User Tools
basic-network
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| basic-network [2024/02/21 02:19] – [WAN(x) Settings] -clarify Load Balance Weights 1 and 5 hogwild | basic-network [2025/08/28 03:25] (current) – old revision restored (2025/08/28 03:10) hogwild | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| ====== Network ====== | ====== Network ====== | ||
| - | The Network | + | This page includes most basic settings needed to configure |
| + | |||
| + | Default settings are denoted with an asterisk (" * ") | ||
| + | |||
| + | \\ | ||
| ===== MultiWAN ===== | ===== MultiWAN ===== | ||
| - | {{: | + | {{: |
| \\ | \\ | ||
| - | **Number of WAN ports**: | + | **Number of WAN ports**: lets you select the number of WAN ports to be used on the device. |
| - | On routers | + | On models |
| \\ | \\ | ||
| - | **Tune route cache**: | + | **Tune route cache**: is used for MultiWAN configurations with load balancing. |
| - | This setting is advised | + | Recommended |
| - | **Check Connections Every: **This is an easy way for FreshTomato to automatically test WAN connection reliability. (Default: Disabled). Choosing any setting but [Disabled] will execute the Watchdog script. This sets how often the router pings to check it is still connected to the Internet. | + | For details, see the [[basic-network# |
| - | The Watchdog script uses ping or traceroute to test WAN connection status. | + | **Check Connections Every: **makes FreshTomato automatically |
| - | Choosing | + | This sets how often the router tests a WAN connection. Any option but Disabled |
| - | | + | \\ |
| - | * Target 2 - Here, enter the address of the second host to ping regularly (Default: | + | |
| + | | ||
| + | * Target 2 - the address of the second host to ping \\ Microsoft.com | ||
| + | |||
| + | \\ | ||
| + | |||
| + | (Default: Disabled). | ||
| + | |||
| + | \\ | ||
| ==== WAN(x) Settings ==== | ==== WAN(x) Settings ==== | ||
| - | Settings | + | Settings |
| - | Depending on the type selected, other settings | + | Depending on the selected |
| - | **Type: **This sets the connection mode the WAN interface will use to connect to your ISP. (Default: DHCP). | + | \\ |
| - | | + | **Type: |
| - | * DHCP does not use authentication. \\ \\ | + | |
| - | | + | \\ |
| - | * This is most often used for DSL networks. | + | |
| - | * This stores | + | * [DHCP]** **- Your ISP's DHCP server dynamically assigns a WAN IP lease to FreshTomato. |
| - | * If authentication succeeds, the PPPoE server allows logon to the ISP network, and a DHCP server assigns you a WAN IP lease. | + | |
| - | * Leave the //Service Name// field blank. | + | |
| - | * Starting with release 2021.3, support for Baby Jumbo Frames (RFC 4638) was added in the [[advanced-misc|Miscellaneous]] menu. | + | |
| - | * When using Baby Jumbo Frames, set MTU to 1500, consistent with the Baby Jumbo Frames change. (See [[https:// | + | * Usually |
| + | * User Name, Password, Service Name, and Options fields appear. | ||
| + | * Freshtomato | ||
| + | * If authentication succeeds, the PPPoE server allows logon to the ISP. | ||
| + | * Since r2021.3, support for Baby Jumbo Frames (RFC 4638) \\ was added to the [[advanced-misc|Miscellaneous]] menu. | ||
| + | * When using Baby Jumbo Frames, set MTU to 1500, to match \\ the Baby Jumbo Frames change. (See: [[basic-network# | ||
| - | * **Static - **This choice | + | * [Static]** **- will configure your WAN port with a static IP. |
| - | * You must manually | + | * You must enter these settings from your ISP here: |
| * Static IP address | * Static IP address | ||
| * Subnet mask | * Subnet mask | ||
| * Gateway address | * Gateway address | ||
| - | * DNS server addresses | + | * DNS server addresses \\ \\ |
| - | * This mode is commonly used for business accounts, when the IP address shouldn' | + | |
| - | * **PPTP - **This configures the WAN port to use Microsoft' | + | * [PPTP]** **- configures the WAN port to connect using PPTP protocol. |
| - | * This section will require you to enter: | + | * User Name, Password, Gateway, PPTP Gateway, Options fields appear. |
| - | * a username | + | * After you enter the User Name / Password, FreshTomato stores them. |
| - | * password | + | * Other settings |
| - | * gateway server | + | |
| - | * **L2TP - **Choosing this configures the WAN port to connect using Cisco' | + | * [L2TP]** **- configures the WAN port to connect using Layer Two Tunneling |
| - | * FreshTomato | + | * FreshTomato |
| - | * L2TP username | + | * Uusername, password, |
| - | * Password | + | |
| - | * L2TP server static IP address | + | |
| - | * Subnet mask | + | |
| - | * Gateway setting | + | |
| - | * **3G modem - **This setting will enable | + | * [3G modem]** **- enables |
| - | * Ensure | + | * To detect modems, enable |
| - | * **4G/ | + | * [4G/LTE]** **- enables support for 4th generation cellular USB modems. |
| - | * When choosing 4G, PIN code and APN fields appear. These must be filled with correct | + | * PIN code and APN fields appear |
| - | * Check USB and 3G/4G/5G modem support | + | * To detect modems, enable |
| - | * **Disabled - **This disables the physical WAN port on your router. | + | * [Disabled]** **- disables the physical WAN port on the router. |
| - | * This effectively | + | * This makes your device function only as a switch (if capable) and/or; |
| - | * It may effectively make your device function as a WiFi access point (if it has that function). \\ \\ | + | * It may effectively make your device function as a WiFi AP (if capable). \\ \\ |
| - | **Wireless Client Mode: **This enables FreshTomato' | + | |
| - | This mode lets the router act as a client to connect to another router/AP, similar to how a WiFi adapter would. | + | This lets the router act as a client |
| - | * Disabled - Wireless Client mode will be disabled. | + | \\ |
