Site Tools


network

This is an old revision of the document!


Network

The Network page includes most settings needed to configure the network. It is divided into sections including MultiWAN, WAN Settings, Ethernet Ports Configuration, LAN and Wireless setttings.

MultiWAN

Number of WAN ports: This lets you select the number of WAN ports to be used on the device. On routers with only one physical WAN interface, options with WAN ports larger than one will be greyed out. This allows you to select only “1 WAN” on such devices.

Check Connections Every: This is a quick way to make Tomato automatically test the reliability of your MultiWAN connection. (Default: Disabled).

Choosing a setting here other than [Disabled] will specify how often you want the router to send ICMP ping packets to check that it is still connected to the Internet. Choosing any setting other than Disabled will make the Target 1 and Target 2 fields appear.
Target 1: Address of first host you want Tomato to ping regularly (Default: Google.com)

Target 2: Address of second host you want Tomato to ping regularly (Default: Microsoft.com)

Note that this function does not work when only one WAN connection is configured. You must have Multiple WAN connections configured for this to work.

WAN Settings

Settings in this section are used to configure the WAN interface.

Type: This sets the connection mode the WAN interface uses to connect to your ISP. Depending on which Type you select, other configuration settings specific to that type of connection will be shown or hidden. See below. (Default: DHCP). The Type setting will depend on your ISP's setup.

DHCP: A DHCP server at your ISP will dynamically assign a WAN IP lease to your Tomato router. DHCP uses no authentication.
DHCP is most often used for cable, but there are exceptions. Even though DHCP itself doesn't include authentication, some cable companies require your cablemodem's MAC address to be on their whitelist, or they may block Internet access via that modem.

PPPoE: The router's WAN port will respond to authentication requests from your ISP's PPPoE server. This will require you to store in Tomato the PPPoE username and password that were assigned by your ISP. If authentication is successful, the PPPoE server will allow you to log on to the ISP's network, and a DHCP server will assign you a WAN IP lease. PPPoE is most often used for DSL networks, again with exceptions. It is suggested you leave the Service Name field blank.
Note: If you use your Tomato router for PPPoE authentication, you should ideally configure your DSL or cable modem for bridge mode. Otherwise, if your modem and router both have routing functions enabled, you have a situation called “Double NAT”, which may create problems, and can also reduce speeds.

Static: This choice will configure your WAN port with a static IP. You must manually enter the static IP, subnet mask, gateway address and DNS server addresses into Tomato. These settings are given to you by your ISP. Static mode is typically used for business accounts, when it's important the IP address doesn't change.

PPTP: This will configure your WAN port to use Microsoft's PPTP (VPN) tunnelling protocol to connect. The encryption in PPTP provides a level of security, so your account credentials can't be stolen as easily. PPTP will require you to enter a username and password, and gateway server settings (given by your ISP).

L2TP: Choosing this will configure your WAN port to connect using Cisco's Layer Two Tunnelling Protocol. Tomato will require you enter the L2TP username, password, L2TP server, (static) IP address, subnet mask and gateway settings, as provided by your ISP. By default, only L2TP control messages are encrypted, not content. L2TP provides a tunnel for layer 2 protocols. Content is encrypted by layer 2 protocols, such as Ethernet or PPP.

3G modem: This setting will enable support for a 3G GSM (cellular) network dongle connected to a USB port. Always ensure USB and 3G/4G modem support are checked in the USB and NAS/USB Support or this mode might not work. The modem might not be detected.

4G/LTE: This option enables support for a fourth generation GSM (cellular) / LTE (Long Term Evolution) USB modem dongle. When choosing 4G/LTE, the PIN code and APN fields will appear, and will need to be completed with the correct settings (see above). Always ensure USB and 3G/4G modem support are checked in the USB and NAS/USB Support or this mode might not work. The modem might not be detected.

Disabled: Disables the physical WAN port on your router. This effectively makes your Tomato device function only as a switch (if it has switching functions) and/or a Wi-Fi access point (if it has those capabilities).

