4 ms·

I am not an OpenWrt developer, but I develop software for OpenWrt based platforms. In short: on a lot of these devices it would be difficult or impossible to h

I am not an OpenWrt developer, but I develop software for OpenWrt based platforms. In short: on a lot of these devices it would be difficult or impossible to have a stable auto update mechanism. This could be due to flash size (16MB is considered large for consumer devices), or due to the state of the kernel modules responsible for hardware (e.g. wireless drivers). Also there isn't usually a backup to the kernel in flash, so if your auto update is interrupted by a power failure or the user pulling the cord, you will have a bricked device. Good luck explaining the limitations of SPI EEPROM and compressed filesystems to a pissed off user with a brick. After the update you have to reboot, how do you schedule this on a device which is typically invisible to the user? In networks it's extremely difficult for these embedded devices to guess when someone might not be using it. Having seen my fair share of ancient OpenWrt devices deployed in the field, the industry as a whole definitely needs to focus more on auto updates to resolve security issues. However as the author points out, the sheer number of chipsets out there, it would be very difficult to accomplish without extensive testing. I hope that we can all make meaningful progress toward auto updates of critical issues, but there is a long road ahead to that.

chx 11y ago
I actually would pay decent money for a device with dual flash to address some of this (like Gigabyte dual BIOS on PC motherboards).
- chrissnell 11y ago
  If you're willing to pay "decent money" for a router with auto-update, get some PC hardware (even as small as a WRAP or Soekris) and run pfSense. You'll never look back. I love OpenWRT but a $100 Netgear or Linksys device just can't touch a real PC motherboard with Intel NICs. My preferred pfSense platform at both home and the office is a server-grade chassis running ESXi. My router runs in a VM on this server and I use vSwitches to connect the VM to the various ports on the 4-port Intel NIC. I just built it like this for convenience (I already had the ESXi server) but I later found a side-benefit: if you've set up a DMZ on pfSense, you can easily attach VMs to the DMZ by associating them with the DMZ vSwitch. So, I have some untrusted VMs sitting in my DMZ and trusted VMs sitting on my LAN...all on the same piece of hardware. I've been running this way since 2013 and it's been flawless and fast. More details here: http://output.chrissnell.com/post/39550480075/the-jack-of-all-trades-home-server http://output.chrissnell.com/post/39550480075/the-jack-of-al...
  - silon7 11y ago
    How much power does that use? I run linux a firewall/router on an older laptop + usb ethernet(2) and it's about 20w. I'd prefer < 10. Perhaps I need to try Raspberry Pi next.
    - bjelkeman-again 11y ago
      I have been running an IPcop firewall on an old PC for ages with three network cards. Just about to replace it with this small thing, also with IPcop, and it runs on a 4 watt power supply. I have realised that by downsizing my servers etc in the basement, now when they are a bit overkill (moved most stuff to a cloud solution) I can save enough electricity to power an electric car for most of the use I would make of it with what I save. http://www.firewallhardware.it/en/alix_pfsense_embedded.html http://www.firewallhardware.it/en/alix_pfsense_embedded.html
    - jlgaddis 11y ago
      The Raspberry Pi is gonna suck as a router due to the "Ethernet on USB". You'd be much happier with one of the boards that chrissnell mentioned above. Personally, I use a "Maxxwave 1106" running BSD I had laying around but it's on the more expensive side. If I was putting something together for myself, I'd get one of the small Atom boards with a couple of onboard Intel NICs.
    - __david__ 11y ago
      I've been running OpenWRT on an PC Engines APU board (4 core x86 based w/ gigabit ethernet). According to the website[1] the power is "About 6 to 12W of 12V DC power depending on CPU load." Before my APU I ran an Alix board[2] for years. It's a little bit more complicated to get running since it requires a custom compiled OpenWRT, but it's great to have more memory and disk space than I'll ever need in my router. I used to run on OpenWRT on reflashed consumer routers and I always had to be real careful about what I installed and ran. With the APU I can just install real `bash` and `less` and not have to deal with the crappy busybox emulations. [1] http://pcengines.ch/apu.htm http://pcengines.ch/apu.htm [2] http://pcengines.ch/alix.htm http://pcengines.ch/alix.htm
    - 11y ago
- darklajid 11y ago
  Why don't you just head over to the linked Indiegogo project (Turris) and grab a router that is open hardware, using open source (openwrt based) and has automatic updates?
  - narrowrail 11y ago
    I was just checking this out, but I've obviously missed the $180 backer opportunity (which is quite a bit more than the $75 all-in I just spent on my 128MB memory OpenWrt). Are you a backer? I wonder if the smartphone app they are building for the Turris will work with other OpenWrt installs; do you happen to know?
    - darklajid 11y ago