| - | * 2.4 GHz - Wireless Client mode will be enabled on the 2.4 GHz interface. | + | |
| - | * 5 GHz - Wireless Client mode will enabled on the 5 GHz interface. | + | |
| - | \\ {{::basic-network-wan_settings-2023.2.jpg?805}} | + | * [Disabled] - disables the wireless Client mode. |
| + | * [2.4 GHz] - enables Wireless Client mode on the 2.4 GHz band. | ||
| + | * [5 GHz] - enables Wireless Client mode on the 5 GHz band. | ||
| + | |||
| + | \\ \\ **Load Balance Weight: | ||
| + | |||
| + | {{:pasted:20240219-103900.png?550}}\\ \\ | ||
| + | |||
| + | In MultiWAN configuration, | ||
| + | |||
| + | Load sharing is done on a per-session basis to avoid issues with interactive traffic such as: | ||
| \\ | \\ | ||
| + | |||
| + | - Real-time voice | ||
| + | - Video | ||
| + | - Remote Desktop / RDP | ||
| \\ | \\ | ||
| - | **Load Balance Weight: | + | Per-packet loadsharing isn't recommended |
| - | {{: | + | \\ \\ // |
| - | When configuring a router in a MultiWAN configuration, | + | \\ \\ If " |
| - | For example: | + | \\ |
| - | Let's assume we have 2x WANs with: | + | For example, say: |
| - | WAN0=" | + | \\ |
| - | WAN1=" | + | * There are 2 WANs |
| + | * WAN0=" | ||
| + | * WAN1=" | ||
| - | At some point, WAN1 fails. As soon as this failure is noticed, WAN0 will bring itself to life and begin routing packets. Later, WAN1 recovers its connectivity. As soon as FreshTomato recognizes this, (within seconds or minutes), WAN0 will go back to idle status while traffic is rerouted through the resuscitated WAN1. This recovery, back to the originally active interface is also known as // | + | \\ |
| - | A very important final point on MultiWAN load-sharing: | + | In this example, routing |
| \\ | \\ | ||
| - | **Modem device: **Here, you specify the 3G modem' | + | - When the failure of WAN1 is detected, WAN0 will activate \\ (assigned with weight: " |
| + | - Later, WAN1 recovers its connectivity. As soon as FreshTomato \\ notices, (seconds/minutes), WAN0 will be reset to idle status \\ while traffic is rerouted through the revived WAN1. | ||
| - | * If you don't know what to choose, check the [[dongle_compatibility|3G/ | + | \\ |
| - | * To ensure your modem is detected, check [[nas-usb|USB Support]] is enabled in the [[nas-usb|USB Support]] menu. | + | |
| - | * When 3G modem or 4G/LTE is set as the WAN type, other fields appear, prompting for more information. | + | |
| - | * The Default device filename is the first serial device on the first USB port: (/ | + | |
| - | * The “tty” part of the device' | + | |
| - | * The “USB0” part of the device' | + | |
| - | * Devices listed as "/ | + | |
| - | * This device type uses Linux' | + | |
| - | * If the interface lists: “/ | + | |
| - | * ACM modems let the modem hardware perform analog functions. | + | |
| - | To get device details, you could also log on to FreshTomato via Telnet/SSH and use the lsusb or dmesg commands | + | Recovery back to the originally-active interface is called |
| + | |||
| + | \\ Any value > " | ||
| + | |||
| + | A weight of " | ||
| + | |||
| + | A good way to understand this is: | ||
| \\ | \\ | ||
| - | **PIN Code: **This is the 3-digit PIN code for the SIM card associated with your cell account. | + | |
| + | | ||
| + | * Thus, if: \\ WAN0=“weight 0” and \\ WAN1=“weight 1”, then\\ WAN1 would handle 100% of the traffic. | ||
| - | * Leave this blank if your SIM card code was deactivated. | + | \\ \\ // |
| - | **Modem init string: **Here, enter the modem' | + | \\ \\ Basically, an interface set to weight: " |
| - | * This will come from your cell provider, or the modem manufacturer. (Default: | + | * WAN0 = weight 0 |
| + | | ||
| + | * WAN2 = weight 5 | ||
| - | **APN: **The access point name (provided by your cell carrier). | + | \\ \\ In this example, routing would proceed as follows: |
| - | * This specifies a gateway to route data between your carrier and the Internet. (Default: internet). \\ \\ | + | \\ |
| - | **Username: **Here, enter the (carrier-provided) username to access your cell carrier' | + | - WAN0 would be used only if WAN1 and WAN2 are failing/ |
| + | - WAN1 would handle the first new LAN client session through the router. | ||
| + | - WAN2 is set to handle the second, third, fourth, fifth and sixth sessions. | ||
| + | - The seventh new session would be treated as another, first new LAN client, \\ so would start again from WAN1. | ||
| + | - WAN2 would then handle | ||
| - | * Some carriers don't require this info. \\ \\ | + | \\ \\ **These settings affect only outbound traffic.** Return traffic tries to return via the WAN interface it came from. |
| - | **Password: **Here, enter the (carrier-provided) password | + | Allocation of new sessions |
| - | * Some carriers do not require this info. \\ \\ | + | \\ |
| - | **Network Type: **This menu appears when WAN type is set to 4G/LTE. (Default setting: | + | **Modem device: **here, specify the 3G/4G/5G modem' |
| - | * The default setting configures FreshTomato to start negotiating with a 4G connection. | + | \\ {{:: |
| - | **DNS Server: ** | + | |
| + | | ||
| + | * If WAN type is 3G or 4G/LTE, fields appear asking for more input. \\ \\ | ||
| + | * The default device filename is the first serial device on the first USB port: | ||
| + | | ||
| + | * “USB0” in the filename means the device is connected to the first USB port. | ||
| + | * Devices listed as "/ | ||
| + | * “ACM” in the device name type means a device type of: “Abstract Control Model” \\ \\ | ||
| + | | ||
| - | * AUTO - FreshTomato uses DNS server addresses included in your Internet Provider' | + | \\ |
| - | * Manual - Enables the DNS server function (dnsmasq). This makes "DNS 1" and "DNS 2" fields appear. | + | |
| - | * DNS 1 - Enter the first DNS server address here (if DNS Server is set to Manual). | + | |