Wireless Client Mode: This locks or unlocks the the ability to enable Tomato's Wireless Client mode in the Wireless (2.4 GHz) and Wireless (5G GHz) menus. Wireless client mode allows the Tomato router to act as a client and connect to another router/AP, much like a normal wireless network adapter.
Disabled: If Wireless Client mode is set to Disabled, the Wireless Client option becomes greyed out in the Wireless (2.4 GHz) and Wireless (5 GHz) menus. This prevents you from enabling Wireless Client mode in either frequency band.
2.4 GHz: If this option is selected, Tomato will unlock enabling of Wireless Client mode setting in the Wireless (2.4 GHz) menu. This will unlock enabling (but not enable) of the 2.4 GHz band Wireless Client mode. It's a bit confusing.
5 GHz: If this is selected, Tomato will unlock enabling of Wireless Client mode in the Wireless (5 GHz) menu. This will unlock enabling (but not enable) enabling of the 5 GHz frequnecy band Wireless Client mode. This is a little confusing.

Modem device: Here you specify the 3G modem's Linux device path/filename. If you're not sure what to choose, check the USB support page to see if your modem dongle is listed there. The Default device filename is the first serial device on the first USB port: (/dev/ttyUSB0). The “TTY” part of the device's filename represents a serial device and the “USB0” part of the device's filename means that device is connected to the first USB port on the Tomato machine. The /ttyUSB devices use the newer Serial→USB device driver framework. If your interface lists, for example, “/dev/ttyACM0 instead, the “ACM” means the device is of type “Abstract Control Model”, which uses Linux's serial modem driver framework.

You could also log on to Tomato via Telnet and use the lsusb or dmesg commands to get device info. When you set 3G modem as the WAN type, other fields will appear, prompting you for more information.

PIN Code: This is the 3-digit PIN code for the SIM card associated with your cell account. Leave this field blank if your SIM card code has been deactivated.

Modem init string: Here, you enter the modem's default initialization string. This will come from your cell provider, or the modem manufacturer. (Default: *99#).

APN: The access point name (provided by your carrier). This specfies a gateway to route data between your cell carrier and the Internet. (Default: internet).

Username: Here you enter the username to access your cell carrier's APN (provided by your cell carrier) gateway.
Some carriers don't require this info.

Password: Here you enter the password to authenticate to your cell carrier's APN (provided by your cell carrier) gateway.
Some carriers do not require this info.

Network Type: This menu appears when WAN type is set to 4G/LTE. (Default setting: 4G/3G/2G). The default setting configures Tomato to start negotiating with a 4G connection, and, if that fails, fall back to negotiating a 3G connection,and failing that, a 2G connection.

DNS Server: When set to AUTO, Tomato uses the DNS server addresses included in your Internet Provider's DHCP lease.
When set to Manual, this enables Tomato's DNS server function (in dnsmaq). In Manual mode, the “DNS 1” and “DNS 2” fields appear in which to manually enter DNS server addresses.
DNS 1: Enter the first DNS server address here. (Applies only when DNS Server is set to Manual).
DNS 2: Enter the second DNS server address here. (Applies only when DNS Server is set to Manual).
Manually chosen DNS servers are useful if your ISP's DNS servers are slow or unreliable, or can be used for parental filtering.

MTU: Maximum Transmission Unit, the maximum size of Ethernet frames to be transferred between WAN and LAN.
This is only for the WAN interface and won't alter client devices on the LAN. However, MTU size differences among devices can cause issues.
(Default: 1500), is typical for Ethernet devices, and is suitable for most settings. The number in the Manual field is greyed out and can't be changed.
Manual: Selecting manual allows you to enter a custom number in the field beside it. Jumbo Frame sizes typically begin at a size of 2000 bytes.

Route Modem IP: Typically, when you have a separate modem and router, you configure/use the modem in bridge mode, or PPPoE passthrough mode. Often, in such cases, you can't easily access the modem's interface when it's behind the router, due to it being on a different subnet. The Route Modem IP function provides a way around this. Enabling this creates a static route between the router's WAN port and the modem. This means you can ping, or even access the Web interface on the modem without having to take the router out of the signal chain or insert a switch to get access.

Query Hilink Modem IP: TBD.

Call Custom Status Script: TBD.

Connect Mode: TBD.

Redial Mode: TBD.

LCP Echo Interval: TBD.

LCP Echo Link fail limit: TBD.

