Daniel,
Thanks for the quick reply, really appreciate the ray of hope that it's indeed
possible!
We are using SAE with a pre-shared-key as well as BMX7 with signed
routing information to implement granular access control to our local
mesh and gateway here in Leipzig. Which issue are you refering to and
what do you mean by 'vanished'?
>
When I set up /etc/config/lime config file with the options from this PR:
https://github.com/libremesh/lime-packages/pull/416/files
(After having installed the required wpad-mesh dependency)
And applying the config, the SSIDs for the AP and mesh SSID both disappeared from my scan
lists when I tried to connect with a laptop or phone.
When I looked into it some more I saw the comment that this configuration might(?) require
two radios, one for the mesh and one for the AP. Unfortunately in my lab I only have one
router with two radios, the other only has one.
I might try to configure the two-radio router to only use the 11s encryption on one radio,
then bridge the AP network somehow, but not sure where to start.
Is there some detailed documentation I can follow for your (or a similar) setup? I
haven't tried rolling my own build yet, I feel that's the next step...
I think the thing tripping me up is that I don't know where to start figuring this
out.
If you have some resources I can use to get up to speed on how it all fits together I can
figure it out, I'm new to OpenWRT, so I may have bitten off more than I can chew!
Cheers,
Martin
5:18 p.m.
Hi Martin,
On Sun, Jun 09, 2019 at 10:47:47PM +1200, Martin Buhr wrote:
Hi Daniel,
Thanks for the quick reply, really appreciate the ray of hope that it's indeed
possible!
We use this on ath9k single-radio devices with AP+mesh on the same
radio and it works very ok.
We are using SAE with a pre-shared-key as well as BMX7 with signed
routing information to implement granular access control to our local
mesh and gateway here in Leipzig. Which issue are you refering to and
what do you mean by 'vanished'?
>
When I set up /etc/config/lime config file with the options from this PR:
https://github.com/libremesh/lime-packages/pull/416/files
(After having installed the required wpad-mesh dependency)
And applying the config, the SSIDs for the AP and mesh SSID both disappeared from my scan
lists when I tried to connect with a laptop or phone.
When I looked into it some more I saw the comment that this configuration might(?)
require two radios, one for the mesh and one for the AP. Unfortunately in my lab I only
have one router with two radios, the other only has one.
I might try to configure the two-radio router to only use the 11s encryption on one
radio, then bridge the AP network somehow, but not sure where to start.
In LibreMesh with have community presets, what we are using here is
freifunk/80211s-sae-bmx7-batadv ie.
https://github.com/libremesh/network-profiles/blob/master/freifunk/80211s-s…
Apart from setting ap_ssid and naming the nodes, no further changes
are made. On some nodes we do change frequency and channel width, to
avoid collisions/overlap with other existing networks.
Is there some detailed documentation I can follow for your (or a similar) setup? I
haven't tried rolling my own build yet, I feel that's the next step...
I think the thing tripping me up is that I don't know where to start figuring this
out.
If you have some resources I can use to get up to speed on how it all fits together I can
figure it out, I'm new to OpenWRT, so I may have bitten off more than I can chew!
First of all: Which hardware are you trying to run this on?
Cheers,
Martin
_______________________________________________
lime-users mailing list
lime-users(a)lists.libremesh.org
https://lists.libremesh.org/mailman/listinfo/lime-users
10 Jun
10 Jun
3:13 a.m.
Hi Daniel,
Thanks for getting back to me with those resources - they gave me another angle to track.
In LibreMesh with have community presets, what we are
using here is
freifunk/80211s-sae-bmx7-batadv ie.
https://github.com/libremesh/network-profiles/blob/master/freifunk/80211s-s…
Apart from setting ap_ssid and naming the nodes, no further changes
are made. On some nodes we do change frequency and channel width, to
avoid collisions/overlap with other existing networks.
Right, I looked at this one and compared it to the LibreMesh/encrypted11s one and they are
quite similar.