| - | * DNS 2 - Enter the second DNS server address here (if DNS Server is set to Manual). | + | |
| - | \\ Manually-set DNS servers are useful if your ISP's DNS servers are slow/ | + | **PIN Code: **the 3-digit PIN code for the SIM card associated with your cell account. |
| - | **MTU: | + | |
| - | This is only for the WAN interface. It won't affect LAN traffic. However, different MTU sizes among devices can cause problems. | + | \\ |
| - | | + | **Modem init string: **enter the modem' |
| - | | + | |
| - | **Use DHCP:** This function is rarely used, and you are advised to leave it disabled. | + | |
| - | * On a few Internet providers, addressing is separated from PPPoE functionality. \\ \\ | + | \\ |
| - | **Single Line MLPPP**: This is outdated, and rarely used nowadays. | + | **APN: **the access point name (provided by your cell carrier). |
| - | Multilink PPP is a version of the PPP protocol that lets you bond two or more physical connections | + | * Sets a gateway |
| + | * (Default: " | ||
| - | **Route Modem IP: **This function lets you access a modem " | + | \\ |
| - | | + | **Username: **the (carrier-provided) username to access |
| - | * That means you can't easily | + | |
| - | * The router' | + | |
| - | * Private addresses aren't routable, so by default, FreshTomato blocks LAN > WAN > MODEM PRIVATE IP traffic. | + | |
| - | * Route Modem IP adds a simple static route to the routing table, giving the modem a private IP on a /32 subnet. | + | |
| - | * This makes the private address reachable via the WAN interface. | + | |
| - | * The mask allows only one host, so only the modem is reachable on that subnet.\\ \\ | + | |
| - | **Query Hilink Modem IP: | + | |
| - | Some Huawei modems have a " | + | \\ |
| + | |||
| + | {{::basic-network-wan0_settings-username_to_options-default_theme-2025.3.png?375}} | ||
| \\ | \\ | ||
| - | **Call Custom Status Script: ** TBD. | + | **Password: **the (carrier-provided) password to authenticate to your carrier' |
| + | |||
| + | * This field appears only when PPPoE, PPTP, or L2TP is selected in the //Type// menu. | ||
| \\ | \\ | ||
| - | **Connect Mode: **This chooses | + | **Service Name:** the service name of the connection with your ISP. |
| - | * Connect on Demand - will make FreshTomato disconnect from the ISP after the period in the //Max Idle Time// field. \\ FreshTomato will reconnect to the Internet a soon as any LAN client requests Internet access. | + | * Most ISPs don't require |
| - | * Some ISPs drop a connection if their router detects no Internet activity. | + | |
| - | * Keepalive - Selecting this makes FreshTomato send small [[https:// | + | |
| - | * Redial Interval - Here, enter how often the router will check the Internet connection. (Default: 10 seconds). \\ This minimizes your Internet connection response time, since usually, the connection will always | + | |
| \\ | \\ | ||
| - | **Redial Interval: ** When PPPoE dialling fails, the Redial Interval is used to delay attempts | + | **Options: **here, you can enter optional settings/ |
| - | **LCP Echo Interval: **The Link Control Protocol sends and receives frames between two peers to verify they' | + | |
| - | * LCP Echo Interval is the period between these signals. Usually, this is used to verify that a DSL modem' | + | \\ |
| - | * (Default: | + | |
| + | **Network Type: **appears when 4G/LTE WAN type is selected. | ||
| + | |||
| + | * The default makes FreshTomato start negotiating with a 4G connection. \\ If that fails, it falls back to negotiating 3G. Finally, it tries a 2G connection. FIXME | ||
| \\ | \\ | ||
| - | **LCP Echo Link fail limit: **This is the number of times LCP echo requests can fail between LCP peers before the status is considered dead. | + | **DNS Server: ** here, you configure |
| - | | + | \\ |
| + | |||
| + | {{:: | ||
| + | |||
| + | | ||
| + | * [Manual] - enables DNS the server functions in dnsmasq. \\ This makes the "DNS 1" and "DNS 2" fields appear. | ||
| + | * DNS 1 - enter the IP address of your first DNS server here. | ||
| + | * DNS 2 - enter the IP address of your second DNS server here. | ||
| \\ | \\ | ||
| - | **Disable Watchdog: | + | Manually-set DNS servers can be useful if your ISP DNS servers are slow/unreliable.\\ |
| \\ | \\ | ||
| - | **Watchdog Mode: **This regularly checks that a given WAN connection | + | **MTU:** sets the Maximum Transmission Unit/ |
| + | |||
| + | | ||
| + | * [Manual] - Enter a custom value. Jumbo Frames \\ start at 2000 bytes. | ||
| + | |||
| + | \\ Different MTU sizes across devices may cause issues. | ||
| + | |||
| + | This applies only to the WAN interface and won't affect LAN traffic. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **Use DHCP: | ||
| + | |||
| + | * Very few Internet providers separate addressing from PPPoE functions. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **Single Line MLPPP: | ||
| + | |||
| + | This Multilink PPP version lets a modem bond the bandwidth of multiple | ||
| + | |||
| + | **Route Modem IP: **allows quick access to a modem/ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | {{:: | ||
| + | |||
| + | * When using separate modem and router, usually the modem is in bridge mode or \\ passthrough mode. This makes it hard to access the modem' | ||
| + | * The router' | ||
| + | * Private addresses aren't routable, so by default, FreshTomato blocks any traffic\\ travelling from LAN --> WAN --> (MODEM with PRIVATE IP). \\ \\ | ||
| + | * Route Modem IP adds a static route to the routing table, giving the modem a\\ private address on a /32 subnet. This makes the private address reachable via \\ the WAN interface, and thus via the LAN. \\ \\ | ||
| + | * The mask allows only one host, so only the modem is reachable on that subnet. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | Default: blank/off. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **Query Hilink Modem IP:** is for Huawei USB modems with Hilink mode. | ||
