This page includes most basic settings needed to configure the network. It's divided into sections including MultiWAN, WAN Settings, Ethernet Ports Configuration, LAN and Wireless setttings.
Number of WAN ports: lets you select the number of WAN ports to be used on the device.
On routers with only one physical WAN interface, options with more WAN ports are greyed out. Only “1 WAN” can be selected in such cases.
Tune route cache: is used for MultiWAN configurations with load balancing.
This setting is advised when two or more WANs have a weight larger than “0”. It uses kernel tweaks to improve workload sharing. For details, see the Notes section below.
Check Connections Every: is an easy way for FreshTomato to automatically test WAN connection reliability. (Default: Disabled). Choosing any setting but Disabled executes the Watchdog script. This sets how often the router (regularly) pings to test it is still connected to the Internet.
The Watchdog script uses ping or traceroute to test WAN connection status.
Choosing a setting other than Disabled will make “Target 1” and “Target 2” fields appear.
Settings here are used to configure the WAN interface. These settings depend on your ISP.
Depending on the type selected, other settings specific to the type of connection will be shown or hidden.
Type: sets the connection mode the WAN interface uses to connect to your ISP. (Default: DHCP).
Wireless Client Mode: enables FreshTomato's Wireless Client mode.
This lets the router act as a client (WiFi adapter) to connect to another router/AP.
(For details, see Wireless Mode tables below).
Load Balance Weight: appears only when number of WANs > 1. Valid settings are between 0 and 256.
When FreshTomato is in a MultiWAN configuration, it performs load sharing of the links. Load sharing is performed on a per-session basis to prevent issues with interactive traffic, such as real-time voice/video, or RDP. After all, your links might have different speeds and per-packet load-sharing would generate out-of-order packets. That could make interactive traffic unusable. Setting a Load Balance Weight on each interface adjusts how it will participate in MultiWAN activities. Some examples follow.
Example: Load Balance Weight: 0 (Failover)
If “0” is used, FreshTomato won't route traffic if other WAN interfaces are functioning. However, a WAN connection with weight “0” will be automatically enabled if all other WAN interfaces with weight of 1 or more fail. This is commonly used in “failover” scenarios. When an interface with weight “0” is automatically enabled, it is assigned a weight of 1.
For example:
Let's assume we have 2 WANs, as follows:
When WAN1 fails, the failure is noticed. WAN0 will activate (assigned with weight: “1”) and begin routing packets.
Later, WAN1 recovers its connectivity. As soon as FreshTomato notices this, (within seconds or minutes), WAN0 will be set back to idle status while traffic is rerouted through the revived WAN1.
Recovering back to the originally active interface is called preempting. This is the default (fixed) behavior.
Example: Load Balance Weight: 1
Any value higher than “0” makes an interface actively route packets.
Weights are relative, so a weight: “1” doesn't mean much. Each weight is compared to the Weights of other interfaces to direct functionality.
Example: Load Balance Weight: 5
Basically, an interface set to weight: “5” would handle 5 new sessions before any other interface was used.
For example, say we have 3 WANs, as follows:
In this case, WAN0 would be used only if both WAN1 and WAN2 are both failing, and are unable to route packets. WAN1 will handle the very first new LAN client session going through the router. WAN2 is set to handle the second, third, fourth, fifth and sixth sessions. The seventh new session starts again from WAN1, as it would be treated as a another first new LAN client session. WAN2 will then handle the next five new sessions, meaning the eighth, ninth, tenth eleventh and twelfth sessions.
These settings affect outbound traffic only. Return traffic always tries to return to the WAN interface it came from. Since allocation of a new session to a WAN is dynamic, you can set which traffic gets allocated to which Interface (or “sticky connection”) in the MultiWAN routing configuration menu.
Modem device: Here, specify the 3G/4G/5G modem's Linux device path/filename.
To get modem details, log on to FreshTomato via Telnet/SSH and use the “lsusb” or “dmesg” commands .