      I'm a backer - but I don't know if that app would work with any OpenWrt based installation. No idea what your current setup is, but I'd guess that this router is more powerful - and comes with the advantages we discussed here: The hardware is open (you can even get one with exposed connectors/a serial cable to mess with ~everything~), the software is open, you get a 'distribution' with updates by a NIC. It's worth the money for me, but I understand if you're considering a generic OpenWrt based setup good enough. That's what I'm on right now, what works for me until this box arrives. And for me, an upgrade to 11ac was planned anyway, so this just came up when I was looking at new hardware anyway.
    - ofutur 11y ago
      At the "discounted" $275 (2GB version + EU shipping), it's more expensive than embedded x86 solutions (APU2b4 or Celeron N) while being less powerful and flexible (the power consumption is the same). Still a nice toy to play with, especially with all the connectors it offers and I can see this being a hit with iOS fans since it's supposed to be super easy to administer using their custom GUI and video tutorials, so worth the asking price.
- mschuster91 11y ago
  You don't need dual flash, just use U-Boot with the bootcount feature to implement failover.
- kazkas 11y ago
  Now you can and you have 3 days to decide: https://www.indiegogo.com/projects/turris-omnia-hi-performance-open-source-router#/ https://www.indiegogo.com/projects/turris-omnia-hi-performan...
- chei0aiV 11y ago
  https://www.indiegogo.com/projects/turris-omnia-hi-performance-open-source-router https://www.indiegogo.com/projects/turris-omnia-hi-performan...
ZenoArrow 11y ago
I'm not an OpenWrt developer either, but I was thinking about this recently (how to handle autoupdates on OpenWrt). How about if OpenWrt was running on a hypervisor? It'd have to be small enough to fit in the EEPROM constraints, which probably rules out Xen, but KVM could work. With a hypervisor in place, you could install an image alongside a working one, then do a warm reboot to start the new image. The user would be presented with a website to confirm that they'd like to keep this new image. If the user doesn't confirm this within a fixed time period, the router would roll back to the old image. As for the space requirements for keeping two images on the router, I wonder if anything could be done there. For example, I wonder if the new image could be applied as a 'patch' on top of the old one, stored as file diffs rather than as a standalone image. Does that sound workable?
- jlgaddis 11y ago
  Your hypervisor scenario wouldn't work out, assuming auto-updates. What happens when the image is updated (automatically), the router reboots, and the user isn't aware of that (and, therefore, can't log into the web interface to "confirm" the update). It'd just get rolled back and reboot again. On another note, if I had something with a hypervisor available, I'd run something other than OpenWRT on it. The primary use case of OpenWRT is these small embedded devices where such a hypervisor isn't available.
  - ZenoArrow 11y ago
    > " the user isn't aware of that (and, therefore, can't log into the web interface to "confirm" the update)." The website would be presented automatically to the user, similar to how a login page is displayed when you connect to some public WiFi networks. > "On another note, if I had something with a hypervisor available, I'd run something other than OpenWRT on it. The primary use case of OpenWRT is these small embedded devices where such a hypervisor isn't available." Yes, it'd almost certainly help with broadening the range of options. Until I realised I was too big I was drawn to the idea of using Xen as I'd like to see OpenMirage running on home router hardware, it seems like a natural fit. A minimal QubesOS image could also be good.
embeem 11y ago
OpenWrt founder here; you've pretty much hit the nail on the head. Due to size constraints most platforms use a split filesystem consisting of a large read only root filesystem and a smaller overlay for changes. The read only filesystem allows for much better compression ratios but it also means if you attempt to replace an individual package you'll end up with two copies, original in the RO and new in the overlay. Reflashing an OpenWrt device generally consists of migrating a minimal environment over to a ramdisk, rewriting the kernel and read only portions and then writing a backup of the config files to the overlay. On failure you're likely to be stuck in whatever rescue mode the bootloader provides.
- kogepathic 11y ago
  > Reflashing an OpenWrt device generally consists of migrating a minimal environment over to a ramdisk, rewriting the kernel and read only portions and then writing a backup of the config files to the overlay. Yup. Which is why auto updates will probably never work well. What if the user is running some custom software on the device and it doesn't have enough RAM to store the new compressed filesystem? These devices don't have swap. Routers are a subset of embedded systems, which means lots of different platforms, possibly with vendor included quirks, AND then users who run their own junk on them (ahem). Given that most manufacturers are loath to even release their uboot source (come on guys, it's a bootloader not missile launch codes) and most of the implementations I've seen are a ham fisted modification of an old revision of uboot; just enough to boot, but dragons exist in the code. Short of an iPhone for routers moment (yes,the irony of Apple's extremely closed system is not lost on me) where some company creates a router which just revolutionizes the whole industry[1], I don't see it happening on a consumer level unless there is a legislative requirement. [1] this won't happen because phones are fun and shiny and routers aren't. At least to your average consumer. Also the internet is awesome. An OpenWrt founder replied to my comment! :D