| + | |||
| + | This lets you communicate with a modem in Hilink mode connected to a LAN device other than the router. | ||
| + | |||
| + | This can be useful for monitoring modem statistics/signal strength. | ||
| + | |||
| + | (Default: 0.0.0.0/ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **Call Custom Status Script: ** allows you to define and execute a custom shell script. | ||
| + | |||
| + | This can be useful for monitoring or to report router status. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **Connect Mode: **here, select the method to keep the router connected to the Internet provider. | ||
| + | |||
| + | \\ {{:: | ||
| + | |||
| + | \\ | ||
| + | |||
| + | * [Connect on Demand] - makes the router disconnect from the ISP after \\ the //Max Idle Time//. FreshTomato reconnects to the Internet as soon as \\ a LAN client requests Internet access. \\ | ||
| + | * IP to trigger connect - the IP address whose activity will \\ trigger FreshTomato to reconnect to the Internet. | ||
| + | * Max idle time - the maximum period of inactivity after which \\ the router disconnects from the internet if no LAN client \\ is requesting access.\\ \\ | ||
| + | * [Keepalive] * - makes FreshTomato send keepalive packets at specified intervals. \\ Some ISPs drop the connection | ||
| + | * Redial Interval - how often FreshTomato checks the WAN connection. \\ This minimizes Internet connection response time, as usually \\ the connection will be up. (Default: 10 seconds). | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **Redial Interval: **if PPPoE dialing fails, this delays attempts for a defined number of seconds. | ||
| + | |||
| + | This allows the PPPoE server/ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **LCP Echo Interval: **Link Control Protocol exchanges frames between 2 peers to check they' | ||
| + | |||
| + | * LCP Echo Interval is the time, in seconds between these signals. | ||
| + | * Usually used to check a DSL modem' | ||
| + | * (Default: 10). | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **LCP Echo Link fail limit:** number of failed echo requests between peers before a link is deemed down. | ||
| + | |||
| + | * The client modem will then drop the PPPoE link. | ||
| + | * LCP will then try to renegotiate a new PPPoE session. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | {{:: | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **Disable Watchdog: **disables the Watchdog function, only for the WAN connection in the menu. | ||
| + | |||
| + | Default: unchecked. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **Watchdog Mode: **regularly checks a given WAN connection is up. | ||
| + | |||
| + | This setting allows | ||
| + | |||
| + | \\ | ||
| * Traceroute * | * Traceroute * | ||
| * Ping | * Ping | ||
| + | |||
| + | \\ | ||
| + | |||
| + | Watchdog supports the following connection types: | ||
| + | |||
| + | \\ | ||
| + | |||
| + | - DHCP | ||
| + | - PPPoE | ||
| + | - PPTP | ||
| + | - L2TP | ||
| + | - 3G/4G/5G LTE | ||
| + | |||
| + | \\ | ||
| ===== LAN ===== | ===== LAN ===== | ||
| - | The LAN section includes information and settings to configure FreshTomato' | + | The LAN section includes information and settings to configure FreshTomato' |
| - | This includes FreshTomato' | + | \\ |
| - | * LAN IP address and subnet mask | + | This includes: |
| - | * Spanning Tree Protocol function | + | |
| - | * DHCP server status and settings (through dnsmasq), such as scope and lease time | + | |
| - | * Stubby (DNS-over-TLS) setting and WINS settings | + | |
| - | \\ {{: | + | - LAN IP address and subnet mask |
| + | | ||
| + | - DHCP server status/ | ||
| + | - Stubby (DNS-over-TLS) setting and WINS settings | ||
| - | **Bridge: | + | \\ |
| - | **STP**: This enables Spanning Tree Protocol to prevent forwarding loops in switches. The default (off) setting is recommended, | + | **Bridge:** lets you selects the bridge whose LAN settings will be modified |
| - | **IP Address: | + | **STP**: |
| - | **Netmask**: | + | The default |
| - | **DHCP**: Checking this enables DHCP server functions in dnsmasq. (Default: | + | **IP Address:** the IP Address to assign to the specified LAN interface. |
| + | \\ | ||
| + | FreshTomato supports Class A/B/C networks. (Default: | ||
| - | **IP Range // | + | **Netmask**: the subnet |
| - | **Lease Time (// | + | (Default: 255.255.255.0 - class " |
| - | **Automatic IP**: | + | **DHCP**: |
| - | After saving settings, | + | **IP Range // |
| - | \\ | + | In the top field, enter the first valid address in the subnet. Enter the the last address in the bottom field. \\ \\ |
| - | {{:pasted:20220907-091646.png}} | + | **Lease Time (// |
| - | \\ | + | **Automatic IP**: lets FreshTomato obtain a LAN IP via DHCP. \\ Since release 2022.6, this option is supported in: \\ |
| + | - AP Mode | ||
| + | - Wireless Ethernet Bridge Mode | ||
| + | - Media Bridge Mode.\\ \\ | ||
| + | |||
| + | After saving settings, the router' | ||
| ===== Ethernet Ports State - Configuration ===== | ===== Ethernet Ports State - Configuration ===== | ||
| - | [[https:// | + | Settings here are for the Ethernet Ports State graphic in the [[status-overview|Overview]] menu. Link status, Link speed and Diagnostic information are shown for each port, . |
| - | | + | \\ |
| - | **Enable Ports State: | + | {{basic-network-ethernet_ports_state_configuration-2024.1.png?291}} |
| - | **Show Speed Info: | + | \\ |
| - | **Invert ports order:** | + | **Enable Ports State:** enables the Ethernet Ports State graphic. (Default: |
| + | **Show Speed Info:** checking this displays the link speed of each port, (1GB/ | ||
| + | |||
| + | (Default: On). \\ \\ | ||
| + | |||
| + | **Invert ports order:** displays port icons in the opposite order from where they are on the hardware. | ||