PIN Code: is the 3-digit PIN code for the SIM card associated with your cell account.
Modem init string: is where you enter the modem's default initialization string.
APN: is the access point name (provided by your cell carrier).
Username: this is the (carrier-provided) username to access your cell carrier's APN gateway.
Password: is the (carrier-provided) password to authenticate to your cell carrier's APN gateway.
Network Type: appears when WAN type is set to 4G/LTE. (Default setting: 4G/3G/2G).
DNS Server:
Manually-set DNS servers can be helfpul if your ISP's DNS servers are slow/unreliable.
MTU: sets the Maximum Transmission Unit, (Ethernet frame size) for traffic between WAN and LAN.
This is for the WAN interface only-it won't affect LAN traffic. Varied MTU sizes across devices may cause problems.
Use DHCP: is rarely used. Generally, you should leave it disabled.
Single Line MLPPP: is outdated, and rarely used nowadays.
Single Line MLPPP is a version of Multilink PPP to let you use one modem to bond the bandwidth of multiple PPPoE sessions. A side effect of using it was that it bypassed some ISP's bandwidth throttling.
Route Modem IP: lets you access a modem “behind a router” with a quick configuration change. (Default: Off)
Query Hilink Modem IP: This function is only for Huawei USB modems supporting Hilink mode. (Default: Disabled).
Some Huawei modems have a “HiLink” operating mode. This function lets you communicate with a modem in Hilink mode connected to a network device other than the FreshTomato router. This can be useful for monitoring modem statistics, or signal strength.
Call Custom Status Script: TBD.
Connect Mode: chooses the method to keep the router connected to the Internet provider. (Default: Keepalive).
Redial Interval: When PPPoE dialling fails, this is used to delay attempts for the defined number
of seconds. This allows more time for the PPPoE server or network gear to restart proper operation
before trying to re-establish a PPPoE connection.
(Default: 10 seconds).
LCP Echo Interval: Link Control Protocol sends/receives frames between two peers to verify they're connected.
LCP Echo Link fail limit: is the number of failed LCP echo requests between peers before the status is considered dead.
Disable Watchdog: disables the Watchdog function, only for the WAN connection in that menu. (Default: Enabled/Tracert).
Watchdog Mode: regularly checks that a given WAN connection is up. This chooses the method used to test the connection.
The Watchdog function supports the following connection types: DHCP, PPPoE, PPTP, L2TP, 3G/4G/5G LTE
The LAN section includes information and settings to configure FreshTomato's LAN interface functions.
This includes:
Bridge: lets you Selects the bridge whose LAN settings will be modified
STP: enables Spanning Tree Protocol to prevent forwarding loops in switches. The default (off) is recommended, unless you are highly experienced.
IP Address: the IP Address to assign to the specified LAN interface. (Default: 192.168.1.1). FreshTomato supports Class A/B/C networks.
Netmask: the subnet mask associated with FreshTomato's LAN IP address. (Default: 255.255.255.0 - class “C” netmask).
DHCP: enables DHCP server functions in dnsmasq. (Default: Off)
IP Range (first/last): the range of IP addresses the DHCP server will assign to LAN clients. In the top field, enter the first valid address in the subnet. In the bottom field, enter the last valid address.
Lease Time (mins.): is the DHCP lease time, in minutes. (Default: 1440).
Automatic IP: lets FreshTomato obtain a LAN IP via DHCP. Since release 2022.6, you can select this option if the router is in AP Mode, Wireless Ethernet Bridge Mode or Media Bridge Mode.
After saving settings, the router's new, default address is 192.168.1.1 as it awaits DHCP details. That address changes once it obtains DHCP data.
These are settings for the Ethernet Ports State graphic in the Overview menu. For each port, the display shows Link status, Link speed and Diagnostic information.
Enable Ports State: Checking this enables the Ethernet Ports State graphic. (Default: On).