I built myself an image with this preset and flashed it, unfortunately the same thing
happened as before - all interfaces were not sending / receiving and the APs were not
visible.
When I manually edited the config to comment out the encryption and key lines, the APs
magically came back online.
First of all: Which hardware are you trying to run
this on?
A TP-Link WDD4300 initially
Cheers,
Martin
5:36 a.m.
On Mon, Jun 10, 2019 at 03:13:42PM +1200, Martin Buhr wrote:
Hi Daniel,
Thanks for getting back to me with those resources - they gave me another angle to
track.
...encryption of the 802.11.s mesh interface, I assume...?
Also note that you will need to use a build based on OpenWrt 'master',
in the 18.06 release (and hence the LibreMesh release built on-top)
this didn't work yet.
In LibreMesh with have community presets, what we
are using here is
freifunk/80211s-sae-bmx7-batadv ie.
https://github.com/libremesh/network-profiles/blob/master/freifunk/80211s-s…
Apart from setting ap_ssid and naming the nodes, no further changes
are made. On some nodes we do change frequency and channel width, to
avoid collisions/overlap with other existing networks.
Right, I looked at this one and compared it to the LibreMesh/encrypted11s one and they
are quite similar.
I built myself an image with this preset and flashed it, unfortunately the same thing
happened as before - all interfaces were not sending / receiving and the APs were not
visible.
When I manually edited the config to comment out the encryption and key lines, the APs
magically came back online. First of all: Which hardware are you trying to
run this on?
A TP-Link WDD4300 initially
Cheers,
Martin
_______________________________________________
lime-users mailing list
lime-users(a)lists.libremesh.org
https://lists.libremesh.org/mailman/listinfo/lime-users
8:54 a.m.
Hi Daniel,
Looks like that's where I went wrong, I will try that again (I think the cloud chef
builder on the site provides a version based on master).
I did try that before, but I was worried about using an unstable build.
Will give it another go. Thanks for the tips!
...encryption of the 802.11.s mesh interface, I
assume...?
Also note that you will need to use a build based on OpenWrt 'master',
in the 18.06 release (and hence the LibreMesh release built on-top)
this didn't work yet.
Cheers,
Martin
12:21 p.m.
Hi Martin, I hear the chef might give unstable results at the moment. When I asked last
month about the best source for current firmware, the answer was:
https://lists.libremesh.org/pipermail/lime-users/2019-May/001467.html
El 10 de junio de 2019 3:54:03 a. m. GMT-05:00, Martin Buhr <martin(a)buhr.co>
escribió:
Hi Daniel,
Looks like that's where I went wrong, I will try that again (I think
the cloud chef builder on the site provides a version based on master).
I did try that before, but I was worried about using an unstable build.
Will give it another go. Thanks for the tips!
...encryption of the 802.11.s mesh interface, I
assume...?
Also note that you will need to use a build based on OpenWrt
'master',
in the 18.06 release (and hence the LibreMesh
release built on-top)
this didn't work yet.
Cheers,
Martin
15 Jun
15 Jun
9:02 p.m.
Hi Patricio,
Awesome - thanks for the tip.
I've managed to compile a couple of images (off master) this way, unfortunately
I'm not sure which combo of packages to install (and I can't seem to get Luci to
work at all). So it's all guesswork atm.
Does anyone have a config they can share (packages/collections) I can use as a baseline?
I feel I'm getting close, really appreciating the help!
Cheers,
Martin
On 11 Jun 2019, 12:21 AM +1200, Patricio Gibbs via lime-users
<lime-users(a)lists.libremesh.org>rg>, wrote:
Hi Martin, I hear the chef might give unstable results
at the moment. When I asked last month about the best source for current firmware, the
answer was:
https://lists.libremesh.org/pipermail/lime-users/2019-May/001467.html
El 10 de junio de 2019 3:54:03 a. m. GMT-05:00,
Martin Buhr <martin(a)buhr.co> escribió:
> Hi Daniel,
>
> Looks like that's where I went wrong, I will try that again (I think the cloud
chef builder on the site provides a version based on master).