| + | |||
| + | This is useful when the order of display icons doesn' | ||
| ===== Wireless Band Steering ===== | ===== Wireless Band Steering ===== | ||
| - | [[https:// | + | This feature makes FreshTomato assess on which band a client should connect, then " |
| - | With Wireless Band Steering enabled, FreshTomato can assess on which band the client device should try to connect. It then " | + | \\ |
| - | * Disable * | + | {{:: |
| - | * Enable | + | |
| - | To achieve this, for all WiFi interfaces, enter the same: | + | \\ |
| - | * SSID name | + | When enabled, these settings |
| - | * Security | + | |
| - | * Password | + | |
| - | * Other settings (see picture below) | + | |
| - | Remember that client devices can also try to switch bands on their own, without the influence of Wireless Band Steering. | + | \\ |
| - | Wireless Band Steering is available starting with release 2020.8 (and only for ARM hardware). See the Notes section below for more details on how it works. | + | - SSID |
| + | - Broadcast | ||
| + | - KEY1-4 | ||
| + | - Shared Key | ||
| + | - Encryption | ||
| + | - Radius Key | ||
| + | - Radius Port | ||
| + | - Radius IP | ||
| \\ | \\ | ||
| + | (Visibility depends on the wireless security selected) | ||
| - | ==== Wireless (2.4 GHz / interface eth1) ==== | + | \\ |
| - | The Wireless (2.4 GHz) section displays information and settings for the 2.4 GHz wireless network interface. | + | Among the settings that will NOT be replicated are: |
| - | Your device may show a different device name than eth1. FreshTomato hardware device numbers begin at " | + | \\ |
| - | **Enable | + | |
| + | * Channel Width | ||
| + | | ||
| + | | ||
| + | * Country Code/Rev | ||
| + | * Beamforming | ||
| - | **MAC Address:** This displays the MAC address of the 2.4 GHz WiFi interface. Clicking on it takes you to the [[: | + | \\ |
| - | **Wireless | + | This feature is available since r2020.8 (for ARM hardware only). See the [[https:// |
| + | |||
| + | Client devices also may try to switch bands on their own, without the influence of Wireless Band Steering. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | ===== Wireless (2.4 GHz / interface eth1) ===== | ||
| + | |||
| + | The Wireless (2.4 GHz) section displays information and settings for the 2.4 GHz wireless interface. | ||
| + | |||
| + | Your device may show a different device name than eth1. Hardware device numbers begin at " | ||
| + | |||
| + | The first Ethernet device might be called " | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **Enable | ||
| + | |||
| + | **MAC Address:** displays the MAC address of the 2.4 GHz WiFi interface. | ||
| + | |||
| + | Clicking this takes you to the [[: | ||
| + | |||
| + | **Wireless Mode:** here, choose | ||
| \\ | \\ | ||
| Line 324: | Line 528: | ||
| ^ | ^ | ||
| | **Wireless Mode** | | **Wireless Mode** | ||
| - | | \\ Access Point | \\ The (default) setting, | + | | \\ Access Point* | \\ The (default) setting, |
| - | | \\ Access Point WDS | \\ Sets the router in " | + | | \\ Access Point WDS | \\ Sets the router in " |
| - | | \\ Wireless Client | + | | |
| - | | \\ Wireless Ethernet Bridge | + | | |
| - | | \\ Media Bridge Mode | \\ Configures FreshTomato to connect to another router/ | + | | |
| | \\ WDS | \\ Serve as a [[https:// | | \\ WDS | \\ Serve as a [[https:// | ||
| | //Table derived from (Creative Commons) Wikibooks - “Tomato Firmware/ | | //Table derived from (Creative Commons) Wikibooks - “Tomato Firmware/ | ||
| - | \\ **Wireless Network Mode: **This lets you choose which 802.11 WiFi protocol(s) to make available to clients. | + | \\ \\ |
| - | The network modes available | + | **Wireless Network Mode: **selects which 802.11 WiFi protocols to make available |
| - | * Auto: * FreshTomato and WiFi client devices negotiate the best protocol automatically. | + | The network modes available here will depend on your hardware. |
| - | * Auto is recommended, | + | |
| - | * Compatibility issues can create many problems. | + | |
| - | * B Only: This allows WiFi clients to connect using only the 802.11b protocol. | + | |
| - | * G Only: This allows WiFi clients to connect using only the 802.11n protocol. | + | |
| - | * B/G Mixed: | + | |
| - | * N only: This allows clients to connect using only the 802.11n protocol. | + | |
| - | These apply only to the 2.4 GHz band interface. There are separate Wireless Network Mode settings for any 5 GHz interface. | + | \\ |
| - | \\ | + | * Auto * - WiFi clients automatically negotiate the best protocol. |
| + | * Recommended, | ||
| + | * Incompatibilities may occur. | ||
| + | * The best settings may not be obvious. \\ \\ | ||
| + | * B Only - allows clients to connect using only 802.11b. \\ \\ | ||
| + | * G Only - allows clients to connect using only 802.11n. \\ \\ | ||
| + | * B/G Mixed - allows clients to connect using 802.11b/ | ||
| + | * N only - allows clients to connect using only the 802.11n. \\ \\ | ||
| - | **SSID: | + | \\ |
| - | **Broadcast: | + | These apply only to the 2.4 GHz interface. Any 5 GHz interface will have separate Mode settings. |
| - | **Channel: **Selects the channel on which the 2.4 GHz radio interface will operate. Generally, it's best to choose a different channel than your neighbours are using. (Default: Auto). | + | \\ |
| - | | + | **SSID:** the network name (Service Set IDentifier) for the 2.4 GHz WiFi interface. |
| - | * Channel: This menu lets you manually choose available channels on the band. Unavailable channels won't appear here. \\ \\ | + | |
| - | **Channel Width: | + | For security, don't include personal identity/ |
| - | * 20 MHz | + | (Default: FreshTomatoXX, |
| - | * 40 MHz | + | |
| - | 802.11n can use 40 MHz channel width, but to maintain compatibility with legacy systems, it uses one main 20 MHz channel plus a free adjacent channel 20 MHz above or below the main channel. \\ \\ | + | **Broadcast: |
