The Network page includes most basic settings needed to configure the network. It is divided into sections including MultiWAN, WAN Settings, Ethernet Ports Configuration, LAN and Wireless setttings.

Number of WAN ports: This lets you select the number of WAN ports to be used on the device.

On routers with only one physical WAN interface, options with WAN ports larger than one will be greyed out. This allows you to select only “1 WAN” on such devices.

Tune route cache: This is intended for Multiwan configurations with load balancing.

This setting is recommended if two or more WANs have a weight larger than 0. Essentially, this uses kernel tweaks to improve workload sharing.

Specifically, enabling this option does the following:

# 2018-01-19
# Reduce and flush the route cache to ensure a more synchronous load-balancing across multi-wan
# https://vincent.bernat.im/en/blog/2011-ipv4-route-cache-linux
 
/bin/echo 1 > /proc/sys/net/ipv4/route/flush
/bin/echo 1 > /proc/sys/net/ipv4/route/secret_interval
/bin/echo 0 > /proc/sys/net/ipv4/route/min_delay
/bin/echo 1 > /proc/sys/net/ipv4/route/max_delay
/bin/echo 1 > /proc/sys/net/ipv4/route/gc_interval
/bin/echo 1 > /proc/sys/net/ipv4/route/gc_elasticity
/bin/echo 1 > /proc/sys/net/ipv4/route/gc_min_interval_ms
/bin/echo 0 > /proc/sys/net/ipv4/route/gc_min_interval
/bin/echo 1 > /proc/sys/net/ipv4/route/gc_thresh
/bin/echo 1 > /proc/sys/net/ipv4/route/gc_timeout
 
#Causes connectivity issues if this value is too small, use defaults or tune accordingly
/bin/echo 512 > /proc/sys/net/ipv4/route/max_size

Check Connections Every: This makes it easy for FreshTomato to automatically test your WAN connection reliability. (Default: Disabled). Choosing any setting except [Disabled] will execute the Watchdog script. This setting specifies how often the router sends ICMP ping packets to check it is still connected to the Internet.

The Watchdog script uses ping or traceroute to test WAN connection status.

Choosing a setting other than Disabled will make the “Target 1” and “Target 2” fields appear.

• Target 1: Here, enter the address of the first host to ping regularly (Default: Google.com)
• Target 2: Here, enter the address of the second host to ping regularly (Default: Microsoft.com)
  
  

Settings in this section are used to configure the WAN interface. These setting depends on your ISP.

Depending on the type selected, other settings specific to that type of connection will be shown or hidden.

Type: This sets the connection mode the WAN interface will use to connect to your ISP. (Default: DHCP).

• DHCP: Your ISP's DHCP server will dynamically assign a WAN IP lease to FreshTomato.
  • DHCP does not use authentication.

• PPPoE: The WAN port will respond to authentication requests from your ISP's PPPoE server.
  • PPPoE is most often used for DSL networks.
  • This requires you to store in FreshTomato the PPPoE username and password assigned by your ISP.
  • If authentication succeeds, the PPPoE server allows logon to the ISP network, and a DHCP server assigns you a WAN IP lease.
  • Leave the Service Name field blank.
  • Starting with release 2021.3, support for Baby Jumbo Frames (RFC 4638) was added.
  • Baby Jumbo Frames support is in the Miscellaneous menu.
  • When using Baby Jumbo Frames, set MTU to 1500 to correspond with the Baby Jumbo Frames change. (See also the notes)

• Static: This choice will configure your WAN port with a static IP.
  • You must manually enter the following settings in FreshTomato, given to you by your ISP:
    • Static IP address
    • Subnet mask
    • Gateway address
    • DNS server addresses
  • Usually, static mode is used for business accounts, when it's important the IP address doesn't change.

• PPTP: This configures the WAN port to use Microsoft's PPTP (VPN) tunnelling protocol to connect.
  • PPTP's encryption provides some security, so account credentials can't easily be stolen.
  • PPTP will require you to enter:
    • a username
    • password
    • gateway server settings (given by your ISP).