Show Speed Info: Checking this displays the link speed of each port, (1GB/100MB/10MB). (Default: On).
Invert ports order: Enabling this displays port icons in Ethernet Ports State in the opposite order from where they are on the hardware. This is useful when the sequence of display icons doesn't match the actual locations on the router. (Default: Off).
This feature causes FreshTomato to assess on which band a client device should connect, and then “nudges” the client towards that band.
Options include:
When enabled, these settings are saved to NVRAM, then replicated from the first wireless radio to all other radios:
(Visibility depends on the wireless security selected)
Among the wireless settings that will NOT be replicated are:
Client devices can also try to switch bands on their own, without the influence of Wireless Band Steering.
This feature is available since release 2020.8 (for ARM hardware only). See the Notes section for more on how it works.
The Wireless (2.4 GHz) section displays information and settings for the 2.4 GHz wireless network interface.
Your device may show a different device name than eth1. FreshTomato hardware device numbers begin at “0”. The first Ethernet device might be called “eth0”. The second wireless device might be called “wl1”.
Enable Wireless: When checked, this turns on the 2.4 GHz WiFi interface. When unchecked, the 2.4 GHz WiFi interface is off.
MAC Address: This displays the MAC address of the 2.4 GHz WiFi interface. Clicking on it takes you to the MAC Address page, where you can specify a custom MAC address for this interface.
Wireless Mode: This allows you to select the wireless mode (function) of the 2.4 GHz WiFi network interface.
Table: 2.4 GHZ Interface Wireless Modes | |
---|---|
Wireless Mode | Description |
Access Point | The (default) setting, which allows clients to connect to FreshTomato's wireless networks. - IPv4 & IPv6 communication work for both MIPS and ARM. |
Access Point WDS | Sets the router in “repeater mode”, allowing clients to connect via wireless while simultaneously acting as a WDS Wireless Distribution System base station. |
Wireless Client | The router connects to another router/access point as any other wireless client device would. - Wireless Client mode works for: MIPS devices (SDK5: RT and RT-N images) ARM devices (SDK6 & SDK7 & SDK714) starting with release 2021.5 - This mode does not work yet on SDK6 MIPS RT-AC builds. (Option will be removed from the GUI starting with Release 2024.3) - Only one wireless radio can be used in this mode. Other radio modules, (if present), can be used in Access Point mode. - Disable band steering if using this mode (at least for the initial setup. Advanced users may adjust nvram values for band steering). - The recommended security setup for WiFi connections is WPA2 Personal with AES. - If no connection is possible using the above, try WPA / WPA2 Personal + AES. - This is the recommended security setup for MIPS SDK5 (RT and RT-N) wireless client mode). |
Wireless Ethernet Bridge | Configures FreshTomato to connect to another router. All clients connected to both routers remain in the same subnet. - Since Wireless Ethernet Bridge 1.19, this mode must have security set to WPA2 to work properly. - IPv4 communication works for MIPS and ARM builds. - IPv6 communication will be blocked (Bug within wl driver =⇒ router may crash; Use Media Bridge Mode for IPv6 support) - ARM SDK7 not working/possible (Option will be removed from the GUI starting with Release 2024.3) - ARM SDK6 & SDK714 working correctly - MIPS SDK5: RT and RT-N working correctly - MIPS SDK6 RT-AC not working/possible (Option will be removed from the GUI starting with Release 2024.3) - Do not enable wireless band steering (BSD) while this mode is enabled. Recommendation: Use this interface only to connect to your main AP (no virtual interfaces). Other radio modules present can be used, for example, in A/P mode. |
Media Bridge Mode | Configures FreshTomato to connect to another router/access point. \\ All clients connected to both routers remain in the same subnet. - Support for this mode is available starting with release 2021.6 . - This mode is similar to Wireless Ethernet Bridge mode for SDK6 and up (only for MIPS RT-AC images and all ARM images). - Recommendations: Use Wireless Ethernet Bridge mode for MIPS RT and RT-N builds (like the RT-N16, E4200v1). - This Mode is not supported in SDK5 (RT / RT-N) builds. - ARM SDK6 & SDK7 & SDK714 working correctly - MIPS SDK6 RT-AC working correctly - Both IPv4 and IPv6 communication function well. You don't need to enable IPv6 via the web interface. IPv6 traffic will work. - Do not enable wireless band steering (BSD) if this mode is enabled. Reccomendation: use this interface only to connect to your main A/P (not to virtual interfaces). Other present radio modules can be used, for example, in A/P mode. |
WDS | Serve as a Wireless Distribution System (WDS) base station only. |
Table derived from (Creative Commons) Wikibooks - “Tomato Firmware/Menu Reference” Wireless Mode Selections |
Wireless Network Mode: This lets you choose which 802.11 WiFi protocols to make available to clients.