LAN

The LAN section includes information and settings to configure Tomato's LAN interface functions. This includes Tomato's:

- LAN IP address and (sub)netmask
- Spanning Tree Protocol function
- DHCP server status and setttings (through DNSMASQ), such as scope and lease time
- Stubby (DNS-over-TLS) setting and WINS settings

Bridge:

STP: Checking or unchecking this enables or disables Spanning Tree Protocol. This is used primarily to prevent forwarding loops in switches.
(Default: Off). Off is the recommended setting unless you're very experienced with networks.

IP Address: Here you enter the IP Address you want to assign to the specified LAN interface. (Default: 192.168.1.1)

Netmask: The (sub)netmask associated with Tomato's LAN IP address. (Default: 255.255.255.0 - a class C netmask).

DHCP: Checking this box enables the DHCP server functions in dnsmasq. Unchecking this disables Tomato's DHCP server functions. (Default: Off)

IP Range (first/last) : Here you enter the first address and last address of the DHCP Scope. This is the range of IP addresses Tomato's DHCP server will assign to LAN clients.

Lease Time (mins.): This is the DHCP lease time, in minutes. (Default: 1440 = one day).

Use Stubby (DNS-over-TLS): This enhances DNS privacy. Checking this box enables Stubby, a DNS Stub resolver. DNS over TLS sends DNS queries over a secure connection, encrypted with TLS, the same technology that encrypts secure Web traffic. This prevents third parties from seeing your DNS queries.

WINS (for DHCP): Windows Internet Name Service (WINS) is a legacy computer name registration and resolution service that maps computer NetBIOS names to IP addresses. Officially, WINS is outdated and largely obsolete. DNS is supposed to have replaced most WINS functionality. However, Microsoft has not officially deprecated WINS. It may still be necessary for some Windows LAN browsing functions, especially on older Windows versions.

Here, you can enter the IP address of a WINS (Windows Internet Naming Service) server. Entering 0.0.0.0 acts a placeholder in when an IP address must be specified but its address is not yet known. It is not supposed to be seen on the network after DHCP IP autoconfiguration completes. This causes Tomato to be the default WINS server on the LAN, but does not enable the WINS service, per se.

More details can be found here:

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc784707(v=ws.10)

Ethernet Ports State - Configuration

This section has settings for the Ethernet Ports State graphic on the Status/Overview page. That graphic intuitively shows the status, link speed, and other diagnostic information for each Ethernet port on the router.
Enable Ports State: Checking this enables the Ethernet Ports State graphic on the Status/Overview page. (Default: On).

Show Speed Info: Checking this displays the link speed of each Ethernet port, (such as 1GB/100MB/10MB). (Default: On).

Invert ports order: Checking this option displays the Ethernet port icons in the Ethernet Ports State graphic in the opposite order to the the default where they are located on the switch. This is useful in situations where the sequence of icons on the Ethernet Ports State do not match the actual port locations on the router's switch. Does this actually mean when facing the front of router, looking at its port LEDs? Or does it mean when facing the rear of the router, looking at the physical ports? The two are mirror opposites. (Default: Off).

Wireless Band Steering - Configuration

Options (checkbox):

  • Disable
  • Enable

If you enable Wireless Band Steering, the Tomato's wireless can decide for each dual-band client device on which band the device should try to connect. To achieve this, enter the same SSID name, security settings, password, and other settings (see picture below) for all wireless interfaces (up to 3 in case of a Tri-Band-Router).

Note: client devices can also try to switch band on their own, without band steering's influence. (Default: Disabled).

Here's an example for the default parameter to trigger the switching (2.4 GHz):

Steer Policy:
max=0 period=5 cnt=3 rssi=-52 phyrate_high=110 phyrate_low=0 flags=0x22 state=3
Rule Logic: OR
RSSI: Greater than
VHT: Allowed
NON VHT: Allowed
NEXT RF: NO
PHYRATE (HIGH): Greater than or Equal to
LOAD BALANCE: NO
STA NUM BALANCE: NO
PHYRATE (LOW): Less than
N ONLY: NO

⇒ The target will be the 5 GHz wireless lan

Here's an example for the default parameter to trigger the switching (5 GHz):