• L2TP: Choosing this will configure your WAN port to connect using Cisco's Layer Two Tunnelling Protocol.
  • By default, only L2TP control messages are encrypted, not content.
  • L2TP provides a tunnel for layer 2 protocols. Content is encrypted by layer 2 protocols, such as Ethernet or PPP.
    • FreshTomato will require you enter the following, provided by your ISP:
      • L2TP username
      • Password
      • L2TP server static IP address
      • Subnet mask
      • Gateway setting

• 3G modem: This setting will enable support for 3G GSM (cellular) USB modems.
  • Ensure USB and 3G/4G modem support are checked in USB Support , or the modem may not be detected.

• 4G/LTE: This enables support for fourth generation GSM (cellular) / LTE USB modems.
  • When choosing 4G, the PIN code and APN fields appear. These must be filled with correct settings (see below).
  • Ensure USB and 3G/4G modem support are enabled in the USB Support menu or the modem might not be detected.

• Disabled: Disables the physical WAN port on your router.
  • This effectively makes your FreshTomato device function only as a switch (if it has those functions) and/or;
  • It may effectively make your FreshTomato device function as a WiFi access point (if it has those functions).

Wireless Client Mode: This enables FreshTomato's Wireless Client mode.

Wireless client mode allows the FreshTomato router to act as a client and connect to another router/AP. This is similar to how a normal WiFi adapter connects to a router/AP. (For details, see Wireless Mode tables below).

• Options include:
  • Disabled: FreshTomato's Wireless Client mode will be disabled.
  • 2.4 GHz: FreshTomato will enable Wireless Client mode on the 2.4 GHz interface.
  • 5 GHz: FreshTomato will enable Wireless Client mode on the 5 GHz interface.

Modem device: Here, you specify the 3G modem's Linux device path/filename.

• If you're not sure what to choose, check the 3G/4G/5G Dongle compatibility page to see if your modem is listed there.
• To ensure your modem is detected, check USB Support is enabled in the USB Support menu.
• When you set 3G modem or 4G/LTE as the WAN type, other fields will appear, prompting you for more information.
• The Default device filename is the first serial device on the first USB port: (/dev/ttyUSB0).
• The “tty” part of the device's filename represents a serial device.
• The “USB0” part of the device's filename means the device is connected to the first USB port.
• Devices listed as “/ttyUSB” use the newer Serial→USB device driver framework.
  • This device type uses Linux's serial modem driver framework.
• If the interface lists: “/dev/ttyACM0“ instead, “ACM” means device type is: “Abstract Control Model”
  • ACM modems let the modem hardware perform analog functions.

To get device details, you could also log on to FreshTomato via Telnet/SSH and use the lsusb or dmesg commands .

PIN Code: This is the 3-digit PIN code for the SIM card associated with your cell account.

• Leave this blank if your SIM card code was deactivated.

Modem init string: Here, enter the modem's default initialization string.

• This will come from your cell provider, or the modem manufacturer. (Default: *99#).

APN: The access point name (provided by your carrier).

• This specifies a gateway to route data between your cell carrier and the Internet. (Default: internet).

Username: Here you enter the username to access your cell carrier's APN (provided by your cell carrier) gateway.

• Some carriers don't require this info.

Password: Here, enter the password to authenticate to your cell carrier's APN (provided by your cell carrier) gateway.

• Some carriers do not require this info.

Network Type: This menu appears when WAN type is set to 4G/LTE. (Default setting: 4G/3G/2G).

• The default setting configures FreshTomato to start negotiating with a 4G connection.
• If that fails, fall back to negotiating a 3G connection, and failing that, a 2G connection.

DNS Server:

• AUTO - FreshTomato uses the DNS server addresses included in your Internet Provider's DHCP lease.
• Manual - Enables FreshTomato's DNS server function (dnsmasq). This makes the “DNS 1” and “DNS 2” fields appear.
  • DNS 1: Enter the first DNS server address here. (only when DNS Server is set to Manual).
  • DNS 2: Enter the second DNS server address here. (only when DNS Server is set to Manual).