The network modes available in this dropdown will depend on your hardware.
These apply only to the 2.4 GHz band interface. There are separate Wireless Network Mode settings for any 5 GHz interface.
SSID: is the network name (Service Set IDentifier) for the 2.4 GHz WiFi interface. For security, you're advised not to include personal words which may indicate your identity, address, location, or equipment type. For example, “HELENLIUNG” would be a poor choice, unless you want everyone nearby to know who owns the network. Single dictionary words also make for very poor security.
(Default: FreshTomatoXX, where “XX” is the two numbers in the band.) For example, on the 2.4 GHz network, the default SSID is “FreshTomato24”.
Broadcast: enables SSID broadcasting. This “announces” the SSID on the air, so it's easy to find and connect to. Some argue that disabling SSID Broadcast provides more security. However, SSID names are easily sniffed using common software. Disabling them provides no real security increase.
Channel: selects the channel on which the 2.4 GHz radio interface will operate. Generally, you should choose a different channel than your neighbours are using. (Default: Auto).
Channel Width: lets you choose the width of the channel (in terms of frequency).
802.11n can use 40 MHz channel width, but to maintain compatibility with legacy systems, it uses one main 20 MHz channel plus a free adjacent channel 20 MHz above or below the main channel.
Control Sideband: lets you choose whether the extra sideband channel used is above (Upper) or below (Lower) the main channel used. (Default: Upper). This is only available If 20 or 40 Channel Width is selected.
Security: lets you select the security protocol used on the 2.4 GHz WiFi interface.
Shared Key: the shared key to authenticate WiFi clients on the LAN. Asterisks are shown until you insert your cursor.
Group Key Renewal: sets how often encryption keys used between clients and router are rotated/changed.
This is a part of the WPA protocol. (Default: 3600 seconds = 1 hour).
Starting with release 2023.5, you can adjust the key rotation interval within the following limits:
From 1 sec to 2592000 sec [for ARM-based and MIPS RT-N / MIPS-RT-AC hardware]
Where: 0 = disabled (not recommended)
In releases 2023.4 and earlier, the limits for all hardware were: 60 sec to 7200 sec.
The Wireless (5 GHz) section displays information and settings for the wireless network interface on the 5 GHz WiFi band.
Your device may show a different device name than eth1. Note: FreshTomato hardware device numbers begin at 0.
For example, the first Ethernet device might be called eth0. The second wireless device might be called wl1.
Typically, the 5 GHz WiFi band has higher bandwidth, but shorter distance propagation than the 2.4 GHz band.
Enable Wireless: Checking this turns on the 5 GHz WiFi interface. When unchecked, the 5 GHz WiFi interface is turned off.
MAC Address: This displays the MAC (hardware) address of the 5 GHz WiFi interface.
Clicking on the MAC address takes you to the MAC Address page, where you can choose your own MAC address for this interface.
Wireless Mode: This lets you choose the wireless mode (function) of the 5 GHz WiFi interface.