>
> I did try that before, but I was worried about using an unstable build.
>
> Will give it another go. Thanks for the tips!
>
> > ...encryption of the 802.11.s mesh interface, I assume...?
> > Also note that you will need to use a build based on OpenWrt
'master',
> > in the 18.06 release (and hence the LibreMesh release built on-top)
> > this didn't work yet.
>
>
> Cheers,
> Martin
_______________________________________________
lime-users mailing list
lime-users(a)lists.libremesh.org
https://lists.libremesh.org/mailman/listinfo/lime-users 
9:13 p.m.
Check the readme, it specifies how to get a working .config to start with.
On June 15, 2019 6:02:55 PM GMT-03:00, Martin Buhr <martin(a)buhr.co> wrote:
Hi Patricio,
Awesome - thanks for the tip.
I've managed to compile a couple of images (off master) this way,
unfortunately I'm not sure which combo of packages to install (and I
can't seem to get Luci to work at all). So it's all guesswork atm.
Does anyone have a config they can share (packages/collections) I can
use as a baseline?
I feel I'm getting close, really appreciating the help!
Cheers,
Martin
On 11 Jun 2019, 12:21 AM +1200, Patricio Gibbs via lime-users
<lime-users(a)lists.libremesh.org>rg>, wrote:
--
Enviado desde mi dispositivo Android con K-9 Mail. Por favor, disculpa mi brevedad.
Hi Martin, I hear the chef might give unstable
results at the moment.
When I asked last month about the best source for current
firmware, the
answer was:
https://lists.libremesh.org/pipermail/lime-users/2019-May/001467.html
> El 10 de junio de 2019 3:54:03 a. m. GMT-05:00, Martin Buhr
<martin(a)buhr.co> escribió:
> > Hi Daniel,
> >
> > Looks like that's where I went wrong, I will try that again (I
think
the cloud chef builder on the site provides a version based on
master).
> >
> > I did try that before, but I was worried about using an unstable
build.
> >
> > Will give it another go. Thanks for the tips!
> >
> > > ...encryption of the 802.11.s mesh interface, I assume...?
> > > Also note that you will need to use a build based on OpenWrt
'master',
> > > in the 18.06 release (and hence
the LibreMesh release built
on-top)
> > > > this didn't work yet.
> > >
> > >
> > > Cheers,
> > > Martin
> _______________________________________________
> lime-users mailing list
> lime-users(a)lists.libremesh.org
> https://lists.libremesh.org/mailman/listinfo/lime-users
10:04 p.m.
LuCI is absent from current LibreMesh. Instead, go to thisnode.info/app . The same thing
happened to me last week :)
El 15 de junio de 2019 4:02:55 p. m. GMT-05:00, Martin Buhr <martin(a)buhr.co>
escribió:
Hi Patricio,
Awesome - thanks for the tip.
I've managed to compile a couple of images (off master) this way,
unfortunately I'm not sure which combo of packages to install (and I
can't seem to get Luci to work at all). So it's all guesswork atm.
Does anyone have a config they can share (packages/collections) I can
use as a baseline?
I feel I'm getting close, really appreciating the help!
Cheers,
Martin
On 11 Jun 2019, 12:21 AM +1200, Patricio Gibbs via lime-users
<lime-users(a)lists.libremesh.org>rg>, wrote:
Hi Martin, I hear the chef might give unstable
results at the moment.
When I asked last month about the best source for current
firmware, the
answer was:
https://lists.libremesh.org/pipermail/lime-users/2019-May/001467.html
> El 10 de junio de 2019 3:54:03 a. m. GMT-05:00, Martin Buhr
<martin(a)buhr.co> escribió:
> > Hi Daniel,
> >
> > Looks like that's where I went wrong, I will try that again (I
think
the cloud chef builder on the site provides a version based on
master).
> >
> > I did try that before, but I was worried about using an unstable
build.