Manually-chosen DNS servers are useful if your ISP's DNS servers are slow or unreliable. They can also be used for content filtering.

MTU: This sets the Maximum Transmission Unit, or maximum Ethernet frame size for traffic between WAN and LAN.

This is only for the WAN interface and won't affect LAN traffic. However, different MTU sizes among devices can cause problems.

• (Default: 1500), is typical for Ethernet devices, and is usually suitable.
• When Default is selected, the number in the Manual field is greyed out and can't be changed.
• Manual: Selecting this lets you to enter a custom number in the field beside it.
• Jumbo Frame sizes usually start at a size of 2000 bytes.

Use DHCP: This function is rarely used, and it is recommended you leave it disabled.

• On a few Internet providers, addressing is separated from PPPoE functionality.

Single Line MLPPP: This is similar to Multilink PPP (MLPPP).

Multilink PPP is a PPP version that allows you to bond two or more physical connections to increase apparent bandwidth. Single Line MLPPP is a version which lets you use one modem, and bond the bandwidth of multiple PPPoE sessions. A side effect of using this is that it bypassed some Internet Providers' bandwidth throttling. This is rarely used these days.

Route Modem IP: This function lets you access a modem “behind a router” with a simple configuration change. (Default: Off)

• When using a separate modem and router, typically you put the modem in bridge mode/PPPoE passthrough mode.
• That means you can't easily access the modem's LAN interface while it's “behind” the router.
• The router's WAN interface has a public IP address, but the modem is reachable only via a private LAN address.
• Private addresses aren't Internet routable, so by default, FreshTomato would block LAN > WAN > MODEM PRIVATE IP traffic.
• Route Modem IP adds a simple static route to the routing table, giving the modem a private IP on a /32 subnet.
• This will make the private IP address reachable via the WAN interface.
• The /32 subnet mask allows only one host. Therefore, only the modem will be reachable on that subnet.

Query Hilink Modem IP: This function is only for Huawei USB modems supporting Hilink mode. (Default: Disabled).

Some Huawei modems have a mode of operation called HiLink mode. Enabling this setting allows you communicate with a modem in HiLink mode which is connected to a device elsewhere on the network (not attached to the local FreshTomato device). This is useful, for example, when monitoring LTE statistics, or signal strength.

Call Custom Status Script: TBD.

Connect Mode: This chooses the method used to keep the router connected to the Internet provider. (Default: Keepalive).

• Selecting Connect on Demand will make FreshTomato disconnect from the ISP after the period in the Max Idle Time field.
  • FreshTomato will reconnect to the Internet a soon as any LAN client requests Internet access.
• Some ISPs drop a connection if their router detects no Internet activity.
  • Selecting Keepalive, FreshTomato will send small keepalive packets at brief, specified intervals.
    • This makes it look to the ISP that there's intermittent activity, even when no clients request Internet access.
• Redial Interval: Here, enter how often the router should check the Internet connection. (Default: 10 seconds).
  • This option minimizes your Internet connection response time, since generally, the connection will always be up.

Redial Interval: When PPPoE dialling fails, the Redial Interval is used to delay each attempt for the defined number of seconds.

• (Default: 10 seconds).
• This allows more time for the PPPoE server or network gear to restart proper functioning before trying a PPPoE connection again.

LCP Echo Interval: The Link Control Protocol sends and receives frames between two peers to check if they're still connected.

• The LCP Echo Interval is the period between these signals. Usually, this is used to verify a DSL modem's PPPoE is still connected to the ISP.
• (Default: 10 seconds).

LCP Echo Link fail limit: This is the number of times LCP echo requests can fail between LCP peers before the status is deemed to be dead.

• The client DSL modem will then drop the PPPoE link.
• When the link is terminated, LCP will try to renegotiate a new PPPoE session.

The LAN section includes information and settings to configure FreshTomato's LAN interface functions.