Table: 5 GHz interface Wireless Mode | |
---|---|
Wireless Mode | Description |
Access Point | The (default) setting, which allows clients to connect to FreshTomato's wireless network(s). - IPv4 & IPv6 communication work for both MIPS and ARM. |
Access Point WDS | Sets the router in “repeater mode”, allowing clients to connect via WiFi while acting as a WDS Wireless Distribution System base station. |
Wireless Client | The router connects to another router/access point as any other wireless client device would. - Wireless Client mode works for: MIPS devices (SDK5: RT and RT-N images) and ARM devices (SDK6 & SDK7) starting with release 2021.5 - This mode does not yet work on SDK6 MIPS RT-AC images. - Only one wireless radio can be used in this mode. Other radio modules present can be used in A/P mode. - Disable Wireless Band Steering when in this mode during default setup. (Advanced users can adjust band steering NVRAM values). - [WPA2 Personal with AES] is the recommended security setup for WiFi connections. - If connection won't establish using the above, try [WPA / WPA2 Personal + AES]. This is the recommended security configuration for MIPS SDK5 (RT and RT-N) wireless client mode. |
Wireless Ethernet Bridge | Configures FreshTomato to connect to another router. All clients connected to both routers remain in the same subnet. - As of version 1.19, this mode must have security set to WPA2 to work properly. - IPv4 communication works for MIPS and ARM builds. - IPv6 communication will only work for FreshTomato 2021.1 SDK6 ARM Dual-Core and newer - SDK7 not working/possible. - Do not enable wireless band steering (BSD) while this mode is enabled. - Recommendation: Use Wireless Ethernet Bridge only to connect to your main AP (no virtual interfaces). Other radio modules can be used, for example, in AP mode. |
Media Bridge Mode | Configures FreshTomato to connect to another router/access point. All clients connected to both routers remain in the same subnet. - This new mode is similar to Wireless Ethernet Bridge mode for SDK6 and up (for MIPS RT-AC and all ARM images). - Using Wireless Ethernet Bridge mode is recommended for MIPS RT and RT-N images (like the RT-N16, E4200v1). - This Mode is not supported with SDK5 (RT / RT-N) builds - Both IPv4 and IPv6 communication function. IPv6 traffic works without needing to enable IPv6 in the web interface. . - Support for this mode started with release 2021.6. - Do not enable wireless band steering with this mode enabled. - You should use use Media Bridge interface to connect to your main AP only (no virtual interfaces). Other radio modules can be used, for example, in AP mode. |
WDS | FreshTomato will act only as a Wireless Distribution System (WDS) base station. |
Table derived from (Creative Commons) Wikibooks - “Tomato Firmware/Menu Reference” Wireless Mode Selections |
Wireless Network Mode: This lets you choose which 802.11 WiFi protocol(s) to make available to clients.
Note that only releases 2021.8 and later have have a separate setting for 802.11ac. Earlier releases don't.
Separate Wireless Network Mode settings will exist for any 2.4 GHz band interface. See the 2.4 GHz section.
(Default: Auto)
SSID: is network name of the 5 GHz WiFi. For security, don't include personal words/phrases here that indicate your identity, address, location, or equipment type. For example, “HELENLIUNG” would be a poor choice, unless you want everyone nearby to know who owns that network. Single dictionary words also make for poor security.
(Default: FreshTomatoXX, where “XX” is the digits in the band.) For example, on a 5 GHz network, the default SSID is “FreshTomato50”.
Broadcast: this enables SSID broadcasting. This “announces” the SSID on the air, so it's easy to find/ connect to. Some argue disabling SSID Broadcast provides more security. However, SSIDs names are easily sniffed with common software, so disabling SSID Broadcast provides little increase in security.
Channel: Selects the channel on which the 5 GHz radio interface will operate. (Default: Auto).
Generally, it's wise to choose a different channel than the one your neighbours are using.
Channel Width: This allows you to choose the width of the channel (in terms of frequency).