Steer Policy:
max=80 period=5 cnt=3 rssi=-82 phyrate_high=0 phyrate_low=0 flags=0x20 state=2
Rule Logic: OR
RSSI: Less than or Equal to
VHT: Allowed
NON VHT: Allowed
NEXT RF: NO
PHYRATE (HIGH): Greater than or Equal to
LOAD BALANCE: NO
STA NUM BALANCE: NO
PHYRATE (LOW): Less than
N ONLY: NO

⇒ The target will be the 2.4 GHz wireless lan

For more details, see https://www.smallnetbuilder.com/wireless/wireless-howto/32653-asus-rt-ac3200-smart-connect-the-missing-manual?start=0

Note: Wireless Band Steering Feature is available starting with FreshTomato 2020-8 and up.

Wireless (2.4 GHz / interface eth1)

The Wireless (2.4 GHz) section displays information and settings for the Wi-Fi network interface on the 2.4 GHz Wi-Fi frequency band.

Your device may show a different device name than eth1. Note: Tomato (Linux) hardware device numbers begin at 0.
For example, the first ethernet device might be called eth0. The second wireless device might be called wl1.

Enable Wireless: When checked, this turns on the 2.4 GHz Wi-Fi network interface.
When unchecked, the 2.4GHz Wi-Fi network interface is turned off.

MAC Address: This displays the MAC (hardware) address of the 2.4 GHz Wi-Fi network interface.
Clicking on the MAC address takes you to the Advanced/MAC Address page, where you can specify your own MAC address for this interface.

Wireless Mode: This allows you to select the wireless mode (function) of the 2.4Gz Wi-fi network interface.

Selection Description
Access Point The normal setting which allows clients to connect to this router wirelessly.
Access Point + WDS Sets the router in “repeater mode,” allowing clients to connect wirelessly while simultaneously acting as a Wireless Distribution System (WDS) base station.
Wireless Client The router connects to the other router/access point like any other wireless client device would connect to an access point. The router provides client connections ONLY through the Ethernet ports. Status as of 2020-12-31: This mode is working on MIPS devices (RT and RT-N images) but NOT working for SDK6 and up, code is missing - tbd.
Wireless Ethernet Bridge This allows it to connect to another gateway router while still keeping all computers connected to both routers in the same subnet. Note: As of version 1.19 - Wireless Bridge must be set to WPA2 (Example: WPA2 Personal + AES)
WDS Serve as a Wireless Distribution System (WDS) base station only.

Wireless Network Mode: This let you choose which 802.11 Wi-Fi LAN protocol(s) you wish to make available to clients. Choices include:

B Only: allows Wi-Fi clients to connect using only the 802.11b protocol.
G Only: allows Wi-Fi clients to connect using only the 802.11G protocol.
B/G Mixed: allows Wi-Fi clients to connect using only the 802.11G protocol OR the 802.11b protocol
N Only: allows Wi-Fi clients to connect using only the 802.11N protocol.

These ONLY apply to the 2.4 GHz Wi-Fi network interface. If there's a 5 GHz network interface, it will have its own, separate Wireless Network Mode settings.

(Default: Auto). Generally, it is recommended to leave this setting on Auto, unless you are very knowlegdeable about networking/Wi-Fi.
Compatibility issues can create all kinds of problems, and often, the “logical” setting is not the best one.

SSID: This is the 2.4 GHz Wi-Fi interface network name, (the Service Set IDentifier). For security purposes, it's generally recommended that you don't include any personal words or expressions/phrases which might indicate your identity, address, location, or equipment type in your SSID. For example, “KHANFAMILY” would not be a good choice unless you want everyone on the street to know who owns that network.

For security purposes, it's also best not to include standard dictionary words in the SSID. Computers can crack SSIDs more easily with something called “dictionary attacks”.

Broadcast: Checking this enables SSID broadcasting. Broadcasting (a sort of electronic advertising) of the wireless network's SSID makes it easier for devices to see the network among available networks in the area. Some people believe that disabling SSID Broadcasting greatly increases security. However, there are plenty of network “sniffing” tools to find networks when their SSIDs are not broadcast. Therefore, disabling Broadcast is not much of a security improvement.