This includes FreshTomato's:

• LAN IP address and (sub)netmask
• Spanning Tree Protocol function
• DHCP server status and settings (through dnsmasq), such as scope and lease time
• Stubby (DNS-over-TLS) setting and WINS settings

Bridge: Selects the bridge whose LAN settings will be modified

STP: Checking this enables Spanning Tree Protocol. This is used primarily to prevent forwarding loops in switches. The recommended setting is off, unless you are highly experienced with networking. (Default: Off).

IP Address: Here you enter the IP Address you want to assign to the specified LAN interface. (Default: 192.168.1.1)

Netmask: The (sub)netmask associated with FreshTomato's LAN IP address. (Default: 255.255.255.0 - a class C netmask).

DHCP: Checking this enables DHCP server functions in dnsmasq. (Default: Off)

IP Range (first/last) : In the top field, enter the first allowable address in the subnet. In the bottom field, enter the last address. This will form the range of IP addresses FreshTomato's DHCP server will assign to LAN clients.

Lease Time (mins.): This is the DHCP lease time, in minutes. (Default: 1440 = one day).

Automatic IP: Starting in release 2022.6, the user can select this option if the router is in Access Point Mode or Wireless Ethernet Bridge Mode or Media Bridge Mode. This option will allow FreshTomato to obtain a LAN IP via DHCP.

Note: After saving the settings, the router's new IP address is 192.168.1.1 (default) while waiting for DHCP Server Infos. IP address will change to a.b.c.d (obtained IP via DHCP).

This section has settings for the Ethernet Ports State graphic in the Overview menu. The graphic shows the status, link speed, and other diagnostic information for each Ethernet port on the router.

Enable Ports State: Checking this enables the Ethernet Ports State graphic on the Overview page. (Default: On).

Show Speed Info: Checking this displays the link speed of each Ethernet port, (such as 1GB/100MB/10MB). (Default: On).

Invert ports order: Checking this option displays the port icons in the Ethernet Ports State graphic in the opposite order of the default where they are located on the switch. This is useful in when the sequence of icons on the Ethernet Ports State does not match the actual port locations on the router's switch. (Default: Off).

Options:

With Wireless Band Steering enabled, FreshTomato can assess, for each dual- or tri-band client, on which band the client device should try to connect and “nudge” it towards that band.

• Disable *
• Enable

To achieve this, for all WiFi interfaces, enter the same:

• SSID name
• Security settings
• Password
• Other settings (see picture below)

Remember that client devices can also try to switch bands on their own, without the influence of Wireless Band Steering.

Wireless Band Steering is available starting with release 2020.8 (only for ARM hardware).

This example shows the default parameters to steer clients from the 2.4 GHz band to the 5 GHz band:

Steer Policy:
max=0 period=5 cnt=3 rssi=-52 phyrate_high=110 phyrate_low=0 flags=0x22 state=3
Rule Logic: OR
RSSI: Greater than
VHT: Allowed
NON VHT: Allowed
NEXT RF: NO
PHYRATE (HIGH): Greater than or Equal to
LOAD BALANCE: NO
STA NUM BALANCE: NO
PHYRATE (LOW): Less than
N ONLY: NO

This example shows default parameters to steer clients from the 5 GHz band to the 2.4 GHz band:

Steer Policy:
max=80 period=5 cnt=3 rssi=-82 phyrate_high=0 phyrate_low=0 flags=0x20 state=2
Rule Logic: OR
RSSI: Less than or Equal to
VHT: Allowed
NON VHT: Allowed
NEXT RF: NO
PHYRATE (HIGH): Greater than or Equal to
LOAD BALANCE: NO
STA NUM BALANCE: NO
PHYRATE (LOW): Less than
N ONLY: NO

For more details, see:
https://www.smallnetbuilder.com/wireless/wireless-howto/32653-asus-rt-ac3200-smart-connect-the-missing-manual?start=0

The Wireless (2.4 GHz) section displays information and settings for the wireless network interface on the 2.4 GHz WiFi band.

Your device may show a different device name than eth1. Note: FreshTomato hardware device numbers begin at 0. For example, the first Ethernet device might be called eth0. The second wireless device might be called wl1.

