freifunk-gluon / gluon

a modular framework for creating OpenWrt-based firmwares for wireless mesh nodes

Gluon

Gluon is a firmware framework to build preconfigured OpenWrt images for public mesh networks.

Overview

Gluon provides an easy-to-use firmware for a public, decentral WLAN and/or wire based mesh network. Common network capable devices, like smartphones, laptops or desktop PCs can connect to the mesh network and communicate over it, without the need of passwords for access and without the need of installing special software. Additionally, internet access and merging mesh clouds can be accomplished over a WAN through VPN connected gateways.

Gluon's features include:

• a decentral mesh network
• easy configuration mode for less techy users
• community-specific technical settings and customizations through a common site.conf and site.mk
• ecdsa signature-based autoupdater
• node status web page
• publication of node information + statistics through respondd
• a variety of preconfigured mesh and VPN protocols:

Supported mesh protocols:

• batman-adv (BATMAN IV fully, BATMAN V partially)
• OLSRv2 (partially)

Supported protocols for node-to-node connections:

• WLAN: 802.11s (with forwarding disabled)
• WAN: VPNs via fastd and Wireguard
• LAN: via VXLAN

Getting started

We have a huge amount of documentation over at https://gluon.readthedocs.io/.

If you're new to Gluon and ready to get your feet wet, have a look at the Getting Started Guide.

Gluon's developers frequent an IRC chatroom at #gluon on hackint. There is also a webchat that allows for uncomplicated access from within your browser. This channel is also available as a bridged Matrix Room at #gluon:hackint.org.

Issues & Feature requests

Before opening an issue, make sure to check whether any existing issues (open or closed) match. If you're suggesting a new feature, drop by on IRC or our mailinglist to discuss it first.

We maintain a Roadmap for the future development of Gluon.

Use a release!

Please refrain from using the main branch for anything else but development purposes! Use the most recent release instead. You can list all releases by running git tag and switch to one by running git checkout v2023.2.3 && make update.

If you're using the autoupdater, do not autoupdate nodes with anything but releases. If you upgrade using random main commits the nodes might break eventually.

Mailinglist

To subscribe to the list, send a message to:

[email protected]

To remove your address from the list, just send a message to the address in the List-Unsubscribe header of any list message. If you haven't changed addresses since subscribing, you can also send a message to:

[email protected]

gluon's Issues

expertmode: toggle batman-adv on WAN/LAN ports

It should be possible to enable batman-adv on ethernet ports so nodes can be connected by wire.

Check that the gluon configuration and the legacy configuration are equivalent

Configmode: Export mesh,client,wan bridges via VLAN

In addition to the planed toggling batman on LAN/WAN ports in Configmode, we should have the ability to deliver all possible networks encapsulated in a VLAN.

Use-case: There are one ethernet port devices like the ubnt bullet or nanostation. Several of these could be installed on the roof or ceilings such that they don't see each other via wlan mesh.
Then we like to mesh those devices via ethernet, so we need at least batman on the ethernet port. But we also like to distribute the client network to other devices. And connect at least one of the devices to the mesh via vpn. So we need access to all three networks.

Practical application:
In Kiel we have one facility where the client network is distributed via a in house cisco wlan router setup. Other mesh nodes are connected via cable and only one of the devices has an uplink.

gluon-luci-admin: enable only when in configmode

Just as gluon-configmode gluon-luci-admin should only be enabled when in configmode.

Verify site.conf structure

Before building the packages there should be an target which verify the structure of the site.conf and aborts the build process if not valid.

Create an upgrade path from the legacy firmwares to Gluon

autoupdater: Should allow multiple mirrors of firmware

What the title said.

In a case when we have a new firmware release we should have more than one point in a decentralized network to retrieve the release. Thus we can have
servers in the mesh clouds which can provide local nodes with updates in case
of intercloud disconnection issues. Last case could for example happen when we are in a mesh protocol changing phase or when we change the cyphers in the intercloud vpn.

Think this must not be ready for the first gluon release.

Should we set PACKAGE_luci-lib-core_stripped=y?

This will precompile and strip luci modules in order to reduce size.

ebtables rules should prevent RAs received on LAN ports from reaching the mesh

Hardware Targets

• TL-MR3020
• TL-MR3040
• TL-MR3220
• TL-MR3420
• TL-WDR3500
• TL-WDR3600
• TL-WDR4300
• TL-WR1043ND
• TL-WR741N
• TL-WR741ND
• TL-WR841ND
• TL-WR842N
• Bullet M2
• NanoStation M2
• NanoStation loco M2
• Unifi AP
• Unifi AP LR
• NanoBridge M2

Make node advertise the ULA prefix by itself

uhttpd should listen on [::]:80 (needed for statuspage)

configmode reboots too soon so the pubkey is not visible

Don't run everything as root

Most services don't need root privileges (e.g. fastd).

Review services used by gluon and create one or more new user accounts for them.

eth0 in br-client on Bullet M, UniFi AP and Nanostation loco M

Bullet M, UniFi APs and Nanostation loco M have only one ethernet port (eth0). This port should be used as a WAN port. However, in the version I just built it is assigned to br-client.

• ar71xx_board_name returns unifi / bullet-m

add package iwinfo

replace vis with alfred

Alfred will replace batman-adv visualisation. It should announce the following information:

• visualisation
• hostname
• firmware version
• br-freifunk's MAC and IPv6
• GPS coordinates
• hardware model
• autoupdater status (enabled/disabled)
• uptime

Add /etc/cron.d/ so packages can install cronjobs

Gluon will depend on periodic jobs (e.g. autoupdater, alfred announcements). Unfortunately, there is no simple way to define such jobs from within a package.