| - | **Control Sideband: | + | This “announces” |
| - | * Upper | + | Common software can easily sniff SSIDs, so in reality, disabling Broadcast provides little security increase.\\ \\ |
| - | * Lower \\ \\ | + | |
| - | **Security**: This menu lets you select | + | **Channel: |
| - | * Disabled: | + | Generally, choose a different channel than your neighbours' |
| - | * This is a basically an unlimited security risk. | + | |
| - | * WEP: This enables Wired Equivalent Privacy protocol. Avoid using this. It's obsolete due to serious vulnerabilities, | + | \\ |
| - | * WPA Personal: This enables WiFi Protected Access Protocol 1.x. WPA uses the RC4-based TKIP protocol. | + | * [Auto]* - this default is generally safe unless there' |
| - | * This lets hosts exchange pre-shared keys, for more security. | + | * [Channel] - lets you manually choose available channels on the band. \\ Unavailable channels won't appear. \\ \\ |
| - | * While more secure than WEP, WPA still has weaknesses, like lower encryption standards. | + | |
| - | * WPA2 is strongly encouraged instead of WPA. | + | |
| - | | + | **Channel Width:** lets you choose the (frequency) width of the channel. |
| + | |||
| + | \\ | ||
| + | |||
| + | * [20 MHz] | ||
| + | * [40 MHz] | ||
| + | |||
| + | \\ | ||
| + | |||
| + | 802.11n uses a 40 MHz channel by combining a main 20 MHz channel with an adjacent 20 MHz channel above/below for compatibility. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **Control Sideband:** this lets you choose whether the sideband channel is above (Upper) or below (Lower) the main channel. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | * Upper * | ||
| + | * Lower\\ | ||
| + | |||
| + | This is only available If 20 or 40 Channel Width is selected. (Default: Upper). | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **Security**: | ||
| + | |||
| + | \\ | ||
| + | |||
| + | * [Disabled] - disables all security, leaving the network open to anyone. \\ Avoid using this. It is a basically an unlimited security risk. \\ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | * [WEP] - enables Wired Equivalent Privacy protocol. Avoid this. \\ It' | ||
| + | |||
| + | \\ | ||
| + | |||
| + | * [WPA Personal] - enables WiFi Protected Access Protocol 1.x. | ||
| + | * Uses the RC4-based TKIP protocol. | ||
| + | * Lets hosts exchange pre-shared keys, for more security. | ||
| + | * More secure than WEP, but has weaker encryption standards. | ||
| + | * WPA2 is strongly encouraged instead. \\ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | * [WPA Enterprise] - (WPA-802.1X) - is similar to WPA Personal, | ||
| * No common pre-shared key is used. | * No common pre-shared key is used. | ||
| - | * WPA Enterprise doesn't require a RADIUS server. Often, one is used anyway for compatibility/ | + | * Doesn't require a RADIUS server. |
| - | * WPA Enterprise is more secure against dictionary attacks | + | * Is more secure against |
| - | * This is suitable | + | * Suitable |
| - | * WPA2 Personal: WiFi Protected Access version 2 uses elements of the 802.11i standard. | + | \\ |
| - | * This supports mandatory use of AES encryption, so it is much more secure than older protocols. | + | |
| - | * WPA2 Personal is recommended for small- to mid-sized, informal networks. | + | |
| - | * WPA2 Enterprise: This enables the Enterprise version of WPA2. | + | * [WPA2 Personal] - WiFi Protected Access v2 uses parts of 802.11i. |
| - | * This uses WPA2, but each user has their own WiFi username/ | + | * Makes AES encryption mandatory, so more secure. |
| - | * WPA2 Enterprise is based on parts of 802.11i. | + | * Recommended |
| - | * This does NOT require a RADIUS server, but one is often used for legacy purposes for compatibility/ | + | |
| - | * This is appropriate | + | |
| - | * WPA / WPA2 Personal: | + | \\ |
| - | * WPA / WPA2 Enterprise: | + | * [WPA2 Enterprise] - enables the Enterprise version of WPA2. |
| + | * Uses WPA2, but each user has own username/ | ||
| + | * Is based on parts of 802.11i. | ||
| + | * Doesn' | ||
| + | * Suitable for larger, more structured networks. \\ | ||
| - | * RADIUS: Enables Remote Access Dialup User Service. | + | \\ |
| - | * This is designed for larger organizations. | + | |
| - | * This uses a separate server to authenticate, | + | |
| - | * This supports authentication via certificates, | + | |
| - | * This is usually only for advanced users. \\ \\ | + | |
| - | **Shared Key: | + | |
| - | **Group Key Renewal: | + | \\ |
| - | Starting with release 2023.5 and newer the user can adjust rotation interval within the following limits: | + | * [WPA / WPA2 Enterprise] - enables both protocols. \\ The router communicates via whatever it detects from the client. |
| - | 1 sec up to 2592000 sec [for mips RT-N / mips-RT-AC and all ARM routers] | + | |
| - | 0 => disabled (not recommended) | + | |
| - | Releases up to 2023.4 can adjust this value within the following limits: | + | \\ |
| - | 60 sec up to 7200 sec [all routers] | + | |
| + | * [RADIUS] - enables Remote Access Dialup User Service. | ||
| + | * Designed for larger organizations. | ||
| + | * Uses a separate server to authenticate/ | ||
| + | * Supports authentication via certificates. | ||
| + | * Is usually only for advanced users.\\ \\ | ||
| + | \\ | ||
| + | |||
| + | **Shared Key: | ||
| + | |||
| + | **Group Key Renewal: | ||
| + | |||
| + | This is a part of the WPA protocol. | ||
| + | |||
| + | (Default: 3600 seconds). | ||
| + | |||
| + | \\ | ||
| + | |||
| + | The following limits apply to adjusting key rotation interval: | ||
| + | |||
| + | \\ | ||
| + | |||
| + | * r2023.5 and later: From 1 second to 2592000 seconds \\ [for ARM-based and MIPS RT-N / MIPS-RT-AC hardware] \\ Where: 0 = disabled | ||
