If you have the need to wake up machines on your local LAN from the outside, there are a few steps you need to take to get it working with OpenWRT (12.09)

  1. Select an unused IP address (which you are certain will never, ever be used). I will be using 192.168.1.254 in the following
  2. Log into OpenWRT and go to System → Startup → Local Startup (the text input at the bottom of the page) and add this line above exit 0:
    ip neigh add 192.168.1.254 lladdr ff:ff:ff:ff:ff:ff nud permanent dev br-lan
  3. Save (or Submit depending on the theme used)
  4. Go to System → Software and verify the package ip is installed. If not, do so.
  5. Go to Network → Firewall → Port forwards and add a new rule like this:
    forward(select custom to enter the internal IP address).
  6. Save and apply
  7. Reboot the router

That’s it. Now wake on lan should work from the WAN (Internet) as well.

This is what it looks like in the WoL Wake On Lan Wan Android app:

wake-on-wan

(via)

Port forwarding in itself is nothing new in OpenWRT, though the way it is done has changed dramatically between White Russian and Kamikaze.

One reoccurring problem is that port forwarding only works for packets coming in through the wan interface – In White Russian it was possible to add some clever rules to

/etc/firewall.user

but things does not seem to be so easy in Kamikaze (even if it is possible to include

/etc/firewall.user

from

/etc/config/firewall

the rules do not work.

Luckily I have a work-around.

As an example, let us say I want to forward traffic from the Internet to my server


192.168.0.1: OpenWRT router
192.168.0.2: Server

First, create the configuration for the forwarded port by adding this to

/etc/config/firewall

:

config 'redirect' 'www'
    option 'src' 'wan'
    option 'proto' 'tcp'
    option 'src_ip' ''
    option 'src_dport' '80'
    option 'dest_ip' '192.168.0.2'
    option 'dest_port' '80

config 'rule'
    option 'src' 'wan'
    option 'proto' 'tcp'
    option 'src_ip' ''
    option 'dest_ip' ''
    option 'dest_port' '80'
    option 'target' 'ACCEPT'
[email protected]:~# /etc/init.d/firewall restart

That is it, traffic coming to the wan interface is now forwarded to the server.

But there is a problem. If you try to connect to www.my.site (which resolves to your public IP) you will get the webif of OpenWRT instead of the website.

To circumvent this we need to redirect (or proxy) the traffic to the web server as there does not seem to be any easy way to do “lan to lan port forwarding”.

For this I decided to use xinetd since it has native support for port redirection.

Start by moving the webif to another port, the configuration is in

/etc/config/httpd

:

config 'httpd'
    option 'home' '/www'
    option 'port' '1080'
[email protected]:~# /etc/init.d/httpd restart

(The configuration for the SSH server is in

/etc/config/dropbear

)

Now install xinetd – It’s not in the “native” OpenWRT packages but can be found in OptWare:

[email protected]:~# ipkpg install http://ipkg.nslu2-linux.org/feeds/optware/openwrt-brcm24/cross/unstable/xinetd_2.3.14-8_mipsel.ipk

Now, either copy

/etc/services

from a Linux/Unix machine or add this line:

www     80/tcp      http        # WorldWideWeb HTTP

Then create the file

/opt/etc/xinetd.d/http-forward

:

service http
{
   flags = REUSE
   socket_type = stream
   wait = no
   user = root
   redirect = 192.168.1.2 80
   log_on_failure += USERID
}

If you plan on using a lot of OptWare packages you could at a custom start-up script that calls all S-scripts in

/opt/etc/init.d

– But I opted for a single OpenWRT-style init-script for xinetd.

/etc/init.d/xinetd

:

#!/bin/sh /etc/rc.common
# Copyright (C) 2006 OpenWrt.org

START=39
start() {
    [ -x /opt/sbin/xinetd ] && {
        /opt/sbin/xinetd
    }      
}
[email protected]:~# /etc/init.d/xinetd enable
[email protected]:~# /etc/init.d/xinetd start
[email protected]:~# ps aux | grep [x]inetd
 1599 root      1900 S    /opt/sbin/xinetd
 1935 root      1900 S    /opt/sbin/xinetd

logread should show something like

May 10 23:25:45 xinetd[2166]: Reading included configuration file: /opt/etc/xinetd.d/http-forward [file=/opt/etc/xinetd.conf] [line=15]
May 10 23:25:45 xinetd[2166]: xinetd Version 2.3.14 started with no options compiled in.
May 10 23:25:45 xinetd[2166]: Started working: 1 available services

Now try to connect to the forwarded port, there should be something like this in the log:

May 10 23:25:53 xinetd[2166]: START: http pid=2168 from=192.168.1.240