OpenWRT provides /etc/crontabs/ for storing crontabs. In this directory one can create a crontab for a single user. Usually, there will be a file named root containing most jobs. Within gluon almost all jobs will run as root so each package installing /etc/crontab/root would overwrite other packages jobs.

Therefore, I think we should introduce a special crontab directory where multiple crontabs to be run as root can be stored. Suggested path: /etc/cron.d/

A special init script could just concatenate all files within said directory, put the result somewhere on the ramdisk and run a crond. This will allow other packages to place files like /etc/cron.d/autoupdater and /etc/cron.d/alfred without conflicts.

Use /var/gluon/config-mode/config instead of /etc/config for everything in config mode/expert mode

configmode: wrong hostname in the final page of the wizard

In the final page of the wizard the wrong hostname is displayed. This is very confusing, especially when the back button leads in a connection fail.

Fixing the hostname in this case should fix this problem.

• fix configmode
• fix site.conf text

decide on what the site-specified repo should contain

configmode: split into simple and advanced mode

Configmode should be split into a simple and an advanced mode. Simple-mode will contain just the necessary wizards to setup a new node while the advanced mode will feature additional options geared towards special node setupts.

Simple mode features:

• hostname
• fastd setup
• GPS coordinate
• disable/enable bandwidth limitation
• set bandwidth limit
• disable/enable autoupdater (without further options)

Advanced mode features:

• set root password
• manage ssh pubkeys
• configure autoupdater
• firmware upgrade
• factory reset
• toggle batman-adv on WAN/LAN ports

bandwidth limit package

Generic limits for arbitrary interfaces.

Add "split-horizon for multicast payload frames" patch for batman-adv

With this patch, we can eliminate the next, upcoming bottleneck, the DSL upload bandwidth:

https://lists.open-mesh.org/pipermail/b.a.t.m.a.n/2013-September/010586.html

And should be enabled on the fastd VPN interface on the embedded mesh routers. That way we spare the rebroadcast of multicast payload frames arriving on the VPN interface on this same interface.

Fix NTP

Make the nodes use an NTP server in the mesh.

allow SSH on WAN port

Currently the firewall will block SSH on the WAN port. This is not desired in most circumstances.

configmode: translate texts, replace placeholders, ...

lock password by default

By default the root password should be locked. It should be possible to set it from configmode (web + telnet).

packages: gluon/gluon-autoupdater: refactor generic parts out of the gluon-specific package

The autoupdater is pretty generic and should be usable on a vanilla OpenWRT, too. Therefore having the 'gluon-' prefix seems unnecessary to me.

However simply removing the gluon prefix might not be so nice either, the name "autoupdater" seems a bit too generic to get upstream in the OpenWRT package repository - a fancy, unique name for the autoupdater would be needed, I suppose.

kmod-usb2 missing on targets with USB ports

configmode: make welcome text configurable in site.conf

Fix configuration of multiple radios

Disable vis in batman-adv kernel module?

I've uploaded a batman-adv branch based on 2013.4.0 without vis at https://github.com/NeoRaider/batman-adv-legacy/tree/no-vis . This version still forwards vis packets from other nodes, but doesn't generate vis data itself.

Merging vis information from the old nodes and the new batadv-vis data from alfred should be trivial (and has to be done anyways), do we want to use the patched version?

If there are no objections, I'll include the new version in our feeds sometime in the next days, so it gets a lot of testing. We should probably extend our vis servers to support alfred and merge the data as soon as possible so both old and new nodes are shown.

configmode: validate hostname

Ubiquity Nanostation loco M2 needs bullet-m image

Ubiquity Nanostation loco M2 (and probably Picostation M2 HP) should be flashed using the bullet-m image as it does only have one ethernet port.

This fact should end up in the documentation.

configmode: fastd, show node name

configmode should show the node's hostname in addition to the public key in order to simplify the procedure of adding new fastd keys.

Review and migrate firewall rules from the legacy firmware

Solve odhcp6c problems

The new OpenWRT IPv6 stack based on odhcp6c still has a number of issues. This ticket is supposed to keep track of them.

• https://dev.openwrt.org/ticket/14268
• https://lists.openwrt.org/pipermail/openwrt-devel/2013-September/021661.html

autoupdater: store crontab in /etc/cron.d/ and remove custom initscript

configmode/expertmode: revision all texts and strings

configmode: CSS style

• remove inline style from reboot.html

Fix service enable/disable issues

After updates, some services don't run anymore.

next-node address

fdef:ffc0:3dd7::1 and 10.130.0.1 should always point to the node that the client is connected to.

TPWR841nd Build - Luci Theme fail

I've build the actual trunk for the tpwr841nd with freifunk mainz site.conf but after reboot there is no freifunk luci theme in the image.
Also any configuration results in a luci error:

No page is registered at '/admin/system/admin'.
If this url belongs to an extension, make sure it is properly installed.
If the extension was recently installed, try removing the /tmp/luci-indexcache file.

I've guess it has something to do with the merge to the packages subdirectory

regards
Knirps

HTTP status page

• hostname
• firmware version
• uptime
• br-client MAC
• br-client IPv6s

configmode: formular enhancements

In case of a form error the color of the field gets red, with the current theme. Sadly the cursor is nearly the same color, so not visible anymore. This behaviour leads to confusion. Furthermore, in the case of the hostname, the error message should include information about valid character and maximal length.

Updating the config doesn't make Gluon rebuild the packages

When the config has been changed, all packaged using it should be rebuilt automatically

simple autoupdater

IPv6 for autoupdate host within Freifunk Lübeck: fdef:ffc0:3dd7::ffff:0
Todo: Add keys to site-ffhl repo

/etc/okpg.conf should contain a working update url

uci: add location section to system config

/etc/config/system:

config location
option latitude 0
option longitude 0