| + | |||
| + | * r2023.4 and earlier (for all hardware): 60 - 7200 seconds. | ||
| ===== Wireless (5 GHz / interface eth2) ===== | ===== Wireless (5 GHz / interface eth2) ===== | ||
| - | The Wireless (5 GHz) section displays information | + | The Wireless (5 GHz) section displays |
| - | Your device may show a different device name than eth1. Note: FreshTomato hardware device numbers begin at 0. \\ For example, the first Ethernet device might be called eth0. The second wireless device might be called wl1. | + | Your device may show a different device name than eth1. FreshTomato hardware device numbers begin at 0. |
| - | Typically, the 5 GHz WiFi band has higher bandwidth, but shorter distance propagation than the 2.4 GHz band. | + | \\ |
| - | **Enable Wireless: | + | For example, |
| - | **MAC Address: | + | |
| + | | ||
| - | **Wireless Mode: | + | \\ |
| + | |||
| + | Typically, the 5 GHz WiFi band has higher bandwidth, but shorter range than the 2.4 GHz band. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **Enable Wireless: | ||
| + | |||
| + | **MAC Address: | ||
| + | |||
| + | **Wireless Mode: | ||
| ^ | ^ | ||
| | **Wireless Mode** | | **Wireless Mode** | ||
| - | | \\ Access Point | \\ The (default) setting, which allows clients to connect to FreshTomato' | + | | \\ Access Point | \\ The default setting |
| - | | \\ Access Point WDS | \\ Sets the router in " | + | | \\ Access Point WDS | \\ Sets the router in " |
| - | | \\ Wireless Client | + | | \\ \\ \\ \\ \\ \\ Wireless Client |
| - | | \\ Wireless Ethernet Bridge | + | | |
| - | | \\ Media Bridge Mode | \\ Configures FreshTomato to connect to another router/access point. \\ All clients connected to both routers remain in the same subnet. \\ \\ - This new mode is similar to Wireless Ethernet Bridge mode for SDK6 and up (for MIPS RT-AC and all ARM images).\\ - Using Wireless Ethernet Bridge mode is recommended for MIPS RT and RT-N images (like the RT-N16, E4200v1).\\ - This Mode is not supported with SDK5 (RT / RT-N) builds\\ - Both IPv4 and IPv6 communication | + | | |
| - | | \\ WDS | \\ FreshTomato will serve as a [[https:// | + | | \\ WDS | \\ FreshTomato will act only as a [[https:// |
| | //Table derived from (Creative Commons) Wikibooks - “Tomato Firmware/ | | //Table derived from (Creative Commons) Wikibooks - “Tomato Firmware/ | ||
| - | | + | |
| - | | + | **Wireless Network Mode: **here, select |
| - | | + | |
| - | | + | |
| - | * A Only - allows | + | |
| - | * N Only - allows | + | |
| - | * N/AC mixed - allows clients to connect using only 802.11AC or 802.11N. | + | |
| - | * AC Only - allows clients to connect using only the 802.11ac protocol. | + | |
| - | Note that releases before 2021.8 do NOT have a separate setting for 802.11ac. That only arrived with 2021.8. | + | \\ |
| - | Separate Wireless Network Mode settings will exist for any 2.4 GHz band interface. See the 2.4 GHz section. \\ | + | * [Auto] - WiFi clients automatically negotiate the best protocol. |
| + | * Recommended unless you're highly experienced with WiFi. | ||
| + | * Compatibility issues may occur. The “logical” setting isn't always best. \\ \\ | ||
| + | * [A Only] - allows clients to connect using only 802.11a. | ||
| + | * [N Only] - allows clients to connect using only 802.11n. \\ \\ | ||
| + | * [N/AC mixed] - allows clients to connect using only 802.11ac or 802.11n. \\ \\ | ||
| + | * [AC Only] - allows clients to connect using only 802.11ac. | ||
| - | **SSID: | + | \\ (Default: |
| - | **Broadcast: **Checking this enables SSID broadcasting. This “announces” | + | **SSID:** the network name of the 5 GHz WiFi. |
| - | **Channel: **Selects the channel on which the 5 GHz radio interface will operate. (Default: | + | For security, don't include personal words/ |
| - | Generally, it's a good idea to choose a different channel than the one your neighbours are using. | + | **Broadcast: |
| - | * Auto: This default is generally safe unless there' | + | This “announces” the SSID, so it' |
| - | * On this setting, FreshTomato selects and uses the channel it believes has the least interference. | + | |
| - | * Channel: This lets you manually choose from available channels on the band. Unavailable channels won't appear here. \\ \\ | + | |
| - | **Channel | + | **Channel: **selects |
| - | * 20 MHz | + | Generally, you should choose a different channel than the one your neighbours use. |
| - | * 40 MHz | + | |
| - | * 80 MHz | + | |
| - | * 160 MHz (not yet supported. May be supported on some SDK714 models) | + | |
| - | | + | \\ |
| - | 802.11N can use 40 MHz channel | + | * [Auto]*: This default is usually safe unless there' |
| + | * FreshTomato selects the channel it thinks has the least interference. | ||
| + | * [Channel]: lets you manually choose from available channels | ||
| - | **Control Sideband: | + | \\ |
| - | Starting with release 2023.3, this menu will allow you to choose | + | **Channel Width: |
| - | **Security: | + | \\ |
| - | * Disabled: | + | * |
| - | * This is a basically an unlimited security risk. | + | * [40 MHz] |
| + | * [80 MHz] | ||
| + | * [160 MHz] (not yet supported, but may eventually be on some SDK714 models) | ||
| - | * WEP: enables Wired Equivalent Privacy protocol. Avoid using this. | + | |
| - | * This is obsolete due to serious vulnerabilities, | + | |
| - | * WPA Personal: | + | Larger channel widths provide |
| - | * This lets hosts exchange pre-shared keys, for more security. | + | |
| - | * While more secure than WEP, WPA still has weaknesses, like lower encryption standards. | + | |
| - | * WPA2 is strongly encouraged instead of WPA. | + | |
| - | | + | The 5GHz band is less prone to interference and noise, because on that band, 20 MHz channels don't overlap. Interference is more common on the 2.4 GHz band. |
| + | |||