Channel: Selects the channel on which the 2.4 GHz Wi-Fi network interface will operate. This is a bit controversial. However, generally, it's a good idea to choose a different channel than the one your neigbhours/people nearby are using for their networks. Clicking on the MAC address itself will take you to the Advanced/MAC Address page, where you can change the MAC address from the factory one to almost anything you want.

Wirelesss (5 GHz / interface eth2)

The Wireless (5 GHz) section displays information and settings for the wireless network interface on the 5 GHz Wi-Fi frequency band.

Your device may show a different device name than eth1. Note: Tomato (Linux) hardware device numbers begin at 0.
For example, the first ethernet device might be called eth0. The second wireless device might be called wl1.

Enable Wireless: When checked, this turns on the 5 GHz Wi-Fi network interface.
When unchecked, the 5 GHzWi-Fi network interface is turned off.

MAC Address: This displays the MAC (hardware) address of the 5 GHz Wi-Fi radio interface.
Clicking on the MAC address takes you to the Advanced/MAC Address page, where you can specify your own MAC address for this interface.

Wireless Mode: This allows you to select the wireless mode (function) of the 5 GHz Wi-fi network interface.

Selection Description
Access Point The normal (default) setting, which allows clients to connect to Tomato's wireless network(s).
Access Point + WDS Sets the router in “repeater mode,” allowing clients to connect wirelessly while simultaneously acting as a Wireless Distribution System (WDS) base station.
Wireless Client The router connects to the other router/access point like any other wireless client device would connect to an access point. The router provides client connections ONLY through the Ethernet ports. Status as of 2020-12-31: This mode is working on MIPS devices (RT and RT-N images) but NOT working for SDK6 and up, code is missing - tbd.
Wireless Ethernet Bridge Configures the Tomato Router to connect to another router while still keeping all computers connected to both routers in the same subnet. Note: As of version 1.19 - Wireless Bridge must be set to WPA2 (Example: WPA2 Personal + AES)
WDS Serve as a Wireless Distribution System (WDS) base station only.

Wireless Network Mode: This lets you choose which 802.11 Wi-Fi LAN protocol(s) you wish to make available to clients. Choices include:

Auto: On this setting, Tomato and Wi-Fi client devices negotiate the best wireless protocol automatically. Generally, Auto is recommended, unless you are very knowlegdeable about networking/Wi-Fi. Compatibility issues can create all kinds of problems, and often, the most “logical” setting is not the best one.
A Only: allows Wi-Fi clients to connect using only the 802.11a protocol.
N Only: allows Wi-Fi clients to connect using only the 802.11N protocol.

These ONLY apply to the 5 GHz band radio interface. Separate Wireless Network Mode settings exist for a 2.4 GHz band interface (if any). See above section.

(Default: Auto)

SSID: This the 5 GHz Wi-Fi interface's network name, (Service Set IDentifier). For security purposes, it's recommended you don't include any personal words or expressions/phrases which might indicate your identity, address, location, or equipment type in your SSID. For example, “HELENLIUNG” would not be a good choice, unless you want everyone on the street to know who owns that network. Common words found in the dictionary also make for poor security.
(Default: TomatoXX, where “XX” is the two numbers in the frequency band.) On a 5 GHz network, for example, the default SSID is “Tomato50”.

Broadcast: Checking this enables SSID broadcasting. This “announces” the SSID (network name) on the air, so it's easy to find and connect to. Some people argue that disabling SSID Broadcast provides more security. However, SSIDs names can be easily sniffed using common software. Therefore, disabling SSID Broadcast provides little increase in security.

Channel: Selects the channel on which the 2.4 GHz radio interface will operate. This is a bit of a controversial topic. However, generally, it's a good idea to choose a different channel than the one your neigbhours/people nearby are using for their networks. (Default: Auto).

Auto: This setting is the default, and is generally safe unless you have significant interference from nearby networks or other equipment. On this setting, Tomato chooses and uses the channel it believes has the least interference.

Channel: This menu lets you manually choose available Wi-Fi channels on the band. Unavailable channels will not appear in this menu. This is normal.

/home/fresoehv/wiki/data/pages/network.txt · Last modified: 2021/01/16 14:48 by hogwild