Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
Cross-Section
Mar 18, 2009

Am I correct in thinking that having MoCA encryption/filters is unnecessary in a standalone suburban house?

Just set up a 2-box network using the existing coax runs in my house and it has been the very definition of plug-and-play. Went from 250mbs down on 5G wi-fi to 950mbs down using the adapters. Rock-solid connection too.

Do I need to worry about turning on MPS and what not? I looked into it a bit and it sounds like a hassle to set up on these ScreenBeam adapters.

Adbot
ADBOT LOVES YOU

withoutclass
Nov 6, 2007

Resist the siren call of rhinocerosness

College Slice

Cross-Section posted:

Am I correct in thinking that having MoCA encryption/filters is unnecessary in a standalone suburban house?

Just set up a 2-box network using the existing coax runs in my house and it has been the very definition of plug-and-play. Went from 250mbs down on 5G wi-fi to 950mbs down using the adapters. Rock-solid connection too.

Do I need to worry about turning on MPS and what not? I looked into it a bit and it sounds like a hassle to set up on these ScreenBeam adapters.

If your coax connection to outside is connected, I'd put a filter there IMO.

H110Hawk
Dec 28, 2006

Cross-Section posted:

Am I correct in thinking that having MoCA encryption/filters is unnecessary in a standalone suburban house?

Is your coaxial run connected to the street? Are you certain? You can hide splitters anywhere. If so you need filters. Period. It's a bus network and any neighbor within range with a moca adapter will wind up on your network or causing problems. If you aren't using the catv line from the street at all just go unhook it. Bingo bango air gap filtering.

Cross-Section
Mar 18, 2009

H110Hawk posted:

Is your coaxial run connected to the street? Are you certain? You can hide splitters anywhere. If so you need filters. Period. It's a bus network and any neighbor within range with a moca adapter will wind up on your network or causing problems. If you aren't using the catv line from the street at all just go unhook it. Bingo bango air gap filtering.

The latter option is fine with me since we don't have cable TV anymore.

I ambled over to the side of my house, unscrewed/yanked off the panel so helpfully marked "Television" and unscrewed the cables on the left from the below splitters. I have no clue where these cables actually run to but would I be correct in assuming at least one of them runs out to the green cable box next to the street? Or should I just unscrew all of them to be safe?

H110Hawk
Dec 28, 2006
That's impressive. I would tape and number left/right in case you need to put any back, but if you get in there one should disappear into a cavity that isn't your house, likely "down", and the rest will go elsewhere. That's the one. Otherwise yeah just keep unscrewing. You might wind up killing your moca connection which may run through there, this is when you need to do troubleshooting on combining them back together and why you should really find the one from the street.

Put your phone on wifi, disable mobile data. Fire up a streaming app. If it cuts out you got the wrong one. Assuming your wifi is on the other side of the moca from the router. If it's not, zoom from the desktop to the phone with a screen share that's moving (YouTube). Same test.

You can also just go to the street box, if there's only 2 connections you can just unscrew the one that goes to your house. If you can't tell ask your neighbor if they have internet or TV via. <spectrum|xfinity>, if no unscrew both. If yes ask if you can coin toss their internet down. Unscrew one, have em go to a website or fire up Netflix.

fletcher
Jun 27, 2003

ken park is my favorite movie

Cybernetic Crumb
This thing is super handy for figuring out where all the connections go and labeling them: Klein Tools VDV512-101 Explorer 2 Coax Tester Kit, Includes Cable Tester / Wire Tracer / Coax Mapper with Remotes to Test up to 4 Locations https://a.co/d/6Yic0pc

Cross-Section
Mar 18, 2009

H110Hawk posted:

That's impressive. I would tape and number left/right in case you need to put any back, but if you get in there one should disappear into a cavity that isn't your house, likely "down", and the rest will go elsewhere. That's the one. Otherwise yeah just keep unscrewing. You might wind up killing your moca connection which may run through there, this is when you need to do troubleshooting on combining them back together and why you should really find the one from the street.