> >
> > Will give it another go. Thanks for the tips!
> >
> > > ...encryption of the 802.11.s mesh interface, I assume...?
> > > Also note that you will need to use a build based on OpenWrt
'master',
> > > in the 18.06 release (and hence
the LibreMesh release built
on-top)
> > > > this didn't work yet.
> > >
> > >
> > > Cheers,
> > > Martin
> _______________________________________________
> lime-users mailing list
> lime-users(a)lists.libremesh.org
> https://lists.libremesh.org/mailman/listinfo/lime-users 
16 Jun
16 Jun
9:35 a.m.
Daniel, what do you mean here?
...encryption of the 802.11.s mesh interface, I
assume...?
Also note that you will need to use a build based on OpenWrt 'master',
in the 18.06 release (and hence the LibreMesh release built on-top)
this didn't work yet.
given http://chef.libremesh.org/ what is OpenWrt 'master'. Do you mean
"Distribution: Libremesh" and "Version: master" ?
Thanks
10:32 a.m.
On Sun, Jun 16, 2019 at 11:35:54AM +0200, guifipedro wrote:
Daniel, what do you mean here?
yes, exactly.
...encryption of the 802.11.s mesh interface, I
assume...?
Also note that you will need to use a build based on OpenWrt 'master',
in the 18.06 release (and hence the LibreMesh release built on-top)
this didn't work yet.
given http://chef.libremesh.org/ what is OpenWrt 'master'. Do you mean
"Distribution: Libremesh" and "Version: master" ?
Thanks
_______________________________________________
lime-users mailing list
lime-users(a)lists.libremesh.org
https://lists.libremesh.org/mailman/listinfo/lime-users
2:46 p.m.
El 9 de junio de 2019 4:55:05 a. m. GMT-05:00, Daniel Golle <daniel(a)makrotopia.org>
escribió:
We are using SAE with a pre-shared-key as well as BMX7 with signed
routing information to implement granular access control to our local
mesh and gateway here in Leipzig.
Does this setup control client access too, or just node access?
What do you mean by "granular access control"? Allow some nodes or clients top
generate internet traffic and others only local traffic?
Having a community profile for "hardened LibreMesh" could be useful for various
installations. And might some of these security settings be sane defaults LibreMesh? I
remember once seeing a table in LuCI that showed me all the active connections,
effectively allowing me to spy on my neighbors, and I think the by default we don't
want that ability.
27 Jun
27 Jun
12:46 a.m.
Howdy folks,
I managed to get everything to work, woohoo! I thought I'd share my notes
here just in case someone else tries to get this running.
Encrypted mesh with Libremesh v17 (stable)
1. Make sure you are using dual-band routers
2. Install the libremesh firmware
3. Install wpad-mesh and remove wpad-mini
4. Edit the /etc/config/wireless file and find your two entries with mode
'mesh', there will be one for each radio. Comment out all the APs for one
radio and only leave the "mesh" point
5. Add the following to the mesh entry:
option encryption 'psk+aes'
option key 'foobarbaz'
6. Now for the other radio, comment out ONLY the mesh entry
7. Make note of which radio is being used for what
7. Reboot the router
8. Repeat steps 1-7 for your other routers
All this does is force one radio to act as your mesh and the other as your
AP, and surprisingly, this works just fine with v17, no custom or unstable
build required.
My realisation came when I managed to get one of my routers to work as an
encrypted mesh endpoint, but it stopped acting as an AP, so I got myself
another dual-band router and now it works. Basically you need two radios.
Admittedly, this was all noted in the Github issue, so I guess I could have
saved myself a lot of time by just following that more carefully.
Hope this helps someone in future & thanks for the awesome project!
Cheers,
Martin
1758
days inactive
1776
days old
lime-users@lists.libremesh.org
14 comments
5 participants
participants (5)
-
Daniel Golle -
guifipedro -
Martin Buhr -
Nicolas Pace -
Patricio Gibbs