| + | Usually, it's fine to choose a larger channel width. However, if you see slow traffic, or clients having trouble authenticating/ | ||
| + | |||
| + | **Control Sideband: | ||
| + | |||
| + | This is available only if 40/80/160 MHz Channel Width is selected. (Default: Upper).\\ \\ | ||
| + | |||
| + | **Security: | ||
| + | |||
| + | \\ | ||
| + | |||
| + | * [Disabled] - disables all security, leaving the network open to anyone. | ||
| + | * Avoid using this. It's basically an unlimited security risk. \\ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | * [WEP] - enables Wired Equivalent Privacy protocol. Avoid using this. | ||
| + | * Obsolete due to serious vulnerabilities like weak encryption. \\ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | * [WPA Personal] - enables WiFi Protected Access 1.x (with RC4-based TKIP protocol). | ||
| + | * Lets hosts exchange pre-shared keys for more security. | ||
| + | * More secure than WEP, but problems include low encryption standards. | ||
| + | * Strongly encouraged instead of WPA. \\ | ||
| + | |||
| + | \\ | ||
| + | |||
| + | | ||
| * No common pre-shared key is used. | * No common pre-shared key is used. | ||
| - | * WPA Enterprise doesn't require a RADIUS server. Often, one is used anyway for compatibility and security reasons. | + | * Doesn't require a RADIUS server. |
| - | * WPA Enterprise is more secure against dictionary attacks | + | * More secure against |
| - | * This is suitable | + | * Suitable |
| - | * WPA2 Personal: WiFi Protected Access version 2 uses elements of the 802.11i standard. | + | \\ |
| - | * This supports mandatory use of AES encryption. It is much more secure than older protocols. | + | |
| - | * WPA2 Personal is recommended for small to mid-sized, informal networks. | + | |
| - | * WPA2 Enterprise: This enables the Enterprise version of WPA2. | + | * [WPA2 Personal] - uses elements |
| - | * This uses WPA2, but each user has their own WiFi username/ | + | * Supports mandatory use of AES. More secure than old protocols. |
| - | * WPA2 Enterprise is based on parts of 802.11i. | + | * Recommended |
| - | * This does NOT require a RADIUS server, but one is often used for legacy purposes for compatibility and security. | + | |
| - | * This is appropriate | + | |
| - | * WPA / WPA2 Personal: This uses WPA2 Personal, and if that fails, allows WPA security | + | \\ |
| - | * WPA / WPA2 Enterprise: This uses WPA2 Enterprise, | + | * [WPA2 Enterprise] - enables the Enterprise |
| + | * Uses WPA2, but each user has their own username/ | ||
| + | * Is based on parts of 802.11i. | ||
| + | * Doesn' | ||
| + | * Is appropriate for larger, more structured networks. \\ | ||
| - | * RADIUS: Enables Remote Access Dialup User Service. | + | \\ |
| - | * This is designed for larger organizations. | + | |
| - | * This uses a separate server to authenticate, permit | + | * [WPA / WPA2 Personal] - uses WPA2 Personal, and if that fails, WPA. |
| - | * This supports authentication via certificates, which eases user management. | + | |
| - | * This is usually only for advanced users. | + | |
| \\ | \\ | ||
| - | **Shared Key: | + | * [WPA / WPA2 Enterprise] - uses WPA2 Enterprise, and if that fails, WPA . |
| + | |||
| + | \\ | ||
| + | |||
| + | * [RADIUS] - enables Remote Access Dialup User Service. | ||
| + | * Designed for larger organizations. | ||
| + | * Uses a separate server to authenticate/ | ||
| + | * Supports authentication via certificates. | ||
| + | * Suitable for advanced users. | ||
| + | |||
| + | \\ | ||
| + | |||
| + | **Shared Key: | ||
| + | |||
| + | **Group Key Renewal: | ||
| - | **Group Key Renewal: | + | This is part of the WPA protocol. See the first wireless radio unit for more details. |
| - | (Default: 3600 seconds). | + | (Default: 3600 seconds). |
| Line 565: | Line 874: | ||
| ==== Baby Jumbo Frames ==== | ==== Baby Jumbo Frames ==== | ||
| - | Support for Baby Jumbo Frames | + | Support for Baby Jumbo Frames |
| - | To enable Baby Jumbo Frames: | + | Very few ISPs support Jumbo Frames for PPPoE. |
| - | + | ||
| - | * Go the Miscellaneous menu. Check //Enable jumbo frame support// in that menu. The router will reboot. | + | |
| - | * In the Network menu, Set the MTU option to manual, and enter an MTU value of 1500 for PPPoE operation. (Usually, packet size will be 1492) | + | |
| - | * Clamping can be manually disabled, if needed. (Type '' | + | |
| - | * Ping with packet size 1472 to verify that you have a working PPP MTU of 1500. | + | |
| \\ | \\ | ||
| + | * Go the [[advanced-misc|Miscellaneous]] menu. Check //Enable jumbo frame support// . \\ The router will reboot. | ||
| + | * In the [[basic-network|Network]] menu, Set MTU to manual. For PPPoE operation, | ||
| + | * Clamping can be manually disabled, if needed. At a FreshTomato\\ command prompt: type: "nvram set tcp_clamp_disable=1" | ||
| + | * Ping with packet size of 1472 to verify a working PPP MTU of 1500. | ||
| + | |||
| + | \\ | ||
| ==== Wireless Band Steering ==== | ==== Wireless Band Steering ==== | ||
| - | \\ | + | |
| - | This example shows the default parameters to steer clients from the 2.4 GHz band to the 5 GHz band: \\ | + | \\ This example shows the default parameters to steer clients from the 2.4 GHz band to the 5 GHz band: \\ |
| - | \\ | + | |
| <code -> | <code -> | ||
| Steer Policy: | Steer Policy: | ||
| Line 595: | Line 905: | ||
| N ONLY: NO | N ONLY: NO | ||
| </ | </ | ||
| - | \\ | + | |
| - | \\ | + | \\ |
| - | This example shows default parameters to steer clients from the 5 GHz band to the 2.4 GHz band: \\ | + | |
| - | \\ | + | This example shows default parameters to steer clients from the 5 GHz band to the 2.4 GHz band: \\ |
| <code -> | <code -> | ||
| Steer Policy: | Steer Policy: | ||
| Line 614: | Line 925: | ||
| </ | </ | ||
| - | \\ | + | \\ |
basic-network.1708481998.txt.gz · Last modified: by hogwild
Page Tools