Put your phone on wifi, disable mobile data. Fire up a streaming app. If it cuts out you got the wrong one. Assuming your wifi is on the other side of the moca from the router. If it's not, zoom from the desktop to the phone with a screen share that's moving (YouTube). Same test.

You can also just go to the street box, if there's only 2 connections you can just unscrew the one that goes to your house. If you can't tell ask your neighbor if they have internet or TV via. <spectrum|xfinity>, if no unscrew both. If yes ask if you can coin toss their internet down. Unscrew one, have em go to a website or fire up Netflix.

I did some more finagling around (and did actually end up finding my moca cable connected on that bottom splitter). The rest of the coax cables connected to the splitters run up and out. There are three conduits coming out of the ground; two resolve to cables that run through the compartment and into the garage, but third ends in this:



... which was already disconnected from anything but said after-mentioned cable coming out of the ground. Mission accomplished, I guess? (read: am too chickenshit to run out to the street and mess with city property lol)

Thanks Ants
May 21, 2004

#essereFerrari


The thick cable with the chunky connector on it will be the one from the street

Cross-Section
Mar 18, 2009

Now that I'm thinking about it, our previous TV cable setup worked through a coax port on a Verizon-provided router (and I remember the set-top boxes would show up in the router dashboard) so it might have not even been using the street hookup in the first place?

Well, at least I got a little refresher on my home's communications infrastructure lol, thanks everyone!

Cross-Section fucked around with this message at 19:30 on Apr 13, 2024

H110Hawk
Dec 28, 2006

Cross-Section posted:

(read: am too chickenshit to run out to the street and mess with city property lol)

Now now, that is government grant private monopoly property unless your city owns the local cable TV company. gently caress em.

And yeah Verizon TV would have been fios. Fiber internet. Perfecto.

Arson Daily
Aug 11, 2003

i needed a filter in front of my cable modem because i guess that particular model gets weird when there is a moca adapter present. i put another one where the wire came into the house just as cheap insurance for the dang college kids living near me. who knows what theyre up to.

H110Hawk
Dec 28, 2006

H110Hawk posted:

They're the feed through connectors where the crimper cuts them off. I guess there could be some kind of poor cut on the end I need to trim. I didn't have much time to troubleshoot this morning.

Well it was this. The 3 wires I tested had poorly cut feed through. Potentially coupled with the panel being stp or something.

I swapped it for a utp panel from the same cheap brand testing a couple of still loose wires - worked great. Put it in, test the wire I had issues with before which I had already zip tied in place and nope. Finally looked at the end and saw like 1mm of cat6 wires sticking out.

Patched in about 8 more cables, only 12 more to go! Also the coaxial keystone I bought for the old patch panel doesn't fit in this one. Welp. Internet is up, u6-lite has taken over the wifi, and I setup a guest network w/ isolation on it to take over the eero network. Setup the eero to be a bogus name and very long password. :toot:

SlowBloke
Aug 14, 2017
Hello, I'd like some hints from people with knowledge in running low specs pc as opnsense.

I'm currently assessing moving from my current 1000/100 ftth line to 10000/2000 but the isp provided modem for that offering is absolute poo poo (sagemcom f@st 5688). Other common models of sfp+ or 10gbase routers sold in my area like udm pros or qnaps have a bad rep on running faster than 2.5g.

What is lowest i can go in processing power to manage 10g routing, an handful of firewall rules and port forwarding along 150mbps+ of wireguard? I would need two 10g ports, one terminated in copper (ISP ONT) and one in optical (switch uplink), so it would need at least four if not eight pcie lanes.

Any experiences?

Shumagorath
Jun 6, 2001
My attempt to homebrew a pfSense continues. I have a dual-NIC mini PC that has one WAN port and one LAN port. On the LAN port I have tagged VLANs A and B, where A is management and B is (ideally) going to serve a VPN out over the WAN port to anything behind it via Network Manager. The problem is that I’ve gone with Ubuntu Server to have full control over firewalling and run headless, so I don’t get a nice little GUI toggle to do this for me.

Is there an nmcli incantation that will let me share the VLAN B connection into a switch with a few access ports? Can I even run a VLAN “object” as an IPv4 sharing device, or does that only work via the physical interface?