Enable Wireless: When checked, this turns on the 2.4 GHz WiFi network interface. When unchecked, the 2.4 GHz WiFi interface is off.

MAC Address: This displays the MAC address of the 2.4 GHz WiFi radio interface. Clicking on it takes you to the MAC Address page, where you can specify your own MAC address for this interface.

Wireless Mode: This allows you to select the wireless mode (function) of the 2.4 GHz WiFi network interface.

Wireless Network Mode: This lets you choose which 802.11 WiFi protocol(s) to make available to clients.

The network modes available in this dropdown will depend on your hardware.

• Auto: * FreshTomato and WiFi client devices negotiate the best protocol automatically.
  • Auto is recommended, unless you're very knowledgeable about networking.
  • Compatibility issues can create many problems. Often, the “logical” setting isn't the best one.
• B Only: This allows WiFi clients to connect using only the 802.11b protocol.
• G Only: This allows WiFi clients to connect using only the 802.11n protocol.
• B/G Mixed: This allows clients to connect using either 802.11b or 802.11g protocols.
• N only: This allows clients to connect using only the 802.11n protocol.

These apply only to the 2.4 GHz band interface. There are separate Wireless Network Mode settings for any 5 GHz interface.

(Default: Auto)

SSID: This is the network name (Service Set IDentifier) for the 2.4 GHz WiFi interface. For security reasons, it's recommended you don't include personal words or phrases which may indicate your identity, address, location, or equipment type here. For example, “HELENLIUNG” would not be a good choice, unless you want everyone on the street to know who owns the network. Dictionary words also make for poor security.
(Default: FreshTomatoXX, where “XX” is the two numbers in the frequency band.) On the 2.4 GHz network, for example, the default SSID is “FreshTomato24”.

Broadcast: Checking this enables SSID broadcasting. This “announces” the SSID on the air, so it's easy to find and connect to. Some argue that disabling SSID Broadcast provides more security. However, SSIDs names are easily sniffed using common software. Thus, disabling SSID Broadcast provides little increase in security.

Channel: Selects the channel on which the 2.4 GHz radio interface will operate. Generally, it's best to choose a different channel than your neighbours are using. (Default: Auto).

• Auto: This default is generally safe unless there's significant interference from other networks or equipment. FreshTomato chooses and uses the channel it believes has the least interference.
• Channel: This menu lets you manually choose available channels on the band. Unavailable channels won't appear here.

Channel Width: This menu lets you choose the width of the channel (in terms of frequency).

• 20 MHz
• 40 MHz

802.11n can use 40 MHz channel width, but to maintain compatibility with legacy systems, it uses one main 20 MHz channel plus a free adjacent channel 20 MHz above or below the main channel.

Control Sideband: This option is only available If the 20 or 40 Channel Width is selected. This menu allows you to choose whether the extra sideband channel used is above (Upper) or below (Lower) the main channelused. (Default: Upper).

• Upper
• Lower

Security: This menu lets you select the security protocol that will be used on the 2.4 GHz WiFi interface.

• Disabled: disables security entirely, leaving the network open to anyone. Avoid using this.
  • This is a basically an unlimited security risk.

• WEP: enables Wired Equivalent Privacy protocol. Avoid using this.
  • This is obsolete due to serious vulnerabilities, such as weak encryption.

• WPA Personal: enables WiFi Protected Access Protocol 1.x. WPA uses the RC4-based TKIP protocol.
  • This lets hosts exchange pre-shared keys, for more security.
  • While more secure than WEP, WPA still has weaknesses, like lower encryption standards.
  • WPA2 is strongly encouraged instead of WPA.

• WPA Enterprise: also known as WPA-802.1X. This is similar to WPA Personal, but each user has their own username/password
  • No common pre-shared key is used.
  • WPA Enterprise doesn't require a RADIUS server. Often, one is used anyway for compatibility and security reasons.
  • WPA Enterprise is more secure against dictionary attacks on short passwords.
  • This is suitable for larger, more formal networks.

• WPA2 Personal: WiFi Protected Access version 2 uses elements of the 802.11i standard.
  • This supports mandatory use of AES encryption. It is much more secure than older protocols.
  • WPA2 Personal is recommended for small to mid-sized, informal networks.

