Howto: WRT54GL v1.1 wired IEEE 802.1x client TTLS PAP:(surfnet / eduroam / securew2 wpa_supplicant, EAPOL TX RX)
!!!Update!!! 2011-10-23
Guide simplified, no external packages needed anymore! Since the "roboswitch driver" is now included by default in "wpa_supplicant" of the "Backfire" releases , although wpa_supplicant must and can be easily installed by the packet manager! The roboswitch driver of wpa_supplicant can push the EAP packages pass the internal WRT54GL switch and makes wired authentication working. This will probably be the last update to this guide since I have no subscription to surfnet anymore to test it... So use the final release of Backfire instead of the rc5 version I described.
1 flash your router with OpenWrt Backfire 10.03.1-rc5 firmware:
http://downloads.openwrt.org/backfire/1 … uashfs.trx #incase you already run a version of OpenWrt
http://downloads.openwrt.org/backfire/1 … /brcm-2.4/ #incase you run Linksys/Tomato/DD-wrt/etc firmware, reset to defaults and read instructions of your router howto upgrade firmware/OpenWrt!
2 login with telnet into the router:
telnet root@192.168.1.1
passwd #it will ask you to change router root password
reboot #it will reboot the router, not your pc, if you are in the right shell
3 login with ssh into the router and install following software:
ssh root@192.168.1.1 #type yes to accept ssh-key and type password to complete login!
opkg update #this command updates the software package list of your router!
opkg install nano #this command installs text editor called nano
opkg install ntpclient #idem adjusts time of router
opkg install wpa-supplicant #the package that does the actual authentication#if router is not connected to a working Internet connection on the (Internet port) these steps fail!
#instead learn howto "scp" (secure copy) these packages http://downloads.openwrt.org/backfire/1 … /packages/
from your local PC to the router and install them manually, don't forget the dependencies!
#if "scp" is too difficult, go to a friend with a working internet connection and connect your router to his/her and continue this guide(just make sure your router which uses 192.168.1.1 does not route the same range as the router of your friend, otherwise you still might not have a working connection)
4 make a wpa-supplicant conf file which contains username and password to authenticate:
#assumes you are still logged into the router with ssh
nano /etc/config/wpa.conf #opens text editor so you can copy paste this code in it(without the word Code: offcourse ;-p !)
ctrl_interface=/var/run/wpa_supplicant ap_scan=0 network={ key_mgmt=IEEE8021X eap=TTLS identity="s0xxxxxx@1x" anonymous_identity="s0xxxxxx@1x" password="xxxxxxxxx" phase2="auth=PAP" }#identity is just a example for Surfnet, Leiden Universiteit, Lijbrandt
#identity for University of Tromsø see https://forum.openwrt.org/viewtopic.php … 23#p113223#on your keyboard press the following two keys:
CTRL+x #save yes and exit the texteditor "nano"
5 test authentication: your Internet connection / Authentication server must be connected to the routers WAN(internet) port:
#assumes you are still logged into the router with ssh
wpa_supplicant -i eth0.1 -D roboswitch -p multicast_only=1 -c /etc/config/wpa.conf
#if it says something like successful after a while(allot of other messages), press ctrl-c to quit
#try getting a ip-address from the Internet Provider
udhcpc -i eth0.1
#if successfull, you'll be able to internet :-)
#if authentication fails perform the wpa_supplicant command with -d or -dd for more verbose information
6 create startup deamon, so you don't have to type all of this in case of the routers power fails or it restarts:
#assumes you are still logged into the router with ssh
nano /etc/init.d/signinwpa #opens text editor copy paste code in it
#!/bin/sh /etc/rc.common # Example script # Copyright (C) 2007 OpenWrt.org START=99 start() { echo start # commands to launch application wpa_supplicant -i eth0.1 -D roboswitch -p multicast_only=1 -B -c /etc/config/wpa.conf sleep 15 #udhcpc -i eth0.1 }CTRL+x #press these two keys on the keyboard and save yes and exit 'nano'
chmod 755 /etc/init.d/signinwpa #change the permission mode so the deamon can access it.
/etc/init.d/signinwpa enable #enables the sign in script for the init deamon
reboot
7 finished, setup Wifi/Access-Point wpa2 encryption etc, can be done in web-interface!
If you are not finished because you don't understand step 2 telnet and step 3 ssh, it might be because you have to type these commands into a "shell". For Mac OS X go to Utilities>Terminal for Ubuntu Linux go to Accessories>Terminal for Windows install putty.
I suggest Windows users to download a LiveCD like Ubuntu burn it, boot PC from the LiveCD and perform these steps... it might make more sense...
PS:
Date and time in router must be set to keep authentication working, otherwise certificates etc can not be detected as valid because of a big time difference, day of firmware got created. Therefor ntpclient is installed. It just sets the router to UTC, although there might be time difference with your region xxx hours, its ok. Feel free to adjust it to work okay with your timezone... it was to much work for me...
To read more about the parameters of the roboswitch driver in wpa-supplicant read this topic.
http://forum.openwrt.org/viewtopic.php?pid=86778#p86778
Different hardware capable of running OpenWrt:
If you have a other "router" that is also capable of running "OpenWrt", and if it doesn't use the same kind of "managed hardware switch" thats on the WRT54GL than you might be lucky with the current stable release of 8.09.2 or newer just follow the new howto at top of this page but use following changes at the next steps:
@step1
choose a correct firmware to flash for your hardware
@step 5/6
change to
wpa_supplicant -i eth0.1 -D wired -c /etc/config/wpa.conf
Tip:
Bridge interfaces if you can! Clients from the WRT54GL may get almost unlimited IP address directly from the radius service provider, therefor your router will not be bugged by heavy NAT/FIREWALL traffic, and will stay stable! Torrents can crash router easy, but when bridged it is no problem 
!
See this thread for howto bridge internet to internal LAN or even WIFI:
http://forum.openwrt.org/viewtopic.php?id=19540
Thanks:
Thanks to OpenWrt and Jouke Witteveen and all other people not mentioned making this possible. I only put this howto together but others figured it out! Whole project got started when stumbled on the following link, which was the other way around connecting the wifi site of the wrt54gl to a radius server hotspot/AP:
http://blog.jozjan.net/2008/12/wrt54gl- … t-aka.html
(Last edited by walterav on 9 Apr 2013, 20:01)
Any ideas ?