BlankSystemDaemon
Mar 13, 2009



A internet speed testing website that, at least in my experinence gets better speeds, is Tele2's speedtest.
And the bufferbloat test probably also needs to be mentioned.

If anyone's using iperf, be aware that version 2 and version 3 are not equivalent - version 2 uses multithreading, version 3 uses singlethreading.
You kinda need both.

ryanrs
Jul 12, 2011

Vanilla OpenWRT on an Aruba AP-303H


e: This is not safe. There is some partition or volume info that is being lost, and it may brick your device. I'll know for sure once I un-brick mine.

Before you start, be aware that a random TTL FTDI serial cable will probably not work on these Aruba APs. I have a serial cable that works fine on my Raspberry Pi, but it would not work with the AP-303H. It will receive console output, but fails to transmit, so you can't type anything. Either buy the official $35 Aruba console cable (no), or this $18 knockoff. At least the knockoff cable costs less than the used access point.


OpenWRT: AP-303H install instructions.

Here's my variation, which overwrites all Aruba code on the NAND flash, so OpenWRT can use the whole 128MB. Assume you will never be able to go back to the Aruba software, unless you backup your flash before doing this install.

The OEM bootloader and other low-level stuff lives on a separate NOR flash chip, which we will not be touching. So you should always be able to get back to the apboot> prompt and boot off your tftp server. I don't think you can brick the AP even if you screw up a command, or cut power in the middle of flashing, etc.


Change the kernel command line to override the flash partition definition in the DeviceTree .dts. This just changed how the OpenWRT kernel sees the flash chip, it doesn't modify any data on it.
code:
Hit <Enter> to stop autoboot:  0
apboot>
apboot> setenv bootargs_openwrt "setenv bootargs console=ttyMSM0,9600n8 mtdparts=spi0.1:-(ubi)"
apboot> setenv nandboot_openwrt "run bootargs_openwrt; ubi part aos0; ubi read 0x85000000 kernel; set fdt_high 0x87000000; bootm 0x85000000"
apboot> setenv ramboot_openwrt "run bootargs_openwrt; setenv ipaddr 192.168.5.49; setenv serverip 192.168.5.30; netget; set fdt_high 0x87000000; 
bootm"
apboot> setenv bootcmd "run nandboot_openwrt"
apboot> saveenv 
Saving Environment to SPI Flash...
Erasing SPI flash...Writing to SPI flash...done
apboot> run ramboot_openwrt



Boot up OpenWRT initramfs image off your tftp server and format the flash. This is the step that destroys all the Aruba data. You can back it up first with dd.
code:
root@OpenWrt:/# ubidetach -p /dev/mtd15
[   54.122938] ubi0: detaching mtd15
[   54.123971] ubi0: mtd15 is detached
root@OpenWrt:/# ubiformat /dev/mtd15
ubiformat: mtd15 (nand), size 134217728 bytes (128.0 MiB), 1024 eraseblocks of 131072 bytes (128.0 KiB), min. I/O size 2048 bytes
ubiformat: formatting eraseblock 1023 -- 100 % complete  % complete
root@OpenWrt:/# cd /tmp
root@OpenWrt:/tmp# scp ryan@192.168.5.20:dl/openwrt-23.05.3-ipq40xx-generic-aruba_ap-303h-squashfs-sysupgrade.bin .
root@OpenWrt:/tmp# sysupgrade -n openwrt-23.05.3-ipq40xx-generic-aruba_ap-303h-squashfs-sysupgrade.bin




The Aruba bootloader (which resides in a different, smaller flash chip) will be pissed that we overwrote the Aruba partitions. But after some complaining, it does find the OpenWRT kernel and jump to it.
code:
APBoot 2.1.4.7 (build 57679)
Built: 2016-12-08 at 15:41:41