• WPA2 Enterprise: This enables the Enterprise version of WPA2.
  • This uses WPA2, but each user has their own WiFi username/passkey, not a common pre-shared key.
  • WPA2 Enterprise is based on parts of 802.11i.
  • This does NOT require a RADIUS server, but one is often used for legacy purposes for compatibility and security.
  • This is appropriate for larger, more structured networks.

• WPA / WPA2 Personal:

• WPA / WPA2 Enterprise:

• RADIUS: Enables Remote Access Dialup User Service.
  • This is designed for larger organizations.
  • This uses a separate server to authenticate, permit and keep track of users.
  • This supports authentication via certificates, which eases user management.
  • This is usually only for advanced users.

Shared Key: Here, enter the shared key which authenticates the WiFi client on the network. The field shows only asterisks until you click your cursor in it.

Group Key Renewal: This sets the interval for how often encryption keys used between client devices and the router/access point are rotated/changed. This is a part of the WPA protocol. (Default: 3600 seconds = 1 hour).

The Wireless (5 GHz) section displays information and settings for the wireless network interface on the 5 GHz WiFi band.

Your device may show a different device name than eth1. Note: FreshTomato hardware device numbers begin at 0.
For example, the first Ethernet device might be called eth0. The second wireless device might be called wl1.

Typically, the 5 GHz WiFi band has higher bandwidth, but shorter distance propagation than the 2.4 GHz band.

Enable Wireless: Checking this turns on the 5 GHz WiFi interface. When unchecked, the 5 GHz WiFi interface is turned off.

MAC Address: This displays the MAC (hardware) address of the 5 GHz WiFi interface.
Clicking on the MAC address takes you to the MAC Address page, where you can choose your own MAC address for this interface.

Wireless Mode: This lets you choose the wireless mode (function) of the 5 GHz WiFi interface.

Wireless Network Mode: This lets you choose which 802.11 WiFi protocol(s) to make available to clients.

• Auto - On this setting, FreshTomato and WiFi clients negotiate the best wireless protocol automatically.
  • Auto is recommended unless you are highly experienced with networking/WiFi.
  • Compatibility issues can create problems. Often, the most “logical” setting is not the best.
• A Only - allows WiFi clients to connect using only the 802.11a protocol.
• N Only - allows clients to connect using only the 802.11n protocol.
• N/AC mixed - allows clients to connect using only 802.11AC or 802.11N.
• AC Only - allows clients to connect using only the 802.11ac protocol.

Note that releases before 2021.8 do NOT have a separate setting for 802.11ac. That only arrived with 2021.8 .

Separate Wireless Network Mode settings will exist for any 2.4 GHz band interface. See the 2.4 GHz section.
(Default: Auto)

SSID: This the 5 GHz WiFi interface's network name, (Service Set IDentifier). For security purposes, it's recommended you don't include any personal words or phrases which might indicate your identity, address, location, or equipment type here. For example, “HELENLIUNG” would not be a good choice, unless you want everyone on the street to know who owns that network. Common dictionary words also make for poor security.

(Default: FreshTomatoXX, where “XX” is the two digits in the frequency band.) For example, on a 5 GHz network, the default SSID is “FreshTomato50”.

Broadcast: Checking this enables SSID broadcasting. This “announces” the SSID (network name) on the air, so it's easy to find and connect to. Some argue that disabling SSID Broadcast provides more security. However, SSIDs names can easily be sniffed with common software. Thus, disabling SSID Broadcast provides little increase in security.

Channel: Selects the channel on which the 5 GHz radio interface will operate.

Generally, it's a good idea to choose a different channel than the one your neighbours are using.

• Auto: This is the default, and is generally safe unless you have significant interference from nearby networks or equipment.
  • On this setting, FreshTomato selects and uses the channel it believes has the least interference.
• Channel: This lets you manually choose available WiFi channels on the band. Unavailable channels will not appear here.

(Default: Auto).