chx 11y ago

I actually would pay decent money for a device with dual flash to address some of this (like Gigabyte dual BIOS on PC motherboards).

chrissnell 11y ago
If you're willing to pay "decent money" for a router with auto-update, get some PC hardware (even as small as a WRAP or Soekris) and run pfSense. You'll never look back. I love OpenWRT but a $100 Netgear or Linksys device just can't touch a real PC motherboard with Intel NICs. My preferred pfSense platform at both home and the office is a server-grade chassis running ESXi. My router runs in a VM on this server and I use vSwitches to connect the VM to the various ports on the 4-port Intel NIC. I just built it like this for convenience (I already had the ESXi server) but I later found a side-benefit: if you've set up a DMZ on pfSense, you can easily attach VMs to the DMZ by associating them with the DMZ vSwitch. So, I have some untrusted VMs sitting in my DMZ and trusted VMs sitting on my LAN...all on the same piece of hardware. I've been running this way since 2013 and it's been flawless and fast. More details here: http://output.chrissnell.com/post/39550480075/the-jack-of-all-trades-home-server http://output.chrissnell.com/post/39550480075/the-jack-of-al...
- silon7 11y ago
  How much power does that use? I run linux a firewall/router on an older laptop + usb ethernet(2) and it's about 20w. I'd prefer < 10. Perhaps I need to try Raspberry Pi next.
  - bjelkeman-again 11y ago
    I have been running an IPcop firewall on an old PC for ages with three network cards. Just about to replace it with this small thing, also with IPcop, and it runs on a 4 watt power supply. I have realised that by downsizing my servers etc in the basement, now when they are a bit overkill (moved most stuff to a cloud solution) I can save enough electricity to power an electric car for most of the use I would make of it with what I save. http://www.firewallhardware.it/en/alix_pfsense_embedded.html http://www.firewallhardware.it/en/alix_pfsense_embedded.html
  - jlgaddis 11y ago
    The Raspberry Pi is gonna suck as a router due to the "Ethernet on USB". You'd be much happier with one of the boards that chrissnell mentioned above. Personally, I use a "Maxxwave 1106" running BSD I had laying around but it's on the more expensive side. If I was putting something together for myself, I'd get one of the small Atom boards with a couple of onboard Intel NICs.
  - __david__ 11y ago
    I've been running OpenWRT on an PC Engines APU board (4 core x86 based w/ gigabit ethernet). According to the website[1] the power is "About 6 to 12W of 12V DC power depending on CPU load." Before my APU I ran an Alix board[2] for years. It's a little bit more complicated to get running since it requires a custom compiled OpenWRT, but it's great to have more memory and disk space than I'll ever need in my router. I used to run on OpenWRT on reflashed consumer routers and I always had to be real careful about what I installed and ran. With the APU I can just install real `bash` and `less` and not have to deal with the crappy busybox emulations. [1] http://pcengines.ch/apu.htm http://pcengines.ch/apu.htm [2] http://pcengines.ch/alix.htm http://pcengines.ch/alix.htm
  - 11y ago
darklajid 11y ago
Why don't you just head over to the linked Indiegogo project (Turris) and grab a router that is open hardware, using open source (openwrt based) and has automatic updates?
- narrowrail 11y ago
  I was just checking this out, but I've obviously missed the $180 backer opportunity (which is quite a bit more than the $75 all-in I just spent on my 128MB memory OpenWrt). Are you a backer? I wonder if the smartphone app they are building for the Turris will work with other OpenWrt installs; do you happen to know?
  - darklajid 11y ago
    I'm a backer - but I don't know if that app would work with any OpenWrt based installation. No idea what your current setup is, but I'd guess that this router is more powerful - and comes with the advantages we discussed here: The hardware is open (you can even get one with exposed connectors/a serial cable to mess with ~everything~), the software is open, you get a 'distribution' with updates by a NIC. It's worth the money for me, but I understand if you're considering a generic OpenWrt based setup good enough. That's what I'm on right now, what works for me until this box arrives. And for me, an upgrade to 11ac was planned anyway, so this just came up when I was looking at new hardware anyway.
  - ofutur 11y ago
    At the "discounted" $275 (2GB version + EU shipping), it's more expensive than embedded x86 solutions (APU2b4 or Celeron N) while being less powerful and flexible (the power consumption is the same). Still a nice toy to play with, especially with all the connectors it offers and I can see this being a hit with iOS fans since it's supposed to be super easy to administer using their custom GUI and video tutorials, so worth the asking price.
mschuster91 11y ago
You don't need dual flash, just use U-Boot with the bootcount feature to implement failover.
kazkas 11y ago
Now you can and you have 3 days to decide: https://www.indiegogo.com/projects/turris-omnia-hi-performance-open-source-router#/ https://www.indiegogo.com/projects/turris-omnia-hi-performan...
chei0aiV 11y ago
https://www.indiegogo.com/projects/turris-omnia-hi-performance-open-source-router https://www.indiegogo.com/projects/turris-omnia-hi-performan...