20 MHz channels on the 5 GHz band have no overlap, so the 5GHz band is less prone to interference and noise. Larger channel widths provide more speed/bandwidth if there's low interference. Interference is more common on the 2.4 GHz band. It's usually fine to choose a wider channel width here. However, if you see slowdowns or trouble authenticating/associating with the router, you may need to use a narrower channel width.
802.11N can use 40 MHz channel width. However, to maintain legacy compatibility, it uses a main 20 MHz channel plus a free adjacent channel 20 MHz above or below the main channel.
Control Sideband: This option is available only if the 40, 80 or 160 MHz Channel Width is selected. This lets you choose whether the extra channel used is above (Upper) or below (Lower) the main channel being used. (Default: Upper).
Starting with release 2023.3, this menu will allow you to choose the exact control channel for use FixME!
Security: This menu lets you select the security protocol that will be used on the 2.4 GHz WiFi interface.
Shared Key: Here, enter the shared key to authenticate WiFi clients on the network. Asterisks are shown until you click your cursor.
Group Key Renewal: sets how often encryption keys used between clients/router are rotated. This is part of the WPA protocol.
(Default: 3600 seconds). See the first wireless radio unit for more details.
Specifically, enabling this option does the following:
# 2018-01-19 # Reduce and flush the route cache to ensure a more synchronous load-balancing across multi-wan # https://vincent.bernat.im/en/blog/2011-ipv4-route-cache-linux /bin/echo 1 > /proc/sys/net/ipv4/route/flush /bin/echo 1 > /proc/sys/net/ipv4/route/secret_interval /bin/echo 0 > /proc/sys/net/ipv4/route/min_delay /bin/echo 1 > /proc/sys/net/ipv4/route/max_delay /bin/echo 1 > /proc/sys/net/ipv4/route/gc_interval /bin/echo 1 > /proc/sys/net/ipv4/route/gc_elasticity /bin/echo 1 > /proc/sys/net/ipv4/route/gc_min_interval_ms /bin/echo 0 > /proc/sys/net/ipv4/route/gc_min_interval /bin/echo 1 > /proc/sys/net/ipv4/route/gc_thresh /bin/echo 1 > /proc/sys/net/ipv4/route/gc_timeout #Causes connectivity issues if this value is too small, use defaults or tune accordingly /bin/echo 512 > /proc/sys/net/ipv4/route/max_size
Support for Baby Jumbo Frames (RFC 4638) was added starting with release 2021.3. This function works only on gigabit routers. Not all ISPs support Jumbo Frames for PPPoE (RFC 4638).
To enable Baby Jumbo Frames:
nvram set tcp_clamp_disable=1
at a FreshTomato command prompt).
This example shows the default parameters to steer clients from the 2.4 GHz band to the 5 GHz band:
Steer Policy: max=0 period=5 cnt=3 rssi=-52 phyrate_high=110 phyrate_low=0 flags=0x22 state=3 Rule Logic: OR RSSI: Greater than VHT: Allowed NON VHT: Allowed NEXT RF: NO PHYRATE (HIGH): Greater than or Equal to LOAD BALANCE: NO STA NUM BALANCE: NO PHYRATE (LOW): Less than N ONLY: NO
This example shows default parameters to steer clients from the 5 GHz band to the 2.4 GHz band:
Steer Policy: max=80 period=5 cnt=3 rssi=-82 phyrate_high=0 phyrate_low=0 flags=0x20 state=2 Rule Logic: OR RSSI: Less than or Equal to VHT: Allowed NON VHT: Allowed NEXT RF: NO PHYRATE (HIGH): Greater than or Equal to LOAD BALANCE: NO STA NUM BALANCE: NO PHYRATE (LOW): Less than N ONLY: NO
For more details, see:
https://www.smallnetbuilder.com/wireless/wireless-howto/32653-asus-rt-ac3200-smart-connect-the-missing-manual?start=0