Model: AP-303H  
DRAM:  512 MiB  
Flash: Detected MX25L3205D: total 4 MiB
NAND:  Detected MX35LFxGE4AB: total 128 MiB
Power: 802.3at POE
UBI error: ubi_read_volume_table: the layout volume was not found
UBI error: ubi_init: cannot attach mtd1
UBI error: ubi_init: UBI error: cannot initialize UBI, error -22
Volume aos0 not found!
Creating dynamic volume aos0 of size 0
UBI error: ubi_create_volume: cannot create volume -1, error -23
Volume aos1 not found!
Creating dynamic volume aos1 of size 0
UBI error: ubi_create_volume: cannot create volume -1, error -23
Volume ubifs not found!
Creating dynamic volume ubifs of size 0
UBI error: ubi_create_volume: cannot create volume -1, error -23
Net:   eth0
Radio: ipq4029#0, ipq4029#1
Reset: warm
FIPS:  passed   

Hit <Enter> to stop autoboot:  0
Volume kernel not found!
Uncompressing Kernel Image ... OK
ipq: fdt fixup unable to find compatible node
[    0.000000] Booting Linux on physical CPU 0x0
[    0.000000] Linux version 5.15.150 (builder@buildhost) (arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 12.3.0 r23809-234f1a2efa) 12.3.0, GNU ld (GNU Binutils) 2.40.0) #0 SMP Fri Mar 22 22:09:42 2024
[    0.000000] CPU: ARMv7 Processor [410fc075] revision 5 (ARMv7), cr=10c5387d
[    0.000000] CPU: div instructions available: patching division code
[    0.000000] CPU: PIPT / VIPT nonaliasing data cache, VIPT aliasing instruction cache
[    0.000000] OF: fdt: Machine model: Aruba AP-303H
code:
BusyBox v1.36.1 (2024-03-22 22:09:42 UTC) built-in shell (ash)

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 -----------------------------------------------------
 OpenWrt 23.05.3, r23809-234f1a2efa
 -----------------------------------------------------
=== WARNING! =====================================
There is no root password defined on this device!
Use the "passwd" command to set up a new password
in order to prevent unauthorized SSH logins.
--------------------------------------------------
root@OpenWrt:/# df -h
Filesystem                Size      Used Available Use% Mounted on
/dev/root                 4.0M      4.0M         0 100% /rom
tmpfs                   248.0M     64.0K    247.9M   0% /tmp
/dev/ubi0_2             103.7M    156.0K     98.8M   0% /overlay
overlayfs:/overlay      103.7M    156.0K     98.8M   0% /
tmpfs                   512.0K         0    512.0K   0% /dev
root@OpenWrt:/# time dd if=/dev/mtd15 of=/dev/null bs=1M
128+0 records in
128+0 records out
real    1m 19.70s
user    0m 0.00s
sys     0m 17.50s
99MB free and 1.6 MB/s. It's... sufficient.


I'm going to set this up as garage wifi, with an ip camera hanging off the downstream PoE port. These access points were originally designed for hotel rooms, so there is PoE lan port for a phone.

I also want a motion detector connected to the USB port. Normally the AP-303H does not allow both downstream PoE and USB unless it is running off a wall adapter. I guess the combined power requirements put it over the upstream 802.3at 30W limit. However, my USB device is quite low power, as is the IP camera. And I think I just deleted the Aruba code that enforces that limitation, heh.

ryanrs fucked around with this message at 06:54 on Apr 19, 2024

movax
Aug 30, 2008

Arson Daily posted:

i needed a filter in front of my cable modem because i guess that particular model gets weird when there is a moca adapter present. i put another one where the wire came into the house just as cheap insurance for the dang college kids living near me. who knows what theyre up to.

Interesting; I have an Arris S33 but no filter on it. Then again, the CATV run from Comcast goes only to my modem and nowhere else -- Coax in the house I just have wired up to an antenna / my own distribution amplifier, so I don't have any MoCA filters installed.

H110Hawk
Dec 28, 2006

movax posted:

Interesting; I have an Arris S33 but no filter on it. Then again, the CATV run from Comcast goes only to my modem and nowhere else -- Coax in the house I just have wired up to an antenna / my own distribution amplifier, so I don't have any MoCA filters installed.