ZenoArrow 11y ago

I'm not an OpenWrt developer either, but I was thinking about this recently (how to handle autoupdates on OpenWrt). How about if OpenWrt was running on a hypervisor? It'd have to be small enough to fit in the EEPROM constraints, which probably rules out Xen, but KVM could work. With a hypervisor in place, you could install an image alongside a working one, then do a warm reboot to start the new image. The user would be presented with a website to confirm that they'd like to keep this new image. If the user doesn't confirm this within a fixed time period, the router would roll back to the old image. As for the space requirements for keeping two images on the router, I wonder if anything could be done there. For example, I wonder if the new image could be applied as a 'patch' on top of the old one, stored as file diffs rather than as a standalone image. Does that sound workable?

jlgaddis 11y ago
Your hypervisor scenario wouldn't work out, assuming auto-updates. What happens when the image is updated (automatically), the router reboots, and the user isn't aware of that (and, therefore, can't log into the web interface to "confirm" the update). It'd just get rolled back and reboot again. On another note, if I had something with a hypervisor available, I'd run something other than OpenWRT on it. The primary use case of OpenWRT is these small embedded devices where such a hypervisor isn't available.
- ZenoArrow 11y ago
  > " the user isn't aware of that (and, therefore, can't log into the web interface to "confirm" the update)." The website would be presented automatically to the user, similar to how a login page is displayed when you connect to some public WiFi networks. > "On another note, if I had something with a hypervisor available, I'd run something other than OpenWRT on it. The primary use case of OpenWRT is these small embedded devices where such a hypervisor isn't available." Yes, it'd almost certainly help with broadening the range of options. Until I realised I was too big I was drawn to the idea of using Xen as I'd like to see OpenMirage running on home router hardware, it seems like a natural fit. A minimal QubesOS image could also be good.

embeem 11y ago

OpenWrt founder here; you've pretty much hit the nail on the head. Due to size constraints most platforms use a split filesystem consisting of a large read only root filesystem and a smaller overlay for changes. The read only filesystem allows for much better compression ratios but it also means if you attempt to replace an individual package you'll end up with two copies, original in the RO and new in the overlay. Reflashing an OpenWrt device generally consists of migrating a minimal environment over to a ramdisk, rewriting the kernel and read only portions and then writing a backup of the config files to the overlay. On failure you're likely to be stuck in whatever rescue mode the bootloader provides.

kogepathic 11y ago
> Reflashing an OpenWrt device generally consists of migrating a minimal environment over to a ramdisk, rewriting the kernel and read only portions and then writing a backup of the config files to the overlay. Yup. Which is why auto updates will probably never work well. What if the user is running some custom software on the device and it doesn't have enough RAM to store the new compressed filesystem? These devices don't have swap. Routers are a subset of embedded systems, which means lots of different platforms, possibly with vendor included quirks, AND then users who run their own junk on them (ahem). Given that most manufacturers are loath to even release their uboot source (come on guys, it's a bootloader not missile launch codes) and most of the implementations I've seen are a ham fisted modification of an old revision of uboot; just enough to boot, but dragons exist in the code. Short of an iPhone for routers moment (yes,the irony of Apple's extremely closed system is not lost on me) where some company creates a router which just revolutionizes the whole industry[1], I don't see it happening on a consumer level unless there is a legislative requirement. [1] this won't happen because phones are fun and shiny and routers aren't. At least to your average consumer. Also the internet is awesome. An OpenWrt founder replied to my comment! :D