Channel Width: This menu allows you to choose the width of the channel (in terms of frequency).

• 20 MHz
• 40 MHz
• 80 MHz
• 160 MHz (not yet supported. May be supported on some SDK714 models)

The 20 MHz channels on the 5 GHz band have no overlap. Therefore, the 5GHz band is less prone to interference and noise. Larger channel widths provide more speed/bandwidth if there's minimal interference. Interference is more common on the 2.4 GHz band than it on the 5 GHz band. It is usually fine to choose a wider channel width here. However, if you see effects, such as slow speeds or trouble authenticating/associating with the router, you may need to use a narrower channel width.

802.11N can use 40 MHz channel width, but to maintain compatibility with legacy systems, it uses one main 20 MHz channel plus a free adjacent channel 20 MHz above or below the main channel.

Control Sideband: This option is available only if the 40, 80 or 160 MHz Channel Width is selected. This menu allows you to choose whether the extra channel used is above (Upper) or below (Lower) the main channel being used. (Default: Upper).

Security: This menu lets you select the security protocol that will be used on the 2.4 GHz WiFi interface.

• Disabled: disables security entirely, leaving the network open to anyone. Avoid using this.
  • This is a basically an unlimited security risk.

• WEP: enables Wired Equivalent Privacy protocol. Avoid using this.
  • This is obsolete due to serious vulnerabilities, such as weak encryption.

• WPA Personal: enables WiFi Protected Access Protocol 1.x. WPA uses the RC4-based TKIP protocol.
  • This lets hosts exchange pre-shared keys, for more security.
  • While more secure than WEP, WPA still has weaknesses, like lower encryption standards.
  • WPA2 is strongly encouraged instead of WPA.

• WPA Enterprise: also known as WPA-802.1X. This is similar to WPA Personal, but each user has their own username/password
  • No common pre-shared key is used.
  • WPA Enterprise doesn't require a RADIUS server. Often, one is used anyway for compatibility and security reasons.
  • WPA Enterprise is more secure against dictionary attacks on short passwords.
  • This is suitable for larger, more formal networks.

• WPA2 Personal: WiFi Protected Access version 2 uses elements of the 802.11i standard.
  • This supports mandatory use of AES encryption. It is much more secure than older protocols.
  • WPA2 Personal is recommended for small to mid-sized, informal networks.

• WPA2 Enterprise: This enables the Enterprise version of WPA2.
  • This uses WPA2, but each user has their own WiFi username/passkey, not a common pre-shared key.
  • WPA2 Enterprise is based on parts of 802.11i.
  • This does NOT require a RADIUS server, but one is often used for legacy purposes for compatibility and security.
  • This is appropriate for larger, more structured networks.

• WPA / WPA2 Personal: This uses WPA2 Personal, and if that fails, allows WPA security

• WPA / WPA2 Enterprise: This uses WPA2 Enterprise, or WPA.

• RADIUS: Enables Remote Access Dialup User Service.
  • This is designed for larger organizations.
  • This uses a separate server to authenticate, permit and keep track of users.
  • This supports authentication via certificates, which eases user management.
  • This is usually only for advanced users.

Shared Key: Here, enter the shared key which authenticates the WiFi client on the network. The field shows only asterisks until you click your cursor in it.

Group Key Renewal: This sets how often encryption keys used between clients and the router are rotated/changed. This is part of the WPA protocol.

(Default: 3600 seconds).

Support for Baby Jumbo Frames (RFC 4638) was added starting with release 2021.3. This function works only on gigabit routers. Not all ISPs support Jumbo Frames for PPPoE (RFC 4638).

To enable Baby Jumbo Frames:

• Go the Miscellaneous menu. Check Enable jumbo frame support in that menu. The router will reboot.
• In the Network menu, Set the MTU option to manual, and enter an MTU value of 1500 for PPPoE operation. (Usually, packet size will be 1492)
• Clamping can be manually disabled, if needed. (Type nvram set tcp_clamp_disable=1 at a FreshTomato command prompt).
• Ping with packet size 1472 to verify that you have a working PPP MTU of 1500.