If there is no physical connection between the two bus's then you don't need any filtering.

chocolateTHUNDER
Jul 19, 2008

GIVE ME ALL YOUR FREE AGENTS

ALL OF THEM

ryanrs posted:

Aruba AP Flashing

Very cool, thanks for sharing!

How did you wind up getting your hands on one of these APs? They seem pretty targeted at the hotel/hospitality industry, and I’m guessing aren’t sold direct to consumers. Second hand off a client or something like that? eBay?

ryanrs
Jul 12, 2011

chocolateTHUNDER posted:

How did you wind up getting your hands on one of these APs? They seem pretty targeted at the hotel/hospitality industry, and I’m guessing aren’t sold direct to consumers. Second hand off a client or something like that? eBay?

Ebay search: AP-303H. They go for $20-40, depending on if you want cords and the plastic wall bracket or desk mount.

You're right, it's a weird niche device. But it means you get PoE (not present on home routers), and 3 lan ports (not present on enterprise APs). A USB port for a peripheral, like a microcontroller or USB stick or a printer, etc. Clean case not bristling with antennas. Fairly small. Good build quality.

But $20/ea is what seals the deal. Especially if you want to mess around with mesh networking or something where you want a bunch of 'em.

e: lmao Aruba is still selling these new. Buy one at Office Depot for $542.

ryanrs fucked around with this message at 01:02 on Apr 19, 2024

Subjunctive
Sep 12, 2006

✨sparkle and shine✨

yeah, I like the UniFi in-wall APs because they’re POE, have 3 gigabit ports (one with POE itself!) and hide in the wall plate. They are not $20 though, that’s for sure.

ryanrs
Jul 12, 2011

I just got write access to the OpenWrt wiki, so all this info will find its way there in a few days. Hopefully I'll make it easier for people to put these devices to use. They are not the newest tech, but they can still be useful.

Arson Daily
Aug 11, 2003

yeah i never needed a filter otherwise. idk what caused the interference but the filter got everything working great

Organic Lube User
Apr 15, 2005

So this is an odd one but my wife has health anxiety and has asked me to block Google and reddit on her phone so she stops googling herself into panic attacks.
I'm thinking the best way to do this is by creating a custom DNS server of some sort (pi-hole?) and blocking those domains on there, and just pointing her iPhone at the custom DNS server.
Are there premade solutions out there? Like a little service I can sign up for that will provide the DNS server out of the box and let me just specify a few domains to block? I'd rather not have to deal with getting a static IP set up at home or whatever I'd have to do to keep the DNS server address consistent. And I'd want it to work when her phone is on any network, as well.

Am I overthinking this?

Internet Explorer
Jun 1, 2005





Check out NextDNS.

Organic Lube User
Apr 15, 2005

Internet Explorer posted:

Check out NextDNS.

Well that looks just about goddamn perfect, thank you.

Internet Explorer
Jun 1, 2005





You're welcome! I'm a big fan. Good luck.

H110Hawk
Dec 28, 2006

Subjunctive posted:

yeah, I like the UniFi in-wall APs because they’re POE, have 3 gigabit ports (one with POE itself!) and hide in the wall plate. They are not $20 though, that’s for sure.



:discourse:

Shumagorath
Jun 6, 2001
Please let me know if this is more of a layer 1/2 thread than higher up. I've made progress on my Network Manager based gateway / firewall, but I can't figure out how to make the VPN fail closed since nmcli treats Wireguard as different from all other VPN types. Am I stuck using OpenVPN or something older so I can designate a secondary object? I tried not having a default route through the main WAN and making routes that only populated when the VPN was up, but that must have been wrong as the connectivity didn't survive a reboot.

Is firewalling done through Network Manager or do I still need iptables?

Adbot
ADBOT LOVES YOU

ryanrs
Jul 12, 2011

Ha ha ha, oops. I wanted to test my flash backups, so I zeroed the flash and then copied it back. Now my AP won't boot.

U-boot still exists and tftp boot still works, so it's not that bad. I think there is some partition info that was lost, though. I do have a second AP of the same model I can examine and copy